context101-cli 0.1.0

package/bin/context101.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import { main } from "../src/main.js";
+
+const code = await main(process.argv.slice(2), {
+  cwd: process.cwd(),
+  env: process.env,
+  stdout: process.stdout,
+  stderr: process.stderr,
+  stdin: process.stdin,
+});
+process.exit(code);

package/package.json

@@ -0,0 +1,26 @@
+{
+  "name": "context101-cli",
+  "version": "0.1.0",
+  "private": false,
+  "description": "Context101 self-host CLI. Use `npx context101-cli` or the `context101` bin. The public npm package named context101 is Context7's MCP, not this tool.",
+  "type": "module",
+  "bin": {
+    "context101": "./bin/context101.js"
+  },
+  "files": [
+    "bin",
+    "src"
+  ],
+  "scripts": {
+    "test": "node --test test/*.test.js"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "@inquirer/prompts": "^7.8.4"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/amplify-repo.js

@@ -0,0 +1,25 @@
+import { DEFAULT_AMPLIFY_REPO } from "./defaults.js";
+
+/** Only this GitHub login gets a default Amplify watch target. */
+export const AMPLIFY_OWNER_LOGIN = "jginorio";
+
+export function detectGithubLogin(exec) {
+  if (!exec) return "";
+  const result = exec({
+    command: "gh",
+    args: ["api", "user", "--jq", ".login"],
+  });
+  if (!result.ok) return "";
+  return String(result.stdout || "").trim();
+}
+
+/**
+ * Amplify is opt-in. A checkout of this repo must not watch
+ * jginorio/context101 unless that user is logged in on the machine,
+ * or they passed --repo.
+ */
+export function defaultAmplifyRepository({ repo, ghLogin } = {}) {
+  if (repo) return repo;
+  if (ghLogin === AMPLIFY_OWNER_LOGIN) return DEFAULT_AMPLIFY_REPO;
+  return "";
+}

package/src/aws-profiles.js

@@ -0,0 +1,128 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+
+export function listAwsProfiles({ exec, env = {}, readFile = readFileSync } = {}) {
+  if (exec) {
+    const cli = exec({
+      command: "aws",
+      args: ["configure", "list-profiles"],
+      env,
+    });
+    if (cli.ok) return unique(splitLines(cli.stdout));
+  }
+
+  const home = env.HOME || env.USERPROFILE || "";
+  const credPath =
+    env.AWS_SHARED_CREDENTIALS_FILE ||
+    (home ? path.join(home, ".aws", "credentials") : "");
+  const configPath =
+    env.AWS_CONFIG_FILE || (home ? path.join(home, ".aws", "config") : "");
+
+  return unique([
+    ...parseAwsCredentialsProfiles(readOptional(readFile, credPath)),
+    ...parseAwsConfigProfiles(readOptional(readFile, configPath)),
+  ]);
+}
+
+export function parseAwsCredentialsProfiles(text) {
+  return sectionNames(text).filter((name) => !name.startsWith("sso-session"));
+}
+
+export function parseAwsConfigProfiles(text) {
+  const names = [];
+  for (const raw of sectionNames(text)) {
+    if (raw.startsWith("sso-session")) continue;
+    if (raw.startsWith("profile ")) names.push(raw.slice("profile ".length).trim());
+    else names.push(raw);
+  }
+  return names.filter(Boolean);
+}
+
+export function resolveAwsProfile({ explicit, profiles, yes, dryRun }) {
+  return resolveAwsAuth({
+    explicitProfile: explicit,
+    profiles,
+    yes,
+    dryRun,
+  });
+}
+
+export function resolveAwsAuth({
+  explicitProfile,
+  accessKeyId,
+  secretAccessKey,
+  profiles,
+  yes,
+  dryRun,
+}) {
+  const list = Array.isArray(profiles) ? unique(profiles) : [];
+  const keyId = accessKeyId || null;
+  const secret = secretAccessKey || null;
+  const empty = {
+    profile: null,
+    accessKeyId: null,
+    secretAccessKey: null,
+    profiles: list,
+  };
+
+  if (explicitProfile) {
+    return { ...empty, profile: explicitProfile, source: "flag" };
+  }
+  if (list.length === 1) {
+    return { ...empty, profile: list[0], source: "only" };
+  }
+  if (list.length > 1) {
+    if (yes && !dryRun) {
+      return {
+        ...empty,
+        source: "ask-profile",
+        error: `multiple AWS profiles (${list.join(", ")}). Pass --aws-profile <name>.`,
+      };
+    }
+    return { ...empty, source: "ask-profile" };
+  }
+  if (keyId && secret) {
+    return { ...empty, accessKeyId: keyId, secretAccessKey: secret, source: "keys" };
+  }
+  if (keyId || secret) {
+    return {
+      ...empty,
+      source: "ask-keys",
+      error:
+        "both --aws-access-key-id and --aws-secret-access-key (or AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY) are required.",
+    };
+  }
+  if (yes && !dryRun) {
+    return { ...empty, source: "default-chain" };
+  }
+  return { ...empty, source: "ask-keys" };
+}
+
+function sectionNames(text) {
+  if (!text) return [];
+  const names = [];
+  for (const match of String(text).matchAll(/^\[([^\]]+)\]/gm)) {
+    names.push(match[1].trim());
+  }
+  return names;
+}
+
+function splitLines(text) {
+  return String(text ?? "")
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean);
+}
+
+function unique(values) {
+  return [...new Set(values.filter(Boolean))];
+}
+
+function readOptional(readFile, filePath) {
+  if (!filePath) return "";
+  try {
+    return readFile(filePath, "utf8");
+  } catch {
+    return "";
+  }
+}

