@hixumo/hive 0.0.0-stage → 0.0.1

package/dist/time.js

@@ -0,0 +1,42 @@
+/** Dates as the sign-ins list says them: "2 Nov", "3 days ago", "in 9 hours". Local time. */
+const MINUTE = 60_000;
+const HOUR = 60 * MINUTE;
+const DAY = 24 * HOUR;
+const MONTHS = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
+function plural(count, unit) {
+    return `${count} ${unit}${count === 1 ? '' : 's'}`;
+}
+/** "2 Nov", with the year when it is not this one. */
+export function day(iso, now) {
+    const date = new Date(iso);
+    if (Number.isNaN(date.getTime()))
+        return 'unknown date';
+    const year = date.getFullYear() === now.getFullYear() ? '' : ` ${date.getFullYear()}`;
+    return `${date.getDate()} ${MONTHS[date.getMonth()]}${year}`;
+}
+export function ago(iso, now) {
+    const passed = now.getTime() - new Date(iso).getTime();
+    if (Number.isNaN(passed))
+        return 'at an unknown time';
+    if (passed < MINUTE)
+        return 'just now';
+    if (passed < HOUR)
+        return `${plural(Math.floor(passed / MINUTE), 'minute')} ago`;
+    if (passed < DAY)
+        return `${plural(Math.floor(passed / HOUR), 'hour')} ago`;
+    if (passed < 2 * DAY)
+        return 'yesterday';
+    return `${Math.floor(passed / DAY)} days ago`;
+}
+export function inTime(iso, now) {
+    const left = new Date(iso).getTime() - now.getTime();
+    if (Number.isNaN(left))
+        return 'at an unknown time';
+    if (left < MINUTE)
+        return 'in under a minute';
+    if (left < HOUR)
+        return `in ${plural(Math.floor(left / MINUTE), 'minute')}`;
+    if (left < DAY)
+        return `in ${plural(Math.floor(left / HOUR), 'hour')}`;
+    return `in ${plural(Math.floor(left / DAY), 'day')}`;
+}

