hammerkit 1.27.0-next.9 → 2.0.0-next.2

package/dist/remote/device-login.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.deviceLogin = void 0;
+exports.deviceLogin = exports.NoSignInError = void 0;
 const server_client_1 = require("./server-client");
 const GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';
 const DEFAULT_INTERVAL_SECONDS = 5;
@@ -8,6 +8,11 @@ const SLOW_DOWN_SECONDS = 5;
 const FETCH_TIMEOUT_MS = 10000;
 const MIN_INTERVAL_SECONDS = 1;
 const MAX_LIFETIME_SECONDS = 30 * 60;
+// The server takes tokens of this issuer but offers no device sign-in for it: the token has
+// to come from elsewhere, such as a token command.
+class NoSignInError extends server_client_1.ServerError {
+}
+exports.NoSignInError = NoSignInError;
 const isLoopbackHost = (hostname) => ['localhost', '127.0.0.1', '[::1]'].includes(hostname);
 // An endpoint must use the scheme of the issuer: loopback http is for a test
 // identity provider on this machine only, never beside an https issuer.
@@ -89,7 +94,7 @@ async function deviceLogin(server, options) {
         throw new server_client_1.ServerError(`${server.url} does not accept tokens from ${server.issuer} (it accepts ${accepted})`);
     }
     if (!offered.clientId) {
-        throw new server_client_1.ServerError(`${server.url} offers no sign-in for ${server.issuer}, it needs a token obtained elsewhere`);
+        throw new NoSignInError(`${server.url} offers no sign-in for ${server.issuer}, it needs a token obtained elsewhere`);
     }
     // What was pinned (by `remote add` or an earlier login) wins; the server can
     // only offer the same, never something else to sign in with.

package/dist/remote/host-config.js

@@ -1,10 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.pinLogin = exports.setDefaultLocation = exports.removeServer = exports.addServer = exports.normalizeServerUrl = exports.validateServerName = exports.writeHostConfig = exports.readHostConfig = exports.getHostConfigPath = exports.hasServer = exports.hostConfigSchema = exports.hostServerSchema = exports.RESERVED_SERVER_NAMES = void 0;
+exports.pinLogin = exports.setDefaultLocation = exports.removeServer = exports.addServer = exports.normalizeServerUrl = exports.validateServerName = exports.writeHostConfig = exports.readHostConfig = exports.getHostConfigPath = exports.getRegisteredServer = exports.getTokenCommand = exports.hasServer = exports.hostConfigSchema = exports.hostServerSchema = exports.RESERVED_SERVER_NAMES = void 0;
 const path_1 = require("path");
 const zod_1 = require("zod");
 const yaml_1 = require("yaml");
 const get_cache_directory_1 = require("../optimizer/get-cache-directory");
+const build_file_secret_provider_schema_1 = require("../schema/build-file-secret-provider-schema");
 // Names with a meaning of their own in `run.on` / `--on`
 exports.RESERVED_SERVER_NAMES = ['local', 'auto'];
 const serverNamePattern = /^[a-z0-9][a-z0-9._-]*$/i;
@@ -28,12 +29,25 @@ exports.hostServerSchema = zod_1.z
     scope: zod_1.z.string().min(1).optional(),
 })
     .strict();
+// A command that prints the token for a server instead of a login, see token-source.ts.
+// It is bound to the url and issuer it was registered for, like a sign-in, and lives
+// beside `servers` rather than in it: hammerkit before 2.0 refuses unknown keys of a
+// server, but keeps unknown top-level keys. It is only ever read from the host config,
+// a build file can't name one.
+const tokenCommandSchema = zod_1.z
+    .object({ url: zod_1.z.string(), issuer: zod_1.z.string(), command: zod_1.z.string().trim().min(1) })
+    .passthrough();
 // Unknown top-level keys are kept when the file is written back, so a newer
 // hammerkit's settings survive an older one editing the file.
 exports.hostConfigSchema = zod_1.z
     .object({
     servers: zod_1.z.record(exports.hostServerSchema).default({}),
+    tokenCommands: zod_1.z.record(tokenCommandSchema).optional(),
     run: zod_1.z.object({ on: zod_1.z.string().optional() }).passthrough().default({}),
+    // how this machine reads secrets, beside what the build files declare (see
+    // collectSecretCatalog); a server reads only its own config
+    secretProviders: build_file_secret_provider_schema_1.buildFileSecretProvidersSchema.optional(),
+    secretAccounts: build_file_secret_provider_schema_1.buildFileSecretAccountsSchema.optional(),
 })
     .passthrough();
 // Names like "constructor" must not find inherited members.
