@kora-platform/cli 0.8.0-rc6 → 0.8.0-rc8

package/dist/api-client.d.ts

@@ -96,6 +96,13 @@ export declare function createPlatformApiClient(input: PlatformApiClientInput):
     }): Promise<{
         variables: RuntimeVariableRecord[];
     }>;
+    upsertRuntimeVariable(session: CliSessionState, orgId: string, inputData: {
+        environment: string;
+        name: string;
+        value: string;
+    }): Promise<{
+        variable: RuntimeVariableRecord;
+    }>;
     listOrgSecrets(session: CliSessionState, orgId: string, inputData?: {
         environment?: string;
     }): Promise<{

package/dist/api-client.js

@@ -98,6 +98,15 @@ export function createPlatformApiClient(input) {
                 session
             });
         },
+        async upsertRuntimeVariable(session, orgId, inputData) {
+            const { environment, name, value } = inputData;
+            return transport.requestJson({
+                body: { value },
+                method: "PUT",
+                path: withQuery(`/api/v1/orgs/${encodeURIComponent(orgId)}/runtime-variables/${encodeURIComponent(name)}`, { environment }),
+                session
+            });
+        },
         async listOrgSecrets(session, orgId, inputData = {}) {
             return transport.requestJson({
                 path: withQuery(`/api/v1/orgs/${encodeURIComponent(orgId)}/secrets`, inputData),

package/dist/api-types.d.ts

@@ -340,7 +340,7 @@ export interface RuntimeControlRunDetailRecord extends RuntimeControlRunRecord {
     failureLookupError?: string;
     historyLength?: number;
     historySizeBytes?: number;
-    state?: CliRecord;
+    state?: CliRecord | null;
     stateQueryError?: string;
 }
 export interface RuntimeControlRunStateRecord extends CliRecord {

package/dist/command-flags.d.ts

@@ -1,4 +1,5 @@
 import type { ParsedCommand } from "./runner.js";
 export declare function readOptionalStringFlag(parsed: ParsedCommand, name: string): string | undefined;
 export declare function readRequiredStringFlag(parsed: ParsedCommand, name: string): string;
+export declare function readRequiredStringFlagPreservingEmpty(parsed: ParsedCommand, name: string): string;
 export declare function readOptionalNumberFlag(parsed: ParsedCommand, name: string): number | undefined;

package/dist/command-flags.js

@@ -10,6 +10,13 @@ export function readRequiredStringFlag(parsed, name) {
     }
     return value;
 }
+export function readRequiredStringFlagPreservingEmpty(parsed, name) {
+    const value = parsed.flags[name];
+    if (typeof value !== "string") {
+        throw usageProblem(`Missing required flag --${name}.`, parsed.definition.id);
+    }
+    return value;
+}
 export function readOptionalNumberFlag(parsed, name) {
     const value = parsed.flags[name];
     return typeof value === "number" ? value : undefined;

package/dist/command-registry.js

@@ -755,7 +755,7 @@ const RAW_CLI_COMMANDS = [
         requiresActiveOrg: true
     }),
     command(["access", "members", "list"], "List organization members.", {
-        labels: ["read", "access"],
+        labels: ["read", "chat-read", "access"],
         flags: [
             flag("limit", "Maximum number of members to return.", {
                 acceptsValue: true,
@@ -770,7 +770,7 @@ const RAW_CLI_COMMANDS = [
         requiresActiveOrg: true
     }),
     command(["access", "members", "get"], "Show one organization member.", {
-        labels: ["read", "access"],
+        labels: ["read", "chat-read", "access"],
         args: [arg("user-id", "User id.")],
         requiresActiveOrg: true
     }),
@@ -793,7 +793,7 @@ const RAW_CLI_COMMANDS = [
         requiresActiveOrg: true
     }),
     command(["access", "invites", "list"], "List organization invites.", {
-        labels: ["read", "access"],
+        labels: ["read", "chat-read", "access"],
         flags: [
             flag("limit", "Maximum number of invites to return.", {
                 acceptsValue: true,
@@ -808,12 +808,12 @@ const RAW_CLI_COMMANDS = [
         requiresActiveOrg: true
     }),
     command(["access", "invites", "get"], "Show one organization invite.", {
-        labels: ["read", "access"],
+        labels: ["read", "chat-read", "access"],
         args: [arg("invite-id", "Invite id.")],
         requiresActiveOrg: true
     }),
     command(["access", "invites", "create"], "Create an organization invite.", {
-        labels: ["write", "access"],
+        labels: ["write", "chat-write", "access"],
         flags: [
             flag("email", "Invitee email address.", {
                 acceptsValue: true,
@@ -1107,6 +1107,23 @@ const RAW_CLI_COMMANDS = [
             })],
         requiresActiveOrg: true
     }),
+    command(["env", "set"], "Create or update one runtime variable without reading other values.", {
+        labels: ["write", "chat-write", "env"],
+        args: [arg("name", "Variable name.")],
+        flags: [
+            flag("environment", "Target environment.", {
+                acceptsValue: true,
+                required: true,
+                valueType: "string"
+            }),
+            flag("value", "Variable value.", {
+                acceptsValue: true,
+                required: true,
+                valueType: "string"
+            })
+        ],
+        requiresActiveOrg: true
+    }),
     command(["env", "replace"], "Replace the full runtime environment from JSON.", {
         labels: ["destructive", "env"],
         destructive: true,

