@irtio/cli 0.5.2 → 0.7.0

package/dist/api-keys-UTLYMZYN.js

@@ -0,0 +1,222 @@
+import {
+  readProjectConfig
+} from "./chunk-JL235KIE.js";
+import {
+  HelpRequested,
+  helpFor,
+  helpRequested
+} from "./chunk-OCVALOGK.js";
+import {
+  createApiClient,
+  isLoginRequired
+} from "./chunk-IDF46P7R.js";
+import {
+  resolveControlUrlForUser
+} from "./chunk-UPHQM6NZ.js";
+
+// src/api-keys.ts
+import pc from "picocolors";
+var SCOPES = ["rooms:read", "rooms:write"];
+var USAGE = `usage: irtio api-keys mint --scopes <list> [--label <text>] [options]
+       irtio api-keys list [options]
+       irtio api-keys revoke <id> [options]
+
+Scoped API keys let a script you run yourself \u2014 a nightly cleanup job, a support tool, your own
+backend \u2014 reach this project's rooms over HTTP, and nothing else. A key belongs to one project,
+carries an explicit list of what it may do there, never expires, and can be revoked.
+
+A key is NOT a login. It cannot deploy, cannot read your usage or billing, cannot see your other
+projects, and cannot mint or list keys, including itself.
+
+subcommands:
+  mint --scopes <list>      create a key and print it once. Scopes are comma-separated:
+                            rooms:read (list and read rooms and their saves) and rooms:write
+                            (also set retention, delete, and force-delete). Write implies read
+  list                      this project's keys, newest first, revoked ones included
+  revoke <id>               stop a key working. The row stays, so the listing is still an audit
+
+options:
+  --label <text>     a note for the listing, e.g. "nightly cleanup"
+  --project <id>     project id (default: the project file)
+  -c, --config <f>   the project file to read (default irtio.json)
+  --url <control>    control plane (default: your stored login)
+  -h, --help         print this
+`;
+function parseApiKeysArgs(args) {
+  if (helpRequested(args)) throw helpFor(USAGE);
+  const first = args[0];
+  if (first !== "mint" && first !== "list" && first !== "revoke") {
+    throw new Error("irtio api-keys: expected mint, list or revoke");
+  }
+  const parsed = { sub: first };
+  let rest = args.slice(1);
+  if (first === "revoke") {
+    const id = rest[0];
+    if (id === void 0 || id.startsWith("-")) {
+      throw new Error("irtio api-keys revoke: needs a key id \u2014 run `irtio api-keys list`");
+    }
+    parsed.id = id;
+    rest = rest.slice(1);
+  }
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    switch (arg) {
+      case "--scopes": {
+        const value = rest[++i];
+        if (value === void 0) throw new Error("irtio api-keys: --scopes needs a value");
+        const scopes = value.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+        for (const scope of scopes) {
+          if (!SCOPES.includes(scope)) {
+            throw new Error(
+              `irtio api-keys: ${JSON.stringify(scope)} is not a scope; the scopes are ${SCOPES.join(" and ")}`
+            );
+          }
+        }
+        if (scopes.length === 0) throw new Error("irtio api-keys: --scopes needs at least one");
+        parsed.scopes = scopes;
+        break;
+      }
+      case "--label": {
+        const value = rest[++i];
+        if (value === void 0) throw new Error("irtio api-keys: --label needs a value");
+        parsed.label = value;
+        break;
+      }
+      case "--project": {
+        const value = rest[++i];
+        if (value === void 0) throw new Error("irtio api-keys: --project needs a value");
+        parsed.project = value;
+        break;
+      }
+      case "-c":
+      case "--config": {
+        const value = rest[++i];
+        if (value === void 0 || value === "") {
+          throw new Error("irtio api-keys: --config needs a value");
+        }
+        parsed.config = value;
+        break;
+      }
+      case "--url": {
+        const value = rest[++i];
+        if (value === void 0) throw new Error("irtio api-keys: --url needs a value");
+        parsed.url = value;
+        break;
+      }
+      default:
+        throw new Error(`irtio api-keys: unknown option ${JSON.stringify(arg)}`);
+    }
+  }
