@newly/cli 0.1.2 → 0.1.27

package/dist/commands/image.js

@@ -0,0 +1,145 @@
+import { InvalidArgumentError, Option } from 'commander';
+import { ApiClient, friendlyApiError } from '../api.js';
+import { requireCredentials } from '../config.js';
+import { formatAge, formatState, printJson, renderDetails, renderTable, shortDigest, StatusLine, style, } from '../terminal.js';
+const POLL_INTERVAL_MS = 3_000;
+const DEFAULT_WAIT_TIMEOUT_SECONDS = 1_200;
+function runCloudApi() {
+    const credentials = requireCredentials();
+    return new ApiClient(credentials.apiUrl, credentials.token);
+}
+function print(value, opts) {
+    if (opts.json) {
+        printJson(value);
+        return;
+    }
+    console.log(renderImage(value));
+}
+function renderImage(row, title) {
+    const heading = title ??
+        (row.state === 'ready'
+            ? '✓ Image ready'
+            : row.state === 'failed'
+                ? '✗ Image build failed'
+                : '◐ Image build started');
+    const footer = row.state === 'building'
+        ? `${style.dim('Follow:')}  runcloud image list`
+        : undefined;
+    return renderDetails(heading, [
+        { label: 'Reference', value: row.ref ?? row.name },
+        { label: 'State', value: formatState(row.state) },
+        { label: 'Digest', value: shortDigest(row.digest) },
+        { label: 'Created', value: formatAge(row.createdAt) },
+        { label: 'Error', value: row.error },
+    ], footer);
+}
+function renderImageList(rows) {
+    if (rows.length === 0) {
+        return `${style.bold('Images')}\n\nNo images registered.\n\n${style.dim('Register one:')}  runcloud image create --ref python:3.12-slim`;
+    }
+    return renderTable(`Images (${rows.length})`, [
+        { key: 'ref', label: 'REFERENCE', maxWidth: 44 },
+        { key: 'state', label: 'STATE', maxWidth: 12 },
+        { key: 'digest', label: 'DIGEST' },
+        { key: 'age', label: 'AGE' },
+    ], rows.map((row) => ({
+        ref: row.ref ?? row.name,
+        state: formatState(row.state),
+        digest: shortDigest(row.digest) ?? '—',
+        age: formatAge(row.createdAt) ?? '—',
+    })));
+}
+async function run(fn) {
+    try {
+        await fn();
+    }
+    catch (err) {
+        console.error(friendlyApiError(err));
+        process.exitCode = 1;
+    }
+}
+function withOutput(cmd) {
+    return cmd.option('--json', 'output JSON', false);
+}
+function parseTimeoutSeconds(value) {
+    const n = Number(value);
+    if (!Number.isFinite(n) || n <= 0) {
+        throw new InvalidArgumentError('--timeout must be a positive number of seconds');
+    }
+    return n;
+}
+const TERMINAL_STATES = new Set(['ready', 'failed']);
+export async function pollImageRegistration(api, ref, opts = {}) {
+    const intervalMs = opts.intervalMs ?? POLL_INTERVAL_MS;
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_WAIT_TIMEOUT_SECONDS * 1000;
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        const data = await api.get('/run-cloud/images');
+        const items = (data?.items ?? []);
+        const row = items.find((item) => item.ref === ref || item.name === ref);
+        if (row)
+            opts.onState?.(row.state);
+        if (row && TERMINAL_STATES.has(row.state))
+            return row;
+        if (Date.now() > deadline) {
+            throw new Error(`Timed out after ${Math.round(timeoutMs / 1000)}s waiting for image ${ref} to become ready`);
+        }
+        await new Promise((done) => setTimeout(done, intervalMs));
+    }
+}
+export function registerImage(program) {
+    const image = program
+        .command('image')
+        .description('Register and manage the OCI images run.cloud sandboxes boot from');
+    withOutput(image
+        .command('create')
+        .description('Register (build-once) an OCI image ref for run.cloud sandboxes')
+        .requiredOption('--ref <ref>', 'OCI image ref to register, e.g. python:3.12-slim')
+        .option('--no-wait', 'return after scheduling instead of waiting for the image build')
