@mriekki/lean 0.1.0 → 0.1.1

package/assets/generated/deployment/src/lean_poc_deployment/doctor.py

@@ -1,121 +1,121 @@
-"""Read-only workstation and target readiness checks."""
-
-from __future__ import annotations
-
-import shutil
-from pathlib import Path
-from typing import Any
-
-from .errors import DeploymentKitError
-from .profiles import config_root, load_profile, target_profile_path
-from .security import check_ssh_material_security, validate_target_trust_file
-from .ssh import resolve_addresses
-
-
-def workstation_doctor(*, home: Path | None = None) -> dict[str, Any]:
-    root = config_root(home)
-    targets_dir = root / "targets"
-    profiles = []
-    if targets_dir.is_dir() and not targets_dir.is_symlink():
-        profiles = sorted(path.stem for path in targets_dir.glob("*.json") if path.is_file() and not path.is_symlink())
-
-    tools = {name: shutil.which(name) for name in ("ssh", "ssh-keygen", "ssh-keyscan", "ssh-add")}
-    missing_tools = [name for name, path in tools.items() if path is None]
-
-    if not root.exists() and not profiles:
-        state = "fresh-workstation"
-    elif missing_tools:
-        state = "blocked"
-    elif profiles:
-        state = "configured"
-    else:
-        state = "partially-configured"
-
-    return {
-        "state": state,
-        "configRoot": str(root),
-        "profiles": profiles,
-        "tools": tools,
-        "missingTools": missing_tools,
-        "mutated": False,
-    }
-
-
-def target_doctor(name: str, *, home: Path | None = None) -> dict[str, Any]:
-    path = target_profile_path(name, home)
-    if not path.exists():
-        return {
-            "targetName": name,
-            "state": "needs-profile",
-            "profilePath": str(path),
-            "nextAction": "configure-target-profile",
-            "mutated": False,
-        }
-
-    try:
-        profile = load_profile(name, home=home)
-    except DeploymentKitError as error:
-        return {
-            "targetName": name,
-            "state": "blocked",
-            "profilePath": str(path),
-            "reason": str(error),
-            "mutated": False,
-        }
-
-    identity = Path(profile["identityFile"])
-    known_hosts = Path(profile["knownHostsFile"])
-    if not identity.is_file():
-        return {
-            "targetName": name,
-            "state": "needs-key",
-            "profilePath": str(path),
-            "identityFile": str(identity),
-            "nextAction": "create-or-select-dedicated-key",
-            "mutated": False,
-        }
-    if not known_hosts.is_file() or known_hosts.stat().st_size == 0:
-        return {
-            "targetName": name,
-            "state": "needs-trust",
-            "profilePath": str(path),
-            "knownHostsFile": str(known_hosts),
-            "nextAction": "verify-console-fingerprint-before-trust-enrollment",
-            "mutated": False,
-        }
-
-    try:
-        check_ssh_material_security(identity, known_hosts)
-        validate_target_trust_file(profile)
-    except DeploymentKitError as error:
-        return {
-            "targetName": name,
-            "state": "blocked",
-            "profilePath": str(path),
-            "reason": str(error),
-            "nextAction": "repair-ssh-material-or-trust",
-            "mutated": False,
-        }
-
-    try:
-        addresses = resolve_addresses(profile)
-    except DeploymentKitError as error:
-        return {
-            "targetName": name,
-            "state": "needs-address",
-            "profilePath": str(path),
-            "hostName": profile["hostName"],
-            "reason": str(error),
-            "nextAction": "set-separately-verified-address-override",
-            "mutated": False,
-        }
-
-    return {
-        "targetName": name,
-        "state": "ready-to-verify",
-        "profilePath": str(path),
-        "hostName": profile["hostName"],
-        "addresses": addresses,
-        "addressSource": "override" if profile["addressOverride"] else "dns-mdns",
-        "mutated": False,
-    }
+"""Read-only workstation and target readiness checks."""
