railcode 0.1.22 → 0.1.24

package/README.md

@@ -22,10 +22,27 @@ railcode login --setup-token <token>  Sign in with a one-time onboarding setup t
 railcode init <app> [--template react|static]
 railcode deploy                    Build (if configured) and deploy the app here
 railcode db <list|query> ...       List data connectors / run read-only SQL
+railcode connections <list|create|delete> ...   Manage org data connectors (admin)
+railcode connector <list|docs|fetch|native|enable|create|delete> ...
+                                   Call service connectors / manage them (admin)
 railcode agent <list|show|create|update|delete|run|schedule> ...
                                    Manage org-scoped managed agents
+railcode members <list|set-role|remove|add> ...  Members + system roles (admin)
+railcode roles <list|create|update|delete|add-member|remove-member|grants|grant|revoke|materialize|effective|catalog> ...
+                                   Org roles + the granular grants table (admin)
+railcode apps <list|show|access|set-access|transfer|delete> ...
+                                   Apps + access policy (owner/admin)
+railcode analytics <app> [--range 1d|7d|30d|90d]    Per-app pageview analytics
+railcode logs <connector|service-connector|llm|email|agent> [filters]
+                                   Org observability logs (admin)
 ```
 
+The `members`, `roles`, `apps`, `analytics`, `logs`, `connections`, and the
+`connector` admin subcommands mirror the web console's admin surfaces — everything
+an owner/admin can do in the dashboard is available from the CLI. They all target
+your saved org and are gated server-side by the same capabilities as the console
+(a plain member gets 403; app list/show/access follow the per-app access policy).
+
 - **`login`** prompts for the server URL (default `https://api.railcode.app`),
   email, and password. It exchanges credentials for a short-lived JWT, mints a
   personal API token, resolves your organization, and saves everything to

package/dist/connections.js

@@ -0,0 +1,179 @@
+// Pure helpers behind `railcode connections` (org data connections) and the admin
+// half of `railcode connector` (service-connector CRUD + native presets). No I/O or
+// process state — the command layer in index.ts does the HTTP and printing.
+import { formatTable } from "./db.js";
+export class ConnectionAdminError extends Error {
+}
+function fmtTime(iso) {
+    if (!iso)
+        return "-";
+    return iso.slice(0, 16).replace("T", " ");
+}
+// Parse a JSON object option (`--config`, `--credentials`, `--auth-config`).
+// Empty/undefined → {}. Non-object JSON is rejected.
+export function parseJsonObject(value, label) {
+    if (value === undefined || value.trim() === "")
+        return {};
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch (error) {
+        throw new ConnectionAdminError(`${label} must be valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new ConnectionAdminError(`${label} must be a JSON object (e.g. '{"key":"value"}').`);
+    }
+    return parsed;
+}
+// ── Data connections (postgres | bigquery | turso) ──────────────────────────
+// The engines the create API accepts (snowflake is enum-only, rejected on create).
+export const CONNECTION_ENGINES = ["postgres", "bigquery", "turso"];
+// Per-engine hint of the config/credentials fields, surfaced in --help and errors.
+export const ENGINE_FIELDS = {
+    postgres: {
+        config: ["host", "database", "username", "port?", "sslmode?"],
+        credentials: ["password"],
+    },
+    bigquery: { config: ["project_id", "dataset"], credentials: ["service_account_json"] },
+    turso: { config: ["url"], credentials: ["auth_token"] },
+};
+export function parseConnectionEngine(value) {
+    const v = (value ?? "").trim().toLowerCase();
+    if (!v) {
+        throw new ConnectionAdminError(`--kind is required (${CONNECTION_ENGINES.join(" | ")}).`);
+    }
+    if (!CONNECTION_ENGINES.includes(v)) {
+        throw new ConnectionAdminError(`--kind must be one of: ${CONNECTION_ENGINES.join(", ")} (got "${value}").`);
+    }
+    return v;
+}
+export function connectionTable(conns) {
+    return formatTable(["name", "kind", "target", "created"], conns.map((c) => [c.name, c.kind, c.target, fmtTime(c.created_at)]));
+}
+export function resolveConnectionRef(conns, ref) {
+    const needle = ref.trim();
+    if (!needle)
+        throw new ConnectionAdminError("Expected a connection (name or UUID).");
+    const byName = conns.find((c) => c.name === needle);
+    if (byName)
+        return byName;
+    const byUuid = conns.find((c) => c.uuid === needle);
+    if (byUuid)
+        return byUuid;
+    throw new ConnectionAdminError(`No connection matches "${ref}" (try a name or UUID).`);
+}
+// Assemble the `POST /connections` body. The server validates required per-engine
+// fields and dials before saving; we only shape the request.
+export function buildConnectionCreateBody(input) {
+    const name = (input.name ?? "").trim();
+    if (!name)
+        throw new ConnectionAdminError("--name is required.");
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(name)) {
+        throw new ConnectionAdminError(`--name "${name}" is invalid (letters/digits/_/-, must start alphanumeric).`);
+    }
+    return { name, kind: input.kind, config: input.config, credentials: input.credentials };
+}
+// ── Service connectors (admin CRUD) ─────────────────────────────────────────
+export const SERVICE_CONNECTOR_AUTH_TYPES = ["none", "bearer", "header", "query", "basic"];
+export function parseAuthType(value) {
+    const v = (value ?? "none").trim().toLowerCase();
+    if (!SERVICE_CONNECTOR_AUTH_TYPES.includes(v)) {
+        throw new ConnectionAdminError(`--auth-type must be one of: ${SERVICE_CONNECTOR_AUTH_TYPES.join(", ")}.`);
+    }
+    return v;
+}
+// A null content_type is a pre-default row: the proxy still sends application/json with
+// any body, so show the effective value rather than a bare "-".
