@sequenceholdings/studio-cli 0.1.9

package/dist/repos/commands.js

@@ -0,0 +1,548 @@
+/**
+ * `seq-studio repos <sub>` — basic management of platform git-service repos
+ * over the JSON API.
+ *
+ * Everything here is API-driven (Auth0 bearer via seqapi login), matching the
+ * rest of seq-studio. `pull` materializes a tree over the JSON API; `clone`
+ * prefers a real `git clone` when `ATLAS_GIT_PAT` is set (smart-HTTP URL from
+ * `show`), otherwise falls back to the same JSON materialize path and hints
+ * at `seq-studio auth pat create`.
+ *
+ * Repo addressing is `<namespace>/<name>` everywhere; the API is id-addressed,
+ * so commands resolve the path via the namespaces + repos endpoints (the same
+ * dance the Repositories UI does — there is no /repos/by-path endpoint).
+ */
+import { existsSync, readdirSync, rmSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { resolve, sep } from 'node:path';
+import { materializeRepo, resolveCommitSha, resolveRepo, } from '@sequenceholdings/artifact-studio/git-service-client';
+import { deleteNoContent, getJson, postJson } from '../atlas-client.js';
+import { printCliError } from '../cli-errors.js';
+import { PREVIEW_DOMAIN } from '../preview.js';
+import { confirmYes } from '../prompt.js';
+import { buildContext, clientOptions, flagBool, LOG, } from '../functions/commands.js';
+import { resolveGitPatFromEnv, runGitClone, } from './git-clone.js';
+import { formatPatSetupHint } from '../pat-hints.js';
+import { tryGetAccessToken } from '../auth.js';
+import { readConfig, resolveEnv } from '../config.js';
+const PAGE_SIZE = 200;
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+export function parseRepoPath(input) {
+    const parts = (input ?? '').split('/');
+    if (parts.length !== 2 || !parts[0] || !parts[1]) {
+        throw new Error(`Expected a repo path of the form <namespace>/<name> (got "${input ?? ''}").`);
+    }
+    return { namespace: parts[0], name: parts[1] };
+}
+/**
+ * A value-taking flag given without a value parses as `true` (parseArgs
+ * semantics) — silently ignoring it would make the command do something other
+ * than what was asked (e.g. `list --namespace --mine` printing the FULL repo
+ * list, or `pull --ref --out x` fetching the default branch). Error instead.
+ */
+export function stringFlag(flags, key) {
+    const value = flags[key];
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== 'string')
+        throw new Error(`--${key} requires a value.`);
+    return value;
+}
+/**
+ * buildContext for repos commands: rejects a valueless -e/--env (which would
+ * silently fall back to the default environment — dangerous with `delete
+ * --yes`) and threads the Cloudflare preview WAF bypass header to
+ * artifact-studio's HTTP client, which resolveRepo/materializeRepo use
+ * (mirrors applyPreviewAccessHeader in ../artifact/delegate.ts — studio-cli's
+ * own atlas-client reads PREVIEW_ACCESS_HEADER directly).
