@botiverse/hands-cli 0.4.0

package/dist/commands/deploy_tokens.d.ts

@@ -0,0 +1,12 @@
+/**
+ * `quiver deploy-tokens` — mint / list / revoke app-scoped deploy tokens.
+ *
+ * Wires GET/POST/DELETE /api/apps/:appId/deploy-tokens. Requires app admin
+ * (otherwise the API returns an admin-native error telling you who can grant
+ * the role). A created token is printed once — the server stores only a hash —
+ * so capture it immediately (e.g. into a CI secret). Deploy tokens authenticate
+ * against the Quiver API as `Authorization: Bearer <token>`, which the CLI also
+ * reads from the QUIVER_BEARER_TOKEN env var.
+ */
+import type { Command } from "commander";
+export declare function registerDeployTokenCommands(program: Command): void;

package/dist/commands/deploy_tokens.js

@@ -0,0 +1,98 @@
+/**
+ * `quiver deploy-tokens` — mint / list / revoke app-scoped deploy tokens.
+ *
+ * Wires GET/POST/DELETE /api/apps/:appId/deploy-tokens. Requires app admin
+ * (otherwise the API returns an admin-native error telling you who can grant
+ * the role). A created token is printed once — the server stores only a hash —
+ * so capture it immediately (e.g. into a CI secret). Deploy tokens authenticate
+ * against the Quiver API as `Authorization: Bearer <token>`, which the CLI also
+ * reads from the QUIVER_BEARER_TOKEN env var.
+ */
+import { apiRequest } from "../lib/api.js";
+async function resolveAppId(appIdOrSlug) {
+    const isUuid = appIdOrSlug.length === 36 && appIdOrSlug.split("-").length === 5;
+    if (isUuid)
+        return appIdOrSlug;
+    const res = await apiRequest("/api/apps");
+    const match = res.apps.find((a) => a.slug === appIdOrSlug);
+    if (!match) {
+        console.error(`No app with slug '${appIdOrSlug}'.`);
+        process.exit(1);
+    }
+    return match.id;
+}
+export function registerDeployTokenCommands(program) {
+    const dt = program
+        .command("deploy-tokens")
+        .description("Mint, list, and revoke app-scoped deploy tokens (requires app admin).");
+    dt.command("list <appIdOrSlug>")
+        .alias("ls")
+        .description("List an app's deploy tokens (metadata only, no secret values).")
+        .option("--json", "Output JSON.", false)
+        .action(async (appIdOrSlug, opts) => {
+        const appId = await resolveAppId(appIdOrSlug);
+        const res = await apiRequest(`/api/apps/${appId}/deploy-tokens`);
+        if (opts.json) {
+            console.log(JSON.stringify(res, null, 2));
+            return;
+        }
+        if (res.deploy_tokens.length === 0) {
+            console.log("No deploy tokens.");
+            return;
+        }
+        console.log(["NAME", "ROLE", "PREFIX", "EXPIRES", "REVOKED", "ID"].join("\t"));
+        for (const t of res.deploy_tokens) {
+            console.log([
+                t.name,
+                t.app_role,
+                t.token_prefix,
+                t.expires_at ? new Date(t.expires_at).toISOString() : "never",
+                t.revoked_at ? "yes" : "no",
+                t.id.slice(0, 8),
+            ].join("\t"));
+        }
+    });
+    dt.command("create <appIdOrSlug>")
+        .description("Mint a new deploy token. The token is printed once — capture it now.")
+        .requiredOption("--name <name>", "Human label for the token (e.g. github-ci).")
+        .option("--role <role>", "publisher | viewer", "publisher")
+        .option("--expires-in-days <days>", "Expiry in days from now (default: never expires).")
+        .option("--json", "Output JSON.", false)
+        .action(async (appIdOrSlug, opts) => {
+        const appId = await resolveAppId(appIdOrSlug);
+        let expiresAt = null;
+        if (opts.expiresInDays != null) {
+            const days = Number(opts.expiresInDays);
+            if (!Number.isFinite(days) || days <= 0) {
+                console.error("--expires-in-days must be a positive number.");
+                process.exit(1);
+            }
+            expiresAt = Date.now() + days * 24 * 60 * 60 * 1000;
+        }
+        const res = await apiRequest(`/api/apps/${appId}/deploy-tokens`, {
+            method: "POST",
+            body: { name: opts.name, app_role: opts.role, expires_at: expiresAt },
+        });
+        if (opts.json) {
+            console.log(JSON.stringify(res, null, 2));
+            return;
+        }
+        const t = res.deploy_token;
+        console.log(`Deploy token '${t.name}' (${t.app_role}) created.`);
+        console.log(`  id: ${t.id}`);
+        console.log(`  expires: ${t.expires_at ? new Date(t.expires_at).toISOString() : "never"}`);
+        console.log("");
+        console.log("  token (shown once — store it now, e.g. as a CI secret):");
+        console.log(`  ${res.token}`);
+    });
+    dt.command("revoke <appIdOrSlug> <tokenId>")
+        .description("Revoke a deploy token by id.")
+        .action(async (appIdOrSlug, tokenId) => {
+        const appId = await resolveAppId(appIdOrSlug);
+        await apiRequest(`/api/apps/${appId}/deploy-tokens/${tokenId}`, {
+            method: "DELETE",
+        });
+        console.log(`Revoked deploy token ${tokenId}.`);
+    });
+}
+//# sourceMappingURL=deploy_tokens.js.map

