@typeship-ax/cli 0.8.0 → 0.9.1

package/dist/api-identity.d.ts

@@ -0,0 +1,40 @@
+/** Identity comes from the authenticated API response, including opaque-token APIs. */
+export type IdentityKind = "subject" | "account" | "organization";
+export type IdentityPolicy = Partial<Record<IdentityKind, string>>;
+export type ApiIdentity = Partial<Record<IdentityKind, string | null>>;
+export interface VerifiedIdentity {
+    values: ApiIdentity;
+    checkedAt: string;
+}
+export interface IdentityConfiguration {
+    operation: string;
+    fields: IdentityPolicy;
+}
+export declare function validateIdentityPointer(pointer: unknown): asserts pointer is string;
+export declare function identityPolicyOf(auth?: {
+    identitySubject?: string | null;
+    identityAccount?: string | null;
+    identityOrganization?: string | null;
+}): IdentityPolicy;
+export declare function readApiIdentity(data: unknown, policy: IdentityPolicy): ApiIdentity;
+export declare function assertApiIdentity(expected: ApiIdentity, actual: ApiIdentity): void;
+/** No redirects, bounded decoded response, and one deadline including body reads. */
+export declare function identityFetch(apiBaseUrl: string): typeof fetch;
+type IdentityResult = {
+    ok: boolean;
+    data?: unknown;
+    error?: {
+        status?: number;
+    };
+};
+export declare function identityResult(client: unknown, operation: {
+    resource: string;
+    method: string;
+}): Promise<IdentityResult>;
+export declare function verifyClientIdentity(createClient: (options: Record<string, unknown>) => unknown, options: Record<string, unknown>, operation: {
+    resource: string;
+    method: string;
+}, policy: IdentityPolicy, expected?: ApiIdentity): Promise<VerifiedIdentity>;
+export declare function verifyApiIdentity(read: (anonymous: boolean) => Promise<IdentityResult>, policy: IdentityPolicy, expected?: ApiIdentity): Promise<VerifiedIdentity>;
+export {};
+//# sourceMappingURL=api-identity.d.ts.map

package/dist/api-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-identity.d.ts","sourceRoot":"","sources":["../src/api-identity.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,SAAS,GAAG,cAAc,CAAC;AAClE,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;AACnE,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;AACvE,MAAM,WAAW,gBAAgB;IAAG,MAAM,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE;AAC5E,MAAM,WAAW,qBAAqB;IAAG,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,cAAc,CAAA;CAAE;AAEpF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAInF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,GAAE;IAAE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GAAG,cAAc,CAKtK;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,GAAG,WAAW,CAelF;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,GAAG,IAAI,CAIlF;AAED,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,KAAK,CA8B9D;AAED,KAAK,cAAc,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AACnF,wBAAsB,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAI9H;AAED,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAI9P;AACD,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,OAAO,KAAK,OAAO,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,CASxK"}

