@usestatemachines/cli 0.0.0-stage → 0.1.0

package/dist/context.js

@@ -0,0 +1,290 @@
+import { StateMachines, } from '@usestatemachines/sdk';
+import { z } from 'zod';
+import { createAnonymousApi, createAuthenticatedApi, createSdkFetch, retryBudgetMs, } from './api-internal.js';
+import { createProjectRepository } from './config/project.js';
+import { apiOriginFromEnvironment, productionOrigin, profileNameFromEnvironment, workspaceIdSchema, } from './context-types.js';
+import { createEnvironmentFiles } from './env-file.js';
+import { CliError } from './errors.js';
+import { parseAgent } from './generated/internal.js';
+import { retryPolicy } from './generated/retry.js';
+import { createAccounts } from './login.js';
+import { createPrograms } from './programs.js';
+export async function allWorkspaces(sdk) {
+    const result = [];
+    const seen = new Set();
+    let cursor = null;
+    do {
+        const page = await sdk.workspaces.list(cursor === null ? {} : { cursor });
+        result.push(...page.data);
+        cursor = page.nextCursor;
+        if (cursor !== null) {
+            if (seen.has(cursor)) {
+                throw new CliError('cli.invalid_response');
+            }
+            seen.add(cursor);
+        }
+    } while (cursor !== null);
+    return result;
+}
+export async function createContextSession(input) {
+    const { io, globals, presentation, version } = input;
+    const defaults = {
+        signal: io.signal,
+        deadline: null,
+    };
+    const environment = io.host.environment;
+    const agentName = input.agent?.name;
+    const agent = parseAgent(agentName === 'claude'
+        ? 'claude_code'
+        : agentName === 'codex'
+            ? 'codex_cli'
+            : agentName === 'gemini'
+                ? 'gemini_cli'
+                : agentName === 'github-copilot-cli'
+                    ? 'github-copilot'
+                    : agentName);
+    const userAgent = `statemachines-cli/${version}${agent === null ? '' : ` agent/${agent}`}`;
+    let lease = null;
+    const fetcher = async (resource, init) => {
+        lease ??= io.http({
+            http: environment.HTTP_PROXY ?? environment.http_proxy ?? null,
+            https: environment.HTTPS_PROXY ?? environment.https_proxy ?? null,
+            noProxy: environment.NO_PROXY ?? environment.no_proxy ?? null,
+        }, defaults);
+        const acquisition = lease;
+        let transport;
+        try {
+            transport = await acquisition;
+        }
+        catch {
+            if (lease === acquisition) {
+                lease = null;
+            }
+            throw new CliError('cli.network');
+        }
+        const request = new Request(resource, init);
+        const headers = new Headers([...request.headers]);
+        headers.set('user-agent', userAgent);
+        return transport.fetch(new Request(request, { headers, redirect: 'manual' }));
+    };
+    function sdk(origin, token, options = defaults) {
+        if (!/^[\x21-\x7e]+$/.test(token)) {
+            throw new CliError('cli.credentials_invalid');
+        }
+        return new StateMachines({
+            apiKey: token,
+            baseUrl: origin,
+            attemptTimeoutMs: retryBudgetMs + retryPolicy.maxInterval,
+            fetch: createSdkFetch({ io, fetch: fetcher, origin, options }),
+        });
+    }
+    const clients = {
+        anonymous: (origin) => createAnonymousApi({ io, fetch: fetcher, origin }),
+        authenticated: (origin, token) => createAuthenticatedApi({ io, fetch: fetcher, origin }, token),
+        async validateKey(origin, key, options) {
+            const me = await sdk(origin, key, options).me();
+            if (me.credential.kind !== 'api_key' || me.workspaceId === null) {
+                throw new CliError('cli.invalid_response');
+            }
+            const kind = z
+                .enum(['dashboard', 'cli_run', 'env_pull'])
+                .safeParse(me.credential.apiKeyKind);
+            if (!kind.success) {
+                throw new CliError('cli.invalid_response');
+            }
+            return {
+                id: me.credential.id,
+                workspaceId: workspaceIdSchema.parse(me.workspaceId),
+                kind: kind.data,
+                expiresAt: me.credential.expiresAt?.toISOString() ?? null,