package/dist/commands/deploy_tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy_tokens.js","sourceRoot":"","sources":["../../src/commands/deploy_tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAkB3C,KAAK,UAAU,YAAY,CAAC,WAAmB;IAC7C,MAAM,MAAM,GACV,WAAW,CAAC,MAAM,KAAK,EAAE,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IACnE,IAAI,MAAM;QAAE,OAAO,WAAW,CAAC;IAC/B,MAAM,GAAG,GAAG,MAAM,UAAU,CAAqB,WAAW,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,qBAAqB,WAAW,IAAI,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC,EAAE,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,OAAgB;IAC1D,MAAM,EAAE,GAAG,OAAO;SACf,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CACV,uEAAuE,CACxE,CAAC;IAEJ,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC;SAC7B,KAAK,CAAC,IAAI,CAAC;SACX,WAAW,CAAC,gEAAgE,CAAC;SAC7E,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC;SACvC,MAAM,CAAC,KAAK,EAAE,WAAmB,EAAE,IAAwB,EAAE,EAAE;QAC9D,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,UAAU,CAC1B,aAAa,KAAK,gBAAgB,CACnC,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/E,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;YAClC,OAAO,CAAC,GAAG,CACT;gBACE,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO;gBAC7D,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;gBAC3B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACjB,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC;SAC/B,WAAW,CAAC,sEAAsE,CAAC;SACnF,cAAc,CAAC,eAAe,EAAE,6CAA6C,CAAC;SAC9E,MAAM,CAAC,eAAe,EAAE,oBAAoB,EAAE,WAAW,CAAC;SAC1D,MAAM,CACL,0BAA0B,EAC1B,mDAAmD,CACpD;SACA,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC;SACvC,MAAM,CACL,KAAK,EACH,WAAmB,EACnB,IAKC,EACD,EAAE;QACF,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;gBACxC,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACtD,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,UAAU,CAC1B,aAAa,KAAK,gBAAgB,EAClC;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE;SACtE,CACF,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,QAAQ,YAAY,CAAC,CAAC;QACjE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CACT,cAAc,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAC9E,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IAChC,CAAC,CACF,CAAC;IAEJ,EAAE,CAAC,OAAO,CAAC,gCAAgC,CAAC;SACzC,WAAW,CAAC,8BAA8B,CAAC;SAC3C,MAAM,CAAC,KAAK,EAAE,WAAmB,EAAE,OAAe,EAAE,EAAE;QACrD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QAC9C,MAAM,UAAU,CAAC,aAAa,KAAK,kBAAkB,OAAO,EAAE,EAAE;YAC9D,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,wBAAwB,OAAO,GAAG,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/feedback.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `quiver feedback` — agent-friendly ticket triage from the terminal.
+ * Works with app-scoped deploy tokens (viewer for list/show, publisher for
+ * update/comment).
+ */
+import type { Command } from "commander";
+export declare function registerFeedbackCommands(program: Command): void;

