@arbol-ai/cli 1.20261017.200040 → 1.20261018.213455

package/README.md

@@ -3,15 +3,25 @@
 `arbol`, the Arbol API from your terminal. Its commands are generated by
 [Cloudflare Forge](https://github.com/cloudflare/forge) from the platform's public OpenAPI,
 [`https://api.getarbol.com/openapi.json`](https://api.getarbol.com/openapi.json), and every request
-goes through [`@arbol-ai/sdk`](https://www.npmjs.com/package/@arbol-ai/sdk). The package's version is
-the API release its commands were generated from (`1.YYYYMMDD.n`).
+goes through [`@arbol-ai/sdk`](https://www.npmjs.com/package/@arbol-ai/sdk). A release's version is
+the date and time it was built (`1.YYYYMMDD.HHMMSS`, UTC); `arbol --version` also names the API release
+its commands were generated from.
 
 ```sh
 npm install --global @arbol-ai/cli
 arbol --version
 ```
 
-It needs Node.js 26 or newer, whose `fetch` and `Temporal` the SDK uses.
+It needs Node.js 26 or newer, whose `fetch` and `Temporal` the SDK uses. On macOS and Linux,
+[cli.getarbol.com](https://cli.getarbol.com) does the same in one line:
+
+```sh
+curl -fsSL https://cli.getarbol.com/install.sh | sh
+```
+
+[`install.sh`](site/public/install.sh) checks for Node.js 26 and runs
+`npm install --global @arbol-ai/cli`, or prints that command when npm is missing. Run it again to
+update; `ARBOL_VERSION=<version>` installs a given release.
 
 ## Profiles
 
@@ -31,6 +41,12 @@ ARBOL_PROFILE=ci arbol sura appointments list
 
 An API key given to one command, through `--api-key-stdin` or `ARBOL_API_KEY`, wins over every
 profile, as `GH_TOKEN` does for `gh`: scripts, servers and CI can run without saving anything.
+When `arbol auth login` without `--profile` signs in as someone else, or to another organization,
+than the default profile is, it asks where the login goes: a new profile (it suggests a name from the
+organization), in place of the profile, or beside it in the same profile (`arbol auth switch` moves
+between them). In a script it saves nothing and asks for `--profile` instead. `--profile <name>`
+always saves the login in that profile.
+
 `arbol auth status` prints which credential is in use and, for a login, its organization;
 `arbol auth logout` signs a login out, or forgets a profile's API key (the key itself works until it
 is revoked in Arbol Account).
@@ -138,6 +154,28 @@ bun run verify      # typecheck, tests and dist/
 `openapi.json` is downloaded at generation time and not committed, and `src/generated/generation.json`
 records which release, Forge commit and plugin wrote each file.
 
+## Releases
+
+A release of the API flows through three repositories, each started by the one before it:
+
+1. **project-arbol-gateway** publishes the OpenAPI at `https://api.getarbol.com/openapi.json` and sends
+   `openapi-release` to project-arbol-sdk-js.
+2. **project-arbol-sdk-js** regenerates `@arbol-ai/sdk` from it, publishes it to npm and sends
+   `sdk-release` (`{ "version": "<release>" }`) here.
+3. **Here**, [Generate](.github/workflows/generate.yml) pins `@arbol-ai/sdk` to exactly that release,
+   regenerates `src/generated/` from the live OpenAPI and, when anything changed and `bun run verify`
+   passes, commits `Release <release>` to main and runs [Publish](.github/workflows/publish.yml) on that
+   commit. When nothing changed, nothing is committed or published.
+
+Generate also runs every 6 hours and by hand, pinning the SDK release the OpenAPI names once it is on
+npm. Its push uses an installation token of the organization's GitHub App (Arbol Bot: the variable
+`ARBOL_BOT_APP_ID` and the secret `ARBOL_BOT_PRIVATE_KEY`), so the commit runs Verify like any other.
+Publish can also run by hand, for a change to the CLI alone; npm receives the package with the
+organization's `NPM_TOKEN` and a provenance statement.
+
+[cli.getarbol.com](https://cli.getarbol.com) is the Worker in [`site/`](site/wrangler.jsonc): static
+files and no code. Cloudflare Workers Builds deploys it on every push to main that changes `site/`.
+
 ## License
 
