@infrarates/cli 0.0.0 → 0.1.0

package/oimo.mjs

@@ -0,0 +1,506 @@
+#!/usr/bin/env node
+import { parseArgs } from "node:util";
+import { pathToFileURL } from "node:url";
+import {
+  readFile,
+  mkdir,
+  writeFile,
+  rename,
+  chmod,
+  open,
+  stat,
+  rm,
+} from "node:fs/promises";
+import { setTimeout as sleep } from "node:timers/promises";
+import { dirname, join } from "node:path";
+import { homedir } from "node:os";
+import { randomUUID } from "node:crypto";
+import { readFileSync, realpathSync } from "node:fs";
+import { commands, resolveCommand } from "./commands.mjs";
+import { browserLogin } from "./browser-login.mjs";
+import { formatHistory, terminalText } from "./format-history.mjs";
+
+// The installed package's own version, so a release only bumps package.json.
+const { version } = JSON.parse(
+  readFileSync(new URL("./package.json", import.meta.url), "utf8"),
+);
+
+const help = `Usage: oimo <command> [options]
+
+Commands (use --data @file.json for JSON request bodies):
+${commands.map(([name, , , auth, opts]) => `  ${name}${opts.length ? `  [${opts.map((o) => `--${o}`).join(" ")}]` : ""}${auth === "session" ? "  (session)" : ""}`).join("\n")}
+  login               Sign in through your browser
+  logout              Remove the locally saved session
+
+Global options: --base-url <origin>, --config <file>, --help, --version
+Login options: --no-browser, --timeout <seconds> (default: 300), --session-stdin
+Environment: OIMO_API_KEY, OIMO_SESSION, OIMO_BASE_URL
+Session commands retain the server's user roles and organization checks.
+Price history: terminal table; JSON when piped. Override with --format table|json.
+Other output: JSON (terms content: text); errors on stderr.
+`;
+const optionNames = [...new Set(commands.flatMap((c) => c[4]))];
+const optionSpec = Object.fromEntries(
+  optionNames.map((name) => [
+    name,
+    { type: name === "all" ? "boolean" : "string" },
+  ]),
+);
+
+async function stdinText(hidden = false) {
+  if (hidden && process.stdin.isTTY) {
+    process.stderr.write("Session value (hidden): ");
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    return new Promise((resolve, reject) => {
+      let value = "";
+      const finish = (error) => {
+        process.stdin.removeListener("data", onData);
+        process.stdin.setRawMode(false);
+        process.stdin.pause();
+        process.stderr.write("\n");
+        if (error) reject(error);
+        else resolve(value);
+      };
+      const onData = (chunk) => {
+        for (const char of chunk.toString()) {
+          if (char === "\x03") {
+            finish(new Error("Login cancelled."));
+            return;
+          }
+          if (["\r", "\n", "\x04"].includes(char)) {
+            finish();
+            return;
+          }
+          if (char === "\x7f" || char === "\b") value = value.slice(0, -1);
+          else value += char;
+        }
+      };
+      process.stdin.on("data", onData);
+    });
+  }
+  let text = "";
+  for await (const chunk of process.stdin) text += chunk;
+  return text;
+}
+async function loadConfig(file) {
+  try {
+    const value = JSON.parse(await readFile(file, "utf8"));
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      throw new Error();
+    return value;
+  } catch (error) {
+    if (error.code === "ENOENT") return {};
+    throw new Error("Cannot read session config.");
+  }
+}
+// An update holds the lock for one small read and write; an older lock was
+// left by a command that died, and waiting commands take it over.
+const LOCK_STALE_MS = 10_000;
+const LOCK_WAIT_MS = 15_000;
+/**
+ * Apply one change to the saved state as it is now, not as this command read
+ * it earlier: commands run side by side, each rotating its own origin, and a
+ * whole-file write of an old snapshot would undo the others.
+ */
+async function updateConfig(file, change) {
+  await mkdir(dirname(file), { recursive: true, mode: 0o700 });
+  const lock = `${file}.lock`;
+  const deadline = Date.now() + LOCK_WAIT_MS;
+  for (;;) {
+    try {
+      await (await open(lock, "wx", 0o600)).close();
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST")
+        throw new Error("Cannot write session config.");
+      const held = await stat(lock).catch(() => null);
+      if (held && Date.now() - held.mtimeMs > LOCK_STALE_MS)
+        await rm(lock, { force: true });
+      else if (Date.now() > deadline)
+        throw new Error(
+          "Session config is locked by another oimo command. Try again.",
+        );
+      else await sleep(10 + Math.random() * 20);
+    }
+  }
+  try {
+    const config = await loadConfig(file);
+    change(config);
+    const temp = `${file}.${randomUUID()}.tmp`;
+    await writeFile(temp, `${JSON.stringify(config)}\n`, {
+      mode: 0o600,
+      flag: "wx",
+    });
+    await rename(temp, file);
+    await chmod(file, 0o600);
+  } finally {
+    await rm(lock, { force: true });
+  }
+}
+const SESSION_COOKIE = "__Host-ptu_session";
+// The organization a staff user is looking into; the server keeps it beside the session.