+            };
+        },
+        async defaultWorkspace(origin, token, options) {
+            const workspaces = await allWorkspaces(sdk(origin, token, options));
+            const first = workspaces[0];
+            return workspaces.length === 1 && first !== undefined
+                ? workspaceIdSchema.parse(first.id)
+                : null;
+        },
+    };
+    const environmentFiles = createEnvironmentFiles(io);
+    const { accounts, authentication, programKeys } = createAccounts({
+        io,
+        version,
+        clients,
+        environmentFiles,
+        options: defaults,
+    });
+    const projects = createProjectRepository(io, defaults);
+    let publicContext;
+    async function bind(account, token, defaultWorkspace, options) {
+        const client = sdk(account.origin, token, options);
+        async function findWorkspace(value, effect = options) {
+            const api = effect === options ? client : sdk(account.origin, token, effect);
+            const workspaces = await allWorkspaces(api);
+            const exact = workspaces.find((workspace) => workspace.id === value);
+            const matches = exact === undefined
+                ? workspaces.filter((workspace) => workspace.name === value)
+                : [exact];
+            const match = matches[0];
+            if (matches.length !== 1 || match === undefined) {
+                throw new CliError('cli.invalid_arguments', {
+                    message: matches.length > 1
+                        ? 'More than one workspace has that name. Use its ID.'
+                        : 'No accessible workspace matches that ID or name.',
+                });
+            }
+            return { id: workspaceIdSchema.parse(match.id), name: match.name };
+        }
+        const context = {
+            ...publicContext,
+            account,
+            sdk: client,
+            internal: createAuthenticatedApi({ io, fetch: fetcher, origin: account.origin, options }, token),
+            findWorkspace,
+            forWorkspace(workspace) {
+                return {
+                    ...context,
+                    workspace,
+                    programs: createPrograms({
+                        io,
+                        origin: account.origin,
+                        workspace: workspace.id,
+                        files: environmentFiles,
+                        credential: account.kind === 'workspace-key'
+                            ? { kind: 'workspace-key', key: token }
+                            : { kind: 'cli-token', account, keys: programKeys },
+                    }),
+                };
+            },
+            async resolveWorkspace(effect = options) {
+                const link = await createProjectRepository(io, effect).read();
+                if (link !== null &&
+                    account.kind === 'cli-token' &&
+                    link.organizationId !== account.organizationId) {
+                    throw new CliError('cli.organization_mismatch');
+                }
+                const selection = globals.workspace !== null
+                    ? { value: globals.workspace, source: 'flag' }
+                    : environment.STATEMACHINES_WORKSPACE !== undefined
+                        ? {
+                            value: environment.STATEMACHINES_WORKSPACE,
+                            source: 'environment',
+                        }
+                        : link !== null
+                            ? { value: link.workspaceId, source: 'link' }
+                            : defaultWorkspace !== null
+                                ? { value: defaultWorkspace, source: 'default' }
+                                : null;
+                let named;
+                if (account.kind === 'workspace-key') {
+                    named = await findWorkspace(account.workspaceId, effect);
+                    const requested = [
+                        globals.workspace,
+                        environment.STATEMACHINES_WORKSPACE,
+                        link?.workspaceId,
+                    ].filter((value) => value !== null && value !== undefined);
+                    if (requested.some((value) => value !== named.id && value !== named.name)) {
+                        throw new CliError('cli.workspace_mismatch');
+                    }
