wawesome 0.20.1 → 0.21.0

package/dist/index.mjs

@@ -895,7 +895,7 @@ async function buildHandler(entryInput, config, options) {
 * that has to name this version — `--version`, the dependency a scaffolded
 * project pins — reads it here, so a release bumps one file.
 */
-const CLI_VERSION = "0.20.1";
+const CLI_VERSION = "0.21.0";
 //#endregion
 //#region src/cli-login.ts
 const START_PATH = "/v1/cli/login/start";
@@ -1207,7 +1207,7 @@ async function renewedSession(creds, tenantId) {
 	if (res.status === 429) throw await asGatewayError(res, "The platform is rate limiting this session's renewals.");
 	if (res.status >= 400 && res.status < 500) {
 		const refused = await asGatewayError(res, "Your session could not be renewed.");
-		if (tenantId && refused.reason === "not-a-member") throw refused;
+		if (tenantId && (refused.reason === "not-a-member" || refused.reason === "session-ended")) throw refused;
 		endSession(refused.message);
 	}
 	if (!res.ok) throw new Error(`Could not renew your session (HTTP ${res.status}).`);
@@ -3562,6 +3562,97 @@ async function uploadAssets(creds, app, funcName, bundle, assets, declared, isVe
 	console.log(`[wawesome] ✅ ${toUpload.length} asset(s) uploaded.`);
 }
 //#endregion
+//#region src/opens-host.ts
+/**
+* The host a variable declared with `opens_host` names, for the App's allowlist.
+* Null for a blank value. A refusal names the variable and never repeats the
+* value, since a connection string carries a password.
+*/
+function hostOpenedBy(key, value) {
+	const trimmed = value.trim();
+	if (!trimmed) return null;
+	const refuse = (why) => {
+		throw new Error(`${key} ${why}`);
+	};
+	let url;
+	try {
+		url = new URL(trimmed);
+	} catch {
+		return refuse("is not an https:// address, so there is no host to open.");
+	}
+	if (url.protocol !== "https:") return refuse(`must be an https:// address, not ${url.protocol}//. Outbound calls are HTTPS only.`);
+	if (url.hostname.startsWith("[")) return refuse("names an IPv6 address. The allowlist takes a host name, not an IPv6 literal.");
+	if (url.port) return refuse(`names port ${url.port}. Only the default HTTPS port is opened from a variable; add the host and port under Egress in the dashboard.`);
+	const host = url.hostname.toLowerCase().replace(/\.$/, "");
+	if (!host) return refuse("names no host.");
+	return host;
+}
+//#endregion
+//#region src/provision.ts
+/** The gateway's own words for a failure, or a plain HTTP status if it gave none. */
+async function rejected(res, fallback) {
+	if (res.status === 401 || res.status === 403) return new GatewayError(unauthorizedMessage(res.status, await res.text().catch(() => "")), res.status);
+	return asGatewayError(res, `${fallback} (HTTP ${res.status}).`);
+}
+function authHeaders(creds) {
+	return {
+		Authorization: `Bearer ${creds.tenant_jwt}`,
+		"Content-Type": "application/json"
+	};
+}
+/**
+* Make sure the App exists before anything is attached to it.
+*
+* Environment variables and subscriptions are both App-scoped, and neither
+* endpoint creates one — deploy would, but it runs last, and a Function that
+* goes live before its secrets do is a Function that fails its first request.
+*
+* Listing first rather than creating and reading the error keeps the common
+* case ("I already have this App") off the failure path; an App that appears in
+* between is still treated as the success it is.
+*/
+async function ensureApp(creds, appSlug) {
+	const listRes = await authorizedFetch(`${creds.gateway_url}/v1/apps`, { headers: { Authorization: `Bearer ${creds.tenant_jwt}` } });
+	if (!listRes.ok) throw await rejected(listRes, "Could not list the Tenant's apps");
+	if ((await listRes.json()).applications?.some((app) => app.slug === appSlug)) return;
+	const createRes = await authorizedFetch(`${creds.gateway_url}/v1/apps`, {
+		method: "POST",
+		headers: authHeaders(creds),
+		body: JSON.stringify({
+			name: appSlug,
+			slug: appSlug
+		})
+	});
+	if (createRes.ok) return;
+	const error = await rejected(createRes, `Could not create the app '${appSlug}'`);
+	if (/already exists/i.test(error.message)) return;
+	throw error;
+}
+/**
+* Enable one catalogue provider for the App.