package/dist/commands.js

@@ -3,7 +3,7 @@ import { executeAuthLogin, executeAuthLogout, executeAuthSignup, executeAuthWhoa
 import { getCliSchema, listCliSchemas } from "./schema-registry.js";
 import { createPlatformApiClient } from "./api-client.js";
 import { authProblem, genericProblem, notFoundProblem, usageProblem } from "./cli-errors.js";
-import { readOptionalNumberFlag, readOptionalStringFlag, readRequiredStringFlag } from "./command-flags.js";
+import { readOptionalNumberFlag, readOptionalStringFlag, readRequiredStringFlag, readRequiredStringFlagPreservingEmpty } from "./command-flags.js";
 import { executeArtifactDownload, executeArtifactArchive, executeArtifactInspect, executeArtifactInventory, executeArtifactList, executeArtifactPurge, executeArtifactRead, executeArtifactRestore, executeArtifactUpload } from "./artifact-commands.js";
 import { executeAudit } from "./audit-commands.js";
 import { isZipArchivePath, readArchiveBytes, readImportEntries, readJsonInputSpecifier, readWorkspaceTestEntries, readTextInputSpecifier, writeReleaseSourceFiles } from "./files.js";
@@ -164,6 +164,7 @@ export async function executeParsedCommand(parsed, context) {
             return executeExtensions(parsed, context, api, resolveOrgScope);
         case "env.list":
         case "env.get":
+        case "env.set":
         case "env.replace":
             return executeEnv(parsed, context, api);
         case "secrets.list":
@@ -1224,6 +1225,29 @@ async function executeEnv(parsed, context, api) {
                 meta: { command: parsed.definition.path.join(" "), environment, orgId: org.id }
             };
         }
+        case "env.set": {
+            const environment = readRequiredCliEnvironmentFlag(parsed);
+            const name = readRequiredArg(parsed, "name");
+            announceResolvedEnvironment(parsed, context, environment);
+            const data = await api.upsertRuntimeVariable(session, org.id, {
+                environment,
+                name,
+                value: readRequiredStringFlagPreservingEmpty(parsed, "value")
+            });
+            return {
+                data: {
+                    variable: {
+                        environmentKey: data.variable.environmentKey,
+                        name: data.variable.name,
+                        status: "defined",
+                        updatedAt: data.variable.updatedAt
+                    }
+                },
+                human: renderSuccess(`Saved runtime variable '${data.variable.name}' in ${environment}.`),
+                kind: "authoring_env_set",
+                meta: { command: parsed.definition.path.join(" "), environment, orgId: org.id }
+            };
+        }
         case "env.replace": {
             const environment = readRequiredCliEnvironmentFlag(parsed);
             const body = await readJsonInputSpecifier(String(parsed.flags.file), context.stdin, parsed.definition.id, { flag: "file" });

