@kinotic-ai/kinotic-cli 2.2.0 → 2.3.0

package/dist/internal/CliAuthenticator.js

@@ -0,0 +1,217 @@
+import { ConnectionInfo, Kinotic } from '@kinotic-ai/core';
+import { confirm } from '@inquirer/prompts';
+import open from 'open';
+import pTimeout from 'p-timeout';
+import { WebSocket } from 'ws';
+import { createStateManager } from './state/IStateManager.js';
+/** State key the rotating refresh token is persisted under, keyed by server url. */
+const CREDENTIALS_KEY = 'kinotic-credentials';
+/** Per-request timeout for REST calls to the Kinotic Server. */
+const FETCH_TIMEOUT_MS = 30_000;
+/**
+ * CLI authentication against a Kinotic server using the OAuth 2.0 Device Authorization Grant
+ * (RFC 8628). {@link login} runs the interactive browser flow once and stores the refresh
+ * token; {@link connect} uses that stored token to open an authenticated {@link Kinotic}
+ * connection, refreshing the short-lived access token before every (re)connect.
+ */
+export class CliAuthenticator {
+    server;
+    configDir;
+    logger;
+    refreshToken = null;
+    accessToken = null;
+    accessTokenExpiresAt = 0;
+    /**
+     * @param server the server url to authenticate against
+     * @param configDir directory the rotating refresh token is persisted in
+     * @param logger sink for user-facing progress messages
+     */
+    constructor(server, configDir, logger) {
+        this.server = server;
+        this.configDir = configDir;
+        this.logger = logger;
+    }
+    /**
+     * Runs the interactive device-authorization login and persists the refresh token, so
+     * later {@link connect} calls — this run or a future one — are non-interactive.
+     *
+     * @return true if login succeeded
+     */
+    async login() {
+        const target = this.parseServer();
+        if (target === null) {
+            return false;
+        }
+        const tokens = await this.deviceLogin(target.restBaseUrl);
+        if (tokens === null) {
+            return false;
+        }
+        await this.saveRefreshToken(tokens.refresh_token);
+        return true;
+    }
+    /**
+     * Opens an authenticated {@link Kinotic} connection using the stored refresh token. Fails
+     * fast — with no interactive prompt — when there are no stored credentials.
+     *
+     * @return true if the connection was established
+     */
+    async connect() {
+        try {
+            const target = this.parseServer();
+            if (target === null) {
+                return false;
+            }
+            this.refreshToken = await this.loadRefreshToken();
+            if (this.refreshToken === null) {
+                this.logger.log('Not logged in. Run `kinotic login` first.');
+                return false;
+            }
+            const connectionInfo = new ConnectionInfo();
+            connectionInfo.host = target.host;
+            connectionInfo.port = target.port;
+            connectionInfo.useSSL = target.useSSL;
+            // The CLI is a Node client: it attaches the access token as a WebSocket upgrade
+            // header. The factory is async so the token is refreshed before each (re)connect.
+            connectionInfo.webSocketFactory = async () => {
+                const token = await this.freshAccessToken(target.restBaseUrl);
+                return new WebSocket(target.wsUrl, {
+                    headers: { Authorization: 'Bearer ' + token }
+                });
+            };
+            await pTimeout(Kinotic.connect(connectionInfo), {
+                milliseconds: 60000,
+                message: 'Connection timeout trying to connect to the Kinotic Server'
+            });
+            return true;
+        }
+        catch (e) {
+            this.logger.log('Could not connect to the Kinotic Server: '
+                + (e instanceof Error ? e.message : String(e)));
+            return false;
+        }
+    }
+    /**
+     * Returns a valid access token, refreshing it — and persisting the rotated refresh token —
+     * when it is absent or within 10s of expiry.
+     */
+    async freshAccessToken(restBaseUrl) {
+        if (this.accessToken !== null && Date.now() < this.accessTokenExpiresAt - 10_000) {
+            return this.accessToken;
+        }
+        const res = await fetch(restBaseUrl + '/api/login/device/refresh', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ refresh_token: this.refreshToken }),
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+        });
