@groundfloorcloud/cli 0.1.8 → 0.1.9

package/README.md

@@ -63,8 +63,10 @@ Do not create an App just to run a function, job, schedule, or service
 (Deployment). Use `gf deploy`. Bind `--app-id` only when the coderunner should
 be a helper of an existing product App.
 
-**Before the first create:** enable workspace Authentication (Administer →
-Authentication, mode `groundfloor` or `external`) until the realm is active.
+**App authentication is optional.** Team **write** can create Coderunners
+when mode is None. For Vault and Files from the workload, attach an M2M
+client (Administer → M2M tokens) and use `gf m2m token` — not a Dataplane
+key. `gf coderunner vault-token` is deprecated.
 
 ### Workload types
 
@@ -104,11 +106,16 @@ port 8080). Add `"scripts": { "start": "node index.js" }` and bind
 eval "$(gf env)"
 export PORT=8080
 npm start
+# files/secrets / operator Vault (builder token):
 curl -sS -H "Authorization: Bearer $(gf token)" \
+  "$CONTROLPLANE_URL/v1/workspaces/$GROUNDFLOOR_WORKSPACE_ID/files"
+# M2M (Coderunner / CI — not gf token):
+curl -sS -H "Authorization: Bearer $(gf m2m token)" \
   "$CONTROLPLANE_URL/v1/workspaces/$GROUNDFLOOR_WORKSPACE_ID/vault/collections"
 ```
 
-Then `gf deploy` the same tree. Do not zip `.env` files.
+Then `gf deploy` the same tree. Do not zip `.env` files. `gf token` is the
+wrong identity for testing Coderunner Vault/Files as the workload.
 
 ### `groundfloor.json`
 
@@ -132,7 +139,7 @@ Then `gf deploy` the same tree. Do not zip `.env` files.
 | `-p, --path <dir>` | Directory to package (default: cwd). |
 | `--git <url>` / `--ref <ref>` | Clone and deploy a remote repo. |
 | `--subdir <dir>` | Package a subdirectory of the source. |
-| `--runtime <r>` | `python` \| `node` \| `dotnet-script`. |
+| `--runtime <r>` | Language slug from `GET …/coderunners/languages` (`node`, `python`, `go`, `dotnet`, `dotnet-script`, …). |
 | `--workload-type <t>` | `function` \| `service` (Deployment) \| `job` \| `schedule`. Service requires a Dockerfile. |
 | `--schedule <cron>` | Cron for `schedule` workloads (or `groundfloor.json` `schedule`). |
 | `--cpu` / `--memory` | Resource requests, e.g. `250m` / `256Mi`. |
@@ -163,10 +170,11 @@ gf apps publish --path release.zip
 `APP_ID` / `groundfloor.manifest.json` `appId` to the slug.
 
 `gf apps publish` uploads **only** `release.zip` from `npm run release`.
-It flattens a Vite `dist/assets/` layout when needed, then **rejects** a zip
-that is only `remoteEntry.js` (missing `__federation_*.js` / CSS) or whose
-federation `name` does not match `federationRemoteName(slug)`. A lone
-`.js` file is also rejected. Pass an app id/slug, or set `appId` in
+It flattens a Vite `dist/assets/` layout when needed, rewrites `./assets/`
+imports in `remoteEntry.js`, then **rejects** a zip that is only
+`remoteEntry.js` (missing `__federation_*.js` / CSS) or whose federation
+`name` does not match `federationRemoteName(slug)`. A lone `.js` file is
+also rejected. Pass an app id/slug, or set `appId` in
 `groundfloor.manifest.json` next to the zip.