package/dist/runner.js

@@ -232,7 +232,10 @@ function parseInvocation(tokens, commandFilter) {
             positionals.push(token);
             continue;
         }
-        const [rawName = "", maybeValue] = token.slice(2).split("=", 2);
+        const rawFlag = token.slice(2);
+        const valueSeparatorIndex = rawFlag.indexOf("=");
+        const rawName = valueSeparatorIndex === -1 ? rawFlag : rawFlag.slice(0, valueSeparatorIndex);
+        const maybeValue = valueSeparatorIndex === -1 ? undefined : rawFlag.slice(valueSeparatorIndex + 1);
         const flag = flagDefinitions.get(rawName);
         if (!flag) {
             const detail = rawName === "output"
@@ -247,11 +250,16 @@ function parseInvocation(tokens, commandFilter) {
             flags[rawName] = true;
             continue;
         }
-        const valueSource = maybeValue ?? resolved.remainder[index + 1];
-        if (!valueSource || valueSource.startsWith("--")) {
-            throw usageProblem(`Flag '--${rawName}' requires a value.`, definition.path.join(" "));
+        let valueSource;
+        if (maybeValue !== undefined) {
+            valueSource = maybeValue;
         }
-        if (maybeValue === undefined) {
+        else {
+            const nextValue = resolved.remainder[index + 1];
+            if (!nextValue || nextValue.startsWith("--")) {
+                throw usageProblem(`Flag '--${rawName}' requires a value.`, definition.path.join(" "));
+            }
+            valueSource = nextValue;
             index += 1;
         }
         const coercedValue = coerceFlagValue(flag.valueType ?? "string", valueSource, rawName, definition.path.join(" "));

package/dist/session-store.js

@@ -1,5 +1,10 @@
+import { mkdir, open, rm, stat } from "node:fs/promises";
+import { dirname } from "node:path";
 import { readSessionFile, removeSessionFile, writeSessionFile } from "./session.js";
+const REFRESH_LOCK_STALE_MS = 30_000;
+const REFRESH_LOCK_RETRY_MS = 25;
 export function createFileSessionStore(path) {
+    const refreshLockPath = `${path}.refresh.lock`;
     return {
         async clear() {
             await removeSessionFile(path);
@@ -9,11 +14,15 @@ export function createFileSessionStore(path) {
         },
         async write(session) {
             await writeSessionFile(path, session);
+        },
+        async withRefreshLock(operation) {
+            return withFileRefreshLock(refreshLockPath, operation);
         }
     };
 }
 export function createMemorySessionStore(initial = null) {
     let current = initial;
+    let refreshLock = Promise.resolve();
     return {
         async clear() {
             current = null;
@@ -23,6 +32,77 @@ export function createMemorySessionStore(initial = null) {
         },
         async write(session) {
             current = session;
+        },
+        async withRefreshLock(operation) {
+            const previous = refreshLock;
+            let release;
+            refreshLock = new Promise((resolve) => {
+                release = resolve;
+            });
+            await previous;
+            try {
+                return await operation();
+            }
+            finally {
+                release();
+            }
         }
     };
 }
+async function withFileRefreshLock(lockPath, operation) {
+    const release = await acquireFileRefreshLock(lockPath);
+    try {
+        return await operation();
+    }
+    finally {
+        await release();
+    }
+}
+async function acquireFileRefreshLock(lockPath) {
+    await mkdir(dirname(lockPath), { recursive: true });
+    while (true) {
+        try {
+            const handle = await open(lockPath, "wx", 0o600);
+            try {
+                await handle.writeFile(`${String(process.pid)} ${new Date().toISOString()}\n`);
+            }
+            finally {
+                await handle.close();
+            }
+            return async () => {
+                await rm(lockPath, { force: true });
+            };
+        }
+        catch (error) {
+            if (!isFileExistsError(error)) {
+                throw error;
+            }
+            await removeStaleFileRefreshLock(lockPath);
+            await sleep(REFRESH_LOCK_RETRY_MS);
+        }
+    }
+}
+async function removeStaleFileRefreshLock(lockPath) {
+    try {
+        const fileStat = await stat(lockPath);
+        if (Date.now() - fileStat.mtimeMs > REFRESH_LOCK_STALE_MS) {
+            await rm(lockPath, { force: true });
+        }
+    }
+    catch (error) {
+        if (!isMissingFileError(error)) {
+            throw error;
+        }
+    }
+}
+async function sleep(ms) {
+    await new Promise((resolve) => {
+        setTimeout(resolve, ms);
+    });
+}
+function isFileExistsError(error) {
+    return Boolean(error && typeof error === "object" && "code" in error && error.code === "EEXIST");
+}
+function isMissingFileError(error) {
+    return Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
+}