+        .option('--timeout <seconds>', 'max time to wait in seconds', parseTimeoutSeconds, DEFAULT_WAIT_TIMEOUT_SECONDS)
+        .addOption(new Option('--wait').hideHelp())).action((opts) => run(async () => {
+        const api = runCloudApi();
+        const created = await api.post('/run-cloud/images', { ref: opts.ref });
+        if (!opts.wait || created?.state === 'ready') {
+            print(created, opts);
+            return;
+        }
+        const status = opts.json ? undefined : new StatusLine();
+        status?.update(`Building ${opts.ref}`);
+        const finalRow = await pollImageRegistration(api, opts.ref, {
+            timeoutMs: opts.timeout * 1000,
+            onState: (state) => status?.update(state === 'building' ? `Building ${opts.ref}` : `${opts.ref} is ${state}`),
+        });
+        if (finalRow.state === 'failed') {
+            status?.fail(`Image build failed`);
+            throw new Error(finalRow.error
+                ? `image ${opts.ref} failed to build: ${finalRow.error}`
+                : `image ${opts.ref} failed to build`);
+        }
+        status?.clear();
+        print(finalRow, opts);
+    }));
+    withOutput(image.command('list').description('List images your organization has registered')).action((opts) => run(async () => {
+        const data = await runCloudApi().get('/run-cloud/images');
+        const rows = (data?.items ?? []);
+        if (opts.json)
+            printJson(rows);
+        else
+            console.log(renderImageList(rows));
+    }));
+    withOutput(image
+        .command('refresh')
+        .description("Move a tag's pin to its current upstream digest")
+        .argument('<ref>', 'OCI image ref to refresh')).action((ref, opts) => run(async () => {
+        const refreshed = await runCloudApi().post('/run-cloud/images/refresh', { ref });
+        if (opts.json)
+            printJson(refreshed);
+        else {
+            console.log(renderDetails('✓ Image refreshed', [
+                { label: 'Reference', value: refreshed?.ref ?? ref },
+                { label: 'Previous', value: shortDigest(refreshed?.old_digest) },
+                { label: 'Digest', value: shortDigest(refreshed?.new_digest ?? refreshed?.digest) },
+            ]));
+        }
+    }));
+}

package/dist/commands/login.js

@@ -1,9 +1,39 @@
 import http from 'node:http';
 import crypto from 'node:crypto';
+import { hostname } from 'node:os';
 import { spawn } from 'node:child_process';
-import { clearCredentials, credentialsDisplayPath, saveCredentials } from '../config.js';
-const DEFAULT_APP_URL = process.env.NEWLY_APP_URL ?? 'https://newly.app';
+import { ApiClient, ApiError } from '../api.js';
+import { clearCredentials, credentialsDisplayPath, loadCredentials, normalizeApiUrl, saveCredentials, } from '../config.js';
+import { acquirePromptIO, ask, PromptAbortedError, select, } from '../prompt.js';
+import { AuthError, createApiKey, fetchProviders, isValidEmail, isValidOtp, normalizeOtp, sendEmailCode, verifyEmailCode, } from '../runCloudAuth.js';
 const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+export const DEFAULT_RUN_CLOUD_API_URL = 'https://api.run.cloud';
+export function loginChoices(providers) {
+    const choices = [];
+    if (providers.emailOtp) {
+        choices.push({ value: 'email', label: 'Email', hint: 'a code is sent to your inbox' });
+    }
+    if (providers.google) {
+        choices.push({ value: 'google', label: 'Google', hint: 'opens your browser' });
+    }
+    if (providers.github) {
+        choices.push({ value: 'github', label: 'GitHub', hint: 'opens your browser' });
+    }
+    return choices;
+}
+export function methodFromFlags(flags) {
+    const chosen = [];
+    if (flags.email)
+        chosen.push('email');
+    if (flags.google)
+        chosen.push('google');
+    if (flags.github)
+        chosen.push('github');
+    if (chosen.length > 1) {
+        throw new Error(`Pick one sign-in method: ${chosen.map((m) => `--${m}`).join(' and ')} conflict.`);
+    }
+    return chosen[0] ?? null;
