@dashai/cli 0.2.3 → 0.2.4

package/dist/bin.js

@@ -92,6 +92,94 @@ function isPlausibleConfig(v) {
   if (typeof u.email !== "string") return false;
   return true;
 }
+
+// src/lib/api-client.ts
+var ApiError = class extends Error {
+  status;
+  code;
+  context;
+  retriable;
+  constructor(status, envelope, fallbackMessage) {
+    const code2 = envelope?.code ?? codeFromStatus(status);
+    const message = envelope?.message ?? fallbackMessage;
+    super(message);
+    this.name = "ApiError";
+    this.status = status;
+    this.code = code2;
+    this.context = envelope?.context;
+    this.retriable = envelope?.retriable ?? status >= 500;
+  }
+};
+async function apiRequest(method, path, body, options = {}) {
+  const baseUrl = (options.baseUrl ?? resolveApiUrl()).replace(/\/+$/, "");
+  const url = `${baseUrl}${path.startsWith("/") ? path : `/${path}`}`;
+  const headers = {
+    Accept: "application/json",
+    ...options.headers ?? {}
+  };
+  if (body !== void 0) {
+    headers["Content-Type"] = "application/json";
+  }
+  const authMode = options.auth ?? "auto";
+  if (authMode === "auto") {
+    const saved = readSavedToken();
+    if (saved) headers["Authorization"] = `Bearer ${saved}`;
+  } else if (typeof authMode === "object" && authMode.token) {
+    headers["Authorization"] = `Bearer ${authMode.token}`;
+  }
+  let res;
+  try {
+    res = await fetch(url, {
+      method,
+      headers,
+      body: body === void 0 ? void 0 : JSON.stringify(body)
+    });
+  } catch (err) {
+    throw new ApiError(0, { code: "NETWORK_ERROR", message: err.message }, "Network error");
+  }
+  if (res.status === 204) {
+    return void 0;
+  }
+  const contentType = res.headers.get("content-type") ?? "";
+  let parsed = null;
+  if (contentType.includes("application/json")) {
+    try {
+      parsed = await res.json();
+    } catch {
+      parsed = null;
+    }
+  } else if (res.status >= 400) {
+    try {
+      parsed = { message: await res.text() };
+    } catch {
+      parsed = null;
+    }
+  }
+  if (!res.ok) {
+    throw new ApiError(res.status, asEnvelope(parsed), `HTTP ${res.status}`);
+  }
+  return parsed;
+}
+function asEnvelope(v) {
+  if (!v || typeof v !== "object") return null;
+  const env = v;
+  const out2 = {};
+  if (typeof env.code === "string") out2.code = env.code;
+  if (typeof env.message === "string") out2.message = env.message;
+  if (typeof env.retriable === "boolean") out2.retriable = env.retriable;
+  if (env.context && typeof env.context === "object") {
+    out2.context = env.context;
+  }
+  return out2;
+}
+function codeFromStatus(status) {
+  if (status === 401) return "UNAUTHENTICATED";
+  if (status === 403) return "FORBIDDEN";
+  if (status === 404) return "NOT_FOUND";
+  if (status === 0) return "NETWORK_ERROR";
+  if (status >= 500) return "INTERNAL_ERROR";
+  return "HTTP_ERROR";
+}
 function success(msg) {
   process.stderr.write(`${pc.green("\u2713")} ${msg}
 `);
@@ -125,6 +213,7 @@ function dim(s) {
 }
 
 // src/commands/dev.ts
+var DEFAULT_NEXT_PORT = 3e3;
 var PREFIX_SDK = `\x1B[36m[sdk]\x1B[0m `;
 var PREFIX_NEXT = `\x1B[35m[next]\x1B[0m `;
 async function devCommand(options) {
@@ -157,17 +246,60 @@ async function devCommand(options) {
     return 1;
   }
   const apiUrl = options.apiUrl ?? process.env.DASHWISE_API_URL ?? savedConfig?.apiUrl ?? "http://localhost:3000";
-  const installationId = options.installationId ?? process.env.DASHWISE_INSTALLATION_ID ?? "local";
+  const port = options.port ?? DEFAULT_NEXT_PORT;
+  const explicitInstallationId = options.installationId ?? process.env.DASHWISE_INSTALLATION_ID;
+  const reuseDevSessionId = process.env.DASHWISE_DEV_SESSION_ID;
+  let installationIdEnv;
+  let devSessionIdEnv;
+  let revokeDevSession;
+  if (explicitInstallationId && explicitInstallationId !== "local") {
+    installationIdEnv = explicitInstallationId;
+  } else if (reuseDevSessionId) {
+    devSessionIdEnv = reuseDevSessionId;
+  } else {