+ */
+async function reposContext(args) {
+    if (args.flags.env === true || args.flags.e === true) {
+        throw new Error('-e/--env requires a value (local|staging|production|banksouth|preview:<slug>).');
+    }
+    const ctx = await buildContext(args);
+    const secret = process.env.PREVIEW_ACCESS_HEADER?.trim();
+    if (secret && isPreviewHost(ctx.env.url)) {
+        process.env.ARTIFACT_STUDIO_EXTRA_HEADERS = JSON.stringify({ 'x-preview-access': secret });
+    }
+    return ctx;
+}
+function isPreviewHost(baseUrl) {
+    try {
+        return new URL(baseUrl).hostname.toLowerCase().endsWith(`.${PREVIEW_DOMAIN}`);
+    }
+    catch {
+        return false;
+    }
+}
+async function listAllPages(ctx, basePath) {
+    const sep = basePath.includes('?') ? '&' : '?';
+    const out = [];
+    for (let offset = 0;; offset += PAGE_SIZE) {
+        const page = await getJson({
+            ...clientOptions(ctx),
+            path: `${basePath}${sep}limit=${PAGE_SIZE}&offset=${offset}`,
+        });
+        out.push(...page.items);
+        if (page.items.length === 0 || out.length >= page.total)
+            return out;
+    }
+}
+/** Smart-HTTP clone base (aligned with PLA-83: `…/repos/<id>/git`). */
+export function cloneUrl(ctx, repoId) {
+    return `${ctx.env.url}/api/git-service/repos/${repoId}/git`;
+}
+function shortDate(iso) {
+    return iso.slice(0, 10);
+}
+function assertDestWritable({ destDir, force, }) {
+    if (!existsSync(destDir))
+        return;
+    const entries = readdirSync(destDir);
+    if (entries.length === 0)
+        return;
+    if (!force) {
+        throw new Error(`${destDir} exists and is not empty — pass --force to write into it anyway ` +
+            '(existing files are overwritten; files absent at the pulled ref are NOT removed).');
+    }
+}
+/**
+ * `--force` may recursively delete `destDir`. Refuse cwd / home / filesystem
+ * roots / ancestors of cwd so a typo like `--out . --force` cannot wipe the
+ * working tree.
+ */
+export function assertSafeForceDest(destDir) {
+    const resolved = resolve(destDir);
+    const cwd = resolve(process.cwd());
+    const home = resolve(homedir());
+    const forbidden = new Set([
+        resolved === '/' ? '/' : '',
+        cwd,
+        home,
+        resolve('/'),
+        resolve('/Users'),
+        resolve('/home'),
+        resolve('/tmp'),
+        resolve('/var'),
+        resolve('/etc'),
+    ].filter(Boolean));
+    if (forbidden.has(resolved)) {
+        throw new Error(`--force refuses to delete ${resolved} (cwd, home, or system path). ` +
+            'Pass a dedicated empty subdirectory, e.g. --out ./my-repo.');
+    }
+    // Ancestor of cwd (e.g. --out .. --force while inside a project).
+    if (cwd !== resolved && cwd.startsWith(resolved.endsWith(sep) ? resolved : `${resolved}${sep}`)) {
+        throw new Error(`--force refuses to delete ${resolved} because it contains the current working directory.`);
+    }
+    // Too shallow to be a sensible clone target (e.g. /Users/you).
+    const depth = resolved.split(sep).filter(Boolean).length;
+    if (depth < 2) {
+        throw new Error(`--force refuses to delete shallow path ${resolved}. Pass a dedicated subdirectory.`);
+    }
+}
+/** Prepare destination for smart-HTTP clone; optionally wipe when --force. */
+function prepareCloneDest({ destDir, force }) {
+    assertDestWritable({ destDir, force });
+    if (force && existsSync(destDir) && readdirSync(destDir).length > 0) {
+        assertSafeForceDest(destDir);
+        rmSync(destDir, { recursive: true, force: true });
+    }
+}
+// ---------------------------------------------------------------------------
+// Commands
+// ---------------------------------------------------------------------------
+export async function reposNamespacesCommand(args) {
+    const [action, slug] = args.positional;
+    const ctx = await reposContext(args);
+    if (action === 'create') {
