@nessielabs/daemon 0.4.0 → 0.5.26

package/dist/commands/sharing.js

@@ -0,0 +1,399 @@
+import { confirm } from "@inquirer/prompts";
+import { getNodeSharing, listSources, listTeams, listTeamSharingPolicies, NeraRpcError, shareNode, triggerCloudSync, unshareNode, } from "../nera/client.js";
+import { ensureRuntime } from "../nera/process.js";
+import { renderTabTable } from "../platform/table.js";
+var SharingAudience;
+(function (SharingAudience) {
+    SharingAudience[SharingAudience["TEAM"] = 1] = "TEAM";
+    SharingAudience[SharingAudience["TEAM_ADMINS"] = 2] = "TEAM_ADMINS";
+    SharingAudience[SharingAudience["USER"] = 3] = "USER";
+})(SharingAudience || (SharingAudience = {}));
+var SharingScope;
+(function (SharingScope) {
+    SharingScope[SharingScope["ALL"] = 1] = "ALL";
+    SharingScope[SharingScope["REPOS"] = 2] = "REPOS";
+})(SharingScope || (SharingScope = {}));
+const AUDIENCES = {
+    team: SharingAudience.TEAM,
+    admins: SharingAudience.TEAM_ADMINS,
+    user: SharingAudience.USER,
+};
+const SCOPES = {
+    all: SharingScope.ALL,
+    repos: SharingScope.REPOS,
+};
+export function registerSharingCommands(program) {
+    const sharing = program.command("sharing").description("Manage sharing for synced agent traces.");
+    sharing.command("get <node-id>").description("Show sharing for a node.").action(showSharing);
+    sharing
+        .command("add <node-id>")
+        .description("Share a node.")
+        .requiredOption("--team <team-id>", "Team id.")
+        .option("--audience <audience>", "team, admins, or user.", "team")
+        .option("--user <user-id>", "User id for user-scoped sharing.", collect, [])
+        .option("--scope <scope>", "all or repos.", "all")
+        .option("--repo <repo-key>", "Repo key for repo-scoped sharing.", collect, [])
+        .action(addSharing);
+    sharing
+        .command("remove <node-id>")
+        .description("Remove sharing from a node.")
+        .option("--team <team-id>", "Team id.")
+        .option("--user <user-id>", "User id for per-user sharing.", collect, [])
+        .action(removeSharing);
+    sharing
+        .command("apply-team-policies")
+        .description("Apply team sharing policy suggestions to configured integrations.")
+        .action(applyTeamPolicies);
+}
+async function showSharing(nodeId) {
+    const runtime = await ensureRuntime({ detached: true });
+    printSharing(await getNodeSharing(runtime, nodeId));
+}
+async function addSharing(nodeId, options) {
+    const request = shareRequest(nodeId, options);
+    const runtime = await ensureRuntime({ detached: true });
+    const sharing = await shareNode(runtime, request);
+    printSharing(sharing);
+}
+async function removeSharing(nodeId, options) {
+    if (!options.team && (options.user ?? []).length === 0) {
+        throw new Error("sharing remove requires --team or --user.");
+    }
+    if (!options.team && (options.user ?? []).length > 0) {
+        throw new Error("--user can only be used with --team.");
+    }
+    const runtime = await ensureRuntime({ detached: true });
+    const sharing = await unshareNode(runtime, { nodeId, teamId: options.team, userIds: options.user });
+    printSharing(sharing);
+}
+async function applyTeamPolicies() {
+    const runtime = await ensureRuntime({ detached: true });
+    await applyTeamPoliciesForRuntime(runtime, { retrySyncMetadata: true });
+}
+export async function applyTeamPoliciesForRuntime(runtime, options = {}) {
+    const [{ sources }, { teams }] = await Promise.all([listSources(runtime), listTeams(runtime)]);
+    if (teams.length === 0) {
+        if (!options.quietNoop)
+            console.log("No teams.");
+        return 0;
+    }
+    const bundles = await listTeamPolicyBundles(runtime, teams);
+    const plan = buildTeamPolicyPlan(sources, bundles);
+    if (plan.length === 0) {
+        if (!options.quietNoop)
+            console.log("No enabled integrations match current team sharing policies.");
+        return 0;
+    }
+    const changes = await planTeamPolicyChanges(runtime, plan);
+    if (changes.length === 0) {
+        if (!options.quietNoop)
+            console.log("Team sharing policies are already applied.");
+        return 0;
+    }
+    printTeamPolicyPlan(changes);
+    const approved = await confirm({
+        message: `Apply ${changes.length} sharing change(s)?`,
+        default: true,
+    });
+    if (!approved) {