+*
+* A template declares the providers it calls; without the subscription the
+* platform's egress policy denies those calls, so this is what stands between a
+* scaffolded template and an outbound request that silently fails at runtime.
+*/
+async function enableEgressProvider(creds, appSlug, providerKey) {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/apps/${encodeURIComponent(appSlug)}/egress/subscriptions`, {
+		method: "POST",
+		headers: authHeaders(creds),
+		body: JSON.stringify({ provider_key: providerKey })
+	});
+	if (!res.ok) throw await rejected(res, `Could not enable outbound provider '${providerKey}'`);
+}
+/** Add a bare host to the App's allowlist. The gateway upserts, so a repeat is harmless. */
+async function allowHost(creds, appSlug, host) {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/apps/${encodeURIComponent(appSlug)}/egress`, {
+		method: "POST",
+		headers: authHeaders(creds),
+		body: JSON.stringify({ host_pattern: host })
+	});
+	if (!res.ok) throw await rejected(res, `Could not open outbound calls to '${host}'`);
+}
+//#endregion
 //#region src/env.ts
 const STANDARD_SECRET_MESSAGES = [
 	"Encrypted at rest using AES-256",
@@ -3585,7 +3676,8 @@ function loadClientContext() {
 	}
 	return {
 		creds,
-		app: config.app.trim()
+		app: config.app.trim(),
+		opensHost: config.opens_host ?? []
 	};
 }
 /**
@@ -3623,8 +3715,18 @@ async function setEnvVar(key, value, options) {
 		console.error("[wawesome] Error: Missing key or value. Usage: wawesome env set <KEY> <VALUE> [--secret]");
 		process.exit(1);
 	}
-	const { creds, app } = loadClientContext();
+	const { creds, app, opensHost } = loadClientContext();
 	const isSecret = Boolean(options.secret);
+	const opensAHost = opensHost.includes(key);
+	let host = null;
+	if (opensAHost) try {
+		host = hostOpenedBy(key, value);
+	} catch (err) {
+		console.error(`[wawesome] Error: ${errorText(err)}`);
+		process.exit(1);
+		return;
+	}
+	const previous = opensAHost ? await previousValue(creds, app, key) : void 0;
 	if (isVerbose) {
 		console.log(`[wawesome:verbose] POST ${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/env`);
 		console.log(`[wawesome:verbose] Payload: key=${key}, is_secret=${isSecret}`);
@@ -3645,6 +3747,41 @@ async function setEnvVar(key, value, options) {
 		for (const msg of messages) console.log(`  • ${msg}`);
 		console.log("");
 	} else console.log(`[wawesome] ✅ Set variable '${key}' on app '${app}'.`);
+	if (host) {
+		try {
+			await allowHost(creds, app, host);
+		} catch (err) {
+			console.error(`[wawesome] Error: ${errorText(err)}`);
+			console.error(`[wawesome] '${key}' is set, but its host is not open. Run the same 'wawesome env set' again.`);
+			process.exit(1);
+			return;
+		}
+		console.log(`[wawesome] ✅ Opened outbound calls to '${host}', from ${key}.`);
+	}
+	if (previous?.is_secret) console.log(`[wawesome] ${key} was a secret, so the host its previous value opened cannot be read back. If that host changed, its entry stays on the allowlist; remove it under Egress in the dashboard if nothing else uses it.`);
+	else if (previous) {
+		const previousHost = derivedOrNull(key, previous.value);
+		if (previousHost && previousHost !== host) console.log(`[wawesome] The allowlist entry '${previousHost}' no longer matches ${key}. It stays; remove it under Egress in the dashboard if nothing else uses it.`);
+	}
+}
+async function previousValue(creds, app, key) {
+	try {
+		const res = await authorizedFetch(`${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/env`, {
+			method: "GET",
+			headers: { Authorization: `Bearer ${creds.tenant_jwt}` }
+		});
+		if (!res.ok) return void 0;
+		return (await res.json()).variables?.find((variable) => variable.key === key);
+	} catch {
+		return;
+	}
+}
+function derivedOrNull(key, value) {
+	try {
+		return hostOpenedBy(key, value);
+	} catch {
+		return null;
+	}
 }
 /**
 * List environment variables on the current app.
