ardent-cli-beta 0.0.6 → 0.0.8

package/README.md

@@ -10,19 +10,9 @@ bound with PKCE. `ardent login --token <token>` validates and stores an existing
 API token for CI and automation; `ARDENT_TOKEN` supplies the same flag
 non-interactively. `ardent status` and `ardent logout` inspect and remove that
 local session. The CLI always talks to Ardent's production control plane. Oclif
-provides help, version, autocomplete, and native JSON command behavior.
-Connector credential delivery is the first resource command; general resource
-commands and resource context remain owed.
-
-`ardent connectors credentials set` delivers a source database password and a
-verified CA directly to the selected environment's authoritative AWS account and
-region. The caller must be logged in to Ardent and authenticated to that AWS account. Supply
-the password only as `{"password":"..."}` on standard input and the CA with
-`--ca-file`; `--request` is a caller-generated UUID that must be reused for a
-retry. The command checks connector ownership through the control-plane API,
-checks the local AWS account through STS, prints its target, then creates the CA
-and password secrets in that order. It never sends either value to the control
-plane or places one on the AWS command's argument vector.
+provides help, version, autocomplete, and native JSON command behavior. Resource
+context is retained from login. Project listing, creation, and local context
+switching are implemented; other resource commands are not implemented yet.
 
 Set `ARDENT_API_URL` to point the CLI at a development control plane. Without
 it, the CLI uses `https://production.tryardent.com`.
@@ -33,6 +23,9 @@ npm run build
 ./bin/run.js --help
 ./bin/run.js login
 ./bin/run.js login --token <token>
+./bin/run.js project list
+./bin/run.js project create "My project"
+./bin/run.js project switch "My project"
 ARDENT_API_URL=http://localhost:8080 ./bin/run.js login --token <token>
 ```
 

package/dist/auth/credentials.d.ts

@@ -1,6 +1,16 @@
 export interface Session {
+    organization?: {
+        id: string;
+        name: string;
+    };
+    projects?: ProjectIdentity[];
+    selectedProject?: ProjectIdentity;
     token: string;
 }
+export interface ProjectIdentity {
+    id: string;
+    name: string;
+}
 export declare function loadSession(directory: string): Promise<Session | undefined>;
 export declare function saveSession(directory: string, session: Session): Promise<void>;
 export declare function clearSession(directory: string): Promise<void>;

package/dist/auth/credentials.js

@@ -16,12 +16,54 @@ export async function loadSession(directory) {
         const session = JSON.parse(contents);
         if (typeof session.token !== 'string' || session.token.length === 0)
             throw new Error();
-        return { token: session.token };
+        if (session.organization === undefined) {
+            if (session.projects !== undefined || session.selectedProject !== undefined)
+                throw new Error();
+            return { token: session.token };
+        }
+        if (typeof session.organization !== 'object' ||
+            session.organization === null ||
+            typeof session.organization.id !== 'string' ||
+            session.organization.id.length === 0 ||
+            typeof session.organization.name !== 'string' ||
+            session.organization.name.length === 0) {
+            throw new Error();
+        }
+        let projects;
+        if (session.projects !== undefined) {
+            if (!Array.isArray(session.projects) || session.projects.some((project) => !isProjectIdentity(project)))
+                throw new Error();
+            projects = session.projects.map(({ id, name }) => ({ id, name }));
+            if (new Set(projects.map(({ id }) => id)).size !== projects.length)
+                throw new Error();
+            if (new Set(projects.map(({ name }) => name)).size !== projects.length)
+                throw new Error();
+        }
+        let selectedProject;
+        if (session.selectedProject !== undefined) {
+            if (!isProjectIdentity(session.selectedProject) || projects === undefined)
+                throw new Error();
+            selectedProject = projects.find(({ id, name }) => id === session.selectedProject?.id && name === session.selectedProject.name);
+            if (!selectedProject)
+                throw new Error();
+        }
+        return {
+            organization: session.organization,
+            ...(projects === undefined ? {} : { projects }),
+            ...(selectedProject === undefined ? {} : { selectedProject }),
+            token: session.token,
+        };
     }
     catch {
