sanka-cli 0.1.5__py3-none-any.whl

sanka_cli/__init__.py

@@ -0,0 +1,3 @@
+__all__ = ["__version__"]
+
+__version__ = "0.1.5"

sanka_cli/__main__.py

@@ -0,0 +1,4 @@
+from sanka_cli.main import main
+
+if __name__ == "__main__":  # pragma: no cover
+    main()

sanka_cli/bundle.py

@@ -0,0 +1,244 @@
+"""Deterministic bundling for ``sanka code``.
+
+The server stores versions content-addressed: pushing identical bytes returns the
+existing version instead of minting a new one. That property is only worth anything if
+identical *source* reliably produces identical *bytes* -- otherwise CI mints a new
+version on every merge and the version list becomes noise.
+
+Ordinary ``tar`` does not give you that. It records mtimes, uid/gid, usernames, and
+directory order from whatever machine happened to run it, so the same tree tars to
+different bytes on a developer laptop and a CI runner. Everything here exists to strip
+that ambient state out:
+
+* entries sorted by path, so filesystem iteration order cannot leak in;
+* mtime, uid, gid, uname, gname all pinned to zero/empty;
+* mode normalized to 0644 (0755 for directories) -- we never honour the executable bit
+  anyway, and preserving it would make ``chmod`` look like a code change;
+* gzip's own mtime header zeroed.
+
+The result: same files in, same sha256 out, on any machine.
+"""
+
+from __future__ import annotations
+
+import fnmatch
+import gzip
+import hashlib
+import io
+import tarfile
+from dataclasses import dataclass
+from pathlib import Path
+
+MANIFEST_FILENAME = "sanka.json"
+IGNORE_FILENAME = ".sankaignore"
+
+# Mirrors the server's ingest ceilings (app/service/custom_code/bundle.py). Checking
+# locally turns a 422 round trip into an immediate, specific error.
+MAX_COMPRESSED_BYTES = 10 * 1024 * 1024
+MAX_UNCOMPRESSED_BYTES = 50 * 1024 * 1024
+MAX_FILE_COUNT = 2000
+
+DEFAULT_IGNORE_PATTERNS: tuple[str, ...] = (
+    ".git",
+    ".git/**",
+    ".gitignore",
+    ".sankaignore",
+    ".venv",
+    ".venv/**",
+    "venv",
+    "venv/**",
+    "node_modules",
+    "node_modules/**",
+    "__pycache__",
+    "__pycache__/**",
+    "**/__pycache__/**",
+    "*.pyc",
+    ".DS_Store",
+    "**/.DS_Store",
+    ".env",
+    ".env.*",
+    "*.log",
+    "dist",
+    "dist/**",
+    "build",
+    "build/**",
+    ".pytest_cache",
+    ".pytest_cache/**",
+    ".mypy_cache",
+    ".mypy_cache/**",
+    ".ruff_cache",
+    ".ruff_cache/**",
+)
+
+
+class BundleError(Exception):
+    """Raised for anything that would be rejected locally before upload."""
+
+
+@dataclass(frozen=True)
+class BuiltBundle:
+    raw: bytes
+    sha256: str
+    paths: tuple[str, ...]
+
+    @property
+    def size_bytes(self) -> int:
+        return len(self.raw)
+
+
+def read_ignore_patterns(root: Path) -> tuple[str, ...]:
+    patterns = list(DEFAULT_IGNORE_PATTERNS)
+    ignore_file = root / IGNORE_FILENAME
+    if ignore_file.is_file():
+        for line in ignore_file.read_text(encoding="utf-8").splitlines():
+            entry = line.strip()
+            if not entry or entry.startswith("#"):
+                continue
+            patterns.append(entry)
+            # A bare directory name should exclude its contents too, which is what users
+            # mean by "fixtures/" and never "just the directory entry".
+            if not entry.endswith("/**"):
+                patterns.append(f"{entry.rstrip('/')}/**")
+    return tuple(patterns)
+
+
+def is_ignored(relative_path: str, patterns: tuple[str, ...]) -> bool:
+    return any(fnmatch.fnmatch(relative_path, pattern) for pattern in patterns)
+
+
+def collect_files(root: Path) -> list[tuple[str, Path]]:
+    if not root.is_dir():
+        raise BundleError(f"{root} is not a directory.")
+    patterns = read_ignore_patterns(root)
+
+    collected: list[tuple[str, Path]] = []
+    for path in root.rglob("*"):
+        # Symlinks are dropped rather than followed: the server rejects non-regular
+        # members, and following one silently inlines a file from outside the bundle.
+        if path.is_symlink() or not path.is_file():
+            continue
+        relative = path.relative_to(root).as_posix()
+        if is_ignored(relative, patterns):
+            continue
+        collected.append((relative, path))
+