+        if (!slug) {
+            console.error('usage: seq-studio repos namespaces create <slug> [-e env]');
+            return 1;
+        }
+        const created = await postJson({
+            ...clientOptions(ctx),
+            path: '/api/git-service/namespaces',
+            body: { slug },
+        });
+        console.log(`${LOG} created namespace ${created.slug} (id=${created.id}) on ${ctx.env.name}`);
+        return 0;
+    }
+    if (action !== undefined) {
+        console.error(`unknown namespaces action: ${action} (expected "create" or no action to list)`);
+        return 1;
+    }
+    const namespaces = await listAllPages(ctx, '/api/git-service/namespaces');
+    if (namespaces.length === 0) {
+        console.log(`${LOG} no namespaces on ${ctx.env.name}`);
+        return 0;
+    }
+    console.log(`${LOG} ${namespaces.length} namespace${namespaces.length === 1 ? '' : 's'} on ${ctx.env.name}:`);
+    for (const ns of namespaces.sort((a, b) => a.slug.localeCompare(b.slug))) {
+        console.log(`  ${ns.slug}  id=${ns.id}  created=${shortDate(ns.createdAt)} by ${ns.createdBy}`);
+    }
+    return 0;
+}
+export async function reposListCommand(args) {
+    const namespaceFilter = stringFlag(args.flags, 'namespace');
+    const ctx = await reposContext(args);
+    const namespaces = await listAllPages(ctx, '/api/git-service/namespaces');
+    const slugById = new Map(namespaces.map((ns) => [ns.id, ns.slug]));
+    let basePath = '/api/git-service/repos';
+    const filters = [];
+    if (namespaceFilter) {
+        const ns = namespaces.find((candidate) => candidate.slug === namespaceFilter);
+        if (!ns) {
+            console.error(`${LOG} namespace "${namespaceFilter}" not found on ${ctx.env.name}`);
+            return 1;
+        }
+        filters.push(`namespaceId=${encodeURIComponent(ns.id)}`);
+    }
+    if (flagBool(args.flags, 'mine'))
+        filters.push('createdBy=me');
+    if (filters.length > 0)
+        basePath += `?${filters.join('&')}`;
+    const repos = await listAllPages(ctx, basePath);
+    if (repos.length === 0) {
+        console.log(`${LOG} no repos visible on ${ctx.env.name}`);
+        return 0;
+    }
+    const path = (repo) => `${slugById.get(repo.namespaceId) ?? repo.namespaceId}/${repo.name}`;
+    const width = Math.max(...repos.map((repo) => path(repo).length));
+    console.log(`${LOG} ${repos.length} repo${repos.length === 1 ? '' : 's'} on ${ctx.env.name}:`);
+    for (const repo of repos.sort((a, b) => path(a).localeCompare(path(b)))) {
+        console.log(`  ${path(repo).padEnd(width)}  ${repo.defaultBranch}  updated=${shortDate(repo.updatedAt)}  by ${repo.createdBy}`);
+    }
+    return 0;
+}
+export async function reposShowCommand(args) {
+    const { namespace, name } = parseRepoPath(args.positional[0]);
+    const ctx = await reposContext(args);
+    const resolved = await resolveRepo({ ...clientOptions(ctx), namespace, name });
+    const repo = await getJson({
+        ...clientOptions(ctx),
+        path: `/api/git-service/repos/${resolved.id}`,
+    });
+    const branches = await getJson({
+        ...clientOptions(ctx),
+        path: `/api/git-service/repos/${resolved.id}/refs?prefix=${encodeURIComponent('refs/heads/')}`,
+    });
+    console.log(`${LOG} repo on ${ctx.env.name}:`);
+    console.log(`  path:           ${namespace}/${name}`);
+    console.log(`  id:             ${repo.id}`);
+    console.log(`  default branch: ${repo.defaultBranch}`);
+    console.log(`  created:        ${shortDate(repo.createdAt)} by ${repo.createdBy}`);
+    console.log(`  updated:        ${shortDate(repo.updatedAt)}`);
+    console.log(`  clone (PAT as basic-auth password): ${cloneUrl(ctx, repo.id)}`);
+    // Best-effort cross-link to a matching Artifact Studio project on this env
+    // (same slug as the repo name). Failures are silent — not every repo is an
+    // artifact, and the projects endpoint may 403 for some principals.
