@barekey/cli 0.4.0 → 0.5.1

package/dist/typegen/core.d.ts

@@ -0,0 +1,45 @@
+import { type TypegenManifest } from "../contracts/index.js";
+export type CliTypegenMode = "semantic" | "minimal";
+export type CliRuntimeMode = "centralized" | "standalone";
+export type CliTypegenResult = {
+    written: boolean;
+    path: string;
+    serverPath: string;
+    publicPath: string;
+    manifestVersion: string;
+};
+type TypegenIdentity = {
+    baseUrl: string | null;
+    orgSlug: string;
+    projectSlug: string;
+    stageSlug: string;
+    typegenMode: CliTypegenMode;
+    runtimeMode: CliRuntimeMode;
+    localEnvRoot: string | null;
+};
+/**
+ * Renders the generated SDK declaration files for one manifest.
+ *
+ * @param manifest The decoded typegen manifest.
+ * @param mode The requested typegen mode.
+ * @returns The rendered server and public declaration contents.
+ * @remarks The CLI owns this rendering so it no longer depends on SDK runtime helpers.
+ * @lastModified 2026-03-19
+ * @author GPT-5.4
+ */
+export declare function renderGeneratedTypesForManifest(manifest: TypegenManifest, mode: CliTypegenMode): {
+    serverContents: string;
+    publicContents: string;
+};
+/**
+ * Writes generated SDK declaration files into the installed `@barekey/sdk` package.
+ *
+ * @param manifest The decoded typegen manifest.
+ * @param identity The manifest identity used for metadata freshness.
+ * @returns The typegen write result.
+ * @remarks This preserves the existing generated file locations without importing the SDK package at runtime.
+ * @lastModified 2026-03-19
+ * @author GPT-5.4
+ */
+export declare function writeInstalledSdkGeneratedTypes(manifest: TypegenManifest, identity: TypegenIdentity): Promise<CliTypegenResult>;
+export {};

