@gurulu/cli 0.1.0

package/dist/commands/audit.js

@@ -0,0 +1,130 @@
+"use strict";
+/**
+ * Phase 20 W3 C4 — `gurulu audit tail` / `gurulu audit export`.
+ *
+ * Thin wrappers around the new /api/cli/audit/{tail,export} endpoints.
+ * Requires a secret key with the `audit:read` scope.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.auditCommand = auditCommand;
+exports.parseSinceFlag = parseSinceFlag;
+const api_client_1 = require("../api-client");
+const ui_1 = require("../utils/ui");
+async function auditCommand(args) {
+    const action = args.action || 'tail';
+    switch (action) {
+        case 'tail':
+            return tailCmd(args);
+        case 'export':
+            return exportCmd(args);
+        default:
+            (0, ui_1.error)(`Unknown audit action: ${action}`);
+            (0, ui_1.info)('Usage: gurulu audit [tail|export]');
+            process.exit(1);
+    }
+}
+/**
+ * Convert short-form windows like "30d" / "24h" to ISO. Exported for
+ * tests.
+ */
+function parseSinceFlag(raw) {
+    if (!raw)
+        return undefined;
+    const trimmed = raw.trim();
+    const m = trimmed.match(/^(\d+)([mhd])$/);
+    if (!m)
+        return trimmed; // pass through as ISO
+    return trimmed; // backend accepts short form too
+}
+async function tailCmd(args) {
+    const qs = new URLSearchParams();
+    if (args.since)
+        qs.set('since', parseSinceFlag(args.since) ?? '');
+    const path = `/api/cli/audit/tail${qs.toString() ? `?${qs.toString()}` : ''}`;
+    const res = await (0, api_client_1.cliApi)(path, {
+        profile: args.profile,
+        headers: { accept: 'text/event-stream' },
+    });
+    if (!res.body) {
+        (0, ui_1.error)('Audit tail returned no body.');
+        process.exit(1);
+    }
+    (0, ui_1.info)('Streaming audit events — press Ctrl+C to stop');
+    const reader = res.body.getReader?.();
+    if (!reader) {
+        for await (const chunk of res.body) {
+            process.stdout.write(formatFrame(Buffer.from(chunk).toString('utf8'), !!args.json));
+        }
+        return;
+    }
+    const decoder = new TextDecoder();
+    // eslint-disable-next-line no-constant-condition
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+            return;
+        const text = decoder.decode(value, { stream: true });
+        process.stdout.write(formatFrame(text, !!args.json));
+    }
+}
+function formatFrame(raw, json) {
+    if (json)
+        return raw;
+    const out = [];
+    for (const block of raw.split('\n\n')) {
+        const lines = block.split('\n');
+        let ev = 'message';
+        let data = '';
+        for (const line of lines) {
+            if (line.startsWith('event: '))
+                ev = line.slice(7).trim();
+            else if (line.startsWith('data: '))
+                data += line.slice(6);
+        }
+        if (data && ev === 'audit_event') {
+            try {
+                const p = JSON.parse(data);
+                out.push(`[${p.createdAt || '-'}] ${p.action || '-'} status=${p.status || '-'} key=${p.secretKeyId || '-'}\n`);
+            }
+            catch {
+                out.push(`[event] ${data}\n`);
+            }
+        }
+    }
+    return out.join('');
+}
+async function exportCmd(args) {
+    const qs = new URLSearchParams();
+    if (args.since)
+        qs.set('since', parseSinceFlag(args.since) ?? '');
+    if (args.limit)
+        qs.set('limit', String(args.limit));
+    const path = `/api/cli/audit/export${qs.toString() ? `?${qs.toString()}` : ''}`;
+    const res = await (0, api_client_1.cliApi)(path, {
+        profile: args.profile,
+        headers: { accept: 'application/x-ndjson' },
+    });
+    if (!res.body) {
+        (0, ui_1.error)('Audit export returned no body.');
+        process.exit(1);
+    }
+    const format = args.format || 'jsonl';
+    if (format !== 'jsonl') {
+        (0, ui_1.error)(`Unsupported export format: ${format} (only jsonl is implemented)`);
+        process.exit(1);
+    }
+    const reader = res.body.getReader?.();
+    if (!reader) {
+        for await (const chunk of res.body) {
+            process.stdout.write(Buffer.from(chunk));
+        }
+        return;
+    }
+    // eslint-disable-next-line no-constant-condition
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+            return;
+        process.stdout.write(Buffer.from(value));
+    }
+}