         throw new Error(`Ardent configuration at ${configPath(directory)} is invalid. Run ardent logout, then log in again.`);
     }
 }
+function isProjectIdentity(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const project = value;
+    return typeof project.id === 'string' && project.id.length > 0 && typeof project.name === 'string' && project.name.length > 0;
+}
 export async function saveSession(directory, session) {
     await mkdir(directory, { mode: 0o700, recursive: true });
     await chmod(directory, 0o700);

package/dist/auth/token.js

@@ -9,10 +9,14 @@ export async function loginWithToken(directory, value, signal) {
         organizations.some((organization) => typeof organization !== 'object' ||
             organization === null ||
             typeof organization.id !== 'string' ||
-            typeof organization.name !== 'string')) {
+            organization.id.length === 0 ||
+            typeof organization.name !== 'string' ||
+            organization.name.length === 0)) {
         throw new Error('Ardent API returned an invalid organization response.');
     }
+    if (organizations.length !== 1)
+        throw new Error('Ardent API token must belong to exactly one organization.');
     signal?.throwIfAborted();
-    await saveSession(directory, { token });
+    await saveSession(directory, { organization: organizations[0], token });
     return organizations;
 }

package/dist/commands/project/create.d.ts

@@ -0,0 +1,10 @@
+import { ArdentCommand } from '../../command.js';
+import { type Project } from '../../projects/client.js';
+export default class ProjectCreate extends ArdentCommand {
+    static args: {
+        name: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static helpGroup: string;
+    run(): Promise<Project>;
+}

package/dist/commands/project/create.js

@@ -0,0 +1,29 @@
+import { Args } from '@oclif/core';
+import { loadSession } from '../../auth/credentials.js';
+import { ArdentCommand } from '../../command.js';
+import { createProject } from '../../projects/client.js';
+import { selectProject } from '../../projects/context.js';
+import { terminalText } from '../../terminal.js';
+export default class ProjectCreate extends ArdentCommand {
+    static args = {
+        name: Args.string({ description: 'Project name', required: true }),
+    };
+    static description = 'Create a project';
+    static helpGroup = 'Projects';
+    async run() {
+        const { args } = await this.parse(ProjectCreate);
+        const name = args.name.trim();
+        if (!name)
+            this.error('Project name cannot be empty.');
+        const session = await loadSession(this.config.configDir);
+        if (!session)
+            this.error('Not logged in to Ardent. Run ardent login.');
+        if (!session.organization)
+            this.error('You must be logged in to run this command. Run ardent login.');
+        const project = await createProject(session.token, session.organization.id, name);
+        await selectProject(this.config.configDir, session, project);
+        if (!this.jsonEnabled())
+            this.log(`✓ Created project ${terminalText(project.name)}`);
+        return project;
+    }
+}

package/dist/commands/project/list.d.ts

@@ -0,0 +1,9 @@
+import { ArdentCommand } from '../../command.js';
+import { type Project } from '../../projects/client.js';
+export default class ProjectList extends ArdentCommand {
+    static description: string;
+    static helpGroup: string;
+    run(): Promise<{
+        projects: Project[];
+    }>;
+}

package/dist/commands/project/list.js

@@ -0,0 +1,29 @@
+import { ux } from '@oclif/core';
+import { loadSession } from '../../auth/credentials.js';
+import { ArdentCommand } from '../../command.js';
+import { listProjects } from '../../projects/client.js';
+import { replaceProjectCache } from '../../projects/context.js';
+import { terminalText } from '../../terminal.js';
+export default class ProjectList extends ArdentCommand {
+    static description = 'List projects';
+    static helpGroup = 'Projects';
+    async run() {
+        const session = await loadSession(this.config.configDir);
+        if (!session)
+            this.error('Not logged in to Ardent. Run ardent login.');
+        if (!session.organization)
+            this.error('You must be logged in to run this command. Run ardent login.');
+        const projects = await listProjects(session.token, session.organization.id);
+        const refreshedSession = await replaceProjectCache(this.config.configDir, session, projects);
+        if (!this.jsonEnabled()) {
+            if (projects.length === 0)
+                this.log('No projects found.');
+            for (const project of projects) {