+const STAFF_ORG_COOKIE = "__Host-ptu_staff_org";
+/** One origin's saved cookies; a bare string is the entry format that held only the session. */
+function savedEntry(value) {
+  if (typeof value === "string") return { session: value };
+  return value && typeof value === "object" && !Array.isArray(value)
+    ? value
+    : {};
+}
+const validOrganization = (value) =>
+  typeof value === "string" && /^org_[A-Za-z0-9]{1,64}$/.test(value);
+function validSession(value) {
+  return (
+    typeof value === "string" &&
+    value.length > 0 &&
+    !/[\s;,\x00-\x1f\x7f]/.test(value)
+  );
+}
+/** What a response leaves in a cookie: its last Set-Cookie wins, "" is a deletion. */
+function cookieUpdate(response, name) {
+  let value;
+  for (const cookie of response.headers.getSetCookie()) {
+    const [pair, ...attributes] = cookie.split(";");
+    if (!pair.startsWith(`${name}=`)) continue;
+    value = attributes.some((a) => /^\s*max-age\s*=\s*(0+|-\d+)\s*$/i.test(a))
+      ? ""
+      : pair.slice(name.length + 1);
+  }
+  return value;
+}
+
+export async function run(
+  args,
+  {
+    env = process.env,
+    fetcher = fetch,
+    write = (s) => process.stdout.write(s),
+    readInput = stdinText,
+    loginBrowser = browserLogin,
+    report = (text) => process.stderr.write(text),
+    isTTY = process.stdout.isTTY ?? false,
+    columns = process.stdout.columns ?? 100,
+  } = {},
+) {
+  const { values, positionals } = parseArgs({
+    args,
+    allowPositionals: true,
+    options: {
+      ...optionSpec,
+      "base-url": { type: "string" },
+      config: { type: "string" },
+      help: { type: "boolean", short: "h" },
+      version: { type: "boolean" },
+      "no-browser": { type: "boolean" },
+      "session-stdin": { type: "boolean" },
+      timeout: { type: "string" },
+    },
+  });
+  if (values.help || args.length === 0) {
+    write(help);
+    return;
+  }
+  if (values.version) {
+    write(`${version}\n`);
+    return;
+  }
+  const special =
+    positionals.length === 1 && ["login", "logout"].includes(positionals[0])
+      ? positionals[0]
+      : null;
+  const command = special ? null : resolveCommand(positionals);
+  for (const option of ["no-browser", "session-stdin", "timeout"]) {
+    if (values[option] !== undefined && special !== "login")
+      throw new Error(`--${option} is only supported by login.`);
+  }
+  if (
+    values["session-stdin"] &&
+    (values["no-browser"] || values.timeout !== undefined)
+  )
+    throw new Error(
+      "--session-stdin cannot be combined with browser login options.",
+    );
+  const timeout = Number(values.timeout ?? 300);
+  if (!Number.isSafeInteger(timeout) || timeout < 1 || timeout > 600)
+    throw new Error("--timeout must be an integer from 1 to 600 seconds.");
+  for (const name of optionNames) {
+    if (values[name] !== undefined && !command?.options.includes(name))
+      throw new Error(`--${name} is not supported by this command.`);
+  }
+  if (
+    values.cursor !== undefined &&
+    (values.providers !== undefined ||
+      values["as-of"] !== undefined ||
+      values.alias !== undefined)
+  )
+    throw new Error(
+      "--cursor already pins providers, as-of and alias; send only cursor and limit.",
+    );
+  const maxLimit = command?.name === "prices latest" ? 1000 : 10000;
+  if (values.format !== undefined && !["table", "json"].includes(values.format))
+    throw new Error("--format must be table or json.");
+  if (
+    values.limit !== undefined &&
+    (!/^\d+$/.test(values.limit) ||
+      Number(values.limit) < 1 ||
+      Number(values.limit) > maxLimit)
+  )
+    throw new Error(`--limit must be an integer from 1 to ${maxLimit}.`);
+  if (
+    values.offset !== undefined &&
+    (!/^\d+$/.test(values.offset) ||
+      !Number.isSafeInteger(Number(values.offset)))
+  )
+    throw new Error("--offset must be a non-negative safe integer.");
+  if (values.dir !== undefined && !["asc", "desc"].includes(values.dir))
+    throw new Error("--dir must be asc or desc.");
+  if (
+    values["still-listed"] !== undefined &&
+    !["true", "false"].includes(values["still-listed"])
+  )
+    throw new Error("--still-listed must be true or false.");
+  const origin = new URL(
+    values["base-url"] ?? env.OIMO_BASE_URL ?? "https://oimo.com",
+  );
+  if (
+    origin.username ||
+    origin.password ||
+    origin.search ||
+    origin.hash ||
+    origin.pathname !== "/"
+  )
+    throw new Error(
+      "--base-url must be an origin without credentials, path, query or fragment.",
