@usestatemachines/cli 0.0.0-stage → 0.1.0

package/dist/keys.js

@@ -0,0 +1,691 @@
+import path from 'node:path';
+import { StateMachinesError } from '@usestatemachines/sdk';
+import { checkEffect } from './api-internal.js';
+import { CliError } from './errors.js';
+import { keyPolicy, parseCreateKey } from './generated/internal.js';
+const RUN_KEY_ROTATION_MS = 7 * 24 * 60 * 60 * 1_000;
+function sameRef(left, right) {
+    return (left.store === right.store &&
+        left.origin === right.origin &&
+        left.entry === right.entry);
+}
+function binding(state, issuer) {
+    const profile = state.profiles.find((item) => item.name === issuer.profile);
+    return profile?.generation === issuer.generation &&
+        profile.session?.origin === issuer.origin &&
+        profile.session.tokenId === issuer.tokenId &&
+        sameRef(profile.session.token, issuer.token)
+        ? profile.session
+        : null;
+}
+function selected(state, account) {
+    const profile = state.profiles.find((item) => item.name === account.profile);
+    if (profile?.session === undefined ||
+        profile.session === null ||
+        profile.session.origin !== account.origin ||
+        profile.session.tokenId !== account.tokenId) {
+        throw new CliError('cli.profile_changed');
+    }
+    return {
+        profile: profile.name,
+        generation: profile.generation,
+        origin: profile.session.origin,
+        tokenId: profile.session.tokenId,
+        token: profile.session.token,
+    };
+}
+function backgroundFailure(error) {
+    return (error instanceof CliError &&
+        [
+            'cli.config_io',
+            'cli.keychain_denied',
+            'cli.keychain_timeout',
+            'cli.keychain_unavailable',
+            'cli.credential_store_mismatch',
+            'cli.git',
+        ].includes(error.document.error.code));
+}
+function usableSecret(secret) {
+    return (secret.length > 0 &&
+        !secret.startsWith('smcli_') &&
+        Array.from(secret).every((character) => character.charCodeAt(0) > 32 && character.charCodeAt(0) !== 127));
+}
+export class KeyOwner {
+    #input;
+    constructor(input) {
+        this.#input = input;
+    }
+    #id() {
+        return Buffer.from(this.#input.io.randomBytes(24)).toString('base64url');
+    }
+    references(state) {
+        return [
+            ...state.keyOperations.flatMap((operation) => [
+                operation.issuer.token,
+                operation.secret,
+            ]),
+            ...state.keyRevocations.flatMap((job) => [
+                job.token,
+                ...(job.secret === null ? [] : [job.secret]),
+            ]),
+            ...state.environments.map((environment) => environment.issuer.token),
+        ];
+    }
+    #queueRevocation(state, issuer, keyId, secret) {
+        if (!state.keyRevocations.some((job) => job.origin === issuer.origin &&
+            job.keyId === keyId &&
+            job.tokenId === issuer.tokenId)) {
+            state.keyRevocations.push({
+                id: this.#id(),
+                keyId,
+                origin: issuer.origin,
+                tokenId: issuer.tokenId,
+                token: issuer.token,
+                secret,
+            });
+        }
+    }
+    #queueIssuerCleanup(state, token) {
+        if (!state.profiles.some((profile) => profile.session !== null && sameRef(profile.session.token, token))) {
+            this.#input.queueCleanup(state, token);
+        }
+    }
+    #retire(state, operation) {
+        if (operation.phase === 'staged') {
+            this.#queueRevocation(state, operation.issuer, operation.keyId, operation.secret);
+        }
+        state.keyOperations = state.keyOperations.filter((item) => item.id !== operation.id);
+        this.#input.queueCleanup(state, operation.secret);
+    }
+    retireSession(state, session) {
+        for (const operation of [...state.keyOperations]) {
+            if (operation.phase === 'creating' &&
+                operation.issuer.origin === session.origin &&
+                operation.issuer.tokenId === session.tokenId) {
+                this.#retire(state, operation);
+            }
+        }
+        for (const key of session.runKeys) {
+            this.#queueRevocation(state, session, key.id, key.secret);
+            this.#input.queueCleanup(state, key.secret);
+        }
+        for (const environment of state.environments.filter((item) => item.issuer.origin === session.origin &&
+            item.issuer.tokenId === session.tokenId)) {
+            this.#queueRevocation(state, environment.issuer, environment.keyId, null);
+        }
+        state.environments = state.environments.filter((item) => item.issuer.origin !== session.origin ||
+            item.issuer.tokenId !== session.tokenId);
+    }
+    cascade(state, issuer) {
+        for (const operation of [...state.keyOperations]) {
+            if (operation.issuer.origin === issuer.origin &&
+                operation.issuer.tokenId === issuer.tokenId) {
+                this.#input.queueCleanup(state, operation.secret);
+                this.#input.queueCleanup(state, operation.issuer.token);
+                state.keyOperations = state.keyOperations.filter((item) => item.id !== operation.id);
+            }
+        }
