lovarch-cli 0.2.1__py3-none-any.whl

lovarch_cli/__init__.py

@@ -0,0 +1,16 @@
+"""lovarch-cli — AI-powered architectural project execution CLI.
+
+Squad di 17 agenti specializzati (mind clones di Schumacher, Baldwin, Mazria,
+Deming, Juran, English, Dodds) che esegue audit, briefing, normativa IT, CAD,
+BIM/IFC, computo metrico, capitolato, pratiche edilizie, contratto CNAPPC, energy/LCA
+preliminare, dossier consolidato.
+
+Two modes:
+- Free: standalone (your own API keys, SQLite local, filesystem storage)
+- Premium: Lovarch-integrated (Supabase + S3 + Edge Functions + credits)
+
+Powered by Lovarch — https://lovarch.com
+"""
+from lovarch_cli.version import __version__
+
+__all__ = ["__version__"]

lovarch_cli/__main__.py

@@ -0,0 +1,10 @@
+"""Entry point for `python -m lovarch_cli`.
+
+This allows users to invoke the CLI both as:
+- `arch <command>` (via [project.scripts] entry point)
+- `python -m lovarch_cli <command>` (via this module)
+"""
+from lovarch_cli.cli import app
+
+if __name__ == "__main__":
+    app()

lovarch_cli/ai/__init__.py

@@ -0,0 +1,21 @@
+"""Lovarch AI gateway — routes CLI AI generation through the platform.
+
+Every paid AI call the CLI makes in premium mode goes through the
+``cli-ai-generate`` Edge Function so the user's Lovarch credits are debited by
+the canonical rule (1000 credits = $1 of API cost). See ``gateway.py``.
+"""
+from lovarch_cli.ai.gateway import (
+    AiGatewayError,
+    AiImageResult,
+    AiTextResult,
+    InsufficientCreditsError,
+    LovarchAiGateway,
+)
+
+__all__ = [
+    "AiGatewayError",
+    "AiImageResult",
+    "AiTextResult",
+    "InsufficientCreditsError",
+    "LovarchAiGateway",
+]

