@varde-flyt/vfac 0.4.0 → 0.5.0

package/README.md

@@ -26,8 +26,18 @@ vfac guide
 vfac whoami
 ```
 
-`doctor` checks the endpoint, the API, your credential and what that credential
-reaches, in that order, and reports the first thing that is actually wrong.
+`doctor` checks the endpoint, the API, whether this client is new enough for the
+platform it is pointed at, your credential and what that credential reaches, in
+that order, and reports the first thing that is actually wrong. A platform
+declares the oldest client it supports; below that, `doctor` fails and says so
+before sending your credential anywhere.
+
+`doctor` is also the one command that contacts a host other than your own
+platform: it asks `registry.npmjs.org` whether a newer `vfac` has been published.
+That request is anonymous — no credential, no session, no endpoint, nothing
+identifying you — and it can never change the exit code, so an unreachable or
+blocked registry is reported and otherwise ignored. Set `VFAC_NO_UPDATE_CHECK` to
+any value to skip it entirely; nothing else in this tool makes that request.
 
 `vfac guide` is the documentation. It is served by the platform you are pointed
 at rather than bundled here, so it always describes the deployment in front of

package/dist/vfac.mjs

@@ -7670,7 +7670,9 @@ async function probeMachineApi(args) {
   }
   const authentication = payload["authentication"];
   const contextGate = typeof authentication === "object" && authentication !== null && typeof authentication["contextGate"] === "string" ? authentication["contextGate"] : null;
-  return { ok: true, service, apiVersion, contextGate };
+  const cli = payload["cli"];
+  const minimumCliVersion = typeof cli === "object" && cli !== null && typeof cli["minimumVersion"] === "string" ? cli["minimumVersion"] : null;
+  return { ok: true, service, apiVersion, contextGate, minimumCliVersion };
 }
 
 // src/manifest.ts
@@ -12678,6 +12680,15 @@ var RESOURCE_API_VERSION = "resources.vardeflyt.no/v1";
 var PRODUCT_INSTANCE_KIND = "ProductInstance";
 
 // ../product-configuration/dist/product-instance-example.js
+function resolveExampleChoice(options, selected, declaredDefault) {
+  if (selected !== void 0)
+    return options.includes(selected) ? { value: selected, issue: null } : { value: null, issue: "invalid" };
+  if (declaredDefault !== void 0 && options.includes(declaredDefault))
+    return { value: declaredDefault, issue: null };
+  if (options.length === 1)
+    return { value: options[0], issue: null };
+  return { value: null, issue: options.length === 0 ? "unavailable" : "required" };
+}
 function isSecret(declaration) {
   return declaration.writeOnly === true || declaration["x-secret"] === true;
 }
@@ -15736,9 +15747,9 @@ async function runApply(verb, parsed, deps = {}) {
     process.stderr.write("Which manifest? Use -f <file>.\n");
     return 2;
   }
-  const manifest = readManifest(file);
-  if (!manifest.ok) {
-    process.stderr.write(`${manifest.message}
+  const manifest2 = readManifest(file);
+  if (!manifest2.ok) {
+    process.stderr.write(`${manifest2.message}
 `);
     return 2;
   }
@@ -15764,7 +15775,7 @@ async function runApply(verb, parsed, deps = {}) {
   const json = parsed.flags["output"] === "json";
   const path = `/api/v1/projects/${encodeURIComponent(projectId)}/manifest`;
   const envelope = {
-    template: manifest.document,
+    template: manifest2.document,
     ...Object.keys(secrets.secrets).length > 0 ? { secrets: secrets.secrets } : {},
     ...parsed.flags["adopt"] ? { adopt: parsed.flags["adopt"] } : {}
   };
@@ -15776,7 +15787,7 @@ async function runApply(verb, parsed, deps = {}) {
       token: session.ready.token,
       // The DOCUMENT, not the envelope: `validate` asks whether a file is well
       // formed, which is a question about the file and not about a request.
