@ductape/cli 0.3.21 → 0.3.23

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## Unreleased
+
+- Browser OAuth now completes through a validated loopback callback and logs the CLI in automatically.
+- Feature sync now establishes the official catalogue-only lifecycle with `DUCTAPE_SYNC_MODE=1` and exposes filtered ownership through `DUCTAPE_FEATURE_FILTER` before project bootstrap.
+
 ## 0.3.0 - 2026-07-26
 
 - Added AI-led migration planning with new-codebase defaults and immutable original E2E gates.

package/README.md

@@ -48,6 +48,8 @@ Do not use `sudo npm link`; it mixes root-owned globals with your normal user.
 ```bash
 ductape install
 ductape login                    # uses `cloud` profile (https://api.ductape.app)
+ductape login --browser google   # browser OAuth; returns to the CLI automatically
+ductape login --browser github
 # Local platform (UI + API on your machine):
 ductape profiles use local
 ductape start

package/dist/commands/db.js

@@ -48,6 +48,22 @@ export async function runDb(method, opts) {
     printJson(result, Boolean(opts.json));
 }
 const DB_ACTION_VERBS = ['create', 'update', 'get', 'list', 'delete', 'execute', 'dispatch'];
+const DB_ACTION_OPERATIONS = ['query', 'insert', 'update', 'delete', 'aggregate', 'count'];
+function validateDatabaseActionCreateBody(body) {
+    const operation = String(body.operation ?? '');
+    if (!DB_ACTION_OPERATIONS.includes(operation)) {
+        throw new Error(`Invalid database action operation "${operation}". Use one of: ${DB_ACTION_OPERATIONS.join(', ')}. ` +
+            'For MongoDB find/findOne actions use operation "query".');
+    }
+    const template = body.template;
+    if (!template || (typeof template !== 'object' && typeof template !== 'string')) {
+        throw new Error('template is required and must be an object for MongoDB or a SQL string.');
+    }
+    if (JSON.stringify(template).includes('$Input{')) {
+        throw new Error('Database action placeholders use {{name}}, not $Input{name}. ' +
+            'Example MongoDB query template: { "where": { "email": "{{email}}" } }.');
+    }
+}
 /**
  * Database Actions — reusable, parameterized query/mutation definitions saved against a
  * database component (databases.action.* in the SDK). Definition management is
@@ -75,6 +91,7 @@ export async function runDbActions(verb, opts, extraArgs) {
                 throw new Error('create requires a body: { tag: "product:database:action", name, tableName, ' +
                     'operation, template, description?, filterTemplate? } (pass -f <file.json>).');
             }
+            validateDatabaseActionCreateBody(body);
             method = 'action.create';
             params = [body];
             break;

package/dist/commands/features-sync.d.ts

@@ -1,6 +1,9 @@
 export interface FeaturesSyncOpts {
     filter?: string;
 }
+export declare const DUCTAPE_CATALOGUE_SYNC_ENV = "DUCTAPE_SYNC_MODE";
+export declare const DUCTAPE_FEATURE_FILTER_ENV = "DUCTAPE_FEATURE_FILTER";
+export declare function buildFeaturesSyncEnvironment(filter?: string, base?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
 /**
  * Persists code-first Ductape Features to the live product. Unlike `ductape db migrate` (which
  * executes declarative migration files directly), a Feature's handler is real application code

package/dist/commands/features-sync.js

@@ -3,6 +3,16 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { findProjectConfig } from '../lib/config.js';
 import { fail } from '../lib/output.js';
+export const DUCTAPE_CATALOGUE_SYNC_ENV = 'DUCTAPE_SYNC_MODE';
+export const DUCTAPE_FEATURE_FILTER_ENV = 'DUCTAPE_FEATURE_FILTER';
+export function buildFeaturesSyncEnvironment(filter, base = process.env) {
+    const env = { ...base, [DUCTAPE_CATALOGUE_SYNC_ENV]: '1' };
+    if (filter)
+        env[DUCTAPE_FEATURE_FILTER_ENV] = filter;
+    else
+        delete env[DUCTAPE_FEATURE_FILTER_ENV];
+    return env;
+}
 const CONVENTION_HINT = `
 Ductape convention for code-first Features:
   1. Define every Feature under ductape/features/ (e.g. ductape/features/src/my-feature.ts),
@@ -13,6 +23,11 @@ Ductape convention for code-first Features:
      construct real dependencies (no HTTP listener) and calls every registerXFeature(...) once.
