hammerkit 1.23.0 → 1.25.0

package/dist/remote/host-config.js

@@ -0,0 +1,170 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pinLogin = exports.setDefaultLocation = exports.removeServer = exports.addServer = exports.normalizeServerUrl = exports.validateServerName = exports.writeHostConfig = exports.readHostConfig = exports.getHostConfigPath = exports.hasServer = exports.hostConfigSchema = exports.hostServerSchema = exports.RESERVED_SERVER_NAMES = void 0;
+const path_1 = require("path");
+const zod_1 = require("zod");
+const yaml_1 = require("yaml");
+const get_cache_directory_1 = require("../optimizer/get-cache-directory");
+// Names with a meaning of their own in `run.on` / `--on`
+exports.RESERVED_SERVER_NAMES = ['local', 'auto'];
+const serverNamePattern = /^[a-z0-9][a-z0-9._-]*$/i;
+const checked = (what) => (value, ctx) => {
+    try {
+        normalizeServerUrl(value, what);
+    }
+    catch (e) {
+        ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, message: e.message });
+    }
+};
+// `clientId`, `audience` and `scope` are what a login asks the identity provider
+// for. They are pinned the first time a login happens (or given to `remote add`),
+// so a server can't change them later, see device-login.ts.
+exports.hostServerSchema = zod_1.z
+    .object({
+    url: zod_1.z.string().superRefine(checked('url')),
+    issuer: zod_1.z.string().superRefine(checked('issuer')),
+    clientId: zod_1.z.string().min(1).optional(),
+    audience: zod_1.z.string().min(1).optional(),
+    scope: zod_1.z.string().min(1).optional(),
+})
+    .strict();
+// Unknown top-level keys are kept when the file is written back, so a newer
+// hammerkit's settings survive an older one editing the file.
+exports.hostConfigSchema = zod_1.z
+    .object({
+    servers: zod_1.z.record(exports.hostServerSchema).default({}),
+    run: zod_1.z.object({ on: zod_1.z.string().optional() }).passthrough().default({}),
+})
+    .passthrough();
+// Names like "constructor" must not find inherited members.
+function hasServer(servers, name) {
+    return Object.prototype.hasOwnProperty.call(servers, name);
+}
+exports.hasServer = hasServer;
+function getHostConfigPath(environment) {
+    return environment.processEnvs.HAMMERKIT_CONFIG ?? (0, path_1.join)((0, get_cache_directory_1.getHammerkitDirectory)(), 'config.yaml');
+}
+exports.getHostConfigPath = getHostConfigPath;
+async function readHostConfig(environment) {
+    const path = getHostConfigPath(environment);
+    if (!(await environment.file.exists(path))) {
+        return exports.hostConfigSchema.parse({});
+    }
+    let raw;
+    try {
+        raw = (0, yaml_1.parse)(await environment.file.read(path));
+    }
+    catch (e) {
+        throw new Error(`unable to read ${path}: ${e.message}`);
+    }
+    const result = exports.hostConfigSchema.safeParse(raw ?? {});
+    if (!result.success) {
+        const issue = result.error.issues[0];
+        throw new Error(`invalid ${path}: ${issue.path.join('.') || 'config'}: ${issue.message}`);
+    }
+    return result.data;
+}
+exports.readHostConfig = readHostConfig;
+async function writeHostConfig(environment, config) {
+    const path = getHostConfigPath(environment);
+    await environment.file.createDirectory((0, path_1.join)(path, '..'));
+    await environment.file.writeFile(path, (0, yaml_1.stringify)(config));
+}
+exports.writeHostConfig = writeHostConfig;
+function validateServerName(name) {
+    if (exports.RESERVED_SERVER_NAMES.includes(name.toLowerCase())) {
+        throw new Error(`"${name}" is reserved and cannot be used as a server name`);
+    }
+    if (!serverNamePattern.test(name)) {
+        throw new Error(`invalid server name "${name}": use letters, digits, ".", "_" and "-", starting with a letter or digit`);
+    }
+    return name;
+}
+exports.validateServerName = validateServerName;
+function isLoopback(hostname) {
+    return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]';
+}
+// A server receives the source of a run and the caller's OAuth token, so it must
+// be reached over https; plain http is only for a server on this machine. The
+// result has no trailing slash, so one server has one spelling.
