apizit-cli 0.2.0b1__py3-none-any.whl

apizit_cli/sources.py

@@ -0,0 +1,259 @@
+"""Deterministic packaging of local source files, without executing customer code."""
+
+from __future__ import annotations
+
+import gzip
+import hashlib
+import json
+import os
+import stat
+import subprocess
+import tarfile
+import tempfile
+import unicodedata
+from dataclasses import dataclass
+from pathlib import Path
+
+from pathspec import GitIgnoreSpec
+
+from apizit_cli.errors import CliError, EXIT_USAGE
+
+MAX_BUNDLE_BYTES = 64 * 1024 * 1024
+MAX_SOURCE_BYTES = 512 * 1024 * 1024
+MAX_FILES = 20_000
+IGNORED_DIRECTORIES = frozenset(
+    {
+        ".git",
+        ".hg",
+        ".svn",
+        ".apizit",
+        ".aws",
+        ".ssh",
+        ".azure",
+        ".gnupg",
+        ".kube",
+        ".venv",
+        "venv",
+        "env",
+        "__pycache__",
+        ".pytest_cache",
+        ".ruff_cache",
+        ".mypy_cache",
+        ".tox",
+        "node_modules",
+        ".aws-sam",
+        "generated",
+        "dist",
+        "build",
+    }
+)
+IGNORED_FILES = frozenset(
+    {".netrc", ".npmrc", ".pypirc", "credentials", "id_rsa", "id_ed25519", "id_ecdsa", "id_dsa"}
+)
+PRIVATE_SUFFIXES = (".pem", ".key", ".p12", ".pfx", ".pyc", ".pyo")
+
+
+@dataclass(frozen=True)
+class LocalBundle:
+    path: Path
+    digest_sha256: str
+    size_bytes: int
+    file_count: int
+    unpacked_size_bytes: int
+    source_commit_sha: str | None
+    working_tree_dirty: bool | None
+    excluded: tuple[str, ...]
+
+
+def _failure(message):
+    return CliError(message, code="LOCAL_SOURCE_INVALID", exit_code=EXIT_USAGE)
+
+
+def _unsafe_stat(info):
+    return stat.S_ISLNK(info.st_mode) or bool(getattr(info, "st_file_attributes", 0) & 0x400)
+
+
+def _ignore_spec(path):
+    if not path.exists():
+        return GitIgnoreSpec.from_lines([])
+    info = path.lstat()
+    if _unsafe_stat(info) or not stat.S_ISREG(info.st_mode) or info.st_size > 64 * 1024:
+        raise _failure("Ignore rules must be regular UTF-8 files of at most 64 KiB.")
+    try:
+        return GitIgnoreSpec.from_lines(path.read_text(encoding="utf-8").splitlines())
+    except (OSError, UnicodeError, ValueError):
+        raise _failure("Could not read source ignore rules.") from None
+
+
+def _collect(root):
+    included = []
+    excluded = []
+    collisions = set()
+    total = 0
+    apizit_ignore = _ignore_spec(root / ".apizitignore")
+
+    def walk(directory, rules):
+        nonlocal total
+        local_rule = directory / ".gitignore"
+        if local_rule.exists():
+            rules = [*rules, (directory, _ignore_spec(local_rule))]
+        for path in sorted(directory.iterdir(), key=lambda item: item.name):
+            relative = path.relative_to(root).as_posix()
+            info = path.lstat()
+            if _unsafe_stat(info):
+                raise _failure(f"Source links are not supported: {relative}")
+            is_directory = stat.S_ISDIR(info.st_mode)
+            name = path.name.lower()
+            forbidden = (
+                name in IGNORED_DIRECTORIES
+                if is_directory
+                else (
+                    name in IGNORED_FILES
+                    or name.startswith(".env")
+                    or name.endswith(PRIVATE_SUFFIXES)
+                )
+            )
+            ignored = False
+            for base, spec in rules:
+                match = spec.check_file(
+                    path.relative_to(base).as_posix() + ("/" if is_directory else "")
+                )
+                if match.include is not None:
+                    ignored = match.include
+            ignored = ignored or apizit_ignore.match_file(relative + ("/" if is_directory else ""))
+            if forbidden or ignored:
+                excluded.append(relative + ("/" if is_directory else ""))
+                continue
+            normalized = unicodedata.normalize("NFC", relative)
+            if (
+                normalized != relative
+                or "\\" in relative
+                or ":" in relative
+                or any(ord(c) < 32 for c in relative)
+            ):
+                raise _failure("Source paths must use normalized names without control characters.")
+            identity = normalized.casefold()
+            if identity in collisions:
+                raise _failure(f"Source paths collide across platforms: {relative}")
+            collisions.add(identity)
+            if is_directory:
+                walk(path, rules)
+            elif stat.S_ISREG(info.st_mode):
+                if info.st_nlink > 1:
+                    raise _failure(f"Hard-linked files are not supported: {relative}")
+                total += info.st_size
+                included.append((relative, path, info))
+                if len(included) > MAX_FILES or total > MAX_SOURCE_BYTES:
+                    raise _failure("Local source exceeds the file-count or expanded-size limit.")
+            else:
+                raise _failure(f"Only ordinary files and directories are supported: {relative}")
+
+    try:
+        walk(root, [])
+    except OSError:
+        raise _failure("The source contains unreadable files.") from None
+    if not included:
+        raise _failure("The project has no files after applying source exclusions.")
+    return sorted(included), tuple(excluded), total
+
+
+def _git_provenance(root):
+    try:
+        command = ["git", "-c", "core.fsmonitor=false", "-c", "core.hooksPath=", "-C", str(root)]
+        head = (
+            subprocess.run(
+                [*command, "rev-parse", "HEAD"], capture_output=True, check=True, timeout=10
+            )
+            .stdout.decode()
+            .strip()
+        )
+        if len(head) != 40 or any(c not in "0123456789abcdef" for c in head):
+            return None, None
+        status = subprocess.run(
+            [*command, "status", "--porcelain", "--untracked-files=normal", "--", "."],
+            capture_output=True,
+            check=True,
+            timeout=10,
+        ).stdout
+        return head, bool(status)
+    except (OSError, subprocess.SubprocessError, UnicodeError):
+        return None, None
+
+
+def pack_local_source(root: Path, destination: Path) -> LocalBundle:
+    root = Path(root).resolve(strict=True)
+    destination = Path(destination).resolve()
+    if not root.is_dir() or destination.is_relative_to(root):
+        raise _failure("Package output must be outside the source directory.")
+    included, excluded, total = _collect(root)
+    manifest = []
+    try:
+        with destination.open("xb") as raw:
+            with gzip.GzipFile(
+                filename="", fileobj=raw, mode="wb", mtime=0, compresslevel=6
+            ) as compressed:
+                with tarfile.open(
+                    fileobj=compressed, mode="w", format=tarfile.PAX_FORMAT
+                ) as archive:
+                    for relative, path, original in included:
+                        digest = hashlib.sha256()
+                        size = 0
+                        with (
+                            path.open("rb") as source,
+                            tempfile.SpooledTemporaryFile(max_size=2 * 1024 * 1024) as buffered,
+                        ):
+                            opened = os.fstat(source.fileno())
+                            if (opened.st_ino, opened.st_size, opened.st_mtime_ns) != (
+                                original.st_ino,
+                                original.st_size,
+                                original.st_mtime_ns,
+                            ):
+                                raise _failure(f"Source changed during packaging: {relative}")
+                            while chunk := source.read(1024 * 1024):
+                                size += len(chunk)
+                                if size > original.st_size:
+                                    raise _failure(f"Source changed during packaging: {relative}")
+                                if size <= 1024 * 1024 and b"PRIVATE KEY-----" in chunk:
+                                    raise _failure(
+                                        f"A private key must not be uploaded: {relative}"
+                                    )
+                                digest.update(chunk)
+                                buffered.write(chunk)
+                            after = path.lstat()
+                            if (
+                                _unsafe_stat(after)
+                                or size != original.st_size
+                                or (after.st_ino, after.st_size, after.st_mtime_ns)
+                                != (original.st_ino, original.st_size, original.st_mtime_ns)
+                            ):
+                                raise _failure(f"Source changed during packaging: {relative}")
+                            buffered.seek(0)
+                            member = tarfile.TarInfo(relative)
+                            member.size = size
+                            member.mode = 0o755 if original.st_mode & 0o111 else 0o644
+                            archive.addfile(member, buffered)
+                        manifest.append(
+                            {"path": relative, "size_bytes": size, "sha256": digest.hexdigest()}
+                        )
+                        if raw.tell() > MAX_BUNDLE_BYTES:
+                            raise _failure("Compressed source exceeds 64 MiB.")
+                    # The manifest is carried alongside the archive in the client result, rather
+                    # than adding a platform-generated file to the customer's source tree.
+        size_bytes = destination.stat().st_size
+        if size_bytes > MAX_BUNDLE_BYTES:
+            raise _failure("Compressed source exceeds 64 MiB.")
+        with destination.open("rb") as stream:
+            digest = hashlib.file_digest(stream, "sha256").hexdigest()
+        head, dirty = _git_provenance(root)
+        destination.with_suffix(destination.suffix + ".manifest.json").write_text(
+            json.dumps(
+                {"version": 1, "ignore_policy_version": 1, "files": manifest}, separators=(",", ":")
+            ),
+            encoding="utf-8",
+        )
+        return LocalBundle(
+            destination, "sha256:" + digest, size_bytes, len(included), total, head, dirty, excluded
+        )
+    except Exception:
+        destination.unlink(missing_ok=True)
+        raise