+        console.log("No sharing changes applied.");
+        return 0;
+    }
+    await applyPlannedShares(runtime, changes, options);
+    return changes.length;
+}
+async function applyPlannedShares(runtime, plan, options) {
+    const failures = [];
+    let applied = 0;
+    for (const item of plan) {
+        try {
+            await shareWithRetry(runtime, item, options);
+            applied += 1;
+        }
+        catch (error) {
+            failures.push({ item, error });
+        }
+    }
+    if (failures.length === 0) {
+        console.log(`Applied ${applied} sharing change(s).`);
+        return;
+    }
+    console.error(`Applied ${applied} of ${plan.length} sharing change(s); ${failures.length} failed.`);
+    for (const { item, error } of failures) {
+        console.error(`${item.teamName} / ${item.sourceName} / ${formatAudience(item.audience, item.userIds[0])}: ${errorMessage(error)}`);
+    }
+    throw new Error("Some sharing changes failed.");
+}
+async function shareWithRetry(runtime, item, options) {
+    const maxAttempts = options.retrySyncMetadata ? 7 : 1;
+    for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+        try {
+            await shareNode(runtime, {
+                nodeId: item.sourceId,
+                teamId: item.teamId,
+                audience: item.audience,
+                userIds: item.userIds,
+                scope: item.scope,
+                repoKeys: item.repoKeys,
+            });
+            return;
+        }
+        catch (error) {
+            if (attempt >= maxAttempts || !isSyncMetadataPendingError(error))
+                throw error;
+            if (attempt === 1)
+                console.log("Waiting for Nessie to finish preparing sharing metadata...");
+            try {
+                await triggerCloudSync(runtime);
+            }
+            catch (syncError) {
+                console.warn(`Could not trigger cloud sync while waiting for sharing metadata: ${errorMessage(syncError)}`);
+            }
+            await sleep(5000);
+        }
+    }
+}
+function isSyncMetadataPendingError(error) {
+    return error instanceof NeraRpcError && error.nessieError === "sync_resource_pending";
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function printSharing(sharing) {
+    if (sharing.grants.length === 0) {
+        console.log("Not shared.");
+        return;
+    }
+    const rows = [
+        ["TEAM", "AUDIENCE", "SCOPE", "ORIGIN"],
+        ...sharing.grants.map((grant) => [
+            grant.teamId,
+            formatAudience(grant.audience, grant.userId),
+            grant.scope === SharingScope.REPOS ? `repos:${(grant.repoKeys ?? []).join(",")}` : "all",
+            grant.inherited ? `inherited:${grant.inheritedFromNodeId ?? ""}` : "direct",
+        ]),
+    ];
+    const colors = [
+        ["bold", "bold", "bold", "bold"],
+        ...sharing.grants.map((grant) => ["dim", grant.audience === SharingAudience.TEAM ? "green" : "cyan", undefined, grant.inherited ? "yellow" : "green"]),
+    ];
+    process.stdout.write(renderTabTable(rows, colors));
+}
+function collect(value, previous) {
+    previous.push(value);
+    return previous;
+}
+export function buildTeamPolicyPlan(sources, bundles) {
+    const enabledSources = sources.filter((source) => source.enabled);
+    const byKey = new Map();
+    for (const { team, policies } of bundles) {
+        for (const policy of policies) {
+            if (!policy.enabled)
+                continue;
+            const kinds = new Set(policy.resourceKinds.map((kind) => kind.trim().toLowerCase()).filter(Boolean));
+            if (kinds.size === 0)
+                continue;
+            const matchingSources = enabledSources.filter((source) => kinds.has(source.kind.trim().toLowerCase()));
+            if (matchingSources.length === 0)
+                continue;
+            const scope = policyScope(policy);
+            if (scope === undefined)
+                continue;
+            const repoKeys = scope === SharingScope.REPOS ? normalizeList(policy.repoKeys) : [];
+            if (scope === SharingScope.REPOS && repoKeys.length === 0)
+                continue;
+            const targets = policyTargets(policy);
+            if (targets.length === 0)
+                continue;
+            for (const source of matchingSources) {
+                for (const target of targets) {
