@salesforce/b2c-tooling-sdk 2.1.0 → 2.3.0

package/dist/esm/openshell/apply.js

@@ -0,0 +1,225 @@
+/*
+ * Copyright (c) 2025, Salesforce, Inc.
+ * SPDX-License-Identifier: Apache-2
+ * For full license text, see the license.txt file in the repo root or http://www.apache.org/licenses/LICENSE-2.0
+ */
+/**
+ * Writes an {@link OpenShellSetup} to disk and applies it with the `openshell`
+ * and `docker` command line tools.
+ *
+ * @module openshell/apply
+ */
+import { execFile } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import * as fs from 'node:fs/promises';
+import path from 'node:path';
+import { OPENSHELL_SAFETY_CONFIG_PATH } from './setup.js';
+/** Default {@link CommandRunner} using `child_process.execFile` (no shell). */
+export const runCommand = (command, args, env) => new Promise((resolve) => {
+    execFile(command, args, { env: { ...process.env, ...env }, maxBuffer: 16 * 1024 * 1024 }, (error, stdout, stderr) => {
+        const code = error ? (typeof error.code === 'number' ? error.code : 127) : 0;
+        resolve({ code, stdout: String(stdout), stderr: String(stderr) });
+    });
+});
+/** Error thrown when an `openshell` or `docker` command fails. */
+export class OpenShellCommandError extends Error {
+    command;
+    result;
+    constructor(command, result) {
+        super(`Command failed (${result.code}): ${command}\n${(result.stderr || result.stdout).trim()}`);
+        this.command = command;
+        this.result = result;
+        this.name = 'OpenShellCommandError';
+    }
+}
+function quote(arg) {
+    return /^[\w@%+=:,./-]+$/.test(arg) ? arg : `'${arg.replaceAll("'", String.raw `'\''`)}'`;
+}
+function formatCommand(command, args) {
+    return [command, ...args].map((a) => quote(a)).join(' ');
+}
+/** Formats a command with one flag per line, for readability in scripts. */
+function formatMultiline(command, args) {
+    const parts = [];
+    for (const arg of args) {
+        if (arg.startsWith('--') && parts.length > 0)
+            parts.push(' \\\n  ');
+        else if (parts.length > 0)
+            parts.push(' ');
+        parts.push(quote(arg));
+    }
+    return `${command} ${parts.join('')}`;
+}
+function sandboxCreateArgs(setup, files, image) {
+    return [
+        'sandbox',
+        'create',
+        '--name',
+        setup.sandboxName,
+        '--from',
+        image,
+        '--policy',
+        files.policy,
+        ...setup.providers.flatMap((p) => ['--provider', p.name]),
+        '--no-auto-providers',
+        ...Object.entries(setup.env).flatMap(([key, value]) => ['--env', `${key}=${value}`]),
+        ...(files.safetyConfig
+            ? ['--upload', `${files.safetyConfig}:${OPENSHELL_SAFETY_CONFIG_PATH}`, '--no-git-ignore']
+            : []),
+        '--detach',
+    ];
+}
+/**
+ * Renders the shell commands that create the sandbox from scratch. Written
+ * next to the generated files so the setup can be reviewed or run by hand.
+ */
+export function formatOpenShellScript(setup, files, image) {
+    const lines = [
+        '#!/usr/bin/env bash',
+        `# Creates the OpenShell sandbox "${setup.sandboxName}". Generated by \`b2c setup openshell\`.`,
+        ...(setup.providers.length > 0
+            ? [
+                '# Export these secrets in your shell (or load them from a secret manager) first:',
+                ...setup.providers.map((p) => `#   ${p.envVar}`),
+            ]
+            : []),
+        'set -euo pipefail',
+        '',
+        formatCommand('docker', ['build', '-t', image, files.dir]),
+        ...Object.values(files.profiles).map((file) => formatCommand('openshell', ['profile', 'import', '--file', file])),
+        ...setup.providers.map((p) => formatCommand('openshell', ['provider', 'create', '--name', p.name, '--type', p.type, '--credential', p.envVar])),
+        formatMultiline('openshell', sandboxCreateArgs(setup, files, image)),
+        '',
+    ];
+    return lines.join('\n');
+}
+/**
+ * Writes the profiles, policy, Dockerfile, and setup script to `dir`.
