@vendure/cloud 0.2.0 → 0.3.0

package/dist/cli/lib/contract/desired-state.js

@@ -0,0 +1,171 @@
+// Mirrors the VC Environment Desired State schema from `@vendure-cloud/environment-state`, and the
+// response `@vendure-cloud/api-types` wraps it in. See ./README.md for why this package cannot
+// import either, including as types.
+//
+// The whole schema is mirrored rather than only the types, because one of the two call sites is not
+// validation: `config <section> set` parses the document it is about to send and reads the PATCH
+// body out of the result, so the server defaults `serverServiceSchema` materializes — the port and
+// the health check path — are part of what the CLI sends. Dropping the parse would change the
+// request, and the bounds and the removed-field messages are asserted on the error path as well.
+// CLO-685 records that decision.
+//
+// `VC_ENVIRONMENT_TYPES` is the runtime half of the `VcEnvironmentType` that `wire-types.ts`
+// declares; `test/cli-contract-parity.test.ts` asserts the two describe the same members, so the
+// mirror still has one answer for the set.
+//
+// This file imports `zod`, so a command reaches it from inside its `run` through `await import(...)`
+// rather than from the module that declares the command tree. `test/cli-published-surface.test.ts`
+// fails if loading the CLI plugin reaches `zod`.
+import { z } from "zod";
+export const DESIRED_STATE_SCHEMA_VERSION = 1;
+export const VC_REGIONS = ["eu-west-1"];
+export const vcRegionSchema = z.string().trim().pipe(z.enum(VC_REGIONS));
+export const VC_ENVIRONMENT_TYPES = ["dev", "uat", "staging", "production"];
+export const vcEnvironmentTypeSchema = z.enum(VC_ENVIRONMENT_TYPES);
+// The plans an addon may run on. The original derives this list by slicing its plan catalog at a
+// named minimum; the catalog itself has no reader here, so the mirror declares the result and the
+// parity suite compares it with the real list at runtime.
+export const VC_ADDON_PLANS = [
+    "vc-compute-20",
+    "vc-compute-50",
+    "vc-compute-100-1",
+    "vc-compute-100-2",
+    "vc-compute-100-4",
+    "vc-compute-200",
+    "vc-compute-200-4",
+    "vc-compute-200-8",
+    "vc-compute-200-16",
+    "vc-compute-400",
+    "vc-compute-400-16",
+    "vc-compute-800-8",
+    "vc-compute-800-16",
+    "vc-compute-800-24",
+    "vc-compute-800-32",
+    "vc-compute-800-40",
+    "vc-compute-1200-24",
+    "vc-compute-1600-32",
+    "vc-compute-2000-40",
+];
+export const vcAddonPlanSchema = z.enum(VC_ADDON_PLANS);
+const runtimeReplicasSchema = z.number().int().min(1).max(20);
+const addonReplicasSchema = z.number().int().min(1).max(10);
+const storageGbSchema = z.number().int().min(1).max(1000);
+const typesenseStorageGbSchema = storageGbSchema.min(6);
+// How many tasks a runtime service runs, and nothing about how large each one is. The task shape is
+// the platform's, resolved from the VC Environment's type and its platform-managed capacity class
+// (CLO-569), and no longer named in this document.
+//
+// `replicas` is the temporary half of that split. It stays customer-configurable because the
+// platform has no autoscaling yet and because stop and start restore a service to the count
+// recorded here (CLO-495). CLO-572 replaces it with platform-owned bounds and removes the field.
+const serviceSchema = z
+    .object({
+    replicas: runtimeReplicasSchema,
+})
+    .strict();
+// Where the server listens and how the load balancer decides it is alive.
+//
+// On the server alone, because the worker has no listener and nothing routes to it. Both carry a
+// default, so a VC Environment created before these existed parses unchanged and a customer who
+// never sets them gets what the managed build produces.
+//
+// They are here rather than fixed in the control plane because a VC Environment may run an image
+// the platform did not build — `deploy --server-image` is a supported path — and that image
+// listens where it listens. A platform-wide constant would mean a target group that never turns
+// healthy, reported as a failed deploy with nothing naming the port as the cause.
+export const DEFAULT_SERVER_PORT = 3000;
+export const DEFAULT_SERVER_HEALTH_CHECK_PATH = "/health";
+const serverServiceSchema = serviceSchema
+    .extend({
+    port: z.number().int().min(1).max(65535).default(DEFAULT_SERVER_PORT),
+    // Rooted, because the load balancer sends it as a path and a relative one is refused at apply
+    // time by AWS rather than here.
+    healthCheckPath: z.string().startsWith("/").default(DEFAULT_SERVER_HEALTH_CHECK_PATH),
+})
+    .strict();
+// A field keeps arriving for a while after it leaves Desired State. A stored document carries the