 [Apache License 2.0](LICENSE)

package/dist/index.js

@@ -64673,6 +64673,27 @@ var schemaComponents = {
     }
   }
 };
+// src/generated/generation.json
+var generation_default = {
+  formatVersion: 4,
+  release: "1.20261017.200040",
+  openapiSha256: "279d68eeef778edef60506856eff29b16919284d546ce9d9f92f6043c927b5a8",
+  forge: {
+    repository: "https://github.com/cloudflare/forge",
+    commit: "7f86447210b7bea3779bfdab3cd5655eade0eadb",
+    license: "Apache-2.0",
+    version: "0.1.0"
+  },
+  plugins: {
+    cli: "fcabf27a9d57a656f3e312e71160b76975ce3585173b8ae507cbabd236ba1cab"
+  },
+  outputs: [
+    {
+      path: "src/generated/commands.ts",
+      sha256: "6815a99764c8bf660482ba688da147eeae2ea2c1c82775964a5683acb5812dde"
+    }
+  ]
+};
 
 // src/oauth.ts
 import { spawn as spawn2 } from "node:child_process";
@@ -64707,14 +64728,8 @@ function openBrowser(url) {
   child.unref();
 }
 var ORGANIZATION = /^org_[A-Za-z0-9]+$/;
-async function login(credentials, {
-  noBrowser = false,
-  organizationId,
-  nameOrganization = () => Promise.resolve(null)
-} = {}) {
-  await credentials.initialize();
-  await credentials.store.get(credentials.loginKey("keyring-preflight", "any"));
-  const { config } = credentials;
+async function signIn(config, { noBrowser = false, organizationId, nameOrganization = () => Promise.resolve(null), preflight } = {}) {
+  await preflight?.();
   const redirect = new URL(config.redirectUri);
   if (redirect.protocol !== "http:" || redirect.hostname !== "127.0.0.1" || !redirect.port) {
     throw new Error("The CLI can only receive a login on a 127.0.0.1 loopback address");
@@ -64798,17 +64813,52 @@ ${authorization.href}
       subject: claims.sub,
       organizationId: organization
     };
-    const name = await nameOrganization(tokens.access_token).catch(() => null);
-    await credentials.locked(credentials.loginKey(claims.sub, organization), () => credentials.save(session, name));
-    process.stderr.write(`Signed in to ${name ?? organization}${name ? ` (${organization})` : ""}.
-`);
-    return { ...credentials.loginOf(session), organizationName: name };
+    return { session, organizationName: await nameOrganization(tokens.access_token).catch(() => null) };
   } finally {
     clearTimeout(timeout);
     server.closeAllConnections();
     server.close();
   }
 }
+async function keep(credentials, { session, organizationName }) {
+  await credentials.initialize();
+  await credentials.locked(credentials.loginKey(session.subject, session.organizationId), () => credentials.save(session, organizationName));
+  process.stderr.write(`Signed in to ${organizationName ?? session.organizationId}${organizationName ? ` (${session.organizationId})` : ""}.
+`);
+}
+async function login(credentials, options = {}) {
+  await credentials.initialize();
+  const signed = await signIn(credentials.config, {
+    ...options,
+    preflight: () => credentials.store.get(credentials.loginKey("keyring-preflight", "any"))
+  });
+  await keep(credentials, signed);
+}
+async function revoke(config, refreshToken) {
+  try {
+    const response = await oauth.revocationRequest(await authority(config), client(config), oauth.None(), refreshToken, {
+      signal: AbortSignal.timeout(15000)
+    });
+    await response.body?.cancel();
+    return response.ok;
+  } catch {
+    return false;
+  }
+}
+async function forgetAll(credentials) {
+  let confirmed = true;
+  for (const login of await credentials.logins()) {
+    await credentials.locked(login.key, async () => {
+      const session = await credentials.session(login).catch(() => null);
+      if (session?.refreshToken && !await revoke(credentials.config, session.refreshToken)) {
+        confirmed = false;
+      }
+      await credentials.store.delete(login.key);
+      await credentials.forget(login);
+    });
+  }
+  return confirmed;
+}
 async function accessToken(credentials) {
   const login = await credentials.active();
   const again = `run arbol auth login --profile ${credentials.profile}`;
@@ -64995,9 +65045,10 @@ ${name}`);
 }
 