package/dist/commands/feedback.js

@@ -0,0 +1,141 @@
+import { writeFile } from "node:fs/promises";
+import { apiRequest } from "../lib/api.js";
+async function resolveAppId(slugOrId) {
+    if (slugOrId.length === 36 && slugOrId.split("-").length === 5)
+        return slugOrId;
+    const res = await apiRequest("/api/apps");
+    const match = res.apps.find((a) => a.slug === slugOrId);
+    if (!match) {
+        console.error(`No app with slug '${slugOrId}'.`);
+        process.exit(1);
+    }
+    return match.id;
+}
+export function registerFeedbackCommands(program) {
+    const feedback = program
+        .command("feedback")
+        .description("Triage feedback/crash tickets.");
+    feedback
+        .command("list <appIdOrSlug>")
+        .description("List tickets, newest first.")
+        .option("--status <status>", "Filter: open | in_progress | resolved | closed.")
+        .option("--kind <kind>", "Filter: feedback | bug | crash.")
+        .option("--json", "Output JSON.", false)
+        .action(async (appIdOrSlug, opts) => {
+        const appId = await resolveAppId(appIdOrSlug);
+        const params = new URLSearchParams();
+        if (opts.status)
+            params.set("status", opts.status);
+        if (opts.kind)
+            params.set("kind", opts.kind);
+        const qs = params.toString();
+        const res = await apiRequest(`/api/apps/${appId}/feedback${qs ? `?${qs}` : ""}`);
+        if (opts.json) {
+            console.log(JSON.stringify(res, null, 2));
+            return;
+        }
+        if (res.tickets.length === 0) {
+            console.log("No tickets.");
+            return;
+        }
+        for (const t of res.tickets) {
+            const preview = t.message.replace(/\s+/g, " ").slice(0, 60);
+            console.log(`${t.id}  ${t.status.padEnd(11)} ${t.kind.padEnd(8)} ` +
+                `${(t.assignee ?? "-").padEnd(16)} v${t.version_name ?? "?"} ` +
+                `[${t.attachment_count}📎 ${t.comment_count}💬]  ${preview}`);
+        }
+    });
+    feedback
+        .command("show <appIdOrSlug> <ticketId>")
+        .description("Show a ticket with device context, attachments, and comments.")
+        .option("--json", "Output JSON.", false)
+        .action(async (appIdOrSlug, ticketId, opts) => {
+        const appId = await resolveAppId(appIdOrSlug);
+        const res = await apiRequest(`/api/apps/${appId}/feedback/${ticketId}`);
+        if (opts.json) {
+            console.log(JSON.stringify(res, null, 2));
+            return;
+        }
+        const t = res.ticket;
+        console.log(`Ticket ${String(t["id"])} (${t["kind"]}, ${t["status"]})`);
+        console.log(`  assignee: ${t["assignee"] ?? "-"}`);
+        console.log(`  version:  ${t["version_name"] ?? "?"} (${t["version_code"] ?? "?"}) · ${t["channel"] ?? "?"}`);
+        console.log(`  device:   ${t["device_model"] ?? "?"} · Android ${t["os_version"] ?? "?"} · ${t["arch"] ?? "?"} · ${t["locale"] ?? "?"}`);
+        console.log(`  device_id: ${t["device_id"] ?? "-"}`);
+        console.log(`  contact:  ${t["contact"] ?? "-"}`);
+        console.log(`  message:`);
+        console.log(String(t["message"] ?? "").split("\n").map((l) => "    " + l).join("\n"));
+        if (res.attachments.length) {
+            console.log(`  attachments:`);
+            for (const a of res.attachments) {
+                console.log(`    ${a.id}  ${a.filename} (${(a.size_bytes / 1024).toFixed(1)} KB)`);
+            }
+        }
+        if (res.comments.length) {
+            console.log(`  comments:`);
+            for (const cm of res.comments) {
+                console.log(`    [${new Date(cm.created_at).toISOString()}] ${cm.author_actor}: ${cm.body}`);
+            }
+        }
+    });
+    feedback
+        .command("update <appIdOrSlug> <ticketId>")
+        .description("Change status and/or assignee.")
+        .option("--status <status>", "open | in_progress | resolved | closed.")
+        .option("--assignee <name>", "Assign to a person/agent; use 'none' to unassign.")
+        .option("--json", "Output JSON.", false)
+        .action(async (appIdOrSlug, ticketId, opts) => {
+        const appId = await resolveAppId(appIdOrSlug);
+        const body = {};
+        if (opts.status)
+            body.status = opts.status;
+        if (opts.assignee !== undefined) {
+            body.assignee = opts.assignee === "none" ? null : opts.assignee;
+        }
+        if (body.status === undefined && body.assignee === undefined) {
+            throw new Error("nothing to update: pass --status and/or --assignee");
+        }
+        const res = await apiRequest(`/api/apps/${appId}/feedback/${ticketId}`, { method: "PATCH", body });
+        if (opts.json) {
+            console.log(JSON.stringify(res, null, 2));
+            return;
+        }
+        console.log(`Updated ticket ${ticketId.slice(0, 8)}.`);
+    });
+    feedback
+        .command("comment <appIdOrSlug> <ticketId> <text>")
+        .description("Add a comment to a ticket.")
+        .option("--json", "Output JSON.", false)
+        .action(async (appIdOrSlug, ticketId, text, opts) => {
+        const appId = await resolveAppId(appIdOrSlug);
+        const res = await apiRequest(`/api/apps/${appId}/feedback/${ticketId}/comments`, { method: "POST", body: { body: text } });
+        if (opts.json) {
+            console.log(JSON.stringify(res, null, 2));
+            return;
+        }
+        console.log(`Commented on ${ticketId.slice(0, 8)}.`);
+    });
+    feedback
+        .command("download-attachment <appIdOrSlug> <ticketId> <attachmentId>")
+        .alias("download")
+        .description("Download a feedback attachment to a file. Saves the raw bytes as-is — " +
+        "Quiver does not unzip or interpret the contents (the producing app owns the format).")
+        .option("-o, --output <path>", "Output file path. Defaults to the server filename in the cwd.")
+        .action(async (appIdOrSlug, ticketId, attachmentId, opts) => {
+        const appId = await resolveAppId(appIdOrSlug);
+        const res = await apiRequest(`/api/apps/${appId}/feedback/${ticketId}/attachments/${attachmentId}`, { raw: true });
+        if (!res.ok) {
+            const detail = await res.text().catch(() => "");
+            console.error(`Download failed: ${res.status} ${res.statusText} ${detail.slice(0, 200)}`);
+            process.exit(1);
+        }
+        const disposition = res.headers.get("content-disposition") ?? "";
+        const match = /filename\*?=(?:UTF-8'')?"?([^";]+)"?/i.exec(disposition);
+        const serverName = match?.[1] ? decodeURIComponent(match[1]) : attachmentId;
+        const outPath = opts.output ?? serverName;
+        const bytes = Buffer.from(await res.arrayBuffer());
+        await writeFile(outPath, bytes);
+        console.log(`Saved ${bytes.length} bytes to ${outPath}`);
+    });
+}
+//# sourceMappingURL=feedback.js.map