+// key, and so does a request from a CLI built before the field went. The strict object below
+// reports both of those as an unrecognized key, which reads as a misspelling rather than as a field
+// that was removed. Each removed field therefore gets its own check here, which names the field and
+// says why it is gone.
+// Asset storage left with ADR-0051: a VC Environment's assets live in a bucket the platform creates
+// and destroys with the environment, so there is nothing to choose.
+export const ASSETS_NOT_CONFIGURABLE_MESSAGE = "Asset storage is not configurable. Remove the assets section: Vendure Cloud gives every VC Environment its own asset storage and serves it.";
+// The cache left with ADR-0026: the platform gives each VC Environment its own cache and injects
+// the cache strategy that uses it, so there is nothing to choose.
+export const CACHE_NOT_CONFIGURABLE_MESSAGE = "The cache is not configurable. Remove the cache section: Vendure Cloud gives every VC Environment its own cache and configures Vendure to use it.";
+// The database left with ADR-0020 and ADR-0040: every VC Environment gets its own PostgreSQL
+// database on the shared Aurora Serverless cluster its Cell owns. The cluster scales itself, so
+// there is one engine and no per-environment size.
+export const DATABASE_NOT_CONFIGURABLE_MESSAGE = "The database is not configurable. Remove the database section: Vendure Cloud gives every VC Environment its own PostgreSQL database and scales it.";
+// The job queue left with ADR-0022: every VC Environment gets its own queue and the platform
+// supplies the strategy that reads and writes it, so there is nothing to choose.
+export const JOB_QUEUE_NOT_CONFIGURABLE_MESSAGE = "The job queue is not configurable. Remove the jobQueue section: Vendure Cloud gives every VC Environment its own job queue and configures Vendure to use it.";
+// Per-service compute plans left with ADR-0036 and CLO-569: Vendure Cloud sizes a VC Environment's
+// server and worker from its type and its platform-managed capacity class, so there is no compute
+// size to pick. Replicas are unaffected and stay in the document.
+export const RUNTIME_PLAN_NOT_CONFIGURABLE_MESSAGE = "Runtime service sizing is not configurable. Remove the plan field: Vendure Cloud sizes the server and the worker. Replicas are still yours to set, and support can raise the size if you need more.";
+const REMOVED_FIELD_MESSAGES = {
+    assets: ASSETS_NOT_CONFIGURABLE_MESSAGE,
+    cache: CACHE_NOT_CONFIGURABLE_MESSAGE,
+    database: DATABASE_NOT_CONFIGURABLE_MESSAGE,
+    jobQueue: JOB_QUEUE_NOT_CONFIGURABLE_MESSAGE,
+};
+// The runtime services whose `plan` is gone. Checked one level down rather than through the strict
+// object above, for the same reason the four top-level sections are: a strict object reports an
+// unrecognized key, which reads as a misspelling rather than as a field the platform took over.
+const REMOVED_RUNTIME_SERVICES = ["server", "worker"];
+const removedFieldsSchema = z.unknown().superRefine((value, ctx) => {
+    if (typeof value !== "object" || value === null)
+        return;
+    for (const [field, message] of Object.entries(REMOVED_FIELD_MESSAGES)) {
+        if (!(field in value))
+            continue;
+        ctx.addIssue({ code: "custom", path: [field], message });
+    }
+    const runtime = value.runtime;
+    if (typeof runtime !== "object" || runtime === null)
+        return;
+    for (const key of REMOVED_RUNTIME_SERVICES) {
+        const service = runtime[key];
+        if (typeof service !== "object" || service === null)
+            continue;
+        if (!("plan" in service))
+            continue;
+        ctx.addIssue({
+            code: "custom",
+            path: ["runtime", key, "plan"],
+            message: RUNTIME_PLAN_NOT_CONFIGURABLE_MESSAGE,
+        });
+    }
+});
+const environmentDesiredStateObjectSchema = z
+    .object({
+    schemaVersion: z.literal(DESIRED_STATE_SCHEMA_VERSION),
+    environment: z
+        .object({
+        type: vcEnvironmentTypeSchema,
+        region: vcRegionSchema,
+    })
+        .strict(),
+    runtime: z
+        .object({
+        server: serverServiceSchema,
+        worker: serviceSchema,
+    })
+        .strict(),
+    search: z.discriminatedUnion("managedService", [
+        z.object({ managedService: z.literal("none") }).strict(),
+        z
+            .object({
+            managedService: z.literal("typesense"),
+            plan: vcAddonPlanSchema,
+            replicas: addonReplicasSchema,
+            storageGb: typesenseStorageGbSchema,
+        })
+            .strict(),
+    ]),
+})
+    .strict();
+export const environmentDesiredStateSchema = removedFieldsSchema.pipe(environmentDesiredStateObjectSchema);
+//# sourceMappingURL=desired-state.js.map

