@struktoai/mirage-cli 0.0.7-alpha.1 → 0.0.7-alpha.3

package/dist/chunk-IJUWWUKK.js

@@ -0,0 +1,603 @@
+// src/credentials.ts
+import {
+  existsSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeSync,
+  closeSync
+} from "fs";
+import { dirname, join } from "path";
+import { mirageHome } from "@struktoai/mirage-server/paths";
+var LOGIN_FILE = "login.json";
+var LOGIN_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
+var REFRESH_MARGIN_SECONDS = 60;
+var LoginError = class extends Error {
+  name = "LoginError";
+};
+function renewBy(login) {
+  const ends = login.logged_in_at + LOGIN_MAX_AGE_SECONDS;
+  if (login.refresh_token === null && login.expires_at !== null) {
+    return Math.min(ends, login.expires_at);
+  }
+  return ends;
+}
+function loginPath(env = process.env) {
+  return join(mirageHome(env), LOGIN_FILE);
+}
+function readLogin(path = loginPath()) {
+  if (!existsSync(path)) return null;
+  return JSON.parse(readFileSync(path, "utf-8"));
+}
+function writeLogin(login, path = loginPath()) {
+  mkdirSync(dirname(path), { recursive: true });
+  const staged = join(dirname(path), `.${LOGIN_FILE}.${String(process.pid)}`);
+  const fd = openSync(staged, "w", 384);
+  try {
+    writeSync(fd, JSON.stringify(login, null, 2));
+  } finally {
+    closeSync(fd);
+  }
+  renameSync(staged, path);
+}
+function removeLogin(path = loginPath()) {
+  const login = readLogin(path);
+  rmSync(path, { force: true });
+  return login;
+}
+function tokenClaims(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return {};
+  try {
+    const claims = JSON.parse(Buffer.from(parts[1] ?? "", "base64url").toString("utf-8"));
+    return typeof claims === "object" && claims !== null && !Array.isArray(claims) ? claims : {};
+  } catch {
+    return {};
+  }
+}
+async function jsonBody(reply) {
+  try {
+    const body = await reply.json();
+    return typeof body === "object" && body !== null && !Array.isArray(body) ? body : {};
+  } catch {
+    return {};
+  }
+}
+function endsAt(body, now) {
+  const expiresIn = body.expires_in;
+  return typeof expiresIn === "number" && expiresIn > 0 ? now + expiresIn : null;
+}
+async function freshToken(login, path = loginPath()) {
+  const now = Date.now() / 1e3;
+  const again = `run \`mirage login\` to log in to ${login.url} again`;
+  if (now >= login.logged_in_at + LOGIN_MAX_AGE_SECONDS) {
+    throw new LoginError(`the login is 30 days old; ${again}`);
+  }
+  if (login.expires_at === null || now < login.expires_at - REFRESH_MARGIN_SECONDS) {
+    return login.access_token;
+  }
+  if (login.refresh_token === null || login.token_endpoint === null || login.client_id === null) {
+    throw new LoginError(`the token has expired; ${again}`);
+  }
+  let reply;
+  try {
+    reply = await fetch(login.token_endpoint, {
+      method: "POST",
+      body: new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: login.refresh_token,
+        client_id: login.client_id
+      }),
+      signal: AbortSignal.timeout(3e4)
+    });
+  } catch (error) {
+    throw new LoginError(`could not reach the issuer: ${String(error)}`);
+  }
+  const body = await jsonBody(reply);
+  if (reply.status !== 200 || typeof body.access_token !== "string") {
+    const reason = typeof body.error === "string" ? body.error : String(reply.status);
+    throw new LoginError(`the issuer refused to refresh the login (${reason}); ${again}`);
+  }
+  login.access_token = body.access_token;
+  if (typeof body.refresh_token === "string" && body.refresh_token !== "") {
+    login.refresh_token = body.refresh_token;
+  }
+  login.expires_at = endsAt(body, now);
+  writeLogin(login, path);
+  return login.access_token;
+}
+
+// src/settings.ts
+import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { dirname as dirname2, join as join2 } from "path";
+import { rstripSlash } from "@struktoai/mirage-core/utils/slash";
+import { compareCodePoints } from "@struktoai/mirage-core/utils/sort";
+import { CONFIG_ENV_KEYS } from "@struktoai/mirage-server/auth/config";
+import { defaultTokenFile, readTokenFile } from "@struktoai/mirage-server/auth/storage";
+import {
+  ENV_ALLOWED_HOSTS,