 // src/index.ts
-var VERSION = "1.20261017.200040";
+var VERSION = "1.20261018.213455";
+var RELEASE = generation_default.release;
 var SERVICES = [...new Set(Object.keys(commands).map((name) => name.split(" ")[0]))].toSorted();
-var HELP = `Arbol CLI ${VERSION}: the Arbol platform from your terminal.
+var HELP = `Arbol CLI ${VERSION} (Arbol API ${RELEASE}): the Arbol platform from your terminal.
 
 Usage
   arbol <command> [flags]
@@ -65194,7 +65245,7 @@ Run arbol --help.`);
   }
   const { positionals, values } = parsed;
   if (values.version) {
-    process.stdout.write(`arbol ${VERSION}
+    process.stdout.write(`arbol ${VERSION} (Arbol API ${RELEASE})
 `);
     return;
   }
@@ -65294,12 +65345,39 @@ Run arbol --help.`);
           throw new UsageError(`Profile ${name} is for ${api}, not ${chosenApi()}; name another with --profile <name>`);
         }
         const auth = await discover(api);
-        await login(credentialsFor(name, auth), {
+        const here = credentialsFor(name, auth);
+        const signed = await signIn(auth, {
           noBrowser: values["no-browser"],
-          nameOrganization: (token) => nameOrganization(api, token)
+          nameOrganization: (token) => nameOrganization(api, token),
+          preflight: () => here.store.get(here.loginKey("keyring-preflight", "any"))
         });
-        await profiles.save(name, { kind: "login", auth });
-        process.stderr.write(`Saved${await saved(name)}.
+        let destination = name;
+        if (named === undefined && existing?.kind === "login") {
+          const before = credentialsFor(name, existing.auth);
+          const current = await before.active().catch(() => null);
+          if (current && (current.subject !== signed.session.subject || current.organizationId !== signed.session.organizationId)) {
+            const known = (await before.logins()).find((entry) => entry.key === current.key);
+            let choice;
+            try {
+              choice = await placement(name, known ?? { ...current, organizationName: null }, signed, profiles);
+            } catch (error) {
+              if (signed.session.refreshToken) {
+                await revoke(auth, signed.session.refreshToken);
+              }
+              throw error;
+            }
+            if (choice.kind === "new") {
+              destination = choice.name;
+            } else if (choice.kind === "replace" && !await forgetAll(before)) {
+              process.stderr.write(`Profile ${name}'s previous login was removed, but its revocation could not be confirmed.
+`);
+            }
+          }
+        }
+        await keep(credentialsFor(destination, auth), signed);
+        await profiles.save(destination, { kind: "login", auth });
+        process.stderr.write(destination === name ? `Saved${await saved(name)}.
+` : `Saved${await saved(destination)}; use it with --profile ${destination}, or by default after arbol auth use ${destination}.
 `);
         return;
       }
@@ -65603,6 +65681,51 @@ Type yes to continue: `);
     prompt.close();
   }
 }
+function suggestedName(organizationName, taken) {
+  const base = folded(organizationName ?? "").replaceAll(/[^a-z0-9]+/g, "-").replaceAll(/^-+|-+$/g, "").slice(0, 28).replace(/-+$/, "") || "profile";
+  let name = base;
+  for (let next = 2;taken.includes(name); next++) {
+    name = `${base}-${next}`;
+  }
+  return name;
+}
+async function placement(profile, current, signed, profiles) {
+  const describe = (subject, organizationId, name) => `${name ? `${name} (${organizationId})` : organizationId} as ${subject}`;
+  const now = describe(signed.session.subject, signed.session.organizationId, signed.organizationName);
+  const before = describe(current.subject, current.organizationId, current.organizationName);
+  if (!(process.stdin.isTTY && process.stderr.isTTY)) {
+    throw new UsageError(`You signed in to ${now}, but profile ${profile} is ${before}. Nothing was saved: run arbol auth login --profile <name> to keep both, or arbol auth logout first to replace it.`);
+  }
+  const taken = (await profiles.list()).map(({ name }) => name);
+  const suggestion = suggestedName(signed.organizationName, taken);
+  process.stderr.write(`You signed in to ${now}.
+Profile ${profile} is ${before}.
+  1. Save it as a new profile (${suggestion})
+  2. Replace profile ${profile} with it
+  3. Add it to profile ${profile}; arbol auth switch moves between them
+`);
+  const prompt = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const answer = (await prompt.question("Choose 1, 2 or 3 [1]: ")).trim() || "1";
+    if (answer === "2") {
+      return { kind: "replace" };
+    }
+    if (answer === "3") {
+      return { kind: "add" };
+    }
+    if (answer !== "1") {
+      throw new UsageError("Choose 1, 2 or 3; nothing was saved.");
+    }
+    const name = (await prompt.question(`Profile name [${suggestion}]: `)).trim() || suggestion;
+    validProfileName(name);
+    if (taken.includes(name)) {
+      throw new UsageError(`Profile ${name} exists; nothing was saved. Run arbol auth login --profile ${name} to sign it in.`);
+    }
+    return { kind: "new", name };
+  } finally {
+    prompt.close();
+  }
+}
 async function nameOrganization(api, token) {
   const { data } = await createClient({ baseUrl: api, token }).account.organizations.current({});
   return typeof data.name === "string" ? data.name : null;
@@ -65742,5 +65865,6 @@ if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.ar
   }
 }
 export {
-  main
+  main,
+  suggestedName
 };