package/dist/transport-refresh.d.ts

@@ -0,0 +1,10 @@
+import type { CliSessionState } from "./session.js";
+import type { SessionStore } from "./transport.js";
+export declare function refreshSessionWithCoordination(input: {
+    isRefreshTokenInvalidError: (error: unknown) => boolean;
+    refreshSessionDirect: (session: CliSessionState) => Promise<CliSessionState>;
+    session: CliSessionState;
+    sessionStore: SessionStore;
+    shouldRefresh: (session: CliSessionState) => boolean;
+}): Promise<CliSessionState>;
+export declare function resolveEffectiveSession(requestSession: CliSessionState | null, sessionStore: SessionStore): Promise<CliSessionState | null>;

package/dist/transport-refresh.js

@@ -0,0 +1,51 @@
+export async function refreshSessionWithCoordination(input) {
+    return withRefreshLock(input.sessionStore, async () => {
+        const effectiveSession = (await resolveEffectiveSession(input.session, input.sessionStore)) ?? input.session;
+        if (isSessionNewer(effectiveSession, input.session) && !input.shouldRefresh(effectiveSession)) {
+            return effectiveSession;
+        }
+        try {
+            return await input.refreshSessionDirect(effectiveSession);
+        }
+        catch (error) {
+            if (input.isRefreshTokenInvalidError(error)) {
+                const recoveredSession = await resolveEffectiveSession(input.session, input.sessionStore);
+                if (recoveredSession &&
+                    isSessionNewer(recoveredSession, input.session) &&
+                    !input.shouldRefresh(recoveredSession)) {
+                    return recoveredSession;
+                }
+            }
+            throw error;
+        }
+    });
+}
+async function withRefreshLock(sessionStore, operation) {
+    return sessionStore.withRefreshLock
+        ? sessionStore.withRefreshLock(operation)
+        : operation();
+}
+export async function resolveEffectiveSession(requestSession, sessionStore) {
+    if (!requestSession) {
+        return null;
+    }
+    const storedSession = await sessionStore.read();
+    if (!storedSession || !isSameSessionIdentity(storedSession, requestSession)) {
+        return requestSession;
+    }
+    return isSessionNewer(storedSession, requestSession) ? storedSession : requestSession;
+}
+function isSameSessionIdentity(candidate, current) {
+    return candidate.baseUrl === current.baseUrl
+        && candidate.user.id === current.user.id
+        && candidate.accessTokenPayload.sub === current.accessTokenPayload.sub;
+}
+function isSessionNewer(candidate, current) {
+    if (candidate.accessToken === current.accessToken && candidate.refreshToken === current.refreshToken) {
+        return false;
+    }
+    if (candidate.accessTokenPayload.exp !== current.accessTokenPayload.exp) {
+        return candidate.accessTokenPayload.exp > current.accessTokenPayload.exp;
+    }
+    return candidate.accessTokenPayload.iat >= current.accessTokenPayload.iat;
+}

package/dist/transport.d.ts

@@ -2,6 +2,7 @@ import { type CliSessionState } from "./session.js";
 export interface SessionStore {
     clear(): Promise<void>;
     read(): Promise<CliSessionState | null>;
+    withRefreshLock?<T>(operation: () => Promise<T>): Promise<T>;
     write(session: CliSessionState): Promise<void>;
 }
 export interface CliAuthSettings {