package/dist/typegen/core.js

@@ -0,0 +1,219 @@
+import { createRequire } from "node:module";
+import { access, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { Schema } from "effect";
+import { TypegenManifestSchema } from "../contracts/index.js";
+const MANIFEST_VERSION_PATTERN = /\/\* barekey-manifest-version: ([^\n]+) \*\//;
+const TypegenMetadataSchema = Schema.Struct({
+    version: Schema.Number,
+    last: Schema.String,
+    baseUrl: Schema.NullOr(Schema.String),
+    orgSlug: Schema.NullOr(Schema.String),
+    projectSlug: Schema.NullOr(Schema.String),
+    stageSlug: Schema.NullOr(Schema.String),
+    typegenMode: Schema.NullOr(Schema.Literal("semantic", "minimal")),
+    runtimeMode: Schema.NullOr(Schema.Literal("centralized", "standalone")),
+    localEnvRoot: Schema.NullOr(Schema.String),
+});
+function renderLinearMilestones(milestones) {
+    if (milestones.length === 0) {
+        return "readonly []";
+    }
+    return `readonly [${milestones
+        .map((milestone) => `readonly [${JSON.stringify(milestone.at)}, ${String(milestone.percentage)}]`)
+        .join(", ")}]`;
+}
+function renderRolloutMetadataType(row) {
+    const renderedMilestones = renderLinearMilestones(row.rolloutMilestones ?? []);
+    if (row.rolloutFunction === "step") {
+        return `Step<${renderedMilestones}>`;
+    }
+    if (row.rolloutFunction === "ease_in_out") {
+        return `EaseInOut<${renderedMilestones}>`;
+    }
+    return `Linear<${renderedMilestones}>`;
+}
+function renderVariableType(row, mode) {
+    if (mode === "minimal") {
+        return row.typeScriptType;
+    }
+    const descriptor = `{ Type: ${row.typeScriptType}; Kind: ${JSON.stringify(row.kind)}; Visibility: ${JSON.stringify(row.visibility)}; Rollout: ${row.kind === "rollout" ? renderRolloutMetadataType(row) : "never"} }`;
+    return `Env<${descriptor}>`;
+}
+function buildGeneratedTypesContents(manifest, input) {
+    const mapLines = manifest.variables
+        .slice()
+        .filter(input.include)
+        .sort((left, right) => left.name.localeCompare(right.name))
+        .map((row) => `    ${JSON.stringify(row.name)}: ${renderVariableType(row, input.mode)};`)
+        .join("\n");
+    const importLine = input.mode === "semantic"
+        ? `import type { EaseInOut, Env, Linear, Step } from "${input.typeModulePath}";\n\n`
+        : "";
+    return `/* eslint-disable */\n/* This file is generated by barekey typegen. */\n/* barekey-manifest-version: ${manifest.manifestVersion} */\n\n${importLine}declare module "${input.declaredModulePath}" {\n  interface ${input.interfaceName} {\n${mapLines.length > 0 ? mapLines : ""}\n  }\n}\n\nexport {};\n`;
+}
+function readManifestVersion(contents) {
+    return contents?.match(MANIFEST_VERSION_PATTERN)?.[1]?.trim() ?? null;
+}
+async function readTextFile(filePath) {
+    try {
+        return await readFile(filePath, "utf8");
+    }
+    catch (error) {
+        const nodeError = error;
+        if (nodeError?.code === "ENOENT") {
+            return null;
+        }
+        throw error;
+    }
+}
+async function writeTextFileAtomic(filePath, value) {
+    const temporaryPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+    try {
+        await writeFile(temporaryPath, value, "utf8");
+        await rename(temporaryPath, filePath);
+    }
+    catch (error) {
+        try {
+            await unlink(temporaryPath);
+        }
+        catch {
+            // Best-effort cleanup only.
+        }
+        throw error;
+    }
+}
+async function resolveInstalledSdkTypegenTarget() {
+    const require = createRequire(path.join(process.cwd(), "__barekey_typegen__.cjs"));
+    let resolvedEntrypoint;
+    try {
+        resolvedEntrypoint = require.resolve("@barekey/sdk/package.json");
+    }
+    catch {
+        return null;
+    }
+    let current = path.dirname(resolvedEntrypoint);
+    while (true) {
+        const candidatePackageJson = path.join(current, "package.json");
+        const rawPackageJson = await readTextFile(candidatePackageJson);
+        if (rawPackageJson !== null) {
+            try {
+                const parsed = JSON.parse(rawPackageJson);
+                if (parsed.name === "@barekey/sdk") {
+                    const serverGeneratedTypesPath = path.join(current, "generated.server.d.ts");
+                    const publicGeneratedTypesPath = path.join(current, "generated.public.d.ts");
+                    await access(serverGeneratedTypesPath);
+                    await access(publicGeneratedTypesPath);
+                    return {
+                        packageRoot: current,
+                        serverGeneratedTypesPath,
+                        publicGeneratedTypesPath,
+                        typegenMetadataPath: path.join(current, "typegen.json"),
+                    };
+                }
+            }
+            catch {
+                // Keep walking upward.
+            }
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            return null;
+        }
+        current = parent;
+    }
+}
+function buildTypegenMetadataContents(lastGeneratedAt, identity) {
+    return `${JSON.stringify({
+        version: 1,
+        last: lastGeneratedAt.toISOString(),
+        baseUrl: identity.baseUrl,
+        orgSlug: identity.orgSlug,
+        projectSlug: identity.projectSlug,
+        stageSlug: identity.stageSlug,
+        typegenMode: identity.typegenMode,
+        runtimeMode: identity.runtimeMode,
+        localEnvRoot: identity.localEnvRoot,
+    }, null, 2)}\n`;
+}
+/**
+ * Renders the generated SDK declaration files for one manifest.
+ *
+ * @param manifest The decoded typegen manifest.
+ * @param mode The requested typegen mode.
+ * @returns The rendered server and public declaration contents.
+ * @remarks The CLI owns this rendering so it no longer depends on SDK runtime helpers.
+ * @lastModified 2026-03-19
+ * @author GPT-5.4
+ */
+export function renderGeneratedTypesForManifest(manifest, mode) {
+    const decodedManifest = Schema.decodeUnknownSync(TypegenManifestSchema)(manifest);
+    return {
+        serverContents: buildGeneratedTypesContents(decodedManifest, {
+            mode,
+            typeModulePath: "./dist/types.js",
+            declaredModulePath: "./dist/types.js",
+            interfaceName: "BarekeyGeneratedTypeMap",
+            include: () => true,
+        }),
+        publicContents: buildGeneratedTypesContents(decodedManifest, {
+            mode,
+            typeModulePath: "./dist/public-types.js",
+            declaredModulePath: "./dist/public-types.js",
+            interfaceName: "BarekeyPublicGeneratedTypeMap",
+            include: (row) => row.visibility === "public",
+        }),
+    };
+}
+/**
+ * Writes generated SDK declaration files into the installed `@barekey/sdk` package.
+ *
+ * @param manifest The decoded typegen manifest.
+ * @param identity The manifest identity used for metadata freshness.
+ * @returns The typegen write result.
+ * @remarks This preserves the existing generated file locations without importing the SDK package at runtime.
+ * @lastModified 2026-03-19
+ * @author GPT-5.4
+ */
+export async function writeInstalledSdkGeneratedTypes(manifest, identity) {
+    const target = await resolveInstalledSdkTypegenTarget();
+    if (target === null) {
+        return {
+            written: false,
+            path: "",
+            serverPath: "",
+            publicPath: "",
+            manifestVersion: manifest.manifestVersion,
+        };
+    }
+    const [existingServerContents, existingPublicContents] = await Promise.all([
+        readTextFile(target.serverGeneratedTypesPath),
+        readTextFile(target.publicGeneratedTypesPath),
+    ]);
+    const rendered = renderGeneratedTypesForManifest(manifest, identity.typegenMode);
+    if (existingServerContents === rendered.serverContents &&
+        existingPublicContents === rendered.publicContents &&
+        readManifestVersion(existingServerContents) === manifest.manifestVersion &&
+        readManifestVersion(existingPublicContents) === manifest.manifestVersion) {
+        await writeTextFileAtomic(target.typegenMetadataPath, buildTypegenMetadataContents(new Date(), identity));
+        return {
+            written: false,
+            path: target.serverGeneratedTypesPath,
+            serverPath: target.serverGeneratedTypesPath,
+            publicPath: target.publicGeneratedTypesPath,
+            manifestVersion: manifest.manifestVersion,
+        };
+    }
+    await Promise.all([
+        writeTextFileAtomic(target.serverGeneratedTypesPath, rendered.serverContents),
+        writeTextFileAtomic(target.publicGeneratedTypesPath, rendered.publicContents),
+    ]);
+    await writeTextFileAtomic(target.typegenMetadataPath, buildTypegenMetadataContents(new Date(), identity));
+    return {
+        written: true,
+        path: target.serverGeneratedTypesPath,
+        serverPath: target.serverGeneratedTypesPath,
+        publicPath: target.publicGeneratedTypesPath,
+        manifestVersion: manifest.manifestVersion,
+    };
+}