+    let workspaceContext;
+    try {
+      workspaceContext = await resolveTargetWorkspace(apiUrl, apiToken, options.workspace);
+    } catch (err) {
+      fail(err.message);
+      return 1;
+    }
+    const callbackOrigins = computeCallbackOrigins(port, options.callbackOrigin ?? []);
+    try {
+      const session = await registerDevSession(apiUrl, apiToken, {
+        target_workspace_id: workspaceContext.id,
+        callback_origins: callbackOrigins
+      });
+      devSessionIdEnv = session.id;
+      revokeDevSession = () => revokeDevSessionBestEffort(apiUrl, apiToken, session.id);
+      info(`  ${dim("dev session")} ${session.id}`);
+      info(`  ${dim("workspace")}   ${workspaceContext.name} (id=${workspaceContext.id}, slug=${workspaceContext.slug})`);
+      info(`  ${dim("callbacks")}   ${callbackOrigins.join(", ")}`);
+      info(`  ${dim("expires")}     ${session.expires_at}`);
+    } catch (err) {
+      if (err instanceof ApiError) {
+        fail(`Failed to register dev session: ${err.code} \u2014 ${err.message}`);
+      } else {
+        fail(`Failed to register dev session: ${err.message}`);
+      }
+      return 1;
+    }
+  }
   const childEnv = {
     ...process.env,
     DASHWISE_API_URL: apiUrl,
     DASHWISE_API_TOKEN: apiToken,
-    DASHWISE_INSTALLATION_ID: installationId
+    DASHWISE_INSTALLATION_ID: installationIdEnv ?? "",
+    ...devSessionIdEnv !== void 0 ? { DASHWISE_DEV_SESSION_ID: devSessionIdEnv } : {}
   };
   info(`Dev loop starting \u2014 Ctrl-C to stop.`);
-  info(`  ${dim("api")}        ${apiUrl}`);
-  info(`  ${dim("installation")} ${installationId}`);
-  info(`  ${dim("token")}      ${maskedToken(apiToken)} ${dim(`(from ${apiToken === savedConfig?.token ? "~/.config/dashwise/auth.json" : "$DASHWISE_API_TOKEN"})`)}`);
+  info(`  ${dim("api")}         ${apiUrl}`);
+  if (installationIdEnv !== void 0) {
+    info(`  ${dim("installation")} ${installationIdEnv} (prod-mode SSO)`);
+  } else {
+    info(`  ${dim("mode")}        dev (DASHWISE_DEV_SESSION_ID injected)`);
+  }
+  info(`  ${dim("token")}       ${maskedToken(apiToken)} ${dim(`(from ${apiToken === savedConfig?.token ? "~/.config/dashwise/auth.json" : "$DASHWISE_API_TOKEN"})`)}`);
   info("");
   const children = [];
   if (!options.nextOnly) {
@@ -175,7 +307,7 @@ async function devCommand(options) {
     children.push({ name: "sdk", child: sdkChild, prefix: PREFIX_SDK });
   }
   if (!options.sdkOnly) {
-    const nextChild = spawnNextDev(projectRoot, childEnv, options.port);
+    const nextChild = spawnNextDev(projectRoot, childEnv, port);
     children.push({ name: "next", child: nextChild, prefix: PREFIX_NEXT });
   }
   for (const { child, prefix } of children) {
@@ -193,6 +325,10 @@ Received ${sig}, stopping children\u2026`);
         child.kill(sig);
       }
     }
+    if (revokeDevSession) {
+      revokeDevSession().catch(() => {
+      });
+    }
   };
   process.on("SIGINT", () => forwardSignal("SIGINT"));
   process.on("SIGTERM", () => forwardSignal("SIGTERM"));
@@ -286,96 +422,60 @@ function maskedToken(token) {
   const tail = token.slice(-4);
   return `${prefix}\u2026${tail}`;
 }
-
-// src/lib/api-client.ts
-var ApiError = class extends Error {
-  status;
-  code;
-  context;
-  retriable;
-  constructor(status, envelope, fallbackMessage) {
-    const code2 = envelope?.code ?? codeFromStatus(status);
-    const message = envelope?.message ?? fallbackMessage;
-    super(message);
-    this.name = "ApiError";
-    this.status = status;
-    this.code = code2;
-    this.context = envelope?.context;
-    this.retriable = envelope?.retriable ?? status >= 500;
-  }
-};
-async function apiRequest(method, path, body, options = {}) {
-  const baseUrl = (options.baseUrl ?? resolveApiUrl()).replace(/\/+$/, "");
-  const url = `${baseUrl}${path.startsWith("/") ? path : `/${path}`}`;
-  const headers = {
-    Accept: "application/json",
-    ...options.headers ?? {}
-  };
-  if (body !== void 0) {