package/dist/transport.js

@@ -1,5 +1,6 @@
 import { normalizePublicErrorCode, readPublicErrorCodeFromType } from "./error-code.js";
 import { extractRefreshTokenFromHeaders } from "./session.js";
+import { refreshSessionWithCoordination, resolveEffectiveSession } from "./transport-refresh.js";
 export class ApiError extends Error {
     code;
     detail;
@@ -28,6 +29,13 @@ export class ApiError extends Error {
 }
 export function createPlatformTransport(input) {
     const now = input.now ?? Date.now;
+    const refreshSession = async (session) => refreshSessionWithCoordination({
+        isRefreshTokenInvalidError,
+        refreshSessionDirect: async (effectiveSession) => refreshSessionDirect(input.sessionStore, effectiveSession),
+        session,
+        sessionStore: input.sessionStore,
+        shouldRefresh: (effectiveSession) => shouldRefresh(effectiveSession, now)
+    });
     return {
         async getAuthSettings(baseUrl) {
             const normalizedBaseUrl = normalizeBaseUrl(baseUrl);
@@ -116,18 +124,7 @@ export function createPlatformTransport(input) {
             return { session, status: "approved" };
         },
         async refreshSession(session) {
-            const response = await fetch(joinBaseUrl(session.baseUrl, "/api/v1/auth/refresh"), {
-                body: JSON.stringify({
-                    refreshToken: session.refreshToken
-                }),
-                headers: {
-                    "content-type": "application/json"
-                },
-                method: "POST"
-            });
-            const nextSession = await parseSessionResponse(response, session.baseUrl, "/api/v1/auth/refresh", session.activeOrg);
-            await input.sessionStore.write(nextSession);
-            return nextSession;
+            return refreshSession(session);
         },
         async requestJson(request) {
             let session = await resolveEffectiveSession(request.session, input.sessionStore);
@@ -141,11 +138,11 @@ export function createPlatformTransport(input) {
                 });
             }
             if (shouldRefresh(session, now) && canRefresh(session)) {
-                session = await this.refreshSession(session);
+                session = await refreshSession(session);
             }
             const firstResponse = await authenticatedFetch(session, request);
             if (firstResponse.status === 401 && canRefresh(session)) {
-                session = await this.refreshSession(session);
+                session = await refreshSession(session);
                 return handleJsonResponse(await authenticatedFetch(session, request), request.path);
             }
             return handleJsonResponse(firstResponse, request.path);
@@ -162,17 +159,36 @@ export function createPlatformTransport(input) {
                 });
             }
             if (shouldRefresh(session, now) && canRefresh(session)) {
-                session = await this.refreshSession(session);
+                session = await refreshSession(session);
             }
             const firstResponse = await authenticatedFetch(session, request);
             if (firstResponse.status === 401 && canRefresh(session)) {
-                session = await this.refreshSession(session);
+                session = await refreshSession(session);
                 return handleBytesResponse(await authenticatedFetch(session, request), request);
             }
             return handleBytesResponse(firstResponse, request);
         }
     };
 }
+async function refreshSessionDirect(sessionStore, session) {
+    const response = await fetch(joinBaseUrl(session.baseUrl, "/api/v1/auth/refresh"), {
+        body: JSON.stringify({
+            refreshToken: session.refreshToken
+        }),
+        headers: {
+            "content-type": "application/json"
+        },
+        method: "POST"
+    });
+    const nextSession = await parseSessionResponse(response, session.baseUrl, "/api/v1/auth/refresh", session.activeOrg);
+    await sessionStore.write(nextSession);
+    return nextSession;
+}
+function isRefreshTokenInvalidError(error) {
+    return error instanceof ApiError &&
+        error.code === "auth/token_invalid" &&
+        error.instance === "/api/v1/auth/refresh";
+}
 async function authenticatedFetch(session, request) {
     const body = resolveRequestBody(request.body, session);
     const hasJsonBody = body !== undefined;
@@ -389,27 +405,3 @@ function shouldRefresh(session, now) {
 function canRefresh(session) {
     return session.refreshToken.trim().length > 0;
 }
-async function resolveEffectiveSession(requestSession, sessionStore) {
-    if (!requestSession) {
-        return null;
-    }
-    const storedSession = await sessionStore.read();
-    if (!storedSession || !isSameSessionIdentity(storedSession, requestSession)) {
-        return requestSession;
-    }
-    return isSessionNewer(storedSession, requestSession) ? storedSession : requestSession;
-}
-function isSameSessionIdentity(candidate, current) {
-    return candidate.baseUrl === current.baseUrl
-        && candidate.user.id === current.user.id
-        && candidate.accessTokenPayload.sub === current.accessTokenPayload.sub;
-}
-function isSessionNewer(candidate, current) {
-    if (candidate.accessToken === current.accessToken && candidate.refreshToken === current.refreshToken) {
-        return false;
-    }
-    if (candidate.accessTokenPayload.exp !== current.accessTokenPayload.exp) {
-        return candidate.accessTokenPayload.exp > current.accessTokenPayload.exp;
-    }
-    return candidate.accessTokenPayload.iat >= current.accessTokenPayload.iat;
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kora-platform/cli",
-  "version": "0.8.0-rc6",
+  "version": "0.8.0-rc8",
   "private": false,
   "type": "module",
   "main": "dist/library.js",