+}
 export async function startCallbackServer(state, appOrigin, timeoutMs) {
     let resolvePayload;
     let rejectPayload;
@@ -11,11 +41,15 @@ export async function startCallbackServer(state, appOrigin, timeoutMs) {
         resolvePayload = resolve;
         rejectPayload = reject;
     });
-    const timer = setTimeout(() => rejectPayload(new Error(`Login timed out after ${timeoutMs / 1000}s`)), timeoutMs);
+    const timer = setTimeout(() => rejectPayload(new Error(`Login timed out after ${timeoutMs / 1000}s.\n` +
+        "If the browser said the local handoff was blocked, Chrome gates HTTPS→localhost behind a permission: " +
+        'click the icon at the left of the address bar, allow "access to apps on this device", ' +
+        'then run login again (or use --manual).')), timeoutMs);
     const corsHeaders = {
         'Access-Control-Allow-Origin': appOrigin,
         'Access-Control-Allow-Methods': 'POST, OPTIONS',
         'Access-Control-Allow-Headers': 'content-type',
+        'Access-Control-Allow-Private-Network': 'true',
     };
     const server = http.createServer((req, res) => {
         if (req.method === 'OPTIONS') {
@@ -38,6 +72,22 @@ export async function startCallbackServer(state, appOrigin, timeoutMs) {
                     res.end('state mismatch');
                     return;
                 }
+                if (typeof parsed.token !== 'string' ||
+                    parsed.token.length === 0 ||
+                    typeof parsed.expiresIn !== 'number' ||
+                    !Number.isFinite(parsed.expiresIn) ||
+                    parsed.expiresIn <= 0 ||
+                    typeof parsed.apiUrl !== 'string') {
+                    res.writeHead(400, corsHeaders);
+                    res.end('invalid credential payload');
+                    return;
+                }
+                const apiUrl = new URL(parsed.apiUrl);
+                if (!['http:', 'https:'].includes(apiUrl.protocol)) {
+                    res.writeHead(400, corsHeaders);
+                    res.end('invalid API URL');
+                    return;
+                }
                 res.writeHead(200, { ...corsHeaders, 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ ok: true }));
                 clearTimeout(timer);
@@ -64,7 +114,7 @@ export async function startCallbackServer(state, appOrigin, timeoutMs) {
         },
     };
 }
-function openBrowser(url) {
+export function openBrowser(url) {
     const [cmd, args] = process.platform === 'darwin'
         ? ['open', [url]]
         : process.platform === 'win32'
@@ -75,6 +125,54 @@ function openBrowser(url) {
     });
     child.unref();
 }
+export function cliAuthUrl(appUrl, port, state, provider) {
+    const url = new URL('/cli-auth', appUrl);
+    url.searchParams.set('port', String(port));
+    url.searchParams.set('state', state);
+    if (provider)
+        url.searchParams.set('provider', provider);
+    return url.toString();
+}
+export async function emailLogin(apiUrl, presetEmail, io) {
+    const email = presetEmail?.trim()
+        ? presetEmail.trim()
+        : await ask('  Email: ', {
+            io,
+            validate: (value) => (isValidEmail(value) ? null : 'That does not look like an email address.'),
+        });
+    if (!isValidEmail(email))
+        throw new Error(`Not a valid email address: ${email}`);
+    await sendEmailCode(apiUrl, email);
+    console.log(`  Code sent to ${email}\n`);
+    let session = null;
+    for (let attempt = 1; attempt <= 3 && !session; attempt += 1) {
+        const code = await ask('  Code: ', {
+            io,
+            validate: (value) => (isValidOtp(value) ? null : 'Codes are six digits.'),
+        });
+        try {
+            session = await verifyEmailCode(apiUrl, email, normalizeOtp(code));
+        }
+        catch (e) {
+            const wrongCode = e instanceof AuthError && (e.status === 400 || e.status === 401);
+            if (!wrongCode || attempt === 3)
+                throw e;
+            console.log(`  ${e.message} — try again.\n`);
