@tomato414941/foundation 0.10.0 → 0.12.0

package/guide.mjs

@@ -41,10 +41,15 @@ export function guide(services) {
     '   PATCH /v1/principals/me {"name"}    DELETE /v1/principals/me    a new name; leaving (your key stops working).',
     '   GET /v1/requests/<id>   one of your requests and what happened at its page (events).   DELETE cancels it.',
     '   GET /v1/relations   every line you are on.   GET /v1/audit-log   what was done in your name or to you.',
-    '   Every resource has an id, shown in every listing. The holder shows one to another principal with',
-    '   POST /v1/relations {"subject":"<principal id>","relation":"viewer"|"editor","object_type":"resource","object_id":"<id>"}   DELETE takes it back.',
+    '   Every resource has an id, shown in every listing. What a principal may do comes from lines drawn to it:',
+    '   POST /v1/relations {"subject":"<principal id>","relation":"<role or action>","object_type":"resource"|"principal","object_id":"<id>"}',
+    '     A role is viewer or editor onto a resource, or actor onto a principal (acting for it). An action is one the rules',
+    '     name, such as credential.disconnect, onto one resource or onto a principal (all it holds). One draws a line where',
+    '     one may give lines (share on a resource, relate on a principal) and may do all the line reaches. DELETE takes it',
+    '     back; anyone may step off a line drawn to them. Owning a principal is never drawn: it comes from making or approving.',
     '   GET /v1/resources?shown=me   what others have shown you.   GET /v1/resources/<id>   one resource, whoever holds it.',
-    '   GET /v1/resources/<id>/content   reads it; PUT writes it, as editor. Lines point at the id, so renaming changes nothing.', '',
+    '   GET /v1/resources/<id>/content   reads it; PUT writes it, as editor. Lines point at the id, so renaming changes nothing.',
+    '',
     'CREDENTIALS',
     '   GET /v1/resources?kind=credential    every credential: id, name, status, and for one made for a service, its',
     '     service, auth_scheme, facts and the variables it yields. &service=<id> narrows to one service; &secret=true to',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomato414941/foundation",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "Foundation CLI: make a key, and hand what is kept to a command without it passing through the agent.",
   "type": "module",
   "engines": {

package/runtime.mjs

@@ -199,7 +199,7 @@ async function main() {
   if (action === 'api') {
     if (!/[?&]as=/.test(call.target)) {
       const me = await send('/v1/principals/me', undefined, { method: 'GET', accept: () => true });
-      if (me.acts_for?.length === 1) call.target += (call.target.includes('?') ? '&' : '?') + 'as=' + encodeURIComponent(me.acts_for[0].id);
+      if (me.acts_for?.length === 1) call.target += (call.target.includes('?') ? '&' : '?') + 'as=' + encodeURIComponent(me.acts_for[0]);
     }
     const response = await fetch(url.origin + call.target, { method: call.method, headers: { authorization: 'Bearer ' + token, ...(call.body === undefined ? {} : { 'content-type': call.type }) },
       ...(call.body === undefined ? {} : { body: call.body }), redirect: 'error', signal: AbortSignal.timeout(30_000) });
@@ -239,9 +239,16 @@ async function main() {
   if (!own && !current.acts_for?.length) throw new Error('Foundation request failed (401, not_approved). This key acts for nobody yet' + (current.requests?.[0] ? '; it is waiting for approval at ' + current.requests[0].verification_uri : '') + '.');
   // Whose resources a run reaches: the one this key acts for, the one named when it acts for several, or its own.
   const acting = current.acts_for ?? [];
-  const holder = process.env.FOUNDATION_AS || (acting.length === 1 ? acting[0].id : null);
+  const holder = process.env.FOUNDATION_AS || (acting.length === 1 ? acting[0] : null);
   if (!holder && acting.length > 1) throw new Error('This key acts for several principals. Set FOUNDATION_AS=<principal id> to say which one this run is for.');
   const forHolder = target => holder ? target + (target.includes('?') ? '&' : '?') + 'as=' + encodeURIComponent(holder) : target;
+  // A client can be updated before its server. Discover the storage kind before the command creates an output.
+  let outputKind = 'secret';
+  if (output) {
+    const probe = await send(forHolder('/v1/resources?kind=secret&prefix=' + encodeURIComponent(output.name)), undefined,
+      { method: 'GET', accept: data => data.error?.code === 'invalid_kind' });
+    if (probe.error?.code === 'invalid_kind') outputKind = 'credential';
+  }
   let injection;
   if (names.length) ({ injection } = await send(forHolder('/v1/injections'), { names }));
   else injection = { environment: {}, files: [] };
@@ -273,7 +280,7 @@ async function main() {
       }
     }
   };
-  const recovery = () => 'Foundation could not confirm the output was saved. The private output file is retained for recovery: ' + outputPath + '\nRetry with foundation api PUT "/v1/resources?kind=credential&name=<URL-encoded-name>" --from <file>, then remove that recovery file.';
+  const recovery = () => 'Foundation could not confirm the output was saved. The private output file is retained for recovery: ' + outputPath + '\nRetry with foundation api PUT "/v1/resources?kind=' + outputKind + '&name=<URL-encoded-name>" --from <file>, then remove that recovery file.';
   process.once('exit', cleanup);
   for (const signal of ['SIGINT', 'SIGTERM', 'SIGHUP']) process.once(signal, () => {
     interrupted = true;
@@ -312,7 +319,7 @@ async function main() {
       retainOutput = true;
       // The command wrote it; the agent never saw it, and keeps it that way: the line drawn for the one who kept it is declined.
       let saved;
-      try { saved = await send(forHolder('/v1/resources?kind=credential&name=' + encodeURIComponent(output.name)), bytes, { method: 'PUT', type: 'application/octet-stream' }); }
+      try { saved = await send(forHolder('/v1/resources?kind=' + outputKind + '&name=' + encodeURIComponent(output.name)), bytes, { method: 'PUT', type: 'application/octet-stream' }); }
       catch { throw new Error(recovery()); }
       try { await send('/v1/relations', { relation: 'editor', object_type: 'resource', object_id: saved.resource.id }, { method: 'DELETE' }); } catch {}
       retainOutput = false;