package/dist/types.d.ts

@@ -4,10 +4,12 @@ export type CliCredentials = {
     accessTokenExpiresAtMs: number;
     refreshTokenExpiresAtMs: number;
     clerkUserId: string;
-    orgId: string;
-    orgSlug: string;
+    orgId: string | null;
+    orgSlug: string | null;
+    lastOrgId?: string | null;
+    lastOrgSlug?: string | null;
 };
 export type CliConfig = {
     baseUrl: string;
-    activeAccountId: string;
+    activeSessionId: string;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@barekey/cli",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "description": "Barekey command line interface",
   "type": "module",
   "bin": {
@@ -15,8 +15,8 @@
   "packageManager": "bun@1.2.22",
   "dependencies": {
     "@clack/prompts": "^0.11.0",
-    "@barekey/sdk": "^0.5.0",
     "commander": "^14.0.1",
+    "effect": "3.19.19",
     "open": "^10.2.0",
     "picocolors": "^1.1.1"
   },

package/src/auth-provider.ts

@@ -1,6 +1,7 @@
 import { postJson } from "./http.js";
 import type { CliCredentials } from "./types.js";
 import { loadConfig, loadCredentials, saveCredentials } from "./credentials-store.js";
+import { buildSessionId } from "./context/session-id.js";
 