package/dist/api-identity.js

@@ -0,0 +1,128 @@
+export function validateIdentityPointer(pointer) {
+    if (typeof pointer !== "string" || !pointer.startsWith("/") || pointer.length > 512 || /[\x00-\x1f\x7f]/.test(pointer) || /~(?:[^01]|$)/.test(pointer)) {
+        throw new Error("Identity fields must be JSON Pointers starting with /, at most 512 characters, with ~0 and ~1 escapes.");
+    }
+}
+export function identityPolicyOf(auth = {}) {
+    const entries = [["subject", auth.identitySubject], ["account", auth.identityAccount], ["organization", auth.identityOrganization]];
+    const policy = {};
+    for (const [kind, pointer] of entries)
+        if (pointer !== undefined && pointer !== null) {
+            validateIdentityPointer(pointer);
+            policy[kind] = pointer;
+        }
+    return policy;
+}
+export function readApiIdentity(data, policy) {
+    const result = {};
+    if (!Object.keys(policy).length)
+        throw new Error("Configure at least one identity field before verifying a session.");
+    for (const [kind, pointer] of Object.entries(policy)) {
+        validateIdentityPointer(pointer);
+        let value = data;
+        for (const part of pointer.slice(1).split("/").map((part) => part.replaceAll("~1", "/").replaceAll("~0", "~"))) {
+            if (!value || typeof value !== "object" || !Object.hasOwn(value, part))
+                throw new Error("The API identity response is missing a configured field. Check the identity field mapping.");
+            value = value[part];
+        }
+        if (value === null && kind === "organization")
+            result[kind] = null;
+        else if ((typeof value === "string" && value.length > 0 && value.length <= 512 && !/[\x00-\x1f\x7f]/.test(value)) || (typeof value === "number" && Number.isSafeInteger(value)))
+            result[kind] = String(value);
+        else
+            throw new Error("The API identity field must return a nonempty ID string or safe integer. Only an organization may be null.");
+    }
+    return result;
+}
+export function assertApiIdentity(expected, actual) {
+    if (!Object.keys(expected).length || Object.entries(expected).some(([key, value]) => !Object.hasOwn(actual, key) || actual[key] !== value)) {
+        throw new Error("The authenticated account, subject or organization does not match this login. Sign in again with the intended account and organization.");
+    }
+}
+/** No redirects, bounded decoded response, and one deadline including body reads. */
+export function identityFetch(apiBaseUrl) {
+    const base = new URL(apiBaseUrl);
+    if ((base.protocol !== "https:" && !(base.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(base.hostname))) || base.username || base.password || base.search || base.hash)
+        throw new Error("Identity verification requires an HTTPS API URL; loopback HTTP is allowed for development.");
+    const basePath = base.pathname.replace(/\/+$/, "");
+    return async (input, init) => {
+        const url = new URL(input instanceof Request ? input.url : String(input));
+        if (url.origin !== base.origin || (url.pathname !== basePath && !url.pathname.startsWith(basePath + "/")) || url.username || url.password || url.hash)
+            throw new Error("The identity read must stay on the configured API.");
+        const abort = new AbortController();
+        const timeout = setTimeout(() => abort.abort(), 10_000);
+        try {
+            const signal = init?.signal ? AbortSignal.any([init.signal, abort.signal]) : abort.signal;
+            const response = await fetch(input, { ...init, redirect: "error", signal });
+            const reader = response.body?.getReader();
+            const chunks = [];
+            let size = 0;
+            if (reader) {
+                try {
+                    while (true) {
+                        const chunk = await reader.read();
+                        if (chunk.done)
+                            break;
+                        size += chunk.value.byteLength;
+                        if (size > 1_048_576) {
+                            abort.abort();
+                            throw new Error();
+                        }
+                        chunks.push(chunk.value);
+                    }
+                }
+                finally {
+                    reader.releaseLock();
+                }
+            }
+            const bytes = new Uint8Array(size);
+            let offset = 0;
+            for (const chunk of chunks) {
+                bytes.set(chunk, offset);
+                offset += chunk.byteLength;
+            }
+            return new Response([204, 205, 304].includes(response.status) ? null : bytes, { status: response.status, statusText: response.statusText, headers: response.headers });
+        }
+        catch {
+            throw new Error("The API identity read failed. Check the API URL, connectivity and response size before signing in again.");
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    };
+}
+export async function identityResult(client, operation) {
+    const target = client[operation.resource];
+    if (!target?.[operation.method])
+        throw new Error("The configured identity operation is not available in this package.");
+    return target[operation.method]();
+}
+export function verifyClientIdentity(createClient, options, operation, policy, expected) {
+    if (typeof options.baseUrl !== "string")
+        throw new Error("Configure the API base URL before verifying identity.");
+    const shared = { baseUrl: options.baseUrl, environment: options.environment, fetch: identityFetch(options.baseUrl), maxRetries: 0, timeoutMs: 10_000 };
+    return verifyApiIdentity((anonymous) => identityResult(createClient(anonymous ? shared : { ...options, ...shared }), operation), policy, expected);
+}
+export async function verifyApiIdentity(read, policy, expected) {
+    let anonymous, authenticated;
+    try {
+        anonymous = await read(true);
+    }
+    catch {
+        throw new Error("Could not verify that the identity read rejects anonymous access.");
+    }
+    if (anonymous.ok || ![401, 403].includes(anonymous.error?.status ?? 0))
+        throw new Error("The identity read must reject anonymous access with 401 or 403 before login can be verified.");
+    try {
+        authenticated = await read(false);
+    }
+    catch {
+        throw new Error("The API identity read failed with the new credential. Check the API configuration and granted permissions.");
+    }
+    if (!authenticated.ok)
+        throw new Error("The API did not accept the new login credential for its identity read. Check the audience, scopes and account access.");
+    const values = readApiIdentity(authenticated.data, policy);
+    if (expected)
+        assertApiIdentity(expected, values);
+    return { values, checkedAt: new Date().toISOString() };
+}

