Install Stratos using Winget - wingetCollections

Stratos CloudCDN

Use this command to install Stratos:

winget install --id=CloudCDN.Stratos -e

Stratos is a command-line client and Node ESM library designed to provide comprehensive control over the CloudCDN platform. It offers a single-file implementation with zero runtime dependencies, enabling seamless interaction with CloudCDN's features through ~30 commands across its full control plane.

Key Features:

Comprehensive Control Plane: Supports operations such as cache purging, signed URL generation, asset management, insights analysis, zone configuration, token management, webhook subscriptions, and more.
Zero-Dependency Implementation: Delivered as a 100% tested, single-file Node.js module requiring only Node ≥20, ensuring minimal overhead and fast execution.
OpenTelemetry Integration: Facilitates observability by exporting metrics and traces for monitoring and analytics.
OS-Keychain Authentication: Securely manages credentials using native keychains on macOS, Linux, and Windows.
Shell Completions: Enhances usability with auto-completion support for zsh, bash, fish, and PowerShell.

Audience & Benefit: Ideal for developers, DevOps engineers, and platform administrators managing CloudCDN resources. Stratos provides a lightweight, efficient toolset to streamline operations, reduce manual overhead, and integrate seamlessly into CI/CD pipelines or shell scripts. Its design ensures reliability and speed, making it suitable for environments requiring fast cold starts and minimal resource usage.

Installation: Stratos can be installed via winget on Windows, ensuring easy setup and integration into your workflow.

README

stratos

Official command-line client and Node ESM library for CloudCDN — the full control plane in a single ~4,000-line, zero-dependency Node ≥ 20 script.

Getting started

Install — eight channels, SHA-pinned installer
Quick Start — verify, authenticate, purge in five lines
Why a single-file CLI? — design rationale

Companion artefacts

Companion artefacts — composite GitHub Action, MCP server, Docker image
Migrating from another CDN CLI — Wrangler, Fastly CLI, Codex CLI

CLI reference

Capabilities — release inventory

Versions

0.0.19

Website

github.com

License

Last updated

6/18/2026

Download latest version

Channel	Command
npm (recommended)	`npm install -g @cloudcdn/stratos`
Homebrew (macOS / Linux, no Node required)	`brew tap sebastienrousseau/tap && brew install sebastienrousseau/tap/stratos`
winget (Windows)	`winget install CloudCDN.Stratos`
Scoop (Windows)	`scoop bucket add sebastienrousseau https://github.com/sebastienrousseau/scoop-bucket && scoop install stratos`
Single binary (no Node required)	Download from the latest release — `stratos-{linux-x64,linux-arm64,darwin-x64,darwin-arm64,win-x64.exe}`. Compiled with Bun; ~58 MB, ~20 ms cold start.
macOS / Linux installer	`curl -sL https://cloudcdn.pro/dist/stratos/install.sh \| bash`
Windows (PowerShell)	`irm https://cloudcdn.pro/dist/stratos/install.ps1 \| iex`
From source	`git clone https://github.com/sebastienrousseau/stratos && cd stratos && node stratos.mjs help`

curl -sL https://cloudcdn.pro/dist/stratos/install.sh | STRATOS_PREFIX=$HOME/bin bash

# Verify the install
stratos version
# → stratos v0.0.17

# Hit the public health endpoint
stratos health
# → { "status": "ok", "bindings": { "ai": true, "kv": true, "d1": true, "r2": true } }

# Set up tab completion (zsh shown; bash/fish/powershell also supported)
eval "$(stratos completion zsh)"

# Authenticate once, then drive the control plane
export CLOUDCDN_ACCOUNT_KEY="cdnsk_…"
stratos purge https://cloudcdn.pro/akande/v1/logos/logo.svg
stratos purge --tag "build-${GITHUB_SHA}" --tag project-akande
cat urls.txt | stratos purge -      # batch invalidate from stdin

# Stream NDJSON into jq for downstream pipelines
stratos assets --all --output ndjson | jq -r '.Path'

# Introspect the surface (agent caller's gateway)
stratos schema --output ndjson | jq -r 'select(.mcp_tool) | "\(.name) → \(.mcp_tool)"'