+// An issuer is compared as a string with the `iss` of tokens, so it keeps the
+// spelling it was given (some providers end it with a slash, some don't).
+function normalizeServerUrl(value, what = 'url') {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error(`invalid ${what} "${value}"`);
+    }
+    if (url.username || url.password) {
+        throw new Error(`the ${what} must not contain credentials`);
+    }
+    if (url.search || url.hash) {
+        throw new Error(`the ${what} must not contain a query or fragment`);
+    }
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && isLoopback(url.hostname))) {
+        throw new Error(`the ${what} must use https (http is only allowed for localhost), got "${value}"`);
+    }
+    return what === 'issuer' ? value : url.toString().replace(/\/+$/, '');
+}
+exports.normalizeServerUrl = normalizeServerUrl;
+const PINNED = ['clientId', 'audience', 'scope'];
+async function addServer(environment, name, url, options) {
+    validateServerName(name);
+    const server = {
+        url: normalizeServerUrl(url),
+        issuer: normalizeServerUrl(options.issuer, 'issuer'),
+    };
+    for (const key of PINNED) {
+        if (options[key]) {
+            server[key] = options[key];
+        }
+    }
+    const config = await readHostConfig(environment);
+    const existing = hasServer(config.servers, name) ? config.servers[name] : undefined;
+    const changed = (a, b) => a.url !== b.url || a.issuer !== b.issuer || PINNED.some((key) => a[key] !== b[key]);
+    if (existing && changed(existing, server) && !options.force) {
+        throw new Error(`server "${name}" is already registered as ${existing.url} (issuer ${existing.issuer}); ` +
+            `use --force to point it somewhere else`);
+    }
+    config.servers[name] = server;
+    await writeHostConfig(environment, config);
+    return server;
+}
+exports.addServer = addServer;
+async function removeServer(environment, name) {
+    const config = await readHostConfig(environment);
+    if (!hasServer(config.servers, name)) {
+        throw new Error(`server "${name}" is not registered`);
+    }
+    delete config.servers[name];
+    const resetDefault = config.run.on === name;
+    if (resetDefault) {
+        delete config.run.on;
+    }
+    await writeHostConfig(environment, config);
+    return { resetDefault };
+}
+exports.removeServer = removeServer;
+async function setDefaultLocation(environment, on) {
+    const config = await readHostConfig(environment);
+    if (!exports.RESERVED_SERVER_NAMES.includes(on) && !hasServer(config.servers, on)) {
+        throw new Error(`server "${on}" is not registered; add it with: hammerkit remote add ${on} <url> --issuer <url>`);
+    }
+    config.run.on = on;
+    await writeHostConfig(environment, config);
+}
+exports.setDefaultLocation = setDefaultLocation;
+// Remember what the first login asked the identity provider for; later logins
+// have to ask for the same.
+async function pinLogin(environment, name, pins) {
+    const config = await readHostConfig(environment);
+    if (!hasServer(config.servers, name)) {
+        return;
+    }
+    Object.assign(config.servers[name], pins);
+    await writeHostConfig(environment, config);
+}
+exports.pinLogin = pinLogin;
+//# sourceMappingURL=host-config.js.map

package/dist/remote/location.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveRunLocation = void 0;
+const host_config_1 = require("./host-config");
+// Where a run happens, highest precedence first: --on / --local, HAMMERKIT_ON,
+// the runner of the tasks, `run.on` of the host config, local. `auto` (as
+// --on, HAMMERKIT_ON or run.on) means the runner of the tasks, else local.
+// A name that is not registered is an error: a run never falls back to the
+// local machine silently.