+  ENV_DAEMON_PORT as ENV_DAEMON_PORT2,
+  ENV_IDLE_GRACE_SECONDS as ENV_IDLE_GRACE_SECONDS2
+} from "@struktoai/mirage-server/env";
+import {
+  ALLOWED_KEYS,
+  DaemonConfigError,
+  NUMERIC_KEYS,
+  parseDaemonTable,
+  readDaemonTable
+} from "@struktoai/mirage-server/daemon_config";
+import { DEFAULT_ALLOWED_HOSTS } from "@struktoai/mirage-server/host_validation_constants";
+import { mirageHome as mirageHome2 } from "@struktoai/mirage-server/paths";
+import {
+  AUTHORIZED_KEYS_NAME,
+  DEFAULT_SSH_HOST,
+  HOST_KEY_NAME,
+  SSH_ENV_KEYS
+} from "@struktoai/mirage-server/ssh/constants";
+import { defaultSSHDir } from "@struktoai/mirage-server/ssh/config";
+
+// src/env.ts
+import { ENV_AUTH_MODE, ENV_AUTH_TOKEN } from "@struktoai/mirage-server/auth/config";
+import { ENV_DAEMON_PORT, ENV_IDLE_GRACE_SECONDS } from "@struktoai/mirage-server/env";
+var ENV_DAEMON_URL = "MIRAGE_DAEMON_URL";
+var ENV_TOKEN = "MIRAGE_TOKEN";
+
+// src/settings.ts
+var DEFAULT_DAEMON_URL = "http://127.0.0.1:8765";
+function isLocalUrl(url) {
+  let host;
+  try {
+    host = new URL(url).hostname;
+  } catch {
+    return false;
+  }
+  return DEFAULT_ALLOWED_HOSTS.includes(host.replace(/^\[(.*)\]$/, "$1"));
+}
+function loadDaemonSettings(options = {}) {
+  const env = options.env ?? process.env;
+  const table = options.configPath !== void 0 ? existsSync2(options.configPath) ? parseDaemonTable(readFileSync2(options.configPath, "utf-8")) : {} : readDaemonTable(mirageHome2(env));
+  const settings = {
+    url: table.url ?? DEFAULT_DAEMON_URL,
+    authToken: table.auth_token ?? "",
+    idleGraceSeconds: Number(table.idle_grace_seconds ?? "30")
+  };
+  const envUrl = env[ENV_DAEMON_URL];
+  if (envUrl !== void 0 && envUrl !== "") {
+    settings.url = envUrl;
+  }
+  const envToken = env[ENV_TOKEN];
+  if (envToken !== void 0 && envToken !== "") {
+    settings.authToken = envToken;
+  }
+  if (settings.authToken === "") {
+    const login = readLogin(loginPath(env));
+    if (login !== null && login.url === rstripSlash(settings.url)) {
+      settings.login = login;
+      return settings;
+    }
+  }
+  if (settings.authToken === "" && isLocalUrl(settings.url)) {
+    const fileToken = readTokenFile(options.tokenFile ?? defaultTokenFile(env));
+    if (fileToken !== void 0 && fileToken !== "") {
+      settings.authToken = fileToken;
+    }
+  }
+  return settings;
+}
+function configPath(env = process.env) {
+  return join2(mirageHome2(env), "config.toml");
+}
+var ENV_FOR_KEY = {
+  url: ENV_DAEMON_URL,
+  allowed_hosts: ENV_ALLOWED_HOSTS,
+  ...CONFIG_ENV_KEYS,
+  auth_token: ENV_TOKEN,
+  idle_grace_seconds: ENV_IDLE_GRACE_SECONDS2,
+  port: ENV_DAEMON_PORT2,
+  ...SSH_ENV_KEYS
+};
+function defaultForKey(key, home) {
+  const defaults = {
+    url: DEFAULT_DAEMON_URL,
+    allowed_hosts: DEFAULT_ALLOWED_HOSTS.join(","),
+    auth_mode: "local",
+    jwt_alg: "",
+    jwt_issuer: "",
+    jwt_audience: "",
+    jwt_pubkey_file: "",
+    jwt_jwks_url: "",
+    jwt_clock_skew: "5",
+    jwt_authorized_parties: "",
+    login_client_id: "",
+    socket: "",
+    auth_token: "",
+    idle_grace_seconds: "30",
+    port: "8765",
+    ssh_port: "",
+    ssh_host: DEFAULT_SSH_HOST,
+    ssh_host_key_file: join2(defaultSSHDir(home), HOST_KEY_NAME),
+    ssh_authorized_keys: join2(defaultSSHDir(home), AUTHORIZED_KEYS_NAME)
+  };
+  return defaults[key] ?? "";
+}
+function resolvedConfig(env = process.env) {
+  const home = mirageHome2(env);
+  const table = readDaemonTable(home);
+  const out = {};
+  for (const key of [...ALLOWED_KEYS].sort(compareCodePoints)) {
+    const envName = ENV_FOR_KEY[key];
+    if (envName !== void 0) {
+      const envValue = env[envName];
+      if (envValue !== void 0 && envValue !== "") {
+        out[key] = [envValue, `env ${envName}`];
+        continue;
+      }
+    }
+    const fileValue = table[key];
+    if (fileValue !== void 0 && fileValue !== "") {
+      out[key] = [fileValue, "file"];
+    } else {
+      out[key] = [defaultForKey(key, home), "default"];
+    }
+  }
+  return out;
+}
+function checkKey(key) {
+  if (!ALLOWED_KEYS.has(key)) {