+        if (!res.ok) {
+            throw new Error('Session expired. Run `kinotic login` again.');
+        }
+        const tokens = await res.json();
+        this.refreshToken = tokens.refresh_token;
+        this.accessToken = tokens.access_token;
+        this.accessTokenExpiresAt = Date.now() + (tokens.expires_in ?? 60) * 1000;
+        await this.saveRefreshToken(this.refreshToken);
+        return this.accessToken;
+    }
+    /** Parses the server url into the host/port the gateway serves both REST and STOMP on. */
+    parseServer() {
+        const url = new URL(this.server);
+        if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+            this.logger.log('Invalid server URL, only http and https are supported');
+            return null;
+        }
+        const useSSL = url.protocol === 'https:';
+        // Locally the server url often points at the static web port; the gateway
+        // (REST + STOMP) always listens on 58503, so the port is overridden.
+        let port;
+        if (url.hostname === 'localhost' || url.hostname === '127.0.0.1') {
+            port = 58503;
+        }
+        else if (url.port) {
+            port = Number(url.port);
+        }
+        else {
+            port = useSSL ? 443 : 58503;
+        }
+        return {
+            host: url.hostname,
+            port,
+            useSSL,
+            restBaseUrl: (useSSL ? 'https' : 'http') + '://' + url.hostname + ':' + port,
+            wsUrl: (useSSL ? 'wss' : 'ws') + '://' + url.hostname + ':' + port + '/v1'
+        };
+    }
+    /** Runs the RFC 8628 device flow: start, browser approval, then poll for tokens. */
+    async deviceLogin(restBaseUrl) {
+        const startRes = await fetch(restBaseUrl + '/api/login/device/start', {
+            method: 'POST',
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+        });
+        if (!startRes.ok) {
+            this.logger.log('Could not start device authorization with the Kinotic Server.');
+            return null;
+        }
+        const start = await startRes.json();
+        this.logger.log('Authenticate your account at:');
+        this.logger.log(start.verification_uri_complete);
+        this.logger.log(`Your code is: ${start.user_code}`);
+        const answer = await confirm({ message: 'Open in browser?', default: true });
+        if (answer) {
+            await open(start.verification_uri_complete);
+        }
+        const deadline = Date.now() + start.expires_in * 1000;
+        let intervalMs = Math.max(start.interval, 1) * 1000;
+        while (Date.now() < deadline) {
+            await delay(intervalMs);
+            const tokenRes = await fetch(restBaseUrl + '/api/login/device/token', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ device_code: start.device_code }),
+                signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+            });
+            if (tokenRes.ok) {
+                return await tokenRes.json();
+            }
+            const error = await readErrorCode(tokenRes);
+            if (error === 'slow_down') {
+                intervalMs += 5000;
+            }
+            else if (error !== 'authorization_pending') {
+                this.logger.log(`Device authorization failed: ${error}`);
+                return null;
+            }
+        }
+        this.logger.log('Device authorization timed out before it was approved.');
+        return null;
+    }
+    async loadRefreshToken() {
+        const stateManager = createStateManager(this.configDir);
+        if (!(await stateManager.containsState(CREDENTIALS_KEY))) {
+            return null;
+        }
+        const credentials = await stateManager.load(CREDENTIALS_KEY);
+        return credentials[this.server] ?? null;
+    }
+    async saveRefreshToken(refreshToken) {
+        const stateManager = createStateManager(this.configDir);
+        let credentials = {};
+        if (await stateManager.containsState(CREDENTIALS_KEY)) {
+            credentials = await stateManager.load(CREDENTIALS_KEY);
+        }
+        credentials[this.server] = refreshToken;
+        await stateManager.save(CREDENTIALS_KEY, credentials);
+    }
+}
+async function readErrorCode(res) {
+    try {
+        const body = await res.json();
+        return body.error ?? 'unknown_error';
+    }
+    catch {
+        return 'unknown_error';
+    }
+}
+function delay(ms) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+}

