@tokenbuddy/tb-admin 1.0.0

package/src/client.ts

@@ -0,0 +1,54 @@
+export class AdminClient {
+  private baseUrl: string;
+  private token: string;
+
+  constructor(baseUrl: string, token: string) {
+    this.baseUrl = baseUrl.replace(/\/+$/, "");
+    this.token = token;
+  }
+
+  private async request(path: string, method: string, body?: any): Promise<any> {
+    const url = `${this.baseUrl}${path}`;
+    const headers: { [key: string]: string } = {
+      "Content-Type": "application/json",
+      "Authorization": `Bearer ${this.token}`
+    };
+
+    const options: RequestInit = {
+      method,
+      headers
+    };
+
+    if (body) {
+      options.body = JSON.stringify(body);
+    }
+
+    try {
+      const response = await fetch(url, options);
+      if (!response.ok) {
+        const errorText = await response.text();
+        throw new Error(`HTTP Error ${response.status}: ${errorText || response.statusText}`);
+      }
+      const text = await response.text();
+      return text ? JSON.parse(text) : {};
+    } catch (err: any) {
+      throw new Error(`Connection failed: ${err.message}`);
+    }
+  }
+
+  public async get(path: string): Promise<any> {
+    return this.request(path, "GET");
+  }
+
+  public async put(path: string, body?: any): Promise<any> {
+    return this.request(path, "PUT", body);
+  }
+
+  public async post(path: string, body?: any): Promise<any> {
+    return this.request(path, "POST", body);
+  }
+
+  public async delete(path: string): Promise<any> {
+    return this.request(path, "DELETE");
+  }
+}

package/src/config.ts

@@ -0,0 +1,159 @@
+import * as fs from "fs";
+import * as path from "path";
+import * as os from "os";
+import TOML from "@iarna/toml";
+
+export interface AdminProfile {
+  url: string;
+  token: string;
+}
+
+export interface SellerProviderConfig {
+  token?: string;
+  flyctl_path?: string;
+  default_app?: string;
+  default_region?: string;
+  default_image?: string;
+  default_config?: string;
+  operator_secret?: string;
+  volume_name?: string;
+  volume_size_gb?: number;
+  volume_snapshot_retention_days?: number;
+}
+
+export interface AdminConfig {
+  default_profile?: string;
+  profiles: { [name: string]: AdminProfile };
+  seller_providers?: { [name: string]: SellerProviderConfig };
+}
+
+export function getDefaultConfigPath(): string {
+  const home = os.homedir();
+  return path.join(home, ".config", "tokenbuddy", "admin.toml");
+}
+
+export class ConfigManager {
+  private configPath: string;
+
+  constructor(customPath?: string) {
+    this.configPath = customPath || getDefaultConfigPath();
+  }
+
+  public getConfigPath(): string {
+    return this.configPath;
+  }
+
+  public load(): AdminConfig {
+    if (!fs.existsSync(this.configPath)) {
+      return { profiles: {} };
+    }
+    try {
+      const content = fs.readFileSync(this.configPath, "utf8");
+
+      // Support legacy JSON format for backward compatibility
+      if (this.configPath.endsWith(".json")) {
+        return JSON.parse(content) as AdminConfig;
+      }
+
+      const parsed = TOML.parse(content) as any;