package/dist/auth-profiles.d.ts

@@ -0,0 +1,30 @@
+export interface ProfileConfig {
+    baseUrl?: string;
+    environment?: string;
+    docsUrl?: string;
+}
+export interface ProfileContext {
+    name: string;
+    directory: string;
+    source: "flag" | "environment" | "selected" | "default";
+}
+export declare function profileName(value: string): string;
+export declare function profileDirectory(root: string, name: string): string;
+export declare function resolveProfile(root: string, options?: {
+    flag?: string;
+    environment?: string;
+    allowMissing?: boolean;
+}): ProfileContext;
+export declare function selectProfile(root: string, name: string): void;
+export declare function readProfileConfig(directory: string): ProfileConfig;
+export declare function updateProfileConfig(directory: string, change: (current: ProfileConfig) => ProfileConfig): Promise<void>;
+export declare function listProfiles(root: string): {
+    name: string;
+    config: ProfileConfig;
+    hasSavedCredentials: boolean;
+}[];
+/** Removing a profile requires logout first. Hold the settings and both storage
+ * locks so a concurrent login cannot be deleted underneath its transaction. */
+export declare function removeProfile(root: string, name: string): Promise<void>;
+export declare function profileFlag(args: string[]): string | undefined;
+//# sourceMappingURL=auth-profiles.d.ts.map

package/dist/auth-profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-profiles.d.ts","sourceRoot":"","sources":["../src/auth-profiles.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,aAAa;IAAG,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE;AAC3F,MAAM,WAAW,cAAc;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,CAAA;CAAE;AAE5H,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGjD;AAqBD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAOnE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,cAAc,CAa1I;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAI9D;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,CAIlE;AAED,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7H;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAAC,mBAAmB,EAAE,OAAO,CAAA;CAAE,EAAE,CAYlH;AAED;+EAC+E;AAC/E,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAc7E;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAS9D"}

