@volcano.dev/cli 0.0.4

package/LICENSE

@@ -0,0 +1,184 @@
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and
+distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by the copyright
+owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all other entities
+that control, are controlled by, or are under common control with that entity.
+For the purposes of this definition, "control" means (i) the power, direct or
+indirect, to cause the direction or management of such entity, whether by
+contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the
+outstanding shares, or (iii) beneficial ownership of such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising
+permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications, including
+but not limited to software source code, documentation source, and configuration
+files.
+
+"Object" form shall mean any form resulting from mechanical transformation or
+translation of a Source form, including but not limited to compiled object code,
+generated documentation, and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object form,
+made available under the License, as indicated by a copyright notice that is
+included in or attached to the work (an example is provided in the Appendix
+below).
+
+"Derivative Works" shall mean any work, whether in Source or Object form, that
+is based on (or derived from) the Work and for which the editorial revisions,
+annotations, elaborations, or other modifications represent, as a whole, an
+original work of authorship. For the purposes of this License, Derivative Works
+shall not include works that remain separable from, or merely link (or bind by
+name) to the interfaces of, the Work and Derivative Works thereof.
+
+"Contribution" shall mean any work of authorship, including the original version
+of the Work and any modifications or additions to that Work or Derivative Works
+thereof, that is intentionally submitted to Licensor for inclusion in the Work
+by the copyright owner or by an individual or Legal Entity authorized to submit
+on behalf of the copyright owner. For the purposes of this definition,
+"submitted" means any form of electronic, verbal, or written communication sent
+to the Licensor or its representatives, including but not limited to
+communication on electronic mailing lists, source code control systems, and
+issue tracking systems that are managed by, or on behalf of, the Licensor for
+the purpose of discussing and improving the Work, but excluding communication
+that is conspicuously marked or otherwise designated in writing by the copyright
+owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity on behalf
+of whom a Contribution has been received by Licensor and subsequently
+incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of this
+License, each Contributor hereby grants to You a perpetual, worldwide,
+non-exclusive, no-charge, royalty-free, irrevocable copyright license to
+reproduce, prepare Derivative Works of, publicly display, publicly perform,
+sublicense, and distribute the Work and such Derivative Works in Source or
+Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of this License,
+each Contributor hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable (except as stated in this section) patent
+license to make, have made, use, offer to sell, sell, import, and otherwise
+transfer the Work, where such license applies only to those patent claims
+licensable by such Contributor that are necessarily infringed by their
+Contribution(s) alone or by combination of their Contribution(s) with the Work
+to which such Contribution(s) was submitted. If You institute patent litigation
+against any entity (including a cross-claim or counterclaim in a lawsuit)
+alleging that the Work or a Contribution incorporated within the Work
+constitutes direct or contributory patent infringement, then any patent licenses
+granted to You under this License for that Work shall terminate as of the date
+such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the Work or
+Derivative Works thereof in any medium, with or without modifications, and in
+Source or Object form, provided that You meet the following conditions:
+
+(a) You must give any other recipients of the Work or Derivative Works a copy of
+this License; and
+
+(b) You must cause any modified files to carry prominent notices stating that
+You changed the files; and
+
+(c) You must retain, in the Source form of any Derivative Works that You
+distribute, all copyright, patent, trademark, and attribution notices from the
+Source form of the Work, excluding those notices that do not pertain to any part
+of the Derivative Works; and
+
+(d) If the Work includes a "NOTICE" text file as part of its distribution, then
+any Derivative Works that You distribute must include a readable copy of the
+attribution notices contained within such NOTICE file, excluding those notices
+that do not pertain to any part of the Derivative Works, in at least one of the
+following places: within a NOTICE text file distributed as part of the
+Derivative Works; within the Source form or documentation, if provided along
+with the Derivative Works; or, within a display generated by the Derivative
+Works, if and wherever such third-party notices normally appear. The contents of
+the NOTICE file are for informational purposes only and do not modify the
+License. You may add Your own attribution notices within Derivative Works that
+You distribute, alongside or as an addendum to the NOTICE text from the Work,
+provided that such additional attribution notices cannot be construed as
+modifying the License.
+
+You may add Your own copyright statement to Your modifications and may provide
+additional or different license terms and conditions for use, reproduction, or
+distribution of Your modifications, or for any such Derivative Works as a whole,
+provided Your use, reproduction, and distribution of the Work otherwise complies
+with the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise, any
+Contribution intentionally submitted for inclusion in the Work by You to the
+Licensor shall be under the terms and conditions of this License, without any
+additional terms or conditions. Notwithstanding the above, nothing herein shall
+supersede or modify the terms of any separate license agreement you may have
+executed with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade names,
+trademarks, service marks, or product names of the Licensor, except as required
+for reasonable and customary use in describing the origin of the Work and
+reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or agreed to in
+writing, Licensor provides the Work (and each Contributor provides its
+Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied, including, without limitation, any warranties
+or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+PARTICULAR PURPOSE. You are solely responsible for determining the
+appropriateness of using or redistributing the Work and assume any risks
+associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory, whether in
+tort (including negligence), contract, or otherwise, unless required by
+applicable law (such as deliberate and grossly negligent acts) or agreed to in
+writing, shall any Contributor be liable to You for damages, including any
+direct, indirect, special, incidental, or consequential damages of any character
+arising as a result of this License or out of the use or inability to use the
+Work (including but not limited to damages for loss of goodwill, work stoppage,
+computer failure or malfunction, or any and all other commercial damages or
+losses), even if such Contributor has been advised of the possibility of such
+damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing the Work or
+Derivative Works thereof, You may choose to offer, and charge a fee for,
+acceptance of support, warranty, indemnity, or other liability obligations
+and/or rights consistent with this License. However, in accepting such
+obligations, You may act only on Your own behalf and on Your sole
+responsibility, not on behalf of any other Contributor, and only if You agree to
+indemnify, defend, and hold each Contributor harmless for any liability incurred
+by, or claims asserted against, such Contributor by reason of your accepting any
+such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+To apply the Apache License to your work, attach the following boilerplate
+notice, with the fields enclosed by brackets "[]" replaced with your own
+identifying information. (Don't include the brackets!) The text should be
+enclosed in the appropriate comment syntax for the file format. We also
+recommend that a file or class name and description of purpose be included on
+the same "printed page" as the copyright notice for easier identification within
+third-party archives.
+
+Copyright 2026 Kong Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/README.md