+    collected.sort(key=lambda item: item[0])
+    return collected
+
+
+def build_bundle(root: Path) -> BuiltBundle:
+    files = collect_files(root)
+    if not files:
+        raise BundleError(f"No files to bundle in {root} (everything was ignored).")
+    if not any(relative == MANIFEST_FILENAME for relative, _ in files):
+        raise BundleError(
+            f"{MANIFEST_FILENAME} not found in {root}. Run `sanka code init` first."
+        )
+    if len(files) > MAX_FILE_COUNT:
+        raise BundleError(
+            f"Bundle would contain {len(files)} files; the limit is {MAX_FILE_COUNT}."
+        )
+
+    total = sum(path.stat().st_size for _, path in files)
+    if total > MAX_UNCOMPRESSED_BYTES:
+        raise BundleError(
+            f"Bundle would be {total} bytes uncompressed; the limit is "
+            f"{MAX_UNCOMPRESSED_BYTES}."
+        )
+
+    tar_buffer = io.BytesIO()
+    with tarfile.open(fileobj=tar_buffer, mode="w", format=tarfile.PAX_FORMAT) as tar:
+        for relative, path in files:
+            payload = path.read_bytes()
+            info = tarfile.TarInfo(relative)
+            info.size = len(payload)
+            info.mtime = 0
+            info.mode = 0o644
+            info.uid = 0
+            info.gid = 0
+            info.uname = ""
+            info.gname = ""
+            info.type = tarfile.REGTYPE
+            tar.addfile(info, io.BytesIO(payload))
+
+    compressed = io.BytesIO()
+    # mtime=0 keeps gzip's own header out of the digest.
+    with gzip.GzipFile(fileobj=compressed, mode="wb", mtime=0) as gz:
+        gz.write(tar_buffer.getvalue())
+    raw = compressed.getvalue()
+
+    if len(raw) > MAX_COMPRESSED_BYTES:
+        raise BundleError(
+            f"Bundle is {len(raw)} bytes compressed; the limit is "
+            f"{MAX_COMPRESSED_BYTES}."
+        )
+
+    return BuiltBundle(
+        raw=raw,
+        sha256=hashlib.sha256(raw).hexdigest(),
+        paths=tuple(relative for relative, _ in files),
+    )
+
+
+def extract_bundle(
+    raw: bytes, destination: Path, *, overwrite: bool = False
+) -> list[str]:
+    """Write a downloaded bundle to disk.
+
+    Re-validates every member path even though the server validated on the way in. This
+    code runs on a developer's machine against bytes fetched over the network, and a
+    client that trusts the server to have been careful is a client that writes to
+    ``/etc`` the one time it wasn't.
+    """
+    written: list[str] = []
+    destination.mkdir(parents=True, exist_ok=True)
+    resolved_root = destination.resolve()
+
+    with tarfile.open(fileobj=io.BytesIO(raw), mode="r:gz") as tar:
+        for member in tar:
+            if member.isdir():
+                continue
+            if not member.isfile():
+                raise BundleError(
+                    f"Refusing to extract non-regular member {member.name!r}."
+                )
+            relative = member.name
+            if relative.startswith("/") or ".." in relative.split("/"):
+                raise BundleError(f"Refusing to extract unsafe path {relative!r}.")
+
+            target = (destination / relative).resolve()
+            # Belt and braces: even a path that looks clean must land inside the root.
+            if not target.is_relative_to(resolved_root):
+                raise BundleError(
+                    f"Refusing to extract outside {destination}: {relative!r}"
+                )
+
+            if target.exists() and not overwrite:
+                raise BundleError(
+                    f"{target} already exists. Re-run with --force to overwrite."
+                )
+
+            handle = tar.extractfile(member)
+            if handle is None:
+                raise BundleError(f"Could not read {relative!r} from the bundle.")
+            target.parent.mkdir(parents=True, exist_ok=True)
+            with handle:
+                target.write_bytes(handle.read())
+            written.append(relative)
+
+    return sorted(written)
+
+
+__all__ = [
+    "IGNORE_FILENAME",
+    "MANIFEST_FILENAME",
+    "MAX_COMPRESSED_BYTES",
+    "MAX_FILE_COUNT",
+    "MAX_UNCOMPRESSED_BYTES",
+    "BuiltBundle",
+    "BundleError",
+    "build_bundle",
+    "collect_files",
+    "extract_bundle",
+    "read_ignore_patterns",
+]