-    headers["Content-Type"] = "application/json";
-  }
-  const authMode = options.auth ?? "auto";
-  if (authMode === "auto") {
-    const saved = readSavedToken();
-    if (saved) headers["Authorization"] = `Bearer ${saved}`;
-  } else if (typeof authMode === "object" && authMode.token) {
-    headers["Authorization"] = `Bearer ${authMode.token}`;
-  }
-  let res;
-  try {
-    res = await fetch(url, {
-      method,
-      headers,
-      body: body === void 0 ? void 0 : JSON.stringify(body)
-    });
-  } catch (err) {
-    throw new ApiError(0, { code: "NETWORK_ERROR", message: err.message }, "Network error");
-  }
-  if (res.status === 204) {
-    return void 0;
+function computeCallbackOrigins(port, extra) {
+  const def = `http://localhost:${port}`;
+  return Array.from(/* @__PURE__ */ new Set([def, ...extra]));
+}
+async function resolveTargetWorkspace(apiUrl, apiToken, flag) {
+  const workspaces = await apiRequest(
+    "GET",
+    "/api/workspaces",
+    void 0,
+    { baseUrl: apiUrl, auth: { token: apiToken } }
+  );
+  if (workspaces.length === 0) {
+    throw new Error(
+      "No workspaces found for your account. Create a workspace at the DashWise dashboard first."
+    );
   }
-  const contentType = res.headers.get("content-type") ?? "";
-  let parsed = null;
-  if (contentType.includes("application/json")) {
-    try {
-      parsed = await res.json();
-    } catch {
-      parsed = null;
-    }
-  } else if (res.status >= 400) {
-    try {
-      parsed = { message: await res.text() };
-    } catch {
-      parsed = null;
+  if (flag === void 0) {
+    if (workspaces.length === 1) {
+      return workspaces[0];
     }
+    const list = workspaces.map((w) => `  - ${w.slug} (id=${w.id}, name="${w.name}")`).join("\n");
+    throw new Error(
+      `You have ${workspaces.length} workspaces. Re-run with --workspace <slug-or-id> to pick one:
+${list}`
+    );
   }
-  if (!res.ok) {
-    throw new ApiError(res.status, asEnvelope(parsed), `HTTP ${res.status}`);
+  const asNumber = Number.parseInt(flag, 10);
+  const isNumeric = !Number.isNaN(asNumber) && String(asNumber) === flag;
+  const match = isNumeric ? workspaces.find((w) => w.id === asNumber) : workspaces.find((w) => w.slug === flag);
+  if (!match) {
+    const list = workspaces.map((w) => `  - ${w.slug} (id=${w.id})`).join("\n");
+    throw new Error(
+      `No workspace matching --workspace=${flag}. Available:
+${list}`
+    );
   }
-  return parsed;
+  return match;
 }
-function asEnvelope(v) {
-  if (!v || typeof v !== "object") return null;
-  const env = v;
-  const out2 = {};
-  if (typeof env.code === "string") out2.code = env.code;
-  if (typeof env.message === "string") out2.message = env.message;
-  if (typeof env.retriable === "boolean") out2.retriable = env.retriable;
-  if (env.context && typeof env.context === "object") {
-    out2.context = env.context;
-  }
-  return out2;
+async function registerDevSession(apiUrl, apiToken, body) {
+  return apiRequest(
+    "POST",
+    "/api/auth/dev/sessions",
+    body,
+    { baseUrl: apiUrl, auth: { token: apiToken } }
+  );
 }
-function codeFromStatus(status) {
-  if (status === 401) return "UNAUTHENTICATED";
-  if (status === 403) return "FORBIDDEN";
-  if (status === 404) return "NOT_FOUND";
-  if (status === 0) return "NETWORK_ERROR";
-  if (status >= 500) return "INTERNAL_ERROR";
-  return "HTTP_ERROR";
+async function revokeDevSessionBestEffort(apiUrl, apiToken, id) {
+  await apiRequest(
+    "DELETE",
+    `/api/auth/dev/sessions/${encodeURIComponent(id)}`,
+    void 0,
+    { baseUrl: apiUrl, auth: { token: apiToken } }
+  );
 }
-
-// src/commands/login.ts
 var DEFAULT_TOKEN_NAME = "dashwise-cli";
 async function loginCommand(options) {
   const apiUrl = (options.apiUrl ?? resolveApiUrl()).replace(/\/+$/, "");
@@ -914,12 +1014,17 @@ function envLocal() {
   return [
     "# Local dev config \u2014 auto-generated by `dashwise module init`.",
     "# Gitignored; safe to edit. `dashwise dev` (the unified loop) auto-",