+    throw new DaemonConfigError(
+      `unknown config key: '${key}'; allowed: ${[...ALLOWED_KEYS].sort(compareCodePoints).join(", ")}`
+    );
+  }
+}
+function formatValue(key, value) {
+  if (NUMERIC_KEYS.has(key)) return value;
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+function listConfig(path) {
+  const p = path ?? configPath(process.env);
+  if (!existsSync2(p)) return {};
+  return parseDaemonTable(readFileSync2(p, "utf-8"));
+}
+function getConfig(key, path) {
+  checkKey(key);
+  return listConfig(path)[key];
+}
+function setConfig(key, value, path) {
+  checkKey(key);
+  const p = path ?? configPath(process.env);
+  const lines = existsSync2(p) ? readFileSync2(p, "utf-8").split("\n") : [];
+  if (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
+  const rendered = `${key} = ${formatValue(key, value)}`;
+  let headerIdx = -1;
+  for (let i = 0; i < lines.length; i++) {
+    if ((lines[i] ?? "").trim() === "[daemon]") {
+      headerIdx = i;
+      break;
+    }
+  }
+  if (headerIdx < 0) {
+    if (lines.length > 0 && (lines[lines.length - 1] ?? "").trim() !== "") lines.push("");
+    lines.push("[daemon]", rendered);
+  } else {
+    let end = lines.length;
+    for (let i = headerIdx + 1; i < lines.length; i++) {
+      if ((lines[i] ?? "").trim().startsWith("[")) {
+        end = i;
+        break;
+      }
+    }
+    let replaced = false;
+    for (let i = headerIdx + 1; i < end; i++) {
+      const t = (lines[i] ?? "").trim();
+      if (t.startsWith("#") || !t.includes("=")) continue;
+      if (t.slice(0, t.indexOf("=")).trim() === key) {
+        lines[i] = rendered;
+        replaced = true;
+        break;
+      }
+    }
+    if (!replaced) lines.splice(end, 0, rendered);
+  }
+  mkdirSync2(dirname2(p), { recursive: true });
+  writeFileSync(p, lines.join("\n") + "\n");
+  chmodSync(p, 384);
+}
+function unsetConfig(key, path) {
+  const p = path ?? configPath(process.env);
+  if (!existsSync2(p)) return;
+  const lines = readFileSync2(p, "utf-8").split("\n");
+  if (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
+  const kept = [];
+  let inDaemon = false;
+  for (const line of lines) {
+    const t = line.trim();
+    if (t === "[daemon]") {
+      inDaemon = true;
+      kept.push(line);
+      continue;
+    }
+    if (t.startsWith("[")) inDaemon = false;
+    if (inDaemon && t.includes("=") && !t.startsWith("#") && t.slice(0, t.indexOf("=")).trim() === key)
+      continue;
+    kept.push(line);
+  }
+  writeFileSync(p, kept.join("\n") + "\n");
+  chmodSync(p, 384);
+}
+
+// src/client.ts
+import { spawn } from "child_process";
+import { randomUUID } from "crypto";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, openSync as openSync2 } from "fs";
+import { createRequire } from "module";
+import { connect } from "net";
+import { join as join3 } from "path";
+import { AuthMode } from "@struktoai/mirage-server/auth/config";
+import { defaultTokenFile as defaultTokenFile2, ensureTokenFile } from "@struktoai/mirage-server/auth/storage";
+import { readDaemonTable as readDaemonTable2, validateDaemonTable } from "@struktoai/mirage-server/daemon_config";
+import { mirageHome as mirageHome3 } from "@struktoai/mirage-server/paths";
+var requireFromHere = createRequire(import.meta.url);
+var DEFAULT_REQUEST_TIMEOUT_MS = 6e4;
+var DaemonUnreachable = class extends Error {
+  name = "DaemonUnreachable";
+};
+var DaemonClient = class {
+  settings;
+  refreshing;
+  /** The last login token this client sent. */
+  held = "";
+  constructor(settings) {
+    this.settings = settings;
+  }
+  /**
+   * The bearer token to send: the settings' own, else the login's,
+   * refreshed when it is about to end; empty when there is none. The client
+   * stays bound to the login it started with. That login is read from its
+   * file each time, so a refresh made by another process is shared, while
+   * `mirage logout` or a new login stops this one; requests sent at once
+   * share one read, so they refresh it once. The token sent is kept as
+   * `held`. Throws `LoginError` when the login ended or changed, or cannot
+   * give a token.