+  if (parsed.sub === "mint" && parsed.scopes === void 0) {
+    throw new Error(
+      "irtio api-keys mint: --scopes is required \u2014 rooms:read to look, rooms:write to change things too"
+    );
+  }
+  return parsed;
+}
+function formatKeys(rows) {
+  if (rows.length === 0) {
+    return [
+      pc.dim("no API keys"),
+      pc.dim("mint one with: irtio api-keys mint --scopes rooms:read")
+    ];
+  }
+  const idWidth = Math.max(2, ...rows.map((r) => r.id.length));
+  const scopeWidth = Math.max(6, ...rows.map((r) => r.scopes.join(",").length));
+  const out = [
+    pc.dim(`${"ID".padEnd(idWidth)}  ${"SCOPES".padEnd(scopeWidth)}  LAST USED             LABEL`)
+  ];
+  for (const r of rows) {
+    const used = r.lastUsed ?? "never";
+    const label = r.revokedAt ? pc.dim(`${r.label} (revoked)`) : r.label;
+    out.push(
+      `${r.id.padEnd(idWidth)}  ${r.scopes.join(",").padEnd(scopeWidth)}  ${pc.dim(used.padEnd(20))}  ${label}`
+    );
+  }
+  return out;
+}
+async function runMint(options) {
+  const log = options.log ?? ((line) => console.log(line));
+  const controlUrl = await resolveControlUrlForUser(options.controlUrl);
+  const client = options.client ?? await createApiClient(controlUrl);
+  const minted = await client.post(`/v1/projects/${options.project}/keys`, {
+    scopes: options.scopes,
+    ...options.label !== void 0 ? { label: options.label } : {}
+  });
+  log("");
+  log(pc.bold(minted.key));
+  log("");
+  log(pc.yellow("Copy this now. It will not be shown again, here or anywhere else."));
+  log(pc.dim(`id ${minted.id}, scopes ${minted.scopes.join(",")}`));
+  log(pc.dim("use it as: Authorization: Bearer <key>, or set IRT_API_KEY for the rooms commands"));
+  log(pc.dim(`revoke it with: irtio api-keys revoke ${minted.id}`));
+  return minted;
+}
+async function runList(options) {
+  const log = options.log ?? ((line) => console.log(line));
+  const controlUrl = await resolveControlUrlForUser(options.controlUrl);
+  const client = options.client ?? await createApiClient(controlUrl);
+  const rows = await client.get(`/v1/projects/${options.project}/keys`);
+  for (const line of formatKeys(rows)) log(line);
+  return rows;
+}
+async function runRevoke(options) {
+  const log = options.log ?? ((line) => console.log(line));
+  const controlUrl = await resolveControlUrlForUser(options.controlUrl);
+  const client = options.client ?? await createApiClient(controlUrl);
+  await client.del(`/v1/projects/${options.project}/keys/${encodeURIComponent(options.id)}`);
+  log(pc.green(`revoked ${options.id}`));
+  log(pc.dim("anything using it now gets a 401. The row stays in the listing as a record"));
+}
+async function apiKeys(args, deps = {}) {
+  const log = deps.log ?? ((line) => console.log(line));
+  const errorLog = deps.errorLog ?? ((line) => console.error(line));
+  try {
+    const parsed = parseApiKeysArgs(args);
+    const config = await readProjectConfig(process.cwd(), "irtio api-keys", parsed.config);
+    const project = parsed.project ?? config.project;
+    if (project === void 0) {
+      throw new Error(
+        "irtio api-keys: no project id \u2014 pass --project or run this from a project with irtio.json"
+      );
+    }
+    const common = {
+      project,
+      log,
+      ...parsed.url !== void 0 ? { controlUrl: parsed.url } : {},
+      ...deps.client !== void 0 ? { client: deps.client } : {}
+    };
+    if (parsed.sub === "mint") {
+      await runMint({
+        ...common,
+        scopes: parsed.scopes,
+        ...parsed.label !== void 0 ? { label: parsed.label } : {}
+      });
+    } else if (parsed.sub === "revoke") {
+      await runRevoke({ ...common, id: parsed.id });
+    } else {
+      await runList(common);
+    }
+  } catch (err) {
+    if (err instanceof HelpRequested) {
+      log(err.usage);
+      return;
+    }
+    if (isLoginRequired(err)) {
+      errorLog(pc.red("not logged in"));
+      errorLog("run: irtio login");
+      process.exitCode = 1;
+      return;
+    }
+    errorLog(pc.red(err instanceof Error ? err.message : String(err)));
+    process.exitCode = 1;
+  }
+}
+export {
+  USAGE,
+  apiKeys,
+  parseApiKeysArgs,
+  runList,
+  runMint,
+  runRevoke
+};