package/package.json

@@ -1,8 +1,14 @@
 {
   "name": "@arbol-ai/cli",
-  "version": "1.20261017.200040",
+  "version": "1.20261018.213455",
   "description": "The Arbol CLI: the Arbol API from your terminal, with commands generated by Cloudflare Forge from the public OpenAPI.",
-  "keywords": ["arbol", "cli", "api", "openapi", "forge"],
+  "keywords": [
+    "arbol",
+    "cli",
+    "api",
+    "openapi",
+    "forge"
+  ],
   "homepage": "https://github.com/getarbol/project-arbol-cli#readme",
   "bugs": {
     "url": "https://github.com/getarbol/project-arbol-cli/issues"
@@ -15,7 +21,11 @@
   "bin": {
     "arbol": "./dist/index.js"
   },
-  "files": ["dist", "README.md", "LICENSE"],
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
   "type": "module",
   "engines": {
     "node": ">=26"
@@ -27,7 +37,7 @@
   "scripts": {
     "forge": "bun scripts/forge.ts",
     "openapi": "curl -fsS --proto =https --max-redirs 0 --max-filesize 33554432 -o openapi.json https://api.getarbol.com/openapi.json",
-    "generate": "bun scripts/generate.ts openapi.json && bun pm pkg set version=\"$(jq -r .info.version openapi.json)\"",
+    "generate": "bun scripts/generate.ts openapi.json",
     "typecheck": "tsc --noEmit",
     "test": "bun test tests",
     "build": "bun scripts/build.ts",