+    try {
+        const projects = await getJson({
+            ...clientOptions(ctx),
+            path: '/api/artifact-studio/projects',
+        });
+        const match = projects.projects.find((p) => p.slug === name);
+        if (match) {
+            console.log(`  artifactSlug:   ${match.slug}`);
+            console.log(`  artifactProjectId: ${match.id}`);
+        }
+    }
+    catch {
+        // ignore
+    }
+    if (branches.items.length > 0) {
+        console.log(`  branches:`);
+        for (const branch of branches.items) {
+            console.log(`    ${branch.ref.replace('refs/heads/', '')}  @ ${branch.sha.slice(0, 12)}`);
+        }
+    }
+    return 0;
+}
+export async function reposCreateCommand(args) {
+    const { namespace, name } = parseRepoPath(args.positional[0]);
+    const ctx = await reposContext(args);
+    const defaultBranch = stringFlag(args.flags, 'default-branch');
+    const repo = await postJson({
+        ...clientOptions(ctx),
+        path: '/api/git-service/repos',
+        body: { namespaceSlug: namespace, name, ...(defaultBranch ? { defaultBranch } : {}) },
+    });
+    console.log(`${LOG} created ${namespace}/${name} (id=${repo.id}, default branch ${repo.defaultBranch}) on ${ctx.env.name}`);
+    return 0;
+}
+async function materializeTree({ ctx, namespace, name, destDir, ref, verb, }) {
+    const resolved = await resolveRepo({ ...clientOptions(ctx), namespace, name });
+    const requestedRef = ref ?? resolved.defaultBranch;
+    const sha = await resolveCommitSha({
+        ...clientOptions(ctx),
+        repoId: resolved.id,
+        ref: requestedRef,
+    });
+    const fileCount = await materializeRepo({
+        ...clientOptions(ctx),
+        repoId: resolved.id,
+        ref: sha,
+        destDir,
+    });
+    console.log(`${LOG} ${verb} ${namespace}/${name} @ ${sha.slice(0, 12)} (${requestedRef}) → ${destDir} (${fileCount} files)`);
+    return 0;
+}
+export async function reposPullCommand(args) {
+    const { namespace, name } = parseRepoPath(args.positional[0]);
+    const ctx = await reposContext(args);
+    const destDir = resolve(stringFlag(args.flags, 'out') ?? name);
+    assertDestWritable({ destDir, force: flagBool(args.flags, 'force') });
+    return materializeTree({
+        ctx,
+        namespace,
+        name,
+        destDir,
+        ref: stringFlag(args.flags, 'ref'),
+        verb: 'pulled',
+    });
+}
+/**
+ * Preferred clone verb.
+ *
+ * With `ATLAS_GIT_PAT`:
+ *   - `--url <clone-url>` or `--id <repo-uuid>` → smart-HTTP clone with no seqapi
+ *   - `<ns>/<name>` → needs Auth0 to resolve the UUID, then smart-HTTP clone
+ * Without a PAT: JSON materialize (needs Auth0) + PAT setup hints.
+ *
+ * `gitClone` is injectable for tests.
+ */
+export async function reposCloneCommand(args, deps = {}) {
+    const force = flagBool(args.flags, 'force');
+    const ref = stringFlag(args.flags, 'ref');
+    const pat = resolveGitPatFromEnv();
+    const urlFlag = stringFlag(args.flags, 'url');
+    const idFlag = stringFlag(args.flags, 'id');
+    const positional = args.positional[0];
+    if (urlFlag && idFlag) {
+        throw new Error('Pass only one of --url or --id.');
+    }
+    if ((urlFlag || idFlag) && positional) {
+        throw new Error('Pass either <ns>/<name> or --url/--id, not both.');
+    }
+    // --url/--id are PAT-only (no JSON materialize for a bare UUID/URL).
+    if ((urlFlag || idFlag) && !pat) {
+        const env = await resolveEnvOnly(args);
+        const lines = [
+            `${LOG} --url/--id requires ATLAS_GIT_PAT (JSON materialize needs <ns>/<name>).`,
+            ...formatPatSetupHint({ envUrl: env.url, envName: env.name }),
+        ];
+        throw new Error(lines.join('\n'));
+    }
+    // PAT-only path: clone by URL or repo UUID without seqapi/Auth0.
