@bankr/cli 0.3.37 → 0.3.43

package/dist/commands/login.js

@@ -8,12 +8,121 @@ import { getErrorMessage } from "../lib/errors.js";
 const DEFAULT_DASHBOARD_URL = "https://bankr.bot/api-keys";
 const MAX_OTP_ATTEMPTS = 3;
 const INVALID_CODE_STATUSES = [400, 401, 422];
+/** The `code` the API's MFA gates send on every step-up 401 envelope
+ * (`sendStepUpRequired` in packages/api/src/middleware/mfaGate.ts). Duplicated
+ * here because the CLI can't import `@bankr/*` packages. */
+const MFA_STEP_UP_CODE = "MFA_STEP_UP_REQUIRED";
+/**
+ * Thrown when a login-gated call answers with the MFA step-up envelope. A
+ * passkey ceremony can't run in a terminal, so the email flow can't recover;
+ * the caller turns this into the browser-key guidance instead of the server's
+ * fallback text.
+ */
+export class MfaStepUpError extends Error {
+    constructor(context) {
+        super("MFA step-up required");
+        this.context = context;
+        this.name = "MfaStepUpError";
+    }
+}
+/** Keyed on `code`, never on message text, so a server wording change can't
+ * silently turn this back into the opaque failure. */
+export function mfaStepUpErrorFrom(body) {
+    if (!body || typeof body !== "object")
+        return null;
+    const { code, context } = body;
+    if (code !== MFA_STEP_UP_CODE)
+        return null;
+    return new MfaStepUpError(typeof context === "string" ? context : "unknown");
+}
+const NETWORK_ERROR_CODES = new Set([
+    "ECONNRESET",
+    "ECONNREFUSED",
+    "ETIMEDOUT",
+    "ENOTFOUND",
+    "EAI_AGAIN",
+    "EPIPE",
+    "UND_ERR_SOCKET",
+    "UND_ERR_CONNECT_TIMEOUT",
+]);
+/** Any 5xx: a gateway page (ALB/CloudFront 502/503/504) the API never saw, or
+ * an API catch-all such as a DB blip. Idempotent callers retry it; the API's
+ * own message, when it sent one, is kept for the final report. */
+export class TransientHttpError extends Error {
+    constructor(status, apiMessage) {
+        super(apiMessage ?? `Bankr API unavailable (${status})`);
+        this.status = status;
+        this.name = "TransientHttpError";
+    }
+}
+/** True for a request the API never answered: undici's `fetch failed`, a
+ * socket-level code, or a gateway error page. An API refusal is not one. */
+export function isTransientNetworkError(err, depth = 0) {
+    if (depth > 5)
+        return false;
+    if (!(err instanceof Error) || err instanceof MfaStepUpError)
+        return false;
+    if (err instanceof TransientHttpError)
+        return true;
+    // undici: "fetch failed" when no connection, "terminated" on a mid-body drop.
+    if (err instanceof TypeError &&
+        (err.message === "fetch failed" || err.message === "terminated")) {
+        return true;
+    }
+    const code = err.code;
+    if (typeof code === "string" && NETWORK_ERROR_CODES.has(code))
+        return true;
+    return isTransientNetworkError(err.cause, depth + 1);
+}
+/**
+ * Retry a login step on network blips only. The OTP is already spent by the
+ * time the wallet step runs, so a dropped connection here used to cost the
+ * user a fresh code; three quick attempts ride out the transient case.
+ */
+export async function withNetworkRetry(run, opts = {}) {
+    const { attempts = 3, baseDelayMs = 1000, sleep = (ms) => new Promise((r) => setTimeout(r, ms)), } = opts;
+    for (let attempt = 1;; attempt++) {
+        try {
+            return await run();
+        }
+        catch (err) {
+            if (attempt >= attempts || !isTransientNetworkError(err))
+                throw err;
+            await sleep(baseDelayMs * 2 ** (attempt - 1));
+        }
+    }
+}
+/** Key names are unique per user, so the default carries the time to the
+ * second: a scripted re-login seconds after a dropped mint response (which
+ * already created the key) must not collide with the earlier default. */
+export function defaultCliKeyName(now = new Date()) {
+    const iso = now.toISOString();
+    return `CLI-${iso.slice(0, 10)}-${iso.slice(11, 19).replace(/:/g, "")}`;
+}
+/** Headless login (`--code` / `--ni`) accepts the Terms of Service as part of
+ * logging in, so the one-time code isn't burned on a missing flag. Interactive
+ * login returns undefined to defer to the prompt. */
+export function resolveTermsAcceptance(opts) {
+    // `--accept-terms` is set-only (no `--no-accept-terms`), so `||` is safe.