package/dist/cli/lib/contract/desired-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"desired-state.js","sourceRoot":"","sources":["../../../../src/cli/lib/contract/desired-state.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,+FAA+F;AAC/F,qCAAqC;AACrC,EAAE;AACF,oGAAoG;AACpG,iGAAiG;AACjG,mGAAmG;AACnG,8FAA8F;AAC9F,iGAAiG;AACjG,iCAAiC;AACjC,EAAE;AACF,6FAA6F;AAC7F,iGAAiG;AACjG,2CAA2C;AAC3C,EAAE;AACF,qGAAqG;AACrG,mGAAmG;AACnG,iDAAiD;AAEjD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAC9C,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,WAAW,CAAU,CAAC;AAEjD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;AAEzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,CAAU,CAAC;AACrF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;AAEpE,iGAAiG;AACjG,kGAAkG;AAClG,0DAA0D;AAC1D,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,eAAe;IACf,eAAe;IACf,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,gBAAgB;IAChB,kBAAkB;IAClB,kBAAkB;IAClB,mBAAmB;IACnB,gBAAgB;IAChB,mBAAmB;IACnB,kBAAkB;IAClB,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,oBAAoB;IACpB,oBAAoB;IACpB,oBAAoB;CACZ,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAExD,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC9D,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC5D,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC1D,MAAM,wBAAwB,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAExD,oGAAoG;AACpG,kGAAkG;AAClG,mDAAmD;AACnD,EAAE;AACF,6FAA6F;AAC7F,4FAA4F;AAC5F,iGAAiG;AACjG,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,CAAC;IACN,QAAQ,EAAE,qBAAqB;CAChC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,0EAA0E;AAC1E,EAAE;AACF,iGAAiG;AACjG,gGAAgG;AAChG,wDAAwD;AACxD,EAAE;AACF,iGAAiG;AACjG,4FAA4F;AAC5F,gGAAgG;AAChG,kFAAkF;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACxC,MAAM,CAAC,MAAM,gCAAgC,GAAG,SAAS,CAAC;AAE1D,MAAM,mBAAmB,GAAG,aAAa;KACtC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACrE,8FAA8F;IAC9F,gCAAgC;IAChC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,gCAAgC,CAAC;CACtF,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,kGAAkG;AAClG,6FAA6F;AAC7F,oGAAoG;AACpG,oGAAoG;AACpG,uBAAuB;AAEvB,oGAAoG;AACpG,oEAAoE;AACpE,MAAM,CAAC,MAAM,+BAA+B,GAC1C,6IAA6I,CAAC;AAEhJ,iGAAiG;AACjG,kEAAkE;AAClE,MAAM,CAAC,MAAM,8BAA8B,GACzC,mJAAmJ,CAAC;AAEtJ,6FAA6F;AAC7F,gGAAgG;AAChG,mDAAmD;AACnD,MAAM,CAAC,MAAM,iCAAiC,GAC5C,oJAAoJ,CAAC;AAEvJ,6FAA6F;AAC7F,iFAAiF;AACjF,MAAM,CAAC,MAAM,kCAAkC,GAC7C,8JAA8J,CAAC;AAEjK,mGAAmG;AACnG,kGAAkG;AAClG,kEAAkE;AAClE,MAAM,CAAC,MAAM,qCAAqC,GAChD,qMAAqM,CAAC;AAExM,MAAM,sBAAsB,GAAG;IAC7B,MAAM,EAAE,+BAA+B;IACvC,KAAK,EAAE,8BAA8B;IACrC,QAAQ,EAAE,iCAAiC;IAC3C,QAAQ,EAAE,kCAAkC;CACpC,CAAC;AAEX,mGAAmG;AACnG,gGAAgG;AAChG,gGAAgG;AAChG,MAAM,wBAAwB,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAE/D,MAAM,mBAAmB,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO;IACxD,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC;YAAE,SAAS;QAChC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAC;IACzD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO;IAC5D,KAAK,MAAM,GAAG,IAAI,wBAAwB,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAI,OAAmC,CAAC,GAAG,CAAC,CAAC;QAC1D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAC9D,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC;YAAE,SAAS;QACnC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC;YAC9B,OAAO,EAAE,qCAAqC;SAC/C,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,mCAAmC,GAAG,CAAC;KAC1C,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC;IACtD,WAAW,EAAE,CAAC;SACX,MAAM,CAAC;QACN,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,cAAc;KACvB,CAAC;SACD,MAAM,EAAE;IACX,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,MAAM,EAAE,mBAAmB;QAC3B,MAAM,EAAE,aAAa;KACtB,CAAC;SACD,MAAM,EAAE;IACX,MAAM,EAAE,CAAC,CAAC,kBAAkB,CAAC,gBAAgB,EAAE;QAC7C,CAAC,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;QACxD,CAAC;aACE,MAAM,CAAC;YACN,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;YACtC,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,mBAAmB;YAC7B,SAAS,EAAE,wBAAwB;SACpC,CAAC;aACD,MAAM,EAAE;KACZ,CAAC;CACH,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,6BAA6B,GAAG,mBAAmB,CAAC,IAAI,CACnE,mCAAmC,CACpC,CAAC"}

