@plime-inc/cli 0.1.0 → 0.1.1

package/README.md

@@ -15,13 +15,13 @@ plime logout
 | --- | --- |
 | `plime login` | ブラウザでログインし、CLIへのアクセスを許可 |
 | `plime login --no-browser` | URLだけ表示。CLIと同じ端末のブラウザで開く |
-| `plime whoami` | JWT署名・issuer・audience・scopeを検証してユーザーIDを表示。期限が近いtokenは自動更新 |
-| `plime whoami --json` | ユーザーID、issuer、resource、scopes、有効期限をJSON出力 |
+| `plime whoami` | JWT署名・issuer・audience・scopeを検証し、ユーザー名 → メールアドレス → IDの順で値だけを表示。期限が近いtokenは自動更新 |
+| `plime whoami --json` | ユーザーID、取得できたユーザー名・メールアドレス、issuer、resource、scopes、有効期限をJSON出力 |
 | `plime logout` | refresh tokenをIDPで失効させ、端末の認証情報を削除 |
 | `plime logout --local` | オフライン時などに端末の認証情報だけを削除。IDPでは失効しない |
 | `--dev` | ローカルIDPを使用。本番とは別に保存 |
 
-標準出力は結果、URLやエラーは標準エラーへ出します。token自体を表示するコマンドはありません。`whoami`は氏名・メールアドレスを要求せず、現在許可されたscopeのユーザーIDを表示します。未ログイン・拒否・通信失敗は終了コード1、中断は130です。
+標準出力は結果、URLやエラーは標準エラーへ出します。token自体を表示するコマンドはありません。表示用のユーザー名・メールアドレスはIDPが署名したtokenから取得します。氏名（`name`）をユーザー名として扱いません。`login`・`whoami`の通常出力に環境名は表示しません。未ログイン・拒否・通信失敗は終了コード1、中断は130です。
 
 認証情報は `$XDG_CONFIG_HOME/plime/<environment>/session.json`（未指定時 `~/.config/plime/<environment>/session.json`）へ保存します。POSIXではディレクトリ700、ファイル600です。暗号化保管やOS Keychainへの保存ではありません。Windowsでは保存先のユーザーACLに依存します。
 
@@ -31,6 +31,8 @@ plime logout
 
 利用開始にはIDPのmigration・公式CLIのprovisionと、accountsのログイン・同意画面のデプロイが必要です。`--dev`ではIDP localhost:8787、accounts localhost:3003を起動し、開発DBでもprovisionしてください。
 
-AIコマンドとAI API側のOAuth検証・利用認可・課金は未実装です。ログイン成功だけではAI APIの利用開始を意味しません。
+AI接続は開発中です。`plime ai jev --json` は標準入力の `{ "state": ..., "questions": ... }` をdecision APIへ送り、結果をJSONで返します。`plime ai text "質問" --model provider/model` と `plime ai models --type decision` も追加しています。個人組織はIDPが署名したtokenから取得するため、以前のログインでは再ログインが必要な場合があります。
+
+課金の受付・消費記録との接続、画像とファイル入力、job操作は未完了です。現時点のAIコマンドを完成版として公開しないでください。
 
 検証: package rootで `vp test run` と `vp lint`。実Better AuthとのOAuth統合テストはmonorepo内のIDPテストfixtureを使います。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plime-inc/cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "PLIME command-line client",
   "author": "@plime-kitajima",
   "license": "UNLICENSED",
@@ -12,6 +12,9 @@
   "bin": {
     "plime": "bin/plime.js"
   },
+  "scripts": {
+    "publish": "npm publish --ignore-scripts --access public --registry=https://registry.npmjs.org/ --@plime-inc:registry=https://registry.npmjs.org/"
+  },
   "files": [
     "bin/",
     "src/",

