railcode 0.1.5 → 0.1.8

package/README.md

@@ -73,6 +73,13 @@ you enter a bare domain.
 `/v1/config/design-system` using the saved browser-authorized API token or
 `RAILCODE_API_TOKEN` and prints it to stdout.
 
+`railcode db list` and `railcode db query "<sql>"` read the admin-configured data
+connectors from the terminal — listing them (`GET /v1/connections`) or running a
+read-only SQL query against one (`POST /v1/sql`). The engine is inferred from the
+named connector (override with `--engine`); use `--connection <name>` to pick a
+connector, `--params '<json-array>'` for `$1, $2, ...` placeholders, and `--json`
+for the raw response. Authenticates with the saved token or `RAILCODE_API_TOKEN`.
+
 `railcode deploy` runs from the current Railcode app directory, builds the app,
 and publishes the inferred app output over HTTP to the canonical API host. It
 uses a saved Railcode token, prints a browser authorization link when needed, or

package/dist/index.js

@@ -26,6 +26,11 @@ Usage:
   railcode login [--api-url <url>]
   railcode deploy [--private | --public]
   railcode access [public|private|restricted] [--users <a,b>]
+  railcode network
+  railcode db list
+  railcode db query "<sql>" [--connection <name>] [--engine <postgres|mysql>]
+  railcode connector list
+  railcode connector fetch <name> <path> [--method <verb>] [--body <data>]
   railcode get design-system
   railcode init <app>
   railcode upgrade
@@ -59,6 +64,16 @@ async function main() {
         case "access":
             await commandAccess(args);
             return;
+        case "network":
+            await commandNetwork(args);
+            return;
+        case "db":
+            await commandDb(args);
+            return;
+        case "connector":
+        case "connectors":
+            await commandConnector(args);
+            return;
         case "get":
             await commandGet(args);
             return;
@@ -620,7 +635,8 @@ async function handleLocalApi(ctx, request, response, url) {
         await handleLocalFiles(ctx, request, response, path);
         return;
     }
-    if (path === "/connections" && (!ctx.token || !ctx.apiBase)) {
+    if ((path === "/connections" || path === "/service-connectors") &&
+        (!ctx.token || !ctx.apiBase)) {
         sendJson(response, 200, []);
         return;
     }
@@ -1594,6 +1610,465 @@ function appUrlFromOrigin(app, origin) {
     url.hash = "";
     return url.toString();
 }
+const NETWORK_HELP = `Usage:
+  railcode network        Show the platform default network mode for new apps
+
+Network mode is the per-app egress policy, enforced as a CSP:
+  open        No CSP — the app may fetch any origin.
+  restricted  External calls only via the Railcode proxy (connect-src 'self').
+  sandboxed   Same-origin only — no inline <script>, no external CDN/fonts.
+
+Admins set the default and flip individual apps from the admin console; the CLI
+only reports the default so you know how to build a new app.