+        }
+    }
+    if (!session)
+        throw new Error('Could not verify the code.');
+    const token = await createApiKey(apiUrl, session.sessionToken, `runcloud CLI (${hostLabel()})`);
+    return { email, token };
+}
+function hostLabel() {
+    try {
+        return hostname() || 'cli';
+    }
+    catch {
+        return 'cli';
+    }
+}
 export function parseManualCredential(blob) {
     let parsed;
     try {
@@ -90,39 +188,113 @@ export function parseManualCredential(blob) {
     }
     return { token: c.token, expiresIn: c.expiresIn, apiUrl: c.apiUrl };
 }
+export async function verifyRunCloudCredential(apiUrl, token) {
+    try {
+        await new ApiClient(normalizeApiUrl(apiUrl), token).get('/run-cloud/account');
+    }
+    catch (e) {
+        if (e instanceof ApiError && (e.status === 401 || e.status === 403)) {
+            throw new Error(`${apiUrl} rejected this credential (${e.status}). Make sure you signed in to the account ` +
+                'you want the CLI to use, then run login again.');
+        }
+        console.warn(`Warning: could not verify the credential against ${apiUrl} ` +
+            `(${e instanceof Error ? e.message : String(e)}). Saving it anyway.`);
+    }
+}
+export async function revokeRunCloudCredential(apiUrl, token) {
+    try {
+        await new ApiClient(normalizeApiUrl(apiUrl), token).delete('/run-cloud/api-keys/self');
+        return 'Credential revoked.';
+    }
+    catch (e) {
+        if (e instanceof ApiError && (e.status === 401 || e.status === 403)) {
+            return 'Credential was already invalid.';
+        }
+        return (`Warning: could not reach ${apiUrl} to revoke this credential ` +
+            `(${e instanceof Error ? e.message : String(e)}). It may still be valid — ` +
+            'revoke it from the run.cloud dashboard.');
+    }
+}
+export function existingLoginSummary(creds) {
+    const who = creds.account ? ` as ${creds.account}` : '';
+    const expiry = creds.expiresAt < Number.MAX_SAFE_INTEGER
+        ? `, valid until ${new Date(creds.expiresAt * 1000).toLocaleString()}`
+        : '';
+    return `You are already logged in${who} (${creds.apiUrl}${expiry}).`;
+}
+export async function confirmReplaceExistingLogin(creds) {
+    if (!creds)
+        return true;
+    const terminal = acquirePromptIO();
+    if (!terminal)
+        return true;
+    try {
+        console.log(`\n  ${existingLoginSummary(creds)}`);
+        const choice = await select('  Do you want to continue?', [
+            { value: 'keep', label: 'Keep this session', hint: 'nothing to do' },
+            { value: 'again', label: 'Log in again', hint: 'replaces the saved credential' },
+        ], terminal.io);
+        return choice === 'again';
+    }
+    finally {
+        terminal.close();
+    }
+}
 export function registerLogin(program) {
+    const isRunCloud = program.name() === 'runcloud';
+    const defaultAppUrl = isRunCloud
+        ? process.env.RUN_CLOUD_APP_URL ?? 'https://run.cloud'
+        : process.env.NEWLY_APP_URL ?? 'https://newly.app';
     program
         .command('login')
-        .description('Log in with your Newly account via the browser')
-        .option('--app-url <url>', 'Newly web app URL', DEFAULT_APP_URL)
-        .option('--manual', 'paste the credential from the browser instead of using the local callback', false)
+        .description(isRunCloud
+        ? 'Log in with your run.cloud account: email, Google, or GitHub'
+        : 'Log in with your Newly account via the browser')
+        .option('--app-url <url>', 'product web app URL', defaultAppUrl)
+        .option('--manual', 'newly skin only: paste the credential from the browser instead of using the local callback', false)
         .option('--api-url <url>', 'explicit API URL (skips browser; use with --token)')
         .option('--token <token>', 'explicit credential token (skips browser; use with --api-url)')
         .option('--expires-in <seconds>', 'session lifetime when using --token (default 7 days)', (v) => Number(v), 604800)