+                }
+                else {
+                    if (selection === null) {
+                        return null;
+                    }
+                    try {
+                        named = await findWorkspace(selection.value, effect);
+                    }
+                    catch (error) {
+                        if ((selection.source === 'default' || selection.source === 'link') &&
+                            error instanceof CliError &&
+                            error.document.error.code === 'cli.invalid_arguments') {
+                            throw new CliError('cli.not_linked', {
+                                message: selection.source === 'default'
+                                    ? 'The saved default workspace is no longer accessible. Choose another workspace.'
+                                    : 'The linked workspace is no longer accessible. Link this repository to another workspace.',
+                                next: [
+                                    {
+                                        command: selection.source === 'default'
+                                            ? 'statemachines workspaces use <id>'
+                                            : 'statemachines link --force --workspace <id>',
+                                        reason: 'Choose an accessible workspace.',
+                                    },
+                                ],
+                            });
+                        }
+                        throw error;
+                    }
+                }
+                return {
+                    ...named,
+                    source: selection?.source ?? 'credential',
+                    assertMember(actualWorkspaceId) {
+                        if (actualWorkspaceId !== named.id) {
+                            throw new CliError('cli.workspace_mismatch');
+                        }
+                    },
+                };
+            },
+        };
+        return context;
+    }
+    async function resolveAccount(options = defaults) {
+        const origin = apiOriginFromEnvironment(environment.STATEMACHINES_BASE_URL);
+        if (environment.STATEMACHINES_API_KEY !== undefined) {
+            const token = environment.STATEMACHINES_API_KEY;
+            if (!/^[\x21-\x7e]+$/.test(token)) {
+                throw new CliError('cli.invalid_environment_credential');
+            }
+            const selectedOrigin = origin ?? productionOrigin;
+            const me = await sdk(selectedOrigin, token, options).me();
+            if (me.credential.kind !== 'api_key' || me.workspaceId === null) {
+                throw new CliError('cli.invalid_environment_credential');
+            }
+            return bind({
+                kind: 'workspace-key',
+                origin: selectedOrigin,
+                workspaceId: workspaceIdSchema.parse(me.workspaceId),
+                source: 'environment',
+            }, token, null, options);
+        }
+        const profile = globals.profile ??
+            profileNameFromEnvironment(environment.STATEMACHINES_PROFILE);
+        return authentication.withCredential({ profile, expectedOrigin: origin }, ({ account, token, defaultWorkspace }) => bind(account, token, defaultWorkspace, options), options);
+    }
+    publicContext = {
+        io,
+        globals,
+        presentation,
+        accounts,
+        projects,
+        version,
+        anonymousApi: clients.anonymous,
+        resolveAccount,
+    };
+    return {
+        presentation,
+        contexts: {
+            public: async () => publicContext,
+            account: () => resolveAccount(),
+            workspace: async () => {
+                const account = await resolveAccount();
+                const workspace = await account.resolveWorkspace();
+                if (workspace === null) {
+                    throw new CliError('cli.not_linked');
+                }
+                return account.forWorkspace(workspace);
+            },
+        },
+        async close() {
+            const closing = lease;
+            lease = null;
+            if (closing !== null) {
+                try {
+                    await (await closing).close();
+                }
+                catch { }
+            }
+        },
+    };
+}