 
 Wrap an existing **service** coderunner as a product:
@@ -215,6 +223,8 @@ gf apps get <id|slug>
 | `gf coderunner logs -c <id\|slug>` | Process Log (stdout/stderr). Also printed automatically on `gf deploy` failure. |
 | `gf coderunner cancel-deployment -c <id\|slug>` | Delete the current (or `--deployment-id`) deployment. |
 | `gf coderunner run -c <id\|slug> [--payload '{}']` | Invoke a deployed function or job. |
+| `gf m2m token` | Print a short Control Plane JWT from M2M client_id + secret. Not `gf token`. |
+| `gf coderunner vault-token` | **Deprecated.** Use `gf m2m token`. |
 | `gf deploy` | Package code and deploy as a coderunner. |
 | `gf domains ls\|add\|rm\|verify -c <id\|slug>` | Custom domains for a service. |
 | `gf secrets ls\|get\|set\|rm` | Workspace secrets. |

package/dist/index.js

@@ -526,11 +526,31 @@ var CpError = class extends Error {
   }
   status;
 };
+function formatCpErrorDetail(detail, fallback) {
+  if (typeof detail === "string" && detail.trim()) return detail.trim();
+  if (detail && typeof detail === "object") {
+    const obj = detail;
+    if (typeof obj.message === "string" && obj.message.trim()) {
+      return obj.message.trim();
+    }
+    if (typeof obj.detail === "string" && obj.detail.trim()) {
+      return obj.detail.trim();
+    }
+    try {
+      return JSON.stringify(detail);
+    } catch {
+      return fallback;
+    }
+  }
+  return fallback;
+}
 async function parseError(res) {
   let detail = res.statusText;
   try {
     const body = await res.json();
-    if (body?.detail) detail = String(body.detail);
+    if (body?.detail !== void 0) {
+      detail = formatCpErrorDetail(body.detail, res.statusText);
+    }
   } catch {
   }
   return `${res.status} ${detail}`;
@@ -640,6 +660,13 @@ async function listCoderunners(apiUrl, workspaceId) {
   if (Array.isArray(data)) return data;
   return data.coderunners ?? [];
 }
+async function listCoderunnerLanguages(apiUrl, workspaceId) {
+  const data = await cpGet(
+    apiUrl,
+    `/v1/workspaces/${encodeURIComponent(workspaceId)}/coderunners/languages`
+  );
+  return data.languages ?? [];
+}
 function createCoderunner(apiUrl, workspaceId, payload) {
   return cpPostJson(
     apiUrl,
@@ -915,6 +942,33 @@ function provisionDataplane(apiUrl, workspaceId) {
     {}
   );
 }
+async function mintM2mToken(apiUrl, workspaceId, clientId, clientSecret) {
+  const res = await fetch(
+    `${apiUrl}${wsPath(workspaceId, "/m2m/token")}`,
+    {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        client_id: clientId,
+        client_secret: clientSecret
+      })
+    }
+  );
+  if (!res.ok) {
+    throw new CpError(res.status, await parseError(res));
+  }
+  return await res.json();
+}
+function mintCoderunnerVaultToken(apiUrl, workspaceId, coderunnerId) {
+  return cpPostJson(
+    apiUrl,
+    `${wsPath(workspaceId, `/coderunners/${encodeURIComponent(coderunnerId)}/vault-token`)}`,
+    {}
+  );
+}
 
 // src/commands/whoami.ts
 async function whoamiCommand() {
@@ -1043,6 +1097,74 @@ async function resolveCoderunnerId(apiUrl, workspaceId, idOrSlug) {
   return match.id;
 }
 
+// src/commands/vault-token.ts
+async function vaultTokenCommand(opts) {
+  const cfg = await resolveConfig({ workspaceId: opts.workspace });
+  if (!cfg.workspaceId) {
+    throw new Error(
+      "No workspace selected. Run `gf workspaces use <id>` or pass --workspace <id>."
+    );
+  }
+  const coderunnerId = await resolveCoderunnerId(
+    cfg.apiUrl,
+    cfg.workspaceId,
+    opts.coderunner
+  );
+  const data = await mintCoderunnerVaultToken(
+    cfg.apiUrl,
+    cfg.workspaceId,
+    coderunnerId
+  );
+  process.stderr.write(
+    "gf coderunner vault-token is deprecated. Attach an M2M client and use gf m2m token.\n"
+  );
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(data, null, 2)}
+`);
+    return;
+  }
+  process.stderr.write(
+    `expires_in=${data.expires_in}s identity=${data.workload_identity_id}
+`
+  );
+  process.stdout.write(`${data.token}
+`);
+}
+
+// src/commands/m2m-token.ts
+async function m2mTokenCommand(opts) {
+  const cfg = await resolveConfig({ workspaceId: opts.workspace });
+  if (!cfg.workspaceId) {
+    throw new Error(
+      "No workspace selected. Run `gf workspaces use <id>` or pass --workspace <id>."
+    );
+  }
+  const clientId = opts.clientId ?? process.env.GROUNDFLOOR_M2M_CLIENT_ID ?? "";
+  const clientSecret = opts.clientSecret ?? process.env.GROUNDFLOOR_M2M_CLIENT_SECRET ?? "";
+  if (!clientId || !clientSecret) {
+    throw new Error(
+      "Set GROUNDFLOOR_M2M_CLIENT_ID and GROUNDFLOOR_M2M_CLIENT_SECRET, or pass --client-id and --client-secret."
