@cowliss/cli 0.11.0 → 0.12.0

package/dist/index.js

@@ -173,6 +173,8 @@ const SYSTEM_EVENT_PREFIX = "system.";
 * system.profile_deleted is the provider-recorded fact that a provider
 * (e.g. Clerk `user.deleted`) deleted the user upstream — a marker event
 * only, with no deletion semantics (hard-delete belongs to GDPR erasure);
+* system.signed_up and system.logged_in are the same shape for the other end
+* of that lifecycle (Clerk `user.created` and `session.created`);
 * system.email_clicked is a link click reported by SES feedback.
 *
 * Rows carrying one of these names get `system: true` so the usage meter
@@ -187,6 +189,17 @@ const SYSTEM_EVENTS = {
 	consentRevoked: "system.consent_revoked",
 	profileDeleted: "system.profile_deleted",
 	/**
+	* The provider's account lifecycle, as facts rather than as profile state:
+	* a profile can predate its `user.created` (an SDK identify or a
+	* membership delivery may have created it first), so these name what the
+	* provider reported, not what Cowliss did. `signedUp` is the trigger for a
+	* welcome journey fed by a provider source, which `emailRegistered` only
+	* approximates (it fires on an address change too, and never for a
+	* profile with no address). `loggedIn` is one row per session start.
+	*/
+	signedUp: "system.signed_up",
+	loggedIn: "system.logged_in",
+	/**
 	* A write's identifiers named more than one profile and Cowliss merged
 	* them (ticket 69). Lands on the survivor's timeline carrying
 	* `mergedProfileIds`, the ids folded into it.
@@ -7873,6 +7886,36 @@ const updateWebhookBodySchema = z.object({ data: z.object({
 /** `q` is a substring search over the webhook's name. */
 const listWebhooksQuerySchema = paginationQuerySchema.extend({ q: searchQuerySchema });
 
+//#endregion
+//#region ../../packages/shared/src/whoami.ts
+/**
+* What an ingestion key plus one source id write into. An org API key is
+* org-scoped and carries no app of its own (`ApiKeyClaims`), so any live
+* `src_` in the organization is accepted by the write path: a well-formed id
+* belonging to another app lands profiles there with a 200. The id the
+* caller is about to send is therefore the input, and this answers where it
+* goes before anything is written.
+*
+* Scoped to that one source's app on purpose: the key stays a write
+* credential, and a leaked one must not enumerate the org's other apps
+* (.scratch/24-onboarding-dx/spec.md).
+*/
+const whoamiQuerySchema = z.object({ sourceId: sourceIdSchema });
+const whoamiSchema = z.object({
+	orgId: z.string(),
+	app: z.object({
+		id: z.string(),
+		name: z.string()
+	}),
+	/** Every live pipe into that app, so "a Clerk source already feeds this" is visible. */
+	sources: z.array(sourceSchema.pick({
+		id: true,
+		kind: true,
+		configured: true,
+		lastReceivedAt: true
+	}))
+});
+
 //#endregion
 //#region ../../packages/api-client/src/client.ts
 var ApiError = class extends Error {
@@ -7897,7 +7940,7 @@ async function send(baseUrl, init) {
 			body: typeof init.body === "string" || init.body === null ? init.body : Uint8Array.from(init.body)
 		});
 	} catch {
-		throw new ApiError("network_error", `Could not reach the API at ${baseUrl}. Is apps/api running?`, 0);
+		throw new ApiError("network_error", `Could not reach the API at ${baseUrl}. Check the address, or set COW_API_URL to the one you meant.`, 0);
 	}
 	const requestId = response.headers.get("X-Request-Id") ?? void 0;
 	if (init.binary && response.ok) return {
@@ -9211,170 +9254,6 @@ function registerAdd(program, io) {
 	});
 }
 
-//#endregion
-//#region src/lib/login.ts
-/**
-* Login via the dashboard's /cli-auth bridge: start a loopback server, open
-* the web app there, and the signed-in browser POSTs the Clerk session token
-* back. `--token <jwt>` bypasses the browser entirely (agents, CI).