@@ -3787,62 +3924,6 @@ function installDependencies(dir, options = {}) {
 	};
 }
 //#endregion
-//#region src/provision.ts
-/** The gateway's own words for a failure, or a plain HTTP status if it gave none. */
-async function rejected(res, fallback) {
-	if (res.status === 401 || res.status === 403) return new GatewayError(unauthorizedMessage(res.status, await res.text().catch(() => "")), res.status);
-	return asGatewayError(res, `${fallback} (HTTP ${res.status}).`);
-}
-function authHeaders(creds) {
-	return {
-		Authorization: `Bearer ${creds.tenant_jwt}`,
-		"Content-Type": "application/json"
-	};
-}
-/**
-* Make sure the App exists before anything is attached to it.
-*
-* Environment variables and subscriptions are both App-scoped, and neither
-* endpoint creates one — deploy would, but it runs last, and a Function that
-* goes live before its secrets do is a Function that fails its first request.
-*
-* Listing first rather than creating and reading the error keeps the common
-* case ("I already have this App") off the failure path; an App that appears in
-* between is still treated as the success it is.
-*/
-async function ensureApp(creds, appSlug) {
-	const listRes = await authorizedFetch(`${creds.gateway_url}/v1/apps`, { headers: { Authorization: `Bearer ${creds.tenant_jwt}` } });
-	if (!listRes.ok) throw await rejected(listRes, "Could not list the Tenant's apps");
-	if ((await listRes.json()).applications?.some((app) => app.slug === appSlug)) return;
-	const createRes = await authorizedFetch(`${creds.gateway_url}/v1/apps`, {
-		method: "POST",
-		headers: authHeaders(creds),
-		body: JSON.stringify({
-			name: appSlug,
-			slug: appSlug
-		})
-	});
-	if (createRes.ok) return;
-	const error = await rejected(createRes, `Could not create the app '${appSlug}'`);
-	if (/already exists/i.test(error.message)) return;
-	throw error;
-}
-/**
-* Enable one catalogue provider for the App.
-*
-* A template declares the providers it calls; without the subscription the
-* platform's egress policy denies those calls, so this is what stands between a
-* scaffolded template and an outbound request that silently fails at runtime.
-*/
-async function enableEgressProvider(creds, appSlug, providerKey) {
-	const res = await authorizedFetch(`${creds.gateway_url}/v1/apps/${encodeURIComponent(appSlug)}/egress/subscriptions`, {
-		method: "POST",
-		headers: authHeaders(creds),
-		body: JSON.stringify({ provider_key: providerKey })
-	});
-	if (!res.ok) throw await rejected(res, `Could not enable outbound provider '${providerKey}'`);
-}
-//#endregion
 //#region src/scaffold.ts
 const MANIFEST_FILE = "template.json";
 const PACKAGE_FILE = "package.json";
@@ -3882,6 +3963,18 @@ function applyTemplateIdentity(dir, identity) {
 		function: identity.functionName
 	}));
 }
+/**
+* Write down which variables open a host, so a later `env set` knows. Nothing is
+* written for a template that declares none.