+`;
+const NETWORK_MODE_BUILD_HINTS = {
+    open: "Build freely: direct fetch() to any origin is allowed.",
+    restricted: "Don't fetch external origins directly — route them through the Railcode proxy. Inline scripts and CDN assets are fine.",
+    sandboxed: "Same-origin only: no external fetch, no inline <script>, no external CDN/font links. Use the SDK and bundle every asset locally.",
+};
+async function commandNetwork(args) {
+    if (booleanOption(args, "help") || args.rest[0] === "help") {
+        console.log(NETWORK_HELP);
+        return;
+    }
+    if (args.rest.length > 0) {
+        throw new CliError("railcode network shows the platform default. Admins flip individual apps from the admin console.", 2);
+    }
+    rejectUnknownOptions(args, ["help", "json", "apiUrl"], "network");
+    const config = loadConfig();
+    const manifestApiUrl = readRailcodeManifest(process.cwd())?.manifest.deploy?.apiUrl;
+    const authUrl = await resolveRequiredAuthOrigin({
+        config,
+        args,
+        action: "Network mode",
+        fallbackApiUrl: manifestApiUrl,
+        missingUrlHint: "Pass --api-url <url>, set deploy.apiUrl in railcode.json, or set RAILCODE_API_URL.",
+    });
+    const apiUrl = canonicalApiOrigin(authUrl);
+    let authedConfig = await ensureApiToken({ ...config, apiUrl: authUrl }, authUrl, "Network mode");
+    let response = await fetchNetworkDefault(apiUrl, authedConfig);
+    if (response.status === 401 && !process.env.RAILCODE_API_TOKEN && process.stdin.isTTY) {
+        console.log("Saved login expired. Log in again to continue.");
+        const retryConfig = { ...authedConfig, apiUrl: authUrl };
+        delete retryConfig.apiToken;
+        delete retryConfig.apiTokenPrefix;
+        delete retryConfig.cookies;
+        saveConfig(retryConfig);
+        authedConfig = await ensureApiToken(retryConfig, authUrl, "Network mode");
+        response = await fetchNetworkDefault(apiUrl, authedConfig);
+    }
+    const view = (await readDbResponse(response, "Network mode"));
+    printNetworkDefault(view, booleanOption(args, "json"));
+}
+function fetchNetworkDefault(apiUrl, config) {
+    return dbFetch(apiUrl, config, "/v1/network-default", { redirect: "manual" });
+}
+function printNetworkDefault(view, json) {
+    if (json) {
+        console.log(JSON.stringify(view, null, 2));
+        return;
+    }
+    const mode = view.network_mode || "restricted";
+    console.log(`Platform default network mode: ${mode}`);
+    const hint = NETWORK_MODE_BUILD_HINTS[mode];
+    if (hint)
+        console.log(hint);
+}
+const DB_ENGINES = new Set(["postgres", "mysql"]);
+const DB_HELP = `Query Railcode data connectors.
+
+Usage:
+  railcode db list
+  railcode db query "<sql>" [options]
+
+Commands:
+  list                       List configured data connectors (name + engine).
+  query "<sql>"              Run a read-only SQL query against a connector.
+
+Query options:
+  --connection <name>        Connector to query (default: default).
+  --engine <postgres|mysql>  Override the engine. Inferred from the connector by default.
+  --params '<json-array>'    Params for $1, $2, ... placeholders, e.g. --params '[42,"ok"]'.
+  --file <path>              Read SQL from a file instead of an argument.
+  --json                     Print raw JSON instead of a table.
+
+Options:
+  --api-url <url>            Railcode auth/API URL. Defaults to saved config or railcode.json.
+
+Examples:
+  railcode db list
+  railcode db query "select id, email from users limit 5"
+  railcode db query "select * from orders where total > $1" --params '[100]'
+  railcode db query "select 1" --connection analytics --engine mysql
+`;
+async function commandDb(args) {
+    const subcommand = args.rest[0];
+    const rest = { ...args, rest: args.rest.slice(1) };
+    switch (subcommand) {
+        case "list":
+        case "ls":