package/dist/commands/feedback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"feedback.js","sourceRoot":"","sources":["../../src/commands/feedback.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAgB3C,KAAK,UAAU,YAAY,CAAC,QAAgB;IAC1C,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAgD,WAAW,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,qBAAqB,QAAQ,IAAI,CAAC,CAAC;QACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC,EAAE,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,MAAM,QAAQ,GAAG,OAAO;SACrB,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,gCAAgC,CAAC,CAAC;IAEjD,QAAQ;SACL,OAAO,CAAC,oBAAoB,CAAC;SAC7B,WAAW,CAAC,6BAA6B,CAAC;SAC1C,MAAM,CAAC,mBAAmB,EAAE,iDAAiD,CAAC;SAC9E,MAAM,CAAC,eAAe,EAAE,iCAAiC,CAAC;SAC1D,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC;SACvC,MAAM,CAAC,KAAK,EAAE,WAAmB,EAAE,IAAwD,EAAE,EAAE;QAC9F,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,UAAU,CAC1B,aAAa,KAAK,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACnD,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC3B,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5D,OAAO,CAAC,GAAG,CACT,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG;gBACpD,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,YAAY,IAAI,GAAG,GAAG;gBAC9D,IAAI,CAAC,CAAC,gBAAgB,MAAM,CAAC,CAAC,aAAa,QAAQ,OAAO,EAAE,CAC/D,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,QAAQ;SACL,OAAO,CAAC,+BAA+B,CAAC;SACxC,WAAW,CAAC,+DAA+D,CAAC;SAC5E,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC;SACvC,MAAM,CAAC,KAAK,EAAE,WAAmB,EAAE,QAAgB,EAAE,IAAwB,EAAE,EAAE;QAChF,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,UAAU,CAIzB,aAAa,KAAK,aAAa,QAAQ,EAAE,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,MAAM,CAAC,GAAG,GAAG,CAAC,MAAiC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,UAAU,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,cAAc,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,GAAG,OAAO,CAAC,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QAC9G,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,cAAc,CAAC,IAAI,GAAG,cAAc,CAAC,CAAC,YAAY,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QACzI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,WAAW,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACtF,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC9B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC3B,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBAC9B,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/F,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,QAAQ;SACL,OAAO,CAAC,iCAAiC,CAAC;SAC1C,WAAW,CAAC,gCAAgC,CAAC;SAC7C,MAAM,CAAC,mBAAmB,EAAE,yCAAyC,CAAC;SACtE,MAAM,CAAC,mBAAmB,EAAE,mDAAmD,CAAC;SAChF,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC;SACvC,MAAM,CACL,KAAK,EACH,WAAmB,EACnB,QAAgB,EAChB,IAA4D,EAC5D,EAAE;QACF,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAkD,EAAE,CAAC;QAC/D,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3C,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;QAClE,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,UAAU,CAC1B,aAAa,KAAK,aAAa,QAAQ,EAAE,EACzC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAC1B,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,kBAAkB,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IACzD,CAAC,CACF,CAAC;IAEJ,QAAQ;SACL,OAAO,CAAC,yCAAyC,CAAC;SAClD,WAAW,CAAC,4BAA4B,CAAC;SACzC,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC;SACvC,MAAM,CAAC,KAAK,EAAE,WAAmB,EAAE,QAAgB,EAAE,IAAY,EAAE,IAAwB,EAAE,EAAE;QAC9F,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,UAAU,CAC1B,aAAa,KAAK,aAAa,QAAQ,WAAW,EAClD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CACzC,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,gBAAgB,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEL,QAAQ;SACL,OAAO,CAAC,6DAA6D,CAAC;SACtE,KAAK,CAAC,UAAU,CAAC;SACjB,WAAW,CACV,wEAAwE;QACtE,sFAAsF,CACzF;SACA,MAAM,CAAC,qBAAqB,EAAE,+DAA+D,CAAC;SAC9F,MAAM,CACL,KAAK,EACH,WAAmB,EACnB,QAAgB,EAChB,YAAoB,EACpB,IAAyB,EACzB,EAAE;QACF,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,UAAU,CAC1B,aAAa,KAAK,aAAa,QAAQ,gBAAgB,YAAY,EAAE,EACrE,EAAE,GAAG,EAAE,IAAI,EAAE,CACd,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAChD,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC;QACjE,MAAM,KAAK,GAAG,uCAAuC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxE,MAAM,UAAU,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACnD,MAAM,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,MAAM,aAAa,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC,CACF,CAAC;AACN,CAAC"}