@@ -41,6 +55,35 @@ function hasServer(servers, name) {
     return Object.prototype.hasOwnProperty.call(servers, name);
 }
 exports.hasServer = hasServer;
+// The token command of a server, unless it was registered for another url or issuer (an
+// older hammerkit that pointed the name elsewhere leaves it behind).
+function getTokenCommand(config, name) {
+    const commands = config.tokenCommands ?? {};
+    const entry = Object.prototype.hasOwnProperty.call(commands, name) ? commands[name] : undefined;
+    const server = hasServer(config.servers, name) ? config.servers[name] : undefined;
+    return entry && server && entry.url === server.url && entry.issuer === server.issuer ? entry.command : undefined;
+}
+exports.getTokenCommand = getTokenCommand;
+function getRegisteredServer(config, name) {
+    const tokenCommand = getTokenCommand(config, name);
+    return { ...config.servers[name], ...(tokenCommand ? { tokenCommand } : {}) };
+}
+exports.getRegisteredServer = getRegisteredServer;
+function setTokenCommand(config, name, entry) {
+    const commands = { ...(config.tokenCommands ?? {}) };
+    if (entry) {
+        commands[name] = entry;
+    }
+    else {
+        delete commands[name];
+    }
+    if (Object.keys(commands).length > 0) {
+        config.tokenCommands = commands;
+    }
+    else {
+        delete config.tokenCommands;
+    }
+}
 function getHostConfigPath(environment) {
     return environment.processEnvs.HAMMERKIT_CONFIG ?? (0, path_1.join)((0, get_cache_directory_1.getHammerkitDirectory)(), 'config.yaml');
 }
@@ -121,16 +164,38 @@ async function addServer(environment, name, url, options) {
             server[key] = options[key];
         }
     }
+    if (typeof options.tokenCommand === 'string' && !options.tokenCommand.trim()) {
+        throw new Error('the token command must not be empty, use --no-token-command to remove it');
+    }
     const config = await readHostConfig(environment);
     const existing = hasServer(config.servers, name) ? config.servers[name] : undefined;
-    const changed = (a, b) => a.url !== b.url || a.issuer !== b.issuer || PINNED.some((key) => a[key] !== b[key]);
+    const sameServer = (a, b) => a.url === b.url && a.issuer === b.issuer;
+    // Adding the same server again keeps what was pinned (by a login, too) unless it is given,
+    // so a later `remote add ... --token-command` needs no --force.
+    if (existing && sameServer(existing, server)) {
+        for (const key of PINNED) {
+            if (!server[key] && existing[key]) {
+                server[key] = existing[key];
+            }
+        }
+    }
+    const changed = (a, b) => !sameServer(a, b) || PINNED.some((key) => a[key] !== b[key]);
     if (existing && changed(existing, server) && !options.force) {
         throw new Error(`server "${name}" is already registered as ${existing.url} (issuer ${existing.issuer}); ` +
             `use --force to point it somewhere else`);
     }
+    // The command decides which identity's token goes to the server: changing it does not
+    // redirect anything, but a name pointed at another server does not keep the old one.
+    const kept = existing && sameServer(existing, server) ? getTokenCommand(config, name) : undefined;
+    const tokenCommand = typeof options.tokenCommand === 'string'
+        ? options.tokenCommand.trim()
+        : options.tokenCommand === undefined
+            ? kept
+            : undefined;
     config.servers[name] = server;
+    setTokenCommand(config, name, tokenCommand ? { url: server.url, issuer: server.issuer, command: tokenCommand } : undefined);
     await writeHostConfig(environment, config);
-    return server;
+    return { ...server, ...(tokenCommand ? { tokenCommand } : {}) };
 }
 exports.addServer = addServer;
 async function removeServer(environment, name) {
@@ -139,6 +204,7 @@ async function removeServer(environment, name) {
         throw new Error(`server "${name}" is not registered`);
     }
     delete config.servers[name];
+    setTokenCommand(config, name, undefined);
     const resetDefault = config.run.on === name;
     if (resetDefault) {
         delete config.run.on;

package/dist/remote/remote-commands.js

@@ -40,6 +40,8 @@ passthrough = []) {
         .addOption(new commander_1.Option('--client-id <id>', 'OAuth client to sign in with (pinned; default: what the server offers)'))
         .addOption(new commander_1.Option('--audience <audience>', 'audience of the token (pinned; default: what the server offers)'))
         .addOption(new commander_1.Option('--scope <scope>', 'scopes to request (pinned; default: what the server offers)'))
+        .addOption(new commander_1.Option('--token-command <command>', 'a command that prints the token for this server, instead of remote login (e.g. of a service account)'))
+        .addOption(new commander_1.Option('--no-token-command', 'remove the token command, sign in with remote login again'))
         .addOption(new commander_1.Option('--force', 'point an already registered name at a different server').default(false))
