@verentis/cli 0.2.5 → 0.2.7

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { Command } from 'commander';
 import { mkdir, stat, writeFile, readFile, readdir, realpath, mkdtemp, rm, glob } from 'fs/promises';
+import { Agent } from 'https';
 import { tmpdir, homedir } from 'os';
 import { resolve, basename, dirname, posix, join, isAbsolute, extname, relative, sep } from 'path';
 import { spawn, spawnSync } from 'child_process';
@@ -12,6 +13,10 @@ import { pipeline } from 'stream/promises';
 import * as tar from 'tar';
 import { fileURLToPath } from 'url';
 
+var insecureAgent = new Agent({ rejectUnauthorized: false });
+function insecureFetchOptions(insecure) {
+  return insecure ? { dispatcher: insecureAgent } : {};
+}
 var configDir = () => process.env.VERENTIS_CONFIG_DIR ?? join(homedir(), ".verentis");
 var configPath = () => join(configDir(), "config.json");
 var keysDir = () => join(configDir(), "keys");
@@ -53,11 +58,12 @@ function isExpired(token, skewSeconds = 60) {
 
 // src/auth/deviceFlow.ts
 var CLI_CLIENT_ID = "Verentis.Cli";
-async function startDeviceAuthorization(apiUrl) {
+async function startDeviceAuthorization(apiUrl, insecure) {
   const res = await fetch(`${apiUrl}/connect/device/authorize`, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({ client_id: CLI_CLIENT_ID })
+    body: new URLSearchParams({ client_id: CLI_CLIENT_ID }),
+    ...insecureFetchOptions(insecure)
   });
   if (!res.ok) {
     const text = await res.text().catch(() => "");
@@ -65,7 +71,7 @@ async function startDeviceAuthorization(apiUrl) {
   }
   return await res.json();
 }
-async function pollForIdentityToken(apiUrl, authorization, onPoll) {
+async function pollForIdentityToken(apiUrl, authorization, insecure, onPoll) {
   let intervalMs = Math.max(authorization.interval, 1) * 1e3;
   const deadline = Date.now() + authorization.expires_in * 1e3;
   while (Date.now() < deadline) {
@@ -78,7 +84,8 @@ async function pollForIdentityToken(apiUrl, authorization, onPoll) {
         grant_type: "device_code",
         device_code: authorization.device_code,
         client_id: CLI_CLIENT_ID
-      })
+      }),
+      ...insecureFetchOptions(insecure)
     });
     let payload;
     try {
@@ -107,7 +114,7 @@ async function pollForIdentityToken(apiUrl, authorization, onPoll) {
 }
 var RefreshTokenError = class extends Error {
 };
-async function refreshIdentityToken(apiUrl, refreshToken) {
+async function refreshIdentityToken(apiUrl, refreshToken, insecure) {
   const res = await fetch(`${apiUrl}/connect/token`, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
@@ -115,7 +122,8 @@ async function refreshIdentityToken(apiUrl, refreshToken) {
       grant_type: "refresh_token",
       refresh_token: refreshToken,
       client_id: CLI_CLIENT_ID
-    })
+    }),
+    ...insecureFetchOptions(insecure)
   });
   let payload;
   try {
@@ -146,6 +154,7 @@ var AUDIENCE = "verentis";
 async function createApiClient(overrides) {
   const config = { ...await loadConfig(), ...overrides };
   const apiUrl = requireApiUrl(config);
+  const insecure = config.insecure;
   const tokenCache = /* @__PURE__ */ new Map();
   const envIdentity = process.env.VERENTIS_TOKEN;
   let currentIdentity = envIdentity ?? config.identityToken;
@@ -172,7 +181,7 @@ async function createApiClient(overrides) {
     if (!refreshInflight) {
       refreshInflight = (async () => {
         try {
-          const refreshed = await refreshIdentityToken(apiUrl, currentRefresh);
+          const refreshed = await refreshIdentityToken(apiUrl, currentRefresh, insecure);
           currentIdentity = refreshed.idToken;
           currentRefresh = refreshed.refreshToken ?? currentRefresh;
           await persistTokens(refreshed.idToken, refreshed.refreshToken);
@@ -217,7 +226,8 @@ async function createApiClient(overrides) {
         ...options.workspaceId ? { workspaceId: options.workspaceId } : {},
         ...options.accountId ? { accountId: options.accountId } : {},
         ...options.resourceId ? { resourceId: options.resourceId, resourceKind: options.resourceKind ?? "Node" } : {}
-      })
+      }),
+      ...insecureFetchOptions(insecure)
     });
     if (!res.ok) {
       const text = await res.text().catch(() => "");
@@ -244,7 +254,7 @@ ${truncate(text)}` : ""}`);