+
+from __future__ import annotations
+
+import shutil
+from pathlib import Path
+from typing import Any
+
+from .errors import DeploymentKitError
+from .profiles import config_root, load_profile, target_profile_path
+from .security import check_ssh_material_security, validate_target_trust_file
+from .ssh import resolve_addresses
+
+
+def workstation_doctor(*, home: Path | None = None) -> dict[str, Any]:
+    root = config_root(home)
+    targets_dir = root / "targets"
+    profiles = []
+    if targets_dir.is_dir() and not targets_dir.is_symlink():
+        profiles = sorted(path.stem for path in targets_dir.glob("*.json") if path.is_file() and not path.is_symlink())
+
+    tools = {name: shutil.which(name) for name in ("ssh", "ssh-keygen", "ssh-keyscan", "ssh-add")}
+    missing_tools = [name for name, path in tools.items() if path is None]
+
+    if not root.exists() and not profiles:
+        state = "fresh-workstation"
+    elif missing_tools:
+        state = "blocked"
+    elif profiles:
+        state = "configured"
+    else:
+        state = "partially-configured"
+
+    return {
+        "state": state,
+        "configRoot": str(root),
+        "profiles": profiles,
+        "tools": tools,
+        "missingTools": missing_tools,
+        "mutated": False,
+    }
+
+
+def target_doctor(name: str, *, home: Path | None = None) -> dict[str, Any]:
+    path = target_profile_path(name, home)
+    if not path.exists():
+        return {
+            "targetName": name,
+            "state": "needs-profile",
+            "profilePath": str(path),
+            "nextAction": "configure-target-profile",
+            "mutated": False,
+        }
+
+    try:
+        profile = load_profile(name, home=home)
+    except DeploymentKitError as error:
+        return {
+            "targetName": name,
+            "state": "blocked",
+            "profilePath": str(path),
+            "reason": str(error),
+            "mutated": False,
+        }
+
+    identity = Path(profile["identityFile"])
+    known_hosts = Path(profile["knownHostsFile"])
+    if not identity.is_file():
+        return {
+            "targetName": name,
+            "state": "needs-key",
+            "profilePath": str(path),
+            "identityFile": str(identity),
+            "nextAction": "create-or-select-dedicated-key",
+            "mutated": False,
+        }
+    if not known_hosts.is_file() or known_hosts.stat().st_size == 0:
+        return {
+            "targetName": name,
+            "state": "needs-trust",
+            "profilePath": str(path),
+            "knownHostsFile": str(known_hosts),
+            "nextAction": "verify-console-fingerprint-before-trust-enrollment",
+            "mutated": False,
+        }
+
+    try:
+        check_ssh_material_security(identity, known_hosts)
+        validate_target_trust_file(profile)
+    except DeploymentKitError as error:
+        return {
+            "targetName": name,
+            "state": "blocked",
+            "profilePath": str(path),
+            "reason": str(error),
+            "nextAction": "repair-ssh-material-or-trust",
+            "mutated": False,
+        }
+
+    try:
+        addresses = resolve_addresses(profile)
+    except DeploymentKitError as error:
+        return {
+            "targetName": name,
+            "state": "needs-address",
+            "profilePath": str(path),
+            "hostName": profile["hostName"],
+            "reason": str(error),
+            "nextAction": "set-separately-verified-address-override",
+            "mutated": False,
+        }
+
+    return {
+        "targetName": name,
+        "state": "ready-to-verify",
+        "profilePath": str(path),
+        "hostName": profile["hostName"],
+        "addresses": addresses,
+        "addressSource": "override" if profile["addressOverride"] else "dns-mdns",
+        "mutated": False,
+    }

package/assets/generated/deployment/src/lean_poc_deployment/entrypoint.py

@@ -1,25 +1,25 @@
-"""Top-level console entrypoint for Deployment Kit command groups."""
-
-from __future__ import annotations
-
-import sys
-
-from .app_cli import main as app_main
-from .cli import main as core_main
-from .sqlite_cli import main as sqlite_main
-from .teardown_cli import main as teardown_main
-
-
-def main(argv: list[str] | None = None) -> int:
-    args = list(sys.argv[1:] if argv is None else argv)
-    if args and args[0] == "app":
-        return app_main(args[1:])
-    if args and args[0] == "sqlite":
-        return sqlite_main(args[1:])
-    if args and args[0] == "tear-down":
-        return teardown_main(args[1:])
-    if not args or args == ["--help"] or args == ["-h"]:
-        print("Command group: app  Generic immutable application runtime inventory/deployment")
-        print("Command group: sqlite  SQLite persistence import/backup/migration/rollback checks")
-        print("Command group: tear-down  Scoped destructive POC environment/local cleanup")
-    return core_main(args)
+"""Top-level console entrypoint for Deployment Kit command groups."""