+        case "connections":
+            await commandDbList(rest);
+            return;
+        case "query":
+        case "sql":
+            await commandDbQuery(rest);
+            return;
+        case undefined:
+        case "help":
+            console.log(DB_HELP);
+            return;
+        default:
+            if (booleanOption(args, "help")) {
+                console.log(DB_HELP);
+                return;
+            }
+            throw new CliError(`Unknown db command: ${subcommand}\n\n${DB_HELP}`, 2);
+    }
+}
+async function commandDbList(args) {
+    if (booleanOption(args, "help") || args.rest[0] === "help") {
+        console.log(DB_HELP);
+        return;
+    }
+    rejectUnknownOptions(args, ["help", "json", "apiUrl"], "db list");
+    if (args.rest.length > 0) {
+        throw new CliError("railcode db list does not accept positional arguments.", 2);
+    }
+    const response = await dbAuthedRequest(args, "Data connectors list", fetchConnections);
+    const connectors = (await readDbResponse(response, "Data connectors list"));
+    printConnectors(connectors, booleanOption(args, "json"));
+}
+async function commandDbQuery(args) {
+    if (booleanOption(args, "help") || args.rest[0] === "help") {
+        console.log(DB_HELP);
+        return;
+    }
+    rejectUnknownOptions(args, ["help", "json", "apiUrl", "connection", "engine", "params", "file"], "db query");
+    const query = resolveQuerySql(args);
+    const connection = (stringOption(args, "connection") || "default").trim() || "default";
+    const params = parseSqlParams(args);
+    const engine = parseEngineOption(args) ?? (await resolveConnectionEngine(args, connection));
+    const body = { engine, connection, query, params };
+    const response = await dbAuthedRequest(args, "SQL query", (apiUrl, config) => postSql(apiUrl, config, body));
+    const result = (await readDbResponse(response, "SQL query", "Run `railcode db list` to see configured connectors."));
+    printSqlResult(result, booleanOption(args, "json"));
+}
+function resolveQuerySql(args) {
+    const file = stringOption(args, "file");
+    if (file && args.rest.length > 0) {
+        throw new CliError("Pass SQL as an argument or --file, not both.", 2);
+    }
+    if (file) {
+        const path = resolve(file);
+        if (!existsSync(path))
+            throw new CliError(`SQL file not found: ${path}`, 1);
+        const sql = readFileSync(path, "utf8").trim();
+        if (!sql)
+            throw new CliError(`SQL file is empty: ${path}`, 1);
+        return sql;
+    }
+    if (args.rest.length > 1) {
+        throw new CliError('railcode db query takes a single SQL string. Quote it: railcode db query "select 1".', 2);
+    }
+    const positional = args.rest[0];
+    if (!positional || !positional.trim()) {
+        throw new CliError('Missing SQL. Usage: railcode db query "select 1" [--connection <name>].', 2);
+    }
+    return positional.trim();
+}
+function parseSqlParams(args) {
+    const raw = stringOption(args, "params");
+    if (raw === undefined)
+        return [];
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new CliError('--params must be a JSON array, e.g. --params \'[42, "ok"]\'.', 2);
+    }
+    if (!Array.isArray(parsed)) {
+        throw new CliError('--params must be a JSON array, e.g. --params \'[42, "ok"]\'.', 2);
+    }
+    return parsed;
+}
+function parseEngineOption(args) {
+    const raw = stringOption(args, "engine");
+    if (raw === undefined)
+        return undefined;
+    const engine = raw.trim().toLowerCase();
+    if (!DB_ENGINES.has(engine)) {
+        throw new CliError(`Unknown engine '${raw}'. Use postgres or mysql.`, 2);
+    }
+    return engine;
+}
+// The server requires an engine and rejects a mismatch, so when the caller omits
+// --engine we look the connection up in the registry and use its engine.