       headers["Content-Type"] = "application/json";
     }
     for (const [key, value] of Object.entries(options.headers ?? {})) headers[key] = value;
-    const res = await fetch(url, { method, headers, body, ...options.rawBody !== void 0 ? { duplex: "half" } : {} });
+    const res = await fetch(url, { method, headers, body, ...insecureFetchOptions(insecure), ...options.rawBody !== void 0 ? { duplex: "half" } : {} });
     if (!res.ok) {
       const text = await res.text().catch(() => "");
       throw new ApiError(res.status, `${method} ${path} failed (${res.status}). ${hintFor(res.status)}${formatErrorBody(text)}`);
@@ -1028,6 +1038,7 @@ function validateManifest(manifest) {
     validateApplicationLaunch(spec, issues);
   }
   validateInstallDirectives(spec.install, issues);
+  validateSettingDeclarations(kind, spec, issues);
   for (const message of validateMarketplaceSection(manifest.marketplace)) error(message);
   const packaging = manifest.packaging ?? {};
   if (!packaging.publisher) warning("packaging.publisher is not set \u2014 `verentis pack`/`publish` will refuse the package");
@@ -1110,6 +1121,72 @@ function validateInstallDirectives(install, issues) {
     }
   });
 }
+var SETTING_KEY_PATTERN = /^[a-z0-9]+([.-][a-z0-9]+)*$/;
+var ENV_VAR_PATTERN = /^[A-Z][A-Z0-9_]*$/;
+var SETTING_TYPES = ["string", "number", "boolean", "select"];
+function validateSettingDeclarations(kind, spec, issues) {
+  const settings2 = spec.settings;
+  if (settings2 === void 0) return;
+  const error = (message) => issues.push({ level: "error", message });
+  if (!Array.isArray(settings2)) {
+    error("spec.settings must be a list of setting declarations");
+    return;
+  }
+  const seen = /* @__PURE__ */ new Set();
+  settings2.forEach((declaration, index) => {
+    const at = `spec.settings[${index}]`;
+    if (!declaration || typeof declaration !== "object" || Array.isArray(declaration)) {
+      error(`${at} must be an object with at least a 'key'`);
+      return;
+    }
+    if (!declaration.key || typeof declaration.key !== "string") {
+      error(`${at}.key is required (short key, stored namespaced as '{metadata.name}.{key}')`);
+    } else if (!SETTING_KEY_PATTERN.test(declaration.key)) {
+      error(`${at}.key '${declaration.key}' must be lowercase kebab/dot notation (e.g. 'api-key' or 'smtp.host')`);
+    } else if (seen.has(declaration.key)) {
+      error(`${at}.key '${declaration.key}' is declared more than once`);
+    } else {
+      seen.add(declaration.key);
+    }
+    if (declaration.env !== void 0) {
+      if (typeof declaration.env !== "string" || !ENV_VAR_PATTERN.test(declaration.env)) {
+        error(`${at}.env must be an environment variable name (UPPER_SNAKE_CASE, e.g. 'MY_API_KEY')`);
+      } else if (declaration.env.startsWith("VERENTIS_")) {
+        error(`${at}.env must not use the reserved 'VERENTIS_' prefix`);
+      }
+    }
+    for (const flag of ["secret", "required"]) {
+      if (declaration[flag] !== void 0 && typeof declaration[flag] !== "boolean") {
+        error(`${at}.${flag} must be a boolean`);
+      }
+    }
+    const type = declaration.type ?? "string";
+    if (typeof type !== "string" || !SETTING_TYPES.includes(type)) {
+      error(`${at}.type must be one of ${SETTING_TYPES.join(", ")} (got '${String(declaration.type)}')`);
+    }
+    if (declaration.secret === true && declaration.default !== void 0) {
+      error(`${at} declares a default for a secret \u2014 secrets must never ship default values`);
+    }
+    if (type === "select") {
+      if (!Array.isArray(declaration.options) || declaration.options.length === 0) {
+        error(`${at}.options is required for type 'select'`);
+      }
+    } else if (declaration.options !== void 0) {
+      error(`${at}.options is only allowed for type 'select'`);
+    }
+  });
+  if (kind === "ExecutionEngine") {
+    const declaresSecret = settings2.some(
+      (declaration) => declaration && typeof declaration === "object" && declaration.secret === true
+    );
+    const runtimes = spec.runtimes ?? {};
+    if (declaresSecret && !runtimes["docker"]) {
+      error(
+        "spec.settings declares secrets but the engine has no docker runtime \u2014 secrets are server-only and cannot be provisioned into browser (wasm) runs"
+      );
+    }
+  }
+}
 
