@turns/dev 0.0.1

package/dist/index.js

@@ -0,0 +1,300 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+import { applicationPaths, authenticate, CREDENTIAL_REFRESH_INTERVAL_MS, credentialsNeedRefresh, exchangeLegacyToken, normalizeOrigin, readCredentials, recoverRejectedCredentials, refreshCredentials, removeCredentials, uploadSocketUrl, writeCredentials, } from "./auth.js";
+import { daemonStatus, installDaemon, uninstallDaemon } from "./daemon.js";
+import { normalizeAllowedDirectories } from "./directory-policy.js";
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const CLI_DIRECTORY = path.basename(HERE) === 'dist' ? path.dirname(HERE) : HERE;
+const pkg = JSON.parse(fs.readFileSync(path.join(CLI_DIRECTORY, 'package.json'), 'utf8'));
+export function migrateLegacyUploaderState(paths) {
+    const legacyDirectory = path.resolve(CLI_DIRECTORY, '../cloudflare');
+    const entries = [
+        [path.join(legacyDirectory, '.machine-id'), paths.machineId],
+        [path.join(legacyDirectory, '.native-upload-state.json'), paths.uploaderState],
+    ];
+    for (const [source, destination] of entries) {
+        if (fs.existsSync(destination) || !fs.existsSync(source))
+            continue;
+        fs.mkdirSync(path.dirname(destination), { recursive: true, mode: 0o700 });
+        const temporary = `${destination}.${process.pid}.tmp`;
+        fs.copyFileSync(source, temporary);
+        fs.chmodSync(temporary, 0o600);
+        fs.renameSync(temporary, destination);
+    }
+}
+export async function migrateLegacyCredentials(paths, origin, { legacyTokenFile = process.env.TURNS_LEGACY_TOKEN_FILE || path.resolve(CLI_DIRECTORY, '../cloudflare/.upload-token'), } = {}) {
+    const saved = readCredentials(paths);
+    if (saved) {
+        // Once access/refresh credentials exist, retaining the old bearer token is
+        // unnecessary secret material and surprising after `turns logout`.
+        try {
+            fs.unlinkSync(legacyTokenFile);
+        }
+        catch (error) {
+            if (error?.code !== 'ENOENT')
+                throw error;
+        }
+        return saved;
+    }
+    let legacyToken = '';
+    try {
+        legacyToken = fs.readFileSync(legacyTokenFile, 'utf8').trim();
+    }
+    catch { }
+    if (!legacyToken)
+        return null;
+    try {
+        const credentials = await exchangeLegacyToken(normalizeOrigin(origin || 'https://turns.dev'), legacyToken);
+        writeCredentials(credentials, paths);
+        fs.unlinkSync(legacyTokenFile);
+        process.stdout.write(`Upgraded the existing uploader credential for @${credentials.user.login}.\n`);
+        return credentials;
+    }
+    catch (error) {
+        process.stderr.write(`Could not upgrade the existing uploader credential: ${error.message}\n`);
+        return null;
+    }
+}
+function help() {
+    return `Turns ${pkg.version}
+
+Usage:
+  turns                         Upload sessions for the current directory once
+  turns upload [directory]      Watch sessions belonging to one directory
+  turns install                 Install and start the all-directory daemon
+  turns status                  Show daemon status
+  turns uninstall               Stop and uninstall the background daemon
+  turns daemon run              Run the daemon in the foreground
+  turns login                   Authenticate this machine in a browser
+  turns logout                  Remove saved credentials
+
+Options:
+  --server URL                  Use a Turns server (saved with credentials)
+  --allow-directory PATH        Restrict daemon uploads/launches to this prefix (repeatable)
+  --dev-user LOGIN              Authenticate to a local Wrangler DEV_USER server
+  --no-browser                  Print the authentication URL without opening it
+
+Environment:
+  TURNS_ORIGIN                  Server origin (default: saved origin or https://turns.dev)
+  TURNS_NO_BROWSER=1            Do not automatically open a browser
+`;
+}
+function parseGlobalArguments(argv) {
+    const remaining = [];
+    let origin = process.env.TURNS_ORIGIN || process.env.TURNS_SERVER || '';
+    let devUser = '';
+    const allowedDirectories = [];