+    if (pat && (urlFlag || idFlag)) {
+        const env = await resolveEnvOnly(args);
+        const targetUrl = urlFlag
+            ? normalizeCloneUrl(urlFlag, env)
+            : cloneUrl({ env, token: '' }, idFlag);
+        const destDir = resolve(stringFlag(args.flags, 'out') ?? defaultOutFromCloneTarget({ url: targetUrl, id: idFlag }));
+        prepareCloneDest({ destDir, force });
+        const clone = deps.gitClone ?? runGitClone;
+        await clone({
+            cloneUrl: targetUrl,
+            destDir,
+            pat,
+            ...(ref ? { ref } : {}),
+        });
+        console.log(`${LOG} cloned ${targetUrl} → ${destDir}` +
+            (ref ? ` (ref ${ref})` : '') +
+            ` via smart-HTTP`);
+        return 0;
+    }
+    // <ns>/<name> path — needs Auth0 for resolveRepo (JSON API) whether or not
+    // we then use smart-HTTP. Without Auth0, point users at --url from the UI.
+    if (!positional) {
+        console.error('usage: seq-studio repos clone <ns>/<name> | --url <clone-url> | --id <uuid> [-e env] [--ref r] [--out dir]');
+        return 1;
+    }
+    const { namespace, name } = parseRepoPath(positional);
+    const token = await tryGetAccessToken();
+    if (!token) {
+        const env = await resolveEnvOnly(args);
+        const lines = pat
+            ? [
+                `ATLAS_GIT_PAT is set, but resolving ${namespace}/${name} needs Auth0 (seqapi login).`,
+                `  No seqapi? Copy the clone URL from Repositories → Clone, then:`,
+                `    ATLAS_GIT_PAT=<token> seq-studio repos clone --url <https://…/repos/<id>/git> -e ${env.name}`,
+            ]
+            : [
+                `${LOG} no ATLAS_GIT_PAT and not logged in (seqapi).`,
+                ...formatPatSetupHint({ envUrl: env.url, envName: env.name }),
+                `  Or: seqapi login && seq-studio repos clone ${namespace}/${name} -e ${env.name}`,
+            ];
+        throw new Error(lines.join('\n'));
+    }
+    const ctx = await reposContext(args);
+    const destDir = resolve(stringFlag(args.flags, 'out') ?? name);
+    if (pat) {
+        prepareCloneDest({ destDir, force });
+        const resolved = await resolveRepo({ ...clientOptions(ctx), namespace, name });
+        const targetUrl = cloneUrl(ctx, resolved.id);
+        const clone = deps.gitClone ?? runGitClone;
+        await clone({
+            cloneUrl: targetUrl,
+            destDir,
+            pat,
+            ...(ref ? { ref } : {}),
+        });
+        console.log(`${LOG} cloned ${namespace}/${name} → ${destDir}` +
+            (ref ? ` (ref ${ref})` : '') +
+            ` via smart-HTTP`);
+        return 0;
+    }
+    assertDestWritable({ destDir, force });
+    console.log(`${LOG} no ATLAS_GIT_PAT — materializing via JSON API (no .git dir).`);
+    for (const line of formatPatSetupHint({ envUrl: ctx.env.url, envName: ctx.env.name })) {
+        console.log(line);
+    }
+    return materializeTree({
+        ctx,
+        namespace,
+        name,
+        destDir,
+        ref,
+        verb: 'cloned',
+    });
+}
+/** Resolve -e/--env without requiring Auth0 (for PAT-only --url/--id clones). */
+async function resolveEnvOnly(args) {
+    if (args.flags.env === true || args.flags.e === true) {
+        throw new Error('-e/--env requires a value (local|staging|production|banksouth|preview:<slug>).');
+    }
+    const config = await readConfig();
+    const requested = (typeof args.flags.env === 'string' ? args.flags.env : undefined) ??