+async function resolveRunLocation(workTree, environment, options = {}) {
+    if (options.on && options.local) {
+        throw new Error('--on and --local contradict each other');
+    }
+    const config = await (0, host_config_1.readHostConfig)(environment);
+    const explicit = options.local ? 'local' : options.on ?? (environment.processEnvs.HAMMERKIT_ON || undefined);
+    if (explicit && explicit !== 'auto') {
+        return explicit === 'local' ? { type: 'local' } : lookup(config.servers, explicit);
+    }
+    const runners = getTaskRunners(workTree);
+    if (runners.length > 1) {
+        throw new Error(`a run goes to one server, but its tasks name ${runners.join(', ')}`);
+    }
+    const requested = runners[0] ?? (explicit ? undefined : config.run.on);
+    if (!requested || requested === 'local' || requested === 'auto') {
+        return { type: 'local' };
+    }
+    return lookup(config.servers, requested);
+}
+exports.resolveRunLocation = resolveRunLocation;
+function lookup(servers, name) {
+    const server = (0, host_config_1.hasServer)(servers, name) ? servers[name] : undefined;
+    if (!server) {
+        throw new Error(`server ${name} is not registered, add it with: hammerkit remote add ${name} <url> --issuer <url>`);
+    }
+    return { type: 'server', name, server };
+}
+function getTaskRunners(workTree) {
+    const runners = new Set();
+    for (const task of Object.values(workTree.tasks)) {
+        if (task.data.runner) {
+            runners.add(task.data.runner);
+        }
+    }
+    return [...runners].sort();
+}
+//# sourceMappingURL=location.js.map

package/dist/remote/remote-commands.js

@@ -0,0 +1,158 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerRemoteCommands = void 0;
+const commander_1 = require("commander");
+const colors_1 = __importDefault(require("colors"));
+const log_1 = require("../log");
+const host_config_1 = require("./host-config");
+const device_login_1 = require("./device-login");
+const credentials_1 = require("./credentials");
+const server_client_1 = require("./server-client");
+const remote_work_commands_1 = require("./remote-work-commands");
+// Host-level commands: they only touch the machine's config file, so they work
+// with or without a build file in the working directory.
+function registerRemoteCommands(program, environment, buildFile) {
+    const remote = program.command('remote').description('register the servers runs can be sent to');
+    const guarded = (failure, fn) => {
+        return async (...args) => {
+            try {
+                await fn(...args);
+            }
+            catch (e) {
+                if (e instanceof commander_1.CommanderError) {
+                    throw e;
+                }
+                program.error(`${failure}: ${(0, log_1.getErrorMessage)(e)}`, { exitCode: 1 });
+            }
+        };
+    };
+    remote
+        .command('add <name> <url>')
+        .description('register a server under a name that build files and --on can refer to')
+        .addOption(new commander_1.Option('--issuer <url>', 'OAuth issuer the server accepts tokens from').makeOptionMandatory())
+        .addOption(new commander_1.Option('--client-id <id>', 'OAuth client to sign in with (pinned; default: what the server offers)'))
+        .addOption(new commander_1.Option('--audience <audience>', 'audience of the token (pinned; default: what the server offers)'))
+        .addOption(new commander_1.Option('--scope <scope>', 'scopes to request (pinned; default: what the server offers)'))
+        .addOption(new commander_1.Option('--force', 'point an already registered name at a different server').default(false))
+        .action(guarded('Remote add was not successful', async (name, url, options) => {
+        const server = await (0, host_config_1.addServer)(environment, name, url, {
+            issuer: options.issuer,
+            clientId: options.clientId,
+            audience: options.audience,
+            scope: options.scope,
+            force: options.force,
+        });
+        environment.stdout.write(`added ${name}: ${server.url} (issuer ${server.issuer})\n`);
+    }));
+    remote
+        .command('list')