+
+from __future__ import annotations
+
+import sys
+
+from .app_cli import main as app_main
+from .cli import main as core_main
+from .sqlite_cli import main as sqlite_main
+from .teardown_cli import main as teardown_main
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = list(sys.argv[1:] if argv is None else argv)
+    if args and args[0] == "app":
+        return app_main(args[1:])
+    if args and args[0] == "sqlite":
+        return sqlite_main(args[1:])
+    if args and args[0] == "tear-down":
+        return teardown_main(args[1:])
+    if not args or args == ["--help"] or args == ["-h"]:
+        print("Command group: app  Generic immutable application runtime inventory/deployment")
+        print("Command group: sqlite  SQLite persistence import/backup/migration/rollback checks")
+        print("Command group: tear-down  Scoped destructive POC environment/local cleanup")
+    return core_main(args)

package/assets/generated/deployment/src/lean_poc_deployment/errors.py

@@ -1,5 +1,5 @@
-"""Deployment Kit exception types."""
-
-
-class DeploymentKitError(Exception):
-    """Expected fail-closed operational or configuration error."""
+"""Deployment Kit exception types."""
+
+
+class DeploymentKitError(Exception):
+    """Expected fail-closed operational or configuration error."""

package/assets/generated/deployment/src/lean_poc_deployment/keys.py

@@ -1,171 +1,171 @@
-"""Dedicated SSH-key and agent onboarding helpers."""
-
-from __future__ import annotations
-
-import os
-import re
-import shutil
-import subprocess
-from pathlib import Path
-from typing import Any
-
-from .errors import DeploymentKitError
-from .security import check_identity_security, prepare_ssh_directory
-
-
-FINGERPRINT_RE = re.compile(r"^SHA256:[A-Za-z0-9+/]{43}$")
-
-
-def required_tool(name: str) -> str:
-    path = shutil.which(name)
-    if path is None:
-        raise DeploymentKitError(f"Required OpenSSH tool is unavailable: {name}")
-    return path
-
-
-def key_fingerprint(path: Path) -> str:
-    if not path.is_file() or path.is_symlink():
-        raise DeploymentKitError(f"SSH key file is missing or unsafe: {path}")
-    result = subprocess.run(
-        [required_tool("ssh-keygen"), "-lf", str(path)],
-        check=False,
-        capture_output=True,
-        text=True,
-        encoding="utf-8",
-        errors="replace",
-    )
-    if result.returncode != 0:
-        raise DeploymentKitError(f"Cannot read SSH key fingerprint for {path}.")
-    fingerprint = next(
-        (token for token in result.stdout.split() if FINGERPRINT_RE.fullmatch(token)),
-        None,
-    )
-    if fingerprint is None:
-        raise DeploymentKitError(f"ssh-keygen returned no valid SHA256 fingerprint for {path}.")
-    return fingerprint
-
-
-def create_dedicated_key(profile: dict[str, Any]) -> dict[str, Any]:
-    identity = Path(profile["identityFile"])
-    public = Path(f"{identity}.pub")
-    if identity.exists() or public.exists():
-        raise DeploymentKitError(
-            f"Refusing to overwrite existing SSH key material: {identity} / {public}"
-        )
-
-    prepare_ssh_directory(identity.parent)
-    comment = f"lean-poc:{profile['targetName']}:{profile['sshAlias']}"
-    result = subprocess.run(
-        [
-            required_tool("ssh-keygen"),
-            "-q",
-            "-t",
-            "ed25519",
-            "-a",
-            "64",
-            "-f",
-            str(identity),
-            "-C",
-            comment,
-        ],
-        check=False,
-    )
-    if result.returncode != 0:
-        raise DeploymentKitError(
-            "ssh-keygen did not complete successfully. Any partial key material is left in place for explicit inspection."
-        )
-    if not identity.is_file() or identity.is_symlink() or not public.is_file() or public.is_symlink():
-        raise DeploymentKitError("ssh-keygen completed without the expected private/public key pair.")
-
-    if os.name != "nt":
-        identity.chmod(0o600)
-        public.chmod(0o644)
-    check_identity_security(identity)
-    return {
-        "targetName": profile["targetName"],
-        "identityFile": str(identity),
-        "publicKeyFile": str(public),
-        "identityFingerprint": key_fingerprint(identity),
-        "status": "created",
-        "mutated": True,
-    }
-
-
-def public_key_info(profile: dict[str, Any]) -> dict[str, str]:
-    identity = Path(profile["identityFile"])
-    public = Path(f"{identity}.pub")
-    check_identity_security(identity)
-    if not public.is_file() or public.is_symlink():
-        raise DeploymentKitError(f"Dedicated public key is missing or unsafe: {public}")
-    try:
-        lines = [line.strip() for line in public.read_text(encoding="utf-8").splitlines() if line.strip()]
-    except (OSError, UnicodeError) as error:
-        raise DeploymentKitError(f"Cannot read dedicated public key {public}: {error}") from error
-    if len(lines) != 1 or not lines[0].startswith("ssh-ed25519 "):
-        raise DeploymentKitError("Dedicated public-key file must contain exactly one ssh-ed25519 key.")