package/dist/commands/login.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `quiver login` — authenticate the CLI.
+ *
+ * v1 flow (browser-required):
+ *   1. CLI prints a URL: https://quiver-worker.../api/auth/login?return_to=...
+ *   2. User opens the URL in any browser, signs in with Raft OAuth.
+ *   3. After login the Worker redirects to /login/raft/callback which is the
+ *      admin SPA — at this point the user has a HttpOnly `quiver_session`
+ *      cookie in their browser for the Worker's origin.
+ *   4. User opens DevTools → Application → Cookies → copies the cookie value.
+ *   5. User runs `quiver login --token <cookie>` (or pastes when prompted).
+ *
+ * CI mode: `QUIVER_SESSION_COOKIE=... quiver whoami` — env var is read
+ * directly, no file storage.
+ *
+ * Why not OAuth Device Flow or PKCE? Raft OAuth today only supports the
+ * browser redirect flow with HttpOnly cookies; the CLI can't intercept
+ * the callback. Headless flow is a v2 (TBD: Raft Device Flow support or
+ * dev-token bypass for service users).
+ */
+import type { Command } from "commander";
+export declare function registerLoginCommands(program: Command): void;

package/dist/commands/login.js

@@ -0,0 +1,129 @@
+/**
+ * `quiver login` — authenticate the CLI.
+ *
+ * v1 flow (browser-required):
+ *   1. CLI prints a URL: https://quiver-worker.../api/auth/login?return_to=...
+ *   2. User opens the URL in any browser, signs in with Raft OAuth.
+ *   3. After login the Worker redirects to /login/raft/callback which is the
+ *      admin SPA — at this point the user has a HttpOnly `quiver_session`
+ *      cookie in their browser for the Worker's origin.
+ *   4. User opens DevTools → Application → Cookies → copies the cookie value.
+ *   5. User runs `quiver login --token <cookie>` (or pastes when prompted).
+ *
+ * CI mode: `QUIVER_SESSION_COOKIE=... quiver whoami` — env var is read
+ * directly, no file storage.
+ *
+ * Why not OAuth Device Flow or PKCE? Raft OAuth today only supports the
+ * browser redirect flow with HttpOnly cookies; the CLI can't intercept
+ * the callback. Headless flow is a v2 (TBD: Raft Device Flow support or
+ * dev-token bypass for service users).
+ */
+import { createInterface } from "node:readline/promises";
+import { stdin, stdout } from "node:process";
+import { apiRequest, getApiBase, QuiverApiError } from "../lib/api.js";
+import { saveConfig, getConfig } from "../lib/config.js";
+async function promptSecret(message) {
+    // Use a raw-mode readline so we can mask input with '*'.
+    const rl = createInterface({ input: stdin, output: stdout, terminal: true });
+    process.stdout.write(message);
+    return new Promise((resolve, reject) => {
+        let input = "";
+        const onData = (chunk) => {
+            const ch = chunk.toString();
+            if (ch === "\n" || ch === "\r" || ch === "\u0004") {
+                process.stdin.removeListener("data", onData);
+                process.stdout.write("\n");
+                rl.close();
+                resolve(input);
+            }
+            else if (ch === "\u0003") {
+                // Ctrl+C
+                process.stdout.write("\n");
+                rl.close();
+                reject(new Error("cancelled"));
+            }
+            else if (ch === "\u007f" || ch === "\b") {
+                // Backspace
+                if (input.length > 0) {
+                    input = input.slice(0, -1);
+                    process.stdout.write("\b \b");
+                }
+            }
+            else {
+                input += ch;
+                process.stdout.write("*");
+            }
+        };
+        process.stdin.on("data", onData);
+    });
+}
+export function registerLoginCommands(program) {
+    const cmd = program
+        .command("login")
+        .description("Authenticate the CLI against the Quiver Worker.")
+        .option("--token <cookie>", "Paste the quiver_session cookie value (from your browser's DevTools).")
+        .option("--api <url>", "Override the Quiver Worker base URL for this login only.")
+        .option("--print-url", "Just print the login URL; don't prompt for a token.", false)
+        .action(async (opts) => {
+        const apiBase = opts.api ?? getApiBase();
+        const loginUrl = `${apiBase}/api/auth/login?return_to=${encodeURIComponent("/cli/callback")}`;
+        if (opts.printUrl) {
+            console.log(loginUrl);
+            return;
+        }
+        console.log("To authenticate the quiver CLI:");
+        console.log("");
+        console.log(`  1. Open this URL in any browser:`);
+        console.log(`     ${loginUrl}`);
+        console.log("");
+        console.log(`  2. Sign in with Raft. You'll land on the admin UI.`);
+        console.log(`  3. Open DevTools → Application → Cookies → copy the value of "quiver_session".`);
+        console.log(`  4. Paste it below.`);
+        console.log("");
+        let token = opts.token;
+        if (!token) {
+            token = await promptSecret("quiver_session cookie value (input is hidden): ");
+            if (token.length < 8) {
+                console.error("Token looks too short (min 8 chars).");
+                process.exit(1);
+            }
+        }
+        // Persist the token + apiBase to config file.
+        saveConfig({ apiBase, sessionCookie: token });
+        console.log(`✔ Saved to ${configDisplayPath()}`);
+        console.log(`  API base: ${apiBase}`);
+        // Verify the token works by calling /api/auth/me.
+        try {
+            await apiRequest("/api/auth/me");
+            console.log(`✔ Token verified — you're logged in.`);
+        }
+        catch (e) {
+            if (e instanceof QuiverApiError && e.status === 401) {
+                console.error(`✘ Token rejected (401). Run \`quiver logout\` and try again.`);
+                process.exit(1);
+            }
+            throw e;
+        }
+    });
+    program
+        .command("logout")
+        .description("Clear the saved session cookie.")
+        .action(() => {
+        const cfg = getConfig();
+        if (!cfg.sessionCookie) {
+            console.log("Not logged in (no saved session cookie).");
+            return;
+        }
+        delete cfg.sessionCookie;
+        saveConfig(cfg);
+        console.log(`✔ Logged out (token cleared from ${configDisplayPath()}).`);
+    });
+}
+function configDisplayPath() {
+    // Mirror getConfig's path resolution for display only.
+    const xdg = process.env.XDG_CONFIG_HOME;
+    const dir = xdg && xdg.length > 0 ? xdg : `${process.env.HOME ?? "~"}/.config`;
+    return `${dir}/quiver/auth.json`;
+}
+// silence "unused import" if user has no cookie in env
+//# sourceMappingURL=login.js.map