-*/
-async function login(env, options) {
-	let token;
-	if (options.token !== void 0) {
-		token = options.token.trim();
-		if (decodeTokenPayload(token) === null) throw new Error("The provided --token value is not a JWT");
-	} else token = await collectTokenViaBrowser(resolveWebUrl(env, (await readCowConfig(process.cwd()))?.webUrl, options.webUrl), 3e5, options.noOpen === true);
-	const claims = decodeSessionToken(token);
-	if (claims === null) throw new Error("Token is not a decodable JWT");
-	if (claims.userId === null) throw new Error("Token has no subject claim. Is it a Clerk session token?");
-	const apiUrl = options.apiFlag ?? resolveApiUrl(env, null, void 0, (await readCowConfig(process.cwd()))?.apiUrl);
-	return {
-		credentialsPath: await writeCredentials(env, {
-			token,
-			apiUrl
-		}),
-		apiUrl,
-		userId: claims.userId,
-		orgId: claims.orgId,
-		role: claims.role,
-		hasOrg: claims.orgId !== null
-	};
-}
-/** Open the dashboard bridge and await one POST of { token }. */
-function collectTokenViaBrowser(webUrl, timeoutMs = 18e4, noOpen = false) {
-	return new Promise((resolve, reject) => {
-		let server = null;
-		const timer = setTimeout(() => {
-			server?.close();
-			reject(/* @__PURE__ */ new Error(`Timed out waiting for the browser to sign in (${Math.round(timeoutMs / 1e3)}s). Or paste a token: \`cow login --token <jwt>\`.`));
-		}, timeoutMs);
-		server = createServer((req, res) => {
-			res.setHeader("Access-Control-Allow-Origin", "*");
-			res.setHeader("Access-Control-Allow-Methods", "POST, OPTIONS");
-			res.setHeader("Access-Control-Allow-Headers", "Content-Type");
-			if (req.method === "OPTIONS") {
-				res.writeHead(204).end();
-				return;
-			}
-			if (req.method !== "POST") {
-				res.writeHead(405).end();
-				return;
-			}
-			const chunks = [];
-			req.on("data", (chunk) => chunks.push(chunk));
-			req.on("end", () => {
-				clearTimeout(timer);
-				try {
-					const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-					const field = (name) => typeof body === "object" && body !== null && name in body ? body[name] : void 0;
-					if (field("denied") === true) {
-						res.writeHead(200, { "Content-Type": "application/json" });
-						res.end(JSON.stringify({ ok: true }));
-						reject(/* @__PURE__ */ new Error("Sign-in was denied in the browser. No access was granted."));
-						return;
-					}
-					const token = field("token");
-					if (typeof token !== "string" || token.length === 0) {
-						res.writeHead(400, { "Content-Type": "application/json" });
-						res.end(JSON.stringify({ error: "missing token" }));
-						reject(/* @__PURE__ */ new Error("The browser bridge sent no token"));
-						return;
-					}
-					res.writeHead(200, { "Content-Type": "application/json" });
-					res.end(JSON.stringify({ ok: true }));
-					resolve(token);
-				} catch (error) {
-					reject(error instanceof Error ? error : new Error(String(error)));
-				} finally {
-					server?.close();
-				}
-			});
-		});
-		server.listen(0, "127.0.0.1", () => {
-			const address = server?.address();
-			if (address === null || typeof address !== "object") {
-				reject(/* @__PURE__ */ new Error("Could not bind a loopback port"));
-				return;
-			}
-			const callbackUrl = `http://127.0.0.1:${address.port}/cb`;
-			const target = `${webUrl}/cli-auth?cb=${encodeURIComponent(callbackUrl)}`;
-			if (!noOpen) openBrowser(target);
-			process.stderr.write(`Waiting for sign-in at:\n  ${target}\n`);
-		});
-		server.on("error", (error) => {
-			clearTimeout(timer);
-			reject(error);
-		});
-	});
-}
-function openBrowser(url) {
-	const cmd = process.platform === "darwin" ? "open" : process.platform === "linux" ? "xdg-open" : null;
-	if (cmd === null) return;
-	spawn(cmd, [url], {
-		stdio: "ignore",
-		detached: true
-	}).unref();
-}
-
-//#endregion
-//#region src/commands/auth.ts
-/** login/logout/whoami: session-token management, no contract route. */
-function registerAuth(program, env, io) {
-	program.command("login").description("authenticate via the dashboard browser flow (or --token) and cache the session token").option("--token <jwt>", "paste a session token instead of the browser flow").option("--web <url>", `dashboard URL; overrides COW_WEB_URL and webUrl in cow.json (default ${DEFAULT_WEB_URL})`).option("--no-open", "do not open the browser; print the URL and wait (headless/agent use)").action(async (opts) => {
-		const outcome = await login(env, {
-			token: opts.token,
-			webUrl: opts.web,
-			apiFlag: opts.api,
-			noOpen: opts.open === false
-		});
-		emit({ data: {
-			...outcome,
-			warnings: outcome.hasOrg ? void 0 : ["The token carries no active organization. Select one in the dashboard and log in again."]
