uc-config 0.1.0

package/dist/schema.js

@@ -0,0 +1,75 @@
+import { readFileSync } from "node:fs";
+import { Ajv2020 } from "ajv/dist/2020.js";
+import addFormats from "ajv-formats";
+import { isObject } from "./util.js";
+export const spec = JSON.parse(readFileSync(new URL("../vendor/core-api.json", import.meta.url), "utf8"));
+const ajv = new Ajv2020({
+    strict: false,
+    allErrors: true,
+    validateFormats: false,
+});
+addFormats(ajv);
+// Authoring-time secret references are legal where a native string is expected.
+// Resolved values are validated again immediately before writes.
+function symbolicSchema(value) {
+    if (Array.isArray(value))
+        return value.map(symbolicSchema);
+    if (!value || typeof value !== "object")
+        return value;
+    const node = Object.fromEntries(Object.entries(value).map(([k, v]) => [k, symbolicSchema(v)]));
+    if (value.type === "string")
+        return {
+            anyOf: [
+                node,
+                {
+                    type: "object",
+                    properties: {
+                        $secret: { type: "string", pattern: "^(env|keychain):.+$" },
+                        version: { type: "string" },
+                    },
+                    required: ["$secret"],
+                    additionalProperties: false,
+                },
+            ],
+        };
+    return node;
+}
+ajv.addSchema({ ...symbolicSchema(spec), $id: "uc" }, "uc");
+export function validateRequest(path, method, data) {
+    const schema = spec.paths[path]?.[method.toLowerCase()]?.requestBody?.content?.["application/json"]?.schema;
+    if (!schema)
+        return;
+    const id = `uc#/paths/${path.replace(/~/g, "~0").replace(/\//g, "~1")}/${method.toLowerCase()}/requestBody/content/application~1json/schema`;
+    const validate = ajv.getSchema(id) ?? ajv.compile({ $ref: id });
+    if (!validate(data))
+        throw new Error(`Invalid ${method} ${path}: ${ajv.errorsText(validate.errors, { dataVar: "body" })}`);
+}
+export function writable(path, method, value) {
+    const root = spec.paths[path]?.[method]?.requestBody?.content?.["application/json"]
+        ?.schema;
+    function properties(schema) {
+        if (!schema)
+            return {};
+        if (schema.$ref)
+            return properties(schema.$ref
+                .split("/")
+                .slice(1)
+                .reduce((a, k) => a[k], spec));
+        return {
+            ...schema.properties,
+            ...Object.assign({}, ...(schema.allOf ?? []).map(properties)),
+        };
+    }
+    function pick(schema, v) {
+        const props = properties(schema);
+        return Object.fromEntries(Object.entries(v)
+            .filter(([k]) => k in props)
+            .map(([k, x]) => [
+            k,
+            isObject(x) && Object.keys(properties(props[k])).length
+                ? pick(props[k], x)
+                : x,
+        ]));
+    }
+    return pick(root, value);
+}

package/dist/transport.d.ts

@@ -0,0 +1,2 @@
+export declare const curlFetch: typeof fetch;
+export declare const localFetch: typeof fetch;