package/dist/cli/lib/contract/foreign-credentials.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Credentials that other Vendure products issue, and that a Vendure Cloud
+ * management request must never authenticate with.
+ *
+ * Two call sites read this file, and they are the two places a customer's
+ * credential is taken in: `resolveCredential` in the CLI, which refuses the
+ * value before it leaves the machine, and `AuthGuard` in the control plane,
+ * which refuses it again for every caller that is not this CLI. Restating
+ * either the prefixes or the refusal at one of those places would let them
+ * drift, and a drifted denylist is one that has a hole in it.
+ *
+ * `AdminGuard` and `StaffAuthGuard` also take a bearer token and are
+ * deliberately not covered. The token they verify is a staff session this
+ * platform issued and signs, checked locally against our own key, so a value
+ * from another Vendure product is refused there on its own and is never handed
+ * to anyone. The property this file protects — that a first-party credential
+ * is not forwarded to a third party — has nothing to reach on those routes.
+ *
+ * `vce_` is the project-scoped Environment Credential that Vendure Platform
+ * writes to `<projectRoot>/.vendure/credentials.json` and injects into a
+ * running Vendure process. `vcli_` and `vclr_` are the access and refresh
+ * halves of the user-scoped Console CLI Session in
+ * `~/.vendure/console-credentials.json`.
+ *
+ * Refusing `vcli_` is not the final answer for it — CLO-641 makes the Console
+ * session usable through a server-side exchange with Console. Until that
+ * exists, a Console session presented here is a credential Cloud cannot check,
+ * and the boundary says so rather than forwarding it.
+ */
+export declare const ENVIRONMENT_CREDENTIAL_PREFIX = "vce_";
+export declare const CONSOLE_SESSION_TOKEN_PREFIX = "vcli_";
+export declare const CONSOLE_REFRESH_TOKEN_PREFIX = "vclr_";
+export declare const ForeignCredential: {
+    readonly ENVIRONMENT: "environment";
+    readonly CONSOLE_SESSION: "consoleSession";
+    readonly CONSOLE_REFRESH: "consoleRefresh";
+};
+export type ForeignCredential = (typeof ForeignCredential)[keyof typeof ForeignCredential];
+/**
+ * Which foreign credential this value is, or null when it is none of them.
+ *
+ * A denylist, not a shape check. Anything that is not recognised here is left
+ * alone and validated as it always was, so a legitimate credential can never be
+ * turned away by this function.
+ */
+export declare function classifyForeignCredential(value: string): ForeignCredential | null;
+/** What the caller is told. One wording, so the CLI and the API agree. */
+export declare function foreignCredentialRefusal(kind: ForeignCredential): string;
+//# sourceMappingURL=foreign-credentials.d.ts.map