Artefact	What it is	Use case
`@cloudcdn/stratos`	The CLI and library (this README)	Local terminal, CI, scripts, in-process integration
`sebastienrousseau/stratos/actions/stratos@v`	Composite GitHub Action	Drop-in CI step; auto-detects `GITHUB_ACTIONS`, emits `::error::` workflow commands on non-zero exit. See `actions/stratos/README.md`.
`stratos mcp serve`	Model Context Protocol stdio server (bundled)	Claude Code, Cursor, Continue.dev, Zed assistant, any MCP host — see MCP server
`ghcr.io/sebastienrousseau/stratos`	Multi-arch Docker image (`linux/amd64`, `linux/arm64`)	Containerised CI runners; `docker run --rm ghcr.io/sebastienrousseau/stratos:latest version`

Theme	Capabilities
Edge cache	URL / Cache-Tag / wildcard purge, dry-run preview, stdin batching, offline length-prefixed HMAC-SHA256 signed URLs
Catalog & analytics	Paginated asset catalogue with `--all` auto-walk, per-asset metadata, insights (summary, top, asset, errors, geo), audit logs, raw analytics filter
Multi-tenancy	Zone create / list / show / delete, custom-domain attachment
Config-as-code	`_headers` / `_redirects` get / set / LCS-based diff (exits non-zero on drift, git-style)
Auth & secrets	Scoped API tokens, webhook subscriptions, `stratos login` → OS keychain (macOS `security`, libsecret, Windows `cmdkey`)
Storage	Single-file CRUD plus recursive `sync` over the batch endpoint, 50 files / request
Observability	SSE-streamed live `logs tail`, historical `logs query`, `doctor` env diagnostic, `bench` cold-start + latency sampler, OTLP/HTTP tracing via `--otlp-endpoint` (one span per command)
AI & media	Alt-text, moderation, smart-crop, background-remove; on-the-fly image `transform`, BlurHash, LQIP, format negotiation, HLS playlist builder
Pipeline & discovery	SVG-driven asset scaffolding, hybrid vector + fuzzy `search`, AI concierge (`ask`)
Agent integration	`stratos mcp serve` (10 tools / 6 resources / 4 prompts), `stratos schema` machine-readable command catalogue, `--output ndjson` streaming, stable typed errors (`error.type` + `retryable`)
Operator UX	Shell completions (bash/zsh/fish/PowerShell), XDG-compliant profiles, `--json`, `--output ndjson\|yaml\|csv\|table`, `--filter` , `-q`, `--verbose`, `--rate /s` client-side throttle, configurable `--timeout` / `--retries` with full-jitter backoff

Env var	Purpose	Default
`CLOUDCDN_URL`	API base URL	`https://cloudcdn.pro`
`CLOUDCDN_ACCOUNT_KEY`	Control plane: purge, zones, rules, tokens, webhooks	unset
`CLOUDCDN_ACCESS_KEY`	Read-only: assets, insights, search	unset
`SIGNED_URL_SECRET`	HMAC secret for `signed` (offline)	unset
`STRATOS_PROFILE`	Default profile name	`default`
`CLOUDCDN_TIMEOUT`	Per-request timeout, ms	`15000`
`CLOUDCDN_RETRIES`	Max retries on 429 / 5xx / network	`3`
`STRATOS_NO_KEYCHAIN`	Set to `1` to skip OS-keychain lookups	unset
`OTEL_EXPORTER_OTLP_ENDPOINT`	OTLP/HTTP traces endpoint (alt to `--otlp-endpoint`)	unset
`OTEL_EXPORTER_OTLP_HEADERS`	OTLP exporter headers (`k=v,k=v`)	unset
`NO_COLOR`	Set to disable ANSI output	unset

stratos config set prod.url        https://cloudcdn.pro
stratos config set prod.account_key cdnsk_xxx…
stratos config set staging.url     https://staging.cloudcdn.example
stratos config list

# Then everywhere:
stratos --profile prod purge --tag build-123
STRATOS_PROFILE=staging stratos health --deep

stratos login              # interactive prompt; writes to macOS Keychain / libsecret / cmdkey
stratos login status       # show resolved config with secrets masked
stratos logout             # clear all stratos secrets from the keychain

