ardent-cli-beta 0.0.6 → 0.0.7

package/README.md

@@ -10,19 +10,8 @@ bound with PKCE. `ardent login --token <token>` validates and stores an existing
 API token for CI and automation; `ARDENT_TOKEN` supplies the same flag
 non-interactively. `ardent status` and `ardent logout` inspect and remove that
 local session. The CLI always talks to Ardent's production control plane. Oclif
-provides help, version, autocomplete, and native JSON command behavior.
-Connector credential delivery is the first resource command; general resource
-commands and resource context remain owed.
-
-`ardent connectors credentials set` delivers a source database password and a
-verified CA directly to the selected environment's authoritative AWS account and
-region. The caller must be logged in to Ardent and authenticated to that AWS account. Supply
-the password only as `{"password":"..."}` on standard input and the CA with
-`--ca-file`; `--request` is a caller-generated UUID that must be reused for a
-retry. The command checks connector ownership through the control-plane API,
-checks the local AWS account through STS, prints its target, then creates the CA
-and password secrets in that order. It never sends either value to the control
-plane or places one on the AWS command's argument vector.
+provides help, version, autocomplete, and native JSON command behavior. Resource
+commands and resource context are not implemented yet.
 
 Set `ARDENT_API_URL` to point the CLI at a development control plane. Without
 it, the CLI uses `https://production.tryardent.com`.

package/oclif.manifest.json

@@ -94,93 +94,7 @@
         "commands",
         "status.js"
       ]
-    },
-    "connectors:credentials:set": {
-      "aliases": [],
-      "args": {},
-      "description": "Deliver a connector password and source CA directly to its environment AWS account",
-      "flags": {
-        "json": {
-          "description": "Format output as json.",
-          "helpGroup": "GLOBAL",
-          "name": "json",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "organization": {
-          "description": "Owning Ardent organization ID",
-          "name": "organization",
-          "required": true,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "project": {
-          "description": "Owning Ardent project ID",
-          "name": "project",
-          "required": true,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "environment": {
-          "description": "Target Ardent environment ID",
-          "name": "environment",
-          "required": true,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "connector": {
-          "description": "Target Ardent connector ID",
-          "name": "connector",
-          "required": true,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "request": {
-          "description": "Stable UUID for safe retries",
-          "name": "request",
-          "required": true,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "ca-file": {
-          "description": "PEM source certificate-authority file",
-          "name": "ca-file",
-          "required": true,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "password-stdin": {
-          "description": "Read {\"password\":\"…\"} from standard input",
-          "name": "password-stdin",
-          "required": true,
-          "allowNo": false,
-          "type": "boolean"
-        }
-      },
-      "hasDynamicHelp": false,
-      "hiddenAliases": [],
-      "id": "connectors:credentials:set",
-      "pluginAlias": "ardent-cli-beta",
-      "pluginName": "ardent-cli-beta",
-      "pluginType": "core",
-      "strict": true,
-      "enableJsonFlag": true,
-      "helpGroup": "Connectors",
-      "isESM": true,
-      "relativePath": [
-        "dist",
-        "commands",
-        "connectors",
-        "credentials",
-        "set.js"
-      ]
     }
   },
-  "version": "0.0.6"
+  "version": "0.0.7"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ardent-cli-beta",
-  "version": "0.0.6",
+  "version": "0.0.7",
   "description": "The Ardent command-line interface",
   "license": "Apache-2.0",
   "type": "module",

package/dist/cloud/source-credentials.d.ts

@@ -1,18 +0,0 @@
-export interface Target {
-    account: string;
-    region: string;
-    environment: string;
-    connector: string;
-    request: string;
-}
-type Run = (arguments_: string[], input?: string) => Promise<string>;
-export declare function validateCA(pem: string, now?: Date): string;
-export declare function parsePasswordDocument(raw: string): string;
-export declare function deliver(target: Target, ca: string, password: string, run?: Run): Promise<void>;
-export declare class AWSFailure extends Error {
-    readonly notFound: boolean;
-    constructor(notFound?: boolean);
-}
-export declare function account(run?: Run): Promise<string>;
-export declare function runAWS(arguments_: string[], input?: string, executable?: string, timeoutMilliseconds?: number): Promise<string>;
-export {};

