@usestatemachines/cli 0.0.0-stage → 0.1.0

package/dist/config/schema.js

@@ -0,0 +1,282 @@
+import { z } from 'zod';
+import { apiOriginSchema, loginIdSchema, organizationIdSchema, profileNameSchema, tokenIdSchema, workspaceIdSchema, } from '../context-types.js';
+import { CliError } from '../errors.js';
+import { parseCreateKey } from '../generated/internal.js';
+import { environmentTargetSchema } from '../program-types.js';
+export const secretRefSchema = z.strictObject({
+    store: z.enum(['file', 'keychain']),
+    origin: apiOriginSchema,
+    entry: z.string().min(1),
+});
+export const ownerSchema = z.strictObject({
+    hostname: z.string(),
+    pid: z.number().int().positive(),
+    nonce: z.string().min(1),
+});
+export const sessionSchema = z.strictObject({
+    origin: apiOriginSchema,
+    organization: z.strictObject({ id: organizationIdSchema, name: z.string() }),
+    email: z.string(),
+    tokenId: tokenIdSchema,
+    token: secretRefSchema,
+    idleExpiresAt: z.iso.datetime({ offset: true }),
+    expiresAt: z.iso.datetime({ offset: true }),
+    runKeys: z.array(z.strictObject({
+        id: z.string().min(1),
+        workspaceId: workspaceIdSchema,
+        expiresAt: z.iso.datetime({ offset: true }),
+        secret: secretRefSchema,
+    })),
+});
+const keyIssuerSchema = z.strictObject({
+    profile: profileNameSchema,
+    generation: z.number().int().nonnegative(),
+    origin: apiOriginSchema,
+    tokenId: tokenIdSchema,
+    token: secretRefSchema,
+});
+const keyRequestSchema = z.unknown().transform((value, context) => {
+    try {
+        return parseCreateKey(value);
+    }
+    catch {
+        context.addIssue({ code: 'custom', message: 'Invalid key request.' });
+        return z.NEVER;
+    }
+});
+const keyOperationBase = z.strictObject({
+    id: z.string().min(1),
+    owner: ownerSchema.nullable(),
+    issuer: keyIssuerSchema,
+    workspaceId: workspaceIdSchema,
+    target: z.discriminatedUnion('kind', [
+        z.strictObject({ kind: z.literal('run') }),
+        z.strictObject({
+            kind: z.literal('environment'),
+            file: environmentTargetSchema,
+        }),
+    ]),
+    request: keyRequestSchema,
+    idempotencyKey: z.string().min(1),
+    secret: secretRefSchema,
+});
+const keyOperationSchema = z.discriminatedUnion('phase', [
+    keyOperationBase.extend({ phase: z.literal('creating') }),
+    keyOperationBase.extend({
+        phase: z.literal('staged'),
+        keyId: z.string().min(1),
+        expiresAt: z.iso.datetime({ offset: true }),
+    }),
+]);
+const keyRevocationSchema = z.strictObject({
+    id: z.string().min(1),
+    keyId: z.string().min(1),
+    origin: apiOriginSchema,
+    tokenId: tokenIdSchema,
+    token: secretRefSchema,
+    secret: secretRefSchema.nullable(),
+});
+const loginPublicSchema = z.strictObject({
+    loginId: loginIdSchema,
+    userCode: z.string(),
+    verificationUrl: z.url(),
+    expiresAt: z.iso.datetime({ offset: true }),
+    interval: z.number().int().positive(),
+});
+export const pendingPayloadSchema = z.strictObject({
+    version: z.literal(1),
+    loginId: loginIdSchema,
+    origin: apiOriginSchema,
+    expiresAt: z.iso.datetime({ offset: true }),
+    interval: z.number().int().positive(),
+    deviceCode: z.string().regex(/^[A-Za-z0-9_-]{43}$/),
+    privateKey: z.string().regex(/^[A-Za-z0-9_-]{43}$/),
+});
+export const attemptSchema = z.strictObject({
+    id: z.string().min(1),
+    profile: profileNameSchema,
+    generation: z.number().int().nonnegative(),
+    origin: apiOriginSchema,
+    owner: ownerSchema.nullable(),
+    login: loginPublicSchema.nullable(),
+    secret: secretRefSchema.nullable(),
+    createdAt: z.iso.datetime({ offset: true }),
+});
+export const profileSchema = z.strictObject({
+    name: profileNameSchema,
+    generation: z.number().int().nonnegative(),
+    session: sessionSchema.nullable(),
+    defaultWorkspace: workspaceIdSchema.nullable(),
+});
+const revokeJobSchema = z.strictObject({
+    id: z.string().min(1),
+    origin: apiOriginSchema,
+    tokenId: tokenIdSchema,
+    token: secretRefSchema,
+});
+const installSchema = z.strictObject({
+    kind: z.literal('install'),
+    id: z.string().min(1),
+    attemptId: z.string().min(1),
+    profile: profileNameSchema,
+    generation: z.number().int().nonnegative(),
+    loginId: loginIdSchema,
+    candidate: sessionSchema,
+});
+export const configSchema = z
+    .strictObject({
+    version: z.literal(1),
+    defaultProfile: profileNameSchema.nullable(),
+    profiles: z.array(profileSchema),
+    attempts: z.array(attemptSchema),
+    intents: z.array(z.discriminatedUnion('kind', [
+        installSchema,
+        z.strictObject({
+            kind: z.literal('pending'),
+            id: z.string().min(1),
+            attemptId: z.string().min(1),
+            token: secretRefSchema,
+        }),
+    ])),
+    acknowledgements: z.array(z.strictObject({
+        id: z.string().min(1),
+        loginId: loginIdSchema,
+        origin: apiOriginSchema,
+        tokenId: tokenIdSchema,
+        token: secretRefSchema,
