@myna-sh/cli 0.8.0 → 0.9.0

package/dist/main.js

@@ -130,10 +130,10 @@ var HttpClient = class {
    * while in flight — this is request coalescing, not a cache.
    */
   inFlight = /* @__PURE__ */ new Map();
-  dedupe(key, run) {
+  dedupe(key, run2) {
     const existing = this.inFlight.get(key);
     if (existing) return existing.then((response) => response.clone());
-    const started = run();
+    const started = run2();
     this.inFlight.set(key, started);
     const cleanup = () => {
       if (this.inFlight.get(key) === started) this.inFlight.delete(key);
@@ -468,6 +468,16 @@ var ManagementClient = class {
       collection ? { origin, collection } : { origin },
       signal
     ),
+    /**
+     * Why a call into this project would be denied: whether the credential
+     * holds a capability, whether it is confined to other collections, and
+     * whether the collection exists at all.
+     */
+    access: (project, opts = {}, signal) => this.get(
+      `/projects/${enc(project)}/access`,
+      { capability: opts.capability, collection: opts.collection },
+      signal
+    ),
     views: (project, signal) => this.get(`/projects/${enc(project)}/views`, void 0, signal),
     createView: (project, body) => this.mutate("POST", `/projects/${enc(project)}/views`, body),
     deleteView: (project, view) => this.mutate("DELETE", `/projects/${enc(project)}/views/${enc(view)}`)
@@ -649,6 +659,19 @@ var ManagementClient = class {
     }),
     get: (project, asset, signal) => this.get(`/projects/${enc(project)}/assets/${enc(asset)}`, void 0, signal),
     usage: (project, asset, signal) => this.get(`/projects/${enc(project)}/assets/${enc(asset)}`, { usage: "true" }, signal),
+    /**
+     * Assets that look like the same picture, by perceptual hash — a resized or
+     * re-encoded copy, which `checksum` cannot see. `maxDistance` is in bits out
+     * of 64 (default 5, maximum 16).
+     */
+    similar: (project, asset, opts = {}, signal) => this.get(
+      `/projects/${enc(project)}/assets/${enc(asset)}/similar`,
+      {
+        maxDistance: opts.maxDistance === void 0 ? void 0 : String(opts.maxDistance),
+        limit: opts.limit === void 0 ? void 0 : String(opts.limit)
+      },
+      signal
+    ).then((r) => r.similar),
     update: (project, asset, body) => this.mutate("PATCH", `/projects/${enc(project)}/assets/${enc(asset)}`, body),
     replace: (project, asset, body) => this.mutate("POST", `/projects/${enc(project)}/assets/${enc(asset)}/replace`, body),
     delete: (project, asset) => this.mutate("DELETE", `/projects/${enc(project)}/assets/${enc(asset)}`),
@@ -1194,7 +1217,33 @@ function startDevice(apiUrl) {
 function pollDevice(apiUrl, deviceCode) {
   return apiPost(apiUrl, `/auth/device/${deviceCode}/token`, { deviceCode });
 }
+function registerAccess(program) {
+  program.command("access").description("Explain what this credential may do in a project, and why a call was denied").option("--capability <cap>", "capability to check, e.g. content:publish").option("--collection <key>", "collection the denied call touched").action(
+    handle(async (ctx, _args, opts) => {
+      const project = ctx.requireProject();
+      const access = await ctx.management().projects.access(project, {
+        capability: opts.capability,
+        collection: opts.collection
+      });
+      emit(access, () => {
+        keyValues([
+          ["Project", access.projectSlug],
+          ["Credential", access.credential + (access.role ? ` (${access.role})` : "")],
+          ["Capabilities", access.capabilities.join(", ") || "(none)"],
+          ["Collections", access.allowedCollections?.join(", ") ?? "all"]
+        ]);
+        for (const check2 of access.checks) {
+          diag(`  ${check2.ok ? "ok  " : "fail"} ${check2.id} \u2014 ${check2.detail}`);
+        }
+        if (access.remedy) diag(`
+  remedy: ${access.remedy}`);
+      });
+      if (!access.allowed) process.exitCode = 1;
+    })
+  );
+}
 function registerAuth(program) {
+  registerAccess(program);
   const login = program.command("login").description("Authenticate via the browser device-authorization flow").action(
     handle(async (ctx) => {
       const start = await startDevice(ctx.apiUrl);
@@ -1483,7 +1532,7 @@ function registerWorkspace(program) {
 }
 
 // src/commands/schema.ts
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
 import { join as join4 } from "path";
 