package/src/bedrock-access.js

@@ -0,0 +1,129 @@
+/**
+ * Request Bedrock model access for every embedding model we support.
+ * Amazon first-party models are auto-enabled. Cohere (Marketplace) needs
+ * a foundation-model agreement. Never print offer tokens.
+ */
+
+export function parseAvailability(payload) {
+  const status = payload?.agreementAvailability?.status;
+  const entitlement = payload?.entitlementAvailability;
+  return {
+    available: status === "AVAILABLE" || entitlement === "AVAILABLE",
+    status: status || entitlement || "unknown",
+  };
+}
+
+export function pickOfferToken(payload) {
+  const offers = Array.isArray(payload?.offers) ? payload.offers : [];
+  const pub = offers.find((offer) => offer.offerType === "PUBLIC") || offers[0];
+  return pub?.offerToken ? String(pub.offerToken) : "";
+}
+
+function awsJson(exec, env, args) {
+  const result = exec({
+    command: "aws",
+    args,
+    env,
+  });
+  if (!result.ok) {
+    return { ok: false, error: result.stderr || result.stdout || "aws failed", data: null };
+  }
+  try {
+    return { ok: true, error: null, data: JSON.parse(result.stdout || "{}") };
+  } catch {
+    return { ok: false, error: "could not parse aws json", data: null };
+  }
+}
+
+export function requestEmbeddingModelAccess({
+  exec,
+  env,
+  region,
+  models,
+  dryRun = false,
+} = {}) {
+  const results = [];
+  for (const model of models || []) {
+    if (dryRun) {
+      results.push({ id: model.id, status: "would-request" });
+      continue;
+    }
+    if (model.provider === "aws") {
+      results.push({ id: model.id, status: "first-party" });
+      continue;
+    }
+
+    const availability = awsJson(exec, env, [
+      "bedrock",
+      "get-foundation-model-availability",
+      "--model-id",
+      model.id,
+      "--region",
+      region,
+      "--output",
+      "json",
+    ]);
+    if (availability.ok && parseAvailability(availability.data).available) {
+      results.push({ id: model.id, status: "already-available" });
+      continue;
+    }
+
+    const offers = awsJson(exec, env, [
+      "bedrock",
+      "list-foundation-model-agreement-offers",
+      "--model-id",
+      model.id,
+      "--region",
+      region,
+      "--output",
+      "json",
+    ]);
+    const token = offers.ok ? pickOfferToken(offers.data) : "";
+    if (!token) {
+      results.push({
+        id: model.id,
+        status: "needs-console",
+        detail: "no Marketplace offer (enable in console → Model access)",
+      });
+      continue;
+    }
+
+    const created = exec({
+      command: "aws",
+      args: [
+        "bedrock",
+        "create-foundation-model-agreement",
+        "--model-id",
+        model.id,
+        "--offer-token",
+        token,
+        "--region",
+        region,
+      ],
+      env,
+    });
+    if (created.ok) {
+      results.push({ id: model.id, status: "granted" });
+      continue;
+    }
+    const err = `${created.stderr || created.stdout || ""}`;
+    if (/already|exist|Conflict/i.test(err)) {
+      results.push({ id: model.id, status: "already-available" });
+      continue;
+    }
+    results.push({
+      id: model.id,
+      status: "needs-console",
+      detail: "could not create agreement — enable in console → Model access",
+    });
+  }
+  return results;
+}
+
+export function formatAccessResult(result) {
+  if (result.status === "first-party") return `${result.id}  Amazon (auto-enabled)`;
+  if (result.status === "already-available") return `${result.id}  already available`;
+  if (result.status === "granted") return `${result.id}  access granted`;
+  if (result.status === "would-request") return `${result.id}  would request`;
+  return `${result.id}  ${result.detail || "enable in console → Model access"}`;
+}