 // src/commands/dev.ts
 async function resolveDevScopes(flags) {
@@ -1917,10 +1994,11 @@ function registerKeygen(program2) {
 
 // src/commands/login.ts
 function registerLogin(program2) {
-  program2.command("login").description("Sign in to Verentis (browser device flow by default; --api-key/--token for non-interactive use)").option("--api-url <url>", "Verentis API gateway URL").option("--api-key <key>", "Verentis API key (vrt_...)").option("--token <token>", "Verentis identity token (exchanged per request for scoped access tokens)").option("--sealing-key <key>", "the platform's base64 X25519 sealing PUBLIC key (used by `pack --encrypt`)").action(async (options) => {
+  program2.command("login").description("Sign in to Verentis (browser device flow by default; --api-key/--token for non-interactive use)").option("--api-url <url>", "Verentis API gateway URL").option("--api-key <key>", "Verentis API key (vrt_...)").option("--token <token>", "Verentis identity token (exchanged per request for scoped access tokens)").option("--sealing-key <key>", "the platform's base64 X25519 sealing PUBLIC key (used by `pack --encrypt`)").option("--insecure", "skip TLS certificate verification (for local dev with self-signed certs)").action(async (options) => {
     const config = await loadConfig();
     if (options.apiUrl) config.apiUrl = options.apiUrl;
     if (options.sealingKey) config.sealingPublicKey = options.sealingKey;
+    if (options.insecure !== void 0) config.insecure = options.insecure;
     if (!config.apiUrl) throw new Error("An API URL is required. Pass --api-url <url>.");
     if (options.apiKey) {
       if (!options.apiKey.startsWith("vrt_")) throw new Error('API keys start with "vrt_".');
@@ -1940,14 +2018,15 @@ function registerLogin(program2) {
       return;
     }
     const apiUrl = config.apiUrl.replace(/\/+$/, "");
-    const authorization = await startDeviceAuthorization(apiUrl);
+    const insecure = config.insecure;
+    const authorization = await startDeviceAuthorization(apiUrl, insecure);
     console.log("To sign in, open this URL in a browser:");
     console.log(`
   ${authorization.verification_uri_complete ?? authorization.verification_uri}
 `);
     console.log(`and confirm the code: ${authorization.user_code}`);
     console.log("\nWaiting for approval\u2026");
-    const identity = await pollForIdentityToken(apiUrl, authorization, () => process.stderr.write("."));
+    const identity = await pollForIdentityToken(apiUrl, authorization, insecure, () => process.stderr.write("."));
     process.stderr.write("\n");
     config.identityToken = identity.idToken;
     if (identity.refreshToken) config.refreshToken = identity.refreshToken;