+*/
+function recordHostVariables(dir, env) {
+	const keys = env.filter((variable) => variable.opens_host === true).map((variable) => variable.key);
+	if (keys.length === 0) return;
+	patchJson(path.join(dir, FUNCTION_CONFIG_FILE), (config) => ({
+		...config,
+		opens_host: keys
+	}));
+}
 /** The package the CLI publishes itself as, and which a template depends on. */
 const CLI_PACKAGE = "wawesome";
 /**
@@ -4481,6 +4574,19 @@ async function offerWorkspaceAddress(session, creds, tenant, appSlug, functionNa
 */
 async function wireUp(creds, appSlug, manifest, answers) {
 	const scaffolded = "Your project is scaffolded. Fix this, then run 'wawesome deploy'.";
+	const opened = [];
+	for (const { declared, value } of answers) {
+		if (declared.opens_host !== true) continue;
+		try {
+			const host = hostOpenedBy(declared.key, value);
+			if (host) opened.push({
+				key: declared.key,
+				host
+			});
+		} catch (err) {
+			fail$1(errorText(err), "Your project is scaffolded, and nothing was stored. Run 'wawesome init' again in an empty directory.");
+		}
+	}
 	try {
 		await ensureApp(creds, appSlug);
 	} catch (err) {
@@ -4507,6 +4613,14 @@ async function wireUp(creds, appSlug, manifest, answers) {
 		}
 		console.log(`[wawesome] ✅ Enabled outbound calls to '${provider}'.`);
 	}
+	for (const { key, host } of opened) {
+		try {
+			await allowHost(creds, appSlug, host);
+		} catch (err) {
+			fail$1(errorText(err), scaffolded);
+		}
+		console.log(`[wawesome] ✅ Opened outbound calls to '${host}', from ${key}.`);
+	}
 }
 /**
 * Scaffold from a catalogue template, wire up what it declared, and deploy it.
@@ -4572,6 +4686,7 @@ async function initFromTemplate(templateName, options) {
 					app: appSlug,
 					functionName
 				});
+				recordHostVariables(cwd, manifest.env);
 				repinned = alignCliDependency(cwd, CLI_VERSION);
 			} catch (err) {
 				fail$1(errorText(err), `Some of '${template.name}' may have been written to ${cwd}.`);
@@ -5709,7 +5824,7 @@ async function renameWorkspace(slug, options) {
 * hearing about it.
 */
 async function listWorkspaces(options) {
-	const read = await requireWorkspaces(requireSession("Your workspaces would be read for that credential's Tenant alone."));
+	const read = await requireWorkspaces(requireSession$1("Your workspaces would be read for that credential's Tenant alone."));
 	console.log("\n[wawesome] Your workspaces:\n");
 	const width = Math.max(...read.workspaces.map((workspace) => workspace.name.length));
 	for (const workspace of read.workspaces) {
@@ -5729,7 +5844,7 @@ async function listWorkspaces(options) {
 * so this is where somebody is told rather than where it is decided.
 */
 async function switchWorkspace(target, options) {
-	const creds = requireSession("A switch would move a session that credential does not have.");
+	const creds = requireSession$1("A switch would move a session that credential does not have.");
 	if (!target || !target.trim()) {
 		console.error("[wawesome] Error: No workspace given. Usage: wawesome workspace switch <name>");
 		process.exit(1);
@@ -5776,7 +5891,7 @@ async function workspaceCommand(action, target, options) {
 * **Deploy credential**: a credential names one Tenant and holds no
 * **Membership** anywhere, so there is nothing for it to list or move.
 */
-function requireSession(consequence) {
+function requireSession$1(consequence) {
 	const credential = credentialFromEnvironment();
 	if (credential) {
 		reportSessionCommandRefused(credential, consequence);
@@ -5814,6 +5929,93 @@ function refuse(headline, next, lines) {
 	process.exit(1);
 }
 //#endregion
+//#region src/export.ts
+const POLL_MS = 3e3;
+async function exportCall(creds, method) {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/export`, {
+		method,
+		headers: { Authorization: `Bearer ${creds.tenant_jwt}` }
+	});
+	if (!res.ok) throw await asGatewayError(res, `Failed to ${method === "POST" ? "ask for" : "read"} the export (HTTP ${res.status}).`);
+	return await res.json();
+}
+function requestExport(creds) {
+	return exportCall(creds, "POST");
+}
+function readExport(creds) {
+	return exportCall(creds, "GET");
+}
+function when(instant) {
+	return new Date(instant).toUTCString();
+}
+function megabytes(bytes) {
+	return `${(bytes / 1048576).toFixed(1)} MB`;
+}
+function describeExport(view) {
+	const current = view.export;
+	if (!current) return ["This workspace has not asked for an export. Run 'wawesome export' to ask for one."];
+	switch (current.status) {
+		case "queued": return [`Export asked for at ${when(current.requested_at)}. It is waiting to be built.`];
+		case "building": return current.last_failed_at ? [`The last attempt to build it failed at ${when(current.last_failed_at)}. It is being tried again.`, "Run 'wawesome export status' later to see where it got to."] : ["The archive is being built. A large workspace takes a while."];
+		case "expired": return [`The last export was deleted on ${when(current.expires_at)}, ${view.retention_days} days after it was built.`, "Run 'wawesome export' to ask for a new one."];
+		case "ready": return [
+			`Ready${current.size_bytes !== null ? ` (${megabytes(current.size_bytes)})` : ""}. Download it here:`,
+			"",
+			`  ${current.download.url}`,
+			"",
+			`This link works until ${when(current.download.expires_at)}. Run 'wawesome export status' for a new one.`,
+			`The archive is deleted on ${when(current.expires_at)}.`,
+			"Secret values are not in it. Rotate any secret that mattered."