package/dist/cloud/source-credentials.js

@@ -1,143 +0,0 @@
-import { spawn } from 'node:child_process';
-import { timingSafeEqual, X509Certificate } from 'node:crypto';
-const secretName = (target, suffix) => `ardent/${target.environment}/connectors/${target.connector}/${suffix}`;
-export function validateCA(pem, now = new Date()) {
-    if (Buffer.byteLength(pem) > 64 * 1024 || !pem.endsWith('\n'))
-        throw new Error('The source CA must be a newline-terminated PEM certificate under 64 KiB.');
-    if ((pem.match(/-----BEGIN CERTIFICATE-----/g) ?? []).length !== 1 || /PRIVATE KEY/.test(pem))
-        throw new Error('The source CA must contain exactly one certificate and no private key.');
-    let certificate;
-    try {
-        certificate = new X509Certificate(pem);
-    }
-    catch {
-        throw new Error('The source CA is not a valid PEM certificate.');
-    }
-    if (!certificate.ca || now < new Date(certificate.validFrom) || now >= new Date(certificate.validTo))
-        throw new Error('The source CA must be a currently valid certificate authority.');
-    return pem;
-}
-export function parsePasswordDocument(raw) {
-    if (Buffer.byteLength(raw) > 64 * 1024)
-        throw new Error('The source credential document is too large.');
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        throw new Error('Standard input must be one JSON object containing password.');
-    }
-    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed) || Object.keys(parsed).length !== 1 || typeof parsed.password !== 'string' || parsed.password.length === 0 || parsed.password.includes('\0')) {
-        throw new Error('Standard input must be one JSON object containing a non-empty password and no other fields.');
-    }
-    return parsed.password;
-}
-export async function deliver(target, ca, password, run = runAWS) {
-    for (const [name, value] of [
-        [secretName(target, 'source-database-ca'), ca],
-        [secretName(target, 'source-database-password'), password],
-    ]) {
-        const description = await describe(run, target, name);
-        if (description !== undefined) {
-            const tags = new Map((description.Tags ?? []).map((tag) => [tag.Key, tag.Value]));
-            if (tags.get('ardent:credential-request') !== target.request || tags.get('ardent:environment') !== target.environment || tags.get('ardent:connector') !== target.connector) {
-                throw new Error(`The deterministic ${name.endsWith('-ca') ? 'CA' : 'password'} secret already belongs to another request.`);
-            }
-            const encodedExisting = await run(['secretsmanager', 'get-secret-value', '--region', target.region, '--secret-id', name, '--query', 'SecretString', '--output', 'json']);
-            let existing;
-            try {
-                existing = JSON.parse(encodedExisting);
-            }
-            catch {
-                throw new AWSFailure();
-            }
-            if (typeof existing !== 'string')
-                throw new AWSFailure();
-            const existingBytes = Buffer.from(existing);
-            const requestedBytes = Buffer.from(value);
-            if (existingBytes.length !== requestedBytes.length || !timingSafeEqual(existingBytes, requestedBytes)) {
-                throw new Error(`The deterministic ${name.endsWith('-ca') ? 'CA' : 'password'} secret already has different contents for this request.`);
-            }
-            continue;
-        }
-        await run([
-            'secretsmanager', 'create-secret', '--region', target.region, '--name', name,
-            '--secret-string', 'file:///dev/stdin', '--tags',
-            `Key=ardent:credential-request,Value=${target.request}`,
-            `Key=ardent:environment,Value=${target.environment}`,
-            `Key=ardent:connector,Value=${target.connector}`,
-            '--output', 'json',
-        ], value);
-    }
-}
-async function describe(run, target, name) {
-    try {
-        return JSON.parse(await run(['secretsmanager', 'describe-secret', '--region', target.region, '--secret-id', name, '--output', 'json']));
-    }
-    catch (error) {
-        if (error instanceof AWSFailure && error.notFound)
-            return undefined;
-        throw error;
-    }
-}
-export class AWSFailure extends Error {
-    notFound;
-    constructor(notFound = false) {
-        super(notFound ? 'The AWS secret does not exist.' : 'The AWS credential operation failed.');
-        this.notFound = notFound;
-    }
-}
-export async function account(run = runAWS) {
-    const value = (await run(['sts', 'get-caller-identity', '--query', 'Account', '--output', 'text'])).trim();
-    if (!/^\d{12}$/.test(value))
-        throw new Error('AWS returned an invalid account identity.');
-    return value;
-}
-export function runAWS(arguments_, input, executable = 'aws', timeoutMilliseconds = 30_000) {
-    return new Promise((resolve, reject) => {
-        const child = spawn(executable, arguments_, { shell: false, stdio: ['pipe', 'pipe', 'pipe'] });
-        let settled = false;
-        let stdout = '';
-        let stderr = '';
-        let timeout;
-        const finish = (error) => {
-            if (settled)
-                return;
-            settled = true;
-            if (timeout)
-                clearTimeout(timeout);
-            if (error)
-                reject(error);
-            else
-                resolve(stdout);
-        };
-        timeout = setTimeout(() => {
-            child.kill('SIGKILL');
-            finish(new AWSFailure());
-        }, timeoutMilliseconds);
-        const failInput = () => {
-            child.kill('SIGKILL');
-            finish(new AWSFailure());
-        };
-        child.stdout.setEncoding('utf8').on('data', (chunk) => {
-            if (stdout.length <= 128 * 1024)
-                stdout += chunk;
-        });
-        child.stderr.setEncoding('utf8').on('data', (chunk) => {
-            if (stderr.length <= 16 * 1024)
-                stderr += chunk;
-        });
-        child.on('error', () => finish(new AWSFailure()));
-        child.stdin.on('error', failInput);
-        child.on('close', (status) => {
-            if (status === 0 && Buffer.byteLength(stdout) <= 128 * 1024)
-                finish();
-            else
-                finish(new AWSFailure(/ResourceNotFoundException/.test(stderr)));
-        });
-        child.stdin.end(input, (error) => {
-            if (error)
-                failInput();
-        });
-    });
-}