-		} }, io, opts.json);
-	});
-	program.command("logout").description("delete the cached session token").action(async (opts) => {
-		const removed = await clearCredentials(env);
-		emit({ data: { removed } }, io, opts.json);
-	});
-	program.command("whoami").description("show which credential commands will use, and for a session its subject, org, role, and expiry").action(async (opts) => {
-		const credentials = await readCredentials(env);
-		const { kind } = resolveCredential(env, credentials);
-		if (kind === "none") throw new Error("Not logged in. Run `cow login` first, or set COW_PIPELINE_KEY.");
-		if (kind === "pipelineKey") {
-			emit({ data: {
-				credential: kind,
-				source: "COW_PIPELINE_KEY",
-				note: "A pipeline key may push, enable, disable, and read executions."
-			} }, io, opts.json);
-			return;
-		}
-		const claims = decodeSessionToken(credentials?.token ?? "");
-		if (!claims) throw new Error("Cached token is not decodable. Run `cow login` again.");
-		const projectApiUrl = (await readCowConfig(process.cwd()))?.apiUrl;
-		const apiUrl = resolveApiUrl(env, credentials, opts.api, projectApiUrl);
-		const mintedFor = credentials?.apiUrl;
-		emit({ data: {
-			credential: kind,
-			apiUrl,
-			mintedFor: mintedFor ?? null,
-			...mintedFor !== void 0 && mintedFor !== apiUrl ? { warning: `This token was minted for ${mintedFor}, but commands here talk to ${apiUrl}. Run \`cow login\` again from this directory.` } : {},
-			...claims
-		} }, io, opts.json);
-	});
-}
-
-//#endregion
-//#region src/commands/build.ts
-/**
-* `cow build`: typecheck, bundle, and write `.cow/build` for the project in
-* the current directory. Local only, no API call and no network.
-*/
-function registerBuild(program, io) {
-	program.command("build").description("typecheck and bundle the repo in the current directory, writing .cow/build (local: no API call)").action(async (opts) => {
-		emit({ data: await buildProject(process.cwd()) }, io, opts.json);
-	});
-}
-
 //#endregion
 //#region ../../node_modules/.pnpm/@asteasolutions+zod-to-openapi@9.1.0_zod@4.4.3/node_modules/@asteasolutions/zod-to-openapi/dist/index.cjs
 var require_dist = /* @__PURE__ */ __commonJSMin(((exports) => {
@@ -10659,6 +10538,19 @@ const ingestion = defineModule(defineRoute({
 		200: envelope(batchResultDtoSchema, "Per-item outcomes, positionally aligned"),
 		...ingestionErrors
 	}
+}), defineRoute({
+	method: "get",
+	path: "/v1/whoami",
+	operationId: "ingestion.whoami",
+	tags: ["ingestion"],
+	summary: "Which app a source id writes into",
+	security: API_KEY_AUTH,
+	surfaces: HIDDEN_FROM_TOOLS,
+	request: { query: whoamiQuerySchema },
+	responses: {
+		200: envelope(whoamiSchema, "The source's org, app, and sibling sources"),
+		...errors("invalid_key", "not_found", "validation_failed", "rate_limited")
+	}
 }));
 
 //#endregion
@@ -11887,6 +11779,180 @@ const allRoutes = Object.values(contract).flatMap((module) => Object.values(modu
 /** The tags in the order their modules are declared. */
 const tags = [...new Set(allRoutes.flatMap((route) => route.tags ?? []))];
 
+//#endregion
+//#region src/lib/login.ts
+/**
+* Login via the dashboard's /cli-auth bridge: start a loopback server, open
+* the web app there, and the signed-in browser POSTs the Clerk session token
+* back. `--token <jwt>` bypasses the browser entirely (agents, CI).