package/dist/cli/lib/contract/foreign-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"foreign-credentials.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/contract/foreign-credentials.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,eAAO,MAAM,6BAA6B,SAAS,CAAC;AACpD,eAAO,MAAM,4BAA4B,UAAU,CAAC;AACpD,eAAO,MAAM,4BAA4B,UAAU,CAAC;AAEpD,eAAO,MAAM,iBAAiB;;;;CAIpB,CAAC;AACX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAC;AAiB3F;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAOjF;AAED,0EAA0E;AAC1E,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAExE"}

package/dist/cli/lib/contract/foreign-credentials.js

@@ -0,0 +1,71 @@
+// Mirrors `@vendure-cloud/api-types`'s `foreign-credentials.ts`. See ./README.md for why this
+// package cannot import it, and `test/cli-contract-parity.test.ts` for what keeps the two
+// answering the same. The refusal wording is shared with the control plane's `AuthGuard`, so it
+// is reproduced exactly rather than reworded for this caller.
+/**
+ * Credentials that other Vendure products issue, and that a Vendure Cloud
+ * management request must never authenticate with.
+ *
+ * Two call sites read this file, and they are the two places a customer's
+ * credential is taken in: `resolveCredential` in the CLI, which refuses the
+ * value before it leaves the machine, and `AuthGuard` in the control plane,
+ * which refuses it again for every caller that is not this CLI. Restating
+ * either the prefixes or the refusal at one of those places would let them
+ * drift, and a drifted denylist is one that has a hole in it.
+ *
+ * `AdminGuard` and `StaffAuthGuard` also take a bearer token and are
+ * deliberately not covered. The token they verify is a staff session this
+ * platform issued and signs, checked locally against our own key, so a value
+ * from another Vendure product is refused there on its own and is never handed
+ * to anyone. The property this file protects — that a first-party credential
+ * is not forwarded to a third party — has nothing to reach on those routes.
+ *
+ * `vce_` is the project-scoped Environment Credential that Vendure Platform
+ * writes to `<projectRoot>/.vendure/credentials.json` and injects into a
+ * running Vendure process. `vcli_` and `vclr_` are the access and refresh
+ * halves of the user-scoped Console CLI Session in
+ * `~/.vendure/console-credentials.json`.
+ *
+ * Refusing `vcli_` is not the final answer for it — CLO-641 makes the Console
+ * session usable through a server-side exchange with Console. Until that
+ * exists, a Console session presented here is a credential Cloud cannot check,
+ * and the boundary says so rather than forwarding it.
+ */
+export const ENVIRONMENT_CREDENTIAL_PREFIX = "vce_";
+export const CONSOLE_SESSION_TOKEN_PREFIX = "vcli_";
+export const CONSOLE_REFRESH_TOKEN_PREFIX = "vclr_";
+export const ForeignCredential = {
+    ENVIRONMENT: "environment",
+    CONSOLE_SESSION: "consoleSession",
+    CONSOLE_REFRESH: "consoleRefresh",
+};
+const PREFIXES = [
+    [ENVIRONMENT_CREDENTIAL_PREFIX, ForeignCredential.ENVIRONMENT],
+    [CONSOLE_SESSION_TOKEN_PREFIX, ForeignCredential.CONSOLE_SESSION],
+    [CONSOLE_REFRESH_TOKEN_PREFIX, ForeignCredential.CONSOLE_REFRESH],
+];
+const REFUSALS = {
+    [ForeignCredential.ENVIRONMENT]: "A Vendure project environment credential cannot manage Vendure Cloud. It authenticates one environment of one project. Use a Vendure Cloud API key, or run `vcloud login`.",
+    [ForeignCredential.CONSOLE_SESSION]: "A Vendure Console session cannot manage Vendure Cloud. Use a Vendure Cloud API key, or run `vcloud login`.",
+    [ForeignCredential.CONSOLE_REFRESH]: "A Vendure Console refresh token is not a credential Vendure Cloud accepts. Use a Vendure Cloud API key, or run `vcloud login`.",
+};
+/**
+ * Which foreign credential this value is, or null when it is none of them.
+ *
+ * A denylist, not a shape check. Anything that is not recognised here is left
+ * alone and validated as it always was, so a legitimate credential can never be
+ * turned away by this function.
+ */
+export function classifyForeignCredential(value) {
+    for (const [prefix, kind] of PREFIXES) {
+        if (value.startsWith(prefix)) {
+            return kind;
+        }
+    }
+    return null;
+}
+/** What the caller is told. One wording, so the CLI and the API agree. */
+export function foreignCredentialRefusal(kind) {
+    return REFUSALS[kind];
+}
+//# sourceMappingURL=foreign-credentials.js.map

