@verentis/cli 0.2.5 → 0.2.6

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { Command } from 'commander';
 import { mkdir, stat, writeFile, readFile, readdir, realpath, mkdtemp, rm, glob } from 'fs/promises';
+import { Agent } from 'https';
 import { tmpdir, homedir } from 'os';
 import { resolve, basename, dirname, posix, join, isAbsolute, extname, relative, sep } from 'path';
 import { spawn, spawnSync } from 'child_process';
@@ -12,6 +13,10 @@ import { pipeline } from 'stream/promises';
 import * as tar from 'tar';
 import { fileURLToPath } from 'url';
 
+var insecureAgent = new Agent({ rejectUnauthorized: false });
+function insecureFetchOptions(insecure) {
+  return insecure ? { dispatcher: insecureAgent } : {};
+}
 var configDir = () => process.env.VERENTIS_CONFIG_DIR ?? join(homedir(), ".verentis");
 var configPath = () => join(configDir(), "config.json");
 var keysDir = () => join(configDir(), "keys");
@@ -53,11 +58,12 @@ function isExpired(token, skewSeconds = 60) {
 
 // src/auth/deviceFlow.ts
 var CLI_CLIENT_ID = "Verentis.Cli";
-async function startDeviceAuthorization(apiUrl) {
+async function startDeviceAuthorization(apiUrl, insecure) {
   const res = await fetch(`${apiUrl}/connect/device/authorize`, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({ client_id: CLI_CLIENT_ID })
+    body: new URLSearchParams({ client_id: CLI_CLIENT_ID }),
+    ...insecureFetchOptions(insecure)
   });
   if (!res.ok) {
     const text = await res.text().catch(() => "");
@@ -65,7 +71,7 @@ async function startDeviceAuthorization(apiUrl) {
   }
   return await res.json();
 }
-async function pollForIdentityToken(apiUrl, authorization, onPoll) {
+async function pollForIdentityToken(apiUrl, authorization, insecure, onPoll) {
   let intervalMs = Math.max(authorization.interval, 1) * 1e3;
   const deadline = Date.now() + authorization.expires_in * 1e3;
   while (Date.now() < deadline) {
@@ -78,7 +84,8 @@ async function pollForIdentityToken(apiUrl, authorization, onPoll) {
         grant_type: "device_code",
         device_code: authorization.device_code,
         client_id: CLI_CLIENT_ID
-      })
+      }),
+      ...insecureFetchOptions(insecure)
     });
     let payload;
     try {
@@ -107,7 +114,7 @@ async function pollForIdentityToken(apiUrl, authorization, onPoll) {
 }
 var RefreshTokenError = class extends Error {
 };
-async function refreshIdentityToken(apiUrl, refreshToken) {
+async function refreshIdentityToken(apiUrl, refreshToken, insecure) {
   const res = await fetch(`${apiUrl}/connect/token`, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
@@ -115,7 +122,8 @@ async function refreshIdentityToken(apiUrl, refreshToken) {
       grant_type: "refresh_token",
       refresh_token: refreshToken,
       client_id: CLI_CLIENT_ID
-    })
+    }),
+    ...insecureFetchOptions(insecure)
   });
   let payload;
   try {
@@ -146,6 +154,7 @@ var AUDIENCE = "verentis";
 async function createApiClient(overrides) {
   const config = { ...await loadConfig(), ...overrides };
   const apiUrl = requireApiUrl(config);
+  const insecure = config.insecure;
   const tokenCache = /* @__PURE__ */ new Map();
   const envIdentity = process.env.VERENTIS_TOKEN;
   let currentIdentity = envIdentity ?? config.identityToken;
@@ -172,7 +181,7 @@ async function createApiClient(overrides) {
     if (!refreshInflight) {
       refreshInflight = (async () => {
         try {
-          const refreshed = await refreshIdentityToken(apiUrl, currentRefresh);
+          const refreshed = await refreshIdentityToken(apiUrl, currentRefresh, insecure);
           currentIdentity = refreshed.idToken;
           currentRefresh = refreshed.refreshToken ?? currentRefresh;
           await persistTokens(refreshed.idToken, refreshed.refreshToken);
@@ -217,7 +226,8 @@ async function createApiClient(overrides) {
         ...options.workspaceId ? { workspaceId: options.workspaceId } : {},
         ...options.accountId ? { accountId: options.accountId } : {},
         ...options.resourceId ? { resourceId: options.resourceId, resourceKind: options.resourceKind ?? "Node" } : {}
-      })
+      }),
+      ...insecureFetchOptions(insecure)
     });
     if (!res.ok) {
       const text = await res.text().catch(() => "");
@@ -244,7 +254,7 @@ ${truncate(text)}` : ""}`);
       headers["Content-Type"] = "application/json";
     }
     for (const [key, value] of Object.entries(options.headers ?? {})) headers[key] = value;
-    const res = await fetch(url, { method, headers, body, ...options.rawBody !== void 0 ? { duplex: "half" } : {} });
+    const res = await fetch(url, { method, headers, body, ...insecureFetchOptions(insecure), ...options.rawBody !== void 0 ? { duplex: "half" } : {} });
     if (!res.ok) {
       const text = await res.text().catch(() => "");
       throw new ApiError(res.status, `${method} ${path} failed (${res.status}). ${hintFor(res.status)}${formatErrorBody(text)}`);
@@ -1917,10 +1927,11 @@ function registerKeygen(program2) {
 