+    })),
+    revocations: z.array(revokeJobSchema),
+    keyOperations: z.array(keyOperationSchema),
+    keyRevocations: z.array(keyRevocationSchema),
+    environments: z.array(z.strictObject({
+        repositoryRoot: z.string().min(1),
+        path: z.string().min(1),
+        workspaceId: workspaceIdSchema,
+        keyId: z.string().min(1),
+        expiresAt: z.iso.datetime({ offset: true }),
+        issuer: keyIssuerSchema,
+    })),
+    cleanup: z.array(secretRefSchema),
+})
+    .superRefine((value, context) => {
+    const sessions = [
+        ...value.profiles.flatMap((profile) => profile.session === null ? [] : [profile.session]),
+        ...value.intents.flatMap((intent) => intent.kind === 'install' ? [intent.candidate] : []),
+    ];
+    const bindings = [
+        ...sessions.flatMap((session) => [
+            { origin: session.origin, token: session.token },
+            ...session.runKeys.map((key) => ({
+                origin: session.origin,
+                token: key.secret,
+            })),
+        ]),
+        ...value.keyOperations.flatMap((operation) => [
+            operation.issuer,
+            { origin: operation.issuer.origin, token: operation.secret },
+        ]),
+        ...value.keyRevocations.flatMap((job) => [
+            job,
+            ...(job.secret === null
+                ? []
+                : [{ origin: job.origin, token: job.secret }]),
+        ]),
+        ...value.environments.map((environment) => environment.issuer),
+        ...value.acknowledgements,
+        ...value.revocations,
+        ...value.attempts.flatMap((attempt) => attempt.secret === null
+            ? []
+            : [{ origin: attempt.origin, token: attempt.secret }]),
+    ];
+    if (bindings.some((binding) => binding.origin !== binding.token.origin)) {
+        context.addIssue({
+            code: 'custom',
+            message: 'Credential origin mismatch.',
+        });
+    }
+    for (const intent of value.intents) {
+        if (intent.kind === 'pending') {
+            const attempt = value.attempts.find((candidate) => candidate.id === intent.attemptId);
+            if (attempt !== undefined && attempt.origin !== intent.token.origin) {
+                context.addIssue({
+                    code: 'custom',
+                    message: 'Pending credential origin mismatch.',
+                });
+            }
+        }
+    }
+    for (const operation of value.keyOperations) {
+        if (operation.request.workspaceId !== operation.workspaceId ||
+            operation.request.kind !==
+                (operation.target.kind === 'run' ? 'cli_run' : 'env_pull')) {
+            context.addIssue({
+                code: 'custom',
+                message: 'Key request binding mismatch.',
+            });
+        }
+    }
+    for (const keys of [
+        value.profiles.map((profile) => profile.name),
+        value.attempts.map((attempt) => attempt.id),
+        value.attempts.map((attempt) => attempt.profile),
+        value.intents.map((intent) => intent.id),
+        value.acknowledgements.map((job) => job.id),
+        value.revocations.map((job) => job.id),
+        value.keyOperations.map((operation) => operation.id),
+        value.keyRevocations.map((job) => job.id),
+        value.environments.map((environment) => JSON.stringify([
+            environment.repositoryRoot,
+            environment.issuer.origin,
+            environment.workspaceId,
+        ])),
+        ...sessions.map((session) => session.runKeys.map((key) => key.workspaceId)),
+        value.keyOperations
+            .filter((operation) => operation.target.kind === 'run')
+            .map((operation) => JSON.stringify([
+            operation.issuer.origin,
+            operation.issuer.tokenId,
+            operation.workspaceId,
+        ])),
+    ]) {
+        if (new Set(keys).size !== keys.length) {
+            context.addIssue({ code: 'custom', message: 'Duplicate record.' });
+        }
+    }
+    if (value.defaultProfile !== null &&
+        !value.profiles.some((profile) => profile.name === value.defaultProfile && profile.session !== null)) {
+        context.addIssue({ code: 'custom', message: 'Missing default profile.' });
+    }
+});
+export function emptyConfig() {
+    return {
+        version: 1,
+        defaultProfile: null,
+        profiles: [],
+        attempts: [],
+        intents: [],
+        acknowledgements: [],
+        revocations: [],
+        keyOperations: [],
+        keyRevocations: [],
+        environments: [],
+        cleanup: [],
+    };
+}
+export function parseVersioned(text, schema) {
+    let input;
+    try {
+        input = JSON.parse(text);
+    }
+    catch {
+        throw new CliError('cli.config_invalid');
+    }
+    const version = z.object({ version: z.number() }).safeParse(input);
+    if (version.success && version.data.version > 1) {
+        throw new CliError('cli.config_too_new');
+    }
+    const result = schema.safeParse(input);
+    if (!result.success) {
+        throw new CliError('cli.config_invalid');
+    }
+    return result.data;
+}

