@compilr-dev/cli 0.5.0 → 0.5.2

package/dist/auth/api-client.d.ts

@@ -0,0 +1,124 @@
+/**
+ * API Client for CLI Authentication
+ *
+ * All backend communication goes through Netlify Functions.
+ * No direct Supabase SDK dependency — the server handles Supabase calls.
+ *
+ * Note: This is for USER authentication only — users still bring their own LLM API keys.
+ */
+export interface RefreshTokenResponse {
+    success: boolean;
+    access_token?: string;
+    refresh_token?: string;
+    expires_in?: number;
+    user?: {
+        id: string;
+        email: string;
+    };
+    error?: string;
+}
+export interface ProfileData {
+    user_id: string;
+    email: string;
+    account_type: 'free' | 'pro' | 'team' | 'enterprise';
+    telemetry_enabled: boolean;
+    default_provider: string;
+    default_model: string;
+    default_tier: string;
+    theme: string;
+    total_sessions: number;
+    total_messages: number;
+    first_session_at: string | null;
+    last_session_at: string | null;
+    created_at: string;
+}
+export interface HeartbeatData {
+    session_id: string;
+    cli_version: string;
+    os: string;
+    node_version: string;
+    project_id?: number;
+    total_messages?: number;
+    total_tokens_in?: number;
+    total_tokens_out?: number;
+    commands_used?: Record<string, number>;
+    agents_used?: string[];
+    tools_used?: string[];
+    llm_provider?: string;
+    llm_model?: string;
+}
+export interface DeviceCodeResponse {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+    expires_in: number;
+    interval: number;
+}
+export interface DeviceTokenResponse {
+    access_token: string;
+    refresh_token: string;
+    token_type: string;
+    expires_in: number;
+    api_token?: string;
+    user: {
+        id: string;
+        email: string;
+    };
+}
+export interface DeviceTokenError {
+    error: 'authorization_pending' | 'slow_down' | 'expired_token' | 'access_denied' | 'invalid_grant' | 'server_error';
+    error_description: string;
+}
+/**
+ * Refresh an access token using a refresh token.
+ * Calls the server-side Netlify function which handles Supabase internally.
+ */
+export declare function refreshToken(refreshTokenValue: string): Promise<RefreshTokenResponse>;
+/**
+ * Send heartbeat to record session.
+ */
+export declare function sendHeartbeat(accessToken: string, data: HeartbeatData): Promise<{
+    success: boolean;
+    telemetry_enabled?: boolean;
+    error?: string;
+}>;
+/**
+ * Get user profile from CLI API.
+ */
+export declare function getProfile(accessToken: string): Promise<{
+    success: boolean;
+    profile?: ProfileData;
+    error?: string;
+}>;
+/**
+ * Update user profile via CLI API.
+ */
+export declare function updateProfile(accessToken: string, updates: Partial<Pick<ProfileData, 'telemetry_enabled' | 'default_provider' | 'default_model' | 'default_tier' | 'theme'>>): Promise<{
+    success: boolean;
+    profile?: ProfileData;
+    error?: string;
+}>;
+/**
+ * Request a device code for CLI authentication.
+ * Returns codes and URLs for the user to authorize.
+ */
+export declare function requestDeviceCode(): Promise<{
+    success: boolean;
+    data?: DeviceCodeResponse;
+    error?: string;
+}>;
+/**
+ * Poll for device token after user authorizes.
+ * Returns tokens on success, or error status if still pending.
+ */
+export declare function pollDeviceToken(deviceCode: string): Promise<{
+    success: boolean;
+    data?: DeviceTokenResponse;
+    error?: DeviceTokenError;
+    networkError?: string;
+}>;
+/**
+ * Get the authorization URL for the device flow.
+ */
+export declare function getAuthorizationUrl(userCode?: string): string;

package/dist/auth/api-client.js

@@ -0,0 +1,261 @@
+/**
+ * API Client for CLI Authentication
+ *
+ * All backend communication goes through Netlify Functions.
+ * No direct Supabase SDK dependency — the server handles Supabase calls.
+ *
+ * Note: This is for USER authentication only — users still bring their own LLM API keys.