 type CliAuthProvider = {
   getAccessToken(): Promise<string>;
@@ -13,7 +14,7 @@ export function createCliAuthProvider(): CliAuthProvider {
 
   async function readCurrentCredentials(): Promise<{
     baseUrl: string;
-    accountId: string;
+    sessionId: string;
     credentials: CliCredentials;
   }> {
     const config = await loadConfig();
@@ -21,7 +22,7 @@ export function createCliAuthProvider(): CliAuthProvider {
       throw new Error("Not logged in. Run barekey login first.");
     }
 
-    const credentials = await loadCredentials(config.activeAccountId);
+    const credentials = await loadCredentials(config.activeSessionId);
     if (credentials === null) {
       throw new Error("CLI credentials are missing. Run barekey login again.");
     }
@@ -30,13 +31,13 @@ export function createCliAuthProvider(): CliAuthProvider {
 
     return {
       baseUrl: config.baseUrl,
-      accountId: config.activeAccountId,
+      sessionId: config.activeSessionId,
       credentials,
     };
   }
 
   async function refreshIfNeeded(): Promise<CliCredentials> {
-    const { baseUrl, accountId, credentials } = await readCurrentCredentials();
+    const { baseUrl, credentials } = await readCurrentCredentials();
     const now = Date.now();
     if (!forceRefresh && credentials.accessTokenExpiresAtMs > now + 10_000) {
       return credentials;
@@ -66,9 +67,11 @@ export function createCliAuthProvider(): CliAuthProvider {
       clerkUserId: refreshed.clerkUserId,
       orgId: refreshed.orgId,
       orgSlug: refreshed.orgSlug,
+      lastOrgId: refreshed.orgId,
+      lastOrgSlug: refreshed.orgSlug,
     };
 
-    await saveCredentials(accountId, nextCredentials);
+    await saveCredentials(buildSessionId(baseUrl, refreshed.clerkUserId), nextCredentials);
     cachedCredentials = nextCredentials;
     forceRefresh = false;
     return nextCredentials;

package/src/command-utils.ts

@@ -49,14 +49,14 @@ export async function requireLocalSession(): Promise<LocalSession> {
     throw new Error("Not logged in. Run barekey auth login first.");
   }
 
-  const credentials = await loadCredentials(config.activeAccountId);
+  const credentials = await loadCredentials(config.activeSessionId);
   if (credentials === null) {
     throw new Error("Saved credentials not found. Run barekey auth login again.");
   }
 
   return {
     baseUrl: config.baseUrl,
-    accountId: config.activeAccountId,
+    accountId: config.activeSessionId,
     credentials,
   };
 }
@@ -74,14 +74,14 @@ export async function resolveTarget(
 
   const projectSlug = options.project?.trim() || runtime?.config.project || "";
   const stageSlug = options.stage?.trim() || runtime?.config.environment || "";
-  const orgSlug = options.org?.trim() || runtime?.config.org || local?.credentials.orgSlug || "";
+  const orgSlug = options.org?.trim() || runtime?.config.org || "";
 
-  if (!isStandalone && (projectSlug.length === 0 || stageSlug.length === 0)) {
+  if (!isStandalone && (orgSlug.length === 0 || projectSlug.length === 0 || stageSlug.length === 0)) {
     const hint = runtime
-      ? `Found ${runtime.path} but project/environment is incomplete.`
+      ? `Found ${runtime.path} but organization/project/environment is incomplete.`
       : "No barekey.json found in current directory tree.";
     throw new Error(
-      `${hint} Pass --project/--stage, or create barekey.json with {"organization":"...","project":"...","environment":"..."}.`,
+      `${hint} Run barekey init or pass --org/--project/--stage.`,
     );
   }
 