package/dist/auth-profiles.js

@@ -0,0 +1,138 @@
+import { randomBytes } from "node:crypto";
+import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { FileCredentialStore } from "./oauth-session.js";
+export function profileName(value) {
+    if (!/^[a-z0-9][a-z0-9_-]{0,63}$/.test(value) || /^(con|prn|aux|nul|com[0-9]|lpt[0-9])$/.test(value))
+        throw new Error("Profile names use 1–64 lowercase letters, numbers, hyphens or underscores and cannot be reserved OS names.");
+    return value;
+}
+function json(path) {
+    try {
+        const value = JSON.parse(readFileSync(path, "utf8"));
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            throw new Error();
+        return value;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw new Error("Cannot read profile settings. Repair the settings file before retrying.");
+    }
+}
+function write(directory, file, value) {
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const temporary = join(directory, ".profile-" + randomBytes(16).toString("hex") + ".tmp");
+    try {
+        writeFileSync(temporary, JSON.stringify(value, null, 2) + "\n", { flag: "wx", mode: 0o600, flush: true });
+        renameSync(temporary, join(directory, file));
+    }
+    finally {
+        rmSync(temporary, { force: true });
+    }
+}
+export function profileDirectory(root, name) {
+    const directory = join(root, "profiles", profileName(name));
+    try {
+        const entry = lstatSync(directory);
+        if (entry.isSymbolicLink() || !entry.isDirectory())
+            throw new Error("A profile must be a directory, not a link or another file.");
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    return directory;
+}
+export function resolveProfile(root, options = {}) {
+    let name, source;
+    if (options.flag !== undefined) {
+        name = profileName(options.flag);
+        source = "flag";
+    }
+    else if (options.environment !== undefined) {
+        name = profileName(options.environment);
+        source = "environment";
+    }
+    else {
+        const settings = json(join(root, "profiles.json"));
+        if (settings && typeof settings.selected !== "string")
+            throw new Error("The selected profile setting is invalid. Pass --profile default to recover.");
+        name = settings ? profileName(settings.selected) : "default";
+        source = settings ? "selected" : "default";
+    }
+    const directory = profileDirectory(root, name);
+    if (name !== "default" && !options.allowMissing && !existsSync(directory))
+        throw new Error("Profile '" + name + "' does not exist. Run login --profile " + name + " or configure that profile first.");
+    return { name, directory, source };
+}
+export function selectProfile(root, name) {
+    const directory = profileDirectory(root, name);
+    if (name !== "default" && !existsSync(directory))
+        throw new Error("Profile '" + name + "' does not exist. Log in or configure it before selecting it.");
+    write(root, "profiles.json", { selected: name });
+}
+export function readProfileConfig(directory) {
+    const value = json(join(directory, "config.json")) ?? {};
+    for (const [key, field] of Object.entries(value))
+        if (!["baseUrl", "environment", "docsUrl"].includes(key) || typeof field !== "string")
+            throw new Error("Profile settings contain an unknown field or a non-string value.");
+    return value;
+}
+export async function updateProfileConfig(directory, change) {
+    await new FileCredentialStore(join(directory, "config.json")).withLock(async () => { write(directory, "config.json", change(readProfileConfig(directory))); });
+}
+export function listProfiles(root) {
+    const names = new Set(["default"]);
+    try {
+        for (const entry of readdirSync(join(root, "profiles"), { withFileTypes: true })) {
+            if (!entry.isDirectory() || entry.isSymbolicLink())
+                continue;
+            try {
+                names.add(profileName(entry.name));
+            }
+            catch { /* unrelated directories are not profiles */ }
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    return [...names].sort().map((name) => {
+        const directory = profileDirectory(root, name);
+        return { name, config: readProfileConfig(directory), hasSavedCredentials: ["credentials.enc", "credentials.json"].some((file) => existsSync(join(directory, file))) };
+    });
+}
+/** Removing a profile requires logout first. Hold the settings and both storage
+ * locks so a concurrent login cannot be deleted underneath its transaction. */
+export async function removeProfile(root, name) {
+    const directory = profileDirectory(root, name);
+    if (!existsSync(directory))
+        throw new Error("Profile '" + name + "' does not exist.");
+    const paths = ["config.json", "credentials.enc", "credentials.json"].map((file) => join(directory, file));
+    await new FileCredentialStore(paths[0]).withLock(async () => {
+        await new FileCredentialStore(paths[1]).withLock(async () => {
+            await new FileCredentialStore(paths[2]).withLock(async () => {
+                if (paths.slice(1).some((path) => existsSync(path)))
+                    throw new Error("Log out of both credential stores for profile '" + name + "' before removing it. Use logout --profile " + name + ".");
+                const selected = json(join(root, "profiles.json"));
+                if (selected?.selected === name)
+                    selectProfile(root, "default");
+                rmSync(directory, { recursive: true });
+            });
+        });
+    });
+}
+export function profileFlag(args) {
+    let value;
+    for (let i = 0; i < args.length; i++) {
+        if (args[i] === "--profile") {
+            value = args[++i];
+            if (value === undefined || value.startsWith("--"))
+                throw new Error("--profile requires a profile name.");
+        }
+        else if (args[i].startsWith("--profile="))
+            value = args[i].slice("--profile=".length);
+    }
+    return value === undefined ? undefined : profileName(value);
+}