+    );
+  if (
+    origin.protocol !== "https:" &&
+    !(
+      origin.protocol === "http:" &&
+      ["localhost", "127.0.0.1", "[::1]"].includes(origin.hostname)
+    )
+  )
+    throw new Error(
+      "--base-url requires HTTPS (HTTP is allowed for localhost).",
+    );
+  const file =
+    values.config ?? join(homedir(), ".config", "oimo", "sessions.json");
+  if (special === "logout") {
+    await updateConfig(file, (config) => {
+      delete config[origin.origin];
+    });
+    write("Local session removed.\n");
+    return;
+  }
+  const key = command?.auth === "key" ? env.OIMO_API_KEY : undefined;
+  let saved = false;
+  let session;
+  let staffOrganization;
+  if (!key) {
+    session = env.OIMO_SESSION;
+    if (special === "login" && !values["session-stdin"]) {
+      const controller = new AbortController();
+      const cancel = () => controller.abort();
+      process.once("SIGINT", cancel);
+      try {
+        session = await loginBrowser(origin.origin, {
+          noBrowser: values["no-browser"] ?? false,
+          timeoutMs: timeout * 1000,
+          signal: controller.signal,
+          report,
+        });
+      } finally {
+        process.removeListener("SIGINT", cancel);
+      }
+    } else if (special === "login") session ??= (await readInput(true)).trim();
+    else if (!session) {
+      saved = true;
+      ({ session, staffOrganization } = savedEntry(
+        (await loadConfig(file))[origin.origin],
+      ));
+      if (!validOrganization(staffOrganization)) staffOrganization = undefined;
+    }
+    if (!validSession(session))
+      throw new Error(
+        command?.auth === "key"
+          ? "Set OIMO_API_KEY or sign in with oimo login."
+          : "A user session is required. Use oimo login or set OIMO_SESSION.",
+      );
+  } else if (/\s/.test(key))
+    throw new Error("Set OIMO_API_KEY to your organization API key.");
+  let body;
+  if (command?.options.includes("data")) {
+    if (!values.data)
+      throw new Error(
+        "This command requires --data <JSON>, --data @file.json, or --data - for stdin.",
+      );
+    const raw =
+      values.data === "-"
+        ? await readInput()
+        : values.data.startsWith("@")
+          ? await readFile(values.data.slice(1), "utf8")
+          : values.data;
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      throw new Error("--data must contain valid JSON.");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+      throw new Error("--data must be a JSON object.");
+    body = JSON.stringify(parsed);
+  }
+  let query = new URLSearchParams();
+  for (const option of command?.options ?? []) {
+    if (
+      option !== "all" &&
+      option !== "data" &&
+      option !== "format" &&
+      values[option] !== undefined
+    )
+      query.set(
+        { "as-of": "asOf", "still-listed": "stillListed" }[option] ?? option,
+        values[option],
+      );
+  }
+  let result;
+  const seen = new Set(values.cursor ? [values.cursor] : []);
+  do {
+    const url = new URL(special === "login" ? "/v1/me" : command.path, origin);
+    url.search = query.toString();
+    const headers = { Accept: "application/json" };
+    if (key) headers.Authorization = `Bearer ${key}`;
+    else {
+      headers.Cookie = `${SESSION_COOKIE}=${session}${staffOrganization ? `; ${STAFF_ORG_COOKIE}=${staffOrganization}` : ""}`;
+      headers.Origin = origin.origin;
+    }
+    if (body) headers["Content-Type"] = "application/json";
+    let response;
+    try {
+      response = await fetcher(url, {
+        method: command?.method ?? "GET",
+        headers,
+        ...(body ? { body } : {}),
+        redirect: "error",
+        signal: AbortSignal.timeout(30000),
+      });
+    } catch {
+      throw new Error(
+        "API request could not complete (network error, redirect, or timeout).",
+      );
+    }
+    const rotated = cookieUpdate(response, SESSION_COOKIE);
+    const viewing = cookieUpdate(response, STAFF_ORG_COOKIE);
+    if (!key && (rotated !== undefined || viewing !== undefined)) {
+      if (
+        (rotated && !validSession(rotated)) ||
+        (viewing && !validOrganization(viewing))
+      )
+        throw new Error("Server returned an invalid session cookie.");
+      if (rotated !== undefined) session = rotated;
+      if (viewing !== undefined) staffOrganization = viewing || undefined;
+      if (saved)
+        await updateConfig(file, (config) => {
+          // An entry removed meanwhile was logged out; a rotation must not restore it.