package/dist/api.d.ts

@@ -0,0 +1,52 @@
+/**
+ * A thin typed `fetch` wrapper around `@irtio/control`'s `/v1` API (contract.ts). Two things
+ * earn this its own module rather than inlined `fetch` calls in every command:
+ *
+ * 1. **`ApiError` becomes a real thrown error.** The control plane's error bodies (`code`,
+ *    `message`, and — on `E_BREAKING_SCHEMA` — `changes`/`hint`) are exactly what `irtio deploy`
+ *    needs to print verbatim; `ApiClientError` carries them through instead of a generic
+ *    "request failed" the command layer would have to re-parse.
+ * 2. **401 is a command, not an error.** Every command that hits the control plane wants the same
+ *    "run: irtio login" line and exit code 1, so it lives here once.
+ */
+declare class ApiClientError extends Error {
+    readonly name = "ApiClientError";
+    readonly status: number;
+    readonly code: string;
+    readonly changes: readonly unknown[] | undefined;
+    readonly hint: string | undefined;
+    constructor(status: number, body: {
+        code: string;
+        message: string;
+        changes?: readonly unknown[];
+        hint?: string;
+    });
+}
+/** Thrown by `requireApiClient`/callers when there is no stored token: the login nudge. */
+declare class NotLoggedInError extends Error {
+    readonly controlUrl: string;
+    readonly name = "NotLoggedInError";
+    constructor(controlUrl: string);
+}
+interface ApiClient {
+    readonly controlUrl: string;
+    get<T>(path: string, query?: Record<string, string | undefined>): Promise<T>;
+    post<T>(path: string, body?: unknown): Promise<T>;
+    patch<T>(path: string, body?: unknown): Promise<T>;
+    /**
+     * `DELETE`, with the same query-string handling as `get`. The one route that needs it today is
+     * `DELETE /v1/projects/:id/origins`, which names the origin to remove in the query rather than
+     * the body, so a client without this method cannot remove an origin at all.
+     */
+    del<T>(path: string, query?: Record<string, string | undefined>): Promise<T>;
+    /** Uploads raw bytes (a bundle) rather than JSON. */
+    postBytes<T>(path: string, bytes: Uint8Array): Promise<T>;
+}
+/** Builds a client bound to one control URL, using whatever token `irtio login` last stored. */
+declare function createApiClient(controlUrl: string): Promise<ApiClient>;
+/** Same as `createApiClient`, but with an explicit token — what tests use. */
+declare function createApiClientWithToken(controlUrl: string, token: string): ApiClient;
+/** True when `err` is the "please log in" case — the shape every command checks for. */
+declare function isLoginRequired(err: unknown): boolean;
+
+export { type ApiClient, ApiClientError, NotLoggedInError, createApiClient, createApiClientWithToken, isLoginRequired };

