@irtio/cli 0.6.0 → 0.7.0

package/dist/api-keys-UTLYMZYN.js

@@ -0,0 +1,222 @@
+import {
+  readProjectConfig
+} from "./chunk-JL235KIE.js";
+import {
+  HelpRequested,
+  helpFor,
+  helpRequested
+} from "./chunk-OCVALOGK.js";
+import {
+  createApiClient,
+  isLoginRequired
+} from "./chunk-IDF46P7R.js";
+import {
+  resolveControlUrlForUser
+} from "./chunk-UPHQM6NZ.js";
+
+// src/api-keys.ts
+import pc from "picocolors";
+var SCOPES = ["rooms:read", "rooms:write"];
+var USAGE = `usage: irtio api-keys mint --scopes <list> [--label <text>] [options]
+       irtio api-keys list [options]
+       irtio api-keys revoke <id> [options]
+
+Scoped API keys let a script you run yourself \u2014 a nightly cleanup job, a support tool, your own
+backend \u2014 reach this project's rooms over HTTP, and nothing else. A key belongs to one project,
+carries an explicit list of what it may do there, never expires, and can be revoked.
+
+A key is NOT a login. It cannot deploy, cannot read your usage or billing, cannot see your other
+projects, and cannot mint or list keys, including itself.
+
+subcommands:
+  mint --scopes <list>      create a key and print it once. Scopes are comma-separated:
+                            rooms:read (list and read rooms and their saves) and rooms:write
+                            (also set retention, delete, and force-delete). Write implies read
+  list                      this project's keys, newest first, revoked ones included
+  revoke <id>               stop a key working. The row stays, so the listing is still an audit
+
+options:
+  --label <text>     a note for the listing, e.g. "nightly cleanup"
+  --project <id>     project id (default: the project file)
+  -c, --config <f>   the project file to read (default irtio.json)
+  --url <control>    control plane (default: your stored login)
+  -h, --help         print this
+`;
+function parseApiKeysArgs(args) {
+  if (helpRequested(args)) throw helpFor(USAGE);
+  const first = args[0];
+  if (first !== "mint" && first !== "list" && first !== "revoke") {
+    throw new Error("irtio api-keys: expected mint, list or revoke");
+  }
+  const parsed = { sub: first };
+  let rest = args.slice(1);
+  if (first === "revoke") {
+    const id = rest[0];
+    if (id === void 0 || id.startsWith("-")) {
+      throw new Error("irtio api-keys revoke: needs a key id \u2014 run `irtio api-keys list`");
+    }
+    parsed.id = id;
+    rest = rest.slice(1);
+  }
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    switch (arg) {
+      case "--scopes": {
+        const value = rest[++i];
+        if (value === void 0) throw new Error("irtio api-keys: --scopes needs a value");
+        const scopes = value.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+        for (const scope of scopes) {
+          if (!SCOPES.includes(scope)) {
+            throw new Error(
+              `irtio api-keys: ${JSON.stringify(scope)} is not a scope; the scopes are ${SCOPES.join(" and ")}`
+            );
+          }
+        }
+        if (scopes.length === 0) throw new Error("irtio api-keys: --scopes needs at least one");
+        parsed.scopes = scopes;
+        break;
+      }
+      case "--label": {
+        const value = rest[++i];
+        if (value === void 0) throw new Error("irtio api-keys: --label needs a value");
+        parsed.label = value;
+        break;
+      }
+      case "--project": {
+        const value = rest[++i];
+        if (value === void 0) throw new Error("irtio api-keys: --project needs a value");
+        parsed.project = value;
+        break;
+      }
+      case "-c":
+      case "--config": {
+        const value = rest[++i];
+        if (value === void 0 || value === "") {
+          throw new Error("irtio api-keys: --config needs a value");
+        }
+        parsed.config = value;
+        break;
+      }
+      case "--url": {
+        const value = rest[++i];
+        if (value === void 0) throw new Error("irtio api-keys: --url needs a value");
+        parsed.url = value;
+        break;
+      }
+      default:
+        throw new Error(`irtio api-keys: unknown option ${JSON.stringify(arg)}`);
+    }
+  }