+    for (let index = 0; index < argv.length; index += 1) {
+        const argument = argv[index];
+        if (argument === '--server' || argument === '--origin') {
+            const value = argv[++index];
+            if (!value)
+                throw new Error(`${argument} requires a URL.`);
+            origin = value;
+        }
+        else if (argument === '--allow-directory') {
+            const value = argv[++index];
+            if (!value)
+                throw new Error(`${argument} requires a path.`);
+            allowedDirectories.push(value);
+        }
+        else if (argument === '--dev-user') {
+            const value = argv[++index];
+            if (!value)
+                throw new Error(`${argument} requires a login.`);
+            devUser = value.trim().toLowerCase();
+        }
+        else if (argument === '--no-browser') {
+            process.env.TURNS_NO_BROWSER = '1';
+        }
+        else {
+            remaining.push(argument);
+        }
+    }
+    return { argv: remaining, origin: origin || undefined, devUser, allowedDirectories };
+}
+function credentialProvider(initial, { paths, interactive }) {
+    let credentials = initial;
+    let refreshing = null;
+    const listeners = new Set();
+    const update = (value) => {
+        credentials = value;
+        for (const listener of listeners)
+            listener(value);
+        return value;
+    };
+    const refreshIfDue = async () => {
+        if (!credentialsNeedRefresh(credentials))
+            return credentials;
+        if (!refreshing) {
+            refreshing = refreshCredentials(credentials)
+                .then((value) => {
+                writeCredentials(value, paths);
+                return update(value);
+            })
+                .finally(() => {
+                refreshing = null;
+            });
+        }
+        return refreshing;
+    };
+    const timer = setInterval(() => {
+        refreshIfDue().catch((error) => {
+            process.stderr.write(`Turns credential refresh failed: ${error.message}; retrying later.\n`);
+        });
+    }, Math.min(CREDENTIAL_REFRESH_INTERVAL_MS, 60 * 60_000));
+    timer.unref?.();
+    return {
+        current: () => credentials,
+        refreshIfDue,
+        async recover() {
+            return update(await recoverRejectedCredentials(credentials, { paths, interactive }));
+        },
+        onUpdate(listener) {
+            listeners.add(listener);
+            return () => listeners.delete(listener);
+        },
+        close() {
+            clearInterval(timer);
+        },
+    };
+}
+/**
+ * @param {object} credentials
+ * @param {object} [options]
+ * @param {import('./auth.ts').AuthPaths} [options.paths]
+ * @param {string} [options.directory]
+ * @param {boolean} [options.watch]
+ * @param {boolean} [options.all]
+ * @param {boolean} [options.interactive]
+ * @param {string} [options.devUser]
+ * @param {string[]} [options.allowedDirectories]
+ */
+async function runUpload(credentials, { paths, directory = '', watch = false, all = false, interactive = true, devUser = '', allowedDirectories = [], } = {}) {
+    migrateLegacyUploaderState(paths);
+    const provider = devUser ? null : credentialProvider(credentials, { paths, interactive });
+    const { runUploader } = await import("./upload-sessions.js");
+    const arguments_ = [
+        '--native',
+        '--url',
+        uploadSocketUrl(credentials.origin),
+        '--native-state-file',
+        paths.uploaderState,
+        '--machine-id-file',
+        paths.machineId,
+        ...(devUser ? ['--dev-user', devUser] : []),
+        ...allowedDirectories.flatMap((directory) => ['--allow-directory', directory]),
+        ...(watch ? ['--watch'] : []),
+        ...(all ? ['--all'] : allowedDirectories.length ? [] : ['--directory', path.resolve(directory || process.cwd())]),
+    ];
+    try {
+        await runUploader(arguments_, { credentialProvider: provider });
+    }
+    finally {
+        provider?.close();
+    }
+}
+async function main(rawArguments = process.argv.slice(2)) {
+    const parsed = parseGlobalArguments(rawArguments);
+    const argv = parsed.argv;
+    const command = argv[0] || '';