package/dist/commands/connectors/credentials/set.d.ts

@@ -1,20 +0,0 @@
-import { ArdentCommand } from '../../../command.js';
-export default class SetSourceCredentials extends ArdentCommand {
-    static description: string;
-    static helpGroup: string;
-    static flags: {
-        organization: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        project: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        environment: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        connector: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        request: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        'ca-file': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        'password-stdin': import("@oclif/core/interfaces").BooleanFlag<boolean>;
-    };
-    run(): Promise<{
-        connector: string;
-        environment: string;
-        account: string;
-        delivered: true;
-    }>;
-}

package/dist/commands/connectors/credentials/set.js

@@ -1,59 +0,0 @@
-import { Flags } from '@oclif/core';
-import { readFile } from 'node:fs/promises';
-import { request } from '../../../api/client.js';
-import { loadSession } from '../../../auth/credentials.js';
-import { account, deliver, parsePasswordDocument, validateCA } from '../../../cloud/source-credentials.js';
-import { ArdentCommand } from '../../../command.js';
-export default class SetSourceCredentials extends ArdentCommand {
-    static description = 'Deliver a connector password and source CA directly to its environment AWS account';
-    static helpGroup = 'Connectors';
-    static flags = {
-        organization: Flags.string({ required: true, description: 'Owning Ardent organization ID' }),
-        project: Flags.string({ required: true, description: 'Owning Ardent project ID' }),
-        environment: Flags.string({ required: true, description: 'Target Ardent environment ID' }),
-        connector: Flags.string({ required: true, description: 'Target Ardent connector ID' }),
-        request: Flags.string({ required: true, description: 'Stable UUID for safe retries' }),
-        'ca-file': Flags.string({ required: true, description: 'PEM source certificate-authority file' }),
-        'password-stdin': Flags.boolean({ required: true, description: 'Read {"password":"…"} from standard input' }),
-    };
-    async run() {
-        const { flags } = await this.parse(SetSourceCredentials);
-        const uuid = '[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}';
-        if (!new RegExp(`^environment_${uuid}$`).test(flags.environment) || !new RegExp(`^connector_${uuid}$`).test(flags.connector) || !new RegExp(`^${uuid}$`).test(flags.request))
-            this.error('Environment, connector, or request identity is invalid.');
-        const session = await loadSession(this.config.configDir);
-        if (!session)
-            this.error('Log in before delivering source credentials.');
-        const connectors = await request(session.token, `/connectors?organization_id=${encodeURIComponent(flags.organization)}&project_id=${encodeURIComponent(flags.project)}`);
-        if (!connectors.some((connector) => connector.id === flags.connector && connector.environment_id === flags.environment))
-            this.error('The selected connector does not belong to the selected project and environment.');
-        const environments = await request(session.token, `/connector-environments?organization_id=${encodeURIComponent(flags.organization)}&project_id=${encodeURIComponent(flags.project)}`);
-        const environment = environments.find((candidate) => candidate.id === flags.environment);
-        if (!environment || !/^\d{12}$/.test(environment.cloud_account_id) || !/^[a-z]{2}(?:-gov)?-[a-z]+-\d$/.test(environment.cloud_region))
-            this.error('The selected environment has no authoritative AWS placement.');
-        const actualAccount = await account();
-        if (actualAccount !== environment.cloud_account_id)
-            this.error(`AWS is authenticated to account ${actualAccount}, not the environment account ${environment.cloud_account_id}.`);
-        const ca = validateCA(await readFile(flags['ca-file'], 'utf8'));
-        const input = await readStdin();
-        const password = parsePasswordDocument(input);
-        if (!this.jsonEnabled())
-            this.log(`Delivering source credentials for ${flags.connector} in ${flags.environment} to AWS account ${environment.cloud_account_id} (${environment.cloud_region})`);
-        await deliver({ account: environment.cloud_account_id, region: environment.cloud_region, environment: flags.environment, connector: flags.connector, request: flags.request }, ca, password);
-        if (!this.jsonEnabled())
-            this.log('✓ Source password and CA delivered');
-        return { connector: flags.connector, environment: flags.environment, account: environment.cloud_account_id, delivered: true };
-    }
-}
-async function readStdin() {
-    const chunks = [];
-    let size = 0;
-    for await (const chunk of process.stdin) {
-        const value = Buffer.from(chunk);
-        size += value.length;
-        if (size > 64 * 1024)
-            throw new Error('The source credential document is too large.');
-        chunks.push(value);
-    }
-    return Buffer.concat(chunks).toString('utf8');
-}