@cimplify/cli 0.15.0 → 0.15.1

package/README.md

@@ -34,7 +34,7 @@ cimplify lint --fix --format json               # safe fixes + stable machine-re
 ## Conventions
 
 - **Project link:** `cimplify link <project-id>` writes `.cimplify/project.json` in the working directory. Subsequent commands read it to know which project to act on — no `--project` flag needed for the common case.
-- **Auth:** credentials persist at `~/.config/cimplify/auth.json`. CI uses `--api-key dk_live_…` to skip the browser.
+- **Auth:** credentials persist at `~/.config/cimplify/auth.json`. Headless login accepts a user-bound Personal key via `--api-key cak_…`.
 - **JSON mode:** pass `--json` (or set `CIMPLIFY_JSON=1`) for `{ ok, data | error }` machine-readable output on stdout.
 - **Lint rules:** `cimplify lint` reads the current project's `@cimplify/sdk/lint-rules` JSON as bounded, validated data and falls back to the rule set bundled with the CLI when an older SDK has no rules asset. It never imports project code. Exit 0 means clean, 1 means diagnostics remain, and 2 means the lint run itself could not start.
 - **Yes/no prompts:** pass `--yes` (or `-y`) to auto-confirm.

package/dist/{add-EPY25NNV.mjs → add-X3OUBJ7D.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { promptYesNo } from './chunk-TH4XENKH.mjs';
-import { REGISTRY_INDEX, REGISTRY } from './chunk-YJDQYKZU.mjs';
+import { REGISTRY_INDEX, REGISTRY } from './chunk-MTEMM6WI.mjs';
 import { parseArgs, flagString, flagBool } from './chunk-5KYR6WJB.mjs';
 import { CliError, CLI_ERROR_CODE, info, bold, dim, success, result, yellow } from './chunk-3QUK5BPY.mjs';
 import { mkdirSync, existsSync, writeFileSync } from 'fs';

package/dist/{auth-step-up-VL742AS7.mjs → auth-step-up-Z6KOTTV7.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { startLoopbackServer, generateState, openBrowser } from './chunk-3KRSHO6J.mjs';
+import { startLoopbackServer, generateState, generatePkcePair, openBrowser } from './chunk-DMLQBAGC.mjs';
 import { parseArgs, flagString, flagBool } from './chunk-5KYR6WJB.mjs';
-import { resolveBaseUrl } from './chunk-NYXA6X56.mjs';
+import { resolveBaseUrl, ApiClient } from './chunk-NYXA6X56.mjs';
 import { readAuth, writeStepUp } from './chunk-MLE4MVYC.mjs';
 import { isJsonMode, CliError, CLI_ERROR_CODE, step, info, dim, success, result } from './chunk-3QUK5BPY.mjs';
 
@@ -9,7 +9,7 @@ import { isJsonMode, CliError, CLI_ERROR_CODE, step, info, dim, success, result
 var FLAG_NO_BROWSER = "no-browser";
 var FLAG_BASE_URL = "base-url";
 var STEP_UP_PATH = "/cli/step-up";
-var STEP_UP_JWT_TTL_MS = 5 * 6e4;
+var STEP_UP_EXCHANGE_PATH = "/v1/auth/cli/step-up/exchange";
 var CALLBACK_TIMEOUT_MS = 10 * 6e4;
 async function run(argv) {
   if (isJsonMode()) {
@@ -26,8 +26,10 @@ async function run(argv) {
   const loopback = await startLoopbackServer(baseUrl);
   const state = generateState();
   const requestId = generateState();
+  const pkce = generatePkcePair();
   const url = new URL(`${dashboardUrl}${STEP_UP_PATH}`);
   url.searchParams.set("request_id", requestId);
+  url.searchParams.set("code_challenge", pkce.codeChallenge);
   url.searchParams.set("redirect_uri", loopback.redirectUri);
   url.searchParams.set("state", state);
   step("Opening browser for fresh-auth...");
@@ -51,20 +53,23 @@ async function run(argv) {
       "Step-up state mismatch. Possible CSRF attempt \u2014 try again."
     );
   }
-  if (!callback.step_up_token) {
-    throw new CliError(
-      CLI_ERROR_CODE.UNAUTHORIZED,
-      "Step-up callback missing step_up_token."
-    );
+  if (!callback.code) {
+    throw new CliError(CLI_ERROR_CODE.UNAUTHORIZED, "Step-up callback missing one-time code.");
   }
+  const exchange = await ApiClient.unauthenticated(baseUrl).post(STEP_UP_EXCHANGE_PATH, {
+    request_id: requestId,
+    code: callback.code,
+    code_verifier: pkce.codeVerifier
+  });
+  const ttlMs = exchange.expires_in_secs * 1e3;
   const token = {
-    token: callback.step_up_token,
-    expiresAt: Date.now() + STEP_UP_JWT_TTL_MS,
+    token: exchange.step_up_token,
+    expiresAt: Date.now() + ttlMs,
     savedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   await writeStepUp(token);
   success(
-    `Step-up complete. Re-run your destructive command within ${Math.round(STEP_UP_JWT_TTL_MS / 6e4)} minutes.`
+    `Step-up complete. Re-run your destructive command within ${Math.max(1, Math.floor(ttlMs / 6e4))} minutes.`
   );
   result({
     step_up_active: true,
@@ -73,10 +78,7 @@ async function run(argv) {
   });
 }
 function deriveDashboardUrl(apiBaseUrl) {
-  return apiBaseUrl.replace(
-    /^https?:\/\/api\./,
-    (m) => m.replace("api.", "app.")
-  );
+  return apiBaseUrl.replace(/^https?:\/\/api\./, (m) => m.replace("api.", "app."));
 }
 