+        (typeof args.flags.e === 'string' ? args.flags.e : undefined);
+    return resolveEnv({ config, requested });
+}
+/**
+ * Validate clone URL shape and that the origin matches the resolved Atlas env
+ * so askpass never sends ATLAS_GIT_PAT to an attacker-controlled host.
+ */
+export function normalizeCloneUrl(raw, env) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new Error(`--url must be a valid HTTPS clone URL (got "${raw}").`);
+    }
+    if (url.protocol !== 'https:' && url.protocol !== 'http:') {
+        throw new Error(`--url must be http(s) (got ${url.protocol}).`);
+    }
+    // HTTPS everywhere except local (http://localhost:5001).
+    if (env.name !== 'local' && url.protocol !== 'https:') {
+        throw new Error(`--url must use HTTPS for ${env.name} (got ${url.protocol}).`);
+    }
+    url.username = '';
+    url.password = '';
+    if (!/\/api\/git-service\/repos\/[^/]+\/git\/?$/.test(url.pathname)) {
+        throw new Error(`--url must look like …/api/git-service/repos/<id>/git (got ${url.pathname}).`);
+    }
+    let expected;
+    try {
+        expected = new URL(env.url);
+    }
+    catch {
+        throw new Error(`Invalid Atlas env URL for ${env.name}: ${env.url}`);
+    }
+    if (url.origin !== expected.origin) {
+        throw new Error(`--url origin ${url.origin} does not match Atlas env ${env.name} (${expected.origin}). ` +
+            `Pass -e to select the matching environment, or use --id <uuid> instead of a foreign URL.`);
+    }
+    return url.toString().replace(/\/$/, '');
+}
+function defaultOutFromCloneTarget({ url, id, }) {
+    if (id)
+        return id;
+    const match = /\/repos\/([^/]+)\/git\/?$/.exec(new URL(url).pathname);
+    return match?.[1] ?? 'repo';
+}
+export async function reposDeleteCommand(args) {
+    const { namespace, name } = parseRepoPath(args.positional[0]);
+    const ctx = await reposContext(args);
+    const resolved = await resolveRepo({ ...clientOptions(ctx), namespace, name });
+    const ok = await confirmYes({
+        preview: [
+            `${LOG} about to DELETE ${namespace}/${name} (id=${resolved.id}) on ${ctx.env.name}.`,
+            `${LOG} this deletes the repo record — it becomes unreachable via the API and UI;`,
+            `${LOG} underlying git objects may be retained in storage until a future GC.`,
+        ],
+        confirmed: flagBool(args.flags, 'yes'),
+    });
+    if (!ok)
+        return 1;
+    await deleteNoContent({
+        ...clientOptions(ctx),
+        path: `/api/git-service/repos/${resolved.id}`,
+    });
+    console.log(`${LOG} deleted ${namespace}/${name} on ${ctx.env.name}`);
+    return 0;
+}
+// ---------------------------------------------------------------------------
+// Router
+// ---------------------------------------------------------------------------
+export const REPOS_USAGE = `usage:
+  seq-studio repos list [-e env] [--namespace <slug>] [--mine]      repos visible on the environment
+  seq-studio repos namespaces [create <slug>] [-e env]              list or create namespaces
+  seq-studio repos show <ns>/<name> [-e env]                        repo detail (branches, clone URL)
+  seq-studio repos create <ns>/<name> [-e env] [--default-branch b] create an empty repo
+  seq-studio repos clone <ns>/<name> [-e env] [--ref r] [--out dir] [--force]
+  seq-studio repos clone --url <https://…/repos/<id>/git> [-e env] [--ref r] [--out dir]
+  seq-studio repos clone --id <uuid> [-e env] [--ref r] [--out dir]
+                                                                    smart-HTTP when ATLAS_GIT_PAT is set;
+                                                                    otherwise JSON materialize (<ns>/<name>)
+  seq-studio repos pull <ns>/<name> [-e env] [--ref r] [--out dir] [--force]
+                                                                    materialize the tree at a ref (JSON API)
+  seq-studio repos delete <ns>/<name> [-e env] [--yes]              delete a repo (confirm prompt)
+
+  Flags: -e/--env <local|staging|production|banksouth>
+
+  clone prefers real git clone (PAT via askpass — never written into the remote
+  URL). Without ATLAS_GIT_PAT, <ns>/<name> falls back to the JSON API and prints
+  how to get a PAT (Atlas UI /settings/tokens — no seqapi required).
