feat/native seal wrappers

.github/workflows/guard.yml

@@ -56,4 +56,4 @@ jobs:
           $binDir | Out-File -Append -Encoding utf8 $env:GITHUB_PATH
 
       - name: Flavor self-check
-        run: flavor check --root . --config flavor.json
+        run: flavor check --root . --config flavor.toml

.github/workflows/release-beta.yml

@@ -80,7 +80,7 @@ jobs:
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
 
       - name: Flavor self-check
-        run: flavor check --root . --config flavor.json
+        run: flavor check --root . --config flavor.toml
 
   build:
     needs: [metadata, verify]

.github/workflows/release-stable.yml

@@ -79,7 +79,7 @@ jobs:
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
 
       - name: Flavor self-check
-        run: flavor check --root . --config flavor.json
+        run: flavor check --root . --config flavor.toml
 
   build:
     needs: [metadata, verify]

.runseal/wrappers/cloudflare.seal

@@ -0,0 +1,221 @@
+usage() {
+  print "Usage: runseal :cloudflare <command> [args]"
+  print ""
+  print "Commands:"
+  print "  init                      create repo-local .local/secrets/cloudflare.env template"
+  print "  check                     validate repo-local credentials and probe core account APIs"
+  print "  manage-plan               print the desired manage redirect rule shape"
+  print "  manage-inspect            inspect current dynamic redirect ruleset for manage rules"
+  print "  manage-ensure-redirect    create/update exact-path manage redirects (use --dry-run first)"
+  print "  api                       use: runseal @tool cloudflare api request <method> <path> ..."
+  print ""
+  print "Credentials:"
+  print "  .local/secrets/cloudflare.env"
+}
+
+if empty "$1"; then
+  usage
+  exit 0
+fi
+
+if eq "$1" help; then
+  usage
+  exit 0
+fi
+
+if eq "$1" --help; then
+  usage
+  exit 0
+fi
+
+case "$1" in
+  init)
+    if not_empty "$2"; then
+      fail "cloudflare: init does not accept arguments"
+    fi
+    local_dir="${RUNSEAL_REPO_LOCAL_DIR:-.local}"
+    secrets_dir="${RUNSEAL_REPO_SECRETS_DIR:-.local/secrets}"
+    tmp_dir="${RUNSEAL_REPO_TMP_DIR:-.local/tmp}"
+    token_file="$secrets_dir/cloudflare.env"
+    seal fs mkdir "$local_dir" 700
+    seal fs mkdir "$secrets_dir" 700
+    seal fs mkdir "$tmp_dir" 700
+    if file_exists "$token_file"; then
+      print "exists $token_file"
+    else
+      seal fs write-base64 "$token_file" IyBSZXBvLWxvY2FsIENsb3VkZmxhcmUgY3JlZGVudGlhbHMgZm9yIHJ1bnNlYWwgc3VwcG9ydCBjb21tYW5kcy4KIyBGaWxsIHRoZXNlIHZhbHVlcyBtYW51YWxseS4gVGhpcyBmaWxlIHN0YXlzIGxvY2FsIGFuZCBnaXRpZ25vcmVkLgpDTE9VREZMQVJFX0FDQ09VTlRfSUQ9CkNMT1VERkxBUkVfQVBJX1RPS0VOPQpDTE9VREZMQVJFX1pPTkVfTkFNRT1wZXJpc2gudWsKQ0xPVURGTEFSRV9NQU5BR0VfSE9TVD1ydW5zZWFsLnBlcmlzaC51awpDTE9VREZMQVJFX01BTkFHRV9PUklHSU5fSE9TVD1yZWxlYXNlcy5ydW5zZWFsLnBlcmlzaC51awpDTE9VREZMQVJFX01BTkFHRV9SRURJUkVDVF9QUkVGSVg9Cg==
+      seal fs chmod "$token_file" 600
+      print "created $token_file"
+    fi
+    ;;
+  check)
+    if not_empty "$2"; then
+      fail "cloudflare: check does not accept arguments"
+    fi
+    account_id=$(seal cloudflare config get account_id)
+    zone_name=$(seal cloudflare config get zone_name)
+    zone=$(seal cloudflare zone get --name "$zone_name")
+    zone_id=$(seal json get "$zone" .id)
+    rulesets=$(seal cloudflare zone ruleset list --zone-id "$zone_id")
+    ruleset_count=$(seal json len "$rulesets")
+    zones_payload=$(seal cloudflare api request GET /zones --query "account.id=$account_id" --query per_page=50)
+    zones=$(seal json get "$zones_payload" .result)
+    zones_pretty=$(seal json pretty "$zones")