+                    const key = [source.sourceId, team.teamId, target.audience, target.userId].join(":");
+                    const existing = byKey.get(key);
+                    if (!existing) {
+                        byKey.set(key, {
+                            sourceId: source.sourceId,
+                            sourceName: source.displayName,
+                            sourceKind: source.kind,
+                            teamId: team.teamId,
+                            teamName: team.name,
+                            audience: target.audience,
+                            userIds: target.userId ? [target.userId] : [],
+                            scope,
+                            repoKeys,
+                            policyNames: [policy.name],
+                        });
+                        continue;
+                    }
+                    existing.policyNames = normalizeList([...existing.policyNames, policy.name]);
+                    if (existing.scope === SharingScope.ALL || scope === SharingScope.ALL) {
+                        existing.scope = SharingScope.ALL;
+                        existing.repoKeys = [];
+                    }
+                    else {
+                        existing.repoKeys = normalizeList([...existing.repoKeys, ...repoKeys]);
+                    }
+                }
+            }
+        }
+    }
+    return Array.from(byKey.values()).sort((a, b) => a.teamName.localeCompare(b.teamName)
+        || a.sourceName.localeCompare(b.sourceName)
+        || formatAudience(a.audience, a.userIds[0]).localeCompare(formatAudience(b.audience, b.userIds[0])));
+}
+export async function listTeamPolicyBundles(runtime, teams) {
+    const results = await Promise.allSettled(teams.map(async (team) => ({
+        team,
+        policies: (await listTeamSharingPolicies(runtime, team.teamId)).policies,
+    })));
+    const bundles = [];
+    for (let index = 0; index < results.length; index += 1) {
+        const result = results[index];
+        if (result?.status === "fulfilled") {
+            bundles.push(result.value);
+        }
+        else {
+            const team = teams[index];
+            console.warn(`Skipping team sharing policies for ${team?.name ?? "unknown team"}: ${errorMessage(result?.reason)}`);
+        }
+    }
+    return bundles;
+}
+function policyScope(policy) {
+    const scope = policy.shareScope.trim().toLowerCase();
+    if (scope === "" || scope === "all")
+        return SharingScope.ALL;
+    if (scope === "repos")
+        return SharingScope.REPOS;
+    console.warn(`Skipping policy "${policy.name}": unknown scope "${policy.shareScope}".`);
+    return undefined;
+}
+function policyTargets(policy) {
+    switch (policy.audience.trim().toLowerCase()) {
+        case "team":
+            return [{ audience: SharingAudience.TEAM }];
+        case "admins":
+            return [{ audience: SharingAudience.TEAM_ADMINS }];
+        case "user":
+        case "users":
+            return normalizeList(policy.audienceUserIds).map((userId) => ({ audience: SharingAudience.USER, userId }));
+        default:
+            console.warn(`Skipping policy "${policy.name}": unknown audience "${policy.audience}".`);
+            return [];
+    }
+}
+function normalizeList(values = []) {
+    const seen = new Set();
+    const result = [];
+    for (const value of values) {
+        const trimmed = value.trim();
+        if (!trimmed || seen.has(trimmed))
+            continue;
+        seen.add(trimmed);
+        result.push(trimmed);
+    }
+    return result;
+}
+export async function planTeamPolicyChanges(runtime, plan) {
+    const sourceIds = [...new Set(plan.map((item) => item.sourceId))];
+    const sharingBySource = new Map(await Promise.all(sourceIds.map(async (sourceId) => [sourceId, await getNodeSharing(runtime, sourceId)])));
+    return diffTeamPolicyPlan(plan, sharingBySource);
+}
+export function diffTeamPolicyPlan(plan, sharingBySource) {
+    const changes = [];
+    for (const item of plan) {
+        const grant = directGrantFor(item, sharingBySource.get(item.sourceId));
+        if (!grant) {
+            changes.push({ ...item, action: "add" });
+            continue;
+        }
+        if (grant.scope === item.scope && sameSet(grant.repoKeys ?? [], item.repoKeys))
+            continue;
+        changes.push({ ...item, action: "change" });
+    }
+    return changes;
+}
+function directGrantFor(item, sharing) {