-    return {
-        "targetName": profile["targetName"],
-        "publicKeyFile": str(public),
-        "identityFingerprint": key_fingerprint(identity),
-        "publicKey": lines[0],
-    }
-
-
-def agent_status(profile: dict[str, Any]) -> dict[str, Any]:
-    identity = Path(profile["identityFile"])
-    check_identity_security(identity)
-    fingerprint = key_fingerprint(identity)
-    result = subprocess.run(
-        [required_tool("ssh-add"), "-l"],
-        check=False,
-        capture_output=True,
-        text=True,
-        encoding="utf-8",
-        errors="replace",
-    )
-    if result.returncode == 2:
-        return {
-            "targetName": profile["targetName"],
-            "state": "agent-unavailable",
-            "identityFingerprint": fingerprint,
-            "loaded": False,
-            "mutated": False,
-        }
-    if result.returncode == 1:
-        return {
-            "targetName": profile["targetName"],
-            "state": "not-loaded",
-            "identityFingerprint": fingerprint,
-            "loaded": False,
-            "mutated": False,
-        }
-    if result.returncode != 0:
-        raise DeploymentKitError(f"ssh-add could not inspect the running SSH agent (exit {result.returncode}).")
-    loaded = fingerprint in result.stdout.split()
-    return {
-        "targetName": profile["targetName"],
-        "state": "loaded" if loaded else "not-loaded",
-        "identityFingerprint": fingerprint,
-        "loaded": loaded,
-        "mutated": False,
-    }
-
-
-def add_key_to_agent(profile: dict[str, Any]) -> dict[str, Any]:
-    before = agent_status(profile)
-    if before["state"] == "agent-unavailable":
-        raise DeploymentKitError(
-            "The SSH agent is unavailable. Start/enable it as a separate workstation action; "
-            "the Deployment Kit will not change agent service configuration implicitly."
-        )
-    if before["loaded"]:
-        return {**before, "status": "already-loaded"}
-
-    identity = Path(profile["identityFile"])
-    result = subprocess.run([required_tool("ssh-add"), str(identity)], check=False)
-    if result.returncode != 0:
-        raise DeploymentKitError("ssh-add did not load the dedicated identity.")
-    after = agent_status(profile)
-    if not after["loaded"]:
-        raise DeploymentKitError("ssh-add reported success but the dedicated identity is not visible in the agent.")
-    return {**after, "status": "loaded", "mutated": True}
+"""Dedicated SSH-key and agent onboarding helpers."""
+
+from __future__ import annotations
+
+import os
+import re
+import shutil
+import subprocess
+from pathlib import Path
+from typing import Any
+
+from .errors import DeploymentKitError
+from .security import check_identity_security, prepare_ssh_directory
+
+
+FINGERPRINT_RE = re.compile(r"^SHA256:[A-Za-z0-9+/]{43}$")
+
+
+def required_tool(name: str) -> str:
+    path = shutil.which(name)
+    if path is None:
+        raise DeploymentKitError(f"Required OpenSSH tool is unavailable: {name}")
+    return path
+
+
+def key_fingerprint(path: Path) -> str:
+    if not path.is_file() or path.is_symlink():
+        raise DeploymentKitError(f"SSH key file is missing or unsafe: {path}")
+    result = subprocess.run(
+        [required_tool("ssh-keygen"), "-lf", str(path)],
+        check=False,
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        errors="replace",
+    )
+    if result.returncode != 0:
+        raise DeploymentKitError(f"Cannot read SSH key fingerprint for {path}.")
+    fingerprint = next(
+        (token for token in result.stdout.split() if FINGERPRINT_RE.fullmatch(token)),
+        None,
+    )
+    if fingerprint is None:
+        raise DeploymentKitError(f"ssh-keygen returned no valid SHA256 fingerprint for {path}.")
