@tomato414941/foundation 0.13.0 → 0.15.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomato414941/foundation",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "Foundation CLI: make a key, and hand what is kept to a command without it passing through the agent.",
   "type": "module",
   "engines": {

package/runtime.mjs

@@ -105,7 +105,7 @@ Commands:
                                        Send one request to the Foundation API with the key attached.
   exec <ENV>=<name> [...] -- <command> [args...]
                                        Run a command with saved values in its environment.
-  exec --inputs '<json>' -- <command>  The same, with files, structured inputs, or a credential for a service by id.
+  exec --inputs '<json>' -- <command>  The same, with files, structured inputs, or a connection for a service by id.
   exec --output '<json>' -- <command>  Also save a file the command writes.
   version                              Print the version.
 
@@ -132,15 +132,22 @@ async function main() {
     const parsed = parseArgs({ args: args.slice(0, separatorAt), options: { inputs: { type: 'string' }, output: { type: 'string' } }, strict: true, allowPositionals: true });
     if (parsed.values.inputs !== undefined && parsed.positionals.length) throw new Error('--inputs and ENV=name are alternatives.');
     if (parsed.values.inputs !== undefined) {
-      try { names = JSON.parse(parsed.values.inputs); } catch { throw new Error('--inputs must be a JSON array of {name, as, filename?}.'); }
+      try { names = JSON.parse(parsed.values.inputs); } catch { throw new Error('--inputs must be a JSON array of {name, as, filename?} or {id, output?, as?, filename?}.'); }
     } else names = parsed.positionals.map(value => {
       const at = value.indexOf('=');
       if (at < 1) throw new Error('Specify the environment variable explicitly: ENV=name');
       return { name: value.slice(at + 1), as: value.slice(0, at) };
     });
-    // A credential for a service names its own variables, so an input may leave `as` out; a secret must say where it goes.
-    if (!Array.isArray(names) || names.length > 16 || names.some(item => !item || typeof item.name !== 'string' || !item.name || (item.as !== undefined && !validEnvName(item.as)))) throw new Error('Each input needs a name and, when given, a non-reserved environment variable in as.');
-    const chosen = names.map(item => item.as).filter(value => value !== undefined);
+    // A connection for a service names its own variables, so an input may leave `as` out; a secret must say where it goes.
+    if (!Array.isArray(names) || names.length > 16 || names.some(item => {
+      if (!item || typeof item !== 'object' || Array.isArray(item) || Object.keys(item).some(key => !['name', 'id', 'output', 'as', 'filename'].includes(key))) return true;
+      if (Object.hasOwn(item, 'name') === Object.hasOwn(item, 'id')) return true;
+      if (Object.hasOwn(item, 'name') && (typeof item.name !== 'string' || !item.name || Object.hasOwn(item, 'output'))) return true;
+      if (Object.hasOwn(item, 'id') && (typeof item.id !== 'string' || !/^[0-9a-f-]{36}$/.test(item.id))) return true;
+      if (Object.hasOwn(item, 'output') && (typeof item.output !== 'string' || !item.output || item.output.length > 200)) return true;
+      return item.as !== undefined && item.as !== null && !validEnvName(item.as);
+    })) throw new Error('Each input needs exactly one of name or id. Use output with a connection id; as must be a non-reserved environment variable.');
+    const chosen = names.map(item => item.as).filter(value => typeof value === 'string');
     if (new Set(chosen).size !== chosen.length) throw new Error('Each input needs a different environment variable.');
     if (parsed.values.output !== undefined) {
       try { output = JSON.parse(parsed.values.output); } catch { throw new Error('--output must be a JSON object {name, as, filename}.'); }
@@ -210,7 +217,7 @@ async function main() {