+ * An existing policy file is kept unless `force` is set, so edits to it
+ * survive re-runs.
+ */
+export async function writeOpenShellFiles(setup, dir, options) {
+    const absDir = path.resolve(dir);
+    await fs.mkdir(path.join(absDir, 'profiles'), { recursive: true });
+    const profiles = {};
+    for (const profile of setup.profiles) {
+        const file = path.join(absDir, 'profiles', `${profile.id}.yaml`);
+        await fs.writeFile(file, profile.content);
+        profiles[profile.id] = file;
+    }
+    const policy = path.join(absDir, 'policy.yaml');
+    const policyWritten = Boolean(options.force) || !existsSync(policy);
+    if (policyWritten) {
+        await fs.writeFile(policy, setup.policy);
+    }
+    const policyDiffers = !policyWritten && (await fs.readFile(policy, 'utf8')) !== setup.policy;
+    const dockerfile = path.join(absDir, 'Dockerfile');
+    await fs.writeFile(dockerfile, options.dockerfile);
+    const safetyConfig = path.join(absDir, 'safety.json');
+    if (setup.safetyConfig) {
+        await fs.writeFile(safetyConfig, setup.safetyConfig);
+    }
+    else {
+        await fs.rm(safetyConfig, { force: true });
+    }
+    const files = {
+        dir: absDir,
+        policy,
+        dockerfile,
+        script: path.join(absDir, 'setup.sh'),
+        profiles,
+        safetyConfig: setup.safetyConfig ? safetyConfig : undefined,
+        policyWritten,
+        policyDiffers,
+    };
+    await fs.writeFile(files.script, formatOpenShellScript(setup, files, options.image), { mode: 0o755 });
+    return files;
+}
+/**
+ * Applies the setup, converging on the desired state so it can be re-run:
+ *
+ * 1. Checks that the OpenShell gateway is reachable.
+ * 2. Builds the sandbox image if it does not exist.
+ * 3. Imports each provider profile, or updates it if it exists.
+ * 4. Creates each provider, or updates its secret if it exists.
+ * 5. Creates the sandbox, or applies the policy and Safety Mode configuration
+ *    to the existing sandbox.
+ *
+ * @returns The steps that were run
+ */
+export async function applyOpenShellSetup(setup, files, options) {
+    const run = options.run ?? runCommand;
+    const steps = [];
+    const runStep = async (description, command, args, env) => {
+        const step = { description, command: formatCommand(command, args) };
+        options.onStep?.(step);
+        const result = await run(command, args, env);
+        if (result.code !== 0)
+            throw new OpenShellCommandError(step.command, result);
+        steps.push(step);
+    };
+    const succeeds = async (command, args) => (await run(command, args)).code === 0;
+    const status = await run('openshell', ['status']);
+    if (status.code !== 0) {
+        throw new OpenShellCommandError('openshell status', status);
+    }
+    if (options.build !== false && !(await succeeds('docker', ['image', 'inspect', options.image]))) {
+        await runStep(`Build image ${options.image}`, 'docker', ['build', '-t', options.image, files.dir]);
+    }
+    for (const [id, file] of Object.entries(files.profiles)) {
+        const existing = await run('openshell', ['profile', 'export', '-o', 'json', id]);
+        if (existing.code !== 0) {
+            await runStep(`Import profile ${id}`, 'openshell', ['profile', 'import', '--file', file]);
+            continue;
+        }
+        // Updates must carry the current resource_version of the profile.