-    "# injects DASHWISE_API_TOKEN from ~/.config/dashwise/auth.json, so",
-    "# leave it blank unless you want to override. Change DASHWISE_API_URL",
+    "# injects DASHWISE_API_TOKEN from ~/.config/dashwise/auth.json AND",
+    "# DASHWISE_DEV_SESSION_ID from the dev session it registers \u2014 so",
+    "# you typically don't need to set either here. Change DASHWISE_API_URL",
     "# to point at a non-default backend (e.g. https://api.dashwise.net).",
+    "#",
+    "# DASHWISE_INSTALLATION_ID is only needed AFTER you publish + install",
+    "# the module in a workspace; until then dev mode (DASHWISE_DEV_SESSION_ID,",
+    "# auto-set by `dashwise dev`) is the auth path.",
     "DASHWISE_API_URL=http://localhost:3000",
     "DASHWISE_API_TOKEN=",
-    "DASHWISE_INSTALLATION_ID=local",
+    "DASHWISE_INSTALLATION_ID=",
     ""
   ].join("\n");
 }
@@ -1357,11 +1462,23 @@ function Row({ label, value }: { label: string; value: string }) {
 function appApiAuthSignInTs() {
   return `// /api/auth/sign-in \u2014 kick off the SSO flow.
 //
-// Reads \`?return_to=\` from the caller (defaults to '/'), looks up
-// the module's installation id from env, redirects the browser to
-// the DashWise backend's \`/api/auth/sso/start\`. The backend mints
-// an exchange code + 302s back to \`/api/auth/callback?code=...\`
-// where we set the session cookie.
+// Reads \`?return_to=\` from the caller (defaults to '/'). Branches
+// on env:
+//
+//   - DASHWISE_DEV_SESSION_ID set (set automatically by
+//     \`dashwise dev\`): hits /api/auth/dev/sso/start with the dev
+//     session id. No installation_id required \u2014 the module isn't
+//     installed in a workspace yet.
+//
+//   - DASHWISE_INSTALLATION_ID set (production / installed-module
+//     path): hits /api/auth/sso/start with the installation id.
+//
+// In both cases the backend mints an exchange code + 302s back to
+// \`/api/auth/callback?code=...\` where we set the session cookie.
+//
+// Unauthenticated browser hits to either backend endpoint 302 to
+// the DashWise FE \`/login?return_to=...\` automatically \u2014 you don't
+// need to handle the "user not logged in" case here.
 import { NextResponse } from 'next/server';
 
 export function GET(request: Request) {
@@ -1369,19 +1486,43 @@ export function GET(request: Request) {
   const returnTo = url.searchParams.get('return_to') ?? '/';
   const apiBaseUrl = process.env.DASHWISE_API_URL;
   const installationId = process.env.DASHWISE_INSTALLATION_ID;
-  if (!apiBaseUrl || !installationId) {
+  const devSessionId = process.env.DASHWISE_DEV_SESSION_ID;
+
+  if (!apiBaseUrl) {
     return new NextResponse(
-      'DASHWISE_API_URL and DASHWISE_INSTALLATION_ID must be set in .env.local',
+      'DASHWISE_API_URL must be set in .env.local',
       { status: 500 },
     );
   }
+  if (!installationId && !devSessionId) {
+    return new NextResponse(
+      'Either DASHWISE_INSTALLATION_ID (installed module) or DASHWISE_DEV_SESSION_ID ' +
+        '(local dev via \`dashwise dev\`) must be set. Run \`dashwise dev\` to register ' +
+        'a dev session, or set DASHWISE_INSTALLATION_ID after publishing your module.',
+      { status: 500 },
+    );
+  }
+
   // Absolute URL for return_to so the backend knows which host to
   // bounce back to (the callback path is fixed at /api/auth/callback
   // by SDK convention).
   const moduleOrigin = url.origin;
-  const ssoStart = new URL('/api/auth/sso/start', apiBaseUrl);
-  ssoStart.searchParams.set('return_to', \`\${moduleOrigin}\${returnTo}\`);
-  ssoStart.searchParams.set('client_id', installationId);
+  const absoluteReturnTo = \`\${moduleOrigin}\${returnTo}\`;
+
+  let ssoStart;
+  if (devSessionId) {
+    // Dev mode wins when both are set \u2014 \`dashwise dev\` injects
+    // DASHWISE_DEV_SESSION_ID into the child env, which overrides
+    // whatever was in .env.local. The dev session id keys back to
+    // the dev's workspace + callback origin allowlist.
