@aisa-one/cli 0.5.1 → 0.6.0

package/dist/constants.js

@@ -1,4 +1,4 @@
-export const VERSION = "0.5.1";
+export const VERSION = "0.6.0";
 /** Root of the platform. Per-surface bases are derived in api.ts#resolveBases. */
 export const BASE_URL = "https://api.aisa.one";
 export const ENV_VAR_NAME = "AISA_API_KEY";
@@ -145,3 +145,6 @@ export const MODEL_PROVIDERS = [
     "alibaba",
     "bytedance",
 ];
+export const AUTH_SERVER = "https://clerk.aisa.one";
+export const AUTH_SETUP_GUIDANCE = `Run "aisa login" to sign in with OAuth. For CI, set ${ENV_VAR_NAME} or use "aisa login --key <key>".`;
+export const MISSING_API_KEY_GUIDANCE = `Not authenticated. ${AUTH_SETUP_GUIDANCE}`;

package/dist/index.js

@@ -4,6 +4,7 @@ import { VERSION } from "./constants.js";
 import { CliError } from "./cli-error.js";
 // Auth
 import { loginAction, logoutAction, whoamiAction } from "./commands/auth.js";
+import { loginHelpAfter } from "./commands/oauth-login.js";
 // Account
 import { balanceAction, topupAction, usageAction } from "./commands/account.js";
 // API
@@ -75,15 +76,16 @@ program
     .description("Sign in to AIsa — browser sign-in by default, or --key to paste one")
     .option("--key <key>", "API key (skips the browser sign-in)")
     .option("--no-browser", "Print the sign-in URL and paste the redirect back (detected on its own over SSH)")
+    .addHelpText("after", loginHelpAfter())
     .action(wrap(loginAction));
 program
     .command("logout")
-    .description("Remove stored API key")
-    .action(logoutAction);
+    .description("Revoke OAuth refresh token and remove stored credentials")
+    .action(wrap(logoutAction));
 program
     .command("whoami")
     .description("Show authentication status")
-    .action(whoamiAction);
+    .action(wrap(whoamiAction));
 // ── Account ──
 program
     .command("topup [amount]")
@@ -243,7 +245,7 @@ mcp
     .option("--agent <agent>", "Target agent: cursor, claude-desktop, all")
     .option("--all", "Configure every live server, not just the default set")
     .option("--yes", "Write the files. Without it, print what would change and stop")
-    .action(mcpSetupAction);
+    .action(wrap(mcpSetupAction));
 mcp
     .command("status")
     .description("Check MCP configuration and ping each configured endpoint")

package/dist/router.d.ts

@@ -26,14 +26,14 @@ export interface RouterRequest {
     /** Raw application JSON. Sent unchanged so numeric tokens survive. */
     body: string;
     /** Bearer credential without the "Bearer " prefix, if any. */
-    apiKey?: string;
+    accessToken?: string;
 }
 export interface RouterHttpResult {
     status: number;
     raw: string;
 }
 /**
- * POST one Router operation. Never retries: quote and use are not safe to
- * replay, and search/schema must not hide a failed attempt.
+ * POST one Router operation. Only a 401 permits one authentication retry; quote and use are not safe to
+ * replay after a transport or server failure.
  */
 export declare function routerPost(request: RouterRequest): Promise<RouterHttpResult>;

package/dist/router.js

@@ -1,5 +1,5 @@
 import { getConfig } from "./config.js";
-import { httpFetch } from "./utils/http.js";
+import { authenticatedFetch } from "./utils/auth-http.js";
 /**
  * Deployed Tool Router origin (nginx / tools.aisa.one). Paths already include
  * `/v1/tool-router/...`, so this is an origin, not the LLM `/v1` base.
@@ -35,8 +35,8 @@ function stripTrailingSlash(url) {
     return url.replace(/\/+$/, "");
 }
 /**
- * POST one Router operation. Never retries: quote and use are not safe to
- * replay, and search/schema must not hide a failed attempt.
+ * POST one Router operation. Only a 401 permits one authentication retry; quote and use are not safe to
+ * replay after a transport or server failure.
  */
 export async function routerPost(request) {
     const url = `${resolveRouterBase()}${ROUTER_PATHS[request.operation]}`;
@@ -44,10 +44,10 @@ export async function routerPost(request) {
         "Content-Type": "application/json",
         "x-aisa-source": "cli",
     };
-    if (request.apiKey) {
-        headers.Authorization = `Bearer ${request.apiKey}`;
+    if (request.accessToken) {
+        headers.Authorization = `Bearer ${request.accessToken}`;
     }
-    const res = await httpFetch(url, {
+    const res = await authenticatedFetch(url, {
         method: "POST",
         headers,
         body: request.body,

package/dist/utils/auth-http.d.ts

@@ -0,0 +1,3 @@
+import { type HttpOptions } from "./http.js";
+/** Retry only an explicit authentication rejection, at most once. */
+export declare function authenticatedFetch(url: string, options: HttpOptions): Promise<Response>;

package/dist/utils/auth-http.js

@@ -0,0 +1,18 @@
+import { refreshAccessToken } from "../config.js";
+import { httpFetch } from "./http.js";
+/** Retry only an explicit authentication rejection, at most once. */
+export async function authenticatedFetch(url, options) {
+    const response = await httpFetch(url, options);
+    if (response.status !== 401)
+        return response;
+    const headers = new Headers(options.headers);
+    const authorization = headers.get("Authorization");
+    if (!authorization?.startsWith("Bearer "))
+        return response;
+    const token = await refreshAccessToken(authorization.slice(7));
+    if (!token)
+        return response;
+    await response.body?.cancel();
+    headers.set("Authorization", `Bearer ${token}`);
+    return httpFetch(url, { ...options, headers: Object.fromEntries(headers.entries()) });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aisa-one/cli",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "CLI for the AIsa unified AI infrastructure platform - one API key for 80+ LLMs and 900+ endpoints across finance, search, social, and video APIs",
   "type": "module",
   "main": "dist/index.js",
@@ -36,10 +36,12 @@
     "commander": "^12.0.0",
     "conf": "^12.0.0",
     "ora": "^8.0.1",
+    "proper-lockfile": "^4.1.2",
     "smol-toml": "^1.8.0"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",
+    "@types/proper-lockfile": "^4.1.4",
     "typescript": "^5.0.0",
     "vitest": "^3.2.4"
   },