package/dist/context-types.d.ts

@@ -0,0 +1,89 @@
+import type { StateMachines } from '@usestatemachines/sdk';
+import { z } from 'zod';
+import type { AnonymousApi, AuthenticatedInternalApi } from './api-internal.js';
+import type { ProjectRepository } from './config/project.js';
+import type { EffectOptions, Io } from './io-types.js';
+import type { Accounts } from './login.js';
+import type { Programs } from './program-types.js';
+export declare const apiOriginSchema: z.core.$ZodBranded<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, "ApiOrigin", "out">;
+export declare const productionOrigin: string & z.$brand<"ApiOrigin">;
+export declare const profileNameSchema: z.core.$ZodBranded<z.ZodString, "ProfileName", "out">;
+export declare const workspaceIdSchema: z.core.$ZodBranded<z.ZodString, "WorkspaceId", "out">;
+export declare const organizationIdSchema: z.core.$ZodBranded<z.ZodString, "OrganizationId", "out">;
+export declare const tokenIdSchema: z.core.$ZodBranded<z.ZodString, "TokenId", "out">;
+export declare const loginIdSchema: z.core.$ZodBranded<z.ZodString, "LoginId", "out">;
+export type ApiOrigin = z.infer<typeof apiOriginSchema>;
+export type ProfileName = z.infer<typeof profileNameSchema>;
+export type WorkspaceId = z.infer<typeof workspaceIdSchema>;
+export type OrganizationId = z.infer<typeof organizationIdSchema>;
+export type TokenId = z.infer<typeof tokenIdSchema>;
+export type LoginId = z.infer<typeof loginIdSchema>;
+export declare function profileNameFromEnvironment(value: string | undefined): ProfileName | null;
+export declare function apiOriginFromEnvironment(value: string | undefined): ApiOrigin | null;
+export interface Globals {
+    readonly profile: ProfileName | null;
+    readonly workspace: string | null;
+    readonly format: 'text' | 'json' | null;
+    readonly noInput: boolean;
+    readonly yes: boolean;
+    readonly stream: boolean;
+}
+export interface Presentation {
+    readonly mode: 'interactive' | 'non-interactive';
+    readonly format: 'text' | 'json';
+    readonly stream: boolean;
+}
+export type Account = {
+    readonly kind: 'workspace-key';
+    readonly origin: ApiOrigin;
+    readonly workspaceId: WorkspaceId;
+    readonly source: 'environment';
+} | {
+    readonly kind: 'cli-token';
+    readonly origin: ApiOrigin;
+    readonly profile: ProfileName;
+    readonly tokenId: TokenId;
+    readonly organizationId: OrganizationId;
+};
+export interface Workspace {
+    readonly id: WorkspaceId;
+    readonly name: string;
+    readonly source: 'flag' | 'environment' | 'link' | 'default' | 'credential';
+    assertMember(actualWorkspaceId: string): void;
+}
+export interface PublicContext {
+    readonly io: Io;
+    readonly globals: Globals;
+    readonly presentation: Presentation;
+    readonly accounts: Pick<Accounts, 'login' | 'logout' | 'list' | 'use' | 'setWorkspace' | 'reconcile' | 'inspect'>;
+    readonly projects: ProjectRepository;
+    readonly version: string;
+    anonymousApi(origin: ApiOrigin): AnonymousApi;
+    resolveAccount(options?: EffectOptions): Promise<AccountContext>;
+}
+export interface AccountContext extends PublicContext {
+    readonly account: Account;
+    readonly sdk: StateMachines;
+    readonly internal: AuthenticatedInternalApi;
+    forWorkspace(workspace: Workspace): WorkspaceContext;
+    resolveWorkspace(options?: EffectOptions): Promise<Workspace | null>;
+    findWorkspace(value: string, options?: EffectOptions): Promise<Pick<Workspace, 'id' | 'name'>>;
+}
+export interface WorkspaceContext extends AccountContext {
+    readonly workspace: Workspace;
+    readonly programs: Programs;
+}
+export interface Contexts {
+    readonly public: PublicContext;
+    readonly account: AccountContext;
+    readonly workspace: WorkspaceContext;
+}
+export type ContextNeed = keyof Contexts;
+export type ContextResolvers = {
+    readonly [Need in ContextNeed]: () => Promise<Contexts[Need]>;
+};
+export interface ContextSession {
+    readonly contexts: ContextResolvers;
+    readonly presentation: Presentation;
+    close(): Promise<void>;
+}