+                const name = terminalText(project.name);
+                const line = project.id === refreshedSession.selectedProject?.id ? `● ${name}` : `  ${name}`;
+                this.log(project.id === refreshedSession.selectedProject?.id ? ux.colorize('green', line) : line);
+            }
+        }
+        return { projects };
+    }
+}

package/dist/commands/project/switch.d.ts

@@ -0,0 +1,12 @@
+import { ArdentCommand } from '../../command.js';
+export default class ProjectSwitch extends ArdentCommand {
+    static args: {
+        name: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static helpGroup: string;
+    run(): Promise<{
+        id: string;
+        name: string;
+    }>;
+}

package/dist/commands/project/switch.js

@@ -0,0 +1,28 @@
+import { Args } from '@oclif/core';
+import { loadSession } from '../../auth/credentials.js';
+import { ArdentCommand } from '../../command.js';
+import { cachedProjectNamed, selectProject } from '../../projects/context.js';
+import { terminalText } from '../../terminal.js';
+export default class ProjectSwitch extends ArdentCommand {
+    static args = {
+        name: Args.string({ description: 'Project name', required: true }),
+    };
+    static description = 'Switch to a project from the local project list';
+    static helpGroup = 'Projects';
+    async run() {
+        const { args } = await this.parse(ProjectSwitch);
+        const name = args.name.trim();
+        if (!name)
+            this.error('Project name cannot be empty.');
+        const session = await loadSession(this.config.configDir);
+        if (!session?.organization)
+            this.error('You must be logged in to run this command. Run ardent login.');
+        const project = cachedProjectNamed(session, name);
+        if (!project)
+            this.error(`Project ${JSON.stringify(name)} not found. Run ardent project list.`);
+        await selectProject(this.config.configDir, session, project);
+        if (!this.jsonEnabled())
+            this.log(`✓ Switched to project ${terminalText(project.name)}`);
+        return project;
+    }
+}

package/dist/projects/client.d.ts

@@ -0,0 +1,9 @@
+export interface Project {
+    created_at: string;
+    id: string;
+    name: string;
+    organization_id: string;
+    updated_at: string;
+}
+export declare function listProjects(token: string, organizationID: string): Promise<Project[]>;
+export declare function createProject(token: string, organizationID: string, name: string): Promise<Project>;

package/dist/projects/client.js

@@ -0,0 +1,30 @@
+import { randomUUID } from 'node:crypto';
+import { request } from '../api/client.js';
+export async function listProjects(token, organizationID) {
+    const projects = await request(token, `/projects?organization_id=${encodeURIComponent(organizationID)}`);
+    if (!Array.isArray(projects) || projects.some((project) => !isProject(project, organizationID))) {
+        throw new Error('Ardent API returned an invalid projects response.');
+    }
+    return projects;
+}
+export async function createProject(token, organizationID, name) {
+    const project = await request(token, '/projects', {
+        body: JSON.stringify({ name, organization_id: organizationID }),
+        headers: { 'Idempotency-Key': randomUUID() },
+        method: 'POST',
+    });
+    if (!isProject(project, organizationID))
+        throw new Error('Ardent API returned an invalid project response.');
+    return project;
+}
+function isProject(value, organizationID) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const project = value;
+    return (typeof project.id === 'string' &&
+        project.id.length > 0 &&
+        project.organization_id === organizationID &&
+        typeof project.name === 'string' &&
+        typeof project.created_at === 'string' &&
+        typeof project.updated_at === 'string');
+}

package/dist/projects/context.d.ts

@@ -0,0 +1,5 @@
+import { type ProjectIdentity, type Session } from '../auth/credentials.js';
+import type { Project } from './client.js';
+export declare function replaceProjectCache(directory: string, session: Session, projects: Project[]): Promise<Session>;
+export declare function selectProject(directory: string, session: Session, project: ProjectIdentity): Promise<Session>;
+export declare function cachedProjectNamed(session: Session, name: string): ProjectIdentity | undefined;

package/dist/projects/context.js

@@ -0,0 +1,29 @@
+import { saveSession } from '../auth/credentials.js';
+export async function replaceProjectCache(directory, session, projects) {
+    const identities = projects.map(projectIdentity);
+    const selectedProject = identities.find(({ id }) => id === session.selectedProject?.id) ??