+      // TOML nested tables [profiles.xxx] are parsed as { profiles: { xxx: { ... } } }
+      return {
+        default_profile: parsed.default_profile,
+        profiles: parsed.profiles || {},
+        seller_providers: parsed.seller_providers || undefined
+      };
+    } catch {
+      return { profiles: {} };
+    }
+  }
+
+  public save(config: AdminConfig): void {
+    const parent = path.dirname(this.configPath);
+    if (!fs.existsSync(parent)) {
+      fs.mkdirSync(parent, { recursive: true });
+    }
+
+    if (this.configPath.endsWith(".json")) {
+      // Legacy JSON format
+      fs.writeFileSync(this.configPath, JSON.stringify(config, null, 2), "utf8");
+    } else {
+      // TOML format (default)
+      const tomlObj: any = {};
+      if (config.default_profile) {
+        tomlObj.default_profile = config.default_profile;
+      }
+      if (config.profiles) {
+        tomlObj.profiles = config.profiles;
+      }
+      if (config.seller_providers) {
+        tomlObj.seller_providers = config.seller_providers;
+      }
+      const content = TOML.stringify(tomlObj);
+      fs.writeFileSync(this.configPath, content, "utf8");
+
+      // chmod 0600 for security (contains tokens) - match Rust behavior
+      try {
+        fs.chmodSync(this.configPath, 0o600);
+      } catch {
+        // Ignore on platforms that don't support chmod
+      }
+    }
+  }
+
+  public getProfile(name?: string): AdminProfile | undefined {
+    const config = this.load();
+    const targetName = name || config.default_profile;
+    if (!targetName) return undefined;
+    return config.profiles[targetName];
+  }
+
+  public setProfile(name: string, profile: AdminProfile): void {
+    const config = this.load();
+    config.profiles[name] = profile;
+    if (!config.default_profile) {
+      config.default_profile = name;
+    }
+    this.save(config);
+  }
+
+  public removeProfile(name: string): void {
+    const config = this.load();
+    if (!config.profiles[name]) {
+      throw new Error(`Profile \`${name}\` does not exist.`);
+    }
+    delete config.profiles[name];
+    if (config.default_profile === name) {
+      const remaining = Object.keys(config.profiles);
+      config.default_profile = remaining.length > 0 ? remaining[0] : undefined;
+    }
+    this.save(config);
+  }
+
+  public useProfile(name: string): void {
+    const config = this.load();
+    if (!config.profiles[name]) {
+      throw new Error(`Profile \`${name}\` does not exist.`);
+    }
+    config.default_profile = name;
+    this.save(config);
+  }
+
+  public listProfiles(): string[] {
+    const config = this.load();
+    return Object.keys(config.profiles);
+  }
+
+  public getSellerProvider(name: string = "fly"): SellerProviderConfig | undefined {
+    const config = this.load();
+    return config.seller_providers?.[name];
+  }
+
+  public setSellerProvider(name: string, provider: SellerProviderConfig): void {
+    const config = this.load();
+    if (!config.seller_providers) {
+      config.seller_providers = {};
+    }
+    config.seller_providers[name] = provider;
+    this.save(config);
+  }
+}