+*/
+async function login(env, options) {
+	let token;
+	if (options.token !== void 0) {
+		token = options.token.trim();
+		if (decodeTokenPayload(token) === null) throw new Error("The provided --token value is not a JWT");
+	} else token = await collectTokenViaBrowser(resolveWebUrl(env, (await readCowConfig(process.cwd()))?.webUrl, options.webUrl), 3e5, options.noOpen === true);
+	const claims = decodeSessionToken(token);
+	if (claims === null) throw new Error("Token is not a decodable JWT");
+	if (claims.userId === null) throw new Error("Token has no subject claim. Is it a Clerk session token?");
+	const apiUrl = options.apiFlag ?? resolveApiUrl(env, null, void 0, (await readCowConfig(process.cwd()))?.apiUrl);
+	return {
+		credentialsPath: await writeCredentials(env, {
+			token,
+			apiUrl
+		}),
+		apiUrl,
+		userId: claims.userId,
+		orgId: claims.orgId,
+		role: claims.role,
+		hasOrg: claims.orgId !== null
+	};
+}
+/** Open the dashboard bridge and await one POST of { token }. */
+function collectTokenViaBrowser(webUrl, timeoutMs = 18e4, noOpen = false) {
+	return new Promise((resolve, reject) => {
+		let server = null;
+		const timer = setTimeout(() => {
+			server?.close();
+			reject(/* @__PURE__ */ new Error(`Timed out waiting for the browser to sign in (${Math.round(timeoutMs / 1e3)}s). Or paste a token: \`cow login --token <jwt>\`.`));
+		}, timeoutMs);
+		server = createServer((req, res) => {
+			res.setHeader("Access-Control-Allow-Origin", "*");
+			res.setHeader("Access-Control-Allow-Methods", "POST, OPTIONS");
+			res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+			if (req.method === "OPTIONS") {
+				res.writeHead(204).end();
+				return;
+			}
+			if (req.method !== "POST") {
+				res.writeHead(405).end();
+				return;
+			}
+			const chunks = [];
+			req.on("data", (chunk) => chunks.push(chunk));
+			req.on("end", () => {
+				clearTimeout(timer);
+				try {
+					const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+					const field = (name) => typeof body === "object" && body !== null && name in body ? body[name] : void 0;
+					if (field("denied") === true) {
+						res.writeHead(200, { "Content-Type": "application/json" });
+						res.end(JSON.stringify({ ok: true }));
+						reject(/* @__PURE__ */ new Error("Sign-in was denied in the browser. No access was granted."));
+						return;
+					}
+					const token = field("token");
+					if (typeof token !== "string" || token.length === 0) {
+						res.writeHead(400, { "Content-Type": "application/json" });
+						res.end(JSON.stringify({ error: "missing token" }));
+						reject(/* @__PURE__ */ new Error("The browser bridge sent no token"));
+						return;
+					}
+					res.writeHead(200, { "Content-Type": "application/json" });
+					res.end(JSON.stringify({ ok: true }));
+					resolve(token);
+				} catch (error) {
+					reject(error instanceof Error ? error : new Error(String(error)));
+				} finally {
+					server?.close();
+				}
+			});
+		});
+		server.listen(0, "127.0.0.1", () => {
+			const address = server?.address();
+			if (address === null || typeof address !== "object") {
+				reject(/* @__PURE__ */ new Error("Could not bind a loopback port"));
+				return;
+			}
+			const callbackUrl = `http://127.0.0.1:${address.port}/cb`;
+			const target = `${webUrl}/cli-auth?cb=${encodeURIComponent(callbackUrl)}`;
+			if (!noOpen) openBrowser(target);
+			process.stderr.write(`Waiting for sign-in at:\n  ${target}\n`);
+		});
+		server.on("error", (error) => {
+			clearTimeout(timer);
+			reject(error);
+		});
+	});
+}
+function openBrowser(url) {
+	const cmd = process.platform === "darwin" ? "open" : process.platform === "linux" ? "xdg-open" : null;
+	if (cmd === null) return;
+	spawn(cmd, [url], {
+		stdio: "ignore",
+		detached: true
+	}).unref();
+}
+
+//#endregion
+//#region src/commands/auth.ts
+/** login/logout/whoami: session-token management, no contract route. */
+function registerAuth(program, env, io) {
+	program.command("login").description("authenticate via the dashboard browser flow (or --token) and cache the session token").option("--token <jwt>", "paste a session token instead of the browser flow").option("--web <url>", `dashboard URL; overrides COW_WEB_URL and webUrl in cow.json (default ${DEFAULT_WEB_URL})`).option("--no-open", "do not open the browser; print the URL and wait (headless/agent use)").action(async (opts) => {
+		const outcome = await login(env, {
+			token: opts.token,
+			webUrl: opts.web,
+			apiFlag: opts.api,
+			noOpen: opts.open === false
+		});
+		emit({ data: {
+			...outcome,
+			warnings: outcome.hasOrg ? void 0 : ["The token carries no active organization. Select one in the dashboard and log in again."]