package/dist/commands/auth.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Phase 18.6 — `gurulu auth` device-link command.
+ *
+ * Implements the client side of the OAuth 2.0 device authorization grant
+ * against `/api/cli/device-link/{start,poll}`. The user-facing flow:
+ *   1. POST /start with deviceType=cli + hostname as deviceLabel
+ *   2. Print the pairing code + verify URL, try to auto-open the browser
+ *   3. Poll /poll every pollIntervalMs until approved / denied / expired
+ *   4. On approval, persist the returned secret key into the local profile
+ *
+ * Backward compat: if the user passes `--key gsk_...` (or `--email` +
+ * `--secret-key`), we delegate to the existing `loginCommand` verbatim so
+ * the legacy manual flow is unchanged.
+ */
+import { type LoginArgs } from './login';
+export interface AuthArgs extends LoginArgs {
+    key?: string;
+    noBrowser?: boolean;
+}
+export declare function authCommand(args: AuthArgs): Promise<void>;

package/dist/commands/auth.js

@@ -0,0 +1,214 @@
+"use strict";
+/**
+ * Phase 18.6 — `gurulu auth` device-link command.
+ *
+ * Implements the client side of the OAuth 2.0 device authorization grant
+ * against `/api/cli/device-link/{start,poll}`. The user-facing flow:
+ *   1. POST /start with deviceType=cli + hostname as deviceLabel
+ *   2. Print the pairing code + verify URL, try to auto-open the browser
+ *   3. Poll /poll every pollIntervalMs until approved / denied / expired
+ *   4. On approval, persist the returned secret key into the local profile
+ *
+ * Backward compat: if the user passes `--key gsk_...` (or `--email` +
+ * `--secret-key`), we delegate to the existing `loginCommand` verbatim so
+ * the legacy manual flow is unchanged.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authCommand = authCommand;
+const os = __importStar(require("os"));
+const child_process_1 = require("child_process");
+const login_1 = require("./login");
+const config_1 = require("../config");
+const api_client_1 = require("../api-client");
+const ui_1 = require("../utils/ui");
+function tryOpenBrowser(url) {
+    const platform = process.platform;
+    const cmd = platform === 'darwin' ? 'open' : platform === 'win32' ? 'start' : 'xdg-open';
+    try {
+        const child = (0, child_process_1.spawn)(cmd, [url], {
+            detached: true,
+            stdio: 'ignore',
+            shell: platform === 'win32',
+        });
+        child.on('error', () => {
+            /* ignore — fall back to manual */
+        });
+        child.unref();
+    }
+    catch {
+        /* ignore — we printed the URL already */
+    }
+}
+function sleep(ms) {
+    return new Promise((r) => setTimeout(r, ms));
+}
+const SPINNER_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
+async function authCommand(args) {
+    // Back-compat: legacy manual flow.
+    const legacyKey = args.key || args.secretKey || args.apiKey || process.env.GURULU_SECRET_KEY;
+    if (legacyKey) {
+        await (0, login_1.loginCommand)({
+            ...args,
+            secretKey: legacyKey,
+        });
+        return;
+    }
+    const profileName = args.profile || 'personal';
+    const apiBase = args.apiBase || (0, config_1.defaultApiBase)();
+    const deviceLabel = os.hostname() || 'Untitled';
+    (0, ui_1.info)('[•] Requesting pairing code...');
+    let startBody;
+    try {
+        const res = await (0, api_client_1.cliApi)('/api/cli/device-link/start', {
+            method: 'POST',
+            skipAuth: true,
+            body: JSON.stringify({ deviceType: 'cli', deviceLabel }),
+            preloadedProfile: {
+                name: profileName,
+                email: 'device-link@gurulu.local',
+                secret_key: '',
+                api_base: apiBase,
+                source: 'env',
+            },
+        });
+        if (!res.ok) {
+            const txt = await res.text();
+            (0, ui_1.error)(`Could not start device-link (${res.status}): ${txt}`);
+            process.exit(1);
+        }
+        startBody = (await res.json());