package/src/ai.js

@@ -0,0 +1,157 @@
+const capabilities = {
+  text: 'text.generate',
+  image: 'image.generate',
+  decision: 'decision.evaluate',
+  embed: 'embed.generate',
+  video: 'video.generate',
+  audio: 'audio.transcribe',
+}
+
+const readInput = async (stdin) => {
+  if (stdin.isTTY) return ''
+
+  const chunks = []
+  let length = 0
+
+  for await (const chunk of stdin) {
+    const bytes = Buffer.from(chunk)
+    length += bytes.length
+    if (length > 1024 * 1024) throw new Error('Input exceeds 1 MiB.')
+
+    chunks.push(bytes)
+  }
+
+  return Buffer.concat(chunks).toString('utf8')
+}
+
+const parseTarget = (model) => {
+  const separator = model?.indexOf('/') ?? -1
+  if (separator < 1 || separator === model.length - 1) throw new Error('Use --model <provider/model>.')
+
+  return {
+    provider: model.slice(0, separator),
+    model: model.slice(separator + 1),
+  }
+}
+
+export const createAiClient = ({ config, commands, signal, fetch: fetcher = globalThis.fetch }) => {
+  const request = (path, { body, query } = {}) => {
+    const operation = async ({ accessToken, identity }) => {
+      const url = new URL(`/api/${path}`, config.resource)
+      if (url.origin !== new URL(config.resource).origin) throw new Error('Unexpected AI endpoint.')
+
+      if (query) url.search = new URLSearchParams(query).toString()
+
+      const headers = {
+        authorization: `Bearer ${accessToken}`,
+        accept: 'application/json',
+      }
+
+      let payload
+
+      if (body) {
+        const organizationId = identity.personalOrganizationId
+        if (!organizationId) {
+          throw new Error('Login does not include a personal organization. Run plime logout, then plime login.')
+        }
+
+        payload = { ...body, metadata: { organizationId } }
+        headers['content-type'] = 'application/json'
+      }
+
+      const timeout = AbortSignal.timeout(120_000)
+
+      const response = await fetcher(url, {
+        method: body ? 'POST' : 'GET',
+        headers,
+        body: payload ? JSON.stringify(payload) : undefined,
+        signal: signal ? AbortSignal.any([ signal, timeout ]) : timeout,
+        redirect: 'error',
+      })
+      // APIが返す本文やHTMLには認証情報が混じり得るため、失敗時にそのまま表示しない。
+      if (!response.ok) throw new Error(`AI request failed (HTTP ${response.status}).`)
+      if (!response.headers.get('content-type')?.includes('application/json')) {
+        throw new Error('AI returned an unexpected response type.')
+      }
+
+      const result = await response.json()
+      if (result.error) throw new Error('AI request failed.')
+
+      return result.data ?? result
+    }
+
+    return commands.authenticated(operation)
+  }
+
+  const models = async (type = 'text') => {
+    const capability = capabilities[type]
+    if (!capability) throw new Error('Unknown model type.')
+
+    const { targets } = await request('catalog/targets', { query: { capability } })
+
+    const listProviderModels = async ({ provider }) => {
+      const catalog = await request(`catalog/targets/${encodeURIComponent(provider)}/models`, { query: { capability } })
+      return catalog.models.map(model => ({ ...model, id: `${provider}/${model.id}` }))
+    }
+
+    const results = await Promise.all(targets.map(listProviderModels))
+
+    return results.flat()
+  }
+
+  const generate = (kind, input, model) => {
+    return request(kind, {
+      body: { ...parseTarget(model), input, response: { mode: 'wait' } },
+    })
+  }
+
+  return { models, generate }
+}
+
+export const runAi = async (args, values, { client, stdin, stdout }) => {
+  const [ command, ...rest ] = args
+  let result
+
+  if (command === 'models') {
+    if (rest.length) throw new Error('Use plime ai models --type <type>.')
+
+    result = await client.models(values.type)
+    const output = values.json ? JSON.stringify(result) : result.map(model => model.id).join('\n')
+    stdout.write(`${output}\n`)
+
+    return
+  }
+
+  if (command === 'jev') {
+    if (rest.length) throw new Error('Pass decision input as JSON on stdin.')
+
+    let input
+
+    try {
+      input = JSON.parse(await readInput(stdin))
+    } catch {
+      throw new Error('Decision input must be JSON containing state and questions.')
+    }
+
+    // npm配布CLIにはprivateな@plime-inc/utilsを持ち込まない。
+    // eslint-disable-next-line plime-utils/prefer-shared-predicate
+    if (!input || Array.isArray(input) || typeof input !== 'object') throw new Error('Decision input must be a JSON object.')
+
+    result = await client.generate('decision', input, values.model || 'typesafe/jev-latest')
+  } else {
+    const prompt = command === 'text' ? rest.join(' ') : args.join(' ')
+    if (!prompt) throw new Error('Provide a prompt for plime ai text.')
+
+    const content = [ prompt, await readInput(stdin) ].filter(Boolean).join('\n\n')
+
+    result = await client.generate('text', {
+      messages: [ { role: 'user', content } ],
+      options: { stream: false },
+    }, values.model)
+  }
+
+  const output = values.json || command === 'jev' ? JSON.stringify(result) : result.result?.text
+  if (typeof output !== 'string') throw new Error('AI returned an unexpected result.')
+
+  stdout.write(`${output}\n`)
+}