+    return sharing?.grants.find((grant) => !grant.inherited
+        && grant.teamId === item.teamId
+        && grant.audience === item.audience
+        && (item.audience !== SharingAudience.USER || grant.userId === item.userIds[0])
+        && (item.audience === SharingAudience.USER || !grant.userId));
+}
+function sameSet(left, right) {
+    const normalizedLeft = normalizeList(left).sort();
+    const normalizedRight = normalizeList(right).sort();
+    return normalizedLeft.length === normalizedRight.length && normalizedLeft.every((value, index) => value === normalizedRight[index]);
+}
+function printTeamPolicyPlan(plan) {
+    console.log("Team sharing policies will apply these changes:");
+    const rows = [
+        ["ACTION", "TEAM", "INTEGRATION", "AUDIENCE", "SCOPE", "POLICY"],
+        ...plan.map((item) => [
+            item.action.toUpperCase(),
+            item.teamName,
+            item.sourceName,
+            formatAudience(item.audience, item.userIds[0]),
+            item.scope === SharingScope.REPOS ? `repos:${item.repoKeys.join(",")}` : "all",
+            item.policyNames.join(", "),
+        ]),
+    ];
+    const colors = [
+        ["bold", "bold", "bold", "bold", "bold", "bold"],
+        ...plan.map((item) => [item.action === "change" ? "yellow" : "green", "dim", undefined, item.audience === SharingAudience.TEAM ? "green" : "cyan", undefined, "dim"]),
+    ];
+    process.stdout.write(renderTabTable(rows, colors));
+}
+export function parseAudience(value) {
+    if (isAudienceInput(value))
+        return AUDIENCES[value];
+    throw new Error("--audience must be team, admins, or user.");
+}
+export function parseScope(value) {
+    if (isScopeInput(value))
+        return SCOPES[value];
+    throw new Error("--scope must be all or repos.");
+}
+export function formatAudience(audience, userId) {
+    if (audience === SharingAudience.TEAM)
+        return "team";
+    if (audience === SharingAudience.TEAM_ADMINS)
+        return "admins";
+    if (audience === SharingAudience.USER)
+        return `user:${userId ?? ""}`;
+    return "unknown";
+}
+export function shareRequest(nodeId, options) {
+    const audience = parseAudience(options.audience);
+    const scope = parseScope(options.scope);
+    const userIds = options.user ?? [];
+    const repoKeys = options.repo ?? [];
+    if (audience === SharingAudience.USER && userIds.length === 0) {
+        throw new Error("--audience user requires at least one --user.");
+    }
+    if (audience !== SharingAudience.USER && userIds.length > 0) {
+        throw new Error("--user can only be used with --audience user.");
+    }
+    if (scope === SharingScope.REPOS && repoKeys.length === 0) {
+        throw new Error("--scope repos requires at least one --repo.");
+    }
+    if (scope !== SharingScope.REPOS && repoKeys.length > 0) {
+        throw new Error("--repo can only be used with --scope repos.");
+    }
+    return {
+        nodeId,
+        teamId: options.team,
+        audience,
+        userIds,
+        scope,
+        repoKeys,
+    };
+}
+function isAudienceInput(value) {
+    return Object.hasOwn(AUDIENCES, value);
+}
+function isScopeInput(value) {
+    return Object.hasOwn(SCOPES, value);
+}

package/dist/commands/status.js

@@ -0,0 +1,67 @@
+import { getAuthState, getRuntimeStatus, listSources } from "../nera/client.js";
+import { probeRuntime } from "../nera/process.js";
+export async function status() {
+    const runtime = await probeRuntime();
+    if (!runtime) {
+        console.log("Nessie is not running.");
+        return;
+    }
+    console.log("Nessie is running.");
+    try {
+        const auth = await getAuthState(runtime);
+        if (auth.user?.email)
+            console.log(`Signed in as ${auth.user.email}.`);
+        for (const line of billingLines(auth.billing))
+            console.log(line);
+        const { sources } = await listSources(runtime);
+        const enabled = sources.filter((source) => source.enabled);
+        console.log(`Enabled integrations: ${enabled.length}.`);
+        const runtimeStatus = await getRuntimeStatus(runtime);
+        for (const line of engineLines("Ingestion", runtimeStatus.ingestion))
+            console.log(line);
+        for (const line of engineLines("Cloud sync", runtimeStatus.cloudSync))
+            console.log(line);
+    }
+    catch {
+        // A healthy runtime without auth is still a useful status.
