gigadrive 2.15.0 → 2.17.0

package/dist/index.cjs

@@ -32,7 +32,7 @@ var import_effect31 = require("effect");
 // package.json
 var package_default = {
   name: "gigadrive",
-  version: "2.15.0",
+  version: "2.17.0",
   repository: {
     type: "git",
     url: "https://github.com/Gigadrive/sdk.git",
@@ -3073,6 +3073,7 @@ var describeMicroVm = (vm, now = Date.now()) => {
     `Size:        ${vm.vcpus} vCPU, ${formatMemory(vm.memoryMb)} memory, ${formatMemory(vm.diskMb)} disk`,
     `Region:      ${vm.region}`,
     `Network:     ${vm.network.egress === "deny" ? "outbound traffic blocked" : vm.network.allow && vm.network.allow.length > 0 ? `only ${vm.network.allow.join(", ")}` : "internet access"}`,
+    ...(vm.network.inject ?? []).map((rule) => `Injects:     ${rule.headers.join(", ")} for ${rule.domain}`),
     `Previews:    ${vm.network.previews === "private" ? "private (preview token required)" : "public"}`,
     `Application: ${vm.applicationId}`,
     `Created:     ${vm.createdAt}`
@@ -3383,6 +3384,37 @@ var parseVolumeFlags = (values) => import_effect24.Effect.gen(function* () {
   }
   return volumes;
 });
+var parseInjectFlags = (values) => import_effect24.Effect.gen(function* () {
+  const rules = /* @__PURE__ */ new Map();
+  for (const value of values) {
+    const colon = value.indexOf(":");
+    const equals = value.indexOf("=", colon + 1);
+    const domain = colon > 0 ? value.slice(0, colon).trim().toLowerCase() : "";
+    const name = colon > 0 && equals > colon ? value.slice(colon + 1, equals).trim() : "";
+    if (domain === "" || name === "" || equals === value.length - 1) {
+      return yield* new InvalidMicroVmOptionsError({
+        // The entry is not echoed: it may hold the credential.
+        message: '--inject and --inject-file take DOMAIN:HEADER=VALUE, such as "api.openai.com:Authorization=Bearer $OPENAI_API_KEY".'
+      });
+    }
+    rules.set(domain, { ...rules.get(domain), [name]: value.slice(equals + 1) });
+  }
+  if (rules.size > 8) {
+    return yield* new InvalidMicroVmOptionsError({ message: "--inject takes at most 8 domains." });
+  }
+  return [...rules].map(([domain, headers]) => ({ domain, headers }));
+});
+var readInjectRules = (inject, injectFile) => import_effect24.Effect.gen(function* () {
+  if (import_effect24.Option.isNone(injectFile)) return yield* parseInjectFlags(inject);
+  const fs = yield* import_platform8.FileSystem.FileSystem;
+  const content = yield* fs.readFileString(injectFile.value).pipe(
+    import_effect24.Effect.mapError(
+      () => new InvalidMicroVmOptionsError({ message: `Could not read --inject-file ${injectFile.value}.` })
+    )
+  );
+  const lines = content.split(/\r?\n/).map((line) => line.trim()).filter((line) => line !== "" && !line.startsWith("#"));
+  return yield* parseInjectFlags([...inject, ...lines]);
+});
 var checkEgressFlags = (denyEgress, allowEgress) => import_effect24.Effect.gen(function* () {
   if (denyEgress && allowEgress.length > 0) {
     return yield* new InvalidMicroVmOptionsError({
@@ -3413,6 +3445,10 @@ var createInput = (flags) => import_effect24.Effect.gen(function* () {
   if (badPort !== void 0) {
     return yield* new InvalidMicroVmOptionsError({ message: `--port must be between 1 and 65535 (got ${badPort}).` });
   }
+  const inject = yield* readInjectRules(flags.inject, flags.injectFile);
+  if (inject.length > 0 && flags.denyEgress) {
+    return yield* new InvalidMicroVmOptionsError({ message: "--inject cannot be combined with --deny-egress." });
+  }
   const volumes = yield* parseVolumeFlags(flags.volumes);
   if (volumes.length > 0 && flags.pauseOnTimeout) {
     return yield* new InvalidMicroVmOptionsError({ message: "--volume cannot be combined with --pause-on-timeout." });
@@ -3434,11 +3470,12 @@ var createInput = (flags) => import_effect24.Effect.gen(function* () {
     ...env ? { env } : {},
     ...metadata ? { metadata } : {},
     ...volumes.length > 0 ? { volumes } : {},
-    ...flags.denyEgress || flags.privatePreviews || flags.allowEgress.length > 0 ? {
+    ...flags.denyEgress || flags.privatePreviews || flags.allowEgress.length > 0 || inject.length > 0 ? {
       network: {
         egress: flags.denyEgress ? "deny" : "allow",