+   */
+  async token() {
+    const login = this.settings.login;
+    if (this.settings.authToken !== "" || login === void 0) {
+      this.held = this.settings.authToken;
+      return this.held;
+    }
+    this.refreshing ??= (async () => {
+      const stored = readLogin();
+      if (stored?.url !== login.url) {
+        throw new LoginError(`not logged in to ${login.url} any more; run \`mirage login\``);
+      }
+      if (stored.logged_in_at !== login.logged_in_at) {
+        throw new LoginError(`the login to ${login.url} changed; run the command again`);
+      }
+      this.held = await freshToken(stored);
+      return this.held;
+    })().finally(() => {
+      this.refreshing = void 0;
+    });
+    return this.refreshing;
+  }
+  async headers(extra) {
+    const h = { ...extra };
+    const token = await this.token();
+    if (token !== "") h.Authorization = `Bearer ${token}`;
+    return h;
+  }
+  async request(method, path, init = {}) {
+    const { timeoutMs = DEFAULT_REQUEST_TIMEOUT_MS, ...rest } = init;
+    const headers = {
+      ...await this.headers(),
+      ...rest.headers ?? {}
+    };
+    if (rest.body !== void 0 && headers["Content-Type"] === void 0) {
+      headers["Content-Type"] = "application/json";
+    }
+    if (timeoutMs === null) return fetch(this.settings.url + path, { ...rest, method, headers });
+    const ctrl = new AbortController();
+    const t = setTimeout(() => {
+      ctrl.abort();
+    }, timeoutMs);
+    try {
+      return await fetch(this.settings.url + path, {
+        ...rest,
+        method,
+        headers,
+        signal: ctrl.signal
+      });
+    } finally {
+      clearTimeout(t);
+    }
+  }
+  /**
+   * Send a JSON `request` part and then `part`, streamed from its data
+   * as it is read, as one multipart body. There is no overall timeout,
+   * since the upload lasts as long as its input; `signal` aborts it.
+   */
+  async requestUpload(method, path, request, part, signal) {
+    const boundary = `mirage-${randomUUID()}`;
+    const text = new TextEncoder();
+    const head = text.encode(
+      `--${boundary}\r
+Content-Disposition: form-data; name="request"; filename="request.json"\r
+Content-Type: application/json\r
+\r
+${JSON.stringify(request)}\r
+--${boundary}\r
+Content-Disposition: form-data; name="${part.name}"; filename="${part.name}.bin"\r
+Content-Type: application/octet-stream\r
+\r
+`
+    );
+    const tail = text.encode(`\r
+--${boundary}--\r
+`);
+    async function* parts() {
+      yield head;
+      for await (const chunk of part.data) yield chunk;
+      yield tail;
+    }
+    return fetch(this.settings.url + path, {
+      method,
+      headers: await this.headers({
+        "Content-Type": `multipart/form-data; boundary=${boundary}`
+      }),
+      body: ReadableStream.from(parts()),
+      duplex: "half",
+      ...signal !== void 0 ? { signal } : {}
+    });
+  }
+  async isReachable(timeoutMs = 500) {
+    const headers = await this.headers();
+    const ctrl = new AbortController();
+    const t = setTimeout(() => {
+      ctrl.abort();
+    }, timeoutMs);
+    try {
+      const r = await fetch(this.settings.url + "/v1/health", {
+        headers,
+        signal: ctrl.signal
+      });
+      return r.status === 200;
+    } catch {
+      return false;
+    } finally {
+      clearTimeout(t);
+    }
+  }
+  /**
+   * Ensure the daemon is reachable, optionally spawning it. `timeoutMs` is
+   * how long a spawned daemon has to answer `/v1/health`: a first start
+   * loads the whole server. A daemon that exits first ends the wait, unless
+   * another daemon already holds the port. Mirrors Python's
+   * `ensure_running`.
