@manyoars/oars 0.1.1 → 0.3.0

package/dist/commands/login.js

@@ -1,14 +1,12 @@
 import { CliError, ExitCode } from '../errors.js';
+import { discoverIssuer, resolveIssuerUrl } from '../issuer.js';
 import { awaitDeviceTokens, discover, startDeviceAuthorization } from '../oidc.js';
 import { exchangeKeycloakToken } from '../session.js';
 const STEP = 'login';
 /** RFC 8628 device flow on Keycloak, then the exchange; stores the credentials. */
 export const login = async (deps, options) => {
-    const issuerUrl = options.issuerUrl ?? deps.env.OARS_ISSUER_URL;
-    if (issuerUrl === undefined || issuerUrl === '') {
-        throw new CliError('No Keycloak issuer URL: pass --issuer-url or set OARS_ISSUER_URL.', ExitCode.USAGE, 'usage');
-    }
-    const config = await discover(issuerUrl, { ...deps, step: STEP });
+    const issuerUrl = await resolveIssuerUrl(deps, options.issuerUrl);
+    const config = await discoverIssuer(deps, options.issuerUrl, () => discover(issuerUrl, { ...deps, step: STEP }));
     const device = await startDeviceAuthorization(config, STEP);
     const url = device.verification_uri_complete ?? device.verification_uri;
     deps.io.stderr(`To sign in, open ${url}\nand confirm the code ${device.user_code}\n`);

package/dist/errors.d.ts

@@ -8,32 +8,32 @@ export declare const ExitCode: {
     readonly AUTH: 3;
     readonly INVALID: 4;
     readonly CONFLICT: 5;
-    readonly HUMAN: 6;
     readonly RATE_LIMITED: 7;
     readonly UNREACHABLE: 8;
-    readonly PARTIAL: 9;
+    /** `pool fetch` hit the pool's weekly cap: nothing is wrong, and the bundle on disk is untouched. */
+    readonly CAPPED: 10;
 };
 export type ExitCode = (typeof ExitCode)[keyof typeof ExitCode];
 /** The exit code for a failed response. The problem's code (then its type) decides; the status covers what has none. Text is never read. */
 export declare const exitCodeForProblem: (status: number, problem?: ProblemDetail) => ExitCode;
-/** What a deploy that stopped after registering leaves behind: the workload, the key shown only once, and the command that resumes. */
-export interface PartialDeploy {
-    workloadId: string;
-    /** Only when the run that failed minted it: no rerun can show it again. */
-    sdkKey?: string;
-    rerun: string;
-}
 /** A failure the CLI reports and exits on. `step` names where it happened in `--json` documents. */
 export declare class CliError extends Error {
     readonly exitCode: ExitCode;
     readonly step: string;
     readonly problem: ProblemDetail;
-    readonly partial?: PartialDeploy | undefined;
-    constructor(message: string, exitCode: ExitCode, step: string, problem?: ProblemDetail, partial?: PartialDeploy | undefined);
+    /** Extra fields for the `--json` failure document, such as the invariants a strict verify failed. */
+    readonly details?: object | undefined;
+    constructor(message: string, exitCode: ExitCode, step: string, problem?: ProblemDetail, 
+    /** Extra fields for the `--json` failure document, such as the invariants a strict verify failed. */
+    details?: object | undefined);
 }
 /** Keeps the known string fields of a response body that should be a ProblemDetail; anything else (HTML from a proxy) is no problem. */
 export declare const toProblem: (body: unknown) => ProblemDetail | undefined;
 /** A CliError for a non-2xx response; its message is the problem's title, else detail, else the status. */
 export declare const problemError: (step: string, status: number, body: unknown) => CliError;
-/** A request that never got an answer (after the retries). */
-export declare const unreachableError: (step: string, cause: unknown) => CliError;
+/**
+ * A request that never got an answer (after the retries). Node's fetch reports every network failure as "fetch failed" and keeps
+ * the reason (`getaddrinfo ENOTFOUND host`, `connect ECONNREFUSED`) on its cause, so the message gives that reason, and names
+ * `server` when the caller knows it: a user whose server does not resolve yet can see which one.
+ */
+export declare const unreachableError: (step: string, cause: unknown, server?: string) => CliError;