package/dist/cli/lib/contract/foreign-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"foreign-credentials.js","sourceRoot":"","sources":["../../../../src/cli/lib/contract/foreign-credentials.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,0FAA0F;AAC1F,gGAAgG;AAChG,8DAA8D;AAE9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC;AACpD,MAAM,CAAC,MAAM,4BAA4B,GAAG,OAAO,CAAC;AACpD,MAAM,CAAC,MAAM,4BAA4B,GAAG,OAAO,CAAC;AAEpD,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,WAAW,EAAE,aAAa;IAC1B,eAAe,EAAE,gBAAgB;IACjC,eAAe,EAAE,gBAAgB;CACzB,CAAC;AAGX,MAAM,QAAQ,GAAwD;IACpE,CAAC,6BAA6B,EAAE,iBAAiB,CAAC,WAAW,CAAC;IAC9D,CAAC,4BAA4B,EAAE,iBAAiB,CAAC,eAAe,CAAC;IACjE,CAAC,4BAA4B,EAAE,iBAAiB,CAAC,eAAe,CAAC;CAClE,CAAC;AAEF,MAAM,QAAQ,GAAsC;IAClD,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAC7B,4KAA4K;IAC9K,CAAC,iBAAiB,CAAC,eAAe,CAAC,EACjC,4GAA4G;IAC9G,CAAC,iBAAiB,CAAC,eAAe,CAAC,EACjC,gIAAgI;CACnI,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,wBAAwB,CAAC,IAAuB;IAC9D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC"}

package/dist/cli/lib/contract/logs.d.ts

@@ -0,0 +1,44 @@
+export declare const LOG_SERVICES: readonly ["server", "worker"];
+export type LogService = (typeof LOG_SERVICES)[number];
+export declare function isLogService(value: string): value is LogService;
+export interface LogEntry {
+    id: string;
+    timestamp: string;
+    message: string;
+    receivedAt?: string;
+    resumeCursor?: string;
+}
+export interface LogStreamErrorFrame {
+    streamError: {
+        statusCode: number;
+        message: string;
+    };
+}
+export interface LogStreamReconnectFrame {
+    streamReconnect: {
+        reason: "LIFETIME_EXPIRED";
+    };
+}
+export interface LogStreamTerminalFrame {
+    streamTerminal: {
+        reason: "BUILD_STEP_FINISHED";
+    };
+}
+export declare const BUILD_LOG_AVAILABILITY: readonly ["AVAILABLE", "NOT_STARTED", "NO_BUILD_STEP", "NO_OUTPUT", "EXPIRED"];
+export type BuildLogAvailability = (typeof BUILD_LOG_AVAILABILITY)[number];
+export interface BuildLogPage {
+    status: BuildLogAvailability;
+    items: LogEntry[];
+    nextCursor: string | null;
+}
+export declare function isLogEntry(value: unknown): value is {
+    id?: string;
+    timestamp?: string;
+    message: string;
+    receivedAt?: string;
+    resumeCursor?: string;
+};
+export declare function isLogStreamErrorFrame(value: unknown): value is LogStreamErrorFrame;
+export declare function isLogStreamReconnectFrame(value: unknown): value is LogStreamReconnectFrame;
+export declare function isLogStreamTerminalFrame(value: unknown): value is LogStreamTerminalFrame;
+//# sourceMappingURL=logs.d.ts.map

package/dist/cli/lib/contract/logs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logs.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/contract/logs.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,YAAY,+BAAgC,CAAC;AAC1D,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,UAAU,CAE/D;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE;QACX,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE;QACf,MAAM,EAAE,kBAAkB,CAAC;KAC5B,CAAC;CACH;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE;QACd,MAAM,EAAE,qBAAqB,CAAC;KAC/B,CAAC;CACH;AAOD,eAAO,MAAM,sBAAsB,gFAMzB,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,oBAAoB,CAAC;IAC7B,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAOD,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI;IACnD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAgBA;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CASlF;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,uBAAuB,CAQ1F;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,sBAAsB,CAQxF"}