package/dist/transport.js

@@ -0,0 +1,101 @@
+import { spawn } from "node:child_process";
+import { mkdtemp, writeFile, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+// curl is a fallback for macOS environments where Node lacks local-network access.
+// Credentials go through stdin, never argv. Request bodies live in a private temporary directory.
+export const curlFetch = async (input, init) => {
+    const request = new Request(input, init);
+    const dir = await mkdtemp(join(tmpdir(), "uc-config-http-"));
+    const quote = (s) => `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\r/g, "\\r").replace(/\n/g, "\\n")}"`;
+    try {
+        const lines = [
+            "silent",
+            "show-error",
+            "globoff",
+            "max-time = 180",
+            `url = ${quote(request.url)}`,
+            `request = ${quote(request.method)}`,
+            `dump-header = ${quote(join(dir, "headers"))}`,
+        ];
+        request.headers.forEach((v, k) => lines.push(`header = ${quote(`${k}: ${v}`)}`));
+        if (request.body) {
+            await writeFile(join(dir, "body"), Buffer.from(await request.arrayBuffer()), { mode: 0o600 });
+            lines.push(`data-binary = ${quote("@" + join(dir, "body"))}`);
+        }
+        const bytes = await new Promise((resolve, reject) => {
+            const child = spawn("curl", ["--config", "-"], {
+                stdio: ["pipe", "pipe", "pipe"],
+            });
+            const chunks = [];
+            let size = 0;
+            const abort = () => {
+                child.kill();
+                reject(new Error("curl request aborted"));
+            };
+            if (request.signal.aborted) {
+                abort();
+                return;
+            }
+            request.signal.addEventListener("abort", abort, { once: true });
+            child.stdout.on("data", (chunk) => {
+                size += chunk.length;
+                if (size > 200 * 1024 * 1024) {
+                    child.kill();
+                    reject(new Error("Response too large"));
+                }
+                else
+                    chunks.push(chunk);
+            });
+            // Do not print curl stderr: upstream diagnostics can include private URLs.
+            child.stderr.resume();
+            child.on("error", () => reject(new Error("curl could not start")));
+            child.on("close", (code) => {
+                request.signal.removeEventListener("abort", abort);
+                code === 0
+                    ? resolve(Buffer.concat(chunks))
+                    : reject(new Error(`curl transport failed (${code})`));
+            });
+            child.stdin.on("error", () => { });
+            child.stdin.end(lines.join("\n") + "\n");
+        });
+        const blocks = (await readFile(join(dir, "headers"), "utf8"))
+            .trim()
+            .split(/\r?\n\r?\n/);
+        const last = blocks.at(-1);
+        const responseLines = last.split(/\r?\n/);
+        const status = Number(responseLines.shift()?.split(" ")[1]);
+        const headers = new Headers();
+        for (const line of responseLines) {
+            const colon = line.indexOf(":");
+            if (colon > 0)
+                headers.append(line.slice(0, colon), line.slice(colon + 1).trim());
+        }
+        return new Response(request.method === "HEAD" || [204, 205, 304].includes(status)
+            ? null
+            : new Uint8Array(bytes), { status, headers });
+    }
+    finally {
+        await rm(dir, { recursive: true, force: true });
+    }
+};
+const curlOrigins = new Set();
+export const localFetch = async (input, init) => {
+    const origin = new URL(input instanceof Request ? input.url : String(input))
+        .origin;
+    if (process.env.UC_HTTP_TRANSPORT === "curl" || curlOrigins.has(origin))
+        return curlFetch(input, init);
+    try {
+        return await fetch(input, init);
+    }
+    catch (error) {
+        const code = error.cause?.code;
+        // Only retry failures known to occur before connection establishment, never a timeout/reset.
+        if (process.platform === "darwin" &&
+            ["EHOSTUNREACH", "ENETUNREACH", "EACCES", "EPERM"].includes(code ?? "")) {
+            curlOrigins.add(origin);
+            return curlFetch(input, init);
+        }
+        throw error;
+    }
+};

package/dist/util.d.ts

@@ -0,0 +1,18 @@
+import type { Json, ObjectValue, State } from "./model.js";
+export declare function canonical(value: unknown): string;
+export declare const hash: (v: unknown) => string;
+export declare const equal: (a: unknown, b: unknown) => boolean;
+export declare const isObject: (v: unknown) => v is ObjectValue;
+export declare function assertJson(v: unknown, path?: string, seen?: Set<object>): asserts v is Json;
+export declare function project(live: ObjectValue, shape: ObjectValue): ObjectValue;
+export declare function merge(a: ObjectValue, b: ObjectValue): ObjectValue;
+export declare function leaves(v: ObjectValue, path?: string[]): Array<[string[], Json]>;
+export declare const get: (v: unknown, path: string[]) => unknown;
+export declare function set(v: ObjectValue, path: string[], value: Json): void;
+export declare function readJson<T>(file: string): Promise<T>;
+export declare function saveJson(file: string, value: unknown): Promise<void>;
+export declare function withLock<T>(file: string, fn: () => Promise<T>): Promise<T>;
+export declare function resolveRefs<T>(value: T, state: State): T;
+export declare function references(value: unknown): string[];
+export declare function redact(value: unknown): unknown;
+export declare function secretFields(v: unknown, path?: string[]): string[];