package/dist/errors.js

@@ -6,18 +6,16 @@ export const ExitCode = {
     AUTH: 3,
     INVALID: 4,
     CONFLICT: 5,
-    HUMAN: 6,
     RATE_LIMITED: 7,
     UNREACHABLE: 8,
-    PARTIAL: 9,
+    /** `pool fetch` hit the pool's weekly cap: nothing is wrong, and the bundle on disk is untouched. */
+    CAPPED: 10,
 };
 const codes = (exit, ...names) => names.map((name) => [name, exit]);
 // Problem codes (or types) from spec 1 §13, T87 and T92. EXPIRED_TOKEN and ACCESS_DENIED are the device flow's own, raised locally.
 const BY_CODE = new Map([
-    ...codes(ExitCode.AUTH, 'SDK_KEY_INVALID', 'EXPIRED_TOKEN', 'ACCESS_DENIED'),
-    ...codes(ExitCode.INVALID, 'MANIFEST_INVALID', 'MULTI_SERVICE_DISABLED', 'PRICE_NOT_FOUND', 'PRICE_INACTIVE', 'FEE_POLICY_INVALID', 'LIVE_MODE_REQUIRED', 'TEST_MODE_ONLY'),
-    ...codes(ExitCode.CONFLICT, 'IDEMPOTENCY_CONFLICT', 'WORKLOAD_FINGERPRINT_EXISTS'),
-    ...codes(ExitCode.HUMAN, 'ACCOUNT_NOT_READY', 'PAYMENT_METHOD_REQUIRED', 'INSUFFICIENT_CREDITS', 'COMPUTE_CAP_REACHED'),
+    ...codes(ExitCode.AUTH, 'EXPIRED_TOKEN', 'ACCESS_DENIED'),
+    ...codes(ExitCode.CONFLICT, 'IDEMPOTENCY_CONFLICT'),
     ...codes(ExitCode.RATE_LIMITED, 'RATE_LIMITED'),
 ]);
 /** The exit code for a failed response. The problem's code (then its type) decides; the status covers what has none. Text is never read. */
@@ -41,13 +39,15 @@ export class CliError extends Error {
     exitCode;
     step;
     problem;
-    partial;
-    constructor(message, exitCode, step, problem = { title: message }, partial) {
+    details;
+    constructor(message, exitCode, step, problem = { title: message }, 
+    /** Extra fields for the `--json` failure document, such as the invariants a strict verify failed. */
+    details) {
         super(message);
         this.exitCode = exitCode;
         this.step = step;
         this.problem = problem;
-        this.partial = partial;
+        this.details = details;
         this.name = 'CliError';
     }
 }
@@ -69,5 +69,22 @@ export const problemError = (step, status, body) => {
     const message = problem?.title ?? problem?.detail ?? `The platform answered HTTP ${String(status)}`;
     return new CliError(message, exitCodeForProblem(status, problem), step, { ...problem, title: message, status });
 };
-/** A request that never got an answer (after the retries). */
-export const unreachableError = (step, cause) => new CliError(`Cannot reach the server: ${cause instanceof Error ? cause.message : String(cause)}`, ExitCode.UNREACHABLE, step);
+/** The network's own reason for a failed fetch: the first of these that is not blank. */
+const reasonOf = (error) => {
+    const inner = error.cause;
+    if (!(inner instanceof Error))
+        return error.message === '' ? 'no reason given' : error.message;
+    // Node 24 tries every address of a dual-stack host and reports an AggregateError whose own message is empty.
+    const first = inner instanceof AggregateError && inner.errors[0] instanceof Error ? inner.errors[0].message : '';
+    const code = 'code' in inner && typeof inner.code === 'string' ? inner.code : '';
+    return [first, inner.message, code, error.message].find((reason) => reason !== '') ?? 'no reason given';
+};
+/**
+ * A request that never got an answer (after the retries). Node's fetch reports every network failure as "fetch failed" and keeps
+ * the reason (`getaddrinfo ENOTFOUND host`, `connect ECONNREFUSED`) on its cause, so the message gives that reason, and names
+ * `server` when the caller knows it: a user whose server does not resolve yet can see which one.
+ */
+export const unreachableError = (step, cause, server) => {
+    const reason = cause instanceof Error ? reasonOf(cause) : String(cause);
+    return new CliError(`Cannot reach the server${server === undefined ? '' : ` at ${server}`}: ${reason}`, ExitCode.UNREACHABLE, step);
+};