+        (identities.length === 1 ? identities[0] : undefined);
+    const updated = { ...session, projects: identities, selectedProject };
+    if (selectedProject === undefined)
+        delete updated.selectedProject;
+    await saveSession(directory, updated);
+    return updated;
+}
+export async function selectProject(directory, session, project) {
+    const selectedProject = projectIdentity(project);
+    const projects = [...(session.projects ?? [])];
+    const existingIndex = projects.findIndex(({ id }) => id === selectedProject.id);
+    if (existingIndex === -1)
+        projects.push(selectedProject);
+    else
+        projects[existingIndex] = selectedProject;
+    const updated = { ...session, projects, selectedProject };
+    await saveSession(directory, updated);
+    return updated;
+}
+export function cachedProjectNamed(session, name) {
+    return session.projects?.find((project) => project.name === name);
+}
+function projectIdentity(project) {
+    return { id: project.id, name: project.name };
+}

package/dist/terminal.d.ts

@@ -0,0 +1 @@
+export declare function terminalText(value: string): string;

package/dist/terminal.js

@@ -0,0 +1,9 @@
+const terminalControlCharacter = /[\u0000-\u001F\u007F-\u009F\u202A-\u202E\u2066-\u2069]/g;
+export function terminalText(value) {
+    return value.replace(terminalControlCharacter, (character) => {
+        const codePoint = character.codePointAt(0);
+        if (codePoint === undefined)
+            return '';
+        return `\\u${codePoint.toString(16).padStart(4, '0')}`;
+    });
+}

package/oclif.manifest.json

@@ -95,10 +95,46 @@
         "status.js"
       ]
     },
-    "connectors:credentials:set": {
+    "project:create": {
+      "aliases": [],
+      "args": {
+        "name": {
+          "description": "Project name",
+          "name": "name",
+          "required": true
+        }
+      },
+      "description": "Create a project",
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "project:create",
+      "pluginAlias": "ardent-cli-beta",
+      "pluginName": "ardent-cli-beta",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "helpGroup": "Projects",
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "project",
+        "create.js"
+      ]
+    },
+    "project:list": {
       "aliases": [],
       "args": {},
-      "description": "Deliver a connector password and source CA directly to its environment AWS account",
+      "description": "List projects",
       "flags": {
         "json": {
           "description": "Format output as json.",
@@ -106,81 +142,61 @@
           "name": "json",
           "allowNo": false,
           "type": "boolean"
-        },
-        "organization": {
-          "description": "Owning Ardent organization ID",
-          "name": "organization",
-          "required": true,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "project": {
-          "description": "Owning Ardent project ID",
-          "name": "project",
-          "required": true,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "environment": {
-          "description": "Target Ardent environment ID",
-          "name": "environment",
-          "required": true,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "connector": {
-          "description": "Target Ardent connector ID",
-          "name": "connector",
-          "required": true,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "request": {
-          "description": "Stable UUID for safe retries",
-          "name": "request",
-          "required": true,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "ca-file": {
-          "description": "PEM source certificate-authority file",
-          "name": "ca-file",
-          "required": true,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "password-stdin": {
-          "description": "Read {\"password\":\"…\"} from standard input",
-          "name": "password-stdin",
-          "required": true,
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "project:list",
+      "pluginAlias": "ardent-cli-beta",
+      "pluginName": "ardent-cli-beta",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "helpGroup": "Projects",
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "project",
+        "list.js"
+      ]
+    },
+    "project:switch": {
+      "aliases": [],
+      "args": {
+        "name": {
+          "description": "Project name",
+          "name": "name",
+          "required": true
+        }
+      },
+      "description": "Switch to a project from the local project list",