+        for (const job of [...state.keyRevocations]) {
+            if (job.origin === issuer.origin && job.tokenId === issuer.tokenId) {
+                this.#input.queueCleanup(state, job.token);
+                if (job.secret !== null) {
+                    this.#input.queueCleanup(state, job.secret);
+                }
+                state.keyRevocations = state.keyRevocations.filter((item) => item.id !== job.id);
+            }
+        }
+        for (const environment of [...state.environments]) {
+            if (environment.issuer.origin === issuer.origin &&
+                environment.issuer.tokenId === issuer.tokenId) {
+                this.#input.queueCleanup(state, environment.issuer.token);
+                state.environments = state.environments.filter((item) => item !== environment);
+            }
+        }
+    }
+    async #dead(operation, options) {
+        return (operation.owner === null ||
+            (operation.owner.hostname === this.#input.io.host.owner.hostname &&
+                (await this.#input.io.child.liveness(operation.owner, options)) ===
+                    'dead'));
+    }
+    async #release(operation, options) {
+        checkEffect(this.#input.io, options);
+        await this.#input.transaction(options, async (transaction) => {
+            const current = transaction.state.keyOperations.find((item) => item.id === operation.id &&
+                item.owner?.nonce === operation.owner?.nonce);
+            if (current !== undefined) {
+                current.owner = null;
+                await transaction.save();
+            }
+        });
+    }
+    async #secret(reference, options) {
+        const secret = await this.#input.store.get(reference, options);
+        if (secret !== null && !usableSecret(secret)) {
+            throw new CliError('cli.credentials_invalid');
+        }
+        return secret;
+    }
+    async #install(transaction, operation, secret, recover) {
+        const { state, options } = transaction;
+        const session = binding(state, operation.issuer);
+        if (session === null) {
+            this.#retire(state, operation);
+            await transaction.save();
+            return false;
+        }
+        if (operation.target.kind === 'run') {
+            const previous = session.runKeys.find((key) => key.workspaceId === operation.workspaceId);
+            if (previous !== undefined && previous.id !== operation.keyId) {
+                this.#input.queueCleanup(state, previous.secret);
+            }
+            session.runKeys = session.runKeys.filter((key) => key.workspaceId !== operation.workspaceId);
+            session.runKeys.push({
+                id: operation.keyId,
+                workspaceId: operation.workspaceId,
+                expiresAt: operation.expiresAt,
+                secret: operation.secret,
+            });
+        }
+        else {
+            const file = operation.target.file;
+            const credential = { key: secret, origin: operation.issuer.origin };
+            const commit = async () => {
+                const previous = state.environments.find((item) => item.repositoryRoot === file.repositoryRoot &&
+                    item.issuer.origin === operation.issuer.origin &&
+                    item.workspaceId === operation.workspaceId);
+                if (previous !== undefined && previous.keyId !== operation.keyId) {
+                    this.#queueRevocation(state, previous.issuer, previous.keyId, null);
+                    this.#queueIssuerCleanup(state, previous.issuer.token);
+                }
+                state.environments = state.environments.filter((item) => item !== previous);
+                state.environments.push({
+                    repositoryRoot: file.repositoryRoot,
+                    path: file.path,
+                    workspaceId: operation.workspaceId,
+                    keyId: operation.keyId,
+                    expiresAt: operation.expiresAt,
+                    issuer: operation.issuer,
+                });
+                this.#input.queueCleanup(state, operation.secret);
+                state.keyOperations = state.keyOperations.filter((item) => item.id !== operation.id);
+                await transaction.save();
+            };
+            if (recover) {
+                try {
+                    return await this.#input.files.commitIfMatches(file, credential, options, commit);
+                }
+                catch (error) {
+                    checkEffect(this.#input.io, options);
+                    if (error instanceof CliError &&
+                        error.document.error.code === 'cli.config_locked') {
+                        return false;
+                    }
+                    throw error;
+                }
+            }
+            await this.#input.files.write(file, credential, options, commit);
+            return true;
+        }
+        state.keyOperations = state.keyOperations.filter((item) => item.id !== operation.id);
+        await transaction.save();
+        return true;
+    }
+    async recover(transaction) {
+        for (const operation of [...transaction.state.keyOperations]) {
+            if (operation.phase === 'creating' &&
+                binding(transaction.state, operation.issuer) === null &&