+    ssoStart = new URL('/api/auth/dev/sso/start', apiBaseUrl);
+    ssoStart.searchParams.set('return_to', absoluteReturnTo);
+    ssoStart.searchParams.set('dev_session_id', devSessionId);
+  } else {
+    ssoStart = new URL('/api/auth/sso/start', apiBaseUrl);
+    ssoStart.searchParams.set('return_to', absoluteReturnTo);
+    ssoStart.searchParams.set('client_id', installationId);
+  }
   return NextResponse.redirect(ssoStart);
 }
 `;
@@ -4114,18 +4255,28 @@ workspace.command("use <slug>").description("Set the default workspace for subse
   process.exitCode = await workspaceUseCommand(slug);
 });
 program.command("dev").description(
-  "One-command local dev loop: runs the manifest watcher + Next.js dev server together, with `DASHWISE_API_URL`/`DASHWISE_API_TOKEN`/`DASHWISE_INSTALLATION_ID` auto-injected from your saved CLI config. Run `dashwise login` first."
+  "One-command local dev loop: runs the manifest watcher + Next.js dev server together. Registers a dev-mode SSO session with the backend so workspace members can sign into your locally-running module via DashWise SSO (no installation_id required). Auth + dev-session env auto-injected into both child processes from your saved CLI config. Run `dashwise login` first."
 ).option("--dir <path>", "Project root containing `module.json` (default: current directory).").option(
   "--installation-id <id>",
-  'Override the `DASHWISE_INSTALLATION_ID` env var passed to children (default: "local").'
+  "Use prod-mode SSO with this installation id instead of registering a dev session. The installation must already exist in the target workspace."
+).option(
+  "--workspace <slug-or-id>",
+  "Workspace to scope the dev session to (slug or numeric id). Required if your account belongs to more than one workspace; auto-picked if you have just one."
+).option(
+  "--callback-origin <url>",
+  "Additional callback origin to allowlist on the dev session (repeatable). The dev server URL (http://localhost:<port>) is always allowlisted; pass this for custom-domain local dev (e.g. https://myapp.local).",
+  collectRepeated,
+  []
 ).option(
   "--api-url <url>",
   "Override the `DASHWISE_API_URL` env var passed to children (default: saved CLI config)."
-).option("--port <number>", "Port for `next dev` (default: Next.js picks 3000 / next free).", parseIntOption).option("--sdk-only", "Only run the manifest watcher; skip `next dev`.").option("--next-only", "Only run `next dev`; skip the manifest watcher.").action(
+).option("--port <number>", "Port for `next dev` (default: 3000).", parseIntOption).option("--sdk-only", "Only run the manifest watcher; skip `next dev`.").option("--next-only", "Only run `next dev`; skip the manifest watcher.").action(
   async (cmdOpts) => {
     process.exitCode = await devCommand({
       ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
       ...cmdOpts.installationId !== void 0 ? { installationId: cmdOpts.installationId } : {},
+      ...cmdOpts.workspace !== void 0 ? { workspace: cmdOpts.workspace } : {},
+      ...cmdOpts.callbackOrigin !== void 0 && cmdOpts.callbackOrigin.length > 0 ? { callbackOrigin: cmdOpts.callbackOrigin } : {},
       ...cmdOpts.apiUrl !== void 0 ? { apiUrl: cmdOpts.apiUrl } : {},
       ...cmdOpts.port !== void 0 ? { port: cmdOpts.port } : {},
       ...cmdOpts.sdkOnly !== void 0 ? { sdkOnly: cmdOpts.sdkOnly } : {},
@@ -4344,7 +4495,7 @@ moduleCmd.command("action-log").description(
   }
 })();
 function getVersion() {
-  return "0.2.3";
+  return "0.2.4";
 }
 function parseIntOption(value) {
   const n = Number.parseInt(value, 10);
@@ -4353,5 +4504,8 @@ function parseIntOption(value) {
   }
   return n;
 }
+function collectRepeated(value, previous) {
+  return [...previous, value];
+}
 //# sourceMappingURL=bin.js.map
 //# sourceMappingURL=bin.js.map