+export const DEFAULT_CONTENT_TYPE = "application/json";
+export function serviceConnectorAdminTable(list) {
+    return formatTable(["name", "base_url", "auth", "cred", "content_type", "methods", "enabled", "native"], list.map((c) => [
+        c.name,
+        c.base_url,
+        c.auth_type,
+        c.has_credential ? "yes" : "no",
+        c.content_type || DEFAULT_CONTENT_TYPE,
+        (c.allowed_methods ?? []).join(", ") || "all",
+        c.enabled ? "yes" : "no",
+        c.native_key ?? "-",
+    ]));
+}
+export function resolveServiceConnectorRef(list, ref) {
+    const needle = ref.trim();
+    if (!needle)
+        throw new ConnectionAdminError("Expected a connector (name or UUID).");
+    const byName = list.find((c) => c.name === needle);
+    if (byName)
+        return byName;
+    const byUuid = list.find((c) => c.uuid === needle);
+    if (byUuid)
+        return byUuid;
+    throw new ConnectionAdminError(`No service connector matches "${ref}" (try a name or UUID).`);
+}
+export function nativeConnectorTable(list) {
+    return formatTable(["key", "name", "enabled", "credential_fields"], list.map((n) => [
+        n.key,
+        n.name,
+        n.enabled ? "yes" : "no",
+        (n.credentials ?? []).map((c) => c.key).join(", "),
+    ]));
+}
+// Assemble the `POST /service-connectors` body for a custom connector.
+export function buildServiceConnectorCreateBody(input) {
+    const name = (input.name ?? "").trim().toLowerCase();
+    if (!name)
+        throw new ConnectionAdminError("--name is required.");
+    if (!/^[a-z0-9][a-z0-9_-]*$/.test(name)) {
+        throw new ConnectionAdminError(`--name "${name}" is invalid (lowercase letters/digits/_/-, must start alphanumeric).`);
+    }
+    const baseUrl = (input.baseUrl ?? "").trim();
+    if (!baseUrl)
+        throw new ConnectionAdminError("--base-url is required.");
+    if (!/^https?:\/\//i.test(baseUrl)) {
+        throw new ConnectionAdminError("--base-url must be an http(s) URL.");
+    }
+    if (input.authType !== "none" && Object.keys(input.authConfig).length === 0) {
+        throw new ConnectionAdminError(`--auth-config is required for auth-type ${input.authType} (e.g. '{"token":"..."}').`);
+    }
+    const body = {
+        name,
+        base_url: baseUrl,
+        auth_type: input.authType,
+        enabled: input.enabled,
+    };
+    if (input.authType !== "none")
+        body.auth_config = input.authConfig;
+    if (input.description !== undefined)
+        body.description = input.description;
+    // Omitted → the server stores application/json. Only send the field when the caller
+    // actually chose a type (e.g. a form-encoded API).
+    if (input.contentType !== undefined)
+        body.content_type = parseContentType(input.contentType);
+    if (input.allowedMethods && input.allowedMethods.length > 0) {
+        body.allowed_methods = input.allowedMethods;
+    }
+    return body;
+}
+// `--content-type <type>`: a single header value, so no CR/LF and nothing blank (an
+// empty value would read as "unset" server-side — just leave the flag off for that).
+export function parseContentType(value) {
+    const text = value.trim();
+    if (!text) {
+        throw new ConnectionAdminError("--content-type requires a value (e.g. application/x-www-form-urlencoded); omit it for application/json.");
+    }
+    if (/[\r\n]/.test(text)) {
+        throw new ConnectionAdminError("--content-type must not contain newlines.");
+    }
+    if (text.length > 255) {
+        throw new ConnectionAdminError("--content-type must be 255 characters or fewer.");
+    }
+    return text;
+}
+export function parseMethodList(value) {
+    if (value === undefined || value.trim() === "")
+        return [];
+    return value
+        .split(",")
+        .map((m) => m.trim().toUpperCase())
+        .filter((m) => m.length > 0);
+}

package/dist/connectors.js

@@ -49,7 +49,10 @@ export function connectorOpenapiOutput(docs) {
 // API docs (link or inline), and the OpenAPI spec (link or inline) when present.
 export function renderConnectorDocs(docs) {
     const methods = (docs.allowed_methods ?? []).join(", ") || "(all)";
-    const sections = [`${docs.name} (${docs.auth_type}) — methods: ${methods}`];
+    const identity = [`${docs.name} (${docs.auth_type}) — methods: ${methods}`];
+    if (docs.content_type)
+        identity.push(`body Content-Type: ${docs.content_type}`);
+    const sections = [identity.join("\n")];
     if (docs.description)
         sections.push(docs.description);
     const hasAny = docs.usage_instructions ||