+async function resolveConnectionEngine(args, connection) {
+    const response = await dbAuthedRequest(args, "Data connectors list", fetchConnections);
+    const connectors = (await readDbResponse(response, "Data connectors list"));
+    const match = connectors.find((c) => c.name === connection);
+    if (!match) {
+        const names = connectors.map((c) => c.name).join(", ") || "none";
+        throw new CliError(`No data connector named '${connection}'. Configured: ${names}. Pass --engine to override.`, 1);
+    }
+    return match.engine;
+}
+async function dbAuthedRequest(args, action, send) {
+    const config = loadConfig();
+    const authUrl = await resolveDbAuthOrigin(config, args);
+    const apiUrl = canonicalApiOrigin(authUrl);
+    let authedConfig = await ensureApiToken({ ...config, apiUrl: authUrl }, authUrl, action);
+    let response = await send(apiUrl, authedConfig);
+    if (response.status === 401 && !process.env.RAILCODE_API_TOKEN && process.stdin.isTTY) {
+        console.log("Saved login expired. Log in again to continue.");
+        const retryConfig = { ...authedConfig, apiUrl: authUrl };
+        delete retryConfig.apiToken;
+        delete retryConfig.apiTokenPrefix;
+        delete retryConfig.cookies;
+        saveConfig(retryConfig);
+        authedConfig = await ensureApiToken(retryConfig, authUrl, action);
+        response = await send(apiUrl, authedConfig);
+    }
+    return response;
+}
+async function resolveDbAuthOrigin(config, args) {
+    const manifestApiUrl = readRailcodeManifest(process.cwd())?.manifest.deploy?.apiUrl;
+    return resolveRequiredAuthOrigin({
+        config,
+        args,
+        action: "Data connectors",
+        fallbackApiUrl: manifestApiUrl,
+        missingUrlHint: "Pass --api-url <url>, set deploy.apiUrl in railcode.json, or set RAILCODE_API_URL.",
+    });
+}
+function fetchConnections(apiUrl, config) {
+    return dbFetch(apiUrl, config, "/v1/connections", { redirect: "manual" });
+}
+function postSql(apiUrl, config, body) {
+    return dbFetch(apiUrl, config, "/v1/sql", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+        redirect: "manual",
+    });
+}
+async function dbFetch(apiUrl, config, path, init) {
+    if (!config.apiToken) {
+        throw new CliError("Missing Railcode API token. Run from a terminal once, or set RAILCODE_API_TOKEN.", 1);
+    }
+    const headers = {
+        ...(init.headers ?? {}),
+        Authorization: `Bearer ${config.apiToken}`,
+    };
+    try {
+        return await fetch(`${apiUrl}${path}`, { ...init, headers });
+    }
+    catch (error) {
+        throw new CliError(`Could not reach ${apiUrl}. Configure the Railcode URL in railcode.json deploy.apiUrl, RAILCODE_API_URL, or --api-url. ${error instanceof Error ? error.message : String(error)}`, 1);
+    }
+}
+async function readDbResponse(response, action, hint) {
+    if (response.ok)
+        return response.json();
+    const detail = errorDetail(await response.text());
+    if (response.status === 401) {
+        throw new CliError(`${action} login was rejected. Run the command again to log in.`, 1);
+    }
+    if (response.status === 403) {
+        throw new CliError(`${action} denied: ${detail}`, 1);
+    }
+    if (response.status === 502) {
+        throw new CliError(detail || "Database unreachable.", 1);
+    }
+    if (response.status === 400 || response.status === 404) {
+        throw new CliError([detail, hint].filter(Boolean).join(" ") || `${action} failed.`, 1);
+    }
+    throw new CliError(`${action} failed (${response.status}): ${detail}`, 1);
+}
+function printConnectors(connectors, asJson) {
+    if (asJson) {
+        console.log(JSON.stringify(connectors, null, 2));
+        return;
+    }
+    if (!connectors || connectors.length === 0) {
+        console.log("No data connectors configured.");
+        return;
+    }
+    console.log(formatTable(["NAME", "ENGINE"], connectors.map((c) => [c.name, c.engine])));
+}
+function printSqlResult(result, asJson) {
+    if (asJson) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    const columns = result.columns ?? [];
+    const rows = result.rows ?? [];
+    if (columns.length > 0) {
+        console.log(formatTable(columns, rows));
+    }
+    const count = typeof result.rowcount === "number" ? result.rowcount : rows.length;
+    console.log(`${columns.length > 0 ? "\n" : ""}${count} ${count === 1 ? "row" : "rows"}${result.truncated ? " (truncated to first 1000)" : ""}`);
+}
+const CONNECTOR_HELP = `Call admin-configured HTTP service connectors (Stripe, PostHog, …).
+
+Usage:
+  railcode connector list
+  railcode connector fetch <name> <path> [options]
+
+Commands:
+  list                       List service connectors you can call (name + auth type).
+  fetch <name> <path>        Proxy an HTTP request through a connector.
+
+Fetch options:
+  --method <verb>            HTTP method (default GET). Must be allowed by the connector.
+  --body <data>              Raw request body (the connector sets the Content-Type).