+                transaction.state.revocations.some((job) => job.origin === operation.issuer.origin &&
+                    job.tokenId === operation.issuer.tokenId)) {
+                this.#retire(transaction.state, operation);
+                await transaction.save();
+                continue;
+            }
+            if (!(await this.#dead(operation, transaction.options))) {
+                continue;
+            }
+            if (operation.phase !== 'staged') {
+                continue;
+            }
+            try {
+                const secret = await this.#secret(operation.secret, transaction.options);
+                if (secret === null ||
+                    Date.parse(operation.expiresAt) <= this.#input.io.now() ||
+                    binding(transaction.state, operation.issuer) === null) {
+                    this.#retire(transaction.state, operation);
+                    await transaction.save();
+                }
+                else {
+                    await this.#install(transaction, operation, secret, true);
+                }
+            }
+            catch (error) {
+                checkEffect(this.#input.io, transaction.options);
+                if (error instanceof CliError &&
+                    [
+                        'cli.env_changed',
+                        'cli.env_path_refused',
+                        'cli.env_invalid',
+                    ].includes(error.document.error.code)) {
+                    this.#retire(transaction.state, operation);
+                    await transaction.save();
+                }
+                else if (!backgroundFailure(error)) {
+                    throw error;
+                }
+            }
+        }
+    }
+    async reconcile(options, call = () => ({
+        signal: options.signal,
+        deadline: Math.min(options.deadline ?? Infinity, this.#input.io.now() + 5_000),
+    })) {
+        const report = {
+            revoked: [],
+            pending: [],
+            unconfirmed: [],
+        };
+        const operations = await this.#input.transaction(options, async ({ state }) => [...state.keyOperations]);
+        for (const operation of operations) {
+            const effect = call();
+            if (effect === null ||
+                operation.phase !== 'creating' ||
+                !(await this.#dead(operation, options))) {
+                continue;
+            }
+            const claimed = await this.#input.transaction(options, async (transaction) => {
+                const current = transaction.state.keyOperations.find((item) => item.id === operation.id);
+                if (current === undefined ||
+                    !(await this.#dead(current, options)) ||
+                    binding(transaction.state, current.issuer) === null) {
+                    return null;
+                }
+                current.owner = { ...this.#input.io.host.owner, nonce: this.#id() };
+                await transaction.save();
+                return current;
+            });
+            if (claimed === null) {
+                continue;
+            }
+            try {
+                const credential = await this.#input.readBackgroundToken(claimed.issuer.token, options, effect);
+                if (credential.kind === 'ready') {
+                    await this.#execute(claimed, effect, true);
+                }
+            }
+            catch (error) {
+                checkEffect(this.#input.io, options);
+                if (!(error instanceof StateMachinesError ||
+                    backgroundFailure(error) ||
+                    (error instanceof CliError &&
+                        error.document.error.code === 'cli.network'))) {
+                    throw error;
+                }
+            }
+            finally {
+                await this.#release(claimed, options);
+            }
+        }
+        const jobs = await this.#input.transaction(options, async ({ state }) => [
+            ...state.keyRevocations,
+        ]);
+        for (const job of jobs) {
+            checkEffect(this.#input.io, options);
+            const read = call();
+            const credential = read === null
+                ? { kind: 'pending' }
+                : await this.#input.readBackgroundToken(job.token, options, read);
+            if (credential.kind === 'pending') {
+                report.pending.push(job.id);
+                continue;
+            }
+            let outcome = credential.kind === 'ready' ? 'revoked' : 'unconfirmed';
+            if (credential.kind === 'ready') {
+                const effect = call();
+                if (effect === null) {
+                    report.pending.push(job.id);
+                    continue;
+                }
+                try {
+                    await this.#input.clients
+                        .authenticated(job.origin, credential.token)
+                        .revokeKey(job.keyId, effect);
+                }
+                catch (error) {
+                    checkEffect(this.#input.io, options);
+                    if (!(error instanceof StateMachinesError &&
+                        (error.status === 404 ||
+                            (error.status === 401 && error.code === 'unauthenticated')))) {
+                        report.pending.push(job.id);
+                        continue;