package/dist/cli/lib/contract/logs.js

@@ -0,0 +1,66 @@
+// Mirrors the environment log and build log wire contract from `@vendure-cloud/api-types`'s
+// `index.ts`. See ./README.md for why this package cannot import it, including as types.
+//
+// `GET /environments/{id}/logs` returns `LogEntry[]`. `GET /environments/{id}/logs/stream`
+// (`?service=<LogService>&lines=<history replay count>`) is SSE: it replays recent history, then
+// tails; each frame's data is a JSON `LogEntry`. Handler-level failures cannot use an HTTP status,
+// because SSE commits the 200 before the handler runs, so they arrive as a single
+// `LogStreamErrorFrame` followed by a clean close — consumers gate on it the way they would gate on
+// the status. Keepalives are frames with empty data and SSE parsers drop them.
+export const LOG_SERVICES = ["server", "worker"];
+export function isLogService(value) {
+    return LOG_SERVICES.includes(value);
+}
+// NO_OUTPUT and EXPIRED are the same absence seen from two distances. A build can fail before it
+// has a log stream at all — a role or an image the build service cannot use fails it in its queued
+// phase, with no container and nothing written — and reporting that as EXPIRED tells a customer
+// their log aged out on a build that ran minutes ago. The reason for such a failure is on the VC
+// Deployment's own status message rather than in a log.
+export const BUILD_LOG_AVAILABILITY = [
+    "AVAILABLE",
+    "NOT_STARTED",
+    "NO_BUILD_STEP",
+    "NO_OUTPUT",
+    "EXPIRED",
+];
+// Runtime guards for stream consumers: each SSE frame is untrusted until
+// shape-checked — a drifted producer must never render garbage as log lines.
+// The guard deliberately accepts older producers without `id`/`timestamp`;
+// consumers can degrade display while the current producer contract remains
+// the stricter LogEntry interface above.
+export function isLogEntry(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const candidate = value;
+    return (typeof candidate.message === "string" &&
+        (candidate.id === undefined || typeof candidate.id === "string") &&
+        (candidate.timestamp === undefined || typeof candidate.timestamp === "string") &&
+        (candidate.receivedAt === undefined || typeof candidate.receivedAt === "string") &&
+        (candidate.resumeCursor === undefined || typeof candidate.resumeCursor === "string"));
+}
+export function isLogStreamErrorFrame(value) {
+    if (typeof value !== "object" || value === null || !("streamError" in value))
+        return false;
+    const candidate = value.streamError;
+    return (typeof candidate === "object" &&
+        candidate !== null &&
+        typeof candidate.statusCode === "number" &&
+        typeof candidate.message === "string");
+}
+export function isLogStreamReconnectFrame(value) {
+    if (typeof value !== "object" || value === null || !("streamReconnect" in value))
+        return false;
+    const candidate = value.streamReconnect;
+    return (typeof candidate === "object" &&
+        candidate !== null &&
+        candidate.reason === "LIFETIME_EXPIRED");
+}
+export function isLogStreamTerminalFrame(value) {
+    if (typeof value !== "object" || value === null || !("streamTerminal" in value))
+        return false;
+    const candidate = value.streamTerminal;
+    return (typeof candidate === "object" &&
+        candidate !== null &&
+        candidate.reason === "BUILD_STEP_FINISHED");
+}
+//# sourceMappingURL=logs.js.map

package/dist/cli/lib/contract/logs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logs.js","sourceRoot":"","sources":["../../../../src/cli/lib/contract/logs.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,yFAAyF;AACzF,EAAE;AACF,2FAA2F;AAC3F,iGAAiG;AACjG,mGAAmG;AACnG,kFAAkF;AAClF,oGAAoG;AACpG,+EAA+E;AAE/E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAG1D,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAQ,YAAkC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AA6BD,iGAAiG;AACjG,mGAAmG;AACnG,gGAAgG;AAChG,iGAAiG;AACjG,wDAAwD;AACxD,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,WAAW;IACX,aAAa;IACb,eAAe;IACf,WAAW;IACX,SAAS;CACD,CAAC;AASX,yEAAyE;AACzE,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,yCAAyC;AACzC,MAAM,UAAU,UAAU,CAAC,KAAc;IAOvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,SAAS,GAAG,KAMjB,CAAC;IACF,OAAO,CACL,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ;QACrC,CAAC,SAAS,CAAC,EAAE,KAAK,SAAS,IAAI,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ,CAAC;QAChE,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ,CAAC;QAC9E,CAAC,SAAS,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,CAAC;QAChF,CAAC,SAAS,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,SAAS,CAAC,YAAY,KAAK,QAAQ,CAAC,CACrF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,aAAa,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3F,MAAM,SAAS,GAAI,KAAkC,CAAC,WAAW,CAAC;IAClE,OAAO,CACL,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,KAAK,IAAI;QAClB,OAAQ,SAAsC,CAAC,UAAU,KAAK,QAAQ;QACtE,OAAQ,SAAmC,CAAC,OAAO,KAAK,QAAQ,CACjE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,iBAAiB,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/F,MAAM,SAAS,GAAI,KAAsC,CAAC,eAAe,CAAC;IAC1E,OAAO,CACL,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,KAAK,IAAI;QACjB,SAAkC,CAAC,MAAM,KAAK,kBAAkB,CAClE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,gBAAgB,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9F,MAAM,SAAS,GAAI,KAAqC,CAAC,cAAc,CAAC;IACxE,OAAO,CACL,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,KAAK,IAAI;QACjB,SAAkC,CAAC,MAAM,KAAK,qBAAqB,CACrE,CAAC;AACJ,CAAC"}