+    }
+    catch (err) {
+        (0, ui_1.error)(`Could not start device-link: ${err.message}`);
+        process.exit(1);
+    }
+    const { code, verifyUrl, expiresAt, pollIntervalMs } = startBody;
+    console.log('');
+    console.log(`  ${(0, ui_1.dim)('Pairing code:')}  ${code}`);
+    console.log(`  ${(0, ui_1.dim)('Visit:')}         ${verifyUrl}`);
+    console.log(`  ${(0, ui_1.dim)('Device:')}        CLI — ${deviceLabel}`);
+    console.log('');
+    if (!args.noBrowser) {
+        tryOpenBrowser(verifyUrl);
+    }
+    const expiresAtMs = new Date(expiresAt).getTime();
+    const interval = Math.max(1000, pollIntervalMs || 2000);
+    const stdout = process.stdout;
+    const isTTY = !!stdout.isTTY;
+    let frame = 0;
+    let approved = null;
+    while (Date.now() < expiresAtMs) {
+        if (isTTY) {
+            stdout.write(`\r${SPINNER_FRAMES[frame++ % SPINNER_FRAMES.length]} Waiting for approval...`);
+        }
+        try {
+            const res = await (0, api_client_1.cliApi)('/api/cli/device-link/poll', {
+                method: 'POST',
+                skipAuth: true,
+                body: JSON.stringify({ code }),
+                preloadedProfile: {
+                    name: profileName,
+                    email: 'device-link@gurulu.local',
+                    secret_key: '',
+                    api_base: apiBase,
+                    source: 'env',
+                },
+            });
+            const json = (await res.json().catch(() => ({})));
+            if (res.status === 410) {
+                if (isTTY)
+                    stdout.write('\r');
+                (0, ui_1.error)('Pairing code expired. Run `gurulu auth` to try again.');
+                process.exit(1);
+            }
+            if (res.status === 404 || ('error' in json && json.error === 'invalid_code')) {
+                if (isTTY)
+                    stdout.write('\r');
+                (0, ui_1.error)('Invalid pairing code.');
+                process.exit(1);
+            }
+            if ('status' in json) {
+                if (json.status === 'approved') {
+                    approved = json;
+                    break;
+                }
+                if (json.status === 'denied') {
+                    if (isTTY)
+                        stdout.write('\r');
+                    (0, ui_1.error)('Pairing request denied. Exiting.');
+                    process.exit(1);
+                }
+                if (json.status === 'expired') {
+                    if (isTTY)
+                        stdout.write('\r');
+                    (0, ui_1.error)('Pairing code expired. Run `gurulu auth` to try again.');
+                    process.exit(1);
+                }
+                // pending → continue
+            }
+        }
+        catch (err) {
+            // Transient network hiccup — continue polling until expiry.
+            if (isTTY)
+                stdout.write('\r');
+            (0, ui_1.info)(`(poll error, retrying: ${err.message})`);
+        }
+        await sleep(interval);
+    }
+    if (isTTY)
+        stdout.write('\r');
+    if (!approved) {
+        (0, ui_1.error)('Timed out waiting for approval. Run `gurulu auth` to try again.');
+        process.exit(1);
+    }
+    const fullKey = approved.secretKey.fullKey;
+    const { storedInKeychain } = await (0, config_1.saveProfile)(profileName, {
+        email: `cli-${deviceLabel}@gurulu.local`,
+        secret_key: fullKey,
+        api_base: apiBase,
+    }, { useKeychain: args.useKeychain ?? (0, config_1.isKeychainAvailable)() });
+    const tail = fullKey.slice(-6);
+    (0, ui_1.success)(`Device paired. Key …${tail} saved to profile "${profileName}".`);
+    if (storedInKeychain) {
+        (0, ui_1.info)(`  Stored in macOS Keychain (${(0, ui_1.dim)('io.gurulu.cli')})`);
+    }
+    if (approved.secretKey.expiresAt) {
+        (0, ui_1.info)(`  Expires: ${approved.secretKey.expiresAt}`);
+    }
+    else {
+        (0, ui_1.info)('  Expires: never');
+    }
+}