package/dist/context-types.js

@@ -0,0 +1,56 @@
+import { z } from 'zod';
+import { CliError } from './errors.js';
+export const apiOriginSchema = z
+    .string()
+    .transform((value, context) => {
+    try {
+        const origin = value.endsWith('/') ? value.slice(0, -1) : value;
+        const url = new URL(origin);
+        const local = url.hostname === 'localhost' || url.hostname === '127.0.0.1';
+        if (/[{}]/.test(origin) ||
+            origin !== url.origin ||
+            (url.protocol !== 'https:' && !(url.protocol === 'http:' && local))) {
+            context.addIssue({
+                code: 'custom',
+                message: 'Use an HTTPS API origin without a path.',
+            });
+            return z.NEVER;
+        }
+        return origin;
+    }
+    catch {
+        context.addIssue({ code: 'custom', message: 'Use a valid API origin.' });
+        return z.NEVER;
+    }
+})
+    .brand();
+export const productionOrigin = apiOriginSchema.parse('https://api.usestatemachines.com');
+export const profileNameSchema = z.string().min(1).brand();
+export const workspaceIdSchema = z.string().min(1).brand();
+export const organizationIdSchema = z.string().min(1).brand();
+export const tokenIdSchema = z.string().min(1).brand();
+export const loginIdSchema = z.string().min(1).brand();
+export function profileNameFromEnvironment(value) {
+    if (value === undefined) {
+        return null;
+    }
+    const result = profileNameSchema.safeParse(value);
+    if (!result.success) {
+        throw new CliError('cli.invalid_arguments', {
+            message: 'STATEMACHINES_PROFILE must name a profile.',
+        });
+    }
+    return result.data;
+}
+export function apiOriginFromEnvironment(value) {
+    if (value === undefined) {
+        return null;
+    }
+    const result = apiOriginSchema.safeParse(value);
+    if (!result.success) {
+        throw new CliError('cli.invalid_arguments', {
+            message: 'STATEMACHINES_BASE_URL must be an HTTPS origin, or HTTP on localhost.',
+        });
+    }
+    return result.data;
+}

package/dist/context.d.ts

@@ -0,0 +1,13 @@
+import { type Workspace as ApiWorkspace, StateMachines } from '@usestatemachines/sdk';
+import { type ContextSession, type Globals, type Presentation } from './context-types.js';
+import type { Io } from './io-types.js';
+export declare function allWorkspaces(sdk: StateMachines): Promise<ApiWorkspace[]>;
+export declare function createContextSession(input: {
+    io: Io;
+    globals: Globals;
+    presentation: Presentation;
+    version: string;
+    agent: {
+        readonly name: string;
+    } | null;
+}): Promise<ContextSession>;