lovarch_cli/ai/gateway.py

@@ -0,0 +1,240 @@
+"""Client for the ``cli-ai-generate`` Edge Function.
+
+This is the ONLY path the premium CLI (and the future MCP server) should use to
+run paid image generation. It forces the call through the Lovarch platform,
+which debits the authenticated user's credits by the 1000cr=$1 rule and refunds
+on failure. The CLI must never call OpenAI/Mapbox/etc. directly in premium mode
+— doing so bypasses the credit system.
+
+Returns the generated image as raw bytes for the caller to persist (Fase 2 adds
+server-side Storage persistence tied to the user's Lovarch account).
+"""
+from __future__ import annotations
+
+import base64
+from dataclasses import dataclass
+from typing import Literal
+
+from lovarch_cli.auth.session import LovarchSession
+
+CLI_AI_GENERATE_PATH = "/functions/v1/cli-ai-generate"
+CLI_AI_TEXT_PATH = "/functions/v1/cli-ai-text"
+# Image generation with gpt-image-2 can take 10-60s; give it generous headroom.
+_IMAGE_TIMEOUT = 200.0
+_TEXT_TIMEOUT = 300.0
+
+Quality = Literal["low", "medium", "high"]
+Mode = Literal["generate", "edit"]
+Role = Literal["executor", "verifier", "chief"]
+
+
+class AiGatewayError(Exception):
+    """Generic failure calling cli-ai-generate."""
+
+
+class InsufficientCreditsError(AiGatewayError):
+    """The user does not have enough credits for the requested operation."""
+
+    def __init__(self, available: int, needed: int) -> None:
+        self.available = available
+        self.needed = needed
+        super().__init__(
+            f"Crediti insufficienti: disponibili {available}, richiesti {needed}."
+        )
+
+
+@dataclass
+class AiImageResult:
+    """Result of a successful image generation via the platform gateway.
+
+    Cost is expressed ONLY in the user's credits — provider amounts never
+    reach the client.
+    """
+
+    image_bytes: bytes
+    content_type: str
+    revised_prompt: str | None
+    credits_charged: int
+    balance: int | None
+    is_admin: bool
+
+
+@dataclass
+class AiTextResult:
+    """Result of a successful text generation via cli-ai-text."""
+
+    text: str
+    model: str
+    input_tokens: int
+    output_tokens: int
+    credits_charged: int
+    balance: int | None
+    is_admin: bool
+
+
+def _decode_data_url(data_url: str) -> tuple[bytes, str]:
+    """Split a ``data:<mime>;base64,<payload>`` URL into (bytes, content_type)."""
+    if not data_url.startswith("data:"):
+        raise AiGatewayError("Risposta immagine non è un data URL.")
+    header, _, payload = data_url.partition(",")
+    if not payload:
+        raise AiGatewayError("Risposta immagine senza payload base64.")
+    content_type = header[len("data:") :].split(";")[0] or "image/png"
+    try:
+        return base64.b64decode(payload), content_type
+    except (ValueError, TypeError) as exc:  # pragma: no cover - defensive
+        raise AiGatewayError(f"Base64 immagine non valido: {exc}") from exc
+
+
+class LovarchAiGateway:
+    """Thin client over ``cli-ai-generate`` bound to a premium session."""
+
+    def __init__(self, session: LovarchSession) -> None:
+        self._session = session
+
+    async def generate_image(
+        self,
+        prompt: str,
+        *,
+        quality: Quality = "medium",
+        aspect: str = "1:1",
+        mode: Mode = "generate",
+        image_urls: list[str] | None = None,
+        operation_type: str | None = None,
+    ) -> AiImageResult:
+        """Generate (or edit) an image via the platform, debiting credits.
+
+        Raises ``InsufficientCreditsError`` on HTTP 402 and ``AiGatewayError``
+        on any other non-success response.
+        """
+        body: dict[str, object] = {
+            "mode": mode,
+            "prompt": prompt,
+            "quality": quality,
+            "aspect": aspect,
+        }
+        if image_urls:
+            body["image_urls"] = image_urls
+        if operation_type:
+            body["operation_type"] = operation_type
+
+        response = await self._session.request(
+            "POST", CLI_AI_GENERATE_PATH, json=body, timeout=_IMAGE_TIMEOUT
+        )
+
+        try:
+            data = response.json()
+        except ValueError:
+            data = {}
+
+        if response.status_code == 402:
+            raise InsufficientCreditsError(
+                available=int(data.get("credits_available", 0) or 0),
+                needed=int(data.get("credits_needed", 0) or 0),
+            )
+
+        if response.status_code != 200 or not data.get("ok"):
+            detail = data.get("error") if isinstance(data, dict) else None
+            raise AiGatewayError(
+                f"cli-ai-generate ha risposto {response.status_code}: {detail or 'errore sconosciuto'}"
+            )
+
+        image_bytes, content_type = _decode_data_url(str(data.get("image_base64", "")))
+        return AiImageResult(
+            image_bytes=image_bytes,
+            content_type=content_type,
+            revised_prompt=data.get("revised_prompt"),
+            credits_charged=int(data.get("credits_charged", 0) or 0),
+            balance=data.get("balance"),
+            is_admin=bool(data.get("is_admin", False)),
+        )
+
+    async def generate_text(
+        self,
+        prompt: str | None = None,
+        *,
+        messages: list[dict] | None = None,
+        role: Role = "executor",
+        model: str | None = None,
+        system: str | None = None,
+        max_tokens: int | None = None,
+        language: str | None = None,
+        operation_type: str | None = None,
+    ) -> AiTextResult:
+        """Generate text via cli-ai-text, debiting the user's credits.
+
+        Model selection is server-side: pass a ``role`` (executor|verifier|
+        chief) for the platform default, or an explicit ``model`` from the
+        platform catalog. ``language`` enforces strict output language.
+        """
+        body: dict[str, object] = {}
+        if model:
+            body["model"] = model
+        else:
+            body["role"] = role
+        if prompt:
+            body["prompt"] = prompt
+        if messages:
+            body["messages"] = messages
+        if system:
+            body["system"] = system
+        if max_tokens:
+            body["max_tokens"] = max_tokens
+        if language:
+            body["language"] = language
+        if operation_type:
+            body["operation_type"] = operation_type
+
+        response = await self._session.request(
+            "POST", CLI_AI_TEXT_PATH, json=body, timeout=_TEXT_TIMEOUT
+        )
+        try:
+            data = response.json()
+        except ValueError:
+            data = {}
+
+        if response.status_code == 402:
+            raise InsufficientCreditsError(
+                available=int(data.get("credits_available", 0) or 0),
+                needed=int(data.get("credits_needed", 0) or 0),
+            )
+        if response.status_code != 200 or not data.get("ok"):
+            detail = data.get("error") if isinstance(data, dict) else None
+            raise AiGatewayError(
+                f"cli-ai-text ha risposto {response.status_code}: {detail or 'errore sconosciuto'}"
+            )
+
+        usage = data.get("usage") or {}
+        return AiTextResult(
+            text=str(data.get("text", "")),
+            model=str(data.get("model", "")),
+            input_tokens=int(usage.get("input_tokens", 0) or 0),
+            output_tokens=int(usage.get("output_tokens", 0) or 0),
+            credits_charged=int(data.get("credits_charged", 0) or 0),
+            balance=data.get("balance"),
+            is_admin=bool(data.get("is_admin", False)),
+        )
+
+    async def get_user_context(self, lead_id: str | None = None) -> dict:
+        """Fetch the personalization bundle (cli-user-context).
+
+        Returns the raw bundle dict — brand, style, fiscal, signature_line,
+        preferences (incl. mandatory output language) and ``prompt_block``
+        ready to prepend to any agent prompt.
+        """
+        body: dict[str, object] = {}
+        if lead_id:
+            body["lead_id"] = lead_id
+        response = await self._session.request(
+            "POST", "/functions/v1/cli-user-context", json=body, timeout=60.0
+        )
+        try:
+            data = response.json()
+        except ValueError:
+            data = {}
+        if response.status_code != 200 or not data.get("ok"):
+            detail = data.get("error") if isinstance(data, dict) else None
+            raise AiGatewayError(
+                f"cli-user-context ha risposto {response.status_code}: {detail or 'errore sconosciuto'}"
+            )
+        return data