         ...flags.privatePreviews ? { previews: "private" } : {},
-        ...flags.allowEgress.length > 0 ? { allow: flags.allowEgress.map((entry) => entry.trim()) } : {}
+        ...flags.allowEgress.length > 0 ? { allow: flags.allowEgress.map((entry) => entry.trim()) } : {},
+        ...inject.length > 0 ? { inject } : {}
       }
     } : {},
     ...import_effect24.Option.match(flags.region, { onNone: () => ({}), onSome: (region) => ({ region }) })
@@ -3529,6 +3566,18 @@ var createCommand = import_cli12.Command.make(
       ),
       import_cli12.Options.repeated
     ),
+    inject: import_cli12.Options.text("inject").pipe(
+      import_cli12.Options.withDescription(
+        "Add a header to HTTPS requests to a domain, as DOMAIN:HEADER=VALUE (repeatable, up to 8 domains); the value never enters the microVM"
+      ),
+      import_cli12.Options.repeated
+    ),
+    injectFile: import_cli12.Options.text("inject-file").pipe(
+      import_cli12.Options.withDescription(
+        "Read --inject rules from a file, one DOMAIN:HEADER=VALUE per line (/dev/stdin for a pipe), so the values stay out of the command line"
+      ),
+      import_cli12.Options.optional
+    ),
     pauseOnTimeout: import_cli12.Options.boolean("pause-on-timeout").pipe(
       import_cli12.Options.withDescription("Pause the microVM when its timeout ends instead of stopping it")
     ),
@@ -3898,15 +3947,31 @@ var updateMicroVmNetwork = (microvmId, flags) => import_effect24.Effect.gen(func
     });
   }
   yield* checkEgressFlags(flags.denyEgress, flags.allowEgress);
+  const inject = yield* readInjectRules(flags.inject, flags.injectFile);
+  if (inject.length > 0 && flags.denyEgress) {
+    return yield* new InvalidMicroVmOptionsError({ message: "--inject cannot be combined with --deny-egress." });
+  }
+  if (flags.clearInject && (inject.length > 0 || flags.denyEgress)) {
+    return yield* new InvalidMicroVmOptionsError({
+      message: "--clear-inject cannot be combined with --inject or --deny-egress."
+    });
+  }
   const apiClient = yield* ApiClientService;
   const vm = yield* apiClient.request(
     (client) => client.microvms.updateNetwork(
       microvmId,
-      flags.denyEgress ? { egress: "deny" } : flags.allowEgress.length > 0 ? { egress: "allow", allow: flags.allowEgress.map((entry) => entry.trim()) } : { egress: "allow" }
+      flags.denyEgress ? { egress: "deny" } : {
+        egress: "allow",
+        ...flags.allowEgress.length > 0 ? { allow: flags.allowEgress.map((entry) => entry.trim()) } : {},
+        ...inject.length > 0 || flags.clearInject ? { inject } : {}
+      }
     )
   );
   const reach = vm.network.egress === "deny" ? "no outbound traffic" : vm.network.allow ? vm.network.allow.join(", ") : "the whole internet";
   yield* import_effect24.Console.log(`${vm.id} now reaches ${reach}.`);
+  for (const rule of vm.network.inject ?? []) {
+    yield* import_effect24.Console.log(`Adds ${rule.headers.join(", ")} to HTTPS requests to ${rule.domain}.`);
+  }
   return vm;
 });
 var networkCommand = import_cli12.Command.make(
@@ -3922,6 +3987,21 @@ var networkCommand = import_cli12.Command.make(
     ),
     allowAllEgress: import_cli12.Options.boolean("allow-all-egress").pipe(
       import_cli12.Options.withDescription("Reach the whole internet again (private networks stay blocked)")
+    ),
+    inject: import_cli12.Options.text("inject").pipe(
+      import_cli12.Options.withDescription(
+        "Add a header to HTTPS requests to a domain, as DOMAIN:HEADER=VALUE (repeatable, up to 8 domains); the value never enters the microVM"
+      ),
+      import_cli12.Options.repeated
+    ),
+    injectFile: import_cli12.Options.text("inject-file").pipe(
+      import_cli12.Options.withDescription(
+        "Read --inject rules from a file, one DOMAIN:HEADER=VALUE per line (/dev/stdin for a pipe), so the values stay out of the command line"
+      ),
+      import_cli12.Options.optional
+    ),
+    clearInject: import_cli12.Options.boolean("clear-inject").pipe(
+      import_cli12.Options.withDescription("Remove every header rule added with --inject")
     )
   },
   ({ microvmId, ...flags }) => updateMicroVmNetwork(microvmId, flags).pipe(import_effect24.Effect.asVoid, reportErrors2("update the microVM network"))