+    return opts.acceptTerms || opts.headless || undefined;
+}
+/** The web app that fronts an API URL: `BANKR_WEB_URL` when set (local dev,
+ * staging), bankr.bot for the official API, else the API host with its
+ * `api.`/`api-` prefix dropped. */
+export function deriveWebOrigin(apiUrl) {
+    const override = process.env.BANKR_WEB_URL?.trim();
+    if (override)
+        return override.replace(/\/+$/, "");
+    if (apiUrl === DEFAULT_API_URL)
+        return "https://bankr.bot";
+    // Anchored to the host's start so a host merely containing "api." is intact.
+    return apiUrl.replace(/\/+$/, "").replace(/^(https?:\/\/)api[.-]/, "$1");
+}
 function deriveDashboardUrl(apiUrl) {
     if (apiUrl === DEFAULT_API_URL) {
         return DEFAULT_DASHBOARD_URL;
     }
-    return (apiUrl.replace(/\/+$/, "").replace("api.", "").replace("api-", "") +
-        "/api-keys");
+    return `${deriveWebOrigin(apiUrl)}/api-keys`;
 }
 async function fetchPrivyConfig(apiUrl) {
     const res = await fetch(`${apiUrl}/cli/config`, {
@@ -73,7 +182,9 @@ export function resolveKeyPermissionOverrides(opts) {
     return overrides;
 }
 async function verifyPrivyOtp(privyConfig, email, code) {
-    const res = await fetch("https://auth.privy.io/api/v1/passwordless/authenticate", {
+    // Retry only a request that never got an answer. If Privy did answer and
+    // the socket dropped, the replay reads as INVALID_CODE: no worse than today.
+    const res = await withNetworkRetry(() => fetch("https://auth.privy.io/api/v1/passwordless/authenticate", {
         method: "POST",
         headers: {
             "Content-Type": "application/json",
@@ -81,7 +192,7 @@ async function verifyPrivyOtp(privyConfig, email, code) {
             "privy-client-id": privyConfig.privyClientId,
         },
         body: JSON.stringify({ email, code, mode: "login-or-sign-up" }),
-    });
+    }));
     if (!res.ok) {
         if (INVALID_CODE_STATUSES.includes(res.status)) {
             throw new Error("INVALID_CODE");
@@ -93,26 +204,49 @@ async function verifyPrivyOtp(privyConfig, email, code) {
     }
     return (await res.json());
 }
+/**
+ * Parse a login-gated response. The body is read as text first so a gateway
+ * HTML error page becomes a `TransientHttpError` instead of a `SyntaxError`
+ * from `res.json()`. Every 5xx is transient (callers that opted into the
+ * retry replay it; others just report it); a 4xx keeps the API's message.
+ */
+export async function readGatedResponse(res, label) {
+    const text = await res.text();
+    let body;
+    try {
+        body = JSON.parse(text);
+    }
+    catch {
+        body = undefined;
+    }
+    const isJsonObject = !!body && typeof body === "object";
+    const { message, error } = (isJsonObject ? body : {});
+    const apiMessage = (typeof message === "string" && message) ||
+        (typeof error === "string" && error) ||
+        undefined;
+    if (!res.ok) {
+        if (res.status >= 500)
+            throw new TransientHttpError(res.status, apiMessage);
+        throw (mfaStepUpErrorFrom(body) ??