lovarch_cli/api.py

@@ -0,0 +1,111 @@
+"""lovarch-cli — HTTP client wrapper for Lovarch API.
+
+Thin httpx wrapper that adds:
+- Default API URL (overridable via LOVARCH_API_URL env)
+- Anon key as default header (for public EFs like cli-signup)
+- Bearer token injection for authenticated calls (premium)
+- Error normalization to LovarchApiError
+- Timeout defaults (30s connect, 120s read for long EFs)
+
+For EF endpoints, the URL pattern is:
+    {API_URL}/functions/v1/{ef_name}
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Any
+
+import httpx
+
+from lovarch_cli.config import DEFAULT_API_ANON_KEY, DEFAULT_API_URL
+from lovarch_cli.i18n import t
+
+
+class LovarchApiError(Exception):
+    """Normalized error from Lovarch API calls."""
+
+    def __init__(
+        self,
+        message: str,
+        status_code: int | None = None,
+        error_code: str | None = None,
+        payload: dict[str, Any] | None = None,
+    ) -> None:
+        super().__init__(message)
+        self.status_code = status_code
+        self.error_code = error_code
+        self.payload = payload or {}
+
+
+@dataclass
+class ApiClient:
+    """HTTP client for Lovarch Supabase APIs (REST + Edge Functions)."""
+
+    base_url: str = DEFAULT_API_URL
+    anon_key: str = DEFAULT_API_ANON_KEY
+    bearer_token: str | None = None
+    timeout_connect: float = 30.0
+    timeout_read: float = 120.0
+
+    def _headers(self) -> dict[str, str]:
+        headers = {
+            "Content-Type": "application/json",
+            "User-Agent": "lovarch-cli/0.1.0",
+        }
+        if self.anon_key:
+            headers["apikey"] = self.anon_key
+        if self.bearer_token:
+            headers["Authorization"] = f"Bearer {self.bearer_token}"
+        elif self.anon_key:
+            headers["Authorization"] = f"Bearer {self.anon_key}"
+        return headers
+
+    async def invoke_ef(
+        self,
+        function_name: str,
+        body: dict[str, Any],
+        bearer_token: str | None = None,
+    ) -> dict[str, Any]:
+        """Call a Supabase Edge Function and return its parsed JSON response.
+
+        Raises LovarchApiError on HTTP errors or `{ok: false}` body.
+        """
+        url = f"{self.base_url}/functions/v1/{function_name}"
+        headers = self._headers()
+        if bearer_token:
+            headers["Authorization"] = f"Bearer {bearer_token}"
+
+        timeout = httpx.Timeout(self.timeout_read, connect=self.timeout_connect)
+
+        try:
+            async with httpx.AsyncClient(timeout=timeout) as client:
+                response = await client.post(url, json=body, headers=headers)
+        except httpx.RequestError as exc:
+            msg = t("errors.network", function_name=function_name, exc=str(exc))
+            raise LovarchApiError(msg) from exc
+
+        try:
+            payload = response.json()
+        except ValueError as exc:
+            msg = t(
+                "errors.invalid_json",
+                function_name=function_name,
+                status_code=response.status_code,
+                snippet=response.text[:200],
+            )
+            raise LovarchApiError(msg, status_code=response.status_code) from exc
+
+        if response.status_code >= 400 or payload.get("ok") is False:
+            error_code = payload.get("error", "unknown_error")
+            # Server-localized message wins; otherwise build a localized fallback.
+            message = payload.get("message") or t(
+                "errors.unknown_api_error", error_code=error_code
+            )
+            raise LovarchApiError(
+                message=message,
+                status_code=response.status_code,
+                error_code=error_code,
+                payload=payload,
+            )
+
+        return payload