+        .option('--email [address]', 'sign in with an emailed code, without a browser')
+        .option('--google', 'sign in with Google', false)
+        .option('--github', 'sign in with GitHub', false)
+        .option('--browser', 'skip the picker and use the browser handoff', false)
         .action(async (opts) => {
         try {
             const hasApiUrl = typeof opts.apiUrl === 'string' && opts.apiUrl.length > 0;
             const hasToken = typeof opts.token === 'string' && opts.token.length > 0;
-            if (hasApiUrl !== hasToken) {
+            if (!isRunCloud && hasApiUrl !== hasToken) {
                 throw new Error('--api-url and --token must be provided together for headless login.');
             }
-            if (hasApiUrl && hasToken) {
+            if (isRunCloud && hasApiUrl && !hasToken) {
+                throw new Error('--api-url requires --token for headless login.');
+            }
+            if (hasToken) {
+                const apiUrl = isRunCloud
+                    ? opts.apiUrl ?? process.env.RUN_CLOUD_API_URL ?? 'https://api.run.cloud'
+                    : opts.apiUrl;
                 try {
-                    new URL(opts.apiUrl);
+                    new URL(apiUrl);
                 }
                 catch {
-                    throw new Error(`--api-url is not a valid URL: ${opts.apiUrl}`);
+                    throw new Error(`--api-url is not a valid URL: ${apiUrl}`);
                 }
                 saveCredentials({
                     token: opts.token,
-                    apiUrl: opts.apiUrl,
+                    apiUrl,
                     appUrl: opts.appUrl,
-                    expiresAt: Math.floor(Date.now() / 1000) + opts.expiresIn,
+                    expiresAt: isRunCloud
+                        ? Number.MAX_SAFE_INTEGER
+                        : Math.floor(Date.now() / 1000) + opts.expiresIn,
                 });
-                console.log(`Logged in headlessly. Credentials written for API ${opts.apiUrl}.`);
+                console.log(`Logged in headlessly. Credentials written for API ${apiUrl}.`);
+                return;
+            }
+            if (!(await confirmReplaceExistingLogin(loadCredentials()))) {
+                console.log(`  Keeping the credential at ${credentialsDisplayPath()}\n`);
                 return;
             }
-            if (opts.manual) {
+            if (opts.manual && !isRunCloud) {
                 const { createInterface } = await import('node:readline/promises');
                 const rl = createInterface({ input: process.stdin, output: process.stdout });
                 const blob = await rl.question('Paste the credential from the browser: ');
@@ -137,15 +309,79 @@ export function registerLogin(program) {
                 console.log('Logged in.');
                 return;
             }
+            let socialProvider;
+            if (isRunCloud && !opts.browser) {
+                const authApiUrl = opts.apiUrl ?? process.env.RUN_CLOUD_API_URL ?? DEFAULT_RUN_CLOUD_API_URL;
+                let method = methodFromFlags(opts);
+                const terminal = method === 'email' || !method ? acquirePromptIO() : null;
+                try {
+                    if (!method && terminal) {
+                        const providers = await fetchProviders(authApiUrl);
+                        const choices = loginChoices(providers);
+                        if (choices.length === 0) {
+                            throw new Error(`${authApiUrl} has no sign-in methods enabled.`);
+                        }
+                        method = await select('  How do you want to sign in?', choices, terminal.io);
+                    }
+                    if (method === 'email') {
+                        const preset = typeof opts.email === 'string' ? opts.email : undefined;
+                        const { email, token } = await emailLogin(authApiUrl, preset, terminal?.io);
+                        saveCredentials({