+    const paths = applicationPaths();
+    if (['--help', '-h', 'help'].includes(command)) {
+        process.stdout.write(help());
+        return;
+    }
+    if (['--version', '-v'].includes(command)) {
+        process.stdout.write(`${pkg.version}\n`);
+        return;
+    }
+    if (command === 'logout') {
+        removeCredentials(paths);
+        process.stdout.write('Removed saved Turns credentials.\n');
+        return;
+    }
+    if (command === 'login') {
+        const credentials = await authenticate({ origin: parsed.origin, forceBrowser: true, paths });
+        process.stdout.write(`Authenticated as @${credentials.user.login}.\n`);
+        return;
+    }
+    if (command === 'status') {
+        const status = daemonStatus();
+        process.stdout.write(`Turns daemon is ${status.active ? 'running' : status.status || 'not running'}.\n`);
+        process.exitCode = status.active ? 0 : 1;
+        return;
+    }
+    if (command === 'uninstall' || (command === 'daemon' && argv[1] === 'uninstall')) {
+        uninstallDaemon({ paths });
+        process.stdout.write('Turns daemon removed. Detached agent anchors were left running.\n');
+        return;
+    }
+    if (command === 'install') {
+        await migrateLegacyCredentials(paths, parsed.origin);
+        const credentials = await authenticate({ origin: parsed.origin, paths });
+        const service = installDaemon({ paths });
+        process.stdout.write(`Installed ${service}; syncing all local sessions as @${credentials.user.login}.\n`);
+        return;
+    }
+    if (command === 'daemon') {
+        if (argv[1] !== 'run')
+            throw new Error(`Unknown daemon command: ${argv[1] || ''}\n\n${help()}`);
+        const allowedDirectories = normalizeAllowedDirectories(parsed.allowedDirectories);
+        if (parsed.devUser && !parsed.origin)
+            throw new Error('--dev-user requires an explicit --server URL.');
+        let credentials;
+        if (parsed.devUser) {
+            credentials = { origin: normalizeOrigin(parsed.origin) };
+        }
+        else {
+            await migrateLegacyCredentials(paths, parsed.origin);
+            credentials = await authenticate({ origin: parsed.origin, paths, interactive: false });
+        }
+        if (allowedDirectories.length) {
+            process.stdout.write(`Daemon directory allowlist:\n${allowedDirectories.map((value) => `  ${value}`).join('\n')}\n`);
+        }
+        await runUpload(credentials, {
+            paths,
+            watch: true,
+            all: allowedDirectories.length === 0,
+            interactive: false,
+            devUser: parsed.devUser,
+            allowedDirectories,
+        });
+        return;
+    }
+    if (parsed.devUser || parsed.allowedDirectories.length) {
+        throw new Error('--dev-user and --allow-directory are supported only by `turns daemon run`.');
+    }
+    if (command && command !== 'upload')
+        throw new Error(`Unknown command: ${command}\n\n${help()}`);
+    const runningDaemon = daemonStatus();
+    if (runningDaemon.active) {
+        process.stdout.write('The Turns daemon is already syncing this directory as part of the all-directory watch.\n');
+        return;
+    }
+    await migrateLegacyCredentials(paths, parsed.origin);
+    const credentials = await authenticate({ origin: parsed.origin, paths });
+    const selectedDirectory = path.resolve(command === 'upload' ? argv[1] || process.cwd() : process.cwd());
+    process.stdout.write(`${command === 'upload' ? 'Watching' : 'Uploading'} sessions in ${selectedDirectory} as @${credentials.user.login}.\n`);
+    await runUpload(credentials, {
+        paths,
+        directory: selectedDirectory,
+        watch: command === 'upload',
+        interactive: true,
+    });
+}
+export { credentialProvider, help, main, parseGlobalArguments, runUpload };
+let invokedAsMain = false;
+try {
+    invokedAsMain = Boolean(process.argv[1] && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url)));
+}
+catch { }
+if (invokedAsMain) {
+    main().catch((error) => {
+        process.stderr.write(`turns: ${error?.message || error}\n`);
+        process.exitCode = 1;
+    });
+}