+            new Error(apiMessage ?? `${label} (${res.status})`));
+    }
+    if (!isJsonObject)
+        throw new Error(`${label}: unexpected response`);
+    return body;
+}
 async function callGenerateWallet(apiUrl, tokens) {
     const res = await fetch(`${apiUrl}/cli/generate-wallet`, {
         method: "POST",
         headers: authHeaders(tokens),
     });
-    const body = (await res.json());
-    if (!res.ok) {
-        throw new Error(body.message || body.error || `Wallet generation failed (${res.status})`);
-    }
-    return body;
+    return readGatedResponse(res, "Wallet generation failed");
 }
 async function callAcceptTerms(apiUrl, tokens) {
     const res = await fetch(`${apiUrl}/user/accept-terms`, {
         method: "POST",
         headers: authHeaders(tokens),
     });
-    if (!res.ok) {
-        const body = (await res.json().catch(() => ({})));
-        throw new Error(body.message || body.error || `Accept terms failed (${res.status})`);
-    }
+    await readGatedResponse(res, "Accept terms failed");
 }
 async function callGenerateApiKey(apiUrl, tokens, opts) {
     const res = await fetch(`${apiUrl}/api-keys`, {
@@ -120,11 +254,111 @@ async function callGenerateApiKey(apiUrl, tokens, opts) {
         headers: authHeaders(tokens),
         body: JSON.stringify(opts),
     });
-    const body = (await res.json());
+    // Parsed through the same seam so a gateway page reports cleanly; the mint
+    // itself is still never retried (see runGatedStep).
+    return readGatedResponse(res, "API key generation failed");
+}
+// ── Out-of-band MFA approval ─────────────────────────────────────────
+// Mirrors `MFA_CHALLENGE_STATUSES` in @bankr/shared (the CLI can't import it).
+const CHALLENGE_STATUSES = [
+    "pending",
+    "verified",
+    "expired",
+    "abandoned",
+    "failed",
+];
+/** Narrow the status poll body; anything unrecognised reads as `failed`. */
+function parseChallengeStatus(body) {
+    const status = body?.status;
+    return CHALLENGE_STATUSES.includes(status)
+        ? status
+        : "failed";
+}
+/**
+ * One poll's outcome from its HTTP status. Only a definitive refusal ends the
+ * wait: the gate (401, an API without this route yet), another wallet's token
+ * (403) or a gone challenge (404). Anything else — 429, 5xx, a dropped
+ * connection — is a blip, so the wait keeps polling as if still pending.
+ */
+export function pollOutcome(httpStatus, body) {
+    if (httpStatus >= 200 && httpStatus < 300)
+        return parseChallengeStatus(body);
+    return [401, 403, 404].includes(httpStatus) ? "failed" : "pending";
+}
+/** Poll cadence: 2s while an approval is likely imminent, then 5s. */
+const POLL_FAST_MS = 2000;
+const POLL_SLOW_MS = 5000;
+const POLL_FAST_WINDOW_MS = 30000;
+/**
+ * Poll until the challenge leaves `pending` or the deadline passes: once at
+ * once, then every 2s for the first 30s, then every 5s. Pure over its
+ * collaborators so the loop is unit-testable without a network.
+ */
+export async function waitForChallengeApproval(deps) {
+    const now = deps.now ?? Date.now;
+    const startedAt = now();
+    for (;;) {
+        const status = await deps.poll();
+        if (status !== "pending")
+            return status;
+        if (now() >= deps.deadlineMs)
+            return "expired";
+        await deps.sleep(now() - startedAt < POLL_FAST_WINDOW_MS ? POLL_FAST_MS : POLL_SLOW_MS);
+    }
+}
+async function createMfaChallenge(apiUrl, tokens, context) {
+    const res = await fetch(`${apiUrl}/user/mfa/challenge`, {
+        method: "POST",
+        headers: authHeaders(tokens),
+        body: JSON.stringify({ context }),
+    });
     if (!res.ok) {
-        throw new Error(body.message || body.error || `API key generation failed (${res.status})`);
+        throw new Error(`Couldn't start passkey approval (${res.status})`);
     }
-    return body;
+    return (await res.json());
+}
+async function readMfaChallengeStatus(apiUrl, tokens, token) {
+    try {
+        const res = await fetch(`${apiUrl}/user/mfa/challenge/${token}`, {
+            headers: authHeaders(tokens),
+        });
+        return pollOutcome(res.status, await res.json().catch(() => null));
+    }
+    catch {
+        return "pending";
+    }
+}
+/** Mirrors the server's challenge TTL; the deadline is kept on the local clock
+ * so a skewed machine can't expire the wait early (the poll reports a real
+ * server-side expiry as `expired` regardless). */
+const CHALLENGE_TTL_MS = 5 * 60 * 1000;
+/**
+ * The browser hop for an MFA-enabled account: create a challenge for THIS
+ * session, hand the user the confirm link, and wait for their passkey on the
+ * web to mint the grants. Resolves true once approved.