   4. Run it explicitly with \`ductape features sync\` — never automatically on app boot.
 
+The CLI sets DUCTAPE_SYNC_MODE=1 for the child process. Ductape framework integrations use this
+official catalogue-only signal to skip serving-time consumers and provider readiness. Project
+readiness hooks should do the same. When a filter is supplied, it is also available as
+DUCTAPE_FEATURE_FILTER and must be applied before booting unrelated service modules.
+
 This mirrors \`ductape db migrate\`: Features are defined in source, but persisted to the live
 product via an explicit command, so a slow or unreachable Ductape API can never block your app
 from starting.
@@ -46,8 +61,12 @@ export async function runFeaturesSync(opts) {
     const npmArgs = ['run', 'features:sync'];
     if (opts.filter)
         npmArgs.push('--', opts.filter);
-    console.log(`Running "npm ${npmArgs.join(' ')}" in ${dir} ...\n`);
-    const result = spawnSync('npm', npmArgs, { cwd: dir, stdio: 'inherit' });
+    console.log(`Running "npm ${npmArgs.join(' ')}" in ${dir} (catalogue sync mode) ...\n`);
+    const result = spawnSync('npm', npmArgs, {
+        cwd: dir,
+        stdio: 'inherit',
+        env: buildFeaturesSyncEnvironment(opts.filter),
+    });
     if (result.status !== 0) {
         fail(`features:sync exited with code ${result.status ?? 1}.`);
     }

package/dist/commands/login.js

@@ -1,6 +1,8 @@
 import inputPrompt from '@inquirer/input';
 import passwordPrompt from '@inquirer/password';
 import { spawn } from 'node:child_process';
+import { createServer } from 'node:http';
+import { randomBytes } from 'node:crypto';
 import { getApiUrl, getActiveProfileName, saveCredentials } from '../lib/config.js';
 import { parseJsonResponse } from '../lib/http.js';
 import { finalizeLoginWorkspace } from '../lib/workspaces.js';
@@ -38,6 +40,58 @@ function openBrowser(url) {
             : 'xdg-open';
     spawn(cmd, [url], { detached: true, stdio: 'ignore' }).unref();
 }
+async function browserOAuthLogin(apiUrl, provider) {
+    const state = randomBytes(24).toString('base64url');
+    let timeout;
+    const tokenPromise = new Promise((resolve, reject) => {
+        const server = createServer((req, res) => {
+            const url = new URL(req.url || '/', 'http://127.0.0.1');
+            if (url.pathname !== '/callback') {
+                res.writeHead(404).end('Not found');
+                return;
+            }
+            const token = url.searchParams.get('token');
+            const returnedState = url.searchParams.get('state');
+            const error = url.searchParams.get('error');
+            const ok = !error && Boolean(token) && returnedState === state;
+            res.writeHead(ok ? 200 : 400, { 'Content-Type': 'text/html; charset=utf-8' });
+            res.end(ok
+                ? '<!doctype html><title>Ductape CLI</title><p>Login complete. You can close this window.</p>'
+                : '<!doctype html><title>Ductape CLI</title><p>Login failed. Return to your terminal.</p>');
+            server.close();
+            if (timeout)
+                clearTimeout(timeout);
+            if (error)
+                reject(new Error(`OAuth login failed: ${error}`));
+            else if (!token || returnedState !== state)
+                reject(new Error('OAuth callback validation failed'));
+            else
+                resolve(token);
+        });
+        server.on('error', reject);
+        server.listen(0, '127.0.0.1', () => {
+            const address = server.address();
+            if (!address || typeof address === 'string') {
+                server.close();
+                reject(new Error('Could not start OAuth callback listener'));
+                return;
+            }
+            const callback = `http://127.0.0.1:${address.port}/callback`;
+            const authUrl = new URL(`${apiUrl}/users/v1/auth/${provider}`);
+            authUrl.searchParams.set('cli_redirect', callback);
+            authUrl.searchParams.set('cli_state', state);