sanka_cli/client.py

@@ -0,0 +1,136 @@
+from __future__ import annotations
+
+import json
+from typing import Any
+
+import httpx
+
+from sanka_cli import __version__
+
+
+class APIError(Exception):
+    def __init__(
+        self,
+        *,
+        status_code: int,
+        message: str,
+        ctx_id: str | None = None,
+        payload: dict[str, Any] | None = None,
+    ) -> None:
+        super().__init__(message)
+        self.status_code = status_code
+        self.message = message
+        self.ctx_id = ctx_id
+        self.payload = payload or {}
+
+    def display_message(self) -> str:
+        if self.ctx_id:
+            return f"{self.message} (ctx_id={self.ctx_id})"
+        return self.message
+
+
+class SankaApiClient:
+    def __init__(
+        self,
+        *,
+        base_url: str,
+        access_token: str,
+        timeout: float = 30.0,
+    ) -> None:
+        self.base_url = base_url.rstrip("/")
+        self.access_token = access_token
+        self.client = httpx.Client(base_url=self.base_url, timeout=timeout)
+
+    def close(self) -> None:
+        self.client.close()
+
+    def _headers(self, *, include_auth: bool = True) -> dict[str, str]:
+        headers = {
+            "User-Agent": f"sanka-cli/{__version__}",
+            "X-Sanka-CLI-Version": __version__,
+        }
+        if include_auth and self.access_token:
+            headers["Authorization"] = f"Bearer {self.access_token}"
+        return headers
+
+    def _raise_for_response(self, response: httpx.Response) -> None:
+        try:
+            payload = response.json()
+        except Exception:
+            payload = {}
+
+        message = ""
+        ctx_id = None
+        if isinstance(payload, dict):
+            error = payload.get("error")
+            error = error if isinstance(error, dict) else {}
+            meta = payload.get("meta")
+            meta = meta if isinstance(meta, dict) else {}
+            message = str(
+                payload.get("message")
+                or payload.get("detail")
+                or error.get("message")
+                or ""
+            ).strip()
+            ctx_id = payload.get("ctx_id") or meta.get("ctx_id")
+        if not message:
+            message = response.text.strip() or f"HTTP {response.status_code}"
+
+        raise APIError(
+            status_code=response.status_code,
+            message=message,
+            ctx_id=ctx_id,
+            payload=payload if isinstance(payload, dict) else {},
+        )
+
+    def request_bytes(
+        self,
+        method: str,
+        path: str,
+        *,
+        params: dict[str, Any] | None = None,
+    ) -> tuple[bytes, dict[str, str]]:
+        """Fetch a non-JSON body (currently only the Custom Code bundle download).
+
+        Returns headers alongside the payload so the caller can verify the digest the
+        server reports without a second request.
+        """
+        response = self.client.request(
+            method.upper(),
+            path,
+            headers=self._headers(),
+            params=params,
+        )
+        if response.status_code >= 400:
+            self._raise_for_response(response)
+        return response.content, dict(response.headers)
+
+    def request_json(
+        self,
+        method: str,
+        path: str,
+        *,
+        params: dict[str, Any] | None = None,
+        json_body: dict[str, Any] | None = None,
+        allow_refresh: bool = True,
+    ) -> dict[str, Any]:
+        response = self.client.request(
+            method.upper(),
+            path,
+            headers=self._headers(),
+            params=params,
+            json=json_body,
+        )
+        _ = allow_refresh
+        if response.status_code >= 400:
+            self._raise_for_response(response)
+
+        if not response.content:
+            return {}
+        try:
+            return response.json()
+        except json.JSONDecodeError as exc:
+            raise APIError(
+                status_code=response.status_code,
+                message="API returned invalid JSON",
+            ) from exc