package/dist/api.js

@@ -0,0 +1,15 @@
+import {
+  ApiClientError,
+  NotLoggedInError,
+  createApiClient,
+  createApiClientWithToken,
+  isLoginRequired
+} from "./chunk-IDF46P7R.js";
+import "./chunk-UPHQM6NZ.js";
+export {
+  ApiClientError,
+  NotLoggedInError,
+  createApiClient,
+  createApiClientWithToken,
+  isLoginRequired
+};

package/dist/bundle.js

@@ -3,7 +3,7 @@ import {
   BundleError,
   EXTERNAL_IMPORTS,
   bundleRoom
-} from "./chunk-KRQUAEN2.js";
+} from "./chunk-OTSFRVJN.js";
 export {
   ALLOWED_IMPORTS,
   BundleError,

package/dist/{chunk-GBNHBWES.js → chunk-BQBOBFBO.js}

@@ -1,19 +1,23 @@
 import {
   STATIC_LIMITS,
   staticPathProblem
-} from "./chunk-BPE452KF.js";
+} from "./chunk-WFMRNGO5.js";
 import {
   ensureProject,
   readProjectConfig
-} from "./chunk-32QTPKVT.js";
+} from "./chunk-JL235KIE.js";
 import {
   HelpRequested,
-  createApiClient,
   helpFor,
-  helpRequested,
-  isLoginRequired,
+  helpRequested
+} from "./chunk-OCVALOGK.js";
+import {
+  createApiClient,
+  isLoginRequired
+} from "./chunk-IDF46P7R.js";
+import {
   resolveControlUrlForUser
-} from "./chunk-TV66QHFP.js";
+} from "./chunk-UPHQM6NZ.js";
 
 // src/static-deploy.ts
 import { existsSync } from "fs";

package/dist/chunk-IDF46P7R.js

@@ -0,0 +1,98 @@
+import {
+  readCredential
+} from "./chunk-UPHQM6NZ.js";
+
+// src/api-client.ts
+var ApiClientError = class extends Error {
+  name = "ApiClientError";
+  status;
+  code;
+  changes;
+  hint;
+  constructor(status, body) {
+    super(body.message);
+    this.status = status;
+    this.code = body.code;
+    this.changes = body.changes;
+    this.hint = body.hint;
+  }
+};
+var NotLoggedInError = class extends Error {
+  constructor(controlUrl) {
+    super(`not logged in to ${controlUrl} \u2014 run: irtio login`);
+    this.controlUrl = controlUrl;
+  }
+  controlUrl;
+  name = "NotLoggedInError";
+};
+async function createApiClient(controlUrl) {
+  const apiKey = process.env.IRT_API_KEY?.trim();
+  if (apiKey) return createApiClientWithToken(controlUrl, apiKey);
+  const credential = await readCredential(controlUrl);
+  if (!credential) throw new NotLoggedInError(controlUrl);
+  return createApiClientWithToken(controlUrl, credential.token);
+}
+function createApiClientWithToken(controlUrl, token) {
+  async function request(method, path, init = {}) {
+    const headers = {
+      Authorization: `Bearer ${token}`,
+      Accept: "application/json"
+    };
+    let requestBody;
+    if (init.bytes !== void 0) {
+      headers["content-type"] = "application/octet-stream";
+      requestBody = init.bytes;
+    } else if (init.body !== void 0) {
+      headers["content-type"] = "application/json";
+      requestBody = JSON.stringify(init.body);
+    }
+    const response = await fetch(`${controlUrl}${path}`, {
+      method,
+      headers,
+      ...requestBody !== void 0 ? { body: requestBody } : {}
+    });
+    const text = await response.text();
+    const parsed = text.length > 0 ? JSON.parse(text) : void 0;
+    if (!response.ok) {
+      const body = parsed !== void 0 && typeof parsed === "object" && parsed !== null && "code" in parsed && "message" in parsed ? parsed : {
+        code: "E_UNKNOWN",
+        message: text || `${method} ${path} failed with ${response.status}`
+      };
+      throw new ApiClientError(response.status, body);
+    }
+    return parsed;
+  }
+  function withQuery(path, query) {
+    const qs = query ? Object.entries(query).filter((e) => e[1] !== void 0).map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join("&") : "";
+    return qs ? `${path}?${qs}` : path;
+  }
+  return {
+    controlUrl,
+    get(path, query) {
+      return request("GET", withQuery(path, query));
+    },
+    del(path, query) {
+      return request("DELETE", withQuery(path, query));
+    },
+    post(path, body) {
+      return request("POST", path, { body });
+    },
+    patch(path, body) {
+      return request("PATCH", path, { body });
+    },
+    postBytes(path, bytes) {
+      return request("POST", path, { bytes });
+    }
+  };
+}
+function isLoginRequired(err) {
+  return err instanceof NotLoggedInError || err instanceof ApiClientError && err.status === 401;
+}
+
+export {
+  ApiClientError,
+  NotLoggedInError,
+  createApiClient,
+  createApiClientWithToken,
+  isLoginRequired
+};