package/dist/credentials/sealing.d.ts

@@ -0,0 +1,10 @@
+import type { Io } from '../io-types.js';
+export declare function createLoginKey(io: Pick<Io, 'randomBytes'>): {
+    privateKey: string;
+    publicKey: string;
+};
+export declare function unsealLoginToken(input: {
+    envelope: unknown;
+    privateKey: string;
+    loginId: string;
+}): string;

package/dist/credentials/sealing.js

@@ -0,0 +1,72 @@
+import { createDecipheriv, createPrivateKey, createPublicKey, diffieHellman, hkdfSync, } from 'node:crypto';
+import { z } from 'zod';
+import { CliError } from '../errors.js';
+function bytes(value, length) {
+    if (!/^[A-Za-z0-9_-]+$/.test(value)) {
+        throw new CliError('cli.invalid_response');
+    }
+    const decoded = Buffer.from(value, 'base64url');
+    if (decoded.toString('base64url') !== value ||
+        (length !== null && decoded.length !== length)) {
+        throw new CliError('cli.invalid_response');
+    }
+    return decoded;
+}
+function privateKey(value) {
+    return createPrivateKey({
+        key: Buffer.concat([
+            Buffer.from('302e020100300506032b656e04220420', 'hex'),
+            bytes(value, 32),
+        ]),
+        format: 'der',
+        type: 'pkcs8',
+    });
+}
+export function createLoginKey(io) {
+    const secret = Buffer.from(io.randomBytes(32)).toString('base64url');
+    const exported = createPublicKey(privateKey(secret)).export({
+        format: 'jwk',
+    });
+    const publicKey = z.object({ x: z.string() }).parse(exported).x;
+    return { privateKey: secret, publicKey };
+}
+const envelopeSchema = z.strictObject({
+    v: z.literal(1),
+    serverPublicKey: z.string(),
+    nonce: z.string(),
+    ciphertext: z.string(),
+    tag: z.string(),
+});
+export function unsealLoginToken(input) {
+    try {
+        const envelope = envelopeSchema.parse(input.envelope);
+        bytes(envelope.serverPublicKey, 32);
+        const shared = diffieHellman({
+            privateKey: privateKey(input.privateKey),
+            publicKey: createPublicKey({
+                format: 'jwk',
+                key: { kty: 'OKP', crv: 'X25519', x: envelope.serverPublicKey },
+            }),
+        });
+        if (shared.every((byte) => byte === 0)) {
+            throw new CliError('cli.invalid_response');
+        }
+        const key = Buffer.from(hkdfSync('sha256', shared, input.loginId, 'statemachines-cli-login-v1', 32));
+        const decipher = createDecipheriv('aes-256-gcm', key, bytes(envelope.nonce, 12));
+        decipher.setAAD(Buffer.from(input.loginId));
+        decipher.setAuthTag(bytes(envelope.tag, 16));
+        const token = Buffer.concat([
+            decipher.update(bytes(envelope.ciphertext, null)),
+            decipher.final(),
+        ]);
+        const value = token.toString('utf8');
+        if (!/^smcli_[A-Za-z0-9_-]{43}$/.test(value) ||
+            !Buffer.from(value).equals(token)) {
+            throw new CliError('cli.invalid_response');
+        }
+        return value;
+    }
+    catch {
+        throw new CliError('cli.invalid_response');
+    }
+}

package/dist/credentials/store.d.ts

@@ -0,0 +1,17 @@
+import { type SecretRef } from '../config/schema.js';
+import { type ApiOrigin } from '../context-types.js';
+import type { EffectOptions, Io } from '../io-types.js';
+export declare const credentialCopy: {
+    fallback: string;
+    windowsFallback: string;
+};
+export declare class CredentialStore {
+    #private;
+    constructor(io: Io);
+    select(): SecretRef['store'];
+    fallback(reference: SecretRef, error: unknown): Promise<SecretRef>;
+    reference(store: SecretRef['store'], origin: ApiOrigin, entry: string): SecretRef;
+    get(reference: SecretRef, options: EffectOptions): Promise<string | null>;
+    set(reference: SecretRef, value: string, options: EffectOptions): Promise<void>;
+    delete(reference: SecretRef, options: EffectOptions): Promise<void>;
+}