+ */
+async function approveInBrowser(apiUrl, tokens) {
+    const { token } = await createMfaChallenge(apiUrl, tokens, "api-key:generate");
+    const url = `${deriveWebOrigin(apiUrl)}/mfa/confirm/${token}`;
+    output.blank();
+    output.warn("Two-factor authentication is enabled on this account.");
+    output.info("Approve this login with your passkey:");
+    output.brandBold(`  ${url}`);
+    if (!output.isNonInteractive()) {
+        await open(url).catch(() => undefined);
+    }
+    const spin = output.spinner("Waiting for approval in your browser...");
+    const status = await waitForChallengeApproval({
+        poll: () => readMfaChallengeStatus(apiUrl, tokens, token),
+        sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+        deadlineMs: Date.now() + CHALLENGE_TTL_MS,
+    });
+    if (status === "verified") {
+        spin.succeed("Approved");
+        return true;
+    }
+    spin.fail(`Approval ${status}`);
+    return false;
 }
 // ── OTP verification helpers ─────────────────────────────────────────
 async function fetchPrivyConfigOrFail(apiUrl) {
@@ -220,20 +454,63 @@ async function authenticateWithEmail(apiUrl, providedEmail, providedCode) {
     }
     output.fatal("Verification failed. Please try again.");
 }
+/**
+ * Run a login-gated call; on the MFA step-up envelope, take the browser
+ * approval hop once and retry. A second refusal, or an approval that expires
+ * or fails, exits with the browser-key guidance. Network blips are retried
+ * only where the caller opts in, so a step is never replayed by default: a key
+ * mint whose response was dropped has already consumed its unique name.
+ */
+async function runGatedStep(apiUrl, tokens, label, run, opts = {}) {
+    const { retryOnNetworkBlip = false } = opts;
+    for (const retry of [false, true]) {
+        const spin = output.spinner(label);
+        try {
+            const result = retryOnNetworkBlip
+                ? await withNetworkRetry(run)
+                : await run();
+            spin.stop();
+            return result;
+        }
+        catch (err) {
+            spin.stop();
+            if (!(err instanceof MfaStepUpError) || retry) {
+                return failLoginStep(`${label} failed`, err, apiUrl);
+            }
+        }
+        const approved = await approveInBrowser(apiUrl, tokens).catch((err) => {
+            output.error(getErrorMessage(err));
+            return false;
+        });
+        if (!approved)
+            return exitWithApiKeyGuidance(apiUrl);
+    }
+    throw new Error("unreachable");
+}
+/** Exit with the generic epilogue, or the browser-key path on a step-up
+ * refusal the approval hop didn't clear. */
+function failLoginStep(label, err, apiUrl) {
+    if (!(err instanceof MfaStepUpError)) {
+        return output.fatal(`${label}: ${getErrorMessage(err)}`);
+    }
+    return exitWithApiKeyGuidance(apiUrl);
+}
+/** The remediation is the point of this message, so every line stays on
+ * stderr with the headline: a scripted caller capturing stderr sees all of it. */
+function exitWithApiKeyGuidance(apiUrl) {
+    output.error("Two-factor authentication is enabled on this account.");
+    output.errorDetail("  The passkey approval didn't complete.");
+    output.errorDetail(`  Generate an API key at ${deriveDashboardUrl(apiUrl)} instead (verify with your passkey there), then run:`);
+    output.errorDetail("    bankr login --api-key bk_YOUR_KEY");
+    process.exit(1);
+}
 // ── Email login flow ────────────────────────────────────────────────
 async function emailLoginFlow(apiUrl, opts) {
     // Step 1: Authenticate via email OTP
     const { tokens } = await authenticateWithEmail(apiUrl, opts.email, opts.code);
-    // Step 2: Generate/resolve wallet
-    const walletSpin = output.spinner("Setting up wallet...");
-    let wallet;
-    try {
-        wallet = await callGenerateWallet(apiUrl, tokens);
-        walletSpin.stop();
-    }
-    catch (err) {
-        output.failWith(walletSpin, "Wallet setup failed", err);
-    }
+    // Step 2: Resolve (or create) the wallet. The label stays neutral because
+    // whether the user is new only comes back in the response.