package/dist/internal/Utils.d.ts

@@ -5,23 +5,7 @@ export type GeneratedServiceInfo = {
     entityServiceName: string;
     namedQueries: FunctionDefinition[];
 };
-export declare class SessionMetadata {
-    sessionId: string;
-    replyToId: string;
-    constructor(sessionId: string, replyToId: string);
-}
 export declare function jsonStringifyReplacer(key: any, value: any): any;
-/**
- * Connects to the server and upgrades the session to a CLI session
- * Currently this works by connecting and waiting for the clients session id on the event bus
- * The cli then disconnects and reconnects using the clients' session.
- * This will be replaced when the server supports a session upgrade command
- * @param server the server to connect to
- * @param logger the logger to use
- * @param authHeadersFile path to a file containing the auth headers
- * @return true if the session was upgraded successfully
- */
-export declare function connectAndUpgradeSession(server: string, logger: Logger, authHeadersFile?: string): Promise<boolean>;
 export type EntityInfo = {
     exportedFromFile: string;
     defaultExport: boolean;

package/dist/internal/Utils.js

@@ -1,24 +1,11 @@
-import { Kinotic, Event, EventConstants, ParticipantConstants } from '@kinotic-ai/core';
 import { ObjectC3Type } from '@kinotic-ai/idl';
 import fs from 'fs';
 import fsPromises from 'fs/promises';
-import { confirm } from '@inquirer/prompts';
-import open from 'open';
-import pTimeout from 'p-timeout';
 import path from 'path';
 import { IndentationText, Node, Project } from 'ts-morph';
-import { v4 as uuidv4 } from 'uuid';
 import { createConversionContext } from './converter/IConversionContext.js';
 import { TypescriptConversionState } from './converter/typescript/TypescriptConversionState.js';
 import { TypescriptConverterStrategy } from './converter/typescript/TypescriptConverterStrategy.js';
-export class SessionMetadata {
-    sessionId;
-    replyToId;
-    constructor(sessionId, replyToId) {
-        this.sessionId = sessionId;
-        this.replyToId = replyToId;
-    }
-}
 function isEmpty(value) {
     if (value === null || value === undefined) {
         return true;
@@ -36,134 +23,6 @@ export function jsonStringifyReplacer(key, value) {
         ? undefined
         : value;
 }
-/**
- * Connects to the server and upgrades the session to a CLI session
- * Currently this works by connecting and waiting for the clients session id on the event bus
- * The cli then disconnects and reconnects using the clients' session.
- * This will be replaced when the server supports a session upgrade command
- * @param server the server to connect to
- * @param logger the logger to use
- * @param authHeadersFile path to a file containing the auth headers
- * @return true if the session was upgraded successfully
- */
-export async function connectAndUpgradeSession(server, logger, authHeadersFile) {
-    try {
-        const serverURL = new URL(server);
-        if (serverURL.protocol !== 'http:' && serverURL.protocol !== 'https:') {
-            logger.log('Invalid server URL, only http and https are supported');
-            return false;
-        }
-        let connectionInfo = { host: '' };
-        if (serverURL.hostname === 'localhost' || serverURL.hostname === '127.0.0.1') {
-            connectionInfo.host = serverURL.hostname;
-            connectionInfo.port = 58503;
-        }
-        else {
-            connectionInfo.host = serverURL.hostname;
-            if (serverURL.protocol === 'https:') {
-                connectionInfo.useSSL = true;
-                connectionInfo.port = 443;
-            }
-            if (serverURL.port) {
-                connectionInfo.port = Number(serverURL.port);
-            }
-            else if (!connectionInfo.useSSL) {
-                connectionInfo.port = 58503;
-            }
-        }
-        if (authHeadersFile) {
-            if (!fs.existsSync(authHeadersFile)) {
-                logger.log(`Authentication header file ${authHeadersFile} does not exist. Please provide a valid file.`);
-                return false;
-            }
-            else {