Command	What it does
`version`, `-v`, `--version`	Print version
`help []`, `-h`, `--help`	Print help; per-command `--help` too
`health [--deep]`	`GET /api/health` (add `?deep=1` with `--deep`)
`purge ...`	Invalidate by URL
`purge --tag ...`	Invalidate by Cache-Tag (repeats accumulate)
`purge --everything`	Wipe edge cache (hard-rate-limited)
`purge --dry-run`	Preview the payload without sending
`purge -`	Read URLs from stdin (one per line)
`signed --expires [--secret ]`	Offline length-prefixed HMAC-SHA256 URL

Command	What it does
`assets [--project] [--format] [--page] [--all]`	Paginated catalogue; `--all` walks every page (cap: 1,000)
`assets show`	Single-asset metadata
`insights summary [--days N] [--zone Z]`	Requests, bandwidth, cache ratio
`insights top [--limit N] [--days N]`	Top requested assets
`insights asset [--days N]`	Per-asset traffic
`insights errors [--days N]`	4xx / 5xx breakdown
`insights geo [--days N]`	Country distribution
`stats [--days N] [--zone Z]`	`/api/core/statistics`
`analytics query [...]`	`/api/analytics` filter
`audit [--action A] [--days N]`	Immutable audit trail

Command	What it does
`zones list \| create \| show \| rm --force`	Tenant zones
`zones domains add`	Add a custom domain
`rules get <_headers\|_redirects>`	Read the edge config file
`rules set <_headers\|_redirects> -f`	Write it back via Git
`rules diff <_headers\|_redirects> -f`	LCS line diff; exits 0 if identical, 69 on drift
`tokens list \| create --name N --scopes S,S \| rm`	Scoped API tokens
`webhooks list \| add --url U --events E,E \| rm`	Event subscriptions

Command	What it does
`storage put`	Single-file upload
`storage get []`	Download (stdout if no ``)
`storage rm`	Delete
`storage ls`	List under a prefix
`storage sync`	Recursive upload via `/api/storage/batch` (50 / req)

Command	What it does
`ai alt \| moderate \| crop \| bg-remove`	AI vision endpoints
`image transform [--w --h --fit --format --q --blur --sharpen]`	Resize / convert
`image blurhash [--size N]`	BlurHash placeholder
`image lqip [--size N] [--blur N]`	Tiny blurred placeholder
`image auto`	Format negotiation
`stream [--quality Q] [--segment N]`	HLS playlist or segment URL

Command	What it does
`pipeline submit --svg --name N`	Asset scaffold from an SVG
`search [--limit N]`	Hybrid asset search
`ask`	CloudCDN AI concierge
`logs tail [--level L]`	SSE-stream live logs
`logs query [--days N] [--level L] [--limit N]`	Historical logs

Command	What it does
`init`	Interactive first-run setup; scriptable via flags
`schema [--output json\|ndjson\|yaml]`	Machine-readable command catalogue (drives MCP tool registration, completion, doc generation)
`completion`	Emit completion script
`upgrade`	Re-run the latest pinned installer
`config get \| set \| list \| edit`	Profile management; `edit` opens `$EDITOR`
`login` / `login status` / `logout`	Store keys in the OS keychain
`passkey`	WebAuthn ceremony bootstrapper (browser)
`doctor`	Diagnose env, credentials, network
`bench [-n N]`	Cold-start + N latency samples
`explain`	Cause + fix for an exit code or HTTP status
`mcp serve`	Run as an MCP server over stdio (10 tools, 6 resources, 4 prompts)

// signed-url-server.mjs — mint short-lived signed URLs from an Express handler.
import { cmdSigned } from '@cloudcdn/stratos';
import express from 'express';

const app = express();

app.get('/preview/:client/:file', async (req, res) =&gt; {
  // cmdSigned writes the URL to process.stdout, so capture stdout briefly.
  const captured = [];
  const originalWrite = process.stdout.write.bind(process.stdout);
  process.stdout.write = (chunk) =&gt; { captured.push(chunk); return true; };

  try {
    const expires = Math.floor(Date.now() / 1000) + 600; // 10 minutes
    await cmdSigned(
      [`/clients/${req.params.client}/${req.params.file}`],
      { expires, secret: process.env.SIGNED_URL_SECRET },
    );
  } finally {
    process.stdout.write = originalWrite;
  }

  res.redirect(302, captured.join('').trim());
});

app.listen(3000);