+  --file <path>              Read the request body from a file instead.
+  --json                     Print the raw JSON envelope instead of the body.
+
+Options:
+  --api-url <url>            Railcode auth/API URL. Defaults to saved config or railcode.json.
+
+Examples:
+  railcode connector list
+  railcode connector fetch stripe /v1/charges
+  railcode connector fetch stripe /v1/charges --method POST --body "amount=100&currency=usd"
+`;
+async function commandConnector(args) {
+    const subcommand = args.rest[0];
+    const rest = { ...args, rest: args.rest.slice(1) };
+    switch (subcommand) {
+        case "list":
+        case "ls":
+            await commandConnectorList(rest);
+            return;
+        case "fetch":
+        case "request":
+            await commandConnectorFetch(rest);
+            return;
+        case undefined:
+        case "help":
+            console.log(CONNECTOR_HELP);
+            return;
+        default:
+            if (booleanOption(args, "help")) {
+                console.log(CONNECTOR_HELP);
+                return;
+            }
+            throw new CliError(`Unknown connector command: ${subcommand}\n\n${CONNECTOR_HELP}`, 2);
+    }
+}
+async function commandConnectorList(args) {
+    if (booleanOption(args, "help") || args.rest[0] === "help") {
+        console.log(CONNECTOR_HELP);
+        return;
+    }
+    rejectUnknownOptions(args, ["help", "json", "apiUrl"], "connector list");
+    if (args.rest.length > 0) {
+        throw new CliError("railcode connector list does not accept positional arguments.", 2);
+    }
+    const response = await dbAuthedRequest(args, "Service connectors list", fetchServiceConnectors);
+    const connectors = (await readDbResponse(response, "Service connectors list"));
+    printServiceConnectors(connectors, booleanOption(args, "json"));
+}
+async function commandConnectorFetch(args) {
+    if (booleanOption(args, "help") || args.rest[0] === "help") {
+        console.log(CONNECTOR_HELP);
+        return;
+    }
+    rejectUnknownOptions(args, ["help", "json", "apiUrl", "method", "body", "file"], "connector fetch");
+    const name = args.rest[0];
+    const path = args.rest[1];
+    if (!name || !path) {
+        throw new CliError("Usage: railcode connector fetch <name> <path> [--method <verb>] [--body <data>].", 2);
+    }
+    if (args.rest.length > 2) {
+        throw new CliError("railcode connector fetch takes a single connector name and path.", 2);
+    }
+    if (!path.startsWith("/")) {
+        throw new CliError("The connector path must start with '/'.", 2);
+    }
+    const method = (stringOption(args, "method") || "GET").trim().toUpperCase();
+    const body = resolveConnectorBody(args);
+    const requestBody = { connector: name, method, path, body };
+    const response = await dbAuthedRequest(args, "Connector request", (apiUrl, config) => postConnectorRequest(apiUrl, config, requestBody));
+    const result = (await readDbResponse(response, "Connector request", "Run `railcode connector list` to see connectors you can call."));
+    printConnectorResponse(result, booleanOption(args, "json"));
+}
+function resolveConnectorBody(args) {
+    const file = stringOption(args, "file");
+    const inline = stringOption(args, "body");
+    if (file && inline !== undefined) {
+        throw new CliError("Pass --body or --file, not both.", 2);
+    }
+    if (file) {
+        const path = resolve(file);
+        if (!existsSync(path))
+            throw new CliError(`Body file not found: ${path}`, 1);
+        return readFileSync(path, "utf8");
+    }
+    return inline;
+}
+function fetchServiceConnectors(apiUrl, config) {
+    return dbFetch(apiUrl, config, "/v1/service-connectors", { redirect: "manual" });
+}
+function postConnectorRequest(apiUrl, config, body) {
+    return dbFetch(apiUrl, config, "/v1/service-connectors/request", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+        redirect: "manual",