         .action(guarded('Remote add was not successful', async (name, url, options) => {
         const server = await (0, host_config_1.addServer)(environment, name, url, {
@@ -47,9 +49,13 @@ passthrough = []) {
             clientId: options.clientId,
             audience: options.audience,
             scope: options.scope,
+            tokenCommand: options.tokenCommand,
             force: options.force,
         });
         environment.stdout.write(`added ${name}: ${server.url} (issuer ${server.issuer})\n`);
+        if (server.tokenCommand) {
+            environment.stdout.write(`tokens for ${name} come from: ${server.tokenCommand}\n`);
+        }
     }));
     remote
         .command('list')
@@ -62,9 +68,10 @@ passthrough = []) {
             return;
         }
         for (const name of names) {
-            const server = config.servers[name];
+            const server = (0, host_config_1.getRegisteredServer)(config, name);
             const marker = config.run.on === name ? colors_1.default.green(' (default)') : '';
-            environment.stdout.write(`${colors_1.default.bold(name)}${marker}  ${server.url}  issuer ${server.issuer}\n`);
+            const token = server.tokenCommand ? `  token from: ${server.tokenCommand}` : '';
+            environment.stdout.write(`${colors_1.default.bold(name)}${marker}  ${server.url}  issuer ${server.issuer}${token}\n`);
         }
         if (config.run.on === 'auto' || config.run.on === 'local') {
             environment.stdout.write(`default location: ${config.run.on}\n`);
@@ -95,17 +102,33 @@ passthrough = []) {
                 ? `server ${name} is not registered, add it with: hammerkit remote add ${name} <url> --issuer <url>`
                 : 'name a server, or set one as the default with: hammerkit remote use <name>');
         }
-        return { name: chosen, server: config.servers[chosen] };
+        return { name: chosen, server: (0, host_config_1.getRegisteredServer)(config, chosen) };
     };
     remote
         .command('login <name>')
         .description('sign in to a registered server with your identity provider (device code, works headless)')
         .action(guarded('Remote login was not successful', async (name) => {
         const { server } = await getServer(name);
-        const { pinned, ...result } = await (0, device_login_1.deviceLogin)(server, {
-            prompt: (message) => environment.stdout.write(`${message}\n`),
-            signal: environment.abortCtrl.signal,
-        });
+        if (server.tokenCommand) {
+            // a sign-in would never be used: the command's token goes first
+            throw new Error(`${name} takes its tokens from its token command (${server.tokenCommand}), it needs no sign-in; ` +
+                `to sign in instead, remove it with: hammerkit remote add ${name} ${server.url} --issuer ${server.issuer} --no-token-command`);
+        }
+        let login;
+        try {
+            login = await (0, device_login_1.deviceLogin)(server, {
+                prompt: (message) => environment.stdout.write(`${message}\n`),
+                signal: environment.abortCtrl.signal,
+            });
+        }
+        catch (e) {
+            if (e instanceof device_login_1.NoSignInError) {
+                throw new Error(`${e.message}: register a command that prints one, such as the token of a service account, with: ` +
+                    `hammerkit remote add ${name} ${server.url} --issuer ${server.issuer} --token-command '<command>'`);
+            }
+            throw e;
+        }
+        const { pinned, ...result } = login;
         await (0, host_config_1.pinLogin)(environment, name, pinned);
         await (0, credentials_1.saveToken)(environment, name, { url: server.url, issuer: server.issuer, ...result });
         try {
@@ -155,6 +178,9 @@ passthrough = []) {
         if (me.repos.length > 0) {
             environment.stdout.write(`repositories: ${me.repos.map(server_client_1.printable).join(', ')}\n`);
         }
+        if (me.observe) {
+            environment.stdout.write('you observe every run of the server, see them with: hammerkit remote runs --all\n');
+        }
     }));
     (0, remote_work_commands_1.registerWorkCommands)(remote, {
         environment,

package/dist/remote/remote-status.js

@@ -0,0 +1,112 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeTaskStats = exports.describeCapacity = exports.describeOverview = exports.describeServiceRun = exports.describeWork = exports.describeWait = void 0;
+const colors_1 = __importDefault(require("colors"));
+const capacity_format_1 = require("../server/capacity-format");
+const timings_1 = require("../server/timings");
+const wait_reason_1 = require("../server/wait-reason");
+Object.defineProperty(exports, "describeWait", { enumerable: true, get: function () { return wait_reason_1.describeWait; } });
+const server_client_1 = require("./server-client");
+// What a run does, in a few words: its tasks, or the services it keeps up.