+            console.log(`Opening ${provider === 'github' ? 'GitHub' : 'Google'} in your browser…`);
+            console.log(`If the browser does not open, visit:\n  ${authUrl.toString()}\n`);
+            openBrowser(authUrl.toString());
+        });
+        timeout = setTimeout(() => {
+            server.close();
+            reject(new Error('OAuth login timed out after 5 minutes'));
+        }, 5 * 60 * 1000);
+        timeout.unref();
+    });
+    return exchangeOAuthToken(apiUrl, await tokenPromise);
+}
 export async function runLogin(opts) {
     const profileName = opts.profile ?? getActiveProfileName();
     const apiUrl = getApiUrl(opts.profile);
@@ -53,14 +107,14 @@ export async function runLogin(opts) {
         return;
     }
     if (opts.browser) {
-        const path = opts.browser === 'github' ? '/users/v1/auth/github' : '/users/v1/auth/google';
-        const authUrl = `${apiUrl}${path}`;
-        console.log('Opening browser for OAuth login…');
-        console.log(`If the browser does not open, visit:\n  ${authUrl}\n`);
-        console.log('After sign-in you will be redirected with ?loggedIn=true&token=… in the URL.\n' +
-            'Copy the token value and run:\n' +
-            '  ductape login --token "<paste-token-here>"\n');
-        openBrowser(authUrl);
+        const user = await browserOAuthLogin(apiUrl, opts.browser);
+        saveFromResult(user);
+        success(`Logged in as ${user.email} (OAuth)`);
+        await finalizeLoginWorkspace({
+            profile: opts.profile,
+            workspace: opts.workspace,
+            skipPrompt: opts.skipWorkspaceSelect,
+        });
         return;
     }
     let email = opts.email;

package/dist/index.js

@@ -74,7 +74,7 @@ program
     .option('-e, --email <email>')
     .option('-p, --password <password>')
     .option('--token <token>', 'OAuth callback token from browser redirect URL')
-    .option('--browser [provider]', 'Open browser for Google OAuth (google|github)')
+    .option('--browser [provider]', 'Log in through browser OAuth (google|github)')
     .option('--profile <name>', 'API profile', 'cloud')
     .option('-w, --workspace <id>', 'Workspace index, name, or id (skips interactive picker)')
     .option('--skip-workspace-select', 'Keep prior active workspace or default without prompting')
@@ -83,7 +83,15 @@ program
     password: opts.password,
     profile: opts.profile,
     token: opts.token,
-    browser: opts.browser === true ? 'google' : opts.browser,
+    browser: opts.browser === undefined
+        ? undefined
+        : opts.browser === true
+            ? 'google'
+            : opts.browser === 'google' || opts.browser === 'github'
+                ? opts.browser
+                : (() => {
+                    throw new Error('--browser provider must be google or github');
+                })(),
     workspace: opts.workspace,
     skipWorkspaceSelect: Boolean(opts.skipWorkspaceSelect),
 })));
@@ -814,8 +822,8 @@ const dbActions = db
     'query/insert/update/delete calls keep their raw table/where/data shape.');
 dbActions
     .command('create')
-    .description('Create a database action from a file: { tag: "product:database:action", name, tableName, operation, template }')
-    .requiredOption('--action-file <path>', 'JSON file with the action definition')
+    .description('Create a saved database action; MongoDB query example uses operation "query" and template { "where": { "email": "{{email}}" } }')
+    .requiredOption('--action-file <path>', 'JSON definition with tag, name, description, tableName, operation, and template')
     .option('--json', 'JSON output')
     .action(wrap((opts) => runDbActions('create', { file: opts.actionFile, json: opts.json }, [])));
 dbActions

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ductape/cli",
-  "version": "0.3.21",
+  "version": "0.3.23",
   "description": "Ductape CLI — local platform, login, link projects, and manage resources via the proxy (Workbench-compatible)",
   "type": "module",
   "main": "dist/index.js",