package/dist/commands/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEzD,KAAK,UAAU,YAAY,CAAC,OAAe;IACzC,yDAAyD;IACzD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,CAAC,KAAsB,EAAE,EAAE;YACxC,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC5B,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAClD,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC3B,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC;iBAAM,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC3B,SAAS;gBACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC3B,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YACjC,CAAC;iBAAM,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC1C,YAAY;gBACZ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrB,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;oBAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,KAAK,IAAI,EAAE,CAAC;gBACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC;QACF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,MAAM,GAAG,GAAG,OAAO;SAChB,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,iDAAiD,CAAC;SAC9D,MAAM,CACL,kBAAkB,EAClB,uEAAuE,CACxE;SACA,MAAM,CACL,aAAa,EACb,0DAA0D,CAC3D;SACA,MAAM,CAAC,aAAa,EAAE,qDAAqD,EAAE,KAAK,CAAC;SACnF,MAAM,CACL,KAAK,EAAE,IAIN,EAAE,EAAE;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,UAAU,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,GAAG,OAAO,6BAA6B,kBAAkB,CAAC,eAAe,CAAC,EAAE,CAAC;QAE9F,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,QAAQ,QAAQ,EAAE,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;QAChG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,MAAM,YAAY,CACxB,iDAAiD,CAClD,CAAC;YACF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,OAAO,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;gBACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,8CAA8C;QAC9C,UAAU,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,cAAc,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC;QAEtC,kDAAkD;QAClD,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,cAAc,CAAC,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,cAAc,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACpD,OAAO,CAAC,KAAK,CACX,8DAA8D,CAC/D,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CACF,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,iCAAiC,CAAC;SAC9C,MAAM,CAAC,GAAG,EAAE;QACX,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,OAAQ,GAAkC,CAAC,aAAa,CAAC;QACzD,UAAU,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,oCAAoC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,iBAAiB;IACxB,uDAAuD;IACvD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACxC,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,UAAU,CAAC;IAC/E,OAAO,GAAG,GAAG,mBAAmB,CAAC;AACnC,CAAC;AAED,uDAAuD"}

package/dist/commands/releases.d.ts

@@ -0,0 +1,5 @@
+/**
+ * `quiver releases` — release operations that are not part of build publish.
+ */
+import type { Command } from "commander";
+export declare function registerReleaseCommands(program: Command): void;