sanka_cli/commands/__init__.py

@@ -0,0 +1 @@
+__all__ = []

sanka_cli/commands/ai.py

@@ -0,0 +1,106 @@
+from __future__ import annotations
+
+from typing import Any
+
+import click
+
+import sanka_cli.runtime as runtime
+from sanka_cli.state import CLIState
+
+
+@click.group()
+def ai() -> None:
+    """AI commands."""
+
+
+@ai.group("score")
+def ai_score() -> None:
+    """Score records."""
+
+
+def _score_command(object_type: str):
+    @click.command(name=object_type)
+    @click.argument("record_id")
+    @click.option("--score-model-id", default=None)
+    @click.pass_obj
+    def command(
+        state: CLIState,
+        record_id: str,
+        score_model_id: str | None,
+    ) -> None:
+        body: dict[str, Any] = {
+            "object_type": object_type,
+            "record_id": record_id,
+        }
+        if score_model_id:
+            body["score_model_id"] = score_model_id
+        payload = runtime.request_json(state, "POST", "/v2/score", json_body=body)
+        runtime.emit_payload(payload, state)
+
+    return command
+
+
+ai_score.add_command(_score_command("company"))
+ai_score.add_command(_score_command("deal"))
+
+
+@ai.group("enrich")
+def ai_enrich() -> None:
+    """Enrich records."""
+
+
+@ai_enrich.command("company")
+@click.argument("record_id", required=False)
+@click.option("--force-refresh", is_flag=True, default=False)
+@click.option("--dry-run", is_flag=True, default=False)
+@click.option("--custom-field-map", default=None, help="JSON string or @file.json")
+@click.option("--seed-name", default=None)
+@click.option("--seed-url", default=None)
+@click.option("--seed-external-id", default=None)
+@click.pass_obj
+def ai_enrich_company(
+    state: CLIState,
+    record_id: str | None,
+    force_refresh: bool,
+    dry_run: bool,
+    custom_field_map: str | None,
+    seed_name: str | None,
+    seed_url: str | None,
+    seed_external_id: str | None,
+) -> None:
+    has_seed = bool(seed_name or seed_url or seed_external_id)
+    if record_id and has_seed:
+        raise click.ClickException("Use either record_id or seed fields, not both")
+    if not record_id and not has_seed:
+        raise click.ClickException("record_id or a seed field is required")
+    if has_seed and not dry_run:
+        raise click.ClickException(
+            "--dry-run is required when seed fields are provided"
+        )
+    if has_seed and custom_field_map:
+        raise click.ClickException(
+            "--custom-field-map is only supported with record_id"
+        )
+
+    body: dict[str, Any] = {
+        "object_type": "company",
+        "dry_run": dry_run,
+        "force_refresh": force_refresh,
+    }
+    if record_id:
+        body["record_id"] = record_id
+        if custom_field_map:
+            body["custom_field_map"] = runtime.parse_json_input(custom_field_map)
+    else:
+        body["seed"] = {
+            key: value
+            for key, value in {
+                "name": seed_name,
+                "url": seed_url,
+                "external_id": seed_external_id,
+            }.items()
+            if value
+        }
+
+    payload = runtime.request_json(state, "POST", "/v2/enrich", json_body=body)
+    runtime.emit_payload(payload, state)