+function describeWork(run) {
+    if (run.up) {
+        return `${(0, server_client_1.printable)(run.up.name)}: up ${run.up.services.map(server_client_1.printable).join(', ')}`;
+    }
+    return run.tasks.length > 0 ? run.tasks.map(server_client_1.printable).join(', ') : 'by labels';
+}
+exports.describeWork = describeWork;
+function ownerOf(run) {
+    return run.owner ? ` of ${(0, server_client_1.printable)(run.owner.sub)}` : '';
+}
+function describeMeter(name, meter) {
+    const full = meter.limit !== undefined && meter.used >= meter.limit;
+    const count = `${meter.used}${meter.limit !== undefined ? ` of ${meter.limit}` : ''}`;
+    return `  ${name.padEnd(9)} ${count.padEnd(9)} ${meter.runs.length > 0 ? meter.runs.map(server_client_1.printable).join(', ') : '-'}${full ? colors_1.default.yellow('  full') : ''}`;
+}
+// A service run on one line, then a line per endpoint: when it ends, when it sleeps.
+function describeServiceRun(run) {
+    const times = [
+        run.state === 'up' || run.state === 'asleep' ? (run.expiresAt ? `until ${run.expiresAt}` : '') : '',
+        run.state === 'up' && run.sleepsAt ? `sleeps at ${run.sleepsAt}` : '',
+        run.wakes ? `woken ${run.wakes}×` : '',
+    ].filter(Boolean);
+    return [
+        `  ${(0, server_client_1.printable)(run.id)}  ${(0, server_client_1.printable)(run.state)}  ${describeWork(run)}${ownerOf(run)}${times.length > 0 ? `  ${(0, server_client_1.printable)(times.join(', '))}` : ''}`,
+        ...(run.up?.endpoints ?? []).map((endpoint) => `    ${(0, server_client_1.printable)(endpoint.service)}:${endpoint.port}${endpoint.url ? `  ${(0, server_client_1.printable)(endpoint.url)}` : ''}`),
+    ];
+}
+exports.describeServiceRun = describeServiceRun;
+// What `hammerkit remote status` prints: the places, the queue, the caller's limits.
+function describeOverview(server, overview, now = Date.now()) {
+    const lines = [
+        `${(0, server_client_1.printable)(server)}: signed in as ${(0, server_client_1.printable)(overview.you.sub)}${overview.you.observe ? ', you observe every run' : ''}`,
+        `places: ${overview.places.used} of ${overview.places.max} taken (runs.maxConcurrent)`,
+        ...overview.places.runs.map((run) => `  ${(0, server_client_1.printable)(run.id)}  ${describeWork(run)}${ownerOf(run)}${run.startedAt ? `  since ${(0, server_client_1.printable)(run.startedAt)}, ${(0, timings_1.roughly)((0, timings_1.ranMs)(run, now) ?? 0)}` : ''}`),
+    ];
+    if (overview.places.others > 0) {
+        lines.push(`  ${overview.places.others} ${overview.places.others === 1 ? 'run' : 'runs'} of others`);
+    }
+    // a place a run holds that is not running: a service run waking up, or a place not given back
+    const unaccounted = overview.places.used - overview.places.runs.length - overview.places.others;
+    if (unaccounted > 0) {
+        lines.push(`  ${unaccounted} taken by no running run`);
+    }
+    lines.push(`queue: ${overview.queue.length === 0 ? 'empty' : overview.queue.length}`);
+    for (const entry of overview.queue) {
+        const waited = entry.run ? (0, timings_1.waitedMs)(entry.run, now) : undefined;
+        const what = entry.run
+            ? `${(0, server_client_1.printable)(entry.run.id)}  ${describeWork(entry.run)}${ownerOf(entry.run)}${waited !== undefined ? `  waiting ${(0, timings_1.roughly)(waited)}` : ''}`
+            : 'a run of somebody else';
+        lines.push(`  ${entry.position}. ${what}  waits: ${(0, server_client_1.printable)((0, wait_reason_1.describeWait)(entry.waitsFor, entry.mine))}`);
+    }
+    lines.push(`waiting for an approval: ${overview.approvals.waiting} of at most ${overview.approvals.max}`);
+    for (const run of overview.approvals.runs) {
+        const accounts = (run.approvals ?? [])
+            .filter((approval) => !approval.approvedBy)
+            .map((approval) => approval.account);
+        lines.push(`  ${(0, server_client_1.printable)(run.id)}  ${describeWork(run)}${ownerOf(run)}  needs ${accounts
+            .map(server_client_1.printable)
+            .join(', ')} until ${(0, server_client_1.printable)(run.approvals?.[0]?.expiresAt ?? '-')}`);
+    }
+    lines.push(`service runs: ${overview.services.open}${overview.services.max !== undefined ? ` of ${overview.services.max}` : ''} places taken on the server`);
+    for (const run of overview.services.runs) {
+        lines.push(...describeServiceRun(run));
+    }
+    lines.push('your limits:', describeMeter('running', overview.limits.running), describeMeter('queued', overview.limits.queued), describeMeter('approval', overview.limits.waiting), describeMeter('services', overview.limits.services), ...(overview.limits.asleep ? [describeMeter('asleep', overview.limits.asleep)] : []));
+    return lines;
+}
+exports.describeOverview = describeOverview;
+// The machines of the server and what runs take of them, for `remote capacity`; `short` for
+// the two lines of `remote status`.