package/dist/util.js

@@ -0,0 +1,140 @@
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, readFile, rename, writeFile, open, unlink, } from "node:fs/promises";
+import { dirname } from "node:path";
+export function canonical(value) {
+    if (value === undefined)
+        return "undefined";
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(",")}]`;
+    if (value && typeof value === "object")
+        return `{${Object.entries(value)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([k, v]) => `${JSON.stringify(k)}:${canonical(v)}`)
+            .join(",")}}`;
+    return JSON.stringify(value);
+}
+export const hash = (v) => createHash("sha256").update(canonical(v)).digest("hex");
+export const equal = (a, b) => canonical(a) === canonical(b);
+export const isObject = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+export function assertJson(v, path = "config", seen = new Set()) {
+    if (v === null ||
+        typeof v === "string" ||
+        typeof v === "boolean" ||
+        (typeof v === "number" && Number.isFinite(v)))
+        return;
+    if (typeof v !== "object" || seen.has(v))
+        throw new Error(`${path}: expected serializable JSON (no undefined, functions, cycles or non-finite numbers)`);
+    if (!Array.isArray(v) &&
+        Object.getPrototypeOf(v) !== Object.prototype &&
+        Object.getPrototypeOf(v) !== null)
+        throw new Error(`${path}: expected plain object`);
+    seen.add(v);
+    for (const [k, x] of Object.entries(v)) {
+        if (["__proto__", "constructor", "prototype"].includes(k))
+            throw new Error(`${path}: forbidden key ${k}`);
+        assertJson(x, `${path}.${k}`, seen);
+    }
+    seen.delete(v);
+}
+export function project(live, shape) {
+    const value = (actual, wanted) => {
+        if (isObject(wanted) && !("$secret" in wanted) && isObject(actual))
+            return project(actual, wanted);
+        if (Array.isArray(wanted) && Array.isArray(actual))
+            return actual.map((item, i) => wanted[i] === undefined ? item : value(item, wanted[i]));
+        return actual;
+    };
+    return Object.fromEntries(Object.entries(shape)
+        .filter(([k]) => k in live)
+        .map(([k, v]) => [k, value(live[k], v)]));
+}
+export function merge(a, b) {
+    const out = structuredClone(a);
+    for (const [k, v] of Object.entries(b))
+        out[k] = isObject(v) && isObject(out[k]) ? merge(out[k], v) : v;
+    return out;
+}
+export function leaves(v, path = []) {
+    return Object.entries(v).flatMap(([k, x]) => isObject(x) && Object.keys(x).length && !("$secret" in x)
+        ? leaves(x, [...path, k])
+        : [[[...path, k], x]]);
+}
+export const get = (v, path) => path.reduce((a, k) => (isObject(a) ? a[k] : undefined), v);
+export function set(v, path, value) {
+    const [key, ...rest] = path;
+    if (!key)
+        throw new Error("Empty path");
+    if (!rest.length)
+        v[key] = value;
+    else {
+        if (!isObject(v[key]))
+            v[key] = {};
+        set(v[key], rest, value);
+    }
+}
+export async function readJson(file) {
+    return JSON.parse(await readFile(file, "utf8"));
+}
+export async function saveJson(file, value) {
+    await mkdir(dirname(file), { recursive: true, mode: 0o700 });
+    const tmp = `${file}.${randomUUID()}.tmp`;
+    await writeFile(tmp, JSON.stringify(value, null, 2) + "\n", { mode: 0o600 });
+    await rename(tmp, file);
+}
+export async function withLock(file, fn) {
+    await mkdir(dirname(file), { recursive: true, mode: 0o700 });
+    const handle = await open(file, "wx", 0o600).catch(() => {
+        throw new Error(`Target locked: ${file}. If its process has exited, inspect the journal before removing this lock.`);
+    });
+    try {
+        await handle.writeFile(JSON.stringify({ pid: process.pid, createdAt: new Date().toISOString() }));
+        return await fn();
+    }
+    finally {
+        await handle.close();
+        await unlink(file);
+    }
+}
+export function resolveRefs(value, state) {
+    if (Array.isArray(value))
+        return value.map((x) => resolveRefs(x, state));
+    if (isObject(value)) {
+        if (typeof value.$ref === "string") {
+            const b = state.bindings[value.$ref];
+            if (!b)
+                throw new Error(`Unresolved reference: ${value.$ref}`);
+            return b.id;
+        }
+        return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, resolveRefs(v, state)]));
+    }
+    return value;
+}
+export function references(value) {
+    if (Array.isArray(value))
+        return value.flatMap(references);
+    if (isObject(value))
+        return typeof value.$ref === "string"
+            ? [value.$ref]
+            : Object.values(value).flatMap(references);
+    return [];
+}
+const sensitive = /password|token|secret|api[_-]?key|authorization|cookie|passkey|(^|_)pin$/i;
+export function redact(value) {
+    if (Array.isArray(value))
+        return value.map(redact);
+    if (!isObject(value))
+        return value;
+    return Object.fromEntries(Object.entries(value).map(([k, v]) => [
+        k,
+        sensitive.test(k) ? "[REDACTED]" : redact(v),
+    ]));
+}
+export function secretFields(v, path = []) {
+    if (!isObject(v) && !Array.isArray(v))
+        return [];
+    if (isObject(v) && "$secret" in v)
+        return [];
+    return Object.entries(v).flatMap(([k, x]) => sensitive.test(k) && !(isObject(x) && "$secret" in x)
+        ? [[...path, k].join(".")]
+        : secretFields(x, [...path, k]));
+}