package/dist/{chunk-32QTPKVT.js → chunk-JL235KIE.js}

@@ -1,6 +1,6 @@
 import {
   ApiClientError
-} from "./chunk-TV66QHFP.js";
+} from "./chunk-IDF46P7R.js";
 
 // src/project-file.ts
 import { existsSync } from "fs";

package/dist/chunk-OCVALOGK.js

@@ -0,0 +1,31 @@
+import {
+  ApiClientError
+} from "./chunk-IDF46P7R.js";
+
+// src/help.ts
+function helpRequested(args) {
+  return args.some((arg) => arg === "--help" || arg === "-h");
+}
+var HelpRequested = class extends Error {
+  constructor(usage) {
+    super(usage);
+    this.usage = usage;
+  }
+  usage;
+  name = "HelpRequested";
+};
+function helpFor(usage) {
+  return new HelpRequested(usage);
+}
+function trailerFor(err, hints = []) {
+  if (err instanceof ApiClientError && err.hint !== void 0 && err.hint !== "") return err.hint;
+  const grounded = hints.filter((h) => h !== "");
+  return grounded.length > 0 ? grounded.join("\n") : void 0;
+}
+
+export {
+  helpRequested,
+  HelpRequested,
+  helpFor,
+  trailerFor
+};

package/dist/{chunk-KRQUAEN2.js → chunk-OTSFRVJN.js}

@@ -5,8 +5,14 @@ import * as path from "path";
 import { pathToFileURL } from "url";
 import { Worker } from "worker_threads";
 import * as esbuild from "esbuild";
-var ALLOWED_IMPORTS = ["@irtio/server", "@irtio/schema", "@dimforge/rapier3d-compat"];
-var EXTERNAL_IMPORTS = ["@dimforge/rapier3d-compat"];
+var ALLOWED_IMPORTS = [
+  "@irtio/server",
+  "@irtio/schema",
+  "@dimforge/rapier3d-compat",
+  // D45: the second blessed engine. Exactly one import added, as the decision says.
+  "matter-js"
+];
+var EXTERNAL_IMPORTS = ["@dimforge/rapier3d-compat", "matter-js"];
 var BundleError = class extends Error {
   name = "BundleError";
 };
@@ -85,8 +91,8 @@ async function bundleRoom(options) {
   const out = result.outputFiles[0];
   if (!out) throw new BundleError("esbuild produced no output");
   const warnings = result.warnings.map((w) => w.text);
-  const importsRapier = Object.values(result.metafile?.outputs ?? {}).some(
-    (o) => o.imports.some((i) => i.path === "@dimforge/rapier3d-compat")
+  const importsEngine = Object.values(result.metafile?.outputs ?? {}).some(
+    (o) => o.imports.some((i) => i.path === "@dimforge/rapier3d-compat" || i.path === "matter-js")
   );
   const hash = createHash("sha256").update(out.contents).digest("hex");
   const file = path.join(options.outDir, `room.${hash.slice(0, 16)}.mjs`);
@@ -108,9 +114,9 @@ async function bundleRoom(options) {
   }
   if (options.verify === false) return { file, hash, warnings };
   const verified = await verifyBundle(file);
-  if (importsRapier && !verified.physics) {
+  if (importsEngine && !verified.physics) {
     throw new BundleError(
-      "irtio: this room imports @dimforge/rapier3d-compat but declares no physics. Add\n  physics: { engine: 'rapier3d', gravity: { x: 0, y: -9.81, z: 0 }, bodies: { ... } }\nto defineRoom(...), and mark the body-backed fields with the schema's physics option. Without it the runtime never creates a world, and nothing you build with the engine steps."
+      "irtio: this room imports a physics engine but declares no physics. Add\n  physics: { engine: 'rapier3d', gravity: { x: 0, y: -9.81, z: 0 }, bodies: { ... } }\nor, for the 2D engine,\n  physics: { engine: 'matter2d', gravity: { x: 0, y: 1 }, bodies: { ... } }\nto defineRoom(...), and mark the body-backed fields with the schema's physics option. Without it the runtime never creates a world, and nothing you build with the engine steps."
     );
   }
   const fullHash = createHash("sha256").update(out.contents).update(verified.canonical).digest("hex");