+        const { resource_version: resourceVersion } = JSON.parse(existing.stdout);
+        const updateFile = path.join(files.dir, 'profiles', `.${id}.update.yaml`);
+        await fs.writeFile(updateFile, `${await fs.readFile(file, 'utf8')}resource_version: ${resourceVersion ?? 0}\n`);
+        try {
+            await runStep(`Update profile ${id}`, 'openshell', ['profile', 'update', '--file', updateFile, id]);
+        }
+        finally {
+            await fs.rm(updateFile, { force: true });
+        }
+    }
+    for (const provider of setup.providers) {
+        const secret = options.secrets[provider.envVar];
+        if (!secret)
+            throw new Error(`No value for ${provider.envVar}`);
+        const env = { [provider.envVar]: secret };
+        await ((await succeeds('openshell', ['provider', 'get', provider.name]))
+            ? runStep(`Update provider ${provider.name}`, 'openshell', ['provider', 'update', provider.name, '--credential', provider.envVar], env)
+            : runStep(`Create provider ${provider.name}`, 'openshell', ['provider', 'create', '--name', provider.name, '--type', provider.type, '--credential', provider.envVar], env));
+    }
+    if (options.sandbox === false)
+        return steps;
+    const sandboxExists = await succeeds('openshell', ['sandbox', 'get', setup.sandboxName]);
+    if (sandboxExists && options.recreate) {
+        await runStep(`Delete sandbox ${setup.sandboxName}`, 'openshell', ['sandbox', 'delete', setup.sandboxName]);
+    }
+    if (!sandboxExists || options.recreate) {
+        await runStep(`Create sandbox ${setup.sandboxName}`, 'openshell', sandboxCreateArgs(setup, files, options.image));
+        return steps;
+    }
+    await runStep(`Apply policy to sandbox ${setup.sandboxName}`, 'openshell', [
+        'policy',
+        'set',
+        setup.sandboxName,
+        '--policy',
+        files.policy,
+        '--wait',
+    ]);
+    if (files.safetyConfig) {
+        await runStep(`Upload Safety Mode configuration to ${setup.sandboxName}`, 'openshell', [
+            'sandbox',
+            'upload',
+            '--no-git-ignore',
+            setup.sandboxName,
+            files.safetyConfig,
+            OPENSHELL_SAFETY_CONFIG_PATH,
+        ]);
+    }
+    return steps;
+}
+//# sourceMappingURL=apply.js.map

package/dist/esm/openshell/apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.js","sourceRoot":"","sources":["../../../src/openshell/apply.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH;;;;;GAKG;AACH,OAAO,EAAC,QAAQ,EAAC,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAC,UAAU,EAAC,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAC,4BAA4B,EAAsB,MAAM,YAAY,CAAC;AAgB7E,+EAA+E;AAC/E,MAAM,CAAC,MAAM,UAAU,GAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAC9D,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IACtB,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,EAAC,GAAG,EAAE,EAAC,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAC,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QAC9G,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,OAAO,CAAC,EAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAiCL,kEAAkE;AAClE,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAEnC;IACA;IAFX,YACW,OAAe,EACf,MAAqB;QAE9B,KAAK,CAAC,mBAAmB,MAAM,CAAC,IAAI,MAAM,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAHxF,YAAO,GAAP,OAAO,CAAQ;QACf,WAAM,GAAN,MAAM,CAAe;QAG9B,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,SAAS,KAAK,CAAC,GAAW;IACxB,OAAO,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAA,MAAM,CAAC,GAAG,CAAC;AAC3F,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,IAAc;IACpD,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,4EAA4E;AAC5E,SAAS,eAAe,CAAC,OAAe,EAAE,IAAc;IACtD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;aAC/D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAqB,EAAE,KAAqB,EAAE,KAAa;IACpF,OAAO;QACL,SAAS;QACT,QAAQ;QACR,QAAQ;QACR,KAAK,CAAC,WAAW;QACjB,QAAQ;QACR,KAAK;QACL,UAAU;QACV,KAAK,CAAC,MAAM;QACZ,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACzD,qBAAqB;QACrB,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;QACpF,GAAG,CAAC,KAAK,CAAC,YAAY;YACpB,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,YAAY,IAAI,4BAA4B,EAAE,EAAE,iBAAiB,CAAC;YAC1F,CAAC,CAAC,EAAE,CAAC;QACP,UAAU;KACX,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAqB,EAAE,KAAqB,EAAE,KAAa;IAC/F,MAAM,KAAK,GAAG;QACZ,qBAAqB;QACrB,oCAAoC,KAAK,CAAC,WAAW,0CAA0C;QAC/F,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YAC5B,CAAC,CAAC;gBACE,kFAAkF;gBAClF,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