octwin-cli 0.8.6 → 0.8.8

package/dist/lib/declaration-check.js

@@ -17,11 +17,18 @@
  * checks that were catching real bugs. So the rule is: **report only what is
  * unambiguous, and walk away from anything else.**
  *
- * It reports exactly four things:
+ * It reports exactly five things:
  *   1. a key not in `properties` where `additionalProperties: false`
  *   2. a missing `required` key
  *   3. a scalar whose `type` is plainly wrong
  *   4. a value outside a closed `enum`
+ *   5. a map KEY outside `propertyNames` (`enum` or `pattern`)
+ *
+ * Rule 5 was added 2026-09-06 and is the reason the RBAC vocabulary is worth publishing at all: a
+ * map's keys carry meaning in `roles.yaml` (grant resource keys, verb keys), and reading only
+ * VALUES meant an author could not learn about a bad key until `--remote`. It is safe under the
+ * false-positive rule above because it is a faithful replay — the same enum membership and the same
+ * regex engine the platform's own Zod runs.
  *
  * It STOPS DESCENDING (reports nothing at all for that subtree) at any node
  * carrying `anyOf` / `oneOf` / `allOf` / `not`, at an unresolvable `$ref`, and at
@@ -142,6 +149,48 @@ function walk(value, schema, path, defs, out, file, depth) {
     const obj = value;
     const props = isObj(schema.properties) ? schema.properties : undefined;
     const addl = schema.additionalProperties;
+    // 5. KEY vocabulary — `propertyNames` on a map schema.
+    //
+    // The fifth rule, and the one this file existed without for its whole life. A map's KEYS carry
+    // meaning in three declarations (`roles.yaml` grants and verbs, `xrm.yaml` entity names), and the
+    // walker read only values — so a pack author following `craft/manifest.md` wrote `case:` where
+    // the key is `record.case`, passed offline `validate`, and learned the truth from a `--remote`
+    // round-trip that reported one bad guess at a time. They abandoned custom RBAC over it.
+    //
+    // Safe to report because it is a FAITHFUL REPLAY: the same `enum` membership and the same JS
+    // regex engine Zod itself runs, over a pattern the platform generated. A false positive would
+    // require the published schema to disagree with the platform that published it.
+    const names = isObj(schema.propertyNames) ? schema.propertyNames : undefined;
+    if (names) {
+        const allowed = Array.isArray(names.enum) ? names.enum : undefined;
+        const pattern = typeof names.pattern === 'string' ? names.pattern : undefined;
+        let re;
+        // A pattern the local engine cannot compile is out of subset, exactly like a combinator —
+        // walk away rather than guess. (JSON Schema permits ECMA-262; this IS that engine, so in
+        // practice only a future dialect change lands here.)
+        if (pattern) {
+            try {
+                re = new RegExp(pattern);
+            }
+            catch {
+                re = undefined;
+            }
+        }
+        for (const k of Object.keys(obj)) {
+            if (allowed && !allowed.includes(k)) {
+                out.push({
+                    file, path: path ? `${path}.${k}` : k,
+                    message: `not a valid key here — must be one of ${allowed.map(e => JSON.stringify(e)).join(', ')}`,
+                });
+            }
+            else if (re && !re.test(k)) {
+                out.push({
+                    file, path: path ? `${path}.${k}` : k,
+                    message: `not a valid key here — it must match ${pattern}`,
+                });
+            }
+        }
+    }
     // A map schema (`additionalProperties: <schema>`, no `properties`) — every
     // value shares one shape. This is how `entities:` and `agents:` are declared.
     if (!props && isObj(addl)) {