+    account=$(seal cloudflare account get --account-id "$account_id")
+    account_name=$(seal json get "$account" .name)
+    buckets=$(seal cloudflare account r2 bucket list --account-id "$account_id")
+    buckets_pretty=$(seal json pretty "$buckets")
+    print "cloudflare check: ok"
+    print "account id: $account_id"
+    print "account name: $account_name"
+    print "manage zone: $zone_name ($zone_id)"
+    print "zone rulesets: $ruleset_count"
+    print "zones:"
+    print "$zones_pretty"
+    print "r2 buckets:"
+    print "$buckets_pretty"
+    ;;
+  manage-plan)
+    if not_empty "$2"; then
+      fail "cloudflare: manage-plan does not accept arguments"
+    fi
+    zone_name=$(seal cloudflare config get zone_name)
+    request_host=$(seal cloudflare config get manage_host)
+    redirect_host=$(seal cloudflare config get manage_origin_host)
+    prefix=$(seal cloudflare config get manage_redirect_prefix)
+    if empty "$prefix"; then
+      target_sh="https://$redirect_host/manage.sh"
+      target_ps1="https://$redirect_host/manage.ps1"
+    else
+      target_sh="https://$redirect_host/$prefix/manage.sh"
+      target_ps1="https://$redirect_host/$prefix/manage.ps1"
+    fi
+    rule_sh=$(seal cloudflare redirect-rule exact --ref runseal_manage_sh_redirect --description "Redirect runseal manage.sh to releases bucket asset" --host "$request_host" --path /manage.sh --target-url "$target_sh")
+    rule_ps1=$(seal cloudflare redirect-rule exact --ref runseal_manage_ps1_redirect --description "Redirect runseal manage.ps1 to releases bucket asset" --host "$request_host" --path /manage.ps1 --target-url "$target_ps1")
+    pretty_sh=$(seal json pretty "$rule_sh")
+    pretty_ps1=$(seal json pretty "$rule_ps1")
+    print "manage redirect plan"
+    print "zone: $zone_name"
+    print "request host: $request_host"
+    print "redirect host: $redirect_host"
+    print "phase: http_request_dynamic_redirect"
+    print "rules:"
+    print "$pretty_sh"
+    print "$pretty_ps1"
+    ;;
+  manage-inspect)
+    if not_empty "$2"; then
+      fail "cloudflare: manage-inspect does not accept arguments"
+    fi
+    zone_name=$(seal cloudflare config get zone_name)
+    zone=$(seal cloudflare zone get --name "$zone_name")
+    zone_id=$(seal json get "$zone" .id)
+    rulesets=$(seal cloudflare zone ruleset list --zone-id "$zone_id")
+    ruleset=$(seal json find "$rulesets" phase http_request_dynamic_redirect)
+    if empty "$ruleset"; then
+      print "manage inspect: no http_request_dynamic_redirect zone ruleset found"
+      exit 0
+    fi
+    ruleset_id=$(seal json get "$ruleset" .id)
+    full_ruleset=$(seal cloudflare zone ruleset get --zone-id "$zone_id" --ruleset-id "$ruleset_id")
+    ruleset_name=$(seal json get "$full_ruleset" .name)
+    rules=$(seal json get "$full_ruleset" .rules)
+    matched=$(seal json filter "$rules" ref runseal_manage_sh_redirect runseal_manage_ps1_redirect)
+    matched_count=$(seal json len "$matched")
+    print "zone id: $zone_id"
+    print "ruleset id: $ruleset_id"
+    print "ruleset name: $ruleset_name"
+    if eq "$matched_count" 0; then
+      print "manage inspect: no manage redirect rules found"
+      exit 0
+    fi
+    pretty=$(seal json pretty "$matched")
+    print "manage rules:"
+    print "$pretty"
+    ;;
+  manage-ensure-redirect)
+    dry_run=false
+    if eq "$2" --dry-run; then
+      dry_run=true
+      if not_empty "$3"; then
+        fail "cloudflare: unknown manage-ensure-redirect argument: $3"
+      fi
+    else
+      if not_empty "$2"; then
+        fail "cloudflare: unknown manage-ensure-redirect argument: $2"