+                            token,
+                            apiUrl: authApiUrl,
+                            appUrl: opts.appUrl,
+                            expiresAt: Number.MAX_SAFE_INTEGER,
+                            revocable: true,
+                            account: email,
+                        });
+                        console.log(`\n  Signed in as ${email}`);
+                        console.log(`  Credential saved to ${credentialsDisplayPath()}\n`);
+                        console.log('  Try:');
+                        console.log('    runcloud ios create --open');
+                        console.log('    runcloud sandbox run "echo hello"');
+                        return;
+                    }
+                }
+                finally {
+                    terminal?.close();
+                }
+                if (method === 'google' || method === 'github')
+                    socialProvider = method;
+            }
+            if (isRunCloud) {
+                if (opts.manual) {
+                    console.log('Note: --manual is no longer needed for run.cloud — `runcloud login` works over SSH and headless via device flow.');
+                }
+                const apiUrl = opts.apiUrl ?? process.env.RUN_CLOUD_API_URL ?? DEFAULT_RUN_CLOUD_API_URL;
+                const { runDeviceLogin } = await import('../deviceLogin.js');
+                const payload = await runDeviceLogin({
+                    apiUrl,
+                    appUrl: opts.appUrl,
+                    provider: socialProvider,
+                    openBrowser,
+                });
+                await verifyRunCloudCredential(payload.apiUrl, payload.token);
+                saveCredentials({
+                    token: payload.token,
+                    apiUrl: payload.apiUrl,
+                    appUrl: opts.appUrl,
+                    expiresAt: Math.floor(Date.now() / 1000) + payload.expiresIn,
+                    revocable: true,
+                });
+                console.log(`Logged in. Credentials saved to ${credentialsDisplayPath()}`);
+                return;
+            }
             const state = crypto.randomBytes(16).toString('hex');
             const appOrigin = new URL(opts.appUrl).origin;
             const { port, waitForToken, close } = await startCallbackServer(state, appOrigin, LOGIN_TIMEOUT_MS);
-            const loginUrl = `${opts.appUrl}/cli-auth?port=${port}&state=${state}`;
+            const loginUrl = cliAuthUrl(opts.appUrl, port, state, socialProvider);
             console.log(`Opening your browser to authorize the CLI…\n  ${loginUrl}\n`);
             console.log("If the browser doesn't open, paste the URL above into it manually.");
             openBrowser(loginUrl);
             try {
                 const payload = await waitForToken();
+                if (isRunCloud)
+                    await verifyRunCloudCredential(payload.apiUrl, payload.token);
                 saveCredentials({
                     token: payload.token,
                     apiUrl: payload.apiUrl,
@@ -159,14 +395,25 @@ export function registerLogin(program) {
             }
         }
         catch (e) {
+            if (e instanceof PromptAbortedError) {
+                console.log('Cancelled.');
+                process.exitCode = 130;
+                return;
+            }
             console.error(e instanceof Error ? e.message : String(e));
             process.exitCode = 1;
         }
     });
     program
         .command('logout')
-        .description('Delete the stored CLI credential')
-        .action(() => {
+        .description(isRunCloud
+        ? 'Revoke this machine’s credential and delete it locally'
+        : 'Delete the stored CLI credential')
+        .action(async () => {
+        const creds = loadCredentials();
+        if (isRunCloud && creds?.revocable) {
+            console.log(await revokeRunCloudCredential(creds.apiUrl, creds.token));
+        }
         clearCredentials();
         console.log('Logged out.');
     });