+  if (parsed.sub === "mint" && parsed.scopes === void 0) {
+    throw new Error(
+      "irtio api-keys mint: --scopes is required \u2014 rooms:read to look, rooms:write to change things too"
+    );
+  }
+  return parsed;
+}
+function formatKeys(rows) {
+  if (rows.length === 0) {
+    return [
+      pc.dim("no API keys"),
+      pc.dim("mint one with: irtio api-keys mint --scopes rooms:read")
+    ];
+  }
+  const idWidth = Math.max(2, ...rows.map((r) => r.id.length));
+  const scopeWidth = Math.max(6, ...rows.map((r) => r.scopes.join(",").length));
+  const out = [
+    pc.dim(`${"ID".padEnd(idWidth)}  ${"SCOPES".padEnd(scopeWidth)}  LAST USED             LABEL`)
+  ];
+  for (const r of rows) {
+    const used = r.lastUsed ?? "never";
+    const label = r.revokedAt ? pc.dim(`${r.label} (revoked)`) : r.label;
+    out.push(
+      `${r.id.padEnd(idWidth)}  ${r.scopes.join(",").padEnd(scopeWidth)}  ${pc.dim(used.padEnd(20))}  ${label}`
+    );
+  }
+  return out;
+}
+async function runMint(options) {
+  const log = options.log ?? ((line) => console.log(line));
+  const controlUrl = await resolveControlUrlForUser(options.controlUrl);
+  const client = options.client ?? await createApiClient(controlUrl);
+  const minted = await client.post(`/v1/projects/${options.project}/keys`, {
+    scopes: options.scopes,
+    ...options.label !== void 0 ? { label: options.label } : {}
+  });
+  log("");
+  log(pc.bold(minted.key));
+  log("");
+  log(pc.yellow("Copy this now. It will not be shown again, here or anywhere else."));
+  log(pc.dim(`id ${minted.id}, scopes ${minted.scopes.join(",")}`));
+  log(pc.dim("use it as: Authorization: Bearer <key>, or set IRT_API_KEY for the rooms commands"));
+  log(pc.dim(`revoke it with: irtio api-keys revoke ${minted.id}`));
+  return minted;
+}
+async function runList(options) {
+  const log = options.log ?? ((line) => console.log(line));
+  const controlUrl = await resolveControlUrlForUser(options.controlUrl);
+  const client = options.client ?? await createApiClient(controlUrl);
+  const rows = await client.get(`/v1/projects/${options.project}/keys`);
+  for (const line of formatKeys(rows)) log(line);
+  return rows;
+}
+async function runRevoke(options) {
+  const log = options.log ?? ((line) => console.log(line));
+  const controlUrl = await resolveControlUrlForUser(options.controlUrl);
+  const client = options.client ?? await createApiClient(controlUrl);
+  await client.del(`/v1/projects/${options.project}/keys/${encodeURIComponent(options.id)}`);
+  log(pc.green(`revoked ${options.id}`));
+  log(pc.dim("anything using it now gets a 401. The row stays in the listing as a record"));
+}
+async function apiKeys(args, deps = {}) {
+  const log = deps.log ?? ((line) => console.log(line));
+  const errorLog = deps.errorLog ?? ((line) => console.error(line));
+  try {
+    const parsed = parseApiKeysArgs(args);
+    const config = await readProjectConfig(process.cwd(), "irtio api-keys", parsed.config);
+    const project = parsed.project ?? config.project;
+    if (project === void 0) {
+      throw new Error(
+        "irtio api-keys: no project id \u2014 pass --project or run this from a project with irtio.json"
+      );
+    }
+    const common = {
+      project,
+      log,
+      ...parsed.url !== void 0 ? { controlUrl: parsed.url } : {},
+      ...deps.client !== void 0 ? { client: deps.client } : {}
+    };
+    if (parsed.sub === "mint") {
+      await runMint({
+        ...common,
+        scopes: parsed.scopes,
+        ...parsed.label !== void 0 ? { label: parsed.label } : {}
+      });
+    } else if (parsed.sub === "revoke") {
+      await runRevoke({ ...common, id: parsed.id });
+    } else {
+      await runList(common);
+    }
+  } catch (err) {
+    if (err instanceof HelpRequested) {
+      log(err.usage);
+      return;
+    }
+    if (isLoginRequired(err)) {
+      errorLog(pc.red("not logged in"));
+      errorLog("run: irtio login");
+      process.exitCode = 1;
+      return;
+    }
+    errorLog(pc.red(err instanceof Error ? err.message : String(err)));
+    process.exitCode = 1;
+  }
+}
+export {
+  USAGE,
+  apiKeys,
+  parseApiKeysArgs,
+  runList,
+  runMint,
+  runRevoke
+};