+        .description('list the registered servers')
+        .action(guarded('Remote list was not successful', async () => {
+        const config = await (0, host_config_1.readHostConfig)(environment);
+        const names = Object.keys(config.servers).sort();
+        if (names.length === 0) {
+            environment.stdout.write(`no servers registered (config: ${(0, host_config_1.getHostConfigPath)(environment)})\n`);
+            return;
+        }
+        for (const name of names) {
+            const server = config.servers[name];
+            const marker = config.run.on === name ? colors_1.default.green(' (default)') : '';
+            environment.stdout.write(`${colors_1.default.bold(name)}${marker}  ${server.url}  issuer ${server.issuer}\n`);
+        }
+        if (config.run.on === 'auto' || config.run.on === 'local') {
+            environment.stdout.write(`default location: ${config.run.on}\n`);
+        }
+    }));
+    remote
+        .command('remove <name>')
+        .description('forget a registered server')
+        .action(guarded('Remote remove was not successful', async (name) => {
+        const { resetDefault } = await (0, host_config_1.removeServer)(environment, name);
+        environment.stdout.write(`removed ${name}\n`);
+        if (resetDefault) {
+            environment.stdout.write('it was the default location, runs are local again\n');
+        }
+    }));
+    remote
+        .command('use <location>')
+        .description('set where runs happen by default: local, auto or a registered server')
+        .action(guarded('Remote use was not successful', async (location) => {
+        await (0, host_config_1.setDefaultLocation)(environment, location);
+        environment.stdout.write(`default location: ${location}\n`);
+    }));
+    const getServer = async (name) => {
+        const config = await (0, host_config_1.readHostConfig)(environment);
+        const chosen = name ?? config.run.on;
+        if (!chosen || !(0, host_config_1.hasServer)(config.servers, chosen)) {
+            throw new Error(name
+                ? `server ${name} is not registered, add it with: hammerkit remote add ${name} <url> --issuer <url>`
+                : 'name a server, or set one as the default with: hammerkit remote use <name>');
+        }
+        return { name: chosen, server: config.servers[chosen] };
+    };
+    remote
+        .command('login <name>')
+        .description('sign in to a registered server with your identity provider (device code, works headless)')
+        .action(guarded('Remote login was not successful', async (name) => {
+        const { server } = await getServer(name);
+        const { pinned, ...result } = await (0, device_login_1.deviceLogin)(server, {
+            prompt: (message) => environment.stdout.write(`${message}\n`),
+            signal: environment.abortCtrl.signal,
+        });
+        await (0, host_config_1.pinLogin)(environment, name, pinned);
+        await (0, credentials_1.saveToken)(environment, name, { url: server.url, issuer: server.issuer, ...result });
+        try {
+            const me = await (0, server_client_1.getMe)(server, result.accessToken);
+            environment.stdout.write(`signed in to ${name} as ${me.sub}\n`);
+            environment.stdout.write(me.accounts.length > 0
+                ? `service accounts: ${me.accounts.map((a) => `${(0, server_client_1.printable)(a.name)} (${a.level})`).join(', ')}\n`
+                : 'you have no service accounts on this server\n');
+        }
+        catch (e) {
+            // a token the server does not accept is of no use
+            await (0, credentials_1.removeToken)(environment, name);
+            throw e;
+        }
+    }));
+    remote
+        .command('logout <name>')
+        .description('forget the sign-in to a server')
+        .action(guarded('Remote logout was not successful', async (name) => {
+        const removed = await (0, credentials_1.removeToken)(environment, name);
+        environment.stdout.write(removed ? `signed out of ${name}\n` : `not signed in to ${name}\n`);
+    }));
+    remote
+        .command('accounts [name]')
+        .description('show who you are on a server and which service accounts you may use')