package/dist/commands/chat.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Gurulu Chat — `gurulu chat` CLI command.
+ *
+ * Single-shot: `gurulu chat "How many events today?"`
+ * Interactive:  `gurulu chat`  (REPL mode)
+ *
+ * Flags:
+ *   --json      Machine-readable output
+ *   --show-sql  Also print the generated SQL
+ */
+export interface ChatArgs {
+    question?: string;
+    json?: boolean;
+    showSql?: boolean;
+    profile?: string;
+    context?: string;
+}
+export declare function chatCommand(args: ChatArgs): Promise<void>;

package/dist/commands/chat.js

@@ -0,0 +1,117 @@
+"use strict";
+/**
+ * Gurulu Chat — `gurulu chat` CLI command.
+ *
+ * Single-shot: `gurulu chat "How many events today?"`
+ * Interactive:  `gurulu chat`  (REPL mode)
+ *
+ * Flags:
+ *   --json      Machine-readable output
+ *   --show-sql  Also print the generated SQL
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.chatCommand = chatCommand;
+const readline = __importStar(require("readline"));
+const api_client_1 = require("../api-client");
+const ui_1 = require("../utils/ui");
+async function askQuestion(question, args) {
+    return (0, api_client_1.cliApiJson)('/api/cli/chat/query', {
+        profile: args.profile,
+        method: 'POST',
+        json: {
+            question,
+            context: args.context,
+        },
+    });
+}
+function printResult(res, args) {
+    if (args.json) {
+        process.stdout.write(JSON.stringify(res, null, 2) + '\n');
+        return;
+    }
+    process.stdout.write(`\n${res.summary}\n`);
+    if (args.showSql) {
+        process.stdout.write(`\nSQL: ${res.sql}\n`);
+    }
+    process.stdout.write(`(${res.rowCount} row${res.rowCount !== 1 ? 's' : ''}${res.cached ? ', cached' : ''})\n\n`);
+}
+async function replMode(args) {
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout,
+        prompt: 'gurulu> ',
+    });
+    (0, ui_1.info)('Gurulu Chat — ask analytics questions in natural language. Type .exit to quit.');
+    rl.prompt();
+    rl.on('line', async (line) => {
+        const trimmed = line.trim();
+        if (!trimmed) {
+            rl.prompt();
+            return;
+        }
+        if (trimmed === '.exit' || trimmed === '.quit') {
+            rl.close();
+            return;
+        }
+        try {
+            const res = await askQuestion(trimmed, args);
+            printResult(res, args);
+        }
+        catch (err) {
+            (0, ui_1.error)(err.message || 'Failed to execute query.');
+        }
+        rl.prompt();
+    });
+    rl.on('close', () => {
+        process.stdout.write('\n');
+    });
+}
+async function chatCommand(args) {
+    if (args.question) {
+        // Single-shot mode
+        try {
+            const res = await askQuestion(args.question, args);
+            printResult(res, args);
+        }
+        catch (err) {
+            (0, ui_1.error)(err.message || 'Failed to execute query.');
+            process.exit(1);
+        }
+        return;
+    }
+    // Interactive REPL mode
+    await replMode(args);
+}

package/dist/commands/config.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Phase 18.5 W2 — `gurulu config ...` subcommands. No network calls; pure
+ * local profile management.
+ */
+export interface ConfigArgs {
+    action?: string;
+    name?: string;
+    json?: boolean;
+}
+export declare function configCommand(args: ConfigArgs): Promise<void>;