;aACjD;YACH,CAAC,CAAC,EAAE,CAAC;QACP,mBAAmB;QACnB,EAAE;QACF,aAAa,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1D,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QACjH,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3B,aAAa,CAAC,WAAW,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CACjH;QACD,eAAe,CAAC,WAAW,EAAE,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACpE,EAAE;KACH,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAqB,EACrB,GAAW,EACX,OAAkD;IAElD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,EAAC,SAAS,EAAE,IAAI,EAAC,CAAC,CAAC;IAEjE,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;QACjE,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;IAC9B,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAChD,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACpE,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,aAAa,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC;IAE7F,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACnD,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAEnD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAC,KAAK,EAAE,IAAI,EAAC,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,KAAK,GAAmB;QAC5B,GAAG,EAAE,MAAM;QACX,MAAM;QACN,UAAU;QACV,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC;QACrC,QAAQ;QACR,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QAC3D,aAAa;QACb,aAAa;KACd,CAAC;IACF,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,EAAC,IAAI,EAAE,KAAK,EAAC,CAAC,CAAC;IACpG,OAAO,KAAK,CAAC;AACf,CAAC;AAkBD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAqB,EACrB,KAAqB,EACrB,OAAmC;IAEnC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC;IACtC,MAAM,KAAK,GAAoB,EAAE,CAAC;IAElC,MAAM,OAAO,GAAG,KAAK,EAAE,WAAmB,EAAE,OAAe,EAAE,IAAc,EAAE,GAA4B,EAAE,EAAE;QAC3G,MAAM,IAAI,GAAG,EAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,EAAC,CAAC;QAClE,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7E,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,EAAE,OAAe,EAAE,IAAc,EAAoB,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;IAEpH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG,MAAM,OAAO,CAAC,eAAe,OAAO,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACrG,CAAC;IAED,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QACjF,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,OAAO,CAAC,kBAAkB,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;YAC1F,SAAS;QACX,CAAC;QACD,kEAAkE;QAClE,MAAM,EAAC,gBAAgB,EAAE,eAAe,EAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAgC,CAAC;QACvG,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QAC1E,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,qBAAqB,eAAe,IAAI,CAAC,IAAI,CAAC,CAAC;QAChH,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,kBAAkB,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;QACtG,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAC,KAAK,EAAE,IAAI,EAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,EAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAC,CAAC;QACxC,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YACtE,CAAC,CAAC,OAAO,CACL,mBAAmB,QAAQ,CAAC,IAAI,EAAE,EAClC,WAAW,EACX,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,EACtE,GAAG,CACJ;YACH,CAAC,CAAC,OAAO,CACL,mBAAmB,QAAQ,CAAC,IAAI,EAAE,EAClC,WAAW,EACX,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,EACzG,GAAG,CACJ,CAAC,CAAC;IACT,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAE5C,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACzF,IAAI,aAAa,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,OAAO,CAAC,kBAAkB,KAAK,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,CAAC,aAAa,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,OAAO,CAAC,kBAAkB,KAAK,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAClH,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,CAAC,2BAA2B,KAAK,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE;QACzE,QAAQ;QACR,KAAK;QACL,KAAK,CAAC,WAAW;QACjB,UAAU;QACV,KAAK,CAAC,MAAM;QACZ,QAAQ;KACT,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,uCAAuC,KAAK,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE;YACrF,SAAS;YACT,QAAQ;YACR,iBAAiB;YACjB,KAAK,CAAC,WAAW;YACjB,KAAK,CAAC,YAAY;YAClB,4BAA4B;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/esm/openshell/index.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Run the B2C tooling inside an NVIDIA OpenShell sandbox.
+ *
+ * Builds provider profiles, providers, and a network policy from a resolved
+ * B2C configuration, then applies them with the `openshell` CLI. Secrets stay
+ * on the gateway; the sandbox receives placeholders.