package/dist/cli/lib/contract/projects.d.ts

@@ -0,0 +1,31 @@
+import type { IdentityEnvironmentType, RuntimeIntent, RuntimeState, VcEnvironmentType } from "./wire-types.js";
+export interface ProjectResponse {
+    id: string;
+    name: string;
+    slug: string;
+    organizationId: string;
+    githubRepoUrl: string | null;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface ProjectEnvironmentSummaryResponse {
+    id: string;
+    name: string;
+    slug: string;
+    type: IdentityEnvironmentType;
+    desiredStateType: VcEnvironmentType;
+    status: string | null;
+    runtimeHealth: string;
+    runtimeIntent: RuntimeIntent | null;
+    runtimeState: RuntimeState;
+    lastDeployedAt: string | null;
+}
+export interface ProjectDetailsResponse extends ProjectResponse {
+    envs: ProjectEnvironmentSummaryResponse[];
+}
+export interface ResourceDeletionResponse {
+    deleted: true;
+    id: string;
+    slug: string;
+}
+//# sourceMappingURL=projects.d.ts.map

package/dist/cli/lib/contract/projects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projects.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/contract/projects.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,uBAAuB,EACvB,aAAa,EACb,YAAY,EACZ,iBAAiB,EAClB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iCAAiC;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,uBAAuB,CAAC;IAC9B,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,YAAY,EAAE,YAAY,CAAC;IAC3B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,sBAAuB,SAAQ,eAAe;IAC7D,IAAI,EAAE,iCAAiC,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,IAAI,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd"}

package/dist/cli/lib/contract/projects.js

@@ -0,0 +1,9 @@
+// Mirrors the VC Project response shapes from `@vendure-cloud/api-types`'s `index.ts`, and the
+// answer both delete commands read. See ./README.md for why this package cannot import them,
+// including as types.
+//
+// `ResourceDeletionResponse` is one shape shared by two families: deleting a VC Project and
+// deleting a VC Environment are answered the same way. It is declared here once rather than in both
+// areas, so the two families cannot end up describing that answer differently.
+export {};
+//# sourceMappingURL=projects.js.map

package/dist/cli/lib/contract/projects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projects.js","sourceRoot":"","sources":["../../../../src/cli/lib/contract/projects.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,6FAA6F;AAC7F,sBAAsB;AACtB,EAAE;AACF,4FAA4F;AAC5F,oGAAoG;AACpG,+EAA+E"}

package/dist/cli/lib/contract/public-error-details.d.ts

@@ -0,0 +1,4 @@
+import { type DeploymentResourceLabelContext } from "./deployment-resource-labels.js";
+export declare function formatUserFacingErrorDetails(error: string, context?: DeploymentResourceLabelContext): string;
+export declare function formatInlineUserFacingErrorReason(error: string, context?: DeploymentResourceLabelContext): string;
+//# sourceMappingURL=public-error-details.d.ts.map

package/dist/cli/lib/contract/public-error-details.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-error-details.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/contract/public-error-details.ts"],"names":[],"mappings":"AAaA,OAAO,EACL,KAAK,8BAA8B,EAEpC,MAAM,iCAAiC,CAAC;AAiDzC,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,8BAA8B,GACvC,MAAM,CAMR;AAED,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,8BAA8B,GACvC,MAAM,CAER"}