package/src/cli.js

@@ -2,13 +2,17 @@ import { parseArgs } from 'node:util'
 import { getConfig } from './config.js'
 import { createStore, getStoreDirectory } from './store.js'
 import { createCommands } from './commands.js'
+import { createAiClient, runAi } from './ai.js'
 
 const help = `Usage: plime <command> [options]
 
 Commands:
   login                Sign in using your browser
   logout               Revoke the CLI login and remove local tokens
-  whoami               Show the authenticated user ID
+  whoami               Show the authenticated account
+  ai text <prompt>     Generate text (--model <provider/model>)
+  ai jev               Evaluate JSON {state, questions} from stdin
+  ai models            List models (--type text|image|decision|embed|video|audio)
 
 Options:
   --dev                Use local IDP with separate login storage
@@ -19,34 +23,69 @@ Options:
   --version, -v        Show version
 `
 
-export const run = async (args, { stdout = process.stdout, stderr = process.stderr, signal, env = process.env } = {}) => {
+export const run = async (args, { stdout = process.stdout, stderr = process.stderr, stdin = process.stdin, signal, env = process.env } = {}) => {
   const { values, positionals } = parseArgs({
-    args, allowPositionals: true, strict: true,
+    args,
+    allowPositionals: true,
+    strict: true,
     options: {
-      dev: { type: 'boolean' }, json: { type: 'boolean' },
-      'no-browser': { type: 'boolean' }, local: { type: 'boolean' },
-      help: { type: 'boolean', short: 'h' }, version: { type: 'boolean', short: 'v' },
+      dev: { type: 'boolean' },
+      json: { type: 'boolean' },
+      'no-browser': { type: 'boolean' },
+      local: { type: 'boolean' },
+      model: { type: 'string' },
+      type: { type: 'string' },
+      help: { type: 'boolean', short: 'h' },
+      version: { type: 'boolean', short: 'v' },
     },
   })
+
   if (values.version) {
     const { default: manifest } = await import('../package.json', { with: { type: 'json' } })
     stdout.write(`${manifest.version}\n`)
     return
   }
-  if (values.help || !positionals.length) { stdout.write(help); return }
+
+  if (values.help || !positionals.length) {
+    stdout.write(help)
+    return
+  }
+
   const [ command ] = positionals
-  if (positionals.length !== 1 || ![ 'login', 'logout', 'whoami' ].includes(command)) throw new Error('Unknown command. Run plime --help.')
+  if (![ 'login', 'logout', 'whoami', 'ai' ].includes(command)) throw new Error('Unknown command. Run plime --help.')
+  if (command !== 'ai' && positionals.length !== 1) throw new Error('Unknown command. Run plime --help.')
   if (values['no-browser'] && command !== 'login') throw new Error('--no-browser is only available for login.')
   if (values.local && command !== 'logout') throw new Error('--local is only available for logout.')
+  if (command !== 'ai' && (values.model || values.type)) throw new Error('--model and --type are only available for ai.')
+  if (command === 'ai' && positionals[1] === 'request') throw new Error('Unknown command. Run plime --help.')
+
   const config = getConfig(values.dev)
   const store = createStore(getStoreDirectory(config.environment, env))
-  const commands = createCommands({ config, store, signal, report: message => stderr.write(`${message}\n`) })
+
+  const commands = createCommands({
+    config,
+    store,
+    signal,
+    report: (message) => stderr.write(`${message}\n`),
+  })
+
+  if (command === 'ai') {
+    const client = createAiClient({ config, commands, signal })
+    return runAi(positionals.slice(1), values, { client, stdin, stdout })
+  }
+
   const result = await commands[command]({ noBrowser: values['no-browser'], local: values.local })
-  if (values.json) { stdout.write(`${JSON.stringify(result)}\n`); return }
+
+  if (values.json) {
+    stdout.write(`${JSON.stringify(result)}\n`)
+    return
+  }
+
   if (command === 'logout') {
     stdout.write(values.local ? 'Local login removed. Server tokens were not revoked.\n' : 'Logged out.\n')
   } else {
-    stdout.write(`${command === 'login' ? 'Logged in as' : 'User'}: ${result.userId}\nEnvironment: ${config.environment}\n`)
+    const account = result.username || result.email || result.userId
+    stdout.write(`${command === 'login' ? 'Logged in as: ' : ''}${account}\n`)
   }
 }
 