+		];
+	}
+}
+function requireSession() {
+	const credential = credentialFromEnvironment();
+	if (credential) {
+		reportSessionCommandRefused(credential, "Only the workspace's owner, signed in, can export it.");
+		process.exit(1);
+	}
+	const creds = readCredentials();
+	if (!creds) {
+		console.error("[wawesome] Error: Not logged in. Run 'wawesome login' first.");
+		process.exit(1);
+	}
+	return creds;
+}
+function print(view) {
+	for (const line of describeExport(view)) console.log(line ? `[wawesome] ${line}` : "");
+}
+const settled = (view) => view.export?.status === "ready" || view.export?.status === "expired";
+async function exportCommand(action, options) {
+	if (action && action !== "status") {
+		console.error(`[wawesome] Error: Unknown export action '${action}'.`);
+		console.error("[wawesome] Usage: wawesome export [status] [--no-wait]");
+		process.exit(1);
+	}
+	const creds = requireSession();
+	try {
+		if (action === "status") {
+			print(await readExport(creds));
+			return;
+		}
+		let view = await requestExport(creds);
+		print(view);
+		if (options.wait === false) return;
+		let said = view.export?.status;
+		while (!settled(view) && !view.export?.last_failed_at) {
+			await new Promise((resolve) => setTimeout(resolve, POLL_MS));
+			view = await readExport(creds);
+			if (view.export?.status !== said) {
+				said = view.export?.status;
+				print(view);
+			}
+		}
+	} catch (err) {
+		console.error(`[wawesome] Error: ${errorText(err)}`);
+		process.exit(1);
+	}
+}
+//#endregion
 //#region ../shared/mint-surface.generated.ts
 const MINT_PRESETS = [
 	{
@@ -5909,9 +6111,10 @@ function mintPreset(name) {
 			"write:egress",
 			"write:billing",
 			"write:credentials",
-			"write:members"
+			"write:members",
+			"write:exports"
 		],
-		summary: "Reads the workspace, Apps, Functions, environment variables, domains, invocations, runs, schedules, previews and the egress allowlist, and can rename the workspace, create Apps, deploy Functions, set environment variables, attach domains, detach domains, run Functions, pause and resume schedules, create previews, widen the egress allowlist, change billing, manage credentials and manage members.",
+		summary: "Reads the workspace, Apps, Functions, environment variables, domains, invocations, runs, schedules, previews and the egress allowlist, and can rename the workspace, create Apps, deploy Functions, set environment variables, attach domains, detach domains, run Functions, pause and resume schedules, create previews, widen the egress allowlist, change billing, manage credentials, manage members and export the workspace.",
 		withheldFromAPerson: "A workspace has one owner, so 'owner' is not a standing anybody is put at."