+ *
+ * @example
+ * ```typescript
+ * import {resolveConfig} from '@salesforce/b2c-tooling-sdk/config';
+ * import {
+ *   applyOpenShellSetup,
+ *   buildOpenShellDockerfile,
+ *   buildOpenShellSetup,
+ *   writeOpenShellFiles,
+ * } from '@salesforce/b2c-tooling-sdk/openshell';
+ *
+ * const config = resolveConfig().values;
+ * const setup = buildOpenShellSetup(config, {accessLevel: 'READ_ONLY'});
+ * const options = {image: 'b2c-openshell:latest', dockerfile: buildOpenShellDockerfile()};
+ * const files = await writeOpenShellFiles(setup, '.openshell/b2c', options);
+ * await applyOpenShellSetup(setup, files, {...options, secrets: {SFCC_CLIENT_SECRET: config.clientSecret!}});
+ * ```
+ *
+ * @module openshell
+ */
+export { buildOpenShellDockerfile, buildOpenShellSetup, OPENSHELL_ACCESS_LEVELS, OPENSHELL_SAFETY_CONFIG_PATH, secretNeedsBodyAuth, } from './setup.js';
+export type { OpenShellAccessLevel, OpenShellProfile, OpenShellProvider, OpenShellSetup, OpenShellSetupOptions, } from './setup.js';
+export { applyOpenShellSetup, runCommand, formatOpenShellScript, OpenShellCommandError, writeOpenShellFiles, } from './apply.js';
+export type { ApplyOpenShellSetupOptions, CommandResult, CommandRunner, OpenShellApplyOptions, OpenShellFiles, OpenShellStep, } from './apply.js';

package/dist/esm/openshell/index.js

@@ -0,0 +1,34 @@
+/*
+ * Copyright (c) 2025, Salesforce, Inc.
+ * SPDX-License-Identifier: Apache-2
+ * For full license text, see the license.txt file in the repo root or http://www.apache.org/licenses/LICENSE-2.0
+ */
+/**
+ * Run the B2C tooling inside an NVIDIA OpenShell sandbox.
+ *
+ * Builds provider profiles, providers, and a network policy from a resolved
+ * B2C configuration, then applies them with the `openshell` CLI. Secrets stay
+ * on the gateway; the sandbox receives placeholders.
+ *
+ * @example
+ * ```typescript
+ * import {resolveConfig} from '@salesforce/b2c-tooling-sdk/config';
+ * import {
+ *   applyOpenShellSetup,
+ *   buildOpenShellDockerfile,
+ *   buildOpenShellSetup,
+ *   writeOpenShellFiles,
+ * } from '@salesforce/b2c-tooling-sdk/openshell';
+ *
+ * const config = resolveConfig().values;
+ * const setup = buildOpenShellSetup(config, {accessLevel: 'READ_ONLY'});
+ * const options = {image: 'b2c-openshell:latest', dockerfile: buildOpenShellDockerfile()};
+ * const files = await writeOpenShellFiles(setup, '.openshell/b2c', options);
+ * await applyOpenShellSetup(setup, files, {...options, secrets: {SFCC_CLIENT_SECRET: config.clientSecret!}});
+ * ```
+ *
+ * @module openshell
+ */
+export { buildOpenShellDockerfile, buildOpenShellSetup, OPENSHELL_ACCESS_LEVELS, OPENSHELL_SAFETY_CONFIG_PATH, secretNeedsBodyAuth, } from './setup.js';
+export { applyOpenShellSetup, runCommand, formatOpenShellScript, OpenShellCommandError, writeOpenShellFiles, } from './apply.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/openshell/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/openshell/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,EACvB,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAQpB,OAAO,EACL,mBAAmB,EACnB,UAAU,EACV,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,YAAY,CAAC"}

package/dist/esm/openshell/setup.d.ts

@@ -0,0 +1,94 @@
+import type { NormalizedConfig } from '../config/types.js';
+import type { SafetyLevel } from '../safety/safety-middleware.js';
+import type { SafetyRule } from '../safety/types.js';
+/** Sandbox access levels. These are the Safety Mode levels. */
+export type OpenShellAccessLevel = SafetyLevel;
+/** All supported sandbox access levels. */
+export declare const OPENSHELL_ACCESS_LEVELS: readonly ["NONE", "NO_DELETE", "NO_UPDATE", "READ_ONLY"];