@@ -55,6 +94,11 @@ export const errorMessage = (error) => {
   if (error.error === 'access_denied') return 'Login was denied.'
   if (error.error) return 'OAuth request failed. Check the IDP configuration and try logging in again.'
   if ([ 'AbortError', 'TimeoutError' ].includes(error.name)) return 'Request cancelled or timed out.'
-  if (error.code?.startsWith('OAUTH_')) return 'OAuth response validation failed. Please try logging in again.'
+
+  if (error.code?.startsWith('OAUTH_')) {
+    const status = error.cause instanceof Response ? ` (HTTP ${error.cause.status})` : ''
+    return `OAuth response validation failed${status}. Check the IDP and try logging in again.`
+  }
+
   return error.message || 'Command failed.'
 }

package/src/commands.js

@@ -1,60 +1,107 @@
 import { createOAuth, createLoginProof } from './oauth.js'
 import { createLoopback, openBrowser } from './loopback.js'
 
-export const createCommands = ({ config, store, signal, report, oauthFactory = createOAuth, browser = openBrowser }) => {
-  const login = ({ noBrowser = false } = {}) => store.withLock(async () => {
-    if (await store.read()) throw new Error('Already logged in. Run plime logout before switching accounts.')
-    const oauth = await oauthFactory(config, { signal })
-    const { state, verifier } = createLoginProof()
-    const loopback = await createLoopback({ path: config.callbackPath, state, signal })
-    try {
-      const url = await oauth.authorize(loopback.redirectUri, state, verifier)
-      report(`Open this URL to sign in:\n${url}`)
-      if (!noBrowser) {
-        // ブラウザ起動コマンドの終了待ちでcallback受信を止めない。
-        void browser(url).then(opened => { if (!opened) report('Open the URL above in your browser.') })
-      }
-      const callback = await loopback.callback
-      const session = await oauth.exchange(callback, loopback.redirectUri, state, verifier)
-      await store.write(session)
-      return oauth.identity(session.accessToken)
-    } finally {
-      await loopback.close()
-    }
-  }, signal)
-
-  const whoami = () => store.withLock(async () => {
-    let session = await store.read()
-    if (!session) throw new Error('Not logged in. Run plime login.')
-    if (session.issuer !== config.issuer || session.resource !== config.resource) throw new Error('Stored login does not match this environment.')
-    const oauth = await oauthFactory(config, { signal })
-    if (session.expiresAt <= Date.now() + 60_000) {
+export const createCommands = ({
+  config,
+  store,
+  signal,
+  report,
+  oauthFactory = createOAuth,
+  browser = openBrowser,
+}) => {
+  const login = ({ noBrowser = false } = {}) => {
+    const operation = async () => {
+      if (await store.read()) throw new Error('Already logged in. Run plime logout before switching accounts.')
+
+      const oauth = await oauthFactory(config, { signal })
+      const { state, verifier } = createLoginProof()
+      const loopback = await createLoopback({ path: config.callbackPath, state, signal })
+
       try {
-        session = await oauth.refresh(session.refreshToken)
+        const url = await oauth.authorize(loopback.redirectUri, state, verifier)
+        report(`Open this URL to sign in:\n${url}`)
+
+        if (!noBrowser) {
+          // ブラウザ起動コマンドの終了待ちでcallback受信を止めない。
+          const reportBrowser = (opened) => {
+            if (!opened) report('Open the URL above in your browser.')
+          }
+
+          void browser(url).then(reportBrowser)
+        }
+
+        const callback = await loopback.callback
+        const session = await oauth.exchange(callback, loopback.redirectUri, state, verifier)
         await store.write(session)
-      } catch (err) {
-        if (err.error === 'invalid_grant') {
-          await store.remove()
-          throw new Error('Login expired or was revoked. Run plime login again.')
+
+        return oauth.identity(session.accessToken)
+      } finally {
+        await loopback.close()
+      }
+    }
+
+    return store.withLock(operation, signal)
+  }
+
+  const readAuthorization = () => {
+    const operation = async () => {
+      let session = await store.read()