+                    }
+                    outcome = error.status === 404 ? 'revoked' : 'unconfirmed';
+                }
+            }
+            await this.#input.transaction(options, async (transaction) => {
+                const current = transaction.state.keyRevocations.find((item) => item.id === job.id && sameRef(item.token, job.token));
+                if (current === undefined) {
+                    return;
+                }
+                transaction.state.keyRevocations =
+                    transaction.state.keyRevocations.filter((item) => item !== current);
+                this.#queueIssuerCleanup(transaction.state, current.token);
+                if (current.secret !== null) {
+                    this.#input.queueCleanup(transaction.state, current.secret);
+                }
+                await transaction.save();
+                await this.#input.cleanup(transaction);
+            });
+            report[outcome].push(outcome === 'revoked' ? job.id : job.tokenId);
+        }
+        report.pending.push(...(await this.#input.transaction(options, async ({ state }) => state.keyOperations.map((operation) => operation.id))));
+        return report;
+    }
+    async #claim(input, options) {
+        const until = Math.min(options.deadline ?? Infinity, this.#input.io.now() + 10_000);
+        while (true) {
+            checkEffect(this.#input.io, options);
+            const result = await this.#input.transaction(options, async (transaction) => {
+                const { state } = transaction;
+                const issuer = selected(state, input.account);
+                const session = binding(state, issuer);
+                if (session === null) {
+                    throw new CliError('cli.profile_changed');
+                }
+                if (input.target.kind === 'run') {
+                    const current = session.runKeys.find((key) => key.workspaceId === input.workspace);
+                    if ((current?.id ?? null) !== (input.expected?.id ?? null)) {
+                        return 'retry';
+                    }
+                }
+                const target = input.target;
+                const conflict = state.keyOperations.find((operation) => target.kind === 'run'
+                    ? operation.target.kind === 'run' &&
+                        operation.issuer.origin === issuer.origin &&
+                        operation.issuer.tokenId === issuer.tokenId &&
+                        operation.workspaceId === input.workspace
+                    : operation.target.kind === 'environment' &&
+                        (operation.target.file.path === target.file.path ||
+                            (operation.target.file.repositoryRoot ===
+                                target.file.repositoryRoot &&
+                                operation.issuer.origin === issuer.origin &&
+                                operation.workspaceId === input.workspace)));
+                if (conflict !== undefined) {
+                    if (!(await this.#dead(conflict, options))) {
+                        return 'busy';
+                    }
+                    if (binding(state, conflict.issuer) === null ||
+                        conflict.issuer.tokenId !== issuer.tokenId ||
+                        (conflict.phase === 'staged' &&
+                            Date.parse(conflict.expiresAt) <= this.#input.io.now()) ||
+                        (target.kind === 'environment' &&
+                            conflict.target.kind === 'environment' &&
+                            conflict.target.file.path !== target.file.path)) {
+                        if (conflict.phase === 'creating') {
+                            return 'busy';
+                        }
+                        this.#retire(state, conflict);
+                    }
+                    else {
+                        conflict.owner = {
+                            ...this.#input.io.host.owner,
+                            nonce: this.#id(),
+                        };
+                        if (target.kind === 'environment') {
+                            conflict.target = target;
+                        }
+                        await transaction.save();
+                        return conflict;
+                    }
+                }
+                const id = this.#id();
+                const prefix = target.kind === 'run' ? 'CLI run on ' : 'env pull: ';
+                const suffix = target.kind === 'run'
+                    ? this.#input.io.host.owner.hostname
+                    : `${(this.#input.io.host.platform === 'win32' ? path.win32 : path.posix).basename(target.file.repositoryRoot)} on ${this.#input.io.host.owner.hostname}`;
+                const operation = {
+                    phase: 'creating',
+                    id,
+                    owner: { ...this.#input.io.host.owner, nonce: this.#id() },
+                    issuer,
+                    workspaceId: input.workspace,
+                    target,
+                    idempotencyKey: this.#id(),
+                    request: parseCreateKey({
+                        workspaceId: input.workspace,
+                        name: `${prefix}${suffix}`.slice(0, keyPolicy.maxNameLength ?? undefined),
+                        permissions: [...keyPolicy.permissions],