+    );
+  }
+  const data = await mintM2mToken(
+    cfg.apiUrl,
+    cfg.workspaceId,
+    clientId,
+    clientSecret
+  );
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(data, null, 2)}
+`);
+    return;
+  }
+  process.stderr.write(
+    `expires_in=${data.expires_in}s client=${data.m2m_client_id}
+`
+  );
+  process.stdout.write(`${data.access_token}
+`);
+}
+
 // src/commands/cancel-deployment.ts
 async function cancelDeploymentCommand(opts) {
   const cfg = await resolveConfig({ workspaceId: opts.workspace });
@@ -1509,7 +1631,13 @@ function formatDeployTarget(input) {
 }
 
 // src/commands/deploy.ts
-var RUNTIMES = /* @__PURE__ */ new Set(["python", "node", "dotnet-script"]);
+var FALLBACK_RUNTIMES = /* @__PURE__ */ new Set([
+  "python",
+  "node",
+  "go",
+  "dotnet",
+  "dotnet-script"
+]);
 var WORKLOAD_TYPES = /* @__PURE__ */ new Set(["function", "service", "job", "schedule"]);
 var VERSION_POLL_INTERVAL_MS = 2e3;
 var VERSION_POLL_TIMEOUT_MS = 5 * 60 * 1e3;
@@ -1580,9 +1708,17 @@ async function deployCommand(opts) {
     log(`Packaged ${pkg.fileCount} file(s), ${sizeKb} KB`);
     const detected = await detectRuntime(pkg.sourceDir);
     const runtime = opts.runtime ?? manifest.runtime ?? detected ?? "python";
-    if (!RUNTIMES.has(runtime)) {
+    let allowedRuntimes = FALLBACK_RUNTIMES;
+    try {
+      const catalog = await listCoderunnerLanguages(cfg.apiUrl, ws);
+      if (catalog.length > 0) {
+        allowedRuntimes = new Set(catalog.map((item) => item.runtime));
+      }
+    } catch {
+    }
+    if (!allowedRuntimes.has(runtime)) {
       throw new Error(
-        `Invalid runtime "${runtime}" (expected: ${[...RUNTIMES].join(", ")}).`
+        `Invalid runtime "${runtime}" (expected: ${[...allowedRuntimes].join(", ")}).`
       );
     }
     const workloadType = opts.workloadType ?? manifest.workloadType ?? manifest.workload_type ?? "function";
@@ -2102,6 +2238,10 @@ import path6 from "path";
 import AdmZip2 from "adm-zip";
 var REMOTE_ENTRY = "remoteEntry.js";
 var FLATTEN_SUFFIXES = [".js", ".mjs", ".cjs", ".css", ".map", ".wasm"];
+var IMPORT_ASSETS = /(__federation_import|import)\((['"])\.\/assets\//g;
+function rewriteRemoteEntryAssetPrefix(source) {
+  return source.replace(IMPORT_ASSETS, "$1($2./");
+}
 function normalizeZipEntryName(filename) {
   return filename.replace(/\\/g, "/").replace(/^\/+/, "");
 }
@@ -2172,15 +2312,31 @@ function flattenFederatedReleaseZip(bytes) {
   }
   const plan = flattenFederatedBundlePlan(rels);
   const keys = Object.keys(plan);
-  if (keys.length === 0) return bytes;
-  for (const dest of keys) {
-    const src = plan[dest];
-    const source = byNorm.get(src);
-    if (!source) continue;
-    zip.addFile(dest, source.getData());
+  if (keys.length > 0) {
+    for (const dest of keys) {
+      const src = plan[dest];
+      const source = byNorm.get(src);
+      if (!source) continue;
+      zip.addFile(dest, source.getData());
+    }
   }
+  rewriteRemoteEntryInZip(zip);
   return zip.toBuffer();
 }
+function rewriteRemoteEntryInZip(zip) {
+  const names = zip.getEntries().filter((entry) => !entry.isDirectory).map((entry) => normalizeZipEntryName(entry.entryName));
+  const entryRel = chooseRemoteEntry(names);
+  if (!entryRel) return;
+  const zipEntry = zip.getEntries().find((item) => {
+    if (item.isDirectory) return false;
+    return normalizeZipEntryName(item.entryName) === entryRel;
+  });
+  if (!zipEntry) return;
+  const before = zipEntry.getData().toString("utf8");
+  const after = rewriteRemoteEntryAssetPrefix(before);
+  if (after === before) return;
+  zip.updateFile(zipEntry.entryName, Buffer.from(after, "utf8"));
+}
 function federatedReleaseZipHint(slug) {
   return `Run \`npm run release\` in a kit from \`gf apps init\`, then publish that zip (do not zip Vite dist/ or upload only remoteEntry.js). ${initThenPublishHint(slug)}`;
 }
@@ -2195,7 +2351,7 @@ function initThenPublishHint(slug) {
 function extractReferencedSiblings(remoteEntrySource) {
   const names = /* @__PURE__ */ new Set();
   for (const match of remoteEntrySource.matchAll(
-    /["']\.\/([^"'/]+\.(?:js|mjs|cjs|css))["']/g
+    /["']\.\/(?:assets\/)?([^"'/]+\.(?:js|mjs|cjs|css))["']/g
   )) {
     if (match[1] !== REMOTE_ENTRY) names.add(match[1]);
   }
@@ -2867,6 +3023,22 @@ program.command("login").description(
 program.command("logout").description("Clear the cached session").action(() => run(() => logoutCommand()));
