@asteroidai/cli 0.0.0 → 1.8.197

package/package.json

@@ -1 +1,51 @@
-{"name":"@asteroidai/cli","version":"0.0.0","description":"The Asteroid CLI. First release coming soon."}
+{
+  "name": "@asteroidai/cli",
+  "version": "1.8.197",
+  "description": "The asteroid command-line interface for the Asteroid platform.",
+  "type": "module",
+  "license": "MIT",
+  "bin": {
+    "asteroid": "./dist/asteroid.js"
+  },
+  "exports": {
+    "./core": {
+      "types": "./src/core.ts",
+      "development": "./src/core.ts",
+      "default": "./dist/core.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "dependencies": {
+    "@bomb.sh/tab": "^0.0.22",
+    "@clack/prompts": "^1.8.1",
+    "@napi-rs/keyring": "^2.1.0",
+    "cli-table3": "^0.6.5",
+    "commander": "^15.0.0",
+    "env-paths": "^4.0.0",
+    "proper-lockfile": "^4.1.2"
+  },
+  "devDependencies": {
+    "@types/node": "^22.20.1",
+    "@types/proper-lockfile": "^4.1.4",
+    "esbuild": "^0.28.2",
+    "prettier": "3.9.6",
+    "tsx": "^4.23.12",
+    "typescript": "5.9.3",
+    "vitest": "^4.1.11",
+    "yaml": "^2.9.0"
+  },
+  "scripts": {
+    "generate": "tsx scripts/generate.ts && pnpm exec prettier --write src/generated/commands.ts",
+    "build": "tsc --noEmit && node scripts/bundle.mjs",
+    "build:core": "node scripts/bundle.mjs",
+    "check-types": "tsc --noEmit",
+    "test": "vitest run",
+    "smoke": "node scripts/smoke.mjs"
+  }
+}