package/dist/api.js

@@ -4,7 +4,7 @@ import {
   createApiClient,
   createApiClientWithToken,
   isLoginRequired
-} from "./chunk-RNAH5T4W.js";
+} from "./chunk-IDF46P7R.js";
 import "./chunk-UPHQM6NZ.js";
 export {
   ApiClientError,

package/dist/{chunk-3HQMVCYA.js → chunk-BQBOBFBO.js}

@@ -1,20 +1,20 @@
 import {
   STATIC_LIMITS,
   staticPathProblem
-} from "./chunk-RQSJZWQC.js";
+} from "./chunk-WFMRNGO5.js";
 import {
   ensureProject,
   readProjectConfig
-} from "./chunk-DKWG7MGO.js";
+} from "./chunk-JL235KIE.js";
 import {
   HelpRequested,
   helpFor,
   helpRequested
-} from "./chunk-ZD4ND6X6.js";
+} from "./chunk-OCVALOGK.js";
 import {
   createApiClient,
   isLoginRequired
-} from "./chunk-RNAH5T4W.js";
+} from "./chunk-IDF46P7R.js";
 import {
   resolveControlUrlForUser
 } from "./chunk-UPHQM6NZ.js";

package/dist/{chunk-RNAH5T4W.js → chunk-IDF46P7R.js}

@@ -26,6 +26,8 @@ var NotLoggedInError = class extends Error {
   name = "NotLoggedInError";
 };
 async function createApiClient(controlUrl) {
+  const apiKey = process.env.IRT_API_KEY?.trim();
+  if (apiKey) return createApiClientWithToken(controlUrl, apiKey);
   const credential = await readCredential(controlUrl);
   if (!credential) throw new NotLoggedInError(controlUrl);
   return createApiClientWithToken(controlUrl, credential.token);

package/dist/{chunk-DKWG7MGO.js → chunk-JL235KIE.js}

@@ -1,6 +1,6 @@
 import {
   ApiClientError
-} from "./chunk-RNAH5T4W.js";
+} from "./chunk-IDF46P7R.js";
 
 // src/project-file.ts
 import { existsSync } from "fs";

package/dist/{chunk-ZD4ND6X6.js → chunk-OCVALOGK.js}

@@ -1,6 +1,6 @@
 import {
   ApiClientError
-} from "./chunk-RNAH5T4W.js";
+} from "./chunk-IDF46P7R.js";
 