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
           "allowNo": false,
           "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "connectors:credentials:set",
+      "id": "project:switch",
       "pluginAlias": "ardent-cli-beta",
       "pluginName": "ardent-cli-beta",
       "pluginType": "core",
       "strict": true,
       "enableJsonFlag": true,
-      "helpGroup": "Connectors",
+      "helpGroup": "Projects",
       "isESM": true,
       "relativePath": [
         "dist",
         "commands",
-        "connectors",
-        "credentials",
-        "set.js"
+        "project",
+        "switch.js"
       ]
     }
   },
-  "version": "0.0.6"
+  "version": "0.0.8"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ardent-cli-beta",
-  "version": "0.0.6",
+  "version": "0.0.8",
   "description": "The Ardent command-line interface",
   "license": "Apache-2.0",
   "type": "module",

package/dist/cloud/source-credentials.d.ts

@@ -1,18 +0,0 @@
-export interface Target {
-    account: string;
-    region: string;
-    environment: string;
-    connector: string;
-    request: string;
-}
-type Run = (arguments_: string[], input?: string) => Promise<string>;
-export declare function validateCA(pem: string, now?: Date): string;
-export declare function parsePasswordDocument(raw: string): string;
-export declare function deliver(target: Target, ca: string, password: string, run?: Run): Promise<void>;
-export declare class AWSFailure extends Error {
-    readonly notFound: boolean;
-    constructor(notFound?: boolean);
-}
-export declare function account(run?: Run): Promise<string>;
-export declare function runAWS(arguments_: string[], input?: string, executable?: string, timeoutMilliseconds?: number): Promise<string>;
-export {};

package/dist/cloud/source-credentials.js

@@ -1,143 +0,0 @@
-import { spawn } from 'node:child_process';
-import { timingSafeEqual, X509Certificate } from 'node:crypto';
-const secretName = (target, suffix) => `ardent/${target.environment}/connectors/${target.connector}/${suffix}`;
-export function validateCA(pem, now = new Date()) {
-    if (Buffer.byteLength(pem) > 64 * 1024 || !pem.endsWith('\n'))
-        throw new Error('The source CA must be a newline-terminated PEM certificate under 64 KiB.');
-    if ((pem.match(/-----BEGIN CERTIFICATE-----/g) ?? []).length !== 1 || /PRIVATE KEY/.test(pem))
-        throw new Error('The source CA must contain exactly one certificate and no private key.');
-    let certificate;
-    try {
-        certificate = new X509Certificate(pem);
-    }
-    catch {
-        throw new Error('The source CA is not a valid PEM certificate.');
-    }
-    if (!certificate.ca || now < new Date(certificate.validFrom) || now >= new Date(certificate.validTo))
-        throw new Error('The source CA must be a currently valid certificate authority.');
-    return pem;
-}
-export function parsePasswordDocument(raw) {
-    if (Buffer.byteLength(raw) > 64 * 1024)
-        throw new Error('The source credential document is too large.');
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        throw new Error('Standard input must be one JSON object containing password.');
-    }
-    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed) || Object.keys(parsed).length !== 1 || typeof parsed.password !== 'string' || parsed.password.length === 0 || parsed.password.includes('\0')) {
-        throw new Error('Standard input must be one JSON object containing a non-empty password and no other fields.');
-    }
-    return parsed.password;
-}
-export async function deliver(target, ca, password, run = runAWS) {
-    for (const [name, value] of [
-        [secretName(target, 'source-database-ca'), ca],
-        [secretName(target, 'source-database-password'), password],
-    ]) {
-        const description = await describe(run, target, name);
-        if (description !== undefined) {
-            const tags = new Map((description.Tags ?? []).map((tag) => [tag.Key, tag.Value]));
-            if (tags.get('ardent:credential-request') !== target.request || tags.get('ardent:environment') !== target.environment || tags.get('ardent:connector') !== target.connector) {
-                throw new Error(`The deterministic ${name.endsWith('-ca') ? 'CA' : 'password'} secret already belongs to another request.`);
-            }
-            const encodedExisting = await run(['secretsmanager', 'get-secret-value', '--region', target.region, '--secret-id', name, '--query', 'SecretString', '--output', 'json']);