package/src/account.ts

@@ -0,0 +1,224 @@
+import { UsageError } from "./args";
+import {
+  API_KEY_OVERRIDES,
+  AuthError,
+  orgFromToken,
+  rememberOrg,
+  resolveAuth,
+  UNSET_API_KEY,
+} from "./auth/credentials";
+import { CredentialStore } from "./auth/store";
+import {
+  authorizeDevice,
+  pollDevice,
+  tokenClaims,
+  type WorkosOrg,
+} from "./auth/workos";
+import {
+  findOrg,
+  loadConfig,
+  mergeOrgs,
+  orgLabel,
+  requestedOrg,
+  saveConfig,
+} from "./config";
+import { send } from "./http";
+import { clean, render } from "./output";
+import type { Deps } from "./run";
+
+async function chooseOrg(deps: Deps, orgs: WorkosOrg[]): Promise<WorkosOrg> {
+  if (orgs.length === 0)
+    throw new AuthError("your account belongs to no organization");
+  if (orgs.length === 1 || !deps.ui) return orgs[0];
+  const id = await deps.ui.select(
+    "Choose an organization",
+    orgs.map((org) => ({ value: org.id, label: clean(org.name) })),
+  );
+  const chosen = orgs.find((org) => org.id === id);
+  if (!chosen) throw new AuthError("sign-in cancelled");
+  return chosen;
+}
+
+export async function login(deps: Deps): Promise<number> {
+  if (deps.env.apiKey)
+    deps.stderr(
+      `Warning: ${API_KEY_OVERRIDES} Every command will use the key, not this sign-in. ${UNSET_API_KEY}\n`,
+    );
+  const client = {
+    clientId: deps.env.workosClientId,
+    apiUrl: deps.env.workosApiUrl,
+    fetch: deps.fetch,
+  };
+  const device = await authorizeDevice(client);
+  const url = device.verification_uri_complete ?? device.verification_uri;
+  deps.stderr(
+    `Open ${clean(url)}\nand confirm the code ${clean(device.user_code)}\n`,
+  );
+  deps.openUrl?.(url);
+
+  let offered: WorkosOrg[] = [];
+  const polling = pollDevice(client, device, (orgs) => {
+    offered = orgs;
+    return chooseOrg(deps, orgs);
+  });
+  const session = deps.ui
+    ? await deps.ui.wait(
+        "Waiting for you to confirm in the browser",
+        "Confirmed",
+        polling,
+      )
+    : await polling;
+
+  const store = new CredentialStore(deps.env);
+  const where = await store.writeLogin({
+    refreshToken: session.refreshToken,
+    email: session.email,
+  });
+  const org = orgFromToken(session.accessToken);
+  const expiresAt = (tokenClaims(session.accessToken).exp ?? 0) * 1000;
+  if (org && expiresAt)
+    store.cacheToken(org.workosId, {
+      accessToken: session.accessToken,
+      expiresAt,
+    });
+
+  const config = loadConfig(deps.env);
+  config.orgs = mergeOrgs(
+    config.orgs,
+    offered.map((o) => ({ workosId: o.id, name: o.name })),
+  );
+  config.org = undefined;
+  saveConfig(deps.env, config);
+  rememberOrg(deps.env, config, org);
+
+  deps.stderr(
+    `Signed in as ${clean(session.email ?? "you")}${config.org ? ` in ${orgLabel(config.org)}` : ""}. ` +
+      `Token saved to the ${where === "keychain" ? "OS keychain" : "config directory"}.\n`,
+  );
+  return 0;
+}
+
+export async function logout(deps: Deps): Promise<number> {
+  const cleared = await new CredentialStore(deps.env).clear();
+  saveConfig(deps.env, { ...loadConfig(deps.env), org: undefined });
+  if (!cleared) {
+    deps.stderr(
+      "Could not remove the sign-in from the OS keychain. Delete the asteroid-cli entry by hand.\n",
+    );
+    return 1;
+  }
+  deps.stderr("Signed out.\n");
+  return 0;
+}
+