package/src/commands/audit.ts

@@ -0,0 +1,63 @@
+import { Command } from "commander";
+
+import { createCliAuthProvider } from "../auth-provider.js";
+import { requireLocalSession, toJsonOutput, type EnvTargetOptions } from "../command-utils.js";
+import { AuditListResponseSchema } from "../contracts/index.js";
+import { postJson } from "../http.js";
+import { promptForOrganizationSlug } from "./target-prompts.js";
+
+async function runAuditList(
+  options: EnvTargetOptions & {
+    limit?: string;
+    json?: boolean;
+  },
+) {
+  const local = await requireLocalSession();
+  const authProvider = createCliAuthProvider();
+  const accessToken = await authProvider.getAccessToken();
+  const orgSlug = await promptForOrganizationSlug(options.org);
+  const limit = options.limit ? Number.parseInt(options.limit, 10) : 25;
+
+  const response = await postJson({
+    baseUrl: local.baseUrl,
+    path: "/v1/cli/audit/list",
+    accessToken,
+    payload: {
+      orgSlug,
+      projectSlug: options.project?.trim() || null,
+      limit: Number.isFinite(limit) ? limit : 25,
+    },
+    schema: AuditListResponseSchema,
+  });
+
+  if (options.json) {
+    toJsonOutput(true, response);
+    return;
+  }
+
+  if (response.items.length === 0) {
+    console.log("No audit events found.");
+    return;
+  }
+
+  for (const item of response.items) {
+    console.log(`${new Date(item.occurredAtMs).toISOString()} ${item.category} ${item.title}`);
+  }
+}
+
+export function registerAuditCommands(program: Command): void {
+  const audit = program.command("audit").description("Audit history");
+
+  audit
+    .command("list")
+    .description("List recent audit events")
+    .option("--org <slug>", "Organization slug")
+    .option("--project <slug>", "Project slug")
+    .option("--limit <count>", "Maximum number of events", "25")
+    .option("--json", "Machine-readable output", false)
+    .action(
+      async (options: EnvTargetOptions & { limit?: string; json?: boolean }) => {
+        await runAuditList(options);
+      },
+    );
+}

package/src/commands/auth.ts

@@ -7,12 +7,19 @@ import pc from "picocolors";
 import open from "open";
 
 import { createCliAuthProvider } from "../auth-provider.js";
+import { buildSessionId } from "../context/session-id.js";
 import {
   clearConfig,
   deleteCredentials,
   saveConfig,
   saveCredentials,
 } from "../credentials-store.js";
+import {
+  CliSessionResponseSchema,
+  DevicePollResponseSchema,
+  DeviceStartResponseSchema,
+  RefreshResponseSchema,
+} from "../contracts/index.js";
 import { getJson, postJson } from "../http.js";
 import { requireLocalSession, resolveBaseUrl, toJsonOutput } from "../command-utils.js";
 
@@ -50,6 +57,14 @@ function resolveVerificationUri(baseUrl: string, verificationUri: string): strin
   return verificationUri;
 }
 
+function resolveDisplayName(input: {
+  displayName: string | null;
+  clerkUserId: string;
+}): string {
+  const displayName = input.displayName?.trim();
+  return displayName && displayName.length > 0 ? displayName : input.clerkUserId;
+}
+
 async function runLogin(options: { baseUrl?: string }): Promise<void> {
   const baseUrl = await resolveBaseUrl(options.baseUrl);
   intro("Barekey CLI login");
@@ -60,18 +75,13 @@ async function runLogin(options: { baseUrl?: string }): Promise<void> {
   let pollActive = false;
 
   try {
-    const started = await postJson<{
-      deviceCode: string;
-      userCode: string;
-      verificationUri: string;
-      intervalSec: number;
-      expiresInSec: number;
-    }>({
+    const started = await postJson({
       baseUrl,
       path: "/v1/cli/device/start",
       payload: {
         clientName: resolveClientName(),
       },
+      schema: DeviceStartResponseSchema,
     });
     const verificationUri = resolveVerificationUri(baseUrl, started.verificationUri);
 