package/dist/commands/releases.js

@@ -0,0 +1,200 @@
+/**
+ * `quiver releases` — release operations that are not part of build publish.
+ */
+import { readFileSync } from "node:fs";
+import { apiRequest } from "../lib/api.js";
+import { readEnv } from "../lib/env.js";
+const DEFAULT_SHARE_TTL_SECONDS = "604800";
+export function registerReleaseCommands(program) {
+    const releases = program
+        .command("releases")
+        .description("Manage release shares.");
+    releases
+        .command("show <appIdOrSlug> <releaseId>")
+        .description("Show a release (status, changelog, rollout) for review.")
+        .option("--json", "Output JSON.", false)
+        .action(async (appIdOrSlug, releaseId, opts) => {
+        const appId = await resolveAppId(appIdOrSlug);
+        const detail = await apiRequest(`/api/apps/${appId}/releases/${releaseId}`);
+        if (opts.json) {
+            console.log(JSON.stringify(detail, null, 2));
+            return;
+        }
+        const r = detail.release;
+        console.log(`Release ${r.id}`);
+        console.log(`  status:  ${r.status}`);
+        console.log(`  rollout: ${r.rollout_cohort_count ?? 100}%`);
+        console.log(`  changelog:`);
+        console.log((r.changelog ?? "(none)").split("\n").map((l) => "    " + l).join("\n"));
+    });
+    releases
+        .command("update <appIdOrSlug> <releaseId>")
+        .description("Update a draft/active release; use to write the reviewed changelog before publish.")
+        .option("--changelog <text>", "Changelog text. Repeatable with lang=text for multiple languages.", (value, prev = []) => [...prev, value])
+        .option("--changelog-file <path>", "Changelog file. Repeatable with lang=path, e.g. --changelog-file zh=zh.md --changelog-file en=en.md.", (value, prev = []) => [...prev, value])
+        .option("--json", "Output JSON.", false)
+        .action(async (appIdOrSlug, releaseId, opts) => {
+        const appId = await resolveAppId(appIdOrSlug);
+        // Each entry is either "text/path" (single-language plain changelog)
+        // or "lang=text/path". Language keys are normalized: zh -> zh-CN.
+        const langAliases = { zh: "zh-CN", cn: "zh-CN" };
+        const byLang = {};
+        let plain;
+        const consume = (entry, fromFile) => {
+            const eq = entry.indexOf("=");
+            if (eq > 0 && eq <= 10) {
+                const langRaw = entry.slice(0, eq).trim().toLowerCase();
+                const lang = langAliases[langRaw] ?? langRaw;
+                const value = entry.slice(eq + 1);
+                byLang[lang] = (fromFile ? readFileSync(value, "utf8") : value).trim();
+            }
+            else {
+                plain = (fromFile ? readFileSync(entry, "utf8") : entry).trim();
+            }
+        };
+        for (const entry of opts.changelog ?? [])
+            consume(entry, false);
+        for (const entry of opts.changelogFile ?? [])
+            consume(entry, true);
+        let changelog;
+        const langs = Object.keys(byLang);
+        if (langs.length > 0) {
+            if (plain !== undefined) {
+                throw new Error("mix of plain and lang= changelog entries; pick one style");
+            }
+            changelog = JSON.stringify(byLang);
+        }
+        else if (plain !== undefined) {
+            changelog = plain;
+        }
+        if (changelog === undefined) {
+            throw new Error("nothing to update: pass --changelog(-file) [lang=]value, e.g. --changelog-file zh=zh.md --changelog-file en=en.md");
+        }
+        const updated = await apiRequest(`/api/apps/${appId}/releases/${releaseId}`, { method: "PATCH", body: { changelog } });
+        if (opts.json) {
+            console.log(JSON.stringify(updated, null, 2));
+            return;
+        }
+        console.log(`Updated release ${releaseId} changelog${langs.length ? ` (${langs.join(", ")})` : ""}.`);
+    });
+    releases
+        .command("publish <appIdOrSlug> <releaseId>")
+        .description("Publish a draft release (the explicit human/agent step after changelog review).")
+        .option("--json", "Output JSON.", false)
+        .action(async (appIdOrSlug, releaseId, opts) => {
+        const appId = await resolveAppId(appIdOrSlug);
+        const result = await apiRequest(`/api/apps/${appId}/releases/${releaseId}/publish`, { method: "POST", body: {} });
+        if (opts.json) {
+            console.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        console.log(`Published release ${releaseId}.`);
+    });
+    releases
+        .command("share <appIdOrSlug> <releaseId>")
+        .description("Create a revocable public share page for a release.")
+        .option("--ttl-seconds <seconds>", "Share lifetime in seconds.", DEFAULT_SHARE_TTL_SECONDS)