-                logger.log(`Authentication header file ${authHeadersFile} loaded successfully. Using authentication headers to connect to the Kinotic Server.`);
-            }
-            const authHeaders = JSON.parse(fs.readFileSync(authHeadersFile, 'utf8'));
-            connectionInfo.connectHeaders = authHeaders;
-            const connectedInfo = await pTimeout(Kinotic.connect(connectionInfo), {
-                milliseconds: 60000,
-                message: 'Connection timeout trying to connect to the Kinotic Server'
-            });
-            if (connectedInfo) {
-                return true;
-            }
-            else {
-                return false;
-            }
-        }
-        else {
-            connectionInfo.connectHeaders = {
-                login: ParticipantConstants.CLI_PARTICIPANT_ID
-            };
-            const connectedInfo = await pTimeout(Kinotic.connect(connectionInfo), {
-                milliseconds: 60000,
-                message: 'Connection timeout trying to connect to the Kinotic Server'
-            });
-            if (connectedInfo) {
-                // This works because any client can subscribe to a destination that is scoped to the connectedInfo.replyToId
-                const scope = connectedInfo.replyToId + ':' + uuidv4();
-                const url = server + (server.endsWith('/') ? '' : '/') + '#/sessionUpgrade/' + encodeURIComponent(scope);
-                logger.log('Authenticate your account at:');
-                logger.log(url);
-                const answer = await confirm({
-                    message: 'Open in browser?',
-                    default: true,
-                });
-                if (answer) {
-                    await open(url);
-                }
-                else {
-                    logger.log('Browser will not be opened. You must authenticate your account before continuing.');
-                }
-                const sessionMetadata = await receiveSessionId(scope);
-                await Kinotic.disconnect();
-                connectionInfo.connectHeaders = {
-                    session: sessionMetadata.sessionId
-                };
-                // Provide this so the continuum client will use the same replyToId as the session
-                connectionInfo.connectHeaders[EventConstants.REPLY_TO_ID_HEADER] = sessionMetadata.replyToId;
-                await Kinotic.connect(connectionInfo);
-                logger.log('Authenticated successfully\n');
-                return true;
-            }
-            else {
-                logger.log("Could not connect to the Kinotic Server. Please check the server is running and the URL is correct.");
-                return false;
-            }
-        }
-    }
-    catch (e) {
-        logger.log("Could not connect to the Kinotic Server. Please check the server is running and the URL is correct.", e);
-        return false;
-    }
-}
-function receiveSessionId(scope) {
-    const subscribeCRI = EventConstants.SERVICE_DESTINATION_PREFIX + scope + '@continuum.cli.SessionUpgradeService';
-    return new Promise((resolve, reject) => {
-        const subscription = Kinotic.eventBus.observe(subscribeCRI).subscribe((value) => {
-            // send reply to user
-            const replyTo = value.getHeader(EventConstants.REPLY_TO_HEADER);
-            if (replyTo) {
-                const replyEvent = new Event(replyTo);
-                const correlationId = value.getHeader(EventConstants.CORRELATION_ID_HEADER);
-                if (correlationId) {
-                    replyEvent.setHeader(EventConstants.CORRELATION_ID_HEADER, correlationId);
-                }
-                replyEvent.setHeader(EventConstants.CONTENT_TYPE_HEADER, EventConstants.CONTENT_JSON);
-                Kinotic.eventBus.send(replyEvent);
-            }
-            subscription.unsubscribe();
-            const jsonObj = JSON.parse(value.getDataString());
-            if (jsonObj?.length > 0) {
-                resolve(jsonObj[0]);
-            }
-            else {
-                reject('No Session Id found in data');
-            }
-        });
-    });
-}
 function getEntityDecoratorIfExists(node) {
     if (Node.isClassDeclaration(node)) {
         return node.getDecorator('Entity');