lovarch_cli/auth/__init__.py

@@ -0,0 +1,32 @@
+"""lovarch-cli auth — premium PKCE flow + token storage.
+
+Three modules:
+- pkce.py            → verifier/challenge generation (RFC 7636)
+- local_server.py    → ephemeral HTTP listener on 127.0.0.1:RANDOM/callback
+- keyring_store.py   → OS-native secure storage (macOS Keychain, Windows
+                       Credential Manager, Linux Secret Service)
+
+The flow (orchestrated in commands/login.py):
+1. Generate verifier + challenge via pkce.PkceParams.generate()
+2. Spin up local_server.AuthServer on 127.0.0.1:RANDOM_PORT
+3. Open browser to https://lovarch.com/cli-auth?...&redirect_uri=http://127.0.0.1:PORT/callback
+4. User authorizes on lovarch.com → web POSTs to cli-auth-store EF →
+   web redirects browser back to local server with ?code=X&state=Y
+5. Local server captures code+state, validates state, calls cli-auth-exchange
+6. Tokens returned → stored via keyring_store.save_premium_session()
+"""
+from lovarch_cli.auth.keyring_store import (
+    PremiumSession,
+    clear_premium_session,
+    load_premium_session,
+    save_premium_session,
+)
+from lovarch_cli.auth.pkce import PkceParams
+
+__all__ = [
+    "PkceParams",
+    "PremiumSession",
+    "clear_premium_session",
+    "load_premium_session",
+    "save_premium_session",
+]