package/dist/chunk-UPHQM6NZ.js

@@ -0,0 +1,72 @@
+// src/credentials.ts
+import { existsSync } from "fs";
+import { chmod, mkdir, readFile, writeFile } from "fs/promises";
+import * as os from "os";
+import * as path from "path";
+function credentialsPath() {
+  if (process.env.IRT_CREDENTIALS_FILE) return process.env.IRT_CREDENTIALS_FILE;
+  if (process.platform === "win32") {
+    const appData = process.env.APPDATA ?? path.join(os.homedir(), "AppData", "Roaming");
+    return path.join(appData, "irtio", "credentials.json");
+  }
+  return path.join(os.homedir(), ".config", "irtio", "credentials.json");
+}
+async function readCredentials() {
+  const file = credentialsPath();
+  if (!existsSync(file)) return {};
+  try {
+    const raw = await readFile(file, "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return {};
+    return parsed;
+  } catch {
+    return {};
+  }
+}
+async function readCredential(controlUrl) {
+  const all = await readCredentials();
+  return all[controlUrl];
+}
+async function writeCredential(controlUrl, credential) {
+  const file = credentialsPath();
+  await mkdir(path.dirname(file), { recursive: true });
+  const all = await readCredentials();
+  all[controlUrl] = credential;
+  await writeFile(file, `${JSON.stringify(all, null, 2)}
+`, { mode: 384 });
+  await chmod(file, 384).catch(() => {
+  });
+  return file;
+}
+async function deleteCredential(controlUrl) {
+  const file = credentialsPath();
+  if (!existsSync(file)) return;
+  const all = await readCredentials();
+  delete all[controlUrl];
+  await writeFile(file, `${JSON.stringify(all, null, 2)}
+`, { mode: 384 });
+}
+var DEFAULT_CONTROL_URL = "https://irt.io";
+function resolveControlUrl(flag) {
+  return flag ?? process.env.IRT_CONTROL_URL ?? DEFAULT_CONTROL_URL;
+}
+async function resolveControlUrlForUser(flag) {
+  const explicit = flag ?? process.env.IRT_CONTROL_URL;
+  if (explicit !== void 0) return explicit;
+  const all = await readCredentials();
+  const now = Date.now();
+  const live = Object.entries(all).filter(([, cred]) => new Date(cred.expiresAt).getTime() > now).map(([url]) => url);
+  const urls = live.length > 0 ? live : Object.keys(all);
+  return urls.length === 1 ? urls[0] : DEFAULT_CONTROL_URL;
+}
+
+export {
+  credentialsPath,
+  readCredentials,
+  readCredential,
+  writeCredential,
+  deleteCredential,
+  DEFAULT_CONTROL_URL,
+  resolveControlUrl,
+  resolveControlUrlForUser
+};