package/dist/commands/config.js

@@ -0,0 +1,92 @@
+"use strict";
+/**
+ * Phase 18.5 W2 — `gurulu config ...` subcommands. No network calls; pure
+ * local profile management.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.configCommand = configCommand;
+const config_1 = require("../config");
+const ui_1 = require("../utils/ui");
+function maskKey(key) {
+    if (!key)
+        return '(keychain)';
+    if (key.length < 16)
+        return '••••••';
+    return `${key.slice(0, 9)}•••••••${key.slice(-6)}`;
+}
+async function configCommand(args) {
+    const action = args.action || 'list';
+    switch (action) {
+        case 'list': {
+            const profiles = (0, config_1.listProfiles)();
+            if (args.json) {
+                process.stdout.write(JSON.stringify(profiles, null, 2) + '\n');
+                return;
+            }
+            if (profiles.length === 0) {
+                (0, ui_1.info)('No profiles configured. Run `gurulu login` to create one.');
+                return;
+            }
+            const def = (0, config_1.getDefaultProfileName)();
+            process.stdout.write(['NAME', 'EMAIL', 'API BASE', 'STORAGE', 'DEFAULT'].join('\t') + '\n');
+            for (const p of profiles) {
+                process.stdout.write([
+                    p.name,
+                    p.email,
+                    p.api_base,
+                    p.keychain ? 'keychain' : 'file',
+                    p.name === def ? '*' : '',
+                ].join('\t') + '\n');
+            }
+            return;
+        }
+        case 'show': {
+            const name = args.name || (0, config_1.getDefaultProfileName)();
+            const p = (0, config_1.getStoredProfile)(name);
+            if (!p) {
+                (0, ui_1.error)(`Profile '${name}' not found.`);
+                process.exit(1);
+            }
+            const out = {
+                name,
+                email: p.email,
+                api_base: p.api_base,
+                storage: p.keychain ? 'keychain' : 'file',
+                secret_key: maskKey(p.secret_key),
+            };
+            if (args.json) {
+                process.stdout.write(JSON.stringify(out, null, 2) + '\n');
+                return;
+            }
+            process.stdout.write(`Profile:     ${name}\n`);
+            process.stdout.write(`Email:       ${p.email}\n`);
+            process.stdout.write(`API base:    ${p.api_base}\n`);
+            process.stdout.write(`Storage:     ${out.storage}\n`);
+            process.stdout.write(`Secret key:  ${out.secret_key}\n`);
+            return;
+        }
+        case 'set-default': {
+            if (!args.name) {
+                (0, ui_1.error)('Usage: gurulu config set-default <profile>');
+                process.exit(1);
+            }
+            try {
+                (0, config_1.setDefaultProfile)(args.name);
+                (0, ui_1.success)(`Default profile set to '${args.name}'.`);
+            }
+            catch (err) {
+                (0, ui_1.error)(err.message);
+                process.exit(1);
+            }
+            return;
+        }
+        case 'path': {
+            process.stdout.write((0, config_1.configPath)() + '\n');
+            return;
+        }
+        default:
+            (0, ui_1.error)(`Unknown config action: ${action}`);
+            (0, ui_1.info)(`Usage: gurulu config [list|show|set-default|path] ${(0, ui_1.dim)('[name]')}`);
+            process.exit(1);
+    }
+}

package/dist/commands/db.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Phase 21 — `gurulu db` — Connect, list, sync, and remove database sources.
+ *
+ * Subcommands:
+ *   gurulu db connect  — connect a Postgres/MySQL database
+ *   gurulu db list     — list connected databases
+ *   gurulu db sync <id> — trigger manual sync
+ *   gurulu db remove <id> — remove a connection
+ */
+export interface DbArgs {
+    action?: string;
+    target?: string;
+    type?: string;
+    host?: string;
+    port?: number;
+    database?: string;
+    user?: string;
+    password?: string;
+    table?: string;
+    schedule?: string;
+    json?: boolean;
+    profile?: string;
+    noInteractive?: boolean;
+}
+export declare function dbCommand(args: DbArgs): Promise<void>;