-            let existing;
-            try {
-                existing = JSON.parse(encodedExisting);
-            }
-            catch {
-                throw new AWSFailure();
-            }
-            if (typeof existing !== 'string')
-                throw new AWSFailure();
-            const existingBytes = Buffer.from(existing);
-            const requestedBytes = Buffer.from(value);
-            if (existingBytes.length !== requestedBytes.length || !timingSafeEqual(existingBytes, requestedBytes)) {
-                throw new Error(`The deterministic ${name.endsWith('-ca') ? 'CA' : 'password'} secret already has different contents for this request.`);
-            }
-            continue;
-        }
-        await run([
-            'secretsmanager', 'create-secret', '--region', target.region, '--name', name,
-            '--secret-string', 'file:///dev/stdin', '--tags',
-            `Key=ardent:credential-request,Value=${target.request}`,
-            `Key=ardent:environment,Value=${target.environment}`,
-            `Key=ardent:connector,Value=${target.connector}`,
-            '--output', 'json',
-        ], value);
-    }
-}
-async function describe(run, target, name) {
-    try {
-        return JSON.parse(await run(['secretsmanager', 'describe-secret', '--region', target.region, '--secret-id', name, '--output', 'json']));
-    }
-    catch (error) {
-        if (error instanceof AWSFailure && error.notFound)
-            return undefined;
-        throw error;
-    }
-}
-export class AWSFailure extends Error {
-    notFound;
-    constructor(notFound = false) {
-        super(notFound ? 'The AWS secret does not exist.' : 'The AWS credential operation failed.');
-        this.notFound = notFound;
-    }
-}
-export async function account(run = runAWS) {
-    const value = (await run(['sts', 'get-caller-identity', '--query', 'Account', '--output', 'text'])).trim();
-    if (!/^\d{12}$/.test(value))
-        throw new Error('AWS returned an invalid account identity.');
-    return value;
-}
-export function runAWS(arguments_, input, executable = 'aws', timeoutMilliseconds = 30_000) {
-    return new Promise((resolve, reject) => {
-        const child = spawn(executable, arguments_, { shell: false, stdio: ['pipe', 'pipe', 'pipe'] });
-        let settled = false;
-        let stdout = '';
-        let stderr = '';
-        let timeout;
-        const finish = (error) => {
-            if (settled)
-                return;
-            settled = true;
-            if (timeout)
-                clearTimeout(timeout);
-            if (error)
-                reject(error);
-            else
-                resolve(stdout);
-        };
-        timeout = setTimeout(() => {
-            child.kill('SIGKILL');
-            finish(new AWSFailure());
-        }, timeoutMilliseconds);
-        const failInput = () => {
-            child.kill('SIGKILL');
-            finish(new AWSFailure());
-        };
-        child.stdout.setEncoding('utf8').on('data', (chunk) => {
-            if (stdout.length <= 128 * 1024)
-                stdout += chunk;
-        });
-        child.stderr.setEncoding('utf8').on('data', (chunk) => {
-            if (stderr.length <= 16 * 1024)
-                stderr += chunk;
-        });
-        child.on('error', () => finish(new AWSFailure()));
-        child.stdin.on('error', failInput);
-        child.on('close', (status) => {
-            if (status === 0 && Buffer.byteLength(stdout) <= 128 * 1024)
-                finish();
-            else
-                finish(new AWSFailure(/ResourceNotFoundException/.test(stderr)));
-        });
-        child.stdin.end(input, (error) => {
-            if (error)
-                failInput();
-        });
-    });
-}

package/dist/commands/connectors/credentials/set.d.ts

@@ -1,20 +0,0 @@
-import { ArdentCommand } from '../../../command.js';
-export default class SetSourceCredentials extends ArdentCommand {
-    static description: string;
-    static helpGroup: string;
-    static flags: {
-        organization: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        project: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        environment: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        connector: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        request: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        'ca-file': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        'password-stdin': import("@oclif/core/interfaces").BooleanFlag<boolean>;