@@ -0,0 +1,144 @@
+# volcano-cli
+
+`volcano` is the command-line client for Volcano, Kong's hosting platform.
+It provides local development workflows and hosted API commands from a
+standalone Go CLI.
+
+## Quickstart
+
+Install the latest published release:
+
+```bash
+curl -fsSL https://github.com/Kong/volcano-cli/releases/latest/download/install.sh | bash
+```
+
+Or install from npm:
+
+```bash
+npm install -g @volcano.dev/cli
+volcano --help
+```
+
+The npm package is a thin wrapper: its `postinstall` step downloads the
+platform-specific binary from the matching GitHub Release and verifies it
+against that release's `SHA256SUMS`. Set `VOLCANO_SKIP_DOWNLOAD=1` to skip the
+download (it is fetched on first run instead).
+
+Build from source:
+
+```bash
+make build
+./volcano --help
+./volcano --version
+make test
+```
+
+From the CLI checkout, create an empty sibling project directory and run it:
+
+```bash
+VOLCANO_CLI="$(pwd)/volcano"
+mkdir ../volcano-quickstart
+cd ../volcano-quickstart
+"$VOLCANO_CLI" init javascript
+"$VOLCANO_CLI" start
+"$VOLCANO_CLI" variables deploy
+"$VOLCANO_CLI" functions deploy --all
+"$VOLCANO_CLI" config deploy
+"$VOLCANO_CLI" migrations deploy --all -d app
+```
+
+`volcano init` without a template creates a base scaffold (environment
+files, migrations directory, and README). Use a template to add
+language-specific files: `javascript` (aliases: `js`, `node`, `nodejs`),
+`nextjs`, `python`, or `ruby`.
+
+## Authentication
+
+New to Volcano? Create an account from the CLI:
+
+```bash
+volcano signup
+```
+
+`volcano signup` prefills your email from `git config --global user.email`
+when available (press Enter to accept, or type a different address), then
+opens Volcano's web signup flow in your browser. Once you finish in the
+browser, the CLI completes the device-authorization handshake and saves your
+credentials to `~/.volcano/config.json` — so a single command signs you up
+**and** logs you in.
+
+Already have an account? Authenticate with `volcano login`:
+
+```bash
+# Browser-based login (default)
+volcano login
+
+# Token-based login (for CI/CD)
+volcano login --token pk-xxxxxxxxxx
+
+# Or skip login entirely with an environment variable
+export VOLCANO_TOKEN=pk-xxxxxxxxxx
+```
+
+Log out at any time (this deletes local credentials but does not revoke the
+token — revoke it in the Volcano dashboard to fully cut off access):
+
+```bash
+volcano logout
+```
+
+To target a non-production environment, set `VOLCANO_API_URL` to that backend's
+API endpoint. `volcano signup` then opens the signup page on the **same**
+environment the API points at — it follows the device-flow verification URL,
+just like `volcano login` — so you normally don't need anything else. Set
+`VOLCANO_WEB_URL` only to force a specific web origin.
+
+## Project configuration (`volcano-config.yaml`)
+
+`volcano config deploy` reconciles declarative project configuration
+(`volcano/volcano-config.yaml` or `./volcano-config.yaml`) against the active
+target — the same manifest applies to local mode and cloud.
+
+Functions may declare scheduled invocations. `name` and `cron` are required;
+`enabled` (default `true`), `payload`, and `regions` are optional. A function
+entry is valid if it sets `public` **or** declares at least one scheduler.
+
+```yaml
+version: 1
+functions:
+  - name: hello
+    public: false
+    schedulers:
+      - name: refresh-cache      # required, unique per function (the reconcile key)
+        cron: "*/5 * * * *"
+        enabled: true
+        payload: { job: refresh }
+        regions: [us-east-1]     # omit to let the server pick one deployed region
+```
+
+Reconciliation follows one rule that mirrors the server: **fields you declare
+are enforced; fields you omit are left server-managed.** An omitted `enabled`,
+`payload`, or `regions` keeps whatever the scheduler already has on the server
+(on first create the server applies its defaults — `enabled: true`, an empty
+payload, and one chosen region). In particular, `config deploy` will not
+re-enable a scheduler you disabled out of band unless the manifest sets
+`enabled: true`. `cron` is always required and enforced.
+
+Reconciliation is also **non-destructive**: it creates and updates the
+schedulers a function declares (matched by `name`, preserving the scheduler ID)
+but never deletes or disables one. A scheduler the manifest no longer declares
+is left running; to remove or disable one, use the imperative commands
+(`volcano functions schedulers delete` / `disable`).
+
+## Contributing
+
+See `CONTRIBUTING.md` for local workflows, generated-code guidance, release
+notes, and pull request expectations. Participation is governed by
+`CODE_OF_CONDUCT.md`.
+
+If you believe you have found a security vulnerability, do not open a public
+issue. Follow `SECURITY.md` instead.
+
+## License
+
+Volcano CLI is licensed under the Apache License, Version 2.0. See `LICENSE`.