+    }
+}
+/** Renders the last known billing status. An unset status (not fetched
+ * yet, offline) prints nothing - unknown is not "no access". */
+export function billingLines(billing) {
+    if (!billing || !billing.tier)
+        return [];
+    const plan = billing.accessSource === "team_subscription" && billing.teamName
+        ? `${billing.tier} (via team ${billing.teamName})`
+        : billing.tier;
+    const lines = [`Plan: ${plan}.`];
+    if (!billing.hasAccess) {
+        lines.push("No active subscription: Nessie is paused. Join a team or subscribe to resume.");
+    }
+    return lines;
+}
+export function engineLines(label, status) {
+    if (!status)
+        return [];
+    const state = status.running
+        ? `running${status.lastTrigger ? ` (${status.lastTrigger})` : ""}`
+        : "idle";
+    const lines = [`${label}: ${state}. Automatic: ${status.autoEnabled ? "on" : "off"}.`];
+    lines.push(`${label} last started: ${timestampOrNever(status.lastStartedAt)}.`);
+    lines.push(`${label} last succeeded: ${timestampOrNever(status.lastSuccessAt)}.`);
+    if (status.lastSkippedAt) {
+        const reason = status.lastSkipReason ? ` (${status.lastSkipReason})` : "";
+        lines.push(`${label} last skipped: ${status.lastSkippedAt}${reason}.`);
+    }
+    if (status.lastCompletedAt &&
+        status.lastCompletedAt !== status.lastSuccessAt &&
+        status.lastCompletedAt !== status.lastSkippedAt) {
+        lines.push(`${label} last completed: ${status.lastCompletedAt}.`);
+    }
+    if (status.lastError)
+        lines.push(`${label} last error: ${status.lastError}.`);
+    return lines;
+}
+function timestampOrNever(value) {
+    return value && value.length > 0 ? value : "never";
+}

package/dist/commands/teams.js

@@ -0,0 +1,64 @@
+import { enableCloudSync, listTeamInvites, listTeams, respondToTeamInvite } from "../nera/client.js";
+import { ensureRuntime } from "../nera/process.js";
+import { renderTabTable } from "../platform/table.js";
+export function registerTeamCommands(program) {
+    const teams = program.command("teams").description("Manage Nessie teams.");
+    teams.command("list").alias("ls").description("List teams.").action(teamList);
+    teams.command("invites").description("List pending team invites.").action(teamInvites);
+    teams.command("accept <team-id>").description("Accept a team invite.").action((teamId) => respond(teamId, true));
+    teams.command("decline <team-id>").description("Decline a team invite.").action((teamId) => respond(teamId, false));
+}
+async function teamList() {
+    const runtime = await ensureRuntime({ detached: true });
+    const { teams } = await listTeams(runtime);
+    if (teams.length === 0) {
+        console.log("No teams.");
+        return;
+    }
+    const rows = [
+        ["NAME", "ROLE", "ID"],
+        ...teams.map((team) => [team.name, team.role, team.teamId]),
+    ];
+    const colors = [
+        ["bold", "bold", "bold"],
+        ...teams.map((team) => [undefined, team.role === "admin" ? "green" : "cyan", "dim"]),
+    ];
+    process.stdout.write(renderTabTable(rows, colors));
+}
+async function teamInvites() {
+    const runtime = await ensureRuntime({ detached: true });
+    const { invites } = await listTeamInvites(runtime);
+    if (invites.length === 0) {
+        console.log("No pending invites.");
+        return;
+    }
+    const rows = [
+        ["TEAM", "INVITED BY", "CREATED", "ID"],
+        ...invites.map((invite) => [invite.teamName, invite.invitedByName, invite.createdAt, invite.teamId]),
+    ];
+    const colors = [
+        ["bold", "bold", "bold", "bold"],
+        ...invites.map(() => [undefined, undefined, "dim", "dim"]),