package/dist/credentials/store.js

@@ -0,0 +1,156 @@
+import { join } from 'node:path';
+import { z } from 'zod';
+import { parseVersioned } from '../config/schema.js';
+import { apiOriginSchema } from '../context-types.js';
+import { CliError, failedWith, keychainFailures } from '../errors.js';
+const credentialsSchema = z
+    .strictObject({
+    version: z.literal(1),
+    entries: z.array(z.strictObject({
+        origin: apiOriginSchema,
+        entry: z.string().min(1),
+        value: z.string(),
+    })),
+})
+    .superRefine((value, context) => {
+    const keys = value.entries.map((entry) => JSON.stringify([entry.origin, entry.entry]));
+    if (new Set(keys).size !== keys.length) {
+        context.addIssue({ code: 'custom', message: 'Duplicate credential.' });
+    }
+});
+export const credentialCopy = {
+    fallback: 'The keychain is unavailable. Credentials are saved in a protected file.\n',
+    windowsFallback: 'The keychain is unavailable. Credentials are saved in your application data directory, where your user account and administrators have access.\n',
+};
+export class CredentialStore {
+    #io;
+    #path;
+    #forced;
+    #warned = false;
+    constructor(io) {
+        this.#io = io;
+        this.#path = join(io.host.configHome, 'credentials.json');
+        const selected = io.host.environment.STATEMACHINES_CREDENTIAL_STORE;
+        if (selected !== undefined &&
+            selected !== 'file' &&
+            selected !== 'keychain') {
+            throw new CliError('cli.invalid_arguments');
+        }
+        this.#forced = selected ?? null;
+    }
+    select() {
+        return this.#forced ?? 'keychain';
+    }
+    async fallback(reference, error) {
+        if (reference.store !== 'keychain' ||
+            this.#forced !== null ||
+            !failedWith(error, keychainFailures)) {
+            throw error;
+        }
+        if (!this.#warned) {
+            this.#warned = true;
+            await this.#io.stderr.write(this.#io.host.platform === 'win32'
+                ? credentialCopy.windowsFallback
+                : credentialCopy.fallback);
+        }
+        return { ...reference, store: 'file' };
+    }
+    reference(store, origin, entry) {
+        return { store, origin, entry };
+    }
+    #check(reference) {
+        if (this.#forced !== null && this.#forced !== reference.store) {
+            throw new CliError('cli.credential_store_mismatch', {
+                next: [
+                    {
+                        command: `STATEMACHINES_CREDENTIAL_STORE=${reference.store} statemachines doctor`,
+                        reason: 'Use the store that holds this credential.',
+                    },
+                ],
+            });
+        }
+    }
+    #failed(result) {
+        if (result.kind === 'timed-out') {
+            throw new CliError('cli.keychain_timeout');
+        }
+        if (result.kind === 'module-unavailable') {
+            throw new CliError('cli.keychain_unavailable');
+        }
+        throw new CliError('cli.keychain_denied');
+    }
+    async #readFile(options) {
+        if (this.#io.host.platform !== 'win32') {
+            for (const path of [this.#io.host.configHome, this.#path]) {
+                const entry = await this.#io.files.inspect(path, options);
+                if (entry.kind !== 'missing' && (entry.mode & 0o077) !== 0) {
+                    throw new CliError('cli.config_io');
+                }
+            }
+        }
+        const text = await this.#io.files.read(this.#path, options);
+        return text === null
+            ? { version: 1, entries: [] }
+            : parseVersioned(text, credentialsSchema);
+    }
+    async get(reference, options) {
+        this.#check(reference);
+        if (reference.store === 'file') {
+            const document = await this.#readFile(options);
+            return (document.entries.find((entry) => entry.origin === reference.origin &&
+                entry.entry === reference.entry)?.value ?? null);
+        }
+        const result = await this.#io.nativeKeychain.executeInChild({
+            kind: 'get',
+            service: `statemachines:${reference.origin}`,
+            account: reference.entry,
+        }, options);
+        if (result.kind === 'value') {
+            return result.value;
+        }
+        if (result.kind === 'missing') {
+            return null;
+        }
+        return this.#failed(result);
+    }
+    async set(reference, value, options) {
+        this.#check(reference);
+        if (reference.store === 'file') {
+            const document = await this.#readFile(options);
+            document.entries = document.entries.filter((entry) => entry.origin !== reference.origin || entry.entry !== reference.entry);
+            document.entries.push({
+                origin: reference.origin,
+                entry: reference.entry,
+                value,
+            });
+            await this.#io.files.atomicWrite(this.#path, JSON.stringify(document), 'private', options);
+            return;
+        }
+        const result = await this.#io.nativeKeychain.executeInChild({
+            kind: 'set',
+            service: `statemachines:${reference.origin}`,
+            account: reference.entry,
+            value,
+        }, options);
+        if (result.kind !== 'written') {
+            this.#failed(result);
+        }
+    }
+    async delete(reference, options) {
+        this.#check(reference);
+        if (reference.store === 'file') {
+            const document = await this.#readFile(options);
+            document.entries = document.entries.filter((entry) => entry.origin !== reference.origin || entry.entry !== reference.entry);
+            await this.#io.files.atomicWrite(this.#path, JSON.stringify(document), 'private', options);
+            return;
+        }
+        const result = await this.#io.nativeKeychain.executeInChild({
+            kind: 'delete',
+            service: `statemachines:${reference.origin}`,
+            account: reference.entry,
+        }, options);
+        if (result.kind !== 'deleted' && result.kind !== 'missing') {
+            this.#failed(result);
+        }
+    }
+}

package/dist/doctor.d.ts

@@ -0,0 +1,4 @@
+import type { z } from 'zod';
+import type { doctorInputSchema, doctorResultSchema } from './commands/doctor/command.js';
+import { type PublicContext } from './context-types.js';
+export declare function runDoctor(context: PublicContext, input: z.infer<typeof doctorInputSchema>): Promise<z.infer<typeof doctorResultSchema>>;