+ */
+import * as os from 'os';
+// =============================================================================
+// Configuration
+// =============================================================================
+// API endpoint for CLI-specific operations
+// Use COMPILR_API_URL env var for testing against branch previews
+const API_BASE_URL = process.env.COMPILR_API_URL || 'https://compilr.dev/.netlify/functions';
+// Device flow authorization URL
+// Use COMPILR_WEB_URL env var for testing against branch previews
+const WEB_BASE_URL = process.env.COMPILR_WEB_URL || 'https://compilr.dev';
+const AUTHORIZATION_URL = `${WEB_BASE_URL}/cli/authorize`;
+// =============================================================================
+// Token Refresh (via Netlify Function)
+// =============================================================================
+/**
+ * Refresh an access token using a refresh token.
+ * Calls the server-side Netlify function which handles Supabase internally.
+ */
+export async function refreshToken(refreshTokenValue) {
+    try {
+        const response = await fetch(`${API_BASE_URL}/cli-refresh-token`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({ refresh_token: refreshTokenValue }),
+        });
+        const contentType = response.headers.get('content-type') ?? '';
+        if (!contentType.includes('application/json')) {
+            return { success: false, error: `Server returned non-JSON response (${String(response.status)})` };
+        }
+        const result = await response.json();
+        if (!response.ok) {
+            return {
+                success: false,
+                error: result.error ?? `HTTP ${String(response.status)}`,
+            };
+        }
+        return {
+            success: true,
+            access_token: result.access_token,
+            refresh_token: result.refresh_token,
+            expires_in: result.expires_in,
+            user: result.user,
+        };
+    }
+    catch (error) {
+        return {
+            success: false,
+            error: error instanceof Error ? error.message : 'Network error',
+        };
+    }
+}
+// =============================================================================
+// CLI API Operations (against our Netlify Functions)
+// =============================================================================
+/**
+ * Send heartbeat to record session.
+ */
+export async function sendHeartbeat(accessToken, data) {
+    try {
+        const response = await fetch(`${API_BASE_URL}/cli-heartbeat`, {
+            method: 'POST',
+            headers: {
+                'Authorization': `Bearer ${accessToken}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify(data),
+        });
+        const contentType = response.headers.get('content-type') ?? '';
+        if (!contentType.includes('application/json')) {
+            return { success: false, error: `Server returned non-JSON response (${String(response.status)})` };
+        }
+        const result = await response.json();
+        if (!response.ok) {
+            return {
+                success: false,
+                error: result.error ?? `HTTP ${String(response.status)}`,
+            };
+        }
+        return {
+            success: result.success ?? true,
+            telemetry_enabled: result.telemetry_enabled,
+        };
+    }
+    catch (error) {
+        return {
+            success: false,
+            error: error instanceof Error ? error.message : 'Network error',
+        };
+    }
+}
+/**
+ * Get user profile from CLI API.
+ */
+export async function getProfile(accessToken) {
+    try {
+        const response = await fetch(`${API_BASE_URL}/cli-profile`, {
+            method: 'GET',
+            headers: {
+                'Authorization': `Bearer ${accessToken}`,
+            },
+        });
+        const contentType = response.headers.get('content-type') ?? '';
+        if (!contentType.includes('application/json')) {
+            return { success: false, error: `Server returned non-JSON response (${String(response.status)})` };
+        }
+        const result = await response.json();
+        if (!response.ok) {
+            return {
+                success: false,
+                error: result.error ?? `HTTP ${String(response.status)}`,
+            };
+        }
+        return {
+            success: true,
+            profile: result,
+        };
+    }
+    catch (error) {
+        return {
+            success: false,
+            error: error instanceof Error ? error.message : 'Network error',
+        };
+    }
+}
+/**
+ * Update user profile via CLI API.