+        .action(guarded('Remote accounts was not successful', async (name) => {
+        const chosen = await getServer(name);
+        const token = await (0, credentials_1.getAccessToken)(environment, chosen.name, chosen.server);
+        const me = await (0, server_client_1.getMe)(chosen.server, token);
+        const { body } = await (0, server_client_1.callServer)(chosen.server, token, 'GET', '/v1/accounts');
+        environment.stdout.write(`${chosen.name}: ${(0, server_client_1.printable)(me.sub)} (${(0, server_client_1.printable)(me.iss)})\n`);
+        if (body.accounts.length === 0) {
+            environment.stdout.write('no service accounts\n');
+        }
+        for (const account of body.accounts) {
+            const level = account.level === 'use' ? 'use' : 'request, somebody who uses it approves';
+            environment.stdout.write(`${colors_1.default.bold((0, server_client_1.printable)(account.name))}  ${level}${account.description ? `  ${(0, server_client_1.printable)(account.description)}` : ''}  from ${account.sources.map(server_client_1.printable).join(', ')}\n`);
+        }
+        if (me.builds) {
+            const may = {
+                run: 'run published build files',
+                propose: 'propose build files, which somebody who publishes approves',
+                publish: 'publish build files',
+            }[me.builds];
+            environment.stdout.write(`you may ${may}\n`);
+        }
+        if (me.repos.length > 0) {
+            environment.stdout.write(`repositories: ${me.repos.map(server_client_1.printable).join(', ')}\n`);
+        }
+    }));
+    (0, remote_work_commands_1.registerWorkCommands)(remote, { environment, buildFile, getServer, guarded });
+}
+exports.registerRemoteCommands = registerRemoteCommands;
+//# sourceMappingURL=remote-commands.js.map

package/dist/remote/remote-work-commands.js

@@ -0,0 +1,224 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerWorkCommands = void 0;
+const commander_1 = require("commander");
+const colors_1 = __importDefault(require("colors"));
+const credentials_1 = require("./credentials");
+const collect_bundle_1 = require("./collect-bundle");
+const bundle_1 = require("./bundle");
+const server_client_1 = require("./server-client");
+const text_diff_1 = require("./text-diff");
+const PROPOSAL_NAME = /^([a-z0-9][a-z0-9._-]{0,63})@(sha256:[0-9a-f]{64})$/i;
+// A proposed version is named like `payments@sha256:...`
+function parseProposal(value) {
+    const match = PROPOSAL_NAME.exec(value);
+    return match && bundle_1.HASH_PATTERN.test(match[2]) ? { name: match[1], hash: match[2] } : undefined;
+}
+const RUN_ID = /^run_[A-Za-z0-9_-]{16}$/;
+// What a person who approves is shown of a run: everything the decision rests on.
+function describe(run) {
+    const source = run.source.type === 'ref' ? `ref ${run.source.ref}` : `snapshot ${run.source.snapshot}`;
+    const options = Object.entries(run.options)
+        .map(([key, value]) => `${key}=${Array.isArray(value) ? value.join(',') : value}`)
+        .join(' ');
+    return [
+        `${colors_1.default.bold((0, server_client_1.printable)(run.id))}  requested by ${(0, server_client_1.printable)(run.requestedBy.sub)} (${(0, server_client_1.printable)(run.requestedBy.iss)})`,
+        `  ${(0, server_client_1.printable)(run.definition.name)} ${(0, server_client_1.printable)(run.definition.hash)}`,
+        `  tasks: ${run.tasks.length > 0 ? run.tasks.map(server_client_1.printable).join(', ') : 'selected by labels'}`,
+        `  accounts: ${run.accounts.length > 0 ? run.accounts.map(server_client_1.printable).join(', ') : 'none'}, source ${(0, server_client_1.printable)(source)}${options ? `, ${(0, server_client_1.printable)(options)}` : ''}`,
+        ...(run.approvals ?? []).map((approval) => `  ${(0, server_client_1.printable)(approval.account)}: ${approval.approvedBy
+            ? `approved by ${(0, server_client_1.printable)(approval.approvedBy.sub)}`
+            : 'waits for somebody who uses it to approve'}`),
+        ...flagLines(run),
+        `  decide before ${(0, server_client_1.printable)(run.approvals?.[0]?.expiresAt ?? '-')}`,
+    ];
+}
+// What to look at first, one line.