 // src/commands/login.ts
 function registerLogin(program2) {
-  program2.command("login").description("Sign in to Verentis (browser device flow by default; --api-key/--token for non-interactive use)").option("--api-url <url>", "Verentis API gateway URL").option("--api-key <key>", "Verentis API key (vrt_...)").option("--token <token>", "Verentis identity token (exchanged per request for scoped access tokens)").option("--sealing-key <key>", "the platform's base64 X25519 sealing PUBLIC key (used by `pack --encrypt`)").action(async (options) => {
+  program2.command("login").description("Sign in to Verentis (browser device flow by default; --api-key/--token for non-interactive use)").option("--api-url <url>", "Verentis API gateway URL").option("--api-key <key>", "Verentis API key (vrt_...)").option("--token <token>", "Verentis identity token (exchanged per request for scoped access tokens)").option("--sealing-key <key>", "the platform's base64 X25519 sealing PUBLIC key (used by `pack --encrypt`)").option("--insecure", "skip TLS certificate verification (for local dev with self-signed certs)").action(async (options) => {
     const config = await loadConfig();
     if (options.apiUrl) config.apiUrl = options.apiUrl;
     if (options.sealingKey) config.sealingPublicKey = options.sealingKey;
+    if (options.insecure !== void 0) config.insecure = options.insecure;
     if (!config.apiUrl) throw new Error("An API URL is required. Pass --api-url <url>.");
     if (options.apiKey) {
       if (!options.apiKey.startsWith("vrt_")) throw new Error('API keys start with "vrt_".');
@@ -1940,14 +1951,15 @@ function registerLogin(program2) {
       return;
     }
     const apiUrl = config.apiUrl.replace(/\/+$/, "");
-    const authorization = await startDeviceAuthorization(apiUrl);
+    const insecure = config.insecure;
+    const authorization = await startDeviceAuthorization(apiUrl, insecure);
     console.log("To sign in, open this URL in a browser:");
     console.log(`
   ${authorization.verification_uri_complete ?? authorization.verification_uri}
 `);
     console.log(`and confirm the code: ${authorization.user_code}`);
     console.log("\nWaiting for approval\u2026");
-    const identity = await pollForIdentityToken(apiUrl, authorization, () => process.stderr.write("."));
+    const identity = await pollForIdentityToken(apiUrl, authorization, insecure, () => process.stderr.write("."));
     process.stderr.write("\n");
     config.identityToken = identity.idToken;
     if (identity.refreshToken) config.refreshToken = identity.refreshToken;