@tigrisdata/cli 3.11.0 → 3.12.0

package/dist/auth/client.js

@@ -1 +1 @@
-import{a,b,c}from"../chunk-J3MAV7JB.js";import"../chunk-F4AGJWCK.js";export{b as TigrisAuthClient,a as getAuth0Config,c as getAuthClient};
+import{a,b,c,d}from"../chunk-HBEO4D3T.js";import"../chunk-F4AGJWCK.js";export{c as TigrisAuthClient,a as getAuth0Config,d as getAuthClient,b as setExternalTokenRefresher};

package/dist/auth/iam.js

@@ -1 +1 @@
-import{a as b,b as c}from"../chunk-GZMEHP36.js";import"../chunk-5AGM4LUA.js";import"../chunk-6TTEDYLD.js";import"../chunk-D7WXNA2O.js";import"../chunk-NI4EYBQH.js";import"../chunk-7Q44GQ2Y.js";import"../chunk-DV3LCXRH.js";import"../chunk-Z54TMLIH.js";import"../chunk-BMWWPXMU.js";import"../chunk-APJUJ6TW.js";import"../chunk-QPUL2AAI.js";import"../chunk-J3MAV7JB.js";import{a}from"../chunk-KJBSIIND.js";import"../chunk-F4AGJWCK.js";export{c as getIAMConfig,b as getOAuthIAMConfig,a as isFlyOrganization};
+import{a as b,b as c}from"../chunk-YR7ZJNOL.js";import"../chunk-Z6R2SWNJ.js";import"../chunk-RGFXGPV7.js";import"../chunk-D7WXNA2O.js";import"../chunk-NI4EYBQH.js";import"../chunk-JSAFHUUW.js";import"../chunk-DV3LCXRH.js";import"../chunk-T7LA7K35.js";import"../chunk-BMWWPXMU.js";import"../chunk-APJUJ6TW.js";import"../chunk-QPUL2AAI.js";import"../chunk-HBEO4D3T.js";import{a}from"../chunk-KJBSIIND.js";import"../chunk-F4AGJWCK.js";export{c as getIAMConfig,b as getOAuthIAMConfig,a as isFlyOrganization};

package/dist/auth/provider.js

@@ -1 +1 @@
-import{a,b,c,d,e,f,g}from"../chunk-5AGM4LUA.js";import"../chunk-QPUL2AAI.js";import"../chunk-J3MAV7JB.js";import"../chunk-F4AGJWCK.js";export{c as getEnvCredentials,b as getEnvForcePathStyle,e as getStorageConfig,f as getStorageConfigWithOrg,a as getTigrisConfig,g as requireOAuthLogin,d as resolveAuthMethod};
+import{a,b,c,d,e,f,g,h}from"../chunk-Z6R2SWNJ.js";import"../chunk-QPUL2AAI.js";import"../chunk-HBEO4D3T.js";import"../chunk-F4AGJWCK.js";export{c as getEnvCredentials,b as getEnvForcePathStyle,f as getStorageConfig,g as getStorageConfigWithOrg,a as getTigrisConfig,h as requireOAuthLogin,d as resetAutoLogin,e as resolveAuthMethod};