package/bin/volcano.js

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+'use strict';
+
+// Launcher shim: exec the platform-specific Volcano CLI binary, forwarding all
+// arguments, stdio, and the exit code. If the binary is missing (e.g. install
+// ran with --ignore-scripts, or the postinstall download failed) it is fetched
+// and verified on demand.
+
+const fs = require('fs');
+const { spawn } = require('child_process');
+const { binaryPath, ensureBinary } = require('../scripts/npm/download.js');
+
+async function resolveBinary() {
+  try {
+    const bin = binaryPath();
+    if (fs.existsSync(bin)) {
+      return bin;
+    }
+    return await ensureBinary();
+  } catch (err) {
+    // Covers both download failures and unsupported platforms: binaryPath() ->
+    // resolveTarget() throws for e.g. Windows arm64, which passes the
+    // package.json os/cpu gate but has no published binary.
+    console.error(`volcano: could not obtain the CLI binary: ${err.message}`);
+    console.error(
+      'Install it manually from https://github.com/Kong/volcano-cli/releases ' +
+        'or re-install the package.'
+    );
+    process.exit(1);
+  }
+}
+
+async function main() {
+  const bin = await resolveBinary();
+  const child = spawn(bin, process.argv.slice(2), { stdio: 'inherit' });
+
+  child.on('error', (err) => {
+    console.error(`volcano: failed to launch binary: ${err.message}`);
+    process.exit(1);
+  });
+
+  child.on('exit', (code, signal) => {
+    if (signal) {
+      // Re-raise the signal so the parent reflects the child's termination.
+      process.kill(process.pid, signal);
+      return;
+    }
+    process.exit(code == null ? 1 : code);
+  });
+}
+
+main().catch((err) => {
+  // Last-resort guard so failures never surface as an unhandled rejection.
+  console.error(`volcano: ${err.message}`);
+  process.exit(1);
+});