+function flagLines(run) {
+    const flagged = Object.entries(run.plan ?? {}).filter(([, entry]) => entry.flags.length > 0);
+    return flagged.length > 0
+        ? [
+            `  look at: ${flagged
+                .map(([name, entry]) => `${(0, server_client_1.printable)(name)} (${entry.flags.map(server_client_1.printable).join(', ')})`)
+                .join(', ')}`,
+        ]
+        : [];
+}
+// The tasks and services the run executes and what each does, never a secret's value.
+function describePlan(plan) {
+    return Object.entries(plan).flatMap(([name, entry]) => [
+        `  ${colors_1.default.bold((0, server_client_1.printable)(name))}  ${entry.kind}, ${(0, server_client_1.printable)(entry.runtime)}${entry.image ? ` ${(0, server_client_1.printable)(entry.image)}` : ''}${entry.flags.length > 0 ? `  [${entry.flags.map(server_client_1.printable).join(', ')}]` : ''}`,
+        ...entry.cmds.map((cmd) => `    $ ${(0, server_client_1.printable)(cmd)}`),
+        ...(entry.deps.length > 0 ? [`    after: ${entry.deps.map(server_client_1.printable).join(', ')}`] : []),
+        ...(entry.needs.length > 0 ? [`    needs: ${entry.needs.map(server_client_1.printable).join(', ')}`] : []),
+        ...entry.secrets.map((secret) => `    secret ${(0, server_client_1.printable)(secret.from)}${secret.account ? ` as ${(0, server_client_1.printable)(secret.account)}` : ''} -> ${(0, server_client_1.printable)(secret.target)}`),
+        ...(entry.mounts.length > 0 ? [`    mounts: ${entry.mounts.map(server_client_1.printable).join(', ')}`] : []),
+        ...(entry.ports.length > 0 ? [`    ports: ${entry.ports.map(server_client_1.printable).join(', ')}`] : []),
+        ...(entry.generates.length > 0 ? [`    generates: ${entry.generates.map(server_client_1.printable).join(', ')}`] : []),
+    ]);
+}
+function registerWorkCommands(remote, context) {
+    const { environment, buildFile, getServer, guarded } = context;
+    const connect = async (name) => {
+        const chosen = await getServer(name);
+        const token = await (0, credentials_1.getAccessToken)(environment, chosen.name, chosen.server);
+        return { ...chosen, token };
+    };
+    remote
+        .command('publish <definition> [server]')
+        .description('publish the build file and the files it includes to a server, under a name runs can refer to')
+        .action(guarded('Remote publish was not successful', async (definition, name) => {
+        const bundle = await (0, collect_bundle_1.collectBundle)(buildFile, environment);
+        const { name: serverName, server, token } = await connect(name);
+        const answer = await (0, server_client_1.callServer)(server, token, 'PUT', `/v1/definitions/${encodeURIComponent(definition)}`, bundle);
+        const version = answer.body;
+        const files = Object.keys(bundle.files).length;
+        const proposed = answer.status === 202;
+        const verb = proposed ? 'proposed' : answer.status === 201 ? 'published' : 'already published';
+        environment.stdout.write(`${verb} ${definition} to ${serverName}: ${(0, server_client_1.printable)(version.hash)} (${files} ${files === 1 ? 'file' : 'files'})\n`);
+        const names = [...(version.tasks ?? []), ...(version.services ?? [])];
+        environment.stdout.write(`tasks and services: ${names.map(server_client_1.printable).join(', ') || 'none'}\n`);
+        if (proposed) {
+            environment.stdout.write(`it can not run before somebody who may publish ${(0, server_client_1.printable)(definition)} approves it, until ${(0, server_client_1.printable)(version.expiresAt)}\n`);
+        }
+    }));
+    remote
+        .command('approvals [server]')
+        .description('list the runs on a server that wait for your approval')
+        .action(guarded('Remote approvals was not successful', async (name) => {
+        const { name: serverName, server, token } = await connect(name);
+        const { body } = await (0, server_client_1.callServer)(server, token, 'GET', '/v1/approvals');
+        if (body.approvals.length === 0) {
+            environment.stdout.write(`${serverName}: no runs wait for your approval\n`);
+            return;
+        }
+        environment.stdout.write(`${serverName}: ${body.approvals.length} waiting for your approval\n`);