package/dist/templates/entity/BaseRepository.liquid

@@ -19,7 +19,7 @@ export class Base{{ entityName }}Repository extends EntityRepository<{{ entityNa
     this.shouldValidate = shouldValidate
   }
 
-  protected async beforeSaveOrUpdate(entity: {{ entityName }}): Promise<{{ entityName }}> {
+  protected override async beforeSaveOrUpdate(entity: {{ entityName }}): Promise<{{ entityName }}> {
     if (this.shouldValidate) {
       return this.validate(entity)
     } else {
@@ -27,7 +27,7 @@ export class Base{{ entityName }}Repository extends EntityRepository<{{ entityNa
     }
   }
 
-  protected async beforeBulkSaveOrUpdate(entities: {{ entityName }}[]): Promise<{{ entityName }}[]> {
+  protected override async beforeBulkSaveOrUpdate(entities: {{ entityName }}[]): Promise<{{ entityName }}[]> {
     if (this.shouldValidate) {
       const validatedEntities: {{ entityName }}[] = []
       for (let entity of entities) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kinotic-ai/kinotic-cli",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "Kinotic CLI provides the ability to build, deploy, and manage Kinotic applications that run on the Kinotic OS.",
   "author": "Kinotic Developers",
   "bin": {
@@ -14,34 +14,27 @@
   "files": [
     "/bin",
     "/dist",
-    "/npm-shrinkwrap.json",
-    "/oclif.manifest.json"
+    "/npm-shrinkwrap.json"
   ],
   "dependencies": {
     "@inquirer/prompts": "^8.3.2",
-    "@kinotic-ai/core": "^1.1.1",
+    "@kinotic-ai/core": "^1.4.0",
     "@kinotic-ai/idl": "^1.0.9",
-    "@kinotic-ai/os-api": "^1.1.0",
-    "@kinotic-ai/persistence": "^1.2.0",
+    "@kinotic-ai/os-api": "^1.5.1",
+    "@kinotic-ai/persistence": "^1.2.1",
     "@oclif/core": "^4.9.0",
-    "@oclif/plugin-autocomplete": "^3.2.41",
-    "@oclif/plugin-help": "^6",
-    "@oclif/plugin-not-found": "^3.2.75",
-    "@oclif/plugin-plugins": "^5.4.58",
-    "@oclif/plugin-update": "^4.7.23",
-    "@oclif/plugin-warn-if-update-available": "^3.1.55",
     "c12": "^3.3.3",
     "chalk": "^5.6.2",
     "execa": "^9.6.1",
     "glob": "^13.0.6",
     "graphql": "^16.13.1",
-    "liquidjs": "10.25.1",
+    "liquidjs": "10.25.7",
     "open": "^11.0.0",
     "ora": "^9.3.0",
     "p-timeout": "^7.0.1",
     "radash": "^12.1.1",
     "reflect-metadata": "^0.2.2",
-    "simple-git": "^3.33.0",
+    "simple-git": "3.36.0",
     "terminal-link": "^5.0.0",
     "ts-morph": "^27.0.2",
     "uuid": "^13.0.0",
@@ -50,7 +43,6 @@
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@oclif/test": "^4.1.16",
     "@types/chai": "^5",
     "@types/inquirer": "^9.0.9",
     "@types/mocha": "^10.0.10",
@@ -59,10 +51,8 @@
     "@types/ws": "^8.18.1",
     "chai": "^6",
     "eslint": "^9",
-    "eslint-config-oclif": "^6",
     "eslint-config-prettier": "^10",
     "mocha": "^11",
-    "oclif": "^4.22.92",
     "shx": "^0.4.0",
     "tslib": "^2.8.1",
     "tsx": "^4.21.0",
@@ -73,14 +63,6 @@
     "bin": "kinotic",
     "dirname": "kinotic",
     "commands": "./dist/commands",
-    "plugins": [
-      "@oclif/plugin-help",
-      "@oclif/plugin-plugins",
-      "@oclif/plugin-update",
-      "@oclif/plugin-not-found",
-      "@oclif/plugin-warn-if-update-available",
-      "@oclif/plugin-autocomplete"
-    ],
     "topicSeparator": " ",
     "topics": {
       "create": {
@@ -91,16 +73,14 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "keywords": [
-    "oclif"
-  ],
+  "keywords": [],
   "types": "dist/index.d.ts",
   "scripts": {
     "build": "shx rm -rf dist && tsc -b && tsc-alias -f && pnpm run copy-files",
     "lint": "eslint . --ext .ts --config .eslintrc",
     "posttest": "pnpm lint",
     "test": "mocha --forbid-only \"test/**/*.test.ts\"",
-    "version": "oclif readme && git add README.md",
+    "version": "git add README.md",
     "copy-files": "cp -r ./src/templates/  ./dist/templates/"
   }
 }

package/bin/dev.cmd

@@ -1,3 +0,0 @@
-@echo off
-
-node "%~dp0\dev" %*

package/bin/dev.js

@@ -1,6 +0,0 @@
-#!/usr/bin/env tsx
-// eslint-disable-next-line node/shebang
-(async () => {
-  const oclif = await import('@oclif/core')
-  await oclif.execute({type: 'esm', development: true, dir: import.meta.url})
-})()

package/bin/run.cmd

@@ -1,3 +0,0 @@
-@echo off
-
-node "%~dp0\run" %*

package/bin/run.js

@@ -1,6 +0,0 @@
-#!/usr/bin/env node
-// eslint-disable-next-line node/shebang
-(async () => {
-  const oclif = await import('@oclif/core')
-  await oclif.execute({type: 'esm', dir: import.meta.url})
-})()