+      if (!session) throw new Error('Not logged in. Run plime login.')
+      if (session.issuer !== config.issuer || session.resource !== config.resource) {
+        throw new Error('Stored login does not match this environment.')
+      }
+
+      const oauth = await oauthFactory(config, { signal })
+
+      if (session.expiresAt <= Date.now() + 60_000) {
+        try {
+          session = await oauth.refresh(session.refreshToken)
+          await store.write(session)
+        } catch (err) {
+          if (err.error === 'invalid_grant') {
+            await store.remove()
+            throw new Error('Login expired or was revoked. Run plime login again.')
+          }
+
+          throw err
         }
-        throw err
       }
+
+      const identity = await oauth.identity(session.accessToken)
+
+      return { accessToken: session.accessToken, identity }
     }
-    return oauth.identity(session.accessToken)
-  }, signal)
-
-  const logout = ({ local = false } = {}) => store.withLock(async () => {
-    if (!local) {
-      const session = await store.read()
-      if (session) {
-        if (session.issuer !== config.issuer || session.resource !== config.resource) throw new Error('Stored login does not match this environment.')
-        const oauth = await oauthFactory(config, { signal })
-        await oauth.revoke(session.refreshToken)
+
+    return store.withLock(operation, signal)
+  }
+
+  const whoami = async () => (await readAuthorization()).identity
+
+  // token更新だけをlock内に置き、AIの実行待ちで他プロセスの認証を止めない。
+  const authenticated = async (operation) => operation(await readAuthorization())
+
+  const logout = ({ local = false } = {}) => {
+    const operation = async () => {
+      if (!local) {
+        const session = await store.read()
+
+        if (session) {
+          if (session.issuer !== config.issuer || session.resource !== config.resource) {
+            throw new Error('Stored login does not match this environment.')
+          }
+
+          const oauth = await oauthFactory(config, { signal })
+          await oauth.revoke(session.refreshToken)
+        }
       }
+
+      await store.remove()
+
+      return { loggedOut: true, localOnly: local }
     }
-    await store.remove()
-    return { loggedOut: true, localOnly: local }
-  }, signal)
 
-  return { login, whoami, logout }
+    return store.withLock(operation, signal)
+  }
+
+  return { login, whoami, logout, authenticated }
 }

package/src/oauth.js

@@ -2,26 +2,32 @@ import * as oauth from 'oauth4webapi'
 
 export const createOAuth = async (config, { signal, fetch: fetcher = globalThis.fetch } = {}) => {
   const issuer = new URL(config.issuer)
+
   const options = () => ({
     signal: signal ? AbortSignal.any([ signal, AbortSignal.timeout(30_000) ]) : AbortSignal.timeout(30_000),
     [oauth.allowInsecureRequests]: config.development,
     [oauth.customFetch]: fetcher,
   })
+
   // discoveryで得たURLにも送信先制限を適用し、tokenを別originへ送信しない。
   const discovery = await oauth.discoveryRequest(issuer, { ...options(), algorithm: 'oauth2' })
   const server = await oauth.processDiscoveryResponse(issuer, discovery)
+
   for (const key of [ 'authorization_endpoint', 'token_endpoint', 'revocation_endpoint', 'jwks_uri' ]) {
     const endpoint = new URL(server[key])
     if (endpoint.origin !== issuer.origin || endpoint.username || endpoint.password || endpoint.hash) {
       throw new Error('IDP returned an unexpected OAuth endpoint.')
     }
   }
+
   if (!server.code_challenge_methods_supported?.includes('S256')) throw new Error('IDP does not support S256 PKCE.')
+
   const client = { client_id: config.clientId }
   const authentication = oauth.None()
 
   const authorize = async (redirectUri, state, verifier) => {
     const url = new URL(server.authorization_endpoint)
+
     url.search = new URLSearchParams({
       client_id: config.clientId,
       redirect_uri: redirectUri,
@@ -32,6 +38,7 @@ export const createOAuth = async (config, { signal, fetch: fetcher = globalThis.
       code_challenge: await oauth.calculatePKCECodeChallenge(verifier),
       code_challenge_method: 'S256',
     }).toString()
+
     return url.href
   }
 