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "@volcano.dev/cli",
+  "version": "0.0.4",
+  "description": "Command-line client for Volcano, Kong's hosting platform.",
+  "keywords": [
+    "volcano",
+    "kong",
+    "cli"
+  ],
+  "homepage": "https://github.com/Kong/volcano-cli#readme",
+  "bugs": {
+    "url": "https://github.com/Kong/volcano-cli/issues"
+  },
+  "license": "Apache-2.0",
+  "type": "commonjs",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Kong/volcano-cli.git"
+  },
+  "bin": {
+    "volcano": "bin/volcano.js"
+  },
+  "files": [
+    "bin/volcano.js",
+    "scripts/npm/"
+  ],
+  "scripts": {
+    "postinstall": "node scripts/npm/install.js",
+    "prepublishOnly": "node -e \"if (require('./package.json').version === '0.0.0') { console.error('Refusing to publish version 0.0.0; set the real version first (npm version <x.y.z>).'); process.exit(1); }\""
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "os": [
+    "linux",
+    "darwin",
+    "win32"
+  ],
+  "cpu": [
+    "x64",
+    "arm64"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/scripts/npm/download.js

@@ -0,0 +1,198 @@
+'use strict';
+
+// Shared helpers for downloading and verifying the platform-specific Volcano
+// CLI binary from GitHub Releases. Used by the postinstall script
+// (scripts/npm/install.js) and, as a self-healing fallback, by the launcher
+// shim (bin/volcano.js).
+
+const fs = require('fs');
+const path = require('path');
+const http = require('http');
+const https = require('https');
+const crypto = require('crypto');
+const { pipeline } = require('stream');
+const { promisify } = require('util');
+
+const streamPipeline = promisify(pipeline);
+
+const pkg = require('../../package.json');
+
+// Allow pointing at a mirror (kept consistent with scripts/install-volcano.sh).
+const RELEASES_BASE = (
+  process.env.VOLCANO_GITHUB_RELEASES_URL ||
+  'https://github.com/Kong/volcano-cli/releases'
+).replace(/\/+$/, '');
+
+// Map Node's platform-arch to the release asset target id.
+const TARGETS = {
+  'linux-x64': 'linux-amd64',
+  'linux-arm64': 'linux-arm64',
+  'darwin-x64': 'macos-amd64',
+  'darwin-arm64': 'macos-arm64',
+  'win32-x64': 'windows-amd64',
+};
+
+function resolveTarget() {
+  const key = `${process.platform}-${process.arch}`;
+  const target = TARGETS[key];
+  if (!target) {
+    throw new Error(
+      `Unsupported platform "${key}". Volcano CLI ships binaries for: ` +
+        `${Object.keys(TARGETS).join(', ')}.`
+    );
+  }
+  return target;
+}
+
+function binaryExt() {
+  return process.platform === 'win32' ? '.exe' : '';
+}
+
+function assetName() {
+  return `volcano-${resolveTarget()}${binaryExt()}`;
+}
+
+// Absolute path where the downloaded binary lives (next to the launcher shim).
+function binaryPath() {
+  return path.join(__dirname, '..', '..', 'bin', assetName());
+}
+
+function releaseTag() {
+  // The npm package version maps 1:1 to the GitHub release tag `v<version>`.
+  return `v${pkg.version}`;
+}
+
+function get(url, redirects = 0) {
+  return new Promise((resolve, reject) => {
+    if (redirects > 10) {
+      reject(new Error(`Too many redirects while fetching ${url}`));
+      return;
+    }
+    let protocol;
+    try {
+      protocol = new URL(url).protocol;
+    } catch (err) {
+      reject(new Error(`Invalid download URL "${url}": ${err.message}`));
+      return;
+    }
+    // Pick the client by scheme so an http:// mirror
+    // (VOLCANO_GITHUB_RELEASES_URL) works too.
+    const client = protocol === 'https:' ? https : protocol === 'http:' ? http : null;
+    if (!client) {
+      reject(new Error(`Unsupported URL scheme "${protocol}" for ${url}; use http or https.`));
+      return;
+    }
+    const req = client.get(
+      url,
+      { headers: { 'User-Agent': `volcano-cli-npm/${pkg.version}` } },
+      (res) => {
+        const { statusCode, headers } = res;
+        if (statusCode >= 300 && statusCode < 400 && headers.location) {
+          res.resume();
+          const next = new URL(headers.location, url).toString();
+          resolve(get(next, redirects + 1));
+          return;
+        }
+        if (statusCode !== 200) {
+          res.resume();
+          reject(new Error(`Request to ${url} failed with status ${statusCode}`));
+          return;
+        }
+        resolve(res);
+      }
+    );
+    req.on('error', reject);
+    req.setTimeout(60000, () => {
+      req.destroy(new Error(`Request to ${url} timed out`));
+    });
+  });
+}
+
+async function getText(url) {
+  const res = await get(url);
+  const chunks = [];
+  for await (const chunk of res) chunks.push(chunk);
+  return Buffer.concat(chunks).toString('utf8');
+}
+
+// Parse a `shasum -a 256` style manifest and return the hex digest for `name`.
+function parseChecksum(manifest, name) {
+  const lines = manifest.split('\n');
+  for (const line of lines) {
+    const match = line.trim().match(/^([a-fA-F0-9]{64})\s+\*?(.+)$/);
+    if (match && match[2].trim() === name) {
+      return match[1].toLowerCase();
+    }
+  }
+  return null;
+}
+
+async function downloadToFile(url, dest) {
+  const tmp = `${dest}.download-${process.pid}`;
+  try {
+    const res = await get(url);
+    await streamPipeline(res, fs.createWriteStream(tmp));
+    // Hash the fully-written file so we verify exactly what landed on disk
+    // (also avoids the flowing-mode subtleties of hashing mid-stream).
+    const hash = crypto.createHash('sha256');
+    await streamPipeline(fs.createReadStream(tmp), hash);
+    const digest = hash.digest('hex');
+    // rename does not overwrite an existing destination on Windows, so clear it
+    // first (also covers a check-then-write race and force re-downloads).
+    fs.rmSync(dest, { force: true });
+    fs.renameSync(tmp, dest);
+    return digest;
+  } catch (err) {
+    // Never leave a partial download behind.
+    fs.rmSync(tmp, { force: true });
+    throw err;
+  }
+}
+
+// Download the correct binary for the current platform and verify its checksum
+// against the release's SHA256SUMS manifest. Idempotent: no-op if present.
+async function ensureBinary({ force = false } = {}) {
+  const dest = binaryPath();
+  if (!force && fs.existsSync(dest)) {
+    return dest;
+  }
+
+  if (pkg.version === '0.0.0') {
+    throw new Error(
+      'No published binary for development version 0.0.0; build from source ' +
+        'with `make build` or install a released version.'
+    );
+  }
+
+  const name = assetName();
+  const tag = releaseTag();
+  const base = `${RELEASES_BASE}/download/${tag}`;
+
+  const manifest = await getText(`${base}/SHA256SUMS`);
+  const expected = parseChecksum(manifest, name);
+  if (!expected) {
+    throw new Error(`No SHA256 checksum for ${name} in ${tag}/SHA256SUMS`);
+  }
+
+  fs.mkdirSync(path.dirname(dest), { recursive: true });
+  const actual = (await downloadToFile(`${base}/${name}`, dest)).toLowerCase();
+  if (actual !== expected) {
+    fs.rmSync(dest, { force: true });
+    throw new Error(
+      `Checksum mismatch for ${name}: expected ${expected}, got ${actual}`
+    );
+  }
+
+  if (process.platform !== 'win32') {
+    fs.chmodSync(dest, 0o755);
+  }
+  return dest;
+}
+
+module.exports = {
+  resolveTarget,
+  assetName,
+  binaryPath,
+  releaseTag,
+  ensureBinary,
+};