+ */
+export async function updateProfile(accessToken, updates) {
+    try {
+        const response = await fetch(`${API_BASE_URL}/cli-profile`, {
+            method: 'PATCH',
+            headers: {
+                'Authorization': `Bearer ${accessToken}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify(updates),
+        });
+        const contentType = response.headers.get('content-type') ?? '';
+        if (!contentType.includes('application/json')) {
+            return { success: false, error: `Server returned non-JSON response (${String(response.status)})` };
+        }
+        const result = await response.json();
+        if (!response.ok) {
+            return {
+                success: false,
+                error: result.error ?? `HTTP ${String(response.status)}`,
+            };
+        }
+        return {
+            success: result.success ?? true,
+            profile: result.profile,
+        };
+    }
+    catch (error) {
+        return {
+            success: false,
+            error: error instanceof Error ? error.message : 'Network error',
+        };
+    }
+}
+// =============================================================================
+// Device Flow Authentication
+// =============================================================================
+/**
+ * Request a device code for CLI authentication.
+ * Returns codes and URLs for the user to authorize.
+ */
+export async function requestDeviceCode() {
+    try {
+        const url = `${API_BASE_URL}/cli-device-code`;
+        const response = await fetch(url, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+        });
+        const contentType = response.headers.get('content-type') ?? '';
+        if (!contentType.includes('application/json')) {
+            return {
+                success: false,
+                error: `Non-JSON response (${String(response.status)}) from: ${url}`,
+            };
+        }
+        if (!response.ok) {
+            const result = await response.json();
+            return {
+                success: false,
+                error: result.error ?? `HTTP ${String(response.status)}`,
+            };
+        }
+        const data = await response.json();
+        return { success: true, data };
+    }
+    catch (error) {
+        return {
+            success: false,
+            error: error instanceof Error ? error.message : 'Network error',
+        };
+    }
+}
+/**
+ * Poll for device token after user authorizes.
+ * Returns tokens on success, or error status if still pending.
+ */
+export async function pollDeviceToken(deviceCode) {
+    try {
+        const response = await fetch(`${API_BASE_URL}/cli-device-token`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                device_code: deviceCode,
+                hostname: os.hostname(),
+            }),
+        });
+        const contentType = response.headers.get('content-type') ?? '';
+        if (!contentType.includes('application/json')) {
+            return {
+                success: false,
+                networkError: `Server returned non-JSON response (${String(response.status)})`,
+            };
+        }
+        const result = await response.json();
+        if (!response.ok) {
+            return {
+                success: false,
+                error: result,
+            };
+        }
+        return {
+            success: true,
+            data: result,
+        };
+    }
+    catch (error) {
+        return {
+            success: false,
+            networkError: error instanceof Error ? error.message : 'Network error',
+        };
+    }
+}
+/**
+ * Get the authorization URL for the device flow.
+ */
+export function getAuthorizationUrl(userCode) {
+    if (userCode) {
+        return `${AUTHORIZATION_URL}?code=${userCode}`;
+    }
+    return AUTHORIZATION_URL;
+}

package/dist/auth/index.d.ts

@@ -0,0 +1,172 @@
+/**
+ * Auth Manager Module
+ *
+ * Singleton authentication manager for the CLI.
+ * Handles login, logout, token refresh, and session management.
+ *
+ * Usage:
+ *   const auth = getAuthManager();
+ *   if (!await auth.isAuthenticated()) {
+ *     // Show login prompt
+ *   }
+ */
+import { type ProfileData } from './api-client.js';
+export interface User {
+    id: string;
+    email: string;
+    accountType: 'free' | 'pro' | 'team' | 'enterprise';
+    createdAt: Date;
+}
+export interface LoginResult {
+    success: boolean;
+    user?: User;
+    error?: string;
+    needsConfirmation?: boolean;
+}
+export interface DeviceFlowCallbacks {
+    /** Called when device code is ready - display the user code and URL */
+    onCodeReady: (userCode: string, verificationUrl: string) => void;
+    /** Called to update status during polling */
+    onStatusUpdate?: (status: 'polling' | 'authorized' | 'expired' | 'denied') => void;
+    /** Called to open the browser (return false to skip) */
+    onOpenBrowser?: (url: string) => Promise<boolean>;
+}
+export interface SessionInfo {
+    sessionId: string;
+    startedAt: Date;
+    projectId?: number;
+    messageCount: number;
+    tokensIn: number;
+    tokensOut: number;
+    commandsUsed: Record<string, number>;
+    agentsUsed: Set<string>;
+    toolsUsed: Set<string>;
+    llmProvider?: string;
+    llmModel?: string;
+}
+declare class AuthManager {
+    private authData;
+    private profileData;
+    private sessionInfo;
+    private heartbeatInterval;
+    constructor();
+    /**
+     * Check if user is authenticated with a valid session.