+export async function orgs(
+  deps: Deps,
+  flagOrg: string | undefined,
+  json: boolean,
+): Promise<number> {
+  if (deps.env.apiKey)
+    throw new UsageError(
+      `${API_KEY_OVERRIDES} The key acts in one organization; \`asteroid whoami\` shows it. ${UNSET_API_KEY}`,
+    );
+  const config = loadConfig(deps.env);
+  const auth = await resolveAuth(
+    deps.env,
+    config,
+    requestedOrg(flagOrg, deps.env, deps.cwd, config),
+    deps.fetch,
+  );
+  const list = loadConfig(deps.env).orgs ?? [];
+  const active = auth.org?.workosId;
+  if (json) {
+    deps.stdout(
+      `${JSON.stringify(
+        list.map((org) => ({ ...org, active: org.workosId === active })),
+        null,
+        2,
+      )}\n`,
+    );
+    return 0;
+  }
+  for (const org of list)
+    deps.stdout(`${org.workosId === active ? "*" : " "} ${orgLabel(org)}\n`);
+  return 0;
+}
+
+export async function use(
+  deps: Deps,
+  ref: string | undefined,
+): Promise<number> {
+  if (deps.env.apiKey)
+    throw new UsageError(
+      `${API_KEY_OVERRIDES} \`use\` only switches the login's organization. ${UNSET_API_KEY}`,
+    );
+  const config = loadConfig(deps.env);
+  if (!ref && deps.ui && (config.orgs?.length ?? 0) > 0) {
+    ref = await deps.ui.select(
+      "Use which organization?",
+      (config.orgs ?? []).map((o) => ({
+        value: o.workosId,
+        label: orgLabel(o),
+      })),
+    );
+    if (!ref) return 1;
+  }
+  if (!ref) throw new UsageError("usage: asteroid use <org>");
+  const org = findOrg(ref, config.orgs ?? []);
+  if (!org)
+    throw new UsageError(
+      `unknown organization ${ref}. Run \`asteroid orgs\` to list yours.`,
+    );
+  const auth = await resolveAuth(deps.env, config, org.workosId, deps.fetch);
+  const updated = loadConfig(deps.env);
+  updated.org =
+    updated.orgs?.find((o) => o.workosId === org.workosId) ?? auth.org ?? org;
+  saveConfig(deps.env, updated);
+  deps.stderr(`Now using ${orgLabel(updated.org)}.\n`);
+  return 0;
+}
+
+export async function whoami(
+  deps: Deps,
+  flagOrg: string | undefined,
+  json: boolean,
+): Promise<number> {
+  const config = loadConfig(deps.env);
+  const auth = await resolveAuth(
+    deps.env,
+    config,
+    requestedOrg(flagOrg, deps.env, deps.cwd, config),
+    deps.fetch,
+  );
+  const response = await send(
+    deps.env.apiUrl,
+    auth,
+    { method: "GET", path: "/users/v2/whoami", query: new URLSearchParams() },
+    false,
+    deps.fetch,
+  );
+  const body = (response.json ?? {}) as Record<string, unknown>;
+  const minutes = auth.expiresAt
+    ? Math.max(0, Math.round((auth.expiresAt - Date.now()) / 60_000))
+    : undefined;
+  if (json) {
+    deps.stdout(
+      `${JSON.stringify({ ...body, organizationName: auth.org?.name, tokenExpiresInMinutes: minutes }, null, 2)}\n`,
+    );
+    return 0;
+  }
+  const person = body.person as { email?: string } | undefined;
+  const orgId = body.organizationId as string | undefined;
+  const organization = auth.org ? orgLabel(auth.org) : (orgId ?? "none");
+  deps.stdout(
+    `${render({
+      as: person?.email ?? body.id,
+      kind: body.kind,
+      credential: body.credential,
+      source: auth.kind === "api-key" ? "ASTEROID_API_KEY" : "asteroid login",
+      organization,
+      ...(minutes === undefined ? {} : { tokenExpiresIn: `${minutes}m` }),
+    })}\n`,
+  );
+  return 0;
+}