+    });
+}
+function printServiceConnectors(connectors, asJson) {
+    if (asJson) {
+        console.log(JSON.stringify(connectors, null, 2));
+        return;
+    }
+    if (!connectors || connectors.length === 0) {
+        console.log("No service connectors available.");
+        return;
+    }
+    console.log(formatTable(["NAME", "AUTH", "METHODS"], connectors.map((c) => [c.name, c.auth_type ?? "none", (c.allowed_methods ?? []).join(",")])));
+}
+function printConnectorResponse(result, asJson) {
+    if (asJson) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    const status = result.status ?? 0;
+    console.log(`${status} ${result.ok ? "OK" : "ERROR"}${result.truncated ? " (truncated)" : ""}`);
+    if (result.body)
+        console.log(result.body);
+}
+function rejectUnknownOptions(args, allowed, label) {
+    const set = new Set(allowed);
+    const unknown = Object.keys(args.options).filter((option) => !set.has(option));
+    if (unknown.length > 0) {
+        throw new CliError(`Unknown option for ${label}: --${unknown[0]}`, 2);
+    }
+}
+function formatTable(columns, rows) {
+    const header = columns.map((c) => c ?? "");
+    const body = rows.map((row) => header.map((_, i) => formatCell(row?.[i])));
+    const widths = header.map((h, i) => Math.max(h.length, ...body.map((r) => r[i].length), 0));
+    const renderRow = (cells) => cells.map((cell, i) => cell.padEnd(widths[i])).join("  ").replace(/\s+$/, "");
+    const lines = [renderRow(header), renderRow(widths.map((w) => "-".repeat(w)))];
+    for (const row of body)
+        lines.push(renderRow(row));
+    return lines.join("\n");
+}
+function formatCell(value) {
+    if (value === null || value === undefined)
+        return "";
+    const text = typeof value === "string"
+        ? value
+        : typeof value === "object"
+            ? JSON.stringify(value)
+            : String(value);
+    return text.replace(/[\r\n\t]+/g, " ");
+}
 const DESIGN_SYSTEM_HELP = `Usage:
   railcode get design-system
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "railcode",
-  "version": "0.1.5",
+  "version": "0.1.8",
   "description": "CLI for building, testing, and deploying Railcode apps.",
   "license": "MIT",
   "type": "module",

package/static/sdk.js

@@ -371,6 +371,39 @@
   var dataConnectors = () => track("connections", "dataConnectors()", () => call("GET", "/connections"));
   var databaseConnectors = dataConnectors;
 
+  // src/service-connectors.ts
+  var PATH_LABEL_MAX = 60;
+  var toResponse = (env) => {
+    const body = env.body ?? "";
+    return {
+      status: env.status,
+      ok: env.ok,
+      headers: env.headers || {},
+      truncated: Boolean(env.truncated),
+      text: () => Promise.resolve(body),
+      json: () => Promise.resolve(JSON.parse(body))
+    };
+  };
+  var request = (name, path, opts) => {
+    const method = (opts?.method || "GET").toUpperCase();
+    const label = `connector(${q(name)}).fetch(${q(method)} ${q(shorten(path, PATH_LABEL_MAX))})`;
+    return track(
+      "connector",
+      label,
+      () => call("POST", "/service-connectors/request", {
+        json: { connector: name, method, path, body: opts?.body }
+      }).then(toResponse)
+    );
+  };
+  var connector = (name) => ({
+    fetch: (path, opts) => request(name, path, opts)
+  });
+  var serviceConnectors = () => track(
+    "service-connectors",
+    "serviceConnectors()",
+    () => call("GET", "/service-connectors")
+  );
+
   // src/design-system.ts
   var designSystem = () => track("design-system", "designSystem()", async () => {
     const response = await call("GET", "/config/design-system");
@@ -437,6 +470,8 @@
   window.mysql = mysql;
   window.dataConnectors = dataConnectors;
   window.databaseConnectors = databaseConnectors;
+  window.connector = connector;
+  window.serviceConnectors = serviceConnectors;
   window.designSystem = designSystem;
   window.me = me;
   window.appUsers = appUsers;