 program.command("whoami").description("Show the current identity and verify the Control Plane session").action(() => run(() => whoamiCommand()));
 program.command("token").description("Print a valid (auto-refreshed) access token to stdout").action(() => run(() => tokenCommand()));
+var m2m = program.command("m2m").description("Machine tokens (client_id + secret \u2192 short Control Plane JWT)");
+m2m.command("token").description(
+  "Exchange GROUNDFLOOR_M2M_CLIENT_ID + SECRET for a short CP JWT (not gf token)"
+).option("-w, --workspace <id>", "Workspace id override").option("--client-id <id>", "M2M client_id (else GROUNDFLOOR_M2M_CLIENT_ID)").option(
+  "--client-secret <secret>",
+  "M2M secret (else GROUNDFLOOR_M2M_CLIENT_SECRET)"
+).option("--json", "Output the full token response as JSON").action(
+  (opts) => run(
+    () => m2mTokenCommand({
+      workspace: opts.workspace,
+      clientId: opts.clientId,
+      clientSecret: opts.clientSecret,
+      json: opts.json
+    })
+  )
+);
 program.command("env").description('Print shell exports for `eval "$(gf env)"`').action(() => run(() => envCommand()));
 var environments = program.command("environments").alias("envs").description("List workspace environments");
 environments.command("list", { isDefault: true }).alias("ls").description("List environments in the default (or --workspace) workspace").option("-w, --workspace <id>", "Workspace id override").option("--json", "Output raw JSON").action((opts) => run(() => environmentsListCommand(opts)));
@@ -2909,6 +3081,17 @@ coderunner.command("run").description("Invoke a deployed function/job (smoke run
     })
   )
 );
+coderunner.command("vault-token").description(
+  "Deprecated: use gf m2m token. D-067 Data Vault JWT for a bound Coderunner"
+).requiredOption("-c, --coderunner <id|slug>", "Coderunner id or slug").option("-w, --workspace <id>", "Workspace id override").option("--json", "Output the full token response as JSON").action(
+  (opts) => run(
+    () => vaultTokenCommand({
+      workspace: opts.workspace,
+      coderunner: opts.coderunner,
+      json: opts.json
+    })
+  )
+);
 var domains = program.command("domains").description("Manage custom domains (CNAME) for a coderunner service");
 domains.command("add <domain>").description("Add a custom domain and print the DNS records to create").requiredOption("-c, --coderunner <id|slug>", "Target coderunner id or slug").option("-w, --workspace <id>", "Workspace id override").option("--json", "Output raw JSON").action((domain, opts) => run(() => domainsAddCommand(domain, opts)));
 domains.command("ls").alias("list").description("List custom domains for a coderunner service").requiredOption("-c, --coderunner <id|slug>", "Target coderunner id or slug").option("-w, --workspace <id>", "Workspace id override").option("--json", "Output raw JSON").action((opts) => run(() => domainsListCommand(opts)));
@@ -2990,7 +3173,7 @@ program.command("deploy").description(
 ).option("-w, --workspace <id>", "Workspace id override").option("--api-url <url>", "Control Plane base URL").option(
   "-c, --coderunner <id>",
   "Deploy into an existing coderunner id (skip find/create)"
-).option("-n, --name <name>", "Coderunner name (default: folder or repo name)").option("-p, --path <dir>", "Local directory to package (default: cwd)").option("--git <url>", "Clone and deploy a remote git/bitbucket repo").option("--ref <ref>", "Branch/tag/commit for --git").option("--subdir <dir>", "Subdirectory within the source to package").option("--runtime <runtime>", "python | node | dotnet-script").option(
+).option("-n, --name <name>", "Coderunner name (default: folder or repo name)").option("-p, --path <dir>", "Local directory to package (default: cwd)").option("--git <url>", "Clone and deploy a remote git/bitbucket repo").option("--ref <ref>", "Branch/tag/commit for --git").option("--subdir <dir>", "Subdirectory within the source to package").option("--runtime <runtime>", "Language slug from Code Runner (node, python, go, \u2026)").option(
   "--workload-type <type>",
   "function | service | job | schedule"
 ).option(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groundfloorcloud/cli",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "Groundfloor gf CLI — sign in, deploy coderunners, publish Shell apps, and manage secrets, files, and Dataplane.",
   "type": "module",
   "bin": {