 // src/schema-loader.ts
@@ -1717,6 +1766,89 @@ function varName(name) {
   return /^[A-Za-z_$]/.test(camel) ? camel : `_${camel}`;
 }
 
+// src/git.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { createHash as createHash2 } from "crypto";
+function run(command, args, cwd) {
+  try {
+    return execFileSync2(command, args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+  } catch (error) {
+    const stderr = error.stderr;
+    const detail = typeof stderr === "string" ? stderr : stderr?.toString("utf8");
+    throw new CliError(`${command} ${args[0]} failed: ${(detail || error.message).trim()}`);
+  }
+}
+function git(args, cwd) {
+  return run("git", args, cwd).trim();
+}
+function gitQuiet(args, cwd) {
+  try {
+    execFileSync2("git", args, { cwd, stdio: "ignore" });
+  } catch {
+  }
+}
+function available(command) {
+  try {
+    execFileSync2(command, ["--version"], { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function branchForContent(contents) {
+  const digest = createHash2("sha256").update(contents.join("\0")).digest("hex").slice(0, 8);
+  return `myna/schema-${digest}`;
+}
+function openPullRequest(input) {
+  if (!available("git")) throw new CliError("git is required to open a pull request.");
+  if (!available("gh")) {
+    throw new CliError("The GitHub CLI (gh) is required to open a pull request. See https://cli.github.com.");
+  }
+  if (git(["rev-parse", "--is-inside-work-tree"], input.cwd) !== "true") {
+    throw new CliError(`${input.cwd} is not inside a git repository.`);
+  }
+  const base = input.base ?? git(["rev-parse", "--abbrev-ref", "HEAD"], input.cwd);
+  if (base === "HEAD") {
+    throw new CliError("HEAD is detached; pass --base to say which branch to open the pull request against.");
+  }
+  const exists = (() => {
+    try {
+      execFileSync2("git", ["rev-parse", "--verify", `refs/heads/${input.branch}`], {
+        cwd: input.cwd,
+        stdio: "ignore"
+      });
+      return true;
+    } catch {
+      return false;
+    }
+  })();
+  if (exists) return { opened: false, branch: input.branch, base, url: null, reason: "branch-exists" };
+  git(["checkout", "-b", input.branch], input.cwd);
+  let pushed = false;
+  try {
+    git(["add", "--", ...input.files], input.cwd);
+    git(["commit", "-m", input.title, "-m", input.body], input.cwd);
+    git(["push", "--set-upstream", "origin", input.branch], input.cwd);
+    pushed = true;
+    const url = run(
+      "gh",
+      ["pr", "create", "--base", base, "--head", input.branch, "--title", input.title, "--body", input.body],
+      input.cwd
+    ).trim().split("\n").filter((line) => line.startsWith("http")).pop();
+    git(["checkout", base], input.cwd);
+    return { opened: true, branch: input.branch, base, url: url ?? null };
+  } catch (error) {
+    gitQuiet(["checkout", base], input.cwd);
+    if (pushed) gitQuiet(["push", "origin", "--delete", input.branch], input.cwd);
+    gitQuiet(["branch", "-D", input.branch], input.cwd);
+    throw error;
+  }
+}
+function dirtyFiles(cwd, paths) {
+  if (paths.length === 0) return [];
+  return run("git", ["status", "--porcelain", "--", ...paths], cwd).split("\n").filter(Boolean).map((line) => line.slice(3).trim());
+}
+
 // src/commands/schema.ts
 async function deployedSchemas(ctx, project) {
   const mgmt = ctx.management();
@@ -1762,21 +1894,59 @@ function registerSchema(program) {
       });
     })
   );
-  schema.command("pull").description("Write deployed schemas to local DSL files").option("--schema-dir <dir>", "target schema directory").action(
+  schema.command("pull").description("Write deployed schemas to local DSL files").option("--schema-dir <dir>", "target schema directory").option("--open-pr", "commit the drift onto a branch and open a pull request instead of writing in place", false).option("--branch <name>", "branch to use with --open-pr (default: derived from the content)").option("--base <branch>", "branch to open the pull request against (default: the current branch)").action(
     handle(async (ctx, _args, opts) => {
       const project = ctx.requireProject();
       const dir = schemaDirFor(ctx.linkedRoot, opts.schemaDir);
       const schemas = await deployedSchemas(ctx, project);
-      mkdirSync3(dir, { recursive: true });
-      const written = [];
-      for (const s of schemas) {
-        const file = join4(dir, `${s.name}.ts`);
-        writeFileSync3(file, schemaToDsl(s));
-        written.push(file);
-      }
-      emit({ pulled: schemas.length, files: written }, () => {
-        for (const f of written) process.stdout.write(`  wrote ${f}
+      const rendered = schemas.map((s) => ({ file: join4(dir, `${s.name}.ts`), code: schemaToDsl(s) }));
+      const changed = rendered.filter(
+        (r) => !existsSync4(r.file) || readFileSync3(r.file, "utf8") !== r.code
+      );
+      const write = () => {
+        mkdirSync3(dir, { recursive: true });
+        for (const r of rendered) writeFileSync3(r.file, r.code);
+        return rendered.map((r) => r.file);
+      };
+      if (!opts.openPr) {
+        const written = write();
+        emit({ pulled: schemas.length, files: written, changed: changed.map((c) => c.file) }, () => {
+          for (const f of written) process.stdout.write(`  wrote ${f}
 `);
+        });
+        return;
+      }
+      if (changed.length === 0) {
+        emit(
+          { pulled: schemas.length, changed: [], pullRequest: null },