@@ -40,17 +47,33 @@ export const createOAuth = async (config, { signal, fetch: fetcher = globalThis.
     const request = new Request(config.resource, { headers: { authorization: `Bearer ${accessToken}` } })
     const claims = await oauth.validateJwtAccessToken(server, request, config.resource, options())
     const scopes = typeof claims.scope === 'string' ? claims.scope.split(' ') : []
+
     if (claims.client_id !== config.clientId || !config.scopes.every(scope => scopes.includes(scope))) {
       throw new Error('IDP returned a token for an unexpected client or scope.')
     }
-    return { userId: claims.sub, issuer: claims.iss, resource: config.resource, scopes, expiresAt: claims.exp * 1000 }
+
+    return {
+      userId: claims.sub,
+      personalOrganizationId: typeof claims.personal_organization_id === 'string' ? claims.personal_organization_id : undefined,
+      username: typeof claims.preferred_username === 'string' ? claims.preferred_username : undefined,
+      email: typeof claims.email === 'string' ? claims.email : undefined,
+      issuer: claims.iss,
+      resource: config.resource,
+      scopes,
+      expiresAt: claims.exp * 1000,
+    }
   }
 
   const session = async (tokens) => {
-    if (!tokens.refresh_token || !Number.isFinite(tokens.expires_in) || tokens.expires_in <= 0 || tokens.token_type !== 'bearer') {
+    // npm配布CLIにはprivateな@plime-inc/utilsを持ち込まない。
+    // eslint-disable-next-line plime-utils/prefer-shared-predicate
+    const validExpiry = Number.isFinite(tokens.expires_in) && tokens.expires_in > 0
+    if (!tokens.refresh_token || !validExpiry || tokens.token_type !== 'bearer') {
       throw new Error('IDP did not return the required login tokens.')
     }
+
     const user = await identity(tokens.access_token)
+
     return {
       version: 1,
       issuer: config.issuer,
@@ -63,27 +86,40 @@ export const createOAuth = async (config, { signal, fetch: fetcher = globalThis.
 
   const exchange = async (callback, redirectUri, state, verifier) => {
     const parameters = oauth.validateAuthResponse(server, client, callback, state)
-    const response = await oauth.authorizationCodeGrantRequest(server, client, authentication, parameters, redirectUri, verifier, {
-      ...options(), additionalParameters: { resource: config.resource },
-    })
+
+    const exchangeOptions = {
+      ...options(),
+      additionalParameters: { resource: config.resource },
+    }
+
+    const request = [ server, client, authentication, parameters, redirectUri, verifier, exchangeOptions ]
+    const response = await oauth.authorizationCodeGrantRequest(...request)
+
     return session(await oauth.processAuthorizationCodeResponse(server, client, response))
   }
 
   const refresh = async (refreshToken) => {
     const response = await oauth.refreshTokenGrantRequest(server, client, authentication, refreshToken, {
-      ...options(), additionalParameters: { resource: config.resource },
+      ...options(),
+      additionalParameters: { resource: config.resource },
     })
+
     return session(await oauth.processRefreshTokenResponse(server, client, response))
   }
 
   const revoke = async (refreshToken) => {
     const response = await oauth.revocationRequest(server, client, authentication, refreshToken, {
-      ...options(), additionalParameters: { token_type_hint: 'refresh_token' },
+      ...options(),
+      additionalParameters: { token_type_hint: 'refresh_token' },
     })
+
     await oauth.processRevocationResponse(response)
   }
 
   return { authorize, exchange, refresh, revoke, identity }
 }
 
-export const createLoginProof = () => ({ state: oauth.generateRandomState(), verifier: oauth.generateRandomCodeVerifier() })
+export const createLoginProof = () => ({
+  state: oauth.generateRandomState(),
+  verifier: oauth.generateRandomCodeVerifier(),
+})