+		} }, io, opts.json);
+	});
+	program.command("logout").description("delete the cached session token").action(async (opts) => {
+		const removed = await clearCredentials(env);
+		emit({ data: { removed } }, io, opts.json);
+	});
+	program.command("whoami").description("show which credential commands will use, and for a session its subject, org, role, and expiry").option("--key <ak_...>", "ask the API what an ingestion key writes into, instead of reading the cached session").option("--source <src_...>", "the source id that key is about to send to (required with --key)").action(async (opts) => {
+		if (opts.key) {
+			if (!opts.source) throw new Error("`--key` needs `--source <src_...>`: the id you are about to send to is what this checks.");
+			const client = createClient({
+				baseUrl: resolveApiUrl(env, await readCredentials(env), opts.api, (await readCowConfig(process.cwd()))?.apiUrl),
+				auth: () => opts.key ?? null,
+				headers: { [CLIENT_HEADER]: `@cowliss/cli/${(await readCliPackage()).version}` }
+			});
+			emit(await client.request(contract.ingestion["ingestion.whoami"], { query: { sourceId: opts.source } }), io, opts.json);
+			return;
+		}
+		const credentials = await readCredentials(env);
+		const { kind } = resolveCredential(env, credentials);
+		if (kind === "none") throw new Error("Not logged in. Run `cow login` first, or set COW_PIPELINE_KEY.");
+		if (kind === "pipelineKey") {
+			emit({ data: {
+				credential: kind,
+				source: "COW_PIPELINE_KEY",
+				note: "A pipeline key may push, enable, disable, and read executions."
+			} }, io, opts.json);
+			return;
+		}
+		const claims = decodeSessionToken(credentials?.token ?? "");
+		if (!claims) throw new Error("Cached token is not decodable. Run `cow login` again.");
+		const projectApiUrl = (await readCowConfig(process.cwd()))?.apiUrl;
+		const apiUrl = resolveApiUrl(env, credentials, opts.api, projectApiUrl);
+		const mintedFor = credentials?.apiUrl;
+		emit({ data: {
+			credential: kind,
+			apiUrl,
+			mintedFor: mintedFor ?? null,
+			...mintedFor !== void 0 && mintedFor !== apiUrl ? { warning: `This token was minted for ${mintedFor}, but commands here talk to ${apiUrl}. Run \`cow login\` again from this directory.` } : {},
+			...claims
+		} }, io, opts.json);
+	});
+}
+
+//#endregion
+//#region src/commands/build.ts
+/**
+* `cow build`: typecheck, bundle, and write `.cow/build` for the project in
+* the current directory. Local only, no API call and no network.
+*/
+function registerBuild(program, io) {
+	program.command("build").description("typecheck and bundle the repo in the current directory, writing .cow/build (local: no API call)").action(async (opts) => {
+		emit({ data: await buildProject(process.cwd()) }, io, opts.json);
+	});
+}
+
 //#endregion
 //#region ../../packages/shared/src/contract/surfaces.ts
 /** camelCase field name → kebab-case flag body (`sourceId` → `source-id`). */
@@ -13591,7 +13657,7 @@ function errorMessage(error) {
 			code: error.code,
 			message: error.message
 		} }, null, 2);
-		if (error.code === "invalid_key") return `${envelope}\n(hint: run \`cow login\` to refresh the session token)`;
+		if (error.code === "invalid_key" && !process.argv.includes("--key")) return `${envelope}\n(hint: run \`cow login\` to refresh the session token)`;
 		return envelope;
 	}
 	if (error instanceof Error) return `error: ${error.message}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cowliss/cli",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "type": "module",
   "bin": {
     "cow": "./dist/index.js"