apizit_cli-0.2.0b1.dist-info/METADATA

@@ -0,0 +1,44 @@
+Metadata-Version: 2.4
+Name: apizit-cli
+Version: 0.2.0b1
+Summary: Launch Python APIs with APIZIT from your terminal or CI.
+Author: APIZIT
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Requires-Python: >=3.12
+Description-Content-Type: text/markdown
+Requires-Dist: requests<3,>=2.32.0
+Requires-Dist: pydantic<3,>=2.12.5
+Requires-Dist: pyyaml<7,>=6.0.3
+Requires-Dist: keyring<26,>=25.7
+Requires-Dist: pathspec<2,>=1
+
+# APIZIT CLI
+
+Launch Python code as a managed public API, inspect logs and manage releases from your terminal.
+
+APIZIT is an advanced development beta. This client targets its managed dev service.
+Check the official CLI documentation for package availability and current workspace capabilities.
+
+Install with `pipx install --pip-args=--pre apizit-cli`
+or `uv tool install --prerelease allow apizit-cli`. Python 3.12 or later is required.
+The client requires no AWS account, AWS credentials, Docker or APIZIT backend checkout.
+
+Run `apizit --help` and `apizit docs` for the command reference.
+The package contains the HTTP client and shared configuration contracts only.
+
+```sh
+apizit login
+apizit workspace list
+apizit workspace use ws_YOUR_WORKSPACE
+apizit scan . --wait
+apizit deploy . --wait
+```
+
+Git repositories and local folders use the same managed launch checks. The optional
+`apizit_config.yaml` uses the strict version 2 schema available through `apizit config schema`.
+Use `--json --non-interactive` and an expiring workspace token in `APIZIT_TOKEN` for CI or an AI
+agent. Secrets belong in the workspace vault, never in source files or command-line arguments.

apizit_cli-0.2.0b1.dist-info/RECORD

@@ -0,0 +1,16 @@
+apizit_cli/__init__.py,sha256=4oWfrWOg004-aoBe9Ph2KS2l-XzV4G6Vt75GJhw9vks,107
+apizit_cli/authentication.py,sha256=fBRKL-N9qsgGc3auIkcs_bVNZsqJKv-h9_91GLGjvQY,14941
+apizit_cli/commands.py,sha256=qoVReU5DXqwzrMCTFnVcZRQRQN1DLR6wVTw492ztwpk,13312
+apizit_cli/configuration.py,sha256=lFAw6kzJdhfZIGdb91bBtKR-uKdeEX_dQZ5c5C1S6oQ,9978
+apizit_cli/context.py,sha256=CsTRiNrWwIYdSmlgdm4W_MahtQjm7Az-J7k-Tg2TCng,5600
+apizit_cli/credential_store.py,sha256=NZM6cfmrqHt1CGAp7OJsumacSpC9rGycleRziODnV7Q,6772
+apizit_cli/errors.py,sha256=JvsX2ymALFpyJjXp7EEAdrWuRj9D_82VvrH7zRXcjy0,442
+apizit_cli/http.py,sha256=CPeQPF-MLg4LjoTEwOB4fqOESYkJEt5XNk6JDaXxeyg,6212
+apizit_cli/main.py,sha256=OmgNJ0jV1e2xs5W5NMql1tDrikTrFcOl4DhHLr9XTjQ,5966
+apizit_cli/operations.py,sha256=LyyBAEnSIJI5gY2X5-loOIo-g6la8Qwt5NKvt-tSKGM,32391
+apizit_cli/sources.py,sha256=Xs03bPpQVaZQrpXTn7q-e1XXU310ngc9yy7d3lU1Jpk,10182
+apizit_cli-0.2.0b1.dist-info/METADATA,sha256=4FQ87TUTfUyaV-95JwHDB7sqcC_ee8Jj7qAbUc7euew,1763
+apizit_cli-0.2.0b1.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+apizit_cli-0.2.0b1.dist-info/entry_points.txt,sha256=AhSrxJL-deUOAw4Oex2z3USK2QlZe8uzdN7N1HDfJHY,48
+apizit_cli-0.2.0b1.dist-info/top_level.txt,sha256=YqJYTfV8JJFrJmgNMQ5opKuqLRGsxModqxKJJxD3W-w,11
+apizit_cli-0.2.0b1.dist-info/RECORD,,

apizit_cli-0.2.0b1.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

apizit_cli-0.2.0b1.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+apizit = apizit_cli.main:main

apizit_cli-0.2.0b1.dist-info/top_level.txt

@@ -0,0 +1 @@
+apizit_cli