+/** Path of the forwarded Safety Mode configuration inside the sandbox. */
+export declare const OPENSHELL_SAFETY_CONFIG_PATH = "/sandbox/.b2c/safety.json";
+/** A provider profile to register with the OpenShell gateway. */
+export interface OpenShellProfile {
+    /** Profile id (the provider `--type`) */
+    id: string;
+    /** Profile YAML */
+    content: string;
+}
+/** A provider (stored secret) to create on the OpenShell gateway. */
+export interface OpenShellProvider {
+    /** Provider name */
+    name: string;
+    /** Profile id the provider is created from */
+    type: string;
+    /** Environment variable that carries the secret (on the host and in the sandbox) */
+    envVar: string;
+    /** Config field the secret is read from */
+    source: 'clientSecret' | 'mrtApiKey' | 'password';
+}
+/** Everything needed to create a B2C sandbox. Contains no secret values. */
+export interface OpenShellSetup {
+    /** Sandbox name */
+    sandboxName: string;
+    /** Provider profiles to register */
+    profiles: OpenShellProfile[];
+    /** Providers to create and attach to the sandbox */
+    providers: OpenShellProvider[];
+    /** Sandbox policy YAML */
+    policy: string;
+    /** Non-secret environment variables for the sandbox */
+    env: Record<string, string>;
+    /** Hosts the policy allows, for display */
+    hosts: string[];
+    /** Safety Mode configuration (JSON) to upload to {@link OPENSHELL_SAFETY_CONFIG_PATH}, if any */
+    safetyConfig?: string;
+    /**
+     * Forwarded command rules that permit operations. The network policy can't
+     * express them, so the requests they permit may still be denied.
+     */
+    unmappedSafetyRules: SafetyRule[];
+}
+/** Options for {@link buildOpenShellSetup}. */
+export interface OpenShellSetupOptions {
+    /** Sandbox name. Defaults to `b2c-<instance name or host prefix>`. */
+    sandboxName?: string;
+    /** Access level for B2C hosts, also applied to Safety Mode in the sandbox. Defaults to `NONE`. */
+    accessLevel?: OpenShellAccessLevel;
+    /**
+     * Safety Mode settings to forward to the sandbox. `allow` and `confirm`
+     * rules for HTTP requests and jobs are also added to the network policy.
+     */
+    safety?: {
+        confirm?: boolean;
+        rules?: SafetyRule[];
+    };
+    /** Additional hosts to allow at the same access level (e.g. the sandbox API host) */
+    allowHosts?: string[];
+}
+/**
+ * Returns true when a secret sent in an unencoded Basic header would reach
+ * Account Manager altered (it form-decodes `+` and `%xx`).
+ */
+export declare function secretNeedsBodyAuth(secret: string): boolean;
+/**
+ * Builds the OpenShell setup for a resolved B2C configuration.
+ *
+ * Only secrets present in the configuration get a provider. The API client
+ * secret is released only to the Account Manager token endpoint, the WebDAV
+ * access key only to the instance host, and the MRT API key only to the MRT
+ * host. B2C hosts are limited to the HTTP methods of the access level.
+ *
+ * @param config - The resolved configuration (secrets are read but never included in the result)
+ * @param options - Sandbox name, access level, and extra hosts
+ */
+export declare function buildOpenShellSetup(config: NormalizedConfig, options?: OpenShellSetupOptions): OpenShellSetup;
+/**
+ * Returns the Dockerfile for a sandbox image with the B2C CLI (and optionally
+ * the MCP server) installed.
+ *
+ * @param options - Package versions to install; defaults to `latest`
+ */
+export declare function buildOpenShellDockerfile(options?: {
+    cliVersion?: string;
+    mcpVersion?: string;
+    mcp?: boolean;
+}): string;