+                        kind: target.kind === 'run' ? 'cli_run' : 'env_pull',
+                    }),
+                    secret: this.#input.store.reference(issuer.token.store, issuer.origin, `key:${id}`),
+                };
+                state.keyOperations.push(operation);
+                await transaction.save();
+                return operation;
+            });
+            if (result !== 'busy') {
+                return result;
+            }
+            if (this.#input.io.now() >= until) {
+                throw new CliError('cli.config_locked');
+            }
+            await this.#input.io.sleep(Math.min(50, until - this.#input.io.now()), options);
+        }
+    }
+    async #execute(operation, options, recover = false) {
+        let candidate = operation;
+        if (candidate.phase === 'creating') {
+            const token = await this.#input.readToken(candidate.issuer.token, options);
+            if (token === null) {
+                throw new CliError('cli.credentials_invalid');
+            }
+            const result = await this.#input.clients
+                .authenticated(candidate.issuer.origin, token)
+                .createKey(candidate.request, candidate.idempotencyKey, options);
+            const expiresAt = result.apiKey.expiresAt;
+            if (result.apiKey.workspaceId !== candidate.workspaceId ||
+                result.apiKey.kind !== candidate.request.kind ||
+                expiresAt === null ||
+                !Number.isFinite(Date.parse(expiresAt)) ||
+                Date.parse(expiresAt) <= this.#input.io.now()) {
+                throw new CliError('cli.invalid_response');
+            }
+            candidate = {
+                ...candidate,
+                phase: 'staged',
+                keyId: result.apiKey.id,
+                expiresAt,
+            };
+            const staged = candidate;
+            const installed = await this.#input.transaction(options, async (transaction) => {
+                const current = transaction.state.keyOperations.find((item) => item.id === staged.id &&
+                    item.owner?.nonce === staged.owner?.nonce);
+                if (current === undefined) {
+                    throw new CliError('cli.profile_changed');
+                }
+                transaction.state.keyOperations = transaction.state.keyOperations.map((item) => (item === current ? staged : item));
+                await transaction.save();
+                if (binding(transaction.state, staged.issuer) === null ||
+                    result.kind === 'replayed-without-secret') {
+                    this.#retire(transaction.state, staged);
+                    await transaction.save();
+                    return false;
+                }
+                if (!usableSecret(result.secret)) {
+                    this.#retire(transaction.state, staged);
+                    await transaction.save();
+                    throw new CliError('cli.invalid_response');
+                }
+                await this.#input.store.set(staged.secret, result.secret, options);
+                if ((await this.#secret(staged.secret, options)) !== result.secret) {
+                    throw new CliError('cli.credentials_invalid');
+                }
+                return true;
+            });
+            if (!installed) {
+                return 'retry';
+            }
+        }
+        const staged = candidate;
+        const secret = await this.#secret(staged.secret, options);
+        if (secret === null) {
+            await this.#input.transaction(options, async (transaction) => {
+                const current = transaction.state.keyOperations.find((item) => item.id === staged.id && item.owner?.nonce === staged.owner?.nonce);
+                if (current !== undefined) {
+                    this.#retire(transaction.state, current);
+                    await transaction.save();
+                }
+            });
+            return 'retry';
+        }
+        const stored = secret;
+        await this.#input.transaction(options, async (transaction) => {
+            const current = transaction.state.keyOperations.find((item) => item.id === staged.id && item.owner?.nonce === staged.owner?.nonce);
+            if (current?.phase !== 'staged' ||
+                binding(transaction.state, current.issuer) === null) {
+                if (current !== undefined) {
+                    this.#retire(transaction.state, current);
+                    await transaction.save();
+                }
+                throw new CliError('cli.profile_changed');
+            }
+            if ((await this.#secret(current.secret, options)) !== stored) {
+                throw new CliError('cli.credentials_invalid');
+            }
+            try {
+                await this.#install(transaction, current, stored, recover);
+            }
+            catch (error) {
+                checkEffect(this.#input.io, options);
+                if (error instanceof CliError &&
+                    [
+                        'cli.env_changed',
+                        'cli.env_path_refused',
+                        'cli.env_invalid',
+                    ].includes(error.document.error.code)) {
+                    this.#retire(transaction.state, current);