+    ];
+    process.stdout.write(renderTabTable(rows, colors));
+}
+async function respond(teamId, accept) {
+    const runtime = await ensureRuntime({ detached: true });
+    await respondToTeamInvite(runtime, teamId, accept);
+    console.log(accept ? "Invite accepted." : "Invite declined.");
+    if (accept)
+        await enableCloudSyncForTeam(runtime, teamId);
+}
+/** Teams share through Nessie Cloud, so joining one opts the account into cloud sync. */
+export async function enableCloudSyncForTeam(runtime, teamId) {
+    try {
+        await enableCloudSync(runtime);
+        console.log("Cloud sync enabled. Your team shares data through Nessie Cloud.");
+    }
+    catch (error) {
+        console.log(`Cloud sync could not be enabled: ${error instanceof Error ? error.message : String(error)}`);
+        // Re-accepting an already-accepted invite is a no-op on the backend but
+        // re-fires this enable, so it works as a durable retry.
+        console.log(`Team sharing needs cloud sync. Run \`nessie-daemon teams accept ${teamId}\` again to retry.`);
+    }
+}

package/dist/nera/client.js

@@ -0,0 +1,156 @@
+import { existsSync } from "node:fs";
+import { promisify } from "node:util";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import * as grpc from "@grpc/grpc-js";
+import * as protoLoader from "@grpc/proto-loader";
+export var AuthStatus;
+(function (AuthStatus) {
+    AuthStatus[AuthStatus["SIGNED_IN"] = 3] = "SIGNED_IN";
+    AuthStatus[AuthStatus["REAUTH_REQUIRED"] = 4] = "REAUTH_REQUIRED";
+})(AuthStatus || (AuthStatus = {}));
+export class NeraRpcError extends Error {
+    code;
+    nessieError;
+    constructor(message, code, nessieError) {
+        super(message);
+        this.code = code;
+        this.nessieError = nessieError;
+        this.name = "NeraRpcError";
+    }
+}
+const moduleDir = dirname(fileURLToPath(import.meta.url));
+const packagedProtoPath = resolve(moduleDir, "../../vendor/proto/nessie.edge.v1.proto");
+const sourceProtoPath = resolve(moduleDir, "../../../nera/proto/nessie.edge.v1.proto");
+const protoPath = existsSync(packagedProtoPath) ? packagedProtoPath : sourceProtoPath;
+const packageDefinition = protoLoader.loadSync(protoPath, {
+    keepCase: false,
+    longs: String,
+    enums: Number,
+    defaults: true,
+    oneofs: true,
+});
+const proto = grpc.loadPackageDefinition(packageDefinition);
+const NeraClient = proto.nessie.edge.v1.Nera;
+export async function getHealth(endpoint) {
+    return call(endpoint, "GetHealth", {});
+}
+export async function beginSignIn(endpoint) {
+    return call(endpoint, "BeginSignIn", {});
+}
+export async function setApiKey(endpoint, apiKey) {
+    return call(endpoint, "SetApiKey", { apiKey });
+}
+export async function startDevicePairing(endpoint, deviceName) {
+    return call(endpoint, "StartDevicePairing", { deviceName });
+}
+export async function switchAccount(endpoint, userId) {
+    return call(endpoint, "SwitchAccount", { userId });
+}
+export async function signOut(endpoint, userId) {
+    return call(endpoint, "SignOut", { userId: userId ?? "" });
+}
+export async function getAuthState(endpoint) {
+    return call(endpoint, "GetAuthState", {});
+}
+export async function getRuntimeStatus(endpoint) {
+    return call(endpoint, "GetRuntimeStatus", {});
+}
+export async function listTeams(endpoint) {
+    return call(endpoint, "ListTeams", {});
+}
+export async function listTeamInvites(endpoint) {
+    return call(endpoint, "ListTeamInvites", {});
+}
+export async function respondToTeamInvite(endpoint, teamId, accept) {
+    return call(endpoint, "RespondToTeamInvite", { teamId, accept });
+}