 // src/help.ts
 function helpRequested(args) {

package/dist/{chunk-RQSJZWQC.js → chunk-WFMRNGO5.js}

@@ -1,14 +1,105 @@
-// ../store/dist/index.js
-import {
-  createHash,
-  createHmac,
-  createPublicKey,
-  generateKeyPairSync,
-  sign,
-  verify
-} from "crypto";
+// ../store/src/static.ts
+var STATIC_LIMITS = {
+  /** Bytes per file. Big enough for a wasm build or a texture atlas; a video does not belong. */
+  maxFileBytes: 32 * 1024 * 1024,
+  /** Files per deploy. */
+  maxFiles: 2e3,
+  /** Total bytes per deploy. */
+  maxTotalBytes: 256 * 1024 * 1024
+};
+function staticPathProblem(path2) {
+  if (path2.length === 0 || path2.length > 512) return "path must be 1-512 characters";
+  if (path2.startsWith("/")) return "path must be relative (no leading slash)";
+  if (path2.includes("\\")) return "path must use forward slashes";
+  if (/[\x00-\x1f\x7f]/.test(path2)) return "path must not contain control characters";
+  for (const segment of path2.split("/")) {
+    if (segment === "" || segment === "." || segment === "..") {
+      return "path segments must be non-empty and not . or ..";
+    }
+  }
+  return void 0;
+}
+
+// ../store/src/disk.ts
 import { mkdir, readFile, readdir, rename, rm, stat, writeFile } from "fs/promises";
 import * as path from "path";
+var DiskStore = class {
+  constructor(dir) {
+    this.dir = dir;
+  }
+  dir;
+  fileFor(key) {
+    if (!/^[A-Za-z0-9_.@/-]+$/.test(key) || key.includes("..")) {
+      throw new Error(`invalid object store key ${JSON.stringify(key)}`);
+    }
+    return path.join(this.dir, `${key}.snap`);
+  }
+  async put(key, bytes) {
+    const file = this.fileFor(key);
+    await mkdir(path.dirname(file), { recursive: true });
+    const tmp = `${file}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+    await writeFile(tmp, bytes);
+    for (let attempt = 0; ; attempt++) {
+      try {
+        await rename(tmp, file);
+        return;
+      } catch (err) {
+        const code = err.code;
+        if ((code === "EPERM" || code === "EBUSY") && attempt < 10) {
+          await new Promise((resolve) => setTimeout(resolve, 5 * (attempt + 1)));
+          continue;
+        }
+        throw err;
+      }
+    }
+  }
+  async get(key) {
+    try {
+      return new Uint8Array(await readFile(this.fileFor(key)));
+    } catch (err) {
+      if (err.code === "ENOENT") return void 0;
+      throw err;
+    }
+  }
+  async delete(key) {
+    await rm(this.fileFor(key), { force: true });
+  }
+  async list(prefix) {
+    const out = [];
+    const walk = async (dir, rel) => {
+      let entries;
+      try {
+        entries = await readdir(dir, { withFileTypes: true });
+      } catch (err) {
+        if (err.code === "ENOENT") return;
+        throw err;
+      }
+      for (const e of entries) {
+        const r = rel ? `${rel}/${e.name}` : e.name;
+        if (e.isDirectory()) await walk(path.join(dir, e.name), r);
+        else if (e.name.endsWith(".snap")) out.push(r.slice(0, -".snap".length));
+      }
+    };
+    await walk(this.dir, "");
+    return out.filter((k) => k.startsWith(prefix)).sort();
+  }
+  async sizes(prefix) {
+    const keys = await this.list(prefix);
+    const out = [];
+    for (const key of keys) {
+      try {
+        const st = await stat(this.fileFor(key));
+        out.push({ key, size: st.size, lastModified: Math.floor(st.mtimeMs) });
+      } catch (err) {
+        if (err.code === "ENOENT") continue;
+        throw err;
+      }
+    }
+    return out;
+  }
+};
+
+// ../store/src/kv.ts
 var KV_LIMITS = {
   /** Max UTF-8 bytes in one value. */
   valueBytes: 16 * 1024,
@@ -31,6 +122,16 @@ var KV_ERRORS = {
   forbidden: "E_KV_FORBIDDEN",
   unavailable: "E_KV_UNAVAILABLE"
 };
+
+// ../store/src/identity.ts
+import {
+  createHash,
+  createHmac,
+  createPublicKey,
+  generateKeyPairSync,
+  sign,
+  verify
+} from "crypto";
 var IRT_IDENTITY_ISSUER = "irt";
 var ASSERTION_TYP = "IRTA";
 var ASSERTION_ALG = "EdDSA";
@@ -131,6 +232,8 @@ function parseIdentityKeys(value) {
   }
   return out.slice(0, 2);
 }
+
+// ../store/src/leaderboard.ts
 var LEADERBOARD_ERRORS = {
   badBoard: "E_LB_BAD_BOARD",
   badScore: "E_LB_BAD_SCORE",
@@ -141,8 +244,21 @@ var LEADERBOARD_ERRORS = {
   /** D62-a: a `top` cursor that is not a cursor for the board and direction it arrived on. Its
    *  own code because the only thing to do about it is start again from the first page, which no
    *  other code in this table implies. */
-  badCursor: "E_LB_BAD_CURSOR"
+  badCursor: "E_LB_BAD_CURSOR",