+     *
+     * If an API token (tok_xxx) is present, authentication is immediate —
+     * no expiry check or refresh needed (server validates on each call).
+     *
+     * Falls back to JWT refresh for pre-v2 users who don't have an API token yet.
+     */
+    isAuthenticated(): Promise<boolean>;
+    /**
+     * Check if any auth data exists (quick check without validation).
+     */
+    hasStoredAuth(): boolean;
+    /**
+     * Get cached email from local auth data (no network call).
+     * Returns null if not authenticated.
+     */
+    getEmail(): string | null;
+    /**
+     * Get the current user.
+     * Throws if not authenticated.
+     */
+    getUser(): Promise<User>;
+    /**
+     * Get the access token (auto-refreshes if needed).
+     * Prefers API token (tok_xxx) over JWT when available.
+     */
+    getAccessToken(): Promise<string>;
+    /**
+     * Login using device flow (browser-based authentication).
+     * This is the recommended way to authenticate the CLI.
+     *
+     * @param callbacks - Callbacks for progress updates
+     * @param signal - AbortSignal for cancellation
+     */
+    loginWithDeviceFlow(callbacks: DeviceFlowCallbacks, signal?: AbortSignal): Promise<LoginResult>;
+    /**
+     * Logout (clear local session).
+     * Tokens expire naturally (1 hour). No server call needed.
+     */
+    logout(): void;
+    /**
+     * Refresh the access token using the refresh token.
+     * Calls the server-side Netlify function (no direct Supabase SDK).
+     */
+    private refreshToken;
+    /**
+     * Get the best available token for API calls.
+     * Prefers API token (tok_xxx) over short-lived JWT.
+     */
+    private getBestToken;
+    /**
+     * Fetch user profile from server.
+     */
+    private fetchProfile;
+    /**
+     * Get cached profile data.
+     */
+    getProfile(): ProfileData | null;
+    /**
+     * Update profile settings on server.
+     */
+    updateProfileSettings(updates: {
+        telemetry_enabled?: boolean;
+        default_provider?: string;
+        default_model?: string;
+        default_tier?: string;
+        theme?: string;
+    }): Promise<boolean>;
+    /**
+     * Start a new CLI session and begin heartbeat.
+     */
+    startSession(projectId?: number): Promise<void>;
+    /**
+     * Stop the current session.
+     */
+    stopHeartbeat(): void;
+    /**
+     * Record a message in the current session.
+     */
+    recordMessage(tokensIn: number, tokensOut: number): void;
+    /**
+     * Record command usage.
+     */
+    recordCommand(command: string): void;
+    /**
+     * Record agent usage.
+     */
+    recordAgent(agentId: string): void;
+    /**
+     * Record tool usage.
+     */
+    recordTool(toolName: string): void;
+    /**
+     * Set LLM provider/model for session.
+     */
+    setLLMInfo(provider: string, model: string): void;
+    /**
+     * Send a single heartbeat regardless of telemetry setting.
+     * Called once at login to register the CLI connection with the server
+     * (sets first_session_at on cli_users_extended). This is account metadata,
+     * not telemetry data.
+     */
+    sendForcedHeartbeat(): Promise<void>;
+    /**
+     * Send heartbeat to server (if telemetry enabled).
+     */
+    private sendHeartbeat;
+}
+/**
+ * Get the AuthManager singleton instance.
+ */
+export declare function getAuthManager(): AuthManager;
+/**
+ * Reset AuthManager (for testing).
+ */
+export declare function resetAuthManager(): void;
+export type { AuthData, AuthSession } from './storage.js';
+export type { ProfileData, HeartbeatData, DeviceCodeResponse } from './api-client.js';
+export { getAuthorizationUrl } from './api-client.js';