package/dist/browser/index.d.ts

@@ -0,0 +1,307 @@
+import { Organization } from '@tigrisdata/iam';
+import * as memfs from 'memfs';
+import { Volume } from 'memfs';
+
+interface Argument {
+    name: string;
+    description?: string;
+    alias?: string;
+    options?: string[] | Array<{
+        name: string;
+        value: string;
+        description: string;
+    }>;
+    default?: string;
+    required?: boolean;
+    'required-when'?: string;
+    type?: 'positional' | 'flag' | string;
+    multiple?: boolean;
+    examples?: string[];
+    /** Hard-removed: providing the flag exits with a redirect message. */
+    removed?: boolean;
+    /** Soft-deprecated: still works, but flagged in help and superseded by `replaced_by`. */
+    deprecated?: boolean;
+    /** Replacement to suggest when a removed or deprecated argument or command is used. */
+    replaced_by?: string;
+}
+interface NextAction {
+    command: string;
+    description: string;
+}
+interface Messages {
+    onStart?: string;
+    onSuccess?: string;
+    onFailure?: string;
+    onEmpty?: string;
+    onAlreadyDone?: string;
+    onDeprecated?: string;
+    hint?: string;
+    nextActions?: NextAction[];
+}
+interface CommandSpec {
+    name: string;
+    description?: string;
+    alias?: string | string[];
+    arguments?: Argument[];
+    examples?: string[];
+    commands?: CommandSpec[];
+    default?: string;
+    deprecated?: boolean;
+    /** Hard-removed: invoking the command exits with a redirect message. */
+    removed?: boolean;
+    /** Replacement to suggest when a removed argument or command is used. */
+    replaced_by?: string;
+    message?: string;
+    messages?: Messages;
+}
+interface Specs {
+    name: string;
+    description: string;
+    version: string;
+    definitions?: {
+        global_arguments?: Argument[];
+        [key: string]: unknown;
+    };
+    commands: CommandSpec[];
+}
+
+/**
+ * The host environment a browser-embedded CLI runs against.
+ *
+ * Shims read the *current* host through `getHost()` rather than taking it as a
+ * parameter: the CLI's handlers are reached through commander and have no way
+ * to thread a context object down. `runCli()` installs the host for the
+ * duration of one invocation.
+ *
+ * The filesystem is deliberately not part of this interface — it is the
+ * process-wide memfs volume in `./volume.js`, which the surrounding shell also
+ * mounts, so both see the same bytes.
+ */
+interface SelectChoice {
+    /** Value handed back to the caller. */
+    value: string;
+    /** Text shown in the terminal. */
+    label: string;
+    hint?: string;
+}
+interface BrowserHost {
+    /** Terminal width, used by the table formatter. Defaults to 120. */
+    columns?: number;
+    /** Environment variables visible to the CLI. */
+    env?: Record<string, string>;
+    /**
+     * Ask a yes/no question. Backs enquirer's `confirm`; `initial` is what an
+     * empty answer means, as in enquirer.
+     */
+    confirm(message: string, options?: {
+        initial?: boolean;
+    }): Promise<boolean>;
+    /** Ask for a line of text. Backs enquirer's `input`/`password` prompts. */
+    input(message: string, options?: {
+        password?: boolean;
+        initial?: string;
+    }): Promise<string>;
+    /**
+     * Ask the user to pick from a list. Backs enquirer's `select`; `initial` is
+     * the choice an empty answer means — an index, or a choice's value — as in
+     * enquirer.
+     */
+    select(message: string, choices: SelectChoice[], options?: {
+        initial?: number | string;
+    }): Promise<string>;
+    /**
+     * Start an interactive login. Replaces the CLI's device-flow login, which
+     * cannot run in a page: `auth.storage.tigrisdata.io/oauth/device/code`
+     * returns no `Access-Control-Allow-Origin`. Implementations use Auth0's
+     * official SPA SDK and write the result through `auth/storage.ts`.
+     */
+    login?(): Promise<void>;
+    /**
+     * Discard any browser-side session the host holds, on `tigris logout`.
+     *
+     * The CLI's own logout clears its credential store, but it knows nothing
+     * about an Auth0 SPA session in `localStorage` — without this, logging out
+     * and reloading signs you straight back in.
+     */
+    logout?(): Promise<void>;
+    /** Open a URL — the browser equivalent of the `open` package. */
+    openUrl?(url: string): void;
+    /**
+     * Renew the OAuth session, on demand from the CLI. Its own refresh path
+     * posts a refresh token, which it does not hold in a browser — Auth0's SPA
+     * SDK keeps that in its own cache. Implementations refresh through the SDK
+     * and install the result with `setOAuthSession`. Called when the access
+     * token is within five minutes of expiry, including mid-command during a
+     * long upload.
+     */
+    refreshSession?(): Promise<void>;
+}
+
+/**
+ * Thrown by the browser `process.exit` shim in place of terminating the process.
+ *
+ * The Node CLI reaches `process.exit()` from ~330 call sites (302 via
+ * `exitWithError`/`failWithError`, plus direct calls). Those functions are typed
+ * `: never`, and throwing preserves that contract exactly — so no handler needs
+ * to change for the browser build. `runCli()` catches this and turns it back
+ * into an exit code.
+ */
+declare class ExitSignal extends Error {
+    readonly exitCode: number;
+    constructor(exitCode: number);
+}
+declare function isExitSignal(error: unknown): error is ExitSignal;
+
+/**
+ * Auth provider
+ * Resolves auth method and provides storage config + service endpoints
+ */
+
+type TigrisStorageConfig = {
+    bucket?: string;
+    accessKeyId?: string;