+                    await transaction.save();
+                }
+                throw error;
+            }
+            await this.#input.cleanup(transaction);
+        });
+        return staged;
+    }
+    async withRunKey(input, options) {
+        await this.reconcile(options);
+        let replays = 0;
+        let installedId = null;
+        while (true) {
+            const saved = await this.#input.transaction(options, async ({ state }) => {
+                const issuer = selected(state, input.account);
+                const session = binding(state, issuer);
+                if (session === null) {
+                    throw new CliError('cli.profile_changed');
+                }
+                return {
+                    issuer,
+                    tokenExpiresAt: Date.parse(session.expiresAt),
+                    key: session.runKeys.find((key) => key.workspaceId === input.workspace) ?? null,
+                };
+            });
+            if (saved.key !== null) {
+                const secret = await this.#secret(saved.key.secret, options);
+                if (secret !== null) {
+                    let reusable = false;
+                    try {
+                        const actual = await this.#input.clients.validateKey(saved.issuer.origin, secret, options);
+                        if (actual.id !== saved.key.id ||
+                            actual.workspaceId !== input.workspace ||
+                            actual.kind !== 'cli_run' ||
+                            actual.expiresAt === null ||
+                            !Number.isFinite(Date.parse(actual.expiresAt))) {
+                            throw new CliError('cli.invalid_response');
+                        }
+                        const expiresAt = Date.parse(actual.expiresAt);
+                        const now = this.#input.io.now();
+                        reusable =
+                            expiresAt > now &&
+                                (actual.id === installedId ||
+                                    expiresAt >=
+                                        Math.min(saved.tokenExpiresAt, now + RUN_KEY_ROTATION_MS));
+                    }
+                    catch (error) {
+                        checkEffect(this.#input.io, options);
+                        if (!(error instanceof StateMachinesError && error.status === 401) ||
+                            saved.key.id === installedId) {
+                            throw error;
+                        }
+                    }
+                    if (reusable) {
+                        const current = await this.#input.transaction(options, async ({ state }) => binding(state, saved.issuer)?.runKeys.some((key) => key.id === saved.key?.id &&
+                            sameRef(key.secret, saved.key.secret)) ?? false);
+                        if (current) {
+                            checkEffect(this.#input.io, options);
+                            return input.consume(secret);
+                        }
+                        continue;
+                    }
+                }
+            }
+            const operation = await this.#claim({
+                account: input.account,
+                workspace: input.workspace,
+                target: { kind: 'run' },
+                expected: saved.key,
+            }, options);
+            if (operation === 'retry') {
+                continue;
+            }
+            try {
+                const result = await this.#execute(operation, options);
+                if (result === 'retry') {
+                    replays += 1;
+                    if (replays >= 2) {
+                        throw new CliError('cli.invalid_response');
+                    }
+                }
+                else {
+                    installedId = result.keyId;
+                }
+            }
+            finally {
+                await this.#release(operation, options);
+            }
+            await this.reconcile(options);
+        }
+    }
+    async pullEnvironment(input, options) {
+        await this.reconcile(options);
+        for (let attempt = 0; attempt < 2; attempt += 1) {
+            const operation = await this.#claim({
+                account: input.account,
+                workspace: input.workspace,
+                target: { kind: 'environment', file: input.target },
+                expected: null,
+            }, options);
+            if (operation === 'retry') {
+                continue;
+            }
+            let result;
+            try {
+                result = await this.#execute(operation, options);
+            }
+            finally {
+                await this.#release(operation, options);
+            }
+            await this.reconcile(options);
+            if (result !== 'retry') {
+                const pendingRevocation = await this.#input.transaction(options, async ({ state }) => state.keyRevocations.length > 0);
+                return {
+                    path: input.target.path,
+                    workspaceId: input.workspace,
+                    keyId: result.keyId,
+                    expiresAt: result.expiresAt,
+                    pendingRevocation,
+                };
+            }
+        }
+        throw new CliError('cli.invalid_response');
+    }
+}