-    };
-    run(): Promise<{
-        connector: string;
-        environment: string;
-        account: string;
-        delivered: true;
-    }>;
-}

package/dist/commands/connectors/credentials/set.js

@@ -1,59 +0,0 @@
-import { Flags } from '@oclif/core';
-import { readFile } from 'node:fs/promises';
-import { request } from '../../../api/client.js';
-import { loadSession } from '../../../auth/credentials.js';
-import { account, deliver, parsePasswordDocument, validateCA } from '../../../cloud/source-credentials.js';
-import { ArdentCommand } from '../../../command.js';
-export default class SetSourceCredentials extends ArdentCommand {
-    static description = 'Deliver a connector password and source CA directly to its environment AWS account';
-    static helpGroup = 'Connectors';
-    static flags = {
-        organization: Flags.string({ required: true, description: 'Owning Ardent organization ID' }),
-        project: Flags.string({ required: true, description: 'Owning Ardent project ID' }),
-        environment: Flags.string({ required: true, description: 'Target Ardent environment ID' }),
-        connector: Flags.string({ required: true, description: 'Target Ardent connector ID' }),
-        request: Flags.string({ required: true, description: 'Stable UUID for safe retries' }),
-        'ca-file': Flags.string({ required: true, description: 'PEM source certificate-authority file' }),
-        'password-stdin': Flags.boolean({ required: true, description: 'Read {"password":"…"} from standard input' }),
-    };
-    async run() {
-        const { flags } = await this.parse(SetSourceCredentials);
-        const uuid = '[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}';
-        if (!new RegExp(`^environment_${uuid}$`).test(flags.environment) || !new RegExp(`^connector_${uuid}$`).test(flags.connector) || !new RegExp(`^${uuid}$`).test(flags.request))
-            this.error('Environment, connector, or request identity is invalid.');
-        const session = await loadSession(this.config.configDir);
-        if (!session)
-            this.error('Log in before delivering source credentials.');
-        const connectors = await request(session.token, `/connectors?organization_id=${encodeURIComponent(flags.organization)}&project_id=${encodeURIComponent(flags.project)}`);
-        if (!connectors.some((connector) => connector.id === flags.connector && connector.environment_id === flags.environment))
-            this.error('The selected connector does not belong to the selected project and environment.');
-        const environments = await request(session.token, `/connector-environments?organization_id=${encodeURIComponent(flags.organization)}&project_id=${encodeURIComponent(flags.project)}`);
-        const environment = environments.find((candidate) => candidate.id === flags.environment);
-        if (!environment || !/^\d{12}$/.test(environment.cloud_account_id) || !/^[a-z]{2}(?:-gov)?-[a-z]+-\d$/.test(environment.cloud_region))
-            this.error('The selected environment has no authoritative AWS placement.');
-        const actualAccount = await account();
-        if (actualAccount !== environment.cloud_account_id)
-            this.error(`AWS is authenticated to account ${actualAccount}, not the environment account ${environment.cloud_account_id}.`);
-        const ca = validateCA(await readFile(flags['ca-file'], 'utf8'));
-        const input = await readStdin();
-        const password = parsePasswordDocument(input);
-        if (!this.jsonEnabled())
-            this.log(`Delivering source credentials for ${flags.connector} in ${flags.environment} to AWS account ${environment.cloud_account_id} (${environment.cloud_region})`);
-        await deliver({ account: environment.cloud_account_id, region: environment.cloud_region, environment: flags.environment, connector: flags.connector, request: flags.request }, ca, password);
-        if (!this.jsonEnabled())
-            this.log('✓ Source password and CA delivered');
-        return { connector: flags.connector, environment: flags.environment, account: environment.cloud_account_id, delivered: true };
-    }
-}
-async function readStdin() {
-    const chunks = [];
-    let size = 0;
-    for await (const chunk of process.stdin) {
-        const value = Buffer.from(chunk);
-        size += value.length;
-        if (size > 64 * 1024)
-            throw new Error('The source credential document is too large.');
-        chunks.push(value);
-    }
-    return Buffer.concat(chunks).toString('utf8');
-}