package/dist/gate/checks.d.ts

@@ -0,0 +1,68 @@
+import type { Redactor } from '../sessions/redact.js';
+import { type ShellCommand } from '../sessions/extract.js';
+import type { Program } from './record.js';
+export declare const CROSSING_CLASSES: readonly ["npm-package", "python-package", "mcp-server", "skill"];
+export type CrossingClass = (typeof CROSSING_CLASSES)[number];
+export declare const CROSSING_FORMS: readonly ["install", "url-install", "fetch-and-run", "url-fetch-and-run", "local-bin-run", "mcp-call", "skill-call"];
+export type CrossingForm = (typeof CROSSING_FORMS)[number];
+/** A command that looks like a crossing and states no name to record. Counted, so a report can say what it could not read. */
+export declare const UNREAD_SHAPES: readonly ["manifest-install", "local-path", "variable-name", "masked-name", "pipe-to-shell", "behind-xargs", "harness-registration", "unreadable-name"];
+export type UnreadShape = (typeof UNREAD_SHAPES)[number];
+export type VersionForm = 'pinned' | 'range' | 'tag' | 'url' | 'unstated';
+export interface Crossing {
+    class: CrossingClass;
+    form: CrossingForm;
+    /** The name as stated, redacted, normalized only where the package manager itself treats the spellings as one. */
+    name: string;
+    version: string | null;
+    versionForm: VersionForm;
+    /** The program that crossed (`npm`, `uvx`), or `mcp` and `skill` for those tools. */
+    program: Program;
+    /** Whether the call's own status reports this command: false behind a pipe or a later `;`. */
+    statusReports: boolean;
+    /**
+     * Whether a registry question for this name would reach the registry the command itself would: false when the command, its environment,
+     * or an earlier `cd` of the call chose the registry, the config, or the folder. A replay then leaves the name unasked.
+     */
+    registryAsked: boolean;
+}
+export interface Removal {
+    class: CrossingClass;
+    name: string;
+}
+export interface CallCheck {
+    crossings: Crossing[];
+    unread: UnreadShape[];
+    removals: Removal[];
+}
+export interface ToolCall {
+    tool: string;
+    input: unknown;
+}
+type Family = 'npm-package' | 'python-package';
+export interface Words {
+    names: string[];
+    flags: Map<string, string[]>;
+    bare: Set<string>;
+}
+/**
+ * `limit` is how many names a runner's own words take. Once that many are read, every later word is a name, whatever it looks like: it
+ * belongs to the fetched program, which may take `-p` or `--package` for its own. Flags before the limit are the runner's.
+ */
+export declare const readWords: (command: ShellCommand, family: Family, limit?: number) => Words;
+export type Admitted = {
+    kind: 'named';
+    name: string;
+} | {
+    kind: 'unread';
+    shape: UnreadShape;
+};
+/**
+ * The one point every recorded name passes, before it reaches `crossings.jsonl`, a registry question, or a removal match. A name outside
+ * its family's grammar is never written and never asked: it is counted by the shape it has. A URL loses its credentials, query, and
+ * fragment first.
+ */
+export declare const admitName: (cls: CrossingClass, form: CrossingForm | "removal", name: string) => Admitted;
+/** Names the crossing a tool call makes, if any. The later hook calls this same function with the call it is handed. */
+export declare const checkCall: (call: ToolCall, redact: Redactor) => CallCheck;
+export {};