+        for (const run of body.approvals) {
+            for (const line of describe(run)) {
+                environment.stdout.write(`${line}\n`);
+            }
+        }
+    }));
+    remote
+        .command('show <run> [server]')
+        .description('show a run that waits for your approval in full: the commands, secrets and accounts of its tasks')
+        .action(guarded('Remote show was not successful', async (run, name) => {
+        if (!RUN_ID.test(run)) {
+            throw new Error(`${(0, server_client_1.printable)(run)} is not a run id, list them with: hammerkit remote approvals`);
+        }
+        const { server, token } = await connect(name);
+        const view = (await (0, server_client_1.callServer)(server, token, 'GET', `/v1/approvals/${run}`)).body;
+        for (const line of describe(view)) {
+            environment.stdout.write(`${line}\n`);
+        }
+        environment.stdout.write(view.plan ? `${describePlan(view.plan).join('\n')}\n` : 'the server did not record what its tasks do\n');
+    }));
+    remote
+        .command('proposals [server]')
+        .description('list the proposed versions of build files you made or may approve')
+        .action(guarded('Remote proposals was not successful', async (name) => {
+        const { name: serverName, server, token } = await connect(name);
+        const { body } = await (0, server_client_1.callServer)(server, token, 'GET', '/v1/proposals');
+        if (body.proposals.length === 0) {
+            environment.stdout.write(`${serverName}: no proposed versions\n`);
+            return;
+        }
+        environment.stdout.write(`${serverName}: ${body.proposals.length} proposed\n`);
+        for (const proposal of body.proposals) {
+            const who = proposal.mine ? 'you' : (0, server_client_1.printable)(proposal.proposedBy.sub);
+            const state = proposal.canDecide ? colors_1.default.bold('waits for your approval') : (0, server_client_1.printable)(proposal.state);
+            environment.stdout.write(`${colors_1.default.bold(`${(0, server_client_1.printable)(proposal.name)}@${(0, server_client_1.printable)(proposal.hash)}`)}  proposed by ${who}, ${state}\n`);
+            const names = [...proposal.tasks, ...proposal.services];
+            environment.stdout.write(`  tasks and services: ${names.map(server_client_1.printable).join(', ') || 'none'}\n`);
+            if (proposal.accounts.length > 0) {
+                environment.stdout.write(`  accounts: ${proposal.accounts.map(server_client_1.printable).join(', ')}${proposal.missing.length > 0
+                    ? `, the proposer does not use ${proposal.missing.map(server_client_1.printable).join(', ')}`
+                    : ''}\n`);
+            }
+            for (const line of flagLines(proposal)) {
+                environment.stdout.write(`${line}\n`);
+            }
+            if (proposal.stale) {
+                environment.stdout.write(`  stale: ${(0, server_client_1.printable)(proposal.name)} has a newer version, reject it and propose again on top of it\n`);
+            }
+            if (proposal.state === 'waiting') {
+                environment.stdout.write(`  decide before ${(0, server_client_1.printable)(proposal.expiresAt)}\n`);
+            }
+            else if (proposal.reason) {
+                environment.stdout.write(`  ${(0, server_client_1.printable)(proposal.state)}: ${(0, server_client_1.printable)(proposal.reason)}\n`);
+            }
+        }
+    }));
+    remote
+        .command('diff <proposal> [server]')
+        .description('show what a proposed version (name@hash) changes against the version it follows')
+        .action(guarded('Remote diff was not successful', async (target, name) => {
+        const proposal = parseProposal(target);
+        if (!proposal) {
+            throw new Error(`${(0, server_client_1.printable)(target)} is not a proposal, list them with: hammerkit remote proposals`);
+        }
+        const { name: serverName, server, token } = await connect(name);
+        const path = `/v1/proposals/${encodeURIComponent(proposal.name)}/${proposal.hash}`;
+        const view = (await (0, server_client_1.callServer)(server, token, 'GET', path)).body;