+        .option("--expires-at <millis>", "Absolute expiration as Unix milliseconds.")
+        .option("--password <password>", "Password-protect the share page (or set QUIVER_SHARE_PASSWORD to keep it out of shell history).")
+        .option("--json", "Output JSON.", false)
+        .action(async (appIdOrSlug, releaseId, opts) => {
+        const appId = await resolveAppId(appIdOrSlug);
+        const body = {};
+        if (opts.expiresAt) {
+            body.expires_at = parsePositiveNumber(opts.expiresAt, "--expires-at");
+        }
+        else {
+            body.ttl_seconds = parsePositiveNumber(opts.ttlSeconds ?? DEFAULT_SHARE_TTL_SECONDS, "--ttl-seconds");
+        }
+        const password = opts.password ?? readEnv("SHARE_PASSWORD");
+        if (password)
+            body.password = password;
+        const share = await apiRequest(`/api/apps/${appId}/releases/${releaseId}/shares`, { method: "POST", body });
+        if (opts.json) {
+            console.log(JSON.stringify(share, null, 2));
+            return;
+        }
+        console.log(`Created release share ${share.id}`);
+        console.log(`  url:        ${share.share_url ?? ""}`);
+        console.log(`  expires_at: ${new Date(share.expires_at).toISOString()}`);
+        if (body.password)
+            console.log("  password:   protected");
+    });
+    releases
+        .command("shares <appIdOrSlug> <releaseId>")
+        .description("List public shares for a release.")
+        .option("--json", "Output JSON.", false)
+        .action(async (appIdOrSlug, releaseId, opts) => {
+        const appId = await resolveAppId(appIdOrSlug);
+        const res = await apiRequest(`/api/apps/${appId}/releases/${releaseId}/shares`);
+        if (opts.json) {
+            console.log(JSON.stringify(res, null, 2));
+            return;
+        }
+        if (res.shares.length === 0) {
+            console.log("No release shares.");
+            return;
+        }
+        for (const share of res.shares) {
+            const state = share.revoked_at ? "revoked" : Date.now() >= share.expires_at ? "expired" : "active";
+            console.log(`${share.id}  ${state}  expires=${new Date(share.expires_at).toISOString()}`);
+        }
+    });
+    releases
+        .command("update-share <appIdOrSlug> <releaseId> <shareId>")
+        .description("Renew or change a public release share expiration.")
+        .option("--ttl-seconds <seconds>", "New lifetime in seconds from now.", DEFAULT_SHARE_TTL_SECONDS)
+        .option("--expires-at <millis>", "Absolute expiration as Unix milliseconds.")
+        .option("--json", "Output JSON.", false)
+        .action(async (appIdOrSlug, releaseId, shareId, opts) => {
+        const appId = await resolveAppId(appIdOrSlug);
+        const body = {};
+        if (opts.expiresAt) {
+            body.expires_at = parsePositiveNumber(opts.expiresAt, "--expires-at");
+        }
+        else {
+            body.ttl_seconds = parsePositiveNumber(opts.ttlSeconds ?? DEFAULT_SHARE_TTL_SECONDS, "--ttl-seconds");
+        }
+        const share = await apiRequest(`/api/apps/${appId}/releases/${releaseId}/shares/${shareId}`, { method: "PATCH", body });
+        if (opts.json) {
+            console.log(JSON.stringify(share, null, 2));
+            return;
+        }
+        console.log(`Updated release share ${share.id}`);
+        console.log(`  expires_at: ${new Date(share.expires_at).toISOString()}`);
+    });
+    releases
+        .command("revoke-share <appIdOrSlug> <releaseId> <shareId>")
+        .description("Revoke a public release share.")
+        .option("--json", "Output JSON.", false)
+        .action(async (appIdOrSlug, releaseId, shareId, opts) => {
+        const appId = await resolveAppId(appIdOrSlug);
+        const res = await apiRequest(`/api/apps/${appId}/releases/${releaseId}/shares/${shareId}`, { method: "DELETE" });
+        if (opts.json) {
+            console.log(JSON.stringify(res, null, 2));
+            return;
+        }
+        console.log(`Revoked release share ${res.id}`);
+        console.log(`  revoked_at: ${new Date(res.revoked_at).toISOString()}`);
+    });
+}
+async function resolveAppId(slugOrId) {
+    if (slugOrId.length === 36 && slugOrId.split("-").length === 5) {
+        return slugOrId;
+    }
+    const res = await apiRequest("/api/apps");
+    const match = res.apps.find((a) => a.slug === slugOrId);
+    if (!match) {
+        console.error(`No app with slug '${slugOrId}'.`);
+        process.exit(1);
+    }
+    return match.id;
+}
+function parsePositiveNumber(value, flag) {
+    const parsed = Number(value);
+    if (!Number.isFinite(parsed) || parsed <= 0) {
+        throw new Error(`${flag} must be a positive number`);
+    }
+    return Math.floor(parsed);
+}
+//# sourceMappingURL=releases.js.map