lovarch_cli/auth/keyring_store.py

@@ -0,0 +1,214 @@
+"""OS-native secure storage for premium Lovarch session tokens.
+
+Uses the `keyring` lib (already in pyproject deps) which routes to:
+- macOS  → Keychain
+- Windows → Windows Credential Manager
+- Linux  → Secret Service (gnome-keyring, KWallet, or fallback)
+
+Service identifier: 'lovarch-cli'
+Account identifiers (one per stored item):
+- 'premium-access-token'
+- 'premium-refresh-token'
+
+The non-sensitive bits (user_id, email, full_name, expires_at) live in
+~/.lovarch/credentials.json alongside the free-mode payload, with
+mode='premium'. Tokens never appear in plain JSON.
+
+Fallback if keyring lib not available or backend fails: store tokens in
+~/.lovarch/credentials.json with chmod 0600 + a warning logged. This is
+a soft fallback for headless/CI environments.
+"""
+from __future__ import annotations
+
+import json
+import logging
+from dataclasses import dataclass, field
+from datetime import datetime
+from pathlib import Path
+from typing import Any
+
+try:
+    import keyring as _keyring
+    import keyring.errors as _keyring_errors
+
+    KEYRING_AVAILABLE = True
+except ImportError:
+    KEYRING_AVAILABLE = False
+
+from lovarch_cli.config import DEFAULT_HOME, Credentials, save_credentials
+
+log = logging.getLogger("lovarch_cli.auth.keyring")
+
+KEYRING_SERVICE = "lovarch-cli"
+KEY_ACCESS = "premium-access-token"
+KEY_REFRESH = "premium-refresh-token"
+
+
+@dataclass
+class PremiumSession:
+    """Loaded premium session — non-sensitive metadata + tokens."""
+
+    user_id: str
+    email: str
+    full_name: str | None
+    access_token: str
+    refresh_token: str
+    expires_at: str  # ISO 8601
+    metadata: dict[str, Any] = field(default_factory=dict)
+
+
+def _backend_available() -> bool:
+    if not KEYRING_AVAILABLE:
+        return False
+    try:
+        _keyring.get_password(KEYRING_SERVICE, KEY_ACCESS)
+        return True
+    except _keyring_errors.NoKeyringError:
+        return False
+    except Exception:  # noqa: BLE001
+        return False
+
+
+def save_premium_session(
+    *,
+    user_id: str,
+    email: str,
+    full_name: str | None,
+    access_token: str,
+    refresh_token: str,
+    expires_at: str,
+    language: str = "it",
+    home: Path | None = None,
+) -> tuple[bool, str]:
+    """Save tokens to OS keyring + non-sensitive credentials to JSON.
+
+    Returns (used_keyring, location_description) for UX messaging.
+    """
+    used_keyring = _backend_available()
+
+    if used_keyring:
+        try:
+            _keyring.set_password(
+                KEYRING_SERVICE, f"{KEY_ACCESS}:{user_id}", access_token
+            )
+            _keyring.set_password(
+                KEYRING_SERVICE, f"{KEY_REFRESH}:{user_id}", refresh_token
+            )
+        except Exception as exc:  # noqa: BLE001
+            log.warning("keyring save failed (%s) — falling back to file", exc)
+            used_keyring = False
+
+    creds = Credentials(
+        mode="premium",
+        user_id=user_id,
+        email=email,
+        full_name=full_name,
+        language=language,
+        signed_up_at=datetime.utcnow().isoformat(timespec="seconds"),
+        metadata={
+            "premium_expires_at": expires_at,
+            "tokens_in_keyring": used_keyring,
+            # If keyring unavailable, store tokens in JSON as fallback (chmod 0600)
+            **(
+                {}
+                if used_keyring
+                else {
+                    "fallback_access_token": access_token,
+                    "fallback_refresh_token": refresh_token,
+                }
+            ),
+        },
+    )
+    creds_path = save_credentials(creds, home)
+
+    location = "OS keyring + " if used_keyring else "JSON fallback (chmod 0600): "
+    return used_keyring, f"{location}{creds_path}"
+
+
+def load_premium_session(
+    home: Path | None = None,
+) -> PremiumSession | None:
+    """Load premium session from credentials.json + keyring.
+
+    Returns None if credentials.json is missing, mode != 'premium', or
+    keyring lookup fails AND no fallback is present.
+    """
+    creds_path = (home or DEFAULT_HOME) / "credentials.json"
+    if not creds_path.exists():
+        return None
+    try:
+        data: dict[str, Any] = json.loads(creds_path.read_text())
+    except (json.JSONDecodeError, ValueError):
+        return None
+    if data.get("mode") != "premium":
+        return None
+
+    user_id = data.get("user_id")
+    if not user_id:
+        return None
+
+    md = data.get("metadata") or {}
+    expires_at = md.get("premium_expires_at", "")
+
+    access_token: str | None = None
+    refresh_token: str | None = None
+
+    if md.get("tokens_in_keyring") and KEYRING_AVAILABLE:
+        try:
+            access_token = _keyring.get_password(
+                KEYRING_SERVICE, f"{KEY_ACCESS}:{user_id}"
+            )
+            refresh_token = _keyring.get_password(
+                KEYRING_SERVICE, f"{KEY_REFRESH}:{user_id}"
+            )
+        except Exception as exc:  # noqa: BLE001
+            log.warning("keyring load failed (%s)", exc)
+
+    if not access_token or not refresh_token:
+        # Try fallback fields
+        access_token = md.get("fallback_access_token")
+        refresh_token = md.get("fallback_refresh_token")
+
+    if not access_token or not refresh_token:
+        return None
+
+    return PremiumSession(
+        user_id=user_id,
+        email=data.get("email", ""),
+        full_name=data.get("full_name"),
+        access_token=access_token,
+        refresh_token=refresh_token,
+        expires_at=expires_at,
+        metadata=md,
+    )
+
+
+def clear_premium_session(home: Path | None = None) -> bool:
+    """Wipe premium tokens from keyring + delete credentials.json.
+
+    Returns True if anything was deleted.
+    """
+    creds_path = (home or DEFAULT_HOME) / "credentials.json"
+    user_id: str | None = None
+    if creds_path.exists():
+        try:
+            user_id = json.loads(creds_path.read_text()).get("user_id")
+        except (json.JSONDecodeError, ValueError):
+            pass
+
+    keyring_cleared = False
+    if user_id and KEYRING_AVAILABLE:
+        try:
+            _keyring.delete_password(KEYRING_SERVICE, f"{KEY_ACCESS}:{user_id}")
+            _keyring.delete_password(KEYRING_SERVICE, f"{KEY_REFRESH}:{user_id}")
+            keyring_cleared = True
+        except Exception:  # noqa: BLE001
+            # Item may not exist — ignore
+            pass
+
+    file_cleared = False
+    if creds_path.exists():
+        creds_path.unlink()
+        file_cleared = True
+
+    return keyring_cleared or file_cleared