+  No seqapi + PAT: use --url from Repositories → Clone (or --id <uuid>).
+  --ref accepts a branch, tag, or commit SHA (SHA → clone then checkout).
+
+  Authenticate JSON API calls with: seqapi login
+  Authenticate git clone/push with: ATLAS_GIT_PAT (from Atlas Settings → Tokens)
+`;
+export async function runReposCommand(sub, args) {
+    try {
+        switch (sub) {
+            case 'list':
+                return await reposListCommand(args);
+            case 'namespaces':
+                return await reposNamespacesCommand(args);
+            case 'show':
+                return await reposShowCommand(args);
+            case 'create':
+                return await reposCreateCommand(args);
+            case 'clone':
+                return await reposCloneCommand(args);
+            case 'pull':
+                return await reposPullCommand(args);
+            case 'delete':
+                return await reposDeleteCommand(args);
+            case 'help':
+            case '--help':
+            case '-h':
+            case undefined:
+                console.log(REPOS_USAGE);
+                return sub ? 0 : 1;
+            default:
+                console.error(`unknown repos command: ${sub}`);
+                console.error(REPOS_USAGE);
+                return 1;
+        }
+    }
+    catch (error) {
+        printCliError(error);
+        return 1;
+    }
+}

package/dist/repos/git-clone.d.ts

@@ -0,0 +1,10 @@
+export { looksLikeCommitSha, redactCloneUrl, resolveGitPatFromEnv, runGitClone, withGitAskpass, type RunGitClone, } from '@sequenceholdings/artifact-studio/git-clone';
+/**
+ * Write a credential via `git credential approve` so subsequent clones against
+ * the same host can authenticate without embedding the PAT in the URL.
+ */
+export declare function storeGitCredentials({ cloneUrl, pat, username, }: {
+    cloneUrl: string;
+    pat: string;
+    username?: string;
+}): Promise<void>;

package/dist/repos/git-clone.js

@@ -0,0 +1,49 @@
+/**
+ * Smart-HTTP git clone helpers for platform git-service.
+ *
+ * The clone primitives (askpass, runGitClone, PAT/URL helpers) are the
+ * canonical implementation in `@sequenceholdings/artifact-studio/git-clone` so
+ * the `repos` tool and the artifact `--repo` deploy path share one code path.
+ * We re-export them here to keep the historical import site stable, and add
+ * `storeGitCredentials` (git credential-helper writer) which is studio-cli
+ * specific.
+ */
+import { spawn } from 'node:child_process';
+export { looksLikeCommitSha, redactCloneUrl, resolveGitPatFromEnv, runGitClone, withGitAskpass, } from '@sequenceholdings/artifact-studio/git-clone';
+/**
+ * Write a credential via `git credential approve` so subsequent clones against
+ * the same host can authenticate without embedding the PAT in the URL.