+      fi
+    fi
+    zone_name=$(seal cloudflare config get zone_name)
+    request_host=$(seal cloudflare config get manage_host)
+    redirect_host=$(seal cloudflare config get manage_origin_host)
+    prefix=$(seal cloudflare config get manage_redirect_prefix)
+    if empty "$prefix"; then
+      target_sh="https://$redirect_host/manage.sh"
+      target_ps1="https://$redirect_host/manage.ps1"
+    else
+      target_sh="https://$redirect_host/$prefix/manage.sh"
+      target_ps1="https://$redirect_host/$prefix/manage.ps1"
+    fi
+    rule_sh=$(seal cloudflare redirect-rule exact --ref runseal_manage_sh_redirect --description "Redirect runseal manage.sh to releases bucket asset" --host "$request_host" --path /manage.sh --target-url "$target_sh")
+    rule_ps1=$(seal cloudflare redirect-rule exact --ref runseal_manage_ps1_redirect --description "Redirect runseal manage.ps1 to releases bucket asset" --host "$request_host" --path /manage.ps1 --target-url "$target_ps1")
+    zone=$(seal cloudflare zone get --name "$zone_name")
+    zone_id=$(seal json get "$zone" .id)
+    if eq "$dry_run" true; then
+      pretty_sh=$(seal json pretty "$rule_sh")
+      pretty_ps1=$(seal json pretty "$rule_ps1")
+      print "manage redirect plan"
+      print "zone: $zone_name"
+      print "zone id: $zone_id"
+      print "request host: $request_host"
+      print "redirect host: $redirect_host"
+      print "phase: http_request_dynamic_redirect"
+      print "rules:"
+      print "$pretty_sh"
+      print "$pretty_ps1"
+      exit 0
+    fi
+    rulesets=$(seal cloudflare zone ruleset list --zone-id "$zone_id")
+    ruleset=$(seal json find "$rulesets" phase http_request_dynamic_redirect)
+    if empty "$ruleset"; then
+      ruleset=$(seal cloudflare zone ruleset create --zone-id "$zone_id" --phase http_request_dynamic_redirect --name "Single Redirects ruleset")
+    else
+      ruleset_id=$(seal json get "$ruleset" .id)
+      ruleset=$(seal cloudflare zone ruleset get --zone-id "$zone_id" --ruleset-id "$ruleset_id")
+    fi
+    ruleset_id=$(seal json get "$ruleset" .id)
+    rules=$(seal json get "$ruleset" .rules)
+    current_sh=$(seal json find "$rules" ref runseal_manage_sh_redirect)
+    current_ps1=$(seal json find "$rules" ref runseal_manage_ps1_redirect)
+    if empty "$current_sh"; then
+      seal cloudflare zone ruleset rule add --zone-id "$zone_id" --ruleset-id "$ruleset_id" --json "$rule_sh"
+      changed_sh="created runseal_manage_sh_redirect"
+    else
+      rule_id=$(seal json get "$current_sh" .id)
+      seal cloudflare zone ruleset rule update --zone-id "$zone_id" --ruleset-id "$ruleset_id" --rule-id "$rule_id" --json "$rule_sh"
+      changed_sh="updated runseal_manage_sh_redirect"
+    fi
+    if empty "$current_ps1"; then
+      seal cloudflare zone ruleset rule add --zone-id "$zone_id" --ruleset-id "$ruleset_id" --json "$rule_ps1"
+      changed_ps1="created runseal_manage_ps1_redirect"
+    else
+      rule_id=$(seal json get "$current_ps1" .id)
+      seal cloudflare zone ruleset rule update --zone-id "$zone_id" --ruleset-id "$ruleset_id" --rule-id "$rule_id" --json "$rule_ps1"
+      changed_ps1="updated runseal_manage_ps1_redirect"
+    fi
+    print "manage ensure redirect: ok"
+    print "  - $changed_sh"
+    print "  - $changed_ps1"
+    ;;
+  api)
+    if empty "$2"; then
+      fail "cloudflare: api requires a method"
+    fi
+    if empty "$3"; then
+      fail "cloudflare: api requires a path"
+    fi
+    seal passthrough 2 cloudflare api request
+    ;;
+  *)
+    fail "cloudflare: unknown command: $1"
+    ;;
+esac