+          if (!(origin.origin in config)) return;
+          if (session) config[origin.origin] = { session, staffOrganization };
+          else delete config[origin.origin];
+        });
+    }
+    if (!response.ok) {
+      let code = "";
+      try {
+        const b = await response.json();
+        if (
+          typeof b?.error?.code === "string" &&
+          /^[a-z_]+$/.test(b.error.code)
+        )
+          code = ` (${b.error.code})`;
+      } catch {}
+      throw new Error(`API request failed: HTTP ${response.status}${code}.`);
+    }
+    if (special === "login") {
+      if (!validSession(session))
+        throw new Error("Server did not return a usable session.");
+      const identity = await response.json();
+      await updateConfig(file, (config) => {
+        config[origin.origin] = { session };
+      });
+      if (!values["session-stdin"] && env.OIMO_SESSION)
+        report(
+          "Unset OIMO_SESSION to use the saved browser login for subsequent commands.\n",
+        );
+      write(
+        `${JSON.stringify({ user: identity.user, organizationId: identity.organizationId }, null, 2)}\n`,
+      );
+      return;
+    }
+    if (command.name === "terms content <key>") {
+      const content = await response.text();
+      // Vendor text is untrusted: a terminal gets visible controls, a pipe the text as served.
+      write(isTTY ? terminalText(content) : content);
+      return;
+    }
+    const text = await response.text();
+    let page;
+    try {
+      page = text ? JSON.parse(text) : null;
+    } catch {
+      throw new Error("API returned invalid JSON.");
+    }
+    if (command.name !== "prices history") {
+      write(`${JSON.stringify(page, null, 2)}\n`);
+      return;
+    }
+    if (
+      !page ||
+      typeof page.asOf !== "string" ||
+      !Array.isArray(page.providers) ||
+      !page.providers.every((p) => typeof p === "string") ||
+      !Array.isArray(page.prices) ||
+      !(
+        page.nextCursor === null ||
+        (typeof page.nextCursor === "string" && page.nextCursor.length > 0)
+      )
+    )
+      throw new Error("API returned an invalid price history response.");
+    if (!result) result = page;
+    else {
+      if (
+        page.asOf !== result.asOf ||
+        JSON.stringify(page.providers) !== JSON.stringify(result.providers) ||
+        JSON.stringify(page.alias) !== JSON.stringify(result.alias)
+      )
+        throw new Error("API changed the pinned history while paginating.");
+      result.prices.push(...page.prices);
+      result.nextCursor = page.nextCursor;
+    }
+    if (!values.all || page.nextCursor === null) break;
+    if (seen.has(page.nextCursor))
+      throw new Error("API returned a repeated pagination cursor.");
+    seen.add(page.nextCursor);
+    query = new URLSearchParams({ cursor: page.nextCursor });
+    if (values.limit !== undefined) query.set("limit", values.limit);
+  } while (true);
+  const format = values.format ?? (isTTY ? "table" : "json");
+  write(
+    format === "table"
+      ? formatHistory(result, {
+          columns,
+          baseUrl: origin.origin,
+          limit: values.limit,
+          config: values.config,
+        })
+      : `${JSON.stringify(result, null, 2)}\n`,
+  );
+}
+
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href
+) {
+  run(process.argv.slice(2)).catch((error) => {
+    process.stderr.write(`oimo: ${error.message}\n`);
+    process.exitCode = 1;
+  });
+}

package/package.json

@@ -1,9 +1,35 @@
 {
   "name": "@infrarates/cli",
-  "version": "0.0.0",
-  "description": "Reserved for the Infrarates CLI (https://infrarates.ai). Not released yet.",
-  "homepage": "https://infrarates.ai/docs",
-  "license": "UNLICENSED",
-  "bin": { "infrarates": "infrarates.js" },
-  "files": ["infrarates.js", "README.md"]
+  "version": "0.1.0",
+  "type": "module",
+  "description": "CLI for the Oimo public API",
+  "license": "MIT",
+  "homepage": "https://oimo.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/oimo-ai/oimo.git",
+    "directory": "services/providers-tracker-ui/cli"
+  },
+  "bin": {
+    "oimo": "oimo.mjs"
+  },
+  "engines": {
+    "node": ">=22.11.0"
+  },
+  "scripts": {
+    "test": "node --test cli-tests.mjs install-smoke.mjs"
+  },
+  "files": [
+    "oimo.mjs",
+    "oimo.d.mts",
+    "browser-login.mjs",
+    "browser-login.d.mts",
+    "commands.mjs",
+    "format-history.mjs",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
 }

package/infrarates.js

@@ -1,3 +0,0 @@
-#!/usr/bin/env node
-console.error("The Infrarates CLI is not released yet. See https://infrarates.ai/docs for the API.");
-process.exit(1);