+          () => diag("No drift: the local schema files already match the deployed schema.")
+        );
+        return;
+      }
+      const root = ctx.linkedRoot ?? process.cwd();
+      const dirty = dirtyFiles(root, [dir]);
+      if (dirty.length > 0) {
+        throw new UsageError(
+          `Commit or stash changes under ${dir} first: ${dirty.join(", ")}.`
+        );
+      }
+      const body = await driftBody(ctx, project, dir, changed.map((c) => c.file));
+      write();
+      const branch = opts.branch ?? branchForContent(changed.map((c) => c.code));
+      const result = openPullRequest({
+        cwd: root,
+        files: changed.map((c) => c.file),
+        branch,
+        base: opts.base,
+        title: `chore(schema): sync ${changed.length} collection(s) from ${project}`,
+        body
+      });
+      emit({ pulled: schemas.length, changed: changed.map((c) => c.file), pullRequest: result }, () => {
+        if (!result.opened) {
+          diag(`Branch ${result.branch} already exists \u2014 this drift is already proposed.`);
+          return;
+        }
+        diag(`Opened ${result.url ?? `pull request from ${result.branch}`} against ${result.base}.`);
       });
     })
   );
@@ -1894,6 +2064,29 @@ function registerSchema(program) {
     })
   );
 }
+async function driftBody(ctx, project, dir, files) {
+  const lines = [
+    `Deployed schema for \`${project}\`, pulled into this repository by \`myna schema pull --open-pr\`.`,
+    "",
+    "Files:",
+    ...files.map((f) => `- \`${f}\``)
+  ];
+  try {
+    const local = await loadLocalSchemas(dir);
+    const diff = await ctx.management().schema.diff(project, canonicalJson(local));
+    if (diff.ops.length > 0) {
+      lines.push(
+        "",
+        `Before this change, pushing this repository would have applied ${diff.ops.length} operation(s) (${diff.classification}):`,
+        "",
+        ...diff.ops.map((op) => `- \`${op.kind}\` ${op.collection}${op.field ? `.${op.field}` : ""} \u2014 ${op.detail}`)
+      );
+    }
+  } catch {
+    lines.push("", "_The local schema could not be diffed; review the file changes directly._");
+  }
+  return lines.join("\n");
+}
 function renderDiff(diff) {
   if (diff.ops.length === 0) {
     diag("No changes.");
@@ -2482,6 +2675,9 @@ function registerChanges(program) {
             { header: "BEFORE", value: (c) => preview(c.before) },
             { header: "AFTER", value: (c) => preview(c.after) }
           ]);
+          for (const change of item.changes) {
+            if (change.segments) diag(`  ${change.path}: ${inlineWords(change.segments)}`);
+          }
         }
         if (diff.items.length === 0) diag("No items.");
       });
@@ -2563,6 +2759,15 @@ function registerChanges(program) {
     })
   );
 }
+function inlineWords(segments) {
+  const KEEP = 32;
+  return segments.map((s) => {
+    const flat = s.value.replaceAll(/\s+/g, " ");
+    if (s.op === "insert") return `{+${flat}+}`;
+    if (s.op === "delete") return `[-${flat}-]`;
+    return flat.length > KEEP * 2 ? `${flat.slice(0, KEEP)} \u2026 ${flat.slice(-KEEP)}` : flat;
+  }).join("");
+}
 function preview(value) {
   if (value === void 0 || value === null) return "\u2014";
   const text = typeof value === "string" ? value : JSON.stringify(value);
@@ -2703,6 +2908,10 @@ function registerAssets(program) {
         let asset = await ctx.management().assets.upload(project, path);
         if (opts.alt) asset = await ctx.management().assets.update(project, asset.id, { defaultAlt: opts.alt });
         uploaded.push(asset);
+        const similar = await ctx.management().assets.similar(project, asset.id).catch(() => []);
+        for (const match of similar) {
+          diag(`  looks like ${match.asset.id} (${match.asset.displayFilename}), distance ${match.distance}`);
+        }
       }
       emit(
         uploaded.length === 1 ? uploaded[0] : uploaded,
@@ -2734,6 +2943,26 @@ function registerAssets(program) {
       );
     })
   );
+  assets.command("similar").description("Find images that look like the same picture as this one").argument("<id>", "asset id (ast_)").option("--max-distance <n>", "how many of the fingerprint's 64 bits may differ", "5").action(
+    handle(async (ctx, args, opts) => {
+      const project = ctx.requireProject();
+      const similar = await ctx.management().assets.similar(project, args[0], {
+        maxDistance: Number(opts.maxDistance)
+      });
+      emit(similar, () => {
+        if (similar.length === 0) {
+          diag("No near-duplicates. (Images uploaded before fingerprinting shipped have none.)");
+          return;
+        }
+        table(similar, [
+          { header: "ID", value: (s) => s.asset.id },
+          { header: "FILENAME", value: (s) => s.asset.displayFilename },
+          { header: "DISTANCE", value: (s) => String(s.distance) },
+          { header: "STATE", value: (s) => s.asset.state }
+        ]);
+      });
+    })
+  );
   assets.command("inspect").description("Show an asset and its usage").argument("<id>", "asset id (ast_)").action(
     handle(async (ctx, args) => {
       const project = ctx.requireProject();
@@ -3459,11 +3688,11 @@ function registerBilling(program) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync4, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
 import { join as join6 } from "path";
 