+  // ---- M6 lane B: boards (D69) ----
+  /** A `?period=` that is not shaped like a period key. */
+  badPeriod: "E_LB_BAD_PERIOD",
+  /** A bucket name that breaks the board-name rules it shares. */
+  badBucket: "E_LB_BAD_BUCKET",
+  /** A bucketed board read or written without a bucket. Refused rather than merged or defaulted:
+   *  a read that silently answered every cohort at once would be a ranking nobody asked for. */
+  bucketRequired: "E_LB_BUCKET_REQUIRED",
+  /** A bucket on a board that declares none. Refused rather than ignored, because a submit whose
+   *  bucket was quietly dropped would put a cohort's scores on the wrong ranking. */
+  noBuckets: "E_LB_NO_BUCKETS"
 };
+
+// ../store/src/rating.ts
 var RATING_LIMITS = {
   /** Max players named in one report. A report is one rating period and decomposes into pairs,
    *  so the work is quadratic in this number; 64 is `MAX_QUEUE_SIZE`, which is the largest party
@@ -272,6 +388,8 @@ function ratingValueProblem(value) {
   }
   return void 0;
 }
+
+// ../store/src/saves.ts
 var SAVES_SEGMENT = "/saves/";
 var SAVE_ID_TIME_DIGITS = 17;
 var DEFAULT_SAVE_RETAIN = 10;
@@ -332,101 +450,12 @@ async function pruneSaves(store, saves, retain, log) {
   }
   return deleted;
 }
-var STATIC_LIMITS = {
-  /** Bytes per file. Big enough for a wasm build or a texture atlas; a video does not belong. */
-  maxFileBytes: 32 * 1024 * 1024,
-  /** Files per deploy. */
-  maxFiles: 2e3,
-  /** Total bytes per deploy. */
-  maxTotalBytes: 256 * 1024 * 1024
-};
-function staticPathProblem(path2) {
-  if (path2.length === 0 || path2.length > 512) return "path must be 1-512 characters";
-  if (path2.startsWith("/")) return "path must be relative (no leading slash)";
-  if (path2.includes("\\")) return "path must use forward slashes";
-  if (/[\x00-\x1f\x7f]/.test(path2)) return "path must not contain control characters";
-  for (const segment of path2.split("/")) {
-    if (segment === "" || segment === "." || segment === "..") {
-      return "path segments must be non-empty and not . or ..";
-    }
-  }
-  return void 0;
-}
-var DiskStore = class {
-  constructor(dir) {
-    this.dir = dir;
-  }
-  dir;
-  fileFor(key) {
-    if (!/^[A-Za-z0-9_.@/-]+$/.test(key) || key.includes("..")) {
-      throw new Error(`invalid object store key ${JSON.stringify(key)}`);
-    }
-    return path.join(this.dir, `${key}.snap`);
-  }
-  async put(key, bytes) {
-    const file = this.fileFor(key);
-    await mkdir(path.dirname(file), { recursive: true });
-    const tmp = `${file}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
-    await writeFile(tmp, bytes);
-    for (let attempt = 0; ; attempt++) {
-      try {
-        await rename(tmp, file);
-        return;
-      } catch (err) {
-        const code = err.code;
-        if ((code === "EPERM" || code === "EBUSY") && attempt < 10) {
-          await new Promise((resolve) => setTimeout(resolve, 5 * (attempt + 1)));
-          continue;
-        }
-        throw err;
-      }
-    }
-  }
-  async get(key) {
-    try {
-      return new Uint8Array(await readFile(this.fileFor(key)));
-    } catch (err) {
-      if (err.code === "ENOENT") return void 0;
-      throw err;
-    }
-  }
-  async delete(key) {
-    await rm(this.fileFor(key), { force: true });
-  }
-  async list(prefix) {
-    const out = [];
-    const walk = async (dir, rel) => {
-      let entries;
-      try {
-        entries = await readdir(dir, { withFileTypes: true });
-      } catch (err) {
-        if (err.code === "ENOENT") return;
-        throw err;
-      }
-      for (const e of entries) {
-        const r = rel ? `${rel}/${e.name}` : e.name;
-        if (e.isDirectory()) await walk(path.join(dir, e.name), r);
-        else if (e.name.endsWith(".snap")) out.push(r.slice(0, -".snap".length));
-      }
-    };
-    await walk(this.dir, "");
-    return out.filter((k) => k.startsWith(prefix)).sort();
-  }
-  async sizes(prefix) {
-    const keys = await this.list(prefix);
-    const out = [];
-    for (const key of keys) {
-      try {
-        const st = await stat(this.fileFor(key));
-        out.push({ key, size: st.size, lastModified: Math.floor(st.mtimeMs) });
-      } catch (err) {
-        if (err.code === "ENOENT") continue;
-        throw err;
-      }
-    }
-    return out;
-  }
-};
+
+// ../store/src/s3.ts
+import { createHash as createHash3 } from "crypto";
+
+// ../store/src/sigv4.ts
+import { createHash as createHash2, createHmac as createHmac2 } from "crypto";
 