// custom-tool.mjs — reuse Stratos's flag parser for consistency with the CLI.
import { parseFlags } from '@cloudcdn/stratos';

const { positional, flags } = parseFlags(process.argv.slice(2));
// e.g. node custom-tool.mjs deploy --env=prod --tag a --tag b
// → positional = ['deploy']
// → flags      = { env: 'prod', tag: ['a', 'b'] }
console.log({ positional, flags });

// integration-test.mjs — invoke any command in-process.
import { main, VERSION, EX } from '@cloudcdn/stratos';

console.log(`Driving stratos v${VERSION}`);          // → Driving stratos v0.0.17
console.log(`Exit codes: ${JSON.stringify(EX)}`);    // → { OK: 0, USAGE: 64, ... }

// Same argv shape as the CLI; same exits, same stdout/stderr discipline.
await main(['health', '--cdn-url', 'http://localhost:8788', '--json']);

Symbol	Kind	Purpose
`main(argv?)`	`async function`	The full CLI router (drives every subcommand)
`parseFlags(args)`	`function`	`argv → { positional, flags }` parser
`jsonReq(path, init?, opts?)`	`async function`	Retrying, auth-aware `fetch` wrapper
`envConfig(flags?)`	`async function`	Resolve `{ BASE, ACCOUNT_KEY, ACCESS_KEY, … }` from flags / env / profile / keychain
`cmdHealth`, `cmdPurge`, `cmdSigned`, `cmdAssets`, `cmdInsights`, `cmdZones`, `cmdTokens`, `cmdWebhooks`, `cmdStorage`, `cmdLogs`, `cmdAI`, `cmdImage`, `cmdSearch`, `cmdAsk`	`async function`	The in-process-driveable subset of CLI subcommands
`MCP_TOOLS`	`Array<{name, desc, schema}>`	The 10 tools exposed over MCP
`mcpCall(name, args)`	`async function`	Invoke an MCP tool in-process
`VERSION`	`string`	e.g. `'0.0.16'`
`EX`	`Readonly`	Sysexits-style exit-code constants

{
  "mcpServers": {
    "cloudcdn": {
      "command": "stratos",
      "args": ["mcp", "serve"],
      "env": {
        "CLOUDCDN_ACCOUNT_KEY": "cdnsk_…",
        "CLOUDCDN_ACCESS_KEY":  "cdnsk_…"
      }
    }
  }
}

# Per-command shape
stratos schema --output ndjson | jq -c 'select(.name == "purge")'
# → {"name":"purge","summary":"Invalidate cache by URL, tag, or wholesale.",
#    "usage":"stratos purge ... [--dry-run]",
#    "exits":[0,64,69,75,77,78],"since":"0.0.1","mcp_tool":"cloudcdn_purge"}

# Top-level wrapper
stratos schema | jq 'keys'
# → ["$schema","commands","error_types","homepage","tool","version"]

# Discover only MCP-exposed commands
stratos schema --output ndjson | jq -r 'select(.mcp_tool) | .name'
# → health, purge, signed, assets, insights, ai, search, logs (10 total)

Code	Meaning
`0`	Success
`64`	Usage / bad CLI args
`65`	Data error — malformed input or response
`69`	Service unavailable (4xx other than auth)
`70`	Software error (uncaught exception)
`74`	Local I/O failure
`75`	Tempfail — 5xx, 429, or network after retries exhausted
`77`	Permission denied (401 / 403)
`78`	Config error (missing key, unreadable config file)
`130`	Interrupted (SIGINT)

stratos signed --json
# stderr: {"error":{"type":"usage_error","message":"signed needs a path argument.",
#                   "retryable":false,"exit_code":64}}

# HTTP-status → type inference via emitFailure()
stratos health --json --retries 0 --cdn-url http://127.0.0.1:1
# stderr: {"error":{"type":"request_failed","message":"...","retryable":true,
#                   "exit_code":75}}