 	},
 	{
@@ -5940,7 +6143,7 @@ function mintPreset(name) {
 			"write:credentials",
 			"write:members"
 		],
-		summary: "Reads the workspace, Apps, Functions, environment variables, domains, invocations, runs, schedules, previews and the egress allowlist, and can create Apps, deploy Functions, set environment variables, attach domains, detach domains, run Functions, pause and resume schedules, create previews, widen the egress allowlist, manage credentials and manage members. It does not rename the workspace or change billing.",
+		summary: "Reads the workspace, Apps, Functions, environment variables, domains, invocations, runs, schedules, previews and the egress allowlist, and can create Apps, deploy Functions, set environment variables, attach domains, detach domains, run Functions, pause and resume schedules, create previews, widen the egress allowlist, manage credentials and manage members. It does not rename the workspace, change billing or export the workspace.",
 		withheldFromAPerson: null
 	},
 	{
@@ -5965,7 +6168,7 @@ function mintPreset(name) {
 			"write:schedules",
 			"write:previews"
 		],
-		summary: "Reads the workspace, Apps, Functions, environment variables, domains, invocations, runs, schedules, previews and the egress allowlist, and can create Apps, deploy Functions, set environment variables, attach domains, run Functions, pause and resume schedules and create previews. It does not rename the workspace, detach domains, widen the egress allowlist, change billing, manage credentials or manage members.",
+		summary: "Reads the workspace, Apps, Functions, environment variables, domains, invocations, runs, schedules, previews and the egress allowlist, and can create Apps, deploy Functions, set environment variables, attach domains, run Functions, pause and resume schedules and create previews. It does not rename the workspace, detach domains, widen the egress allowlist, change billing, manage credentials, manage members or export the workspace.",
 		withheldFromAPerson: null
 	},
 	{
@@ -5987,7 +6190,7 @@ function mintPreset(name) {
 			"write:env",
 			"write:runs"
 		],
-		summary: "Reads the workspace, Apps, Functions, environment variables, domains, invocations, runs, schedules, previews and the egress allowlist, and can create Apps, deploy Functions, set environment variables and run Functions. It does not rename the workspace, attach domains, detach domains, pause and resume schedules, create previews, widen the egress allowlist, change billing, manage credentials or manage members.",
+		summary: "Reads the workspace, Apps, Functions, environment variables, domains, invocations, runs, schedules, previews and the egress allowlist, and can create Apps, deploy Functions, set environment variables and run Functions. It does not rename the workspace, attach domains, detach domains, pause and resume schedules, create previews, widen the egress allowlist, change billing, manage credentials, manage members or export the workspace.",
 		withheldFromAPerson: "'deployer' is the recipe a Deploy credential is cut from. A pipeline gets a credential of its own rather than somebody's account."
 	},
 	{
@@ -6473,6 +6676,7 @@ cli.command("login", "Authenticate with the wawesome.io platform").option("--api
 cli.command("logout", "Clear stored authentication credentials").action(async () => await logout());
 cli.command("whoami", "Show current login session info").action(() => whoami());
 cli.command("workspace [action] [name]", "Show the workspace, move between workspaces, or rename the public address").usage("workspace <action> [name]\n\nActions:\n  show                Show the workspace name, address, and whether it can still change\n  list (ls)           Show the workspaces you belong to, and which one you are in\n  switch <name>       Move this terminal to another workspace you belong to\n  rename <name>       Change the public address, while nothing live depends on it").example("wawesome workspace").example("wawesome workspace list").example("wawesome workspace switch northwind").example("wawesome workspace rename northwind").option("-v, --verbose", "Enable verbose debug output").action((action, name, options) => workspaceCommand(action, name, options));
+cli.command("export [action]", "Export the whole workspace as one archive, and print the link to it").usage("export [status]\n\nWith no action, asks for an export and waits until it is ready.\n  status              Show the latest export, and a new link if it is ready").example("wawesome export").example("wawesome export status").option("--no-wait", "Ask for the export and return without waiting for it").option("-v, --verbose", "Enable verbose debug output").action((action, options) => exportCommand(action, options));
 cli.command("templates [action]", "Browse the template catalog").usage("templates [action]\n\nActions:\n  list (ls)           Show every available template (default)").example("wawesome templates").example("wawesome templates list").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("-v, --verbose", "Enable verbose debug output").action((action, options) => templatesCommand(action, options));
 cli.command("credentials [action] [target]", "Mint, list, regenerate, revoke and delete deploy credentials").alias("credential").usage(`credentials <action> [options]
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wawesome",
-  "version": "0.20.1",
+  "version": "0.21.0",
   "description": "CLI tool for building and deploying serverless functions on wawesome.io platform",
   "type": "module",
   "bin": {