 export {
   PLAYER_ISSUER_RE,

package/dist/{delete-project-VENS2B44.js → delete-project-MXUYNGAO.js}

@@ -2,11 +2,11 @@ import {
   HelpRequested,
   helpFor,
   helpRequested
-} from "./chunk-ZD4ND6X6.js";
+} from "./chunk-OCVALOGK.js";
 import {
   createApiClient,
   isLoginRequired
-} from "./chunk-RNAH5T4W.js";
+} from "./chunk-IDF46P7R.js";
 import {
   resolveControlUrlForUser
 } from "./chunk-UPHQM6NZ.js";

package/dist/deploy.d.ts

@@ -90,6 +90,8 @@ interface RunDeployResult {
 /** The room entry, or undefined when the project has none. `--room` naming a missing file still
  *  throws: that is a typo, not a project without a room. */
 declare function findRoomEntry(cwd: string, room: string | undefined): string | undefined;
+/** D70: the schema entry of a schema-only project, or `undefined` when it has none. */
+declare function findSchemaEntry(cwd: string): string | undefined;
 /** Every room type a project declares, resolved to entry files. */
 interface RoomTypeEntries {
     /** The entry `resolveEntry` would have picked: what a plain roomId gets. */
@@ -146,4 +148,4 @@ declare function deploy(args: readonly string[], deps?: {
     irtioPackages?: BundleOptions['irtioPackages'];
 }): Promise<void>;
 
-export { type DeployArgs, DeployRefusedError, type RoomTypeEntries, type RunDeployOptions, type RunDeployResult, USAGE, deploy, findRoomEntry, findRoomTypes, parseDeployArgs, runDeploy };
+export { type DeployArgs, DeployRefusedError, type RoomTypeEntries, type RunDeployOptions, type RunDeployResult, USAGE, deploy, findRoomEntry, findRoomTypes, findSchemaEntry, parseDeployArgs, runDeploy };