+    secretAccessKey?: string;
+    endpoint?: string;
+    forcePathStyle?: boolean;
+    sessionToken?: string;
+    organizationId?: string;
+    iamEndpoint?: string;
+    authDomain?: string;
+    credentialProvider?: () => Promise<{
+        accessKeyId: string;
+        secretAccessKey: string;
+        sessionToken?: string;
+        expiration?: Date;
+    }>;
+};
+
+/**
+ * Installing credentials into the CLI's own credential store.
+ *
+ * The browser build cannot run the CLI's device-flow login — Auth0's
+ * `/oauth/device/code` sends no CORS headers — so the host performs login (via
+ * Auth0's SPA SDK) and hands the result here. Everything downstream then works
+ * unmodified: `getStorageConfig()` resolves it, `whoami` reports it, `logout`
+ * clears it, and token refresh goes through the CLI's existing client.
+ *
+ * The store writes to `~/.tigris/config.json` on the in-memory volume, so
+ * nothing survives a page reload.
+ */
+
+interface OAuthSession {
+    accessToken: string;
+    refreshToken?: string;
+    idToken?: string;
+    /** Unix ms. Defaults to one hour out when the provider does not say. */
+    expiresAt?: number;
+    organizations?: Organization[];
+    /** Organization id to make active. Defaults to the first one. */
+    selectedOrganization?: string;
+}
+interface AccessKeySession {
+    accessKeyId: string;
+    secretAccessKey: string;
+    endpoint?: string;
+    organizationId?: string;
+}
+/** Install an OAuth session obtained by the host. */
+declare function setOAuthSession(session: OAuthSession): Promise<void>;
+interface RenewedTokens {
+    accessToken: string;
+    /** Kept from the current session when the refresh response carries none. */
+    idToken?: string;
+    /** Unix ms. Defaults to one hour out when the provider does not say. */
+    expiresAt?: number;
+}
+/**
+ * Replace the access token of the current OAuth session, keeping everything
+ * else. A refresh response does not always carry an ID token, and `whoami`
+ * reads the user's identity out of the stored one — installing the refreshed
+ * set with `setOAuthSession` would wipe it.
+ *
+ * @throws if there is no OAuth session to renew.
+ */
+declare function renewOAuthSession(tokens: RenewedTokens): Promise<void>;
+/**
+ * Install access-key credentials. Stored as *temporary* credentials — the same
+ * slot `tigris login credentials` uses, which `logout` clears.
+ */
+declare function setAccessKeySession(session: AccessKeySession): Promise<void>;
+/** Forget everything. Equivalent to `tigris logout`. */
+declare function clearSession(): Promise<void>;
+/**
+ * The resolved storage config for the active session — the same object every
+ * CLI handler passes to the SDK. Exposed so a host can mount buckets or make
+ * SDK calls of its own without re-deriving credentials.
+ *
+ * @throws if nothing is authenticated.
+ */
+declare function getSessionConfig(): Promise<TigrisStorageConfig>;
+interface SessionState {
+    method: 'oauth' | 'credentials' | null;
+    organizationId: string | null;
+}
+declare function getSessionState(): SessionState;
+
+declare const HOME_DIR = "/home/tigris";
+declare const volume: Volume;
+/** Node-compatible `fs` bound to {@link volume}. */
+declare const fs: memfs.IFs;
+/** Drop every file and start clean — used between tests and on logout. */
+declare function resetVolume(): void;
+
+/**
+ * Browser entry point for Tigris CLI.
+ *
+ * Runs the *same* commander program and the *same* `src/lib` handlers as the
+ * Node CLI, driven by the same `specs.yaml`. The differences are confined to
+ * the build: node builtins are aliased to the shims in `./shims`, and the free
+ * `process` and `console` identifiers are replaced at bundle time so
+ * `process.exit()` becomes a catchable throw and output is captured instead of
+ * being written to a terminal.
+ *
+ * @example
+ * ```ts
+ * import { createBrowserCli, volume } from '@tigrisdata/cli/browser';
+ *
+ * const cli = createBrowserCli({
+ *   confirm: (message) => terminal.confirm(message),
+ *   input: (message, options) => terminal.input(message, options),
+ *   select: (message, choices) => terminal.select(message, choices),
+ *   login: () => auth0Login(),
+ * });
+ *
+ * const { stdout, exitCode } = await cli.run(['objects', 'list', 'my-bucket']);
+ * ```
+ */
+
+interface CliResult {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+    /**
+     * `'bytes'` when the command streamed binary to stdout — `stdout` is then a
+     * latin1 string (one char per byte) to be forwarded verbatim. Otherwise
+     * `'text'`.
+     */
+    stdoutKind: 'text' | 'bytes';
+}
+interface RunOptions {
+    /**
+     * Bytes piped into this invocation. Providing it makes `process.stdin.isTTY`
+     * false, which is how the CLI detects piped input (`objects put`, `bundle`).
+     */
+    stdin?: Uint8Array;
+    /** Directory to run in, so relative paths resolve as the user expects. */
+    cwd?: string;
+}
+interface BrowserCli {
+    run(argv: string[], options?: RunOptions): Promise<CliResult>;
+    /** Command paths available in this build, e.g. `['objects/list', ...]`. */
+    commands(): string[];
+    /** The parsed command tree, for help text and tab completion. */
+    specs(): Specs;
+}
+declare function createBrowserCli(host: BrowserHost): BrowserCli;
+
+export { type AccessKeySession, type BrowserCli, type BrowserHost, type CliResult, ExitSignal, HOME_DIR, type OAuthSession, type RenewedTokens, type RunOptions, type SelectChoice, type SessionState, type TigrisStorageConfig, clearSession, createBrowserCli, fs, getSessionConfig, getSessionState, isExitSignal, renewOAuthSession, resetVolume, setAccessKeySession, setOAuthSession, volume };