ardent-cli-beta 0.1.1 → 0.1.2

package/dist/branches/connection.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { acknowledgeBranchCredential, ALL_SCHEMAS_PROFILE, composeCredentialDelivery, CredentialIssueRefused, describeUnadmitted, issuedConnectKey, issueBranchCredential, revokeBranchCredential, waitForBranchCredential } from './credentials.js';
+import { acknowledgeBranchCredential, ALL_SCHEMAS_PROFILE, composeCredentialDelivery, CredentialIssueRefused, describeUnadmitted, issuedConnectKey, issueBranchCredentialWhenMarked, revokeBranchCredential, waitForBranchCredential } from './credentials.js';
 import { CLIENT_REQUIREMENTS, connectionString } from './drivers.js';
 import { connectionEnvironment, runPsql } from './psql.js';
 import { CredentialRecoveryCleanupError, forgetCredentialRecovery, openCredentialWitness, rememberCredentialIssuance, rememberCredentialRequest } from './recovery.js';
@@ -29,7 +29,7 @@ export async function connectToBranch(connection) {
         let failure;
         try {
             try {
-                const issued = await issueBranchCredential(token, branchID, requestID, credential);
+                const issued = await issueBranchCredentialWhenMarked(token, branchID, requestID, credential, say);
                 issuanceID = issued.issuanceID;
                 await rememberCredentialIssuance(recovery, issuanceID);
                 connectKey = issuedConnectKey(issued);

package/dist/branches/credentials.d.ts

@@ -41,6 +41,7 @@ export type CredentialRequest = {
 export declare function validSourceRole(role: string): boolean;
 export declare function refusedBeforeIssuance(error: unknown): boolean;
 export declare function issueBranchCredential(token: string, branchID: string, requestID: string, credential: CredentialRequest): Promise<IssuedCredential>;
+export declare function issueBranchCredentialWhenMarked(token: string, branchID: string, requestID: string, credential: CredentialRequest, say: (message: string) => void): Promise<IssuedCredential>;
 export declare function issuedConnectKey(issued: IssuedCredential): string | undefined;
 export declare function composeCredentialDelivery(delivered: DeliveredCredential, connectKey?: string): DeliveredCredential;
 export declare function waitForBranchCredential(token: string, issuanceID: string, stop?: AbortSignal, served?: Promise<void>): Promise<DeliveredCredential>;

package/dist/branches/credentials.js

@@ -9,10 +9,18 @@ export class CredentialIssueRefused extends Error {
         this.code = code;
     }
 }
+// branch_mark_pending is a branch registered ahead of its covering mark. The
+// API refuses its credential before recording anything, and the same request
+// is accepted once the mark binds (issueBranchCredentialWhenMarked).
+const MARK_PENDING = 'branch_mark_pending';
+// How long a credential wait lasts once nothing outside it bounds it: the wait
+// for a branch to bind its covering mark, and the wait for delivery once the
+// branch serves.
+const WAIT_BOUND_MS = 10 * 60 * 1000;
 // The issuance refusals that come before any issuance is recorded: a request
 // refused with one of these left nothing to revoke.
 const issueRefusals = new Set(['invalid_source_role', 'source_role_unsupported', 'source_role_held', 'source_role_revocation_pending', 'connect_key_unsupported',
-    'all_schemas_read_write_unsupported', 'all_schemas_read_write_unowned']);
+    'all_schemas_read_write_unsupported', 'all_schemas_read_write_unowned', MARK_PENDING]);
 // The access profile branch connect asks for without --role, and the one an
 // earlier release of this CLI asked for, which a recovery record naming no
 // profile replays.
@@ -74,6 +82,33 @@ export async function issueBranchCredential(token, branchID, requestID, credenti
     // records and revokes an issuance even when its secret is absent or malformed.
     return { issuanceID: result.issuance_id, connectKey: result.connect_key, connectKeyRequired: result.connect_key_required };
 }
+// issueBranchCredentialWhenMarked is issueBranchCredential for a branch that
+// may still be waiting for its covering mark: a branch_mark_pending refusal
+// sends the same request again on the poll cadence, saying so once, until the
+// API accepts it or ten minutes pass. Every other refusal is thrown as it
+// came. Credential recovery calls issueBranchCredential instead, since a
+// branch_mark_pending answer already tells it there is nothing to revoke.
+export async function issueBranchCredentialWhenMarked(token, branchID, requestID, credential, say) {
+    const deadline = Date.now() + WAIT_BOUND_MS;
+    const pause = pollPauser();
+    let announced = false;
+    for (;;) {
+        try {
+            return await issueBranchCredential(token, branchID, requestID, credential);
+        }
+        catch (error) {
+            if (!(error instanceof CredentialIssueRefused) || error.code !== MARK_PENDING)
+                throw error;
+            if (Date.now() >= deadline) {
+                throw new CredentialIssueRefused(`Timed out after ten minutes waiting for the branch's snapshot, so no credential was issued. Check branch status before trying again. ${error.message}`, MARK_PENDING);
+            }
+            if (!announced)
+                say('Waiting for the branch\'s snapshot...');
+            announced = true;
+            await pause();
+        }
+    }
+}
 export function issuedConnectKey(issued) {
     if (issued.connectKeyRequired === undefined || issued.connectKeyRequired === false) {
         if (issued.connectKey !== undefined)
@@ -129,7 +164,7 @@ export function composeCredentialDelivery(delivered, connectKey) {
 // since the control plane delivers nothing before it, and until then the wait
 // is bounded by whatever bounds served.
 export async function waitForBranchCredential(token, issuanceID, stop, served) {
-    const bound = 10 * 60 * 1000;
+    const bound = WAIT_BOUND_MS;
     let deadline = served ? Number.POSITIVE_INFINITY : Date.now() + bound;
     served?.then(() => { deadline = Date.now() + bound; }, () => { });
     // A 202 is re-read on the poll cadence; a 5xx or a lost response is retried

package/oclif.manifest.json

@@ -908,5 +908,5 @@
       ]
     }
   },
-  "version": "0.1.1"
+  "version": "0.1.2"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ardent-cli-beta",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "The Ardent command-line interface",
   "license": "Apache-2.0",
   "type": "module",