package/src/cdk-invoke.js

@@ -0,0 +1,231 @@
+import { spawn } from "node:child_process";
+import path from "node:path";
+import {
+  classifyGithubToken,
+  githubTokenWorksForAmplify,
+} from "./checks.js";
+import { findDeployEnvPath, readDeployEnvFile } from "./deploy-env-load.js";
+import { isHostedContext101Url } from "./hosted-url.js";
+import { mask } from "./redact.js";
+
+export const CONTEXT_KEYS = [
+  "DATABASE_URL",
+  "DATABASE_DRIVER",
+  "DATABASE_PREPARE",
+  "BETTER_AUTH_SECRET",
+  "BETTER_AUTH_URL",
+  "MCP_TOKEN_PEPPER",
+  "APP_MODE",
+  "ALLOW_PUBLIC_SIGNUP",
+  "BILLING_ENABLED",
+  "APP_URL",
+  "MARKETING_URL",
+  "MCP_PUBLIC_HOST",
+  "MCP_DOMAIN_CERT_ARN",
+  "MCP_APPRUNNER",
+  "SES_REGION",
+  "SES_FROM_EMAIL",
+  "SES_REPLY_TO_EMAIL",
+  "REPOSITORY",
+  "EMBED_MODEL_ID",
+  "CREATE_RDS",
+];
+
+const SECRET_CONTEXT = new Set([
+  "token",
+  "githubToken",
+  "DATABASE_URL",
+  "BETTER_AUTH_SECRET",
+  "MCP_TOKEN_PEPPER",
+]);
+
+export function resolveDeployContext({
+  repoRoot,
+  env = {},
+  home = false,
+  envFile = null,
+  cwd,
+  exec,
+} = {}) {
+  const filePath = findDeployEnvPath({ repoRoot, envFile, home, cwd });
+  const file = readDeployEnvFile(filePath);
+  const values = { ...file.values };
+
+  const token = String(env.CTX_TOKEN || values.CTX_TOKEN || "").trim();
+  let githubToken = String(env.CTX_GH_TOKEN || values.CTX_GH_TOKEN || "").trim();
+  if (!githubToken && exec) {
+    const gh = exec({ command: "gh", args: ["auth", "token"], env });
+    if (gh.ok) githubToken = String(gh.stdout || "").trim();
+  }
+
+  const awsProfile = env.AWS_PROFILE || values.AWS_PROFILE || "";
+  const repository = String(values.REPOSITORY || env.REPOSITORY || "").trim();
+
+  return {
+    filePath: file.exists ? file.path : filePath,
+    fileExists: file.exists,
+    declared: file.declared,
+    values,
+    token,
+    githubToken,
+    awsProfile,
+    repository,
+  };
+}
+
+export function assertDeployTokens(context, { action = "deploy" } = {}) {
+  if (action === "destroy") return;
+  if (!context.token) {
+    const error = new Error(
+      "Missing CTX_TOKEN. Run `context101 init` or `context101 config set CTX_TOKEN=…`, then `context101 deploy`."
+    );
+    error.code = "USAGE";
+    throw error;
+  }
+  if (context.repository) {
+    const kind = classifyGithubToken(context.githubToken);
+    if (!githubTokenWorksForAmplify(kind)) {
+      const error = new Error(
+        "GitHub token is not a personal access token (need ghp_ or github_pat_). Amplify CreateApp calls list-repository-webhooks; ghs_ / gho_ tokens 403 and roll the stack back. Set CTX_GH_TOKEN to a classic PAT with repo scope."
+      );
+      error.code = "USAGE";
+      throw error;
+    }
+  }
+}
+
+export function buildCdkArgs({
+  action = "deploy",
+  seed = false,
+  context,
+  extraArgs = [],
+  stackName = null,
+  env = {},
+} = {}) {
+  const args = [action];
+  if (action === "destroy" && stackName) args.push(stackName);
+  if (seed) args.push("-c", "seed=true");
+  if (context.token) args.push("-c", `token=${context.token}`);
+  if (context.repository && context.githubToken) {
+    args.push("-c", `githubToken=${context.githubToken}`);
+  }
+
+  for (const key of CONTEXT_KEYS) {
+    if (context.fileExists && !context.declared.has(key)) continue;
+    const value = context.fileExists
+      ? context.values[key]
+      : context.values[key] || env[key] || "";