-      body: { verb: "validate", payload: manifest.document }
+      body: { verb: "validate", payload: manifest2.document }
     });
     if (!result.ok) return printError(result.error, json);
     process.stdout.write(
@@ -15849,7 +15860,7 @@ Read the operation that failed: \`vfac get operation <id>\`, or \`vfac get produ
     body: { verb: "apply", action, payload: envelope }
   });
   if (!applied.ok) return printError(applied.error, json);
-  const key = manifestKeyOf(manifest.document) ?? planned.data.manifestKey ?? "(unnamed)";
+  const key = manifestKeyOf(manifest2.document) ?? planned.data.manifestKey ?? "(unnamed)";
   const rawOperationId = applied.data["operationId"];
   const operationId = typeof rawOperationId === "string" && rawOperationId !== "" ? rawOperationId : null;
   if (!parsed.booleans.has("wait")) {
@@ -15993,17 +16004,63 @@ Project   ${projectId ?? "(none)"}
 
 // src/version.ts
 import { readFileSync as readFileSync3 } from "node:fs";
-function cliVersion() {
+function manifest() {
   try {
-    const manifest = JSON.parse(
+    const parsed = JSON.parse(
       readFileSync3(new URL("../package.json", import.meta.url), "utf8")
     );
-    const version = typeof manifest === "object" && manifest !== null ? manifest["version"] : void 0;
-    return typeof version === "string" ? version : "unknown";
+    return typeof parsed === "object" && parsed !== null ? parsed : null;
   } catch {
-    return "unknown";
+    return null;
   }
 }
+function cliVersion() {
+  const version = manifest()?.["version"];
+  return typeof version === "string" ? version : "unknown";
+}
+function cliPackageName() {
+  const name = manifest()?.["name"];
+  return typeof name === "string" ? name : null;
+}
+function cliInstallCommand() {
+  const name = cliPackageName();
+  return name === null ? null : `npm install -g ${name}`;
+}
+
+// src/registry.ts
+var UPDATE_CHECK_TIMEOUT_MS = 3e3;
+var REGISTRY_ORIGIN = "https://registry.npmjs.org";
+var UPDATE_CHECK_OPT_OUT = "VFAC_NO_UPDATE_CHECK";
+async function latestPublishedVersion(args) {
+  const env = args?.env ?? process.env;
+  if (env[UPDATE_CHECK_OPT_OUT]) return { ok: false };
+  const name = cliPackageName();
+  if (name === null) return { ok: false };
+  const doFetch = args?.fetchImpl ?? fetch;
+  let response;
+  try {
+    response = await doFetch(`${REGISTRY_ORIGIN}/-/package/${encodeURIComponent(name)}/dist-tags`, {
+      method: "GET",
+      redirect: "manual",
+      signal: signal()
+    });
+  } catch {
+    return { ok: false };
+  }
+  if (!response.ok) return { ok: false };
+  let payload;
+  try {
+    payload = await response.json();
+  } catch {
+    return { ok: false };
+  }
+  if (typeof payload !== "object" || payload === null) return { ok: false };
+  const latest = payload["latest"];
+  return typeof latest === "string" && latest !== "" ? { ok: true, latest } : { ok: false };
+}
+function signal() {
+  return typeof AbortSignal !== "undefined" && typeof AbortSignal.timeout === "function" ? AbortSignal.timeout(UPDATE_CHECK_TIMEOUT_MS) : void 0;
+}
 
 // src/commands/doctor.ts
 async function runDoctor(parsed) {
@@ -16036,6 +16093,9 @@ async function runDoctor(parsed) {
     return report(checks, json);
   }
   checks.push({ name: "Machine API", ok: true, detail: probe.apiVersion });
+  const compatible = compatibility(cliVersion(), probe.minimumCliVersion);
+  checks.push(compatible);
+  if (!compatible.ok) return report(checks, json);
   const signedIn = await signIn({ endpoint });
   if (!signedIn.ok) {
     checks.push({ name: "Context Gate", ok: false, detail: signedIn.message });
@@ -16110,8 +16170,87 @@ async function runDoctor(parsed) {
     note: true,
     detail: "run `vfac guide` for the platform's own instructions, written for a machine"
   });
+  checks.push(await updateAvailable(cliVersion()));
   return report(checks, json);
 }
+function compatibility(local, declared) {
+  const name = "Compatibility";
+  const facts = { version: local, minimumVersion: declared };
+  if (declared === null) {
+    return {
+      name,
+      ok: true,
+      detail: "this Tenant Portal names no minimum version, so there is nothing to check against.",
+      facts
+    };
+  }
+  if (!PLAIN_SEMVER_REGEX.test(declared)) {
+    return {
+      name,
+      ok: true,
+      note: true,
+      detail: `this Tenant Portal asks for "${declared}", which is not a version this client can read. Treated as no requirement rather than as a refusal.`,
+      facts
+    };
+  }
+  if (!PLAIN_SEMVER_REGEX.test(local)) {
+    return {
+      name,
+      ok: true,
+      note: true,
+      detail: `this build does not report its own version, so it cannot be checked against the vfac ${declared} this Tenant Portal requires.`,
+      facts
+    };
+  }
+  if (compareSemver(local, declared) >= 0) {
+    return { name, ok: true, detail: `OK \u2014 requires vfac ${declared} or newer`, facts };
+  }
+  const install = cliInstallCommand();
+  return {
+    name,
+    ok: false,
+    detail: `UPGRADE REQUIRED. This Tenant Portal supports vfac ${declared} and newer; this is ${local}. ` + (local.includes("-") ? `A prerelease sorts below the release it is named for, so ${local} does not satisfy ${declared}. ` : "") + (install === null ? "" : `Run: ${install}`),
+    facts
+  };
+}
+async function updateAvailable(local) {
+  const name = "Update";
+  const result = await latestPublishedVersion();