+    const wallet = await runGatedStep(apiUrl, tokens, "Loading wallet...", () => callGenerateWallet(apiUrl, tokens), { retryOnNetworkBlip: true });
     // Show wallet info
     output.blank();
     if (wallet.isNewUser) {
@@ -253,29 +530,21 @@ async function emailLoginFlow(apiUrl, opts) {
         output.blank();
         output.dim("  Please review our Terms of Service: https://bankr.bot/terms");
         output.blank();
-        const accepted = opts.acceptTerms ??
-            (headless
-                ? false
-                : await confirm({
-                    message: "Do you accept the Terms of Service?",
-                    default: false,
-                    theme: output.bankrTheme,
-                }));
+        const accepted = resolveTermsAcceptance({ headless, acceptTerms: opts.acceptTerms }) ??
+            (await confirm({
+                message: "Do you accept the Terms of Service?",
+                default: false,
+                theme: output.bankrTheme,
+            }));
         if (!accepted) {
             output.fatal("Terms must be accepted to continue.");
         }
-        const termsSpin = output.spinner("Accepting terms...");
-        try {
-            await callAcceptTerms(apiUrl, tokens);
-            termsSpin.succeed("Terms accepted");
-        }
-        catch (err) {
-            output.failWith(termsSpin, "Failed to accept terms", err);
-        }
+        await runGatedStep(apiUrl, tokens, "Accepting terms...", () => callAcceptTerms(apiUrl, tokens), { retryOnNetworkBlip: true });
+        output.success("Terms accepted");
     }
     // Step 4: Generate API key
     output.blank();
-    const defaultKeyName = `CLI-${new Date().toISOString().slice(0, 10)}`;
+    const defaultKeyName = defaultCliKeyName();
     const keyName = opts.keyName ??
         (headless
             ? defaultKeyName
@@ -301,23 +570,15 @@ async function emailLoginFlow(apiUrl, opts) {
                 default: false,
                 theme: output.bankrTheme,
             }));
-    const keySpin = output.spinner("Generating API key...");
-    let apiKeyResult;
-    try {
-        apiKeyResult = await callGenerateApiKey(apiUrl, tokens, {
-            name: keyName.trim(),
-            walletApiEnabled: enableWallet,
-            ...overrides,
-            tokenLaunchApiEnabled: enableTokenLaunch,
-            llmGatewayEnabled: enableLlm,
-            allowedIps: opts.allowedIps,
-            allowedRecipients: opts.allowedRecipients,
-        });
-        keySpin.stop();
-    }
-    catch (err) {
-        output.failWith(keySpin, "Failed to generate API key", err);
-    }
+    const apiKeyResult = await runGatedStep(apiUrl, tokens, "Generating API key...", () => callGenerateApiKey(apiUrl, tokens, {
+        name: keyName.trim(),
+        walletApiEnabled: enableWallet,
+        ...overrides,
+        tokenLaunchApiEnabled: enableTokenLaunch,
+        llmGatewayEnabled: enableLlm,
+        allowedIps: opts.allowedIps,
+        allowedRecipients: opts.allowedRecipients,
+    }));
     // Show result
     output.blank();
     const features = [

package/dist/commands/{profile.d.ts → project.d.ts}

@@ -1,7 +1,7 @@
-export declare function profileViewCommand(opts: {
+export declare function projectViewCommand(opts: {
     json?: boolean;
 }): Promise<void>;
-export declare function profileCreateCommand(opts: {
+export declare function projectCreateCommand(opts: {
     name?: string;
     description?: string;
     token?: string;
@@ -9,7 +9,7 @@ export declare function profileCreateCommand(opts: {
     website?: string;
     json?: boolean;
 }): Promise<void>;
-export declare function profileUpdateCommand(opts: {
+export declare function projectUpdateCommand(opts: {
     slug?: string;
     name?: string;
     description?: string;
@@ -18,13 +18,13 @@ export declare function profileUpdateCommand(opts: {
     website?: string;
     json?: boolean;
 }): Promise<void>;
-export declare function profileDeleteCommand(opts: {
+export declare function projectDeleteCommand(opts: {
     slug?: string;
 }): Promise<void>;
-export declare function profileAddUpdateCommand(opts: {
+export declare function projectAddUpdateCommand(opts: {
     slug?: string;
     title?: string;
     content?: string;
     json?: boolean;
 }): Promise<void>;
-//# sourceMappingURL=profile.d.ts.map
+//# sourceMappingURL=project.d.ts.map