+    if (!value) continue;
+    if (isHostedContext101Url(value)) {
+      if (context.fileExists && context.declared.has(key)) {
+        const error = new Error(
+          `${key} in the env file is the hosted Context101 product, not a self-host URL. Omit it so CDK uses the Amplify default domain, or set a domain you own.`
+        );
+        error.code = "USAGE";
+        throw error;
+      }
+      continue;
+    }
+    args.push("-c", `${key}=${value}`);
+  }
+
+  if (action === "deploy") args.push("--require-approval", "never");
+  if (action === "destroy") args.push("--force");
+  args.push(...extraArgs);
+  return args;
+}
+
+export function formatCdkPreview({ action, context, args, seed }) {
+  const lines = [`cdk ${action}`];
+  if (context.fileExists) {
+    lines.push(`  env file:    ${displayEnv(context.filePath)}`);
+  }
+  if (context.awsProfile) lines.push(`  AWS_PROFILE: ${context.awsProfile}`);
+  lines.push(`  token:       ${mask(context.token)}`);
+  if (context.repository) {
+    lines.push(`  githubToken: ${mask(context.githubToken)}`);
+  } else {
+    lines.push("  githubToken: (skipped — no REPOSITORY)");
+  }
+  for (const [flag, value] of contextPairs(args)) {
+    if (flag === "token" || flag === "githubToken" || flag === "seed") continue;
+    const shown = SECRET_CONTEXT.has(flag) ? `${flag}: ${mask(value)}` : `${flag}: ${value}`;
+    lines.push(`  ${shown}`);
+  }
+  if (seed) lines.push("  seed:        true");
+  return lines.join("\n");
+}
+
+function contextPairs(args) {
+  const pairs = [];
+  for (let i = 0; i < args.length; i += 1) {
+    if (args[i] === "-c" && args[i + 1]) {
+      const raw = args[i + 1];
+      const eq = raw.indexOf("=");
+      if (eq > 0) pairs.push([raw.slice(0, eq), raw.slice(eq + 1)]);
+      i += 1;
+    }
+  }
+  return pairs;
+}
+
+function displayEnv(filePath) {
+  if (!filePath) return "";
+  const home = `${process.env.HOME || ""}/.context101/deploy-env`;
+  if (filePath === home || filePath.endsWith("/.context101/deploy-env")) {
+    return "~/.context101/deploy-env";
+  }
+  if (filePath.endsWith("/cdk/.deploy-env") || filePath.endsWith("cdk/.deploy-env")) {
+    return "cdk/.deploy-env";
+  }
+  return filePath;
+}
+
+export function runCdk({
+  repoRoot,
+  action = "deploy",
+  seed = false,
+  extraArgs = [],
+  stackName = null,
+  env = {},
+  home = false,
+  envFile = null,
+  cwd,
+  exec,
+  stdio = "inherit",
+} = {}) {
+  const context = resolveDeployContext({
+    repoRoot,
+    env,
+    home,
+    envFile,
+    cwd,
+    exec,
+  });
+  assertDeployTokens(context, { action });
+  const args = buildCdkArgs({
+    action,
+    seed,
+    context,
+    extraArgs,
+    stackName,
+    env,
+  });
+  const childEnv = { ...env };
+  if (context.awsProfile) childEnv.AWS_PROFILE = context.awsProfile;
+  if (context.values.AWS_ACCESS_KEY_ID && !childEnv.AWS_ACCESS_KEY_ID) {
+    childEnv.AWS_ACCESS_KEY_ID = context.values.AWS_ACCESS_KEY_ID;
+  }
+  if (context.values.AWS_SECRET_ACCESS_KEY && !childEnv.AWS_SECRET_ACCESS_KEY) {
+    childEnv.AWS_SECRET_ACCESS_KEY = context.values.AWS_SECRET_ACCESS_KEY;
+  }
+  return new Promise((resolve, reject) => {
+    const child = spawn("npx", ["cdk", ...args], {
+      cwd: path.join(repoRoot, "cdk"),
+      env: childEnv,
+      stdio,
+    });
+    child.on("error", reject);
+    child.on("exit", (code) => resolve(code ?? 1));
+  });
+}