+  if (!result.ok) {
+    return {
+      name,
+      ok: true,
+      detail: "could not check for updates",
+      facts: { version: local, latest: null }
+    };
+  }
+  const facts = { version: local, latest: result.latest };
+  if (!PLAIN_SEMVER_REGEX.test(local) || !PLAIN_SEMVER_REGEX.test(result.latest)) {
+    return {
+      name,
+      ok: true,
+      detail: `the latest published release is vfac ${result.latest}`,
+      facts
+    };
+  }
+  const order = compareSemver(local, result.latest);
+  if (order > 0) {
+    return {
+      name,
+      ok: true,
+      detail: `vfac ${local} is ahead of the latest release (${result.latest})`,
+      facts
+    };
+  }
+  if (order === 0) return { name, ok: true, detail: `vfac ${local} is the latest release`, facts };
+  return {
+    name,
+    ok: true,
+    note: true,
+    detail: `vfac ${result.latest} is available (running ${local})`,
+    facts
+  };
+}
 function report(checks, json) {
   const failed = checks.filter((check) => !check.ok);
   if (json) {
@@ -16724,42 +16863,27 @@ async function runManifestInit(parsed) {
   }
   const regions = product.supportedRegions ?? [];
   const chosenRegion = parsed.flags["region"];
-  let region;
-  if (chosenRegion !== void 0) {
-    if (!regions.includes(chosenRegion)) {
-      return refuse(
-        `${product.productId} ${product.version} does not offer the region "${chosenRegion}".${regions.length > 0 ? ` It offers: ${regions.join(", ")}.` : ""}`
-      );
-    }
-    region = chosenRegion;
-  } else if (regions.length === 1) {
-    region = regions[0];
-  } else {
+  const regionChoice = resolveExampleChoice(regions, chosenRegion);
+  if (regionChoice.value === null) {
     return refuse(
-      regions.length === 0 ? `${product.productId} ${product.version} declares no region. Ask the publisher.` : `This Product offers several regions. Pass --region <${regions.join("|")}>.`
+      regionChoice.issue === "invalid" ? `${product.productId} ${product.version} does not offer the region "${chosenRegion}".${regions.length > 0 ? ` It offers: ${regions.join(", ")}.` : ""}` : regionChoice.issue === "unavailable" ? `${product.productId} ${product.version} declares no region. Ask the publisher.` : `This Product offers several regions. Pass --region <${regions.join("|")}>.`
     );
   }
+  const region = regionChoice.value;
   const profiles = product.profiles ?? [];
   const offered = profiles.map((entry) => entry.id);
   const chosenProfile = parsed.flags["profile"];
-  const declaredDefault = profiles.find((entry) => entry.default === true);
-  let profile;
-  if (chosenProfile !== void 0) {
-    if (!offered.includes(chosenProfile)) {
-      return refuse(
-        `${product.productId} ${product.version} does not offer the service profile "${chosenProfile}".${offered.length > 0 ? ` It offers: ${offered.join(", ")}.` : ""}`
-      );
-    }
-    profile = chosenProfile;
-  } else if (declaredDefault) {
-    profile = declaredDefault.id;
-  } else if (offered.length === 1) {
-    profile = offered[0];
-  } else {
+  const profileChoice = resolveExampleChoice(
+    offered,
+    chosenProfile,
+    profiles.find((entry) => entry.default === true)?.id
+  );
+  if (profileChoice.value === null) {
     return refuse(
-      offered.length === 0 ? `${product.productId} ${product.version} declares no service profile. Ask the publisher.` : `This Product offers several service profiles. Pass --profile <${offered.join("|")}>.`
+      profileChoice.issue === "invalid" ? `${product.productId} ${product.version} does not offer the service profile "${chosenProfile}".${offered.length > 0 ? ` It offers: ${offered.join(", ")}.` : ""}` : profileChoice.issue === "unavailable" ? `${product.productId} ${product.version} declares no service profile. Ask the publisher.` : `This Product offers several service profiles. Pass --profile <${offered.join("|")}>.`
     );
   }
+  const profile = profileChoice.value;
   const seed = seedConfiguration(product.configuration);
   for (const property of seed.requiredSecrets) {
     notes.push(`--secret ${property}=env:VAR  \u2014 required, and never written to this file`);
@@ -16979,9 +17103,12 @@ Options
       --output    json, for a pipeline that reads the answer
 
 Diagnosing
-  vfac doctor   checks the endpoint, the machine API, the credential and what
-                that credential can reach \u2014 in that order, so the first thing
-                that is actually wrong is the thing it reports
+  vfac doctor   checks the endpoint, the machine API, whether this client is new
+                enough for that platform, the credential and what that credential
+                can reach \u2014 in that order, so the first thing that is actually
+                wrong is the thing it reports. It ends by asking npm whether a
+                newer vfac has been published, which is a note and never a
+                failure. Set VFAC_NO_UPDATE_CHECK to skip that one request
   vfac whoami   what this credential is, and which Project scopes it has been
                 GRANTED. A credential scoped to one Project deploys fine and
                 cannot make organization-wide reads \u2014 this is where that is said.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@varde-flyt/vfac",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Deploy and manage Varde Flyt Products from a manifest.",
   "repository": {
     "type": "git",