package/src/args.ts

@@ -0,0 +1,39 @@
+import type { CliCommand } from "./types";
+
+export class UsageError extends Error {}
+
+export interface Parsed {
+  positionals: string[];
+  flags: Map<string, string[]>;
+  json: boolean;
+  org?: string;
+  body?: string;
+  output?: string;
+}
+
+export function leadingWords(argv: string[]): string[] {
+  const words: string[] = [];
+  for (const token of argv) {
+    if (token.startsWith("-")) break;
+    words.push(token);
+  }
+  return words;
+}
+
+export function matchCommand(
+  words: string[],
+  commands: CliCommand[],
+): { command?: CliCommand; prefix: string[] } {
+  for (let length = Math.min(words.length, 4); length > 0; length--) {
+    const candidate = words.slice(0, length).join(" ");
+    const command = commands.find((c) => c.command === candidate);
+    if (command) return { command, prefix: words.slice(0, length) };
+  }
+  for (let length = Math.min(words.length, 3); length > 0; length--) {
+    const prefix = words.slice(0, length);
+    if (commands.some((c) => c.command.startsWith(`${prefix.join(" ")} `))) {
+      return { prefix };
+    }
+  }
+  return { prefix: [] };
+}

package/src/auth/credentials.ts

@@ -0,0 +1,141 @@
+import {
+  type Config,
+  type Env,
+  findOrg,
+  mergeOrgs,
+  type Org,
+  orgLabel,
+  saveConfig,
+} from "../config";
+import { CredentialStore } from "./store";
+import { refresh, tokenClaims, WorkosError } from "./workos";
+
+export class AuthError extends Error {}
+
+export const API_KEY_OVERRIDES =
+  "ASTEROID_API_KEY is set, so the CLI uses that key and ignores `asteroid login`.";
+export const UNSET_API_KEY =
+  "Run `unset ASTEROID_API_KEY` to use your login instead.";
+
+export interface Auth {
+  kind: "api-key" | "bearer";
+  headers: Record<string, string>;
+  org?: Org;
+  expiresAt?: number;
+}
+
+export function orgFromToken(token: string): Org | undefined {
+  const claims = tokenClaims(token);
+  if (!claims.org_id) return undefined;
+  return {
+    workosId: claims.org_id,
+    id: claims.org?.id,
+    name: claims.org?.name,
+  };
+}
+
+export function rememberOrg(env: Env, config: Config, org: Org | undefined) {
+  if (!org) return;
+  config.orgs = mergeOrgs(config.orgs, [org]);
+  if (!config.org || config.org.workosId === org.workosId) {
+    config.org = config.orgs.find((o) => o.workosId === org.workosId);
+  }
+  saveConfig(env, config);
+}
+
+function bearer(token: string, expiresAt: number): Auth {
+  return {
+    kind: "bearer",
+    headers: { Authorization: `Bearer ${token}` },
+    org: orgFromToken(token),
+    expiresAt,
+  };
+}
+
+const SSO_OR_MFA =
+  /^(sso_required|mfa_.*|organization_authentication_methods_required)$/;
+
+function refreshError(error: WorkosError, org: Org): AuthError {
+  if (error.code === "invalid_grant") {
+    return new AuthError("your sign-in has expired. Run `asteroid login`.");
+  }
+  if (SSO_OR_MFA.test(error.code)) {
+    return new AuthError(
+      `${orgLabel(org)} requires SSO or MFA. Run \`asteroid login\` and sign in to it again.`,
+    );
+  }
+  if (error.code === "organization_membership_not_found") {
+    return new AuthError(
+      `you are not a member of ${orgLabel(org)}. Staff access to other organizations is not available yet.`,
+    );
+  }
+  return new AuthError(
+    `signing in to ${orgLabel(org)} failed: ${error.message}`,
+  );
+}
+
+export async function resolveAuth(
+  env: Env,
+  config: Config,
+  orgRef: string | undefined,
+  fetchImpl: typeof fetch = fetch,
+): Promise<Auth> {
+  if (env.apiKey)
+    return { kind: "api-key", headers: { "X-Api-Key": env.apiKey } };
+
+  const store = new CredentialStore(env);
+  if (!(await store.readLogin())) {
+    throw new AuthError(
+      "not signed in. Run `asteroid login`, or set ASTEROID_API_KEY.",
+    );
+  }
+
+  const org = orgRef ? findOrg(orgRef, config.orgs ?? []) : config.org;
+  if (orgRef && !org) {
+    throw new AuthError(
+      `unknown organization ${orgRef}. Run \`asteroid orgs\` to list yours.`,
+    );
+  }
+  if (!org) {
+    throw new AuthError(
+      "no organization. Run `asteroid use <org>`, or pass --org.",
+    );
+  }
+
+  const cached = store.cachedToken(org.workosId);
+  if (cached) return bearer(cached.accessToken, cached.expiresAt);
+
+  return store.withRefreshLock(async () => {
+    const fresh = store.cachedToken(org.workosId);
+    if (fresh) return bearer(fresh.accessToken, fresh.expiresAt);
+    const login = await store.readLogin();
+    if (!login) {
+      throw new AuthError("not signed in. Run `asteroid login`.");
+    }
+    try {
+      const session = await refresh(
+        {
+          clientId: env.workosClientId,
+          apiUrl: env.workosApiUrl,
+          fetch: fetchImpl,
+        },
+        login.refreshToken,
+        org.workosId,
+      );
+      await store.writeLogin({ ...login, refreshToken: session.refreshToken });
+      const expiresAt =
+        (tokenClaims(session.accessToken).exp ?? 0) * 1000 ||
+        Date.now() + 60_000;
+      const auth = bearer(session.accessToken, expiresAt);
+      store.cacheToken(auth.org?.workosId ?? org.workosId, {
+        accessToken: session.accessToken,
+        expiresAt,
+      });
+      rememberOrg(env, config, auth.org);
+      return auth;
+    } catch (error) {
+      if (error instanceof WorkosError) throw refreshError(error, org);
+      throw error;
+    }
+  });
+}