       await writeKey(keyPath, made.token, !process.env.FOUNDATION_RUNTIME_KEY_FILE);
       token = made.token; me = null;
     }
-    const answer = me?.acts_for?.length ? null : await send('/v1/requests', { kind: 'actor', input: { name: wanted } });
+    const answer = me?.acts_for?.length ? null : await send('/v1/requests', { authorization_details: [{ type: 'relation', relation: 'actor' }] });
     if (connectTo !== undefined) await saveUrl(url.origin);
     console.log(answer === null ? 'Already approved on ' + url.origin + '.' : JSON.stringify(answer, null, 2));
     console.log('\nKey file: ' + keyPath + '\nServer: ' + url.origin + (connectTo !== undefined ? ' (saved to ' + configPath() + ')' : '') + '\nEverything else is HTTP: Authorization: Bearer <the contents of that file>');
@@ -228,13 +235,6 @@ async function main() {
   const holder = process.env.FOUNDATION_AS || (acting.length === 1 ? acting[0] : null);
   if (!holder && acting.length > 1) throw new Error('This key acts for several principals. Set FOUNDATION_AS=<principal id> to say which one this run is for.');
   const forHolder = target => holder ? target + (target.includes('?') ? '&' : '?') + 'as=' + encodeURIComponent(holder) : target;
-  // A client can be updated before its server. Discover the storage kind before the command creates an output.
-  let outputKind = 'secret';
-  if (output) {
-    const probe = await send(forHolder('/v1/resources?kind=secret&prefix=' + encodeURIComponent(output.name)), undefined,
-      { method: 'GET', accept: data => data.error?.code === 'invalid_kind' });
-    if (probe.error?.code === 'invalid_kind') outputKind = 'credential';
-  }
   let injection;
   if (names.length) ({ injection } = await send(forHolder('/v1/injections'), { names }));
   else injection = { environment: {}, files: [] };
@@ -254,7 +254,7 @@ async function main() {
     fileNames.add(file.filename); variables.add(file.env);
   }
   if (output && variables.has(output.as)) throw new Error('Output needs a different environment variable from every input.');
-  environment.FOUNDATION_NAMES = JSON.stringify(names.map(item => item.name));
+  environment.FOUNDATION_NAMES = JSON.stringify(names.map(item => item.name ?? item.id));
   // Injected inputs are always cleaned up. A completed output survives only an unconfirmed upload.
   let secretDir, outputDir, outputPath, child, interrupted = false, retainOutput = false;
   const cleanup = () => {
@@ -266,7 +266,7 @@ async function main() {
       }
     }
   };
-  const recovery = () => 'Foundation could not confirm the output was saved. The private output file is retained for recovery: ' + outputPath + '\nRetry with foundation api PUT "/v1/resources?kind=' + outputKind + '&name=<URL-encoded-name>" --from <file>, then remove that recovery file.';
+  const recovery = () => 'Foundation could not confirm the output was saved. The private output file is retained for recovery: ' + outputPath + '\nRetry with foundation api PUT "/v1/resources?kind=secret&name=<URL-encoded-name>" --from <file>, then remove that recovery file.';
   process.once('exit', cleanup);
   for (const signal of ['SIGINT', 'SIGTERM', 'SIGHUP']) process.once(signal, () => {
     interrupted = true;
@@ -305,7 +305,7 @@ async function main() {
       retainOutput = true;
       // The command wrote it; the agent never saw it, and keeps it that way: the line drawn for the one who kept it is declined.
       let saved;
-      try { saved = await send(forHolder('/v1/resources?kind=' + outputKind + '&name=' + encodeURIComponent(output.name)), bytes, { method: 'PUT', type: 'application/octet-stream' }); }
+      try { saved = await send(forHolder('/v1/resources?kind=secret&name=' + encodeURIComponent(output.name)), bytes, { method: 'PUT', type: 'application/octet-stream' }); }
       catch { throw new Error(recovery()); }
       try { await send('/v1/relations', { relation: 'editor', object_type: 'resource', object_id: saved.resource.id }, { method: 'DELETE' }); } catch {}
       retainOutput = false;