`error.type`	When	`retryable`	Exit
`usage_error`	Invalid CLI invocation	`false`	`64`
`auth_missing_key`	Required credential not configured	`false`	`78`
`auth_invalid`	401 / 403 from the API	`false`	`77`
`target_not_found`	404 from the API	`false`	`69`
`rate_limited`	429 from the API	`true`	`75`
`server_error`	5xx from the API	`true`	`75`
`request_failed`	Network / transport failure	`true`	`75`
`data_error`	Malformed input or response (400 / 422)	`false`	`65`
`io_error`	Local filesystem failure	`false`	`74`
`unavailable`	Other non-2xx	`false`	`69`
`software_error`	Unexpected internal error	`false`	`70`

stratos health --deep | jq '.bindings | to_entries[] | select(.value != true)'
# (no output = all bindings healthy)

export CLOUDCDN_ACCOUNT_KEY="$CLOUDCDN_PROD_KEY"
stratos purge --tag "build-${GITHUB_SHA::7}" --tag "project-akande"

EXPIRES=$(($(date +%s) + 600))   # 10 minutes
stratos signed "/clients/$CLIENT/preview.pdf" --expires "$EXPIRES"

stratos logs tail --level error

stratos storage sync ./dist /sites/acme --concurrency 16

stratos assets --format=jpg --output ndjson | jq -r '.Path' \
  | xargs -I{} -P4 stratos ai alt "https://cloudcdn.pro{}"

stratos rules diff _headers -f ./public/_headers

# An agent caller wraps each call with this pattern.
if ! out=$(stratos purge --tag "$TAG" --json 2&gt;err.json); then
  retryable=$(jq -r '.error.retryable' err.json)
  [[ "$retryable" == "true" ]] &amp;&amp; sleep 1 &amp;&amp; retry
fi

Recipe	File
CI cache bust + warm-up	`examples/ci-cache-bust.sh`
Client preview signed URL	`examples/client-preview-url.sh`
Batch AI alt-text → CSV	`examples/ai-alt-text-batch.sh`
Log triage → Slack webhook	`examples/log-triage.sh`
MCP with Claude Code	`examples/mcp-claude-code.md`
Migrating from Wrangler	`examples/migrate-from-wrangler.md`
Migrating from Fastly CLI	`examples/migrate-from-fastly.md`
Migrating from Codex CLI	`examples/migrate-from-codex.md`
Setting up the Homebrew tap	`examples/homebrew-tap-setup.md`

Pinned SHA-256. Both shell installers verify the downloaded stratos.mjs against a SHA-256 constant baked into the installer itself.
npm provenance. Releases publish with npm publish --provenance — Sigstore-backed attestation. Verify with:
```
npm audit signatures
```
SLSA L3 build provenance. Each tagged release attaches an in-toto attestation (stratos-v.intoto.jsonl) via slsa-framework/slsa-github-generator. Verify with slsa-verifier. Standard GitHub Actions attestations also exist:
```
gh attestation verify stratos.mjs --owner sebastienrousseau
```
Cosign keyless signatures. .sig and .crt files alongside every canonical artefact (script, binaries, installers, SBOM, VEX). Sigstore Fulcio CA + Rekor transparency log. See SECURITY-AUDIT.md for the verification recipe.
CycloneDX SBOM + VEX. Attached to every release; both signed with Cosign keyless.
Signed commits. Every commit on main is SSH ED25519 signed.
No telemetry. Every network call is initiated by an explicit command. No phone-home, no auto-update polling.
Offline signed. The HMAC mint runs in-process; the secret never leaves the host.

curl -fsSL https://cloudcdn.pro/dist/stratos/stratos.mjs -o stratos.mjs
shasum -a 256 stratos.mjs
# Compare against EXPECTED_SHA in install/install.sh