+function describeCapacity(capacity, short = false) {
+    const { machines, runs } = capacity;
+    const resources = (value) => value ? `${(0, capacity_format_1.formatCpu)(value.cpu)} CPU, ${(0, capacity_format_1.formatMemory)(value.memory)}` : '?';
+    const kind = capacity.backend === 'kubernetes' ? (machines?.count === 1 ? 'node' : 'nodes') : 'machine';
+    const lines = [
+        `capacity: ${machines
+            ? `${machines.count} ${kind} with ${resources(machines.allocatable)}`
+            : 'what the machines have is not known'}${machines?.used ? `, ${resources(machines.used)} in use` : ''}${machines?.load ? `, load ${machines.load.map((load) => load.toFixed(2)).join(' ')}` : ''}`,
+        `  runs: ${runs.pods !== undefined ? `${(0, capacity_format_1.plural)(runs.pods, 'pod')}, ` : ''}${runs.containers !== undefined ? `${runs.containers} containers, ` : ''}${capacity.backend === 'kubernetes' ? `requested ${resources(runs.requested)}` : ''}${runs.used ? `${capacity.backend === 'kubernetes' ? ', ' : ''}in use ${resources(runs.used)}` : ''}`,
+    ];
+    if (short) {
+        return lines;
+    }
+    for (const group of capacity.groups) {
+        lines.push(`  ${(0, server_client_1.printable)(group.name)}  ${group.kind === 'service-run' ? 'service run' : 'caller'}${group.owner ? ` of ${(0, server_client_1.printable)(group.owner.sub)}` : ''}${group.run ? ` ${(0, server_client_1.printable)(group.run)}` : ''}  ${(0, capacity_format_1.plural)(group.pods ?? 0, 'pod')}  requested ${resources(group.requested)}${group.quota ? ` of ${resources(group.quota)}` : ''}${group.used ? `  in use ${resources(group.used)}` : ''}`);
+    }
+    for (const problem of capacity.problems) {
+        lines.push(colors_1.default.yellow(`  not shown: ${(0, server_client_1.printable)(problem)}`));
+    }
+    return lines;
+}
+exports.describeCapacity = describeCapacity;
+// What the past runs of each task took, for `remote tasks`.
+function describeTaskStats(stats) {
+    const span = (ms) => (ms === undefined ? '-' : (0, timings_1.roughly)(ms));
+    return stats.map((entry) => `${(0, server_client_1.printable)(entry.task)}  ${(0, server_client_1.printable)(entry.repo)}  last ${(0, server_client_1.printable)(entry.last.status)} ${(0, server_client_1.printable)(entry.last.at)}${entry.last.durationMs !== undefined ? ` took ${(0, timings_1.roughly)(entry.last.durationMs)}` : ''}  ${(0, capacity_format_1.plural)(entry.runs, 'run')}${entry.failed ? `, ${entry.failed} failed` : ''}${entry.cached ? `, ${entry.cached} cached` : ''}  median ${span(entry.medianMs)}, 90% ${span(entry.p90Ms)}, waited ${span(entry.medianWaitMs)}`);
+}
+exports.describeTaskStats = describeTaskStats;
+//# sourceMappingURL=remote-status.js.map