@@ -93,27 +103,13 @@ async function runLogin(options: { baseUrl?: string }): Promise<void> {
     pollActive = true;
 
     while (Date.now() < expiresAtMs) {
-      const poll = await postJson<
-        | {
-            status: "pending";
-            intervalSec: number;
-          }
-        | {
-            status: "approved";
-            accessToken: string;
-            refreshToken: string;
-            accessTokenExpiresAtMs: number;
-            refreshTokenExpiresAtMs: number;
-            orgId: string;
-            orgSlug: string;
-            clerkUserId: string;
-          }
-      >({
+      const poll = await postJson({
         baseUrl,
         path: "/v1/cli/device/poll",
         payload: {
           deviceCode: started.deviceCode,
         },
+        schema: DevicePollResponseSchema,
       });
 
       if (poll.status === "pending") {
@@ -121,24 +117,38 @@ async function runLogin(options: { baseUrl?: string }): Promise<void> {
         continue;
       }
 
-      const accountId = `${poll.orgSlug}:${poll.clerkUserId}`;
-      await saveCredentials(accountId, {
+      const refreshed = RefreshResponseSchema.make({
         accessToken: poll.accessToken,
         refreshToken: poll.refreshToken,
         accessTokenExpiresAtMs: poll.accessTokenExpiresAtMs,
         refreshTokenExpiresAtMs: poll.refreshTokenExpiresAtMs,
-        clerkUserId: poll.clerkUserId,
         orgId: poll.orgId,
         orgSlug: poll.orgSlug,
+        clerkUserId: poll.clerkUserId,
+        displayName: poll.displayName,
+        email: poll.email,
+      });
+      const sessionId = buildSessionId(baseUrl, refreshed.clerkUserId);
+
+      await saveCredentials(sessionId, {
+        accessToken: refreshed.accessToken,
+        refreshToken: refreshed.refreshToken,
+        accessTokenExpiresAtMs: refreshed.accessTokenExpiresAtMs,
+        refreshTokenExpiresAtMs: refreshed.refreshTokenExpiresAtMs,
+        clerkUserId: refreshed.clerkUserId,
+        orgId: refreshed.orgId,
+        orgSlug: refreshed.orgSlug,
+        lastOrgId: refreshed.orgId,
+        lastOrgSlug: refreshed.orgSlug,
       });
       await saveConfig({
         baseUrl,
-        activeAccountId: accountId,
+        activeSessionId: sessionId,
       });
 
       pollSpinner.stop("Login approved");
       pollActive = false;
-      outro(`Logged in as ${pc.bold(poll.clerkUserId)} in ${pc.bold(poll.orgSlug)}.`);
+      outro(`Signed in as ${pc.bold(resolveDisplayName(refreshed))}.`);
       return;
     }
 
@@ -158,7 +168,7 @@ async function runLogin(options: { baseUrl?: string }): Promise<void> {
 
 async function runLogout(): Promise<void> {
   const local = await requireLocalSession();
-  await postJson<{ revoked: boolean }>({
+  await postJson({
     baseUrl: local.baseUrl,
     path: "/v1/cli/logout",
     payload: {
@@ -174,15 +184,11 @@ async function runWhoami(options: { json?: boolean }): Promise<void> {
   const local = await requireLocalSession();
   const authProvider = createCliAuthProvider();
   const accessToken = await authProvider.getAccessToken();
-  const session = await getJson<{
-    clerkUserId: string;
-    orgId: string;
-    orgSlug: string;
-    source: "clerk" | "cli";
-  }>({
+  const session = await getJson({
     baseUrl: local.baseUrl,
     path: "/v1/cli/session",
     accessToken,
+    schema: CliSessionResponseSchema,
   });
 
   if (options.json) {
@@ -190,9 +196,10 @@ async function runWhoami(options: { json?: boolean }): Promise<void> {
     return;
   }
 
-  console.log(`${pc.bold("User")}: ${session.clerkUserId}`);
-  console.log(`${pc.bold("Org")}: ${session.orgSlug}`);
-  console.log(`${pc.bold("Source")}: ${session.source}`);
+  console.log(resolveDisplayName(session));
+  if (session.email !== null) {
+    console.log(session.email);
+  }
 }
 
 export function registerAuthCommands(program: Command): void {
@@ -221,7 +228,6 @@ export function registerAuthCommands(program: Command): void {
       await runWhoami(options);
     });
 
-  // Backward-compatible top-level auth aliases.
   program
     .command("login")
     .description("Alias for barekey auth login")