+        const proposed = (await (0, server_client_1.callServer)(server, token, 'GET', `${path}/files`)).body;
+        const base = view.base
+            ? (await (0, server_client_1.callServer)(server, token, 'GET', `/v1/definitions/${encodeURIComponent(proposal.name)}/${view.base}/files`)).body
+            : undefined;
+        environment.stdout.write(`${(0, server_client_1.printable)(proposal.name)}@${(0, server_client_1.printable)(proposal.hash)} on ${serverName}, proposed by ${(0, server_client_1.printable)(view.proposedBy.sub)} (${(0, server_client_1.printable)(view.proposedBy.iss)})\n`);
+        environment.stdout.write(base ? `compared with ${(0, server_client_1.printable)(view.base)}\n` : 'no version is published yet, everything is new\n');
+        if (view.stale) {
+            environment.stdout.write(`warning: ${(0, server_client_1.printable)(proposal.name)} has a newer version (${(0, server_client_1.printable)(view.latest)}), this can only be rejected\n`);
+        }
+        const lines = (0, text_diff_1.diffBundles)(base, proposed);
+        environment.stdout.write(lines.length > 0 ? `${lines.join('\n')}\n` : 'the files are the same\n');
+    }));
+    for (const action of ['yank', 'unyank']) {
+        remote
+            .command(`${action} <version> [server]`)
+            .description(action === 'yank'
+            ? 'pull a published version (name@hash) back: no run starts from it and it is not latest'
+            : 'let a yanked version (name@hash) go on')
+            .addOption(new commander_1.Option('--reason <text>', 'why, shown to whoever tries to run it').argParser((value) => value))
+            .action(guarded(`Remote ${action} was not successful`, async (target, name, options) => {
+            const version = parseProposal(target);
+            if (!version) {
+                throw new Error(`${(0, server_client_1.printable)(target)} is not a version, name it like payments@sha256:...`);
+            }
+            const { name: serverName, server, token } = await connect(name);
+            await (0, server_client_1.callServer)(server, token, 'POST', `/v1/definitions/${encodeURIComponent(version.name)}/${version.hash}/${action}`, options.reason ? { reason: options.reason } : undefined);
+            environment.stdout.write(`${action === 'yank' ? 'yanked' : 'let go on'} ${(0, server_client_1.printable)(target)} on ${serverName}\n`);
+        }));
+    }
+    for (const action of ['approve', 'reject']) {
+        remote
+            .command(`${action} <target> [server]`)
+            .description(action === 'approve'
+            ? 'let a run (run_...) or a proposed version (name@hash) that waits for your approval go ahead'
+            : 'end a run (run_...) or drop a proposed version (name@hash) that waits for your approval')
+            .addOption(new commander_1.Option('--reason <text>', 'why, shown to who asked').argParser((value) => value))
+            .action(guarded(`Remote ${action} was not successful`, async (target, name, options) => {
+            const proposal = parseProposal(target);
+            if (!proposal && !RUN_ID.test(target)) {
+                throw new Error(`${(0, server_client_1.printable)(target)} is not a run id or a proposed version, list them with: hammerkit remote approvals or remote proposals`);
+            }
+            const { name: serverName, server, token } = await connect(name);
+            const path = proposal
+                ? `/v1/proposals/${encodeURIComponent(proposal.name)}/${proposal.hash}/${action}`
+                : `/v1/approvals/${target}/${action}`;
+            const { body } = await (0, server_client_1.callServer)(server, token, 'POST', path, options.reason ? { reason: options.reason } : undefined);
+            const rejected = body.state === 'rejected';
+            environment.stdout.write(proposal
+                ? rejected
+                    ? `rejected ${target} on ${serverName}\n`
+                    : `approved ${target} on ${serverName}, it is published\n`
+                : rejected
+                    ? `rejected ${target} on ${serverName}\n`
+                    : `approved ${target} on ${serverName}, it is queued\n`);
+        }));
+    }
+}
+exports.registerWorkCommands = registerWorkCommands;
+//# sourceMappingURL=remote-work-commands.js.map