package/dist/lib/device-login.js

@@ -0,0 +1,127 @@
+/**
+ * The pure half of a browser `octwin login` — everything about the device-code
+ * handshake that isn't a socket.
+ *
+ * `index.ts` keeps the URL construction and the actual `fetch` calls (the route
+ * guard in `cli-routes.test.ts` reads that file and only that file, so a URL that
+ * moved here would stop being checked against the platform's route table). What
+ * lives here is the part worth testing without a server: how a poll response is
+ * read, how long to wait next, and the on-disk record of a handshake in flight.
+ *
+ * ## Why a handshake is written to disk at all
+ *
+ * Because the CLI is mostly driven by an agent, and an agent's shell call is cut
+ * off long before a human finishes clicking. So `octwin login` waits a bounded
+ * time and then RETURNS, keeping the request; running it again resumes the same
+ * one with the same code. Without a file, a second run would mint a second code
+ * and the code the human is looking at would be dead.
+ */
+import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { dirname } from 'node:path';
+/**
+ * `~/.octwin/pending-login.json`, a map of platform url → handshake.
+ *
+ * Deliberately NOT `credentials.json`: every value in that file is a token, and its
+ * one reserved key is safe only because a url always contains `://` and the key
+ * never does. A second value shape there would make that argument stop holding.
+ */
+export function readPending(path, url) {
+    let raw;
+    try {
+        raw = readFileSync(path, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    try {
+        const map = JSON.parse(raw);
+        const found = map[url];
+        return found && typeof found.device_code === 'string' ? found : null;
+    }
+    catch {
+        return null;
+    } // a corrupt file just means "no handshake in flight"
+}
+export function writePending(path, url, pending) {
+    let map = {};
+    try {
+        map = JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch { /* first one */ }
+    map[url] = pending;
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify(map, null, 2), 'utf8');
+}
+export function clearPending(path, url) {
+    let map;
+    try {
+        map = JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch {
+        return;
+    }
+    if (!(url in map))
+        return;
+    delete map[url];
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify(map, null, 2), 'utf8');
+}
+/** True once the platform would refuse this handshake — checked before reusing one. */
+export function isPendingExpired(pending, now = Date.now()) {
+    const at = Date.parse(pending.expires_at);
+    return Number.isNaN(at) || at <= now;
+}
+/** Whole seconds left, floored at 0 — for the "expires in 7 min" line. */
+export function secondsLeft(pending, now = Date.now()) {
+    const at = Date.parse(pending.expires_at);
+    if (Number.isNaN(at))
+        return 0;
+    return Math.max(0, Math.round((at - now) / 1000));
+}
+/**
+ * Read one poll response.
+ *
+ * A 429 is NOT a failure — the platform's own limiter sets `Retry-After`, and a
+ * client that treats being asked to slow down as an error turns a wait into a
+ * broken login. 5xx is the same shape for a different reason.
+ */
+export function interpretPoll(status, json, retryAfterHeader, defaultDelayMs) {
+    if (status === 429 || status >= 500) {
+        const secs = Number(retryAfterHeader);
+        const afterMs = Number.isFinite(secs) && secs > 0 ? secs * 1000 : defaultDelayMs * 2;
+        return { kind: 'retry', afterMs };
+    }
+    const body = (json ?? {});
+    if (status !== 200) {
+        return { kind: 'failed', detail: String(body.error ?? `the platform answered HTTP ${status}`) };
+    }
+    switch (body.status) {
+        case 'approved':
+            if (typeof body.token !== 'string' || !body.token) {
+                return { kind: 'failed', detail: 'the platform approved the login but returned no token' };
+            }
+            return {
+                kind: 'approved',
+                token: body.token,
+                tenantSlug: typeof body.tenant_slug === 'string' ? body.tenant_slug : '',
+                projectSlug: typeof body.project_slug === 'string' ? body.project_slug : null,
+                tokenExpires: typeof body.token_expires === 'string' ? body.token_expires : null,
+            };
+        case 'pending': return { kind: 'pending' };
+        case 'expired': return { kind: 'gone', reason: 'expired' };
+        case 'not_found': return { kind: 'gone', reason: 'not_found' };
+        default:
+            return { kind: 'failed', detail: `the platform answered with an unknown status '${String(body.status)}'` };
+    }
+}
+/**
+ * How this machine introduces itself on the approval screen. Untrusted by the
+ * platform (this call carries no credential), so it is a courtesy to the approver,
+ * never a claim — which is exactly how the console renders it.
+ */
+export function clientLabel(hostname, platform) {
+    const os = { win32: 'Windows', darwin: 'macOS', linux: 'Linux' }[platform] ?? platform;
+    return `${hostname || 'unknown host'} · ${os}`;
+}
+/** Exit code for "the wait ended, nothing is wrong" — `EX_TEMPFAIL`. An agent branches on it. */
+export const EXIT_STILL_PENDING = 75;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "octwin-cli",
-  "version": "0.8.6",
+  "version": "0.8.8",
   "description": "Octwin external-pack developer CLI (by CEQUENS) — scaffold, validate, deploy, and check pure-YAML packs on your tenant.",
   "type": "module",
   "bin": {