sanka_cli/commands/auth.py

@@ -0,0 +1,111 @@
+from __future__ import annotations
+
+import click
+
+import sanka_cli.runtime as runtime
+from sanka_cli.config import DEFAULT_BASE_URL
+from sanka_cli.state import CLIState
+
+
+@click.group()
+def auth() -> None:
+    """Authentication commands."""
+
+
+@auth.command("login")
+@click.option("--access-token", required=True, help="Developer API access token.")
+@click.option(
+    "--refresh-token",
+    default=None,
+    help="Deprecated legacy refresh token. V2 public API uses bearer tokens.",
+)
+@click.option("--profile", "profile_name", default=None, help="Profile name to save.")
+@click.option("--base-url", default=None, help="API base URL to store for the profile.")
+@click.pass_obj
+def auth_login(
+    state: CLIState,
+    access_token: str,
+    refresh_token: str | None,
+    profile_name: str | None,
+    base_url: str | None,
+) -> None:
+    """Verify an access token against the API and store it for the profile."""
+    resolved_profile_name = profile_name or state.profile or "default"
+    resolved_base_url = (base_url or state.base_url or DEFAULT_BASE_URL).rstrip("/")
+    try:
+        identity, verify_warning = runtime.verify_access_token(
+            base_url=resolved_base_url,
+            access_token=access_token,
+        )
+    except runtime.TokenVerificationError as exc:
+        raise click.ClickException(
+            f"{exc} Nothing was saved. Create a token under "
+            "Developers → API in Sanka and retry."
+        ) from exc
+    runtime.upsert_profile(resolved_profile_name, base_url=resolved_base_url)
+    try:
+        runtime.store_tokens(
+            resolved_profile_name,
+            access_token=access_token,
+            refresh_token=refresh_token,
+        )
+    except runtime.CredentialStoreError as exc:
+        raise click.ClickException(str(exc)) from exc
+    payload: dict[str, object] = {
+        "message": "logged_in" if identity is not None else "saved",
+    }
+    if identity:
+        payload.update(_identity_fields(identity))
+    payload["profile"] = resolved_profile_name
+    payload["base_url"] = resolved_base_url
+    if verify_warning:
+        payload["warning"] = verify_warning
+    runtime.emit_payload(payload, state)
+
+
+def _identity_fields(identity: dict) -> dict[str, str]:
+    workspace_name = str(identity.get("workspace_name") or "").strip()
+    workspace_code = str(identity.get("workspace_code") or "").strip()
+    if workspace_name and workspace_code:
+        workspace = f"{workspace_name} ({workspace_code})"
+    else:
+        workspace = workspace_name or workspace_code
+    fields = {
+        "workspace": workspace,
+        "user": str(identity.get("email") or identity.get("username") or "").strip(),
+        "token": str(identity.get("token_name") or "").strip(),
+        "permission_level": str(identity.get("permission_level") or "").strip(),
+    }
+    return {key: value for key, value in fields.items() if value}
+
+
+@auth.command("status")
+@click.pass_obj
+def auth_status(state: CLIState) -> None:
+    try:
+        resolved = runtime.resolve_runtime(
+            profile_name=state.profile,
+            base_url_override=state.base_url,
+        )
+    except runtime.CredentialStoreError as exc:
+        raise click.ClickException(str(exc)) from exc
+    payload = runtime.request_json(state, "GET", "/v2/public/auth/whoami")
+    data = payload.get("data", payload)
+    data["profile"] = resolved["profile_name"]
+    data["base_url"] = resolved["base_url"]
+    runtime.emit_payload(data, state)
+
+
+@auth.command("logout")
+@click.option("--profile", "profile_name", default=None, help="Profile name to clear.")
+@click.pass_obj
+def auth_logout(state: CLIState, profile_name: str | None) -> None:
+    resolved_profile_name = profile_name or state.profile or "default"
+    runtime.clear_tokens(resolved_profile_name)
+    runtime.emit_payload(
+        {
+            "message": "logged_out",
+            "profile": resolved_profile_name,
+        },
+        state,
+    )