+    return fingerprint
+
+
+def create_dedicated_key(profile: dict[str, Any]) -> dict[str, Any]:
+    identity = Path(profile["identityFile"])
+    public = Path(f"{identity}.pub")
+    if identity.exists() or public.exists():
+        raise DeploymentKitError(
+            f"Refusing to overwrite existing SSH key material: {identity} / {public}"
+        )
+
+    prepare_ssh_directory(identity.parent)
+    comment = f"lean-poc:{profile['targetName']}:{profile['sshAlias']}"
+    result = subprocess.run(
+        [
+            required_tool("ssh-keygen"),
+            "-q",
+            "-t",
+            "ed25519",
+            "-a",
+            "64",
+            "-f",
+            str(identity),
+            "-C",
+            comment,
+        ],
+        check=False,
+    )
+    if result.returncode != 0:
+        raise DeploymentKitError(
+            "ssh-keygen did not complete successfully. Any partial key material is left in place for explicit inspection."
+        )
+    if not identity.is_file() or identity.is_symlink() or not public.is_file() or public.is_symlink():
+        raise DeploymentKitError("ssh-keygen completed without the expected private/public key pair.")
+
+    if os.name != "nt":
+        identity.chmod(0o600)
+        public.chmod(0o644)
+    check_identity_security(identity)
+    return {
+        "targetName": profile["targetName"],
+        "identityFile": str(identity),
+        "publicKeyFile": str(public),
+        "identityFingerprint": key_fingerprint(identity),
+        "status": "created",
+        "mutated": True,
+    }
+
+
+def public_key_info(profile: dict[str, Any]) -> dict[str, str]:
+    identity = Path(profile["identityFile"])
+    public = Path(f"{identity}.pub")
+    check_identity_security(identity)
+    if not public.is_file() or public.is_symlink():
+        raise DeploymentKitError(f"Dedicated public key is missing or unsafe: {public}")
+    try:
+        lines = [line.strip() for line in public.read_text(encoding="utf-8").splitlines() if line.strip()]
+    except (OSError, UnicodeError) as error:
+        raise DeploymentKitError(f"Cannot read dedicated public key {public}: {error}") from error
+    if len(lines) != 1 or not lines[0].startswith("ssh-ed25519 "):
+        raise DeploymentKitError("Dedicated public-key file must contain exactly one ssh-ed25519 key.")
+    return {
+        "targetName": profile["targetName"],
+        "publicKeyFile": str(public),
+        "identityFingerprint": key_fingerprint(identity),
+        "publicKey": lines[0],
+    }
+
+
+def agent_status(profile: dict[str, Any]) -> dict[str, Any]:
+    identity = Path(profile["identityFile"])
+    check_identity_security(identity)
+    fingerprint = key_fingerprint(identity)
+    result = subprocess.run(
+        [required_tool("ssh-add"), "-l"],
+        check=False,
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        errors="replace",
+    )
+    if result.returncode == 2:
+        return {
+            "targetName": profile["targetName"],
+            "state": "agent-unavailable",
+            "identityFingerprint": fingerprint,
+            "loaded": False,
+            "mutated": False,
+        }
+    if result.returncode == 1:
+        return {
+            "targetName": profile["targetName"],
+            "state": "not-loaded",
+            "identityFingerprint": fingerprint,
+            "loaded": False,
+            "mutated": False,
+        }
+    if result.returncode != 0:
+        raise DeploymentKitError(f"ssh-add could not inspect the running SSH agent (exit {result.returncode}).")
+    loaded = fingerprint in result.stdout.split()
+    return {
+        "targetName": profile["targetName"],
+        "state": "loaded" if loaded else "not-loaded",
+        "identityFingerprint": fingerprint,
+        "loaded": loaded,
+        "mutated": False,
+    }
+
+
+def add_key_to_agent(profile: dict[str, Any]) -> dict[str, Any]:
+    before = agent_status(profile)
+    if before["state"] == "agent-unavailable":
+        raise DeploymentKitError(
+            "The SSH agent is unavailable. Start/enable it as a separate workstation action; "
+            "the Deployment Kit will not change agent service configuration implicitly."
+        )
+    if before["loaded"]:
+        return {**before, "status": "already-loaded"}
+
+    identity = Path(profile["identityFile"])
+    result = subprocess.run([required_tool("ssh-add"), str(identity)], check=False)
+    if result.returncode != 0:
+        raise DeploymentKitError("ssh-add did not load the dedicated identity.")
+    after = agent_status(profile)
+    if not after["loaded"]:
+        raise DeploymentKitError("ssh-add reported success but the dedicated identity is not visible in the agent.")
+    return {**after, "status": "loaded", "mutated": True}