package/src/index.ts

@@ -0,0 +1,8 @@
+import { ConfigManager } from "./config.js";
+import { buildAdminCli } from "./cli.js";
+
+export function run() {
+  const configManager = new ConfigManager();
+  const program = buildAdminCli(configManager);
+  program.parse(process.argv);
+}

package/src/server-cmd.ts

@@ -0,0 +1,132 @@
+import { execSync } from "child_process";
+import { SellerProviderConfig } from "./config.js";
+
+export function checkFlyctlInstalled(flyctlPath?: string): boolean {
+  try {
+    execSync(`which ${flyctlPath || "flyctl"}`, { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export interface SellerCreateOptions {
+  name: string;
+  region?: string;
+  image?: string;
+  operatorSecret: string;
+  flyConfig?: string;
+  dryRun?: boolean;
+}
+
+export class FlyProvider {
+  private providerConfig?: SellerProviderConfig;
+
+  constructor(providerConfig?: SellerProviderConfig) {
+    this.providerConfig = providerConfig;
+  }
+
+  private get flyctl(): string {
+    return this.providerConfig?.flyctl_path || "flyctl";
+  }
+
+  /**
+   * List apps on Fly.io
+   */
+  public listApps(): string {
+    if (!checkFlyctlInstalled(this.flyctl)) {
+      throw new Error(`\`${this.flyctl}\` is not installed on your system PATH.`);
+    }
+    return execSync(`${this.flyctl} apps list`, { encoding: "utf8" });
+  }
+
+  /**
+   * Create and deploy a new seller app on Fly.io
+   */
+  public createSeller(options: SellerCreateOptions): string {
+    const { name, dryRun } = options;
+    const appName = `tb-seller-${name}`;
+
+    // Merge CLI options with provider config defaults
+    const targetImage = options.image
+      || this.providerConfig?.default_image
+      || "registry.fly.io/tb-seller:latest";
+    const targetRegion = options.region
+      || this.providerConfig?.default_region
+      || "hkg";
+    const operatorSecret = options.operatorSecret
+      || this.providerConfig?.operator_secret
+      || "";
+    const flyConfig = options.flyConfig
+      || this.providerConfig?.default_config;
+    const volumeName = this.providerConfig?.volume_name || "tb_seller_data";
+    const volumeSizeGb = this.providerConfig?.volume_size_gb || 1;
+
+    if (dryRun) {
+      const lines = [
+        `[DRY-RUN] Will create fly app: ${appName}`,
+        `  Region: ${targetRegion}`,
+        `  Image:  ${targetImage}`,
+        `  Secret: OPERATOR_SECRET=***${operatorSecret.slice(-4) || "????"}`,
+        `  Volume: ${volumeName} (${volumeSizeGb}GB)`,
+      ];
+      if (flyConfig) lines.push(`  Fly config: ${flyConfig}`);
+      return lines.join("\n");
+    }
+
+    if (!checkFlyctlInstalled(this.flyctl)) {
+      throw new Error(`\`${this.flyctl}\` is not installed on PATH.`);
+    }
+
+    if (!operatorSecret) {
+      throw new Error("operator_secret is required. Provide --operator-secret or configure seller_providers.fly.operator_secret");
+    }
+
+    console.log(`[Fly.io] Creating app ${appName}...`);
+    execSync(`${this.flyctl} apps create ${appName} --machines`, { stdio: "inherit" });
+
+    console.log(`[Fly.io] Setting secrets...`);
+    execSync(
+      `${this.flyctl} secrets set ALLOW_MOCK=false OPERATOR_SECRET=${operatorSecret} --app ${appName}`,
+      { stdio: "inherit" }
+    );
+
+    console.log(`[Fly.io] Deploying image ${targetImage}...`);
+    const deployCmd = flyConfig
+      ? `${this.flyctl} deploy -c ${flyConfig} --image ${targetImage} --region ${targetRegion} --app ${appName} --now`
+      : `${this.flyctl} deploy --image ${targetImage} --region ${targetRegion} --app ${appName} --now`;
+    execSync(deployCmd, { stdio: "inherit" });
+
+    return `Successfully deployed ${appName} on Fly.io`;
+  }
+
+  /**
+   * Destroy a seller app on Fly.io
+   */
+  public removeSeller(name: string, dryRun?: boolean): string {
+    const appName = `tb-seller-${name}`;
+    if (dryRun) {
+      return `[DRY-RUN] Will destroy fly app: ${appName}`;
+    }
+
+    if (!checkFlyctlInstalled(this.flyctl)) {
+      throw new Error(`\`${this.flyctl}\` is not installed.`);
+    }
+
+    console.log(`[Fly.io] Destroying app ${appName}...`);
+    execSync(`${this.flyctl} apps destroy ${appName} --yes`, { stdio: "inherit" });
+
+    return `Successfully destroyed ${appName} on Fly.io`;
+  }
+
+  /**
+   * Get status of a specific seller app
+   */
+  public statusApp(name: string): string {
+    const appName = `tb-seller-${name}`;
+    if (!checkFlyctlInstalled(this.flyctl)) {
+      throw new Error(`\`${this.flyctl}\` is not installed.`);
+    }
+    return execSync(`${this.flyctl} status --app ${appName}`, { encoding: "utf8" });
+  }
+}