 export { run as default };

package/dist/{chunk-3KRSHO6J.mjs → chunk-DMLQBAGC.mjs}

@@ -11,9 +11,7 @@ var CALLBACK_PATH = "/callback";
 var CALLBACK_TIMEOUT_MS = 10 * 60 * 1e3;
 function generatePkcePair() {
   const codeVerifier = base64UrlEncode(randomBytes(CODE_VERIFIER_BYTES));
-  const codeChallenge = base64UrlEncode(
-    createHash("sha256").update(codeVerifier).digest()
-  );
+  const codeChallenge = base64UrlEncode(createHash("sha256").update(codeVerifier).digest());
   return { codeVerifier, codeChallenge, codeChallengeMethod: "S256" };
 }
 function generateState() {
@@ -69,7 +67,6 @@ async function startLoopbackServer(apiBaseUrl) {
       return;
     }
     const code = parsed.searchParams.get("code");
-    const stepUpToken = parsed.searchParams.get("step_up_token");
     const state = parsed.searchParams.get("state");
     const error = parsed.searchParams.get("error");
     if (error) {
@@ -77,7 +74,7 @@ async function startLoopbackServer(apiBaseUrl) {
       rejectCb?.(new CliError(CLI_ERROR_CODE.UNAUTHORIZED, `OAuth error: ${error}`));
       return;
     }
-    if (!state || !code && !stepUpToken) {
+    if (!state || !code) {
       res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" }).end(HTML_ERROR("Missing code or token in callback"));
       rejectCb?.(new CliError(CLI_ERROR_CODE.UNAUTHORIZED, "Malformed callback"));
       return;
@@ -85,7 +82,6 @@ async function startLoopbackServer(apiBaseUrl) {
     res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" }).end(HTML_SUCCESS(apiBaseUrl));
     resolveCb?.({
       code: code ?? void 0,
-      step_up_token: stepUpToken ?? void 0,
       state
     });
   });
@@ -96,10 +92,7 @@ async function startLoopbackServer(apiBaseUrl) {
   const address = server.address();
   if (!address || typeof address === "string") {
     server.close();
-    throw new CliError(
-      CLI_ERROR_CODE.UNAUTHORIZED,
-      "Could not bind loopback server"
-    );
+    throw new CliError(CLI_ERROR_CODE.UNAUTHORIZED, "Could not bind loopback server");
   }
   const redirectUri = `http://${LOOPBACK_HOST}:${address.port}${CALLBACK_PATH}`;
   return {

package/dist/{chunk-GCQKTUXN.mjs → chunk-MGQD5MEC.mjs}

@@ -2,7 +2,7 @@
 // package.json
 var package_default = {
   name: "@cimplify/cli",
-  version: "0.15.0",
+  version: "0.15.1",
   description: "Cimplify CLI \u2014 deploy, manage env vars, link projects, and scaffold storefronts",
   keywords: [
     "cimplify",
@@ -43,7 +43,7 @@ var package_default = {
     "@babel/parser": "^8.0.4",
     "@babel/traverse": "^8.0.4",
     "@babel/types": "^8.0.4",
-    "@cimplify/sdk": "^0.102.0",
+    "@cimplify/sdk": "^0.104.1",
     re2js: "^1.4.0"
   },
   devDependencies: {
@@ -54,7 +54,7 @@ var package_default = {
     "@typescript/native-preview": "^7.0.0-dev.20260616.1",
     tsup: "^8.5.1",
     typescript: "6.0.3",
-    vitest: "^4.1.9"
+    vitest: "^4.1.10"
   }
 };