+ */
+export async function storeGitCredentials({ cloneUrl, pat, username = 'git', }) {
+    const parsed = new URL(cloneUrl);
+    const protocol = parsed.protocol.replace(/:$/, '');
+    const host = parsed.host;
+    const path = parsed.pathname;
+    const payload = [
+        `protocol=${protocol}`,
+        `host=${host}`,
+        `path=${path}`,
+        `username=${username}`,
+        `password=${pat}`,
+        '',
+    ].join('\n');
+    await new Promise((resolve, reject) => {
+        const child = spawn('git', ['credential', 'approve'], {
+            stdio: ['pipe', 'ignore', 'pipe'],
+        });
+        let stderr = '';
+        child.stderr?.on('data', (chunk) => {
+            stderr += chunk.toString();
+        });
+        child.on('error', (err) => reject(err));
+        child.on('close', (code) => {
+            if (code === 0) {
+                resolve();
+                return;
+            }
+            reject(new Error(`git credential approve failed (exit ${code ?? 'null'}): ${stderr.trim() || 'no stderr'}`));
+        });
+        child.stdin?.write(payload);
+        child.stdin?.end();
+    });
+}

package/dist/secrets/commands.d.ts

@@ -0,0 +1,24 @@
+import type { ParsedArgs } from '../process/commands.js';
+export declare const LOG = "[seq-studio]";
+export declare function secretsCreateCommand(args: ParsedArgs): Promise<number>;
+export declare function secretsSetCommand(args: ParsedArgs): Promise<number>;
+export declare function secretsListCommand(args: ParsedArgs): Promise<number>;
+export declare function secretsAttachCommand(args: ParsedArgs): Promise<number>;
+export declare function secretsDetachCommand(args: ParsedArgs): Promise<number>;
+export declare function secretsApplyCommand(args: ParsedArgs): Promise<number>;
+export declare function secretsVersionsCommand(args: ParsedArgs): Promise<number>;
+/**
+ * Point the shared default at a prior version. Editor-tier, same as `set` —
+ * and with the same propagation model: nothing is redeployed, attached
+ * functions are flagged and pick the version up on their own next redeploy.
+ */
+export declare function secretsSetDefaultCommand(args: ParsedArgs): Promise<number>;
+/**
+ * Pin one attached function to a specific secret version (sticky — survives
+ * rotations until `--unpin`). Requires editor+ on the secret AND the
+ * function (server-enforced dual-editor gate). Three-way flow mirroring the
+ * UI: pin + redeploy the function's active version / pin only / cancel.
+ */
+export declare function secretsPinCommand(args: ParsedArgs): Promise<number>;
+export declare const SECRETS_USAGE = "usage:\n  seq-studio secrets create <NAME> [--description text]   register an org-owned secret\n  seq-studio secrets set <NAME>                             set the shared default value (write-only)\n  seq-studio secrets list [-e env]                          secrets you can see (never values)\n  seq-studio secrets attach <NAME> --fn <slug>              mount default on a function env var\n  seq-studio secrets detach <NAME> --fn <slug>              remove attachment\n  seq-studio secrets apply --from-env-file .env [-e env]    push defaults + attach (keys default from manifest)\n  seq-studio secrets versions <NAME>                        value version history (never values)\n  seq-studio secrets set-default <NAME> [version]           point the default at a prior version (editor)\n  seq-studio secrets pin <NAME> --fn <slug> [version]       pin one function to a version (sticky; --unpin clears)\n\n  Note: for the common deploy loop, secrets declared in managed-function.yml are\n  reconciled automatically by `seq-studio functions deploy` using a local .env.\n  Use `secrets` commands for CI (no .env), bulk/multi-function ops, or write-only\n  value changes without a redeploy.\n\n  Flags: -e/--env <local|staging|production|banksouth>\n         --fn <slug> \u00B7 --env-var <NAME> \u00B7 --yes\n         --functions <f1,f2> \u00B7 --keys <K1,K2> \u00B7 --all (override key selection)\n         set-default: [version|version-row-id] (defaults to the most recent non-default) \u00B7 --yes\n         pin: [version|version-row-id] (defaults to the current default) \u00B7 --unpin \u00B7 --yes (redeploy) \u00B7 --yes --no-redeploy\n";
+export declare function runSecretsCommand(sub: string | undefined, args: ParsedArgs): Promise<number>;