package/tests/admin.test.ts

@@ -0,0 +1,109 @@
+import { ConfigManager } from "../src/config.js";
+import { buildAdminCli } from "../src/cli.js";
+import {
+  validateRegistryDocument
+} from "../src/bootstrap-registry.js";
+import * as fs from "fs";
+import * as path from "path";
+
+const TEMP_CONF_PATH = path.resolve(__dirname, "../../data-test/admin-config.json");
+
+describe("Admin CLI Config Profile Management Tests", () => {
+  beforeEach(() => {
+    if (fs.existsSync(TEMP_CONF_PATH)) {
+      try { fs.unlinkSync(TEMP_CONF_PATH); } catch (e) {}
+    }
+  });
+
+  afterAll(() => {
+    if (fs.existsSync(TEMP_CONF_PATH)) {
+      try { fs.unlinkSync(TEMP_CONF_PATH); } catch (e) {}
+    }
+    const dir = path.dirname(TEMP_CONF_PATH);
+    if (fs.existsSync(dir)) {
+      try { fs.rmdirSync(dir); } catch (e) {}
+    }
+  });
+
+  test("Load and save profile seamlessly", () => {
+    const mgr = new ConfigManager(TEMP_CONF_PATH);
+    
+    // Initial empty
+    expect(mgr.listProfiles().length).toBe(0);
+
+    // Save profile 1
+    mgr.setProfile("prod", { url: "http://127.0.0.1:8000", token: "secret-op" });
+    expect(mgr.listProfiles()).toContain("prod");
+    
+    const p = mgr.getProfile("prod");
+    expect(p?.url).toBe("http://127.0.0.1:8000");
+    expect(p?.token).toBe("secret-op");
+
+    // Default profile is automatically set
+    const defaultP = mgr.getProfile();
+    expect(defaultP?.url).toBe("http://127.0.0.1:8000");
+  });
+
+  test("Switch default profiles", () => {
+    const mgr = new ConfigManager(TEMP_CONF_PATH);
+    mgr.setProfile("prod", { url: "http://127.0.0.1:8000", token: "secret-op" });
+    mgr.setProfile("dev", { url: "http://127.0.0.1:8001", token: "dev-op" });
+
+    mgr.useProfile("dev");
+    const active = mgr.getProfile();
+    expect(active?.url).toBe("http://127.0.0.1:8001");
+    expect(active?.token).toBe("dev-op");
+
+    expect(() => {
+      mgr.useProfile("non-exist");
+    }).toThrow("does not exist");
+  });
+
+  test("bootstrap sellers commands parse without global option conflicts", () => {
+    const program = buildAdminCli(new ConfigManager(TEMP_CONF_PATH));
+    const bootstrap = program.commands.find((command) => command.name() === "bootstrap");
+    const sellers = bootstrap?.commands.find((command) => command.name() === "sellers");
+    const sellerConfig = program.commands.find((command) => command.name() === "seller-config");
+    const payments = program.commands.find((command) => command.name() === "payments");
+    const upstreams = program.commands.find((command) => command.name() === "upstreams");
+
+    expect(bootstrap).toBeDefined();
+    expect(sellers).toBeDefined();
+    expect(sellers?.commands.map((command) => command.name()).sort()).toEqual(["get", "put", "validate"]);
+    expect(sellers?.commands.find((command) => command.name() === "put")?.options.some((option) => option.long === "--file")).toBe(true);
+    expect(sellers?.commands.find((command) => command.name() === "validate")?.options.some((option) => option.long === "--file")).toBe(true);
+    expect(sellerConfig).toBeDefined();
+    expect(sellerConfig?.commands.map((command) => command.name()).sort()).toEqual(["get", "put", "validate"]);
+    expect(sellerConfig?.commands.find((command) => command.name() === "put")?.options.some((option) => option.long === "--file")).toBe(true);
+    expect(sellerConfig?.commands.find((command) => command.name() === "validate")?.options.some((option) => option.long === "--file")).toBe(true);
+    expect(upstreams).toBeDefined();
+    expect(upstreams?.commands.map((command) => command.name()).sort()).toEqual(["get", "refresh", "update"]);
+    expect(upstreams?.commands.find((command) => command.name() === "update")?.options.some((option) => option.long === "--upstream-url")).toBe(true);
+    expect(upstreams?.commands.find((command) => command.name() === "refresh")?.options.some((option) => option.long === "--auto-models")).toBe(true);
+    expect(payments?.commands.map((command) => command.name()).sort()).toEqual([
+      "clear-clawtip",
+      "disable-mock",
+      "enable-mock",
+      "list",
+      "set-clawtip"
+    ]);
+  });
+
+  test("bootstrap registry validation accepts demo config and rejects unsafe variants", () => {
+    const document = JSON.parse(fs.readFileSync(path.resolve(__dirname, "../../../config/demo-sellers.json"), "utf8"));
+
+    expect(() => validateRegistryDocument(document)).not.toThrow();
+
+    const httpUrl = structuredClone(document);
+    httpUrl.sellers[0].url = "http://seller.example.com";
+    expect(() => validateRegistryDocument(httpUrl)).toThrow("url must be https");
+
+    const duplicate = structuredClone(document);
+    duplicate.sellers[1].id = duplicate.sellers[0].id;
+    expect(() => validateRegistryDocument(duplicate)).toThrow("duplicate seller id");
+
+    const badDefault = structuredClone(document);
+    badDefault.defaultSeller = "missing";
+    expect(() => validateRegistryDocument(badDefault)).toThrow("defaultSeller `missing`");
+  });
+});

package/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "outDir": "./dist",
+    "rootDir": "./"
+  },
+  "include": ["src/**/*"]
+}