+export async function listTeamSharingPolicies(endpoint, teamId) {
+    return call(endpoint, "ListTeamSharingPolicies", { teamId });
+}
+export async function discoverSources(endpoint) {
+    return call(endpoint, "DiscoverSources", {});
+}
+export async function listSources(endpoint) {
+    return call(endpoint, "ListSources", {});
+}
+export async function addSource(endpoint, kind, basePath, enabled, alreadyAdded) {
+    if (alreadyAdded) {
+        const { sources } = await listSources(endpoint);
+        const existing = sources.find((source) => source.kind === kind && source.basePath === basePath);
+        if (!existing)
+            throw new Error(`Source ${kind} at ${basePath} was reported as added but could not be listed.`);
+        return call(endpoint, "ConfigureSource", { sourceId: existing.sourceId, enabled, basePath });
+    }
+    return call(endpoint, "AddSource", { kind, basePath, enabled });
+}
+export async function configureSource(endpoint, sourceId, enabled) {
+    return call(endpoint, "ConfigureSource", { sourceId, enabled });
+}
+export async function removeSource(endpoint, sourceId) {
+    return call(endpoint, "RemoveSource", { sourceId });
+}
+export async function startIngestion(endpoint) {
+    return call(endpoint, "StartIngestion", {});
+}
+export async function stopIngestion(endpoint) {
+    return call(endpoint, "StopIngestion", {});
+}
+export async function startCloudSync(endpoint) {
+    return call(endpoint, "StartCloudSync", {});
+}
+export async function triggerIngestion(endpoint) {
+    return call(endpoint, "TriggerIngestion", {});
+}
+export async function triggerCloudSync(endpoint) {
+    return call(endpoint, "TriggerCloudSync", {});
+}
+/** Account-level opt-in: runs a sync preflight and turns the automatic loop on. */
+export async function enableCloudSync(endpoint) {
+    return call(endpoint, "EnableCloudSync", {});
+}
+/**
+ * Turns the automatic loop off; the account-level flag stays set on the backend.
+ * Intentionally has no CLI entrypoint: cloud sync is default-off and opt-in
+ * rides team-invite accept only (product decision 2026-07-05), so this wrapper
+ * exists for API symmetry and non-CLI consumers of the daemon surface.
+ */
+export async function disableCloudSync(endpoint) {
+    return call(endpoint, "DisableCloudSync", {});
+}
+export async function getNodeSharing(endpoint, nodeId) {
+    return call(endpoint, "GetNodeSharing", { nodeId });
+}
+export async function shareNode(endpoint, request) {
+    return call(endpoint, "ShareNode", request);
+}
+export async function unshareNode(endpoint, request) {
+    return call(endpoint, "UnshareNode", { nodeId: request.nodeId, teamId: request.teamId ?? "", userIds: request.userIds ?? [] });
+}
+async function call(endpoint, method, request) {
+    const client = new NeraClient(`${endpoint.host}:${endpoint.port}`, grpc.credentials.createInsecure());
+    const metadata = new grpc.Metadata();
+    metadata.set("authorization", `Bearer ${endpoint.token}`);
+    const rpc = promisify(client[method].bind(client));
+    try {
+        return await rpc(request, metadata);
+    }
+    catch (error) {
+        if (isServiceError(error)) {
+            throw new NeraRpcError(error.details || error.message, error.code, metadataValue(error.metadata, "nessie-error"));
+        }
+        throw error;
+    }
+    finally {
+        client.close();
+    }
+}
+function isServiceError(error) {
+    return typeof error === "object" && error !== null && "code" in error && "metadata" in error;
+}
+function metadataValue(metadata, key) {
+    const value = metadata?.get(key)[0];
+    if (typeof value === "string")
+        return value;
+    return value?.toString();
+}