.
├── stratos.mjs              # the CLI (~4,000 lines, zero runtime deps)
├── install/
│   ├── install.sh           # POSIX installer
│   └── install.ps1          # Windows installer
├── scripts/
│   ├── check-docs.mjs       # zero-dep JSDoc coverage gate
│   ├── check-versions.mjs   # version-string + EXPECTED_SHA agreement check
│   └── lint-tests.mjs       # resource-leak rule for test/*.test.mjs
├── test/                    # 532 tests across 29 files, node --test
│   ├── parse.test.mjs · router.test.mjs · signed.test.mjs · http.test.mjs
│   ├── mcp.test.mjs         # JSON-RPC stdio
│   ├── commands.test.mjs · coverage-edge.test.mjs · branches.test.mjs · more-branches.test.mjs
│   ├── doctor-bench.test.mjs · diff-pagination.test.mjs
│   ├── v003.test.mjs … v013-branch-push.test.mjs   # per-release regression sets
│   └── v016-{lint-tests,schema,ndjson,typed-errors}.test.mjs
├── examples/                # cookbook + migration guides
├── actions/stratos/         # composite GitHub Action
├── .github/workflows/
│   ├── ci.yml               # Node 20/22/24 × { ubuntu, macos, windows }
│   └── release.yml          # npm publish --provenance on tag
├── .github/dependabot.yml   # weekly actions/npm/docker updates
├── .c8rc.json               # coverage config (enforcement in coverage:check)
├── README.md · CHANGELOG.md · CONTRIBUTING.md · CODE_OF_CONDUCT.md
├── GOVERNANCE.md · MAINTAINERS.md · NON-GOALS.md
├── SECURITY.md · SECURITY-AUDIT.md · LICENSE
└── package.json · package-lock.json

npm test                     # all 532 tests, ~8 s
npm run coverage             # text + HTML + LCOV reports
npm run coverage:check       # enforce 100 / 100 / 100 / 100 thresholds
npm run docs:check           # enforce 100% JSDoc coverage
npm run tests:lint           # resource-leak rule (CI gate)

node stratos.mjs version
node stratos.mjs health --cdn-url https://staging.cloudcdn.example

Resource	Where
CLI reference	`stratos help` and per-command `stratos --help`
Machine-readable schema	`stratos schema` (JSON / NDJSON / YAML; drives agent introspection + MCP)
Programmatic API	Programmatic API section above; full JSDoc on every export
Cookbook	`examples/`
Migration guides	`examples/migrate-from-wrangler.md`, `examples/migrate-from-fastly.md`, `examples/migrate-from-codex.md`
MCP integration	`examples/mcp-claude-code.md`
Release notes	`CHANGELOG.md`
Security disclosure	`SECURITY.md`
Security audit / threat model	`SECURITY-AUDIT.md`
Contributing	`CONTRIBUTING.md`
Code of Conduct	`CODE_OF_CONDUCT.md`
Governance	`GOVERNANCE.md`
Maintainers	`MAINTAINERS.md`
Non-goals	`NON-GOALS.md`

Command	Cast
`stratos purge --tag … --dry-run`
`stratos signed …` (offline HMAC mint)
`stratos doctor`

Coming from…	Guide
Cloudflare Wrangler	`examples/migrate-from-wrangler.md`
Fastly CLI	`examples/migrate-from-fastly.md`
OpenAI Codex CLI (agentic-CLI patterns)	`examples/migrate-from-codex.md`

Metric	Result
Tests	532 / 532 green (`node --test`, zero runtime deps, ~8 s)
Code: Statements	100%
Code: Lines	100%
Code: Functions	100%
Code: Branches	100%
Docs: JSDoc declarations	100% (118 / 118)

Stratos CloudCDN

README

stratos

Contents

Install

Quick Start

In-terminal demos

Why a single-file CLI?

Companion artefacts

Migrating from another CDN CLI

Capabilities

Authentication & profiles

Commands

Edge ops

Catalog & insights

Zones, rules, tokens, webhooks

Storage

AI, image, media

Pipeline & discovery

Meta

Global options

Programmatic API

Minting a signed URL from your application

Parsing CLI-style flags in your own tool

Driving the full router (for test harnesses)

Public exports

MCP server

Machine-readable schema

Output, exit codes, typed errors

Examples

When not to use Stratos

Integrity & supply chain

Development

Versioning policy

Tests & coverage

Security

Governance

Documentation

License