+   */
+  async ensureRunning(opts = {}) {
+    const allowSpawn = opts.allowSpawn ?? true;
+    const timeoutMs = opts.timeoutMs ?? 3e4;
+    if (await this.isReachable()) return;
+    if (!isLocalUrl(this.settings.url)) {
+      throw new DaemonUnreachable(`daemon not reachable at ${this.settings.url}`);
+    }
+    if (!allowSpawn) {
+      throw new DaemonUnreachable(
+        `daemon not reachable at ${this.settings.url}; run \`mirage workspace create CONFIG.yaml\` to spawn one`
+      );
+    }
+    const daemon = this.spawnDaemon();
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+      if (await this.isReachable(300)) return;
+      const code = daemon.exitCode ?? daemon.signalCode;
+      if (code !== null && !await this.listening()) {
+        throw new DaemonUnreachable(
+          `daemon exited with code ${String(code)} before answering /v1/health; see ${join3(mirageHome3(), "daemon.log")}`
+        );
+      }
+      await new Promise((r) => setTimeout(r, 100));
+    }
+    throw new DaemonUnreachable(
+      `daemon spawned but did not answer /v1/health within ${String(timeoutMs)}ms`
+    );
+  }
+  /** Whether anything accepts a connection on the daemon's port. */
+  listening() {
+    return new Promise((resolve) => {
+      const sock = connect({ host: new URL(this.settings.url).hostname, port: this.portFromUrl() });
+      const done = (up) => {
+        sock.destroy();
+        resolve(up);
+      };
+      sock.setTimeout(300);
+      sock.once("connect", () => {
+        done(true);
+      });
+      sock.once("timeout", () => {
+        done(false);
+      });
+      sock.once("error", (err) => {
+        console.debug(`nothing accepts on the daemon's port: ${String(err)}`);
+        done(false);
+      });
+    });
+  }
+  spawnDaemon() {
+    const table = readDaemonTable2(mirageHome3());
+    validateDaemonTable(table);
+    const env = {};
+    for (const [k, v] of Object.entries(process.env)) {
+      if (typeof v === "string") env[k] = v;
+    }
+    env[ENV_DAEMON_PORT] = String(this.resolvePort(table));
+    if ((env[ENV_IDLE_GRACE_SECONDS] ?? "") === "") {
+      env[ENV_IDLE_GRACE_SECONDS] = String(this.settings.idleGraceSeconds);
+    }
+    if (this.settings.authToken === "") {
+      this.settings.authToken = ensureTokenFile(defaultTokenFile2());
+    }
+    env[ENV_AUTH_TOKEN] = this.settings.authToken;
+    if ((env[ENV_AUTH_MODE] ?? "") === "" && (table.auth_mode ?? "") === "") {
+      env[ENV_AUTH_MODE] = AuthMode.Local;
+    }
+    const logDir = mirageHome3();
+    mkdirSync3(logDir, { recursive: true });
+    const out = openSync2(join3(logDir, "daemon.log"), "a");
+    const daemonEntry = requireFromHere.resolve("@struktoai/mirage-server/bin/daemon");
+    if (!existsSync3(daemonEntry)) {
+      throw new Error(
+        `daemon binary not found at ${daemonEntry}; reinstall @struktoai/mirage-server`
+      );
+    }
+    const child = spawn(process.execPath, [daemonEntry], {
+      env,
+      detached: true,
+      stdio: ["ignore", out, out]
+    });
+    child.on("error", (err) => {
+      console.error("failed to spawn daemon:", err);
+    });
+    child.unref();
+    return child;
+  }
+  resolvePort(table) {
+    const envPort = process.env[ENV_DAEMON_PORT];
+    if (envPort !== void 0 && envPort !== "") return Number(envPort);
+    const configPort = table.port;
+    if (configPort !== void 0 && configPort !== "") return Number(configPort);
+    return this.portFromUrl();
+  }
+  portFromUrl() {
+    const u = new URL(this.settings.url);
+    return Number(u.port) || 8765;
+  }
+};
+function makeClient(settings) {
+  return new DaemonClient(settings);
+}
+
+export {
+  LoginError,
+  renewBy,
+  readLogin,
+  writeLogin,
+  removeLogin,
+  tokenClaims,
+  jsonBody,
+  endsAt,
+  DEFAULT_DAEMON_URL,
+  isLocalUrl,
+  loadDaemonSettings,
+  resolvedConfig,
+  listConfig,
+  getConfig,
+  setConfig,
+  unsetConfig,
+  DaemonUnreachable,
+  DaemonClient,
+  makeClient
+};
+//# sourceMappingURL=chunk-IJUWWUKK.js.map