package/scripts/npm/install.js

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+'use strict';
+
+// npm postinstall hook: download the platform-specific Volcano CLI binary.
+//
+// Failures here are non-fatal so that `npm install` still succeeds in
+// restricted/offline environments (or with `--ignore-scripts`). In that case
+// the launcher shim (bin/volcano.js) downloads the binary on first use.
+
+const { ensureBinary, resolveTarget } = require('./download.js');
+const pkg = require('../../package.json');
+
+async function main() {
+  if (process.env.VOLCANO_SKIP_DOWNLOAD === '1') {
+    console.log('Skipping Volcano CLI download (VOLCANO_SKIP_DOWNLOAD=1).');
+    return;
+  }
+
+  // No release exists for the placeholder version, so skip quietly for anyone
+  // running `npm install` in a source checkout (the publish workflow stamps a
+  // real version before publishing).
+  if (pkg.version === '0.0.0') {
+    console.log('Skipping Volcano CLI download for development version 0.0.0.');
+    return;
+  }
+
+  const target = resolveTarget();
+  const binary = await ensureBinary();
+  console.log(`Installed Volcano CLI (${target}) -> ${binary}`);
+}
+
+main().catch((err) => {
+  console.warn(`Warning: could not download the Volcano CLI binary: ${err.message}`);
+  console.warn('It will be downloaded automatically the first time you run "volcano".');
+  // Exit 0 so installation does not hard-fail; the shim self-heals on first run.
+  process.exit(0);
+});