package/dist/values.js

@@ -0,0 +1,111 @@
+import { asCliError, callerOf, signedIn, tokenApi } from "./callers.js";
+import { withConfirm } from "./device-flow.js";
+import { assertReadable, environmentNamed, projectOf, sameName } from "./environments.js";
+import { withWorkflowAccess } from "./github-actions.js";
+import { findLink, isProjectId } from "./link-file.js";
+import { CliError, plain } from "./output.js";
+export async function readValues(ctx, options) {
+    try {
+        const caller = callerOf(ctx.env);
+        if (caller.kind === 'token')
+            return await readWithToken(ctx, caller.token, options);
+        if (caller.kind === 'github')
+            return await readAsGithubActions(ctx, caller.request, options);
+        return await readSignedIn(ctx, options);
+    }
+    catch (error) {
+        throw asCliError(error);
+    }
+}
+/** `--env`, else HIVE_ENV, and which of them said it. */
+function asked(ctx, options) {
+    if (options.env?.trim())
+        return { name: options.env.trim(), by: '--env' };
+    const fromShell = ctx.env.HIVE_ENV?.trim();
+    return fromShell ? { name: fromShell, by: 'HIVE_ENV' } : undefined;
+}
+async function readWithToken(ctx, token, options) {
+    const api = tokenApi(ctx, token);
+    const found = linkBesideToken(ctx);
+    const wanted = asked(ctx, options);
+    // What the token is for is asked only when there is something to check it against.
+    let info;
+    if (found || wanted) {
+        info = await api.tokenInfo();
+        const project = plain(info.project.name);
+        const environment = plain(info.environment.name);
+        if (found && found.link.project !== info.project.id.toLowerCase()) {
+            throw new CliError(`HIVE_TOKEN is for ${project}, but ${found.path} names another project (${found.link.project}). Use this repository's token.`);
+        }
+        if (wanted && !sameName(wanted.name, info.environment.name)) {
+            throw new CliError(`HIVE_TOKEN reads ${environment} of ${project}, but ${wanted.by} asks for ${plain(wanted.name)}. Leave out ${wanted.by}, or use a token for ${plain(wanted.name)}.`);
+        }
+    }
+    const read = await api.tokenValues();
+    return {
+        values: read.values,
+        environment: plain(read.environment.name),
+        project: info && plain(info.project.name),
+    };
+}
+/**
+ * With a token, `.hive.json` only guards against the wrong token in a repository: one that
+ * cannot be read, or is not a link file, has nothing to guard with, so it is left out with one
+ * warning instead of stopping a deploy.
+ */
+function linkBesideToken(ctx) {
+    try {
+        return findLink(ctx.cwd);
+    }
+    catch (error) {
+        if (!(error instanceof CliError))
+            throw error;
+        ctx.ui.warn(`${error.message} HIVE_TOKEN is set, so it is left out and the token decides the project.`);
+        return undefined;
+    }
+}
+async function readAsGithubActions(ctx, request, options) {
+    const target = githubTarget(ctx, options);
+    const read = await withWorkflowAccess(ctx, request, target, (api) => api.tokenValues());
+    return { values: read.values, environment: plain(read.environment.name) };
+}
+/**
+ * What a GitHub Actions run asks for, settled before GitHub is asked for anything. HIVE_PROJECT
+ * (set in the workflow) wins over the committed `.hive.json`, as `--env` and HIVE_ENV win over
+ * its environment; `.hive.json` is read only when one of the two is still missing.
+ */
+export function githubTarget(ctx, options) {
+    const fromShell = ctx.env.HIVE_PROJECT?.trim();
+    if (fromShell && !isProjectId(fromShell)) {
+        throw new CliError("HIVE_PROJECT is not a project id. Use the one in the project's .hive.json (`hive link` writes it).");
+    }
+    const wanted = asked(ctx, options);
+    const found = fromShell && wanted ? undefined : findLink(ctx.cwd);
+    const project = fromShell?.toLowerCase() || found?.link.project;
+    if (!project) {
+        throw new CliError("No project to read: there is no .hive.json in this folder or above it, and HIVE_PROJECT is not set. Commit the .hive.json `hive link` writes, or set HIVE_PROJECT to the project's id.");
+    }
+    const environment = wanted?.name ?? found?.link.environment;
+    if (!environment) {
+        throw new CliError('No environment to read: pass --env (as in `--env production`), or set HIVE_ENV.');
+    }
+    return { project, environment };
+}
+async function readSignedIn(ctx, options) {
+    const { api } = await signedIn(ctx);
+    const found = findLink(ctx.cwd);
+    if (!found) {
+        throw new CliError('This folder is not linked to a Hive project. Run `hive link` first.');
+    }
+    const project = await projectOf(api, found.link.project, found.path);
+    const environment = environmentNamed(project, asked(ctx, options)?.name ?? found.link.environment);
+    assertReadable(project, environment);
+    // A protected environment needs "Confirm it is you" within 10 minutes; servers, with nobody
+    // to approve it, use an access token.
+    const name = plain(environment.name);
+    const { values } = await withConfirm(ctx, api, () => api.reveal(environment.id), {
+        why: `${name} is protected.`,
+        noTerminal: `${name} is protected. Use an access token on servers, or run this in a terminal.`,
+    });
+    return { values, environment: name, project: plain(project.name) };
+}

package/dist/version.js

@@ -0,0 +1,6 @@
+import { readFileSync } from 'node:fs';
+import { arch, platform, versions } from 'node:process';
+/** package.json sits one folder above both src/ (the tests) and dist/ (the published CLI). */
+export const VERSION = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
+/** Contract C4: which CLI, which Node, which system, for Hive's records and its sign-ins list. */
+export const USER_AGENT = `hixumo-hive-cli/${VERSION} node/${versions.node} ${platform}-${arch}`;

package/package.json

@@ -1,6 +1,31 @@
 {
   "name": "@hixumo/hive",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.0.1",
+  "description": "The Hixumo Hive CLI: run a project with its environment's values, without a .env file.",
+  "license": "SEE LICENSE IN LICENSE",
+  "type": "module",
+  "bin": {
+    "hive": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "build": "node scripts/write-build-info.mjs && tsc -p tsconfig.build.json",
+    "typecheck": "node scripts/write-build-info.mjs --if-missing && tsc --noEmit -p tsconfig.json",
+    "test": "node scripts/write-build-info.mjs --if-missing && node --test --test-concurrency=4 \"tests/**/*.test.ts\"",
+    "prepublishOnly": "node scripts/check-build.mjs"
+  },
+  "optionalDependencies": {
+    "@napi-rs/keyring": "2.1.2"
+  },
+  "devDependencies": {
+    "@types/node": "^22.20.5",
+    "typescript": "^5.9.3"
+  }
+}