 // src/version.ts
-var VERSION = true ? "0.8.0" : "0.0.0-dev";
+var VERSION = true ? "0.9.0" : "0.0.0-dev";
 
 // src/commands/doctor.ts
 var NPM_REGISTRY = "https://registry.npmjs.org";
@@ -3650,7 +3879,7 @@ async function checkOrigin(ctx, origin) {
 }
 async function checkSchema(ctx, schemaDir) {
   const dir = schemaDirFor(ctx.linkedRoot, schemaDir);
-  if (!existsSync4(dir)) {
+  if (!existsSync5(dir)) {
     return check("schema.drift", "Local schema", "skip", `No schema directory at ${dir}.`);
   }
   if (!ctx.project) {
@@ -3677,7 +3906,9 @@ async function checkSchema(ctx, schemaDir) {
       "Local schema",
       "warn",
       `${diff.ops.length} undeployed change(s) (${diff.classification}).`,
-      "myna schema diff, then myna schema push"
+      // Drift has two directions and two fixes: push local ahead, or pull
+      // the deployed schema back into the repository as a reviewable change.
+      "myna schema diff, then myna schema push \u2014 or myna schema pull --open-pr if the deployed schema is the one to keep"
     );
   } catch (error) {
     return check(
@@ -3711,7 +3942,7 @@ function findGeneratedTypes(root, depth = 4) {
     }
     if (!/\.(ts|d\.ts)$/.test(entry)) continue;
     try {
-      if (looksGenerated(readFileSync3(full, "utf8"))) return full;
+      if (looksGenerated(readFileSync4(full, "utf8"))) return full;
     } catch {
     }
   }
@@ -3728,16 +3959,16 @@ async function checkTypes(ctx, explicit, schemaDir) {
   if (!file) {
     return check("types.freshness", "Generated types", "skip", "No generated types file found.");
   }
-  if (!existsSync4(file)) {
+  if (!existsSync5(file)) {
     return check("types.freshness", "Generated types", "fail", `${file} does not exist.`);
   }
   const dir = schemaDirFor(ctx.linkedRoot, schemaDir);
-  if (!existsSync4(dir)) {
+  if (!existsSync5(dir)) {
     return check("types.freshness", "Generated types", "skip", `Found ${file} but no schema directory to compare against.`);
   }
   try {
     const expected = generateTypesModule(await loadLocalSchemas(dir));
-    return readFileSync3(file, "utf8") === expected ? check("types.freshness", "Generated types", "pass", `${file} matches the local schema.`) : check(
+    return readFileSync4(file, "utf8") === expected ? check("types.freshness", "Generated types", "pass", `${file} matches the local schema.`) : check(
       "types.freshness",
       "Generated types",
       "warn",