package/src/auth/store.ts

@@ -0,0 +1,145 @@
+import { mkdirSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import lockfile from "proper-lockfile";
+
+import { type Env, readJson, writePrivateJson } from "../config";
+import { WorkosError } from "./workos";
+
+const SERVICE = "asteroid-cli";
+const LOCK_STALE_MS = 30_000;
+const ACCOUNT = "refresh-token";
+
+export interface Login {
+  refreshToken: string;
+  email?: string;
+}
+
+export interface CachedToken {
+  accessToken: string;
+  expiresAt: number;
+}
+
+interface Keyring {
+  get(): string | null;
+  set(value: string): void;
+  delete(): void;
+}
+
+async function keyring(): Promise<Keyring | undefined> {
+  if (process.env.ASTEROID_NO_KEYCHAIN) return undefined;
+  try {
+    const { Entry } = await import("@napi-rs/keyring");
+    const entry = new Entry(SERVICE, ACCOUNT);
+    entry.getPassword();
+    return {
+      get: () => entry.getPassword() ?? null,
+      set: (value) => entry.setPassword(value),
+      delete: () => {
+        entry.deletePassword();
+      },
+    };
+  } catch {
+    return undefined;
+  }
+}
+
+function tryGet(ring: Keyring): { ok: boolean; value: string | null } {
+  try {
+    return { ok: true, value: ring.get() };
+  } catch {
+    return { ok: false, value: null };
+  }
+}
+
+function trySet(ring: Keyring, value: string | null): boolean {
+  try {
+    if (value === null) ring.delete();
+    else ring.set(value);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export class CredentialStore {
+  constructor(private readonly env: Env) {}
+
+  private get loginFile() {
+    return join(this.env.configDir, "credentials.json");
+  }
+
+  private get tokenFile() {
+    return join(this.env.configDir, "tokens.json");
+  }
+
+  async readLogin(): Promise<Login | undefined> {
+    const ring = await keyring();
+    const raw = ring ? tryGet(ring).value : null;
+    if (raw) return JSON.parse(raw) as Login;
+    return readJson<Login | undefined>(this.loginFile, undefined);
+  }
+
+  async writeLogin(login: Login): Promise<"keychain" | "file"> {
+    const ring = await keyring();
+    if (ring && trySet(ring, JSON.stringify(login))) {
+      rmSync(this.loginFile, { force: true });
+      return "keychain";
+    }
+    const stale = ring ? tryGet(ring) : { ok: true, value: null };
+    if (!stale.ok || (stale.value && !trySet(ring!, null))) {
+      throw new WorkosError(
+        "keychain",
+        "could not update the sign-in in the OS keychain. Unlock it, or run `asteroid logout` and sign in again.",
+      );
+    }
+    writePrivateJson(this.loginFile, login);
+    return "file";
+  }
+
+  async clear(): Promise<boolean> {
+    const ring = await keyring();
+    const current = ring ? tryGet(ring) : { ok: true, value: null };
+    const cleared = current.ok && (!current.value || trySet(ring!, null));
+    rmSync(this.loginFile, { force: true });
+    rmSync(this.tokenFile, { force: true });
+    return cleared;
+  }
+
+  async withRefreshLock<T>(work: () => Promise<T>): Promise<T> {
+    mkdirSync(this.env.configDir, { recursive: true, mode: 0o700 });
+    const lockfilePath = join(this.env.configDir, "refresh.lock");
+    let release: () => Promise<void>;
+    try {
+      release = await lockfile.lock(this.env.configDir, {
+        lockfilePath,
+        stale: LOCK_STALE_MS,
+        retries: { retries: 60, minTimeout: 100, maxTimeout: 500 },
+      });
+    } catch {
+      throw new WorkosError(
+        "locked",
+        `another asteroid command is refreshing the sign-in. Try again, or delete ${lockfilePath} if none is running.`,
+      );
+    }
+    try {
+      return await work();
+    } finally {
+      await release();
+    }
+  }
+
+  cachedToken(orgId: string): CachedToken | undefined {
+    const tokens = readJson<Record<string, CachedToken>>(this.tokenFile, {});
+    const token = tokens[orgId];
+    return token && token.expiresAt - 30_000 > Date.now() ? token : undefined;
+  }
+
+  cacheToken(orgId: string, token: CachedToken) {
+    const tokens = readJson<Record<string, CachedToken>>(this.tokenFile, {});
+    for (const [id, cached] of Object.entries(tokens)) {
+      if (cached.expiresAt <= Date.now()) delete tokens[id];
+    }
+    tokens[orgId] = token;
+    writePrivateJson(this.tokenFile, tokens);
+  }
+}