@ductape/cli 0.3.22 → 0.3.24

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## Unreleased
+
+- Browser OAuth now completes through a validated loopback callback and logs the CLI in automatically.
+- Feature sync now establishes the official catalogue-only lifecycle with `DUCTAPE_SYNC_MODE=1` and exposes filtered ownership through `DUCTAPE_FEATURE_FILTER` before project bootstrap.
+
 ## 0.3.0 - 2026-07-26
 
 - Added AI-led migration planning with new-codebase defaults and immutable original E2E gates.

package/README.md

@@ -48,6 +48,8 @@ Do not use `sudo npm link`; it mixes root-owned globals with your normal user.
 ```bash
 ductape install
 ductape login                    # uses `cloud` profile (https://api.ductape.app)
+ductape login --browser google   # browser OAuth; returns to the CLI automatically
+ductape login --browser github
 # Local platform (UI + API on your machine):
 ductape profiles use local
 ductape start

package/dist/commands/features-sync.d.ts

@@ -1,6 +1,9 @@
 export interface FeaturesSyncOpts {
     filter?: string;
 }
+export declare const DUCTAPE_CATALOGUE_SYNC_ENV = "DUCTAPE_SYNC_MODE";
+export declare const DUCTAPE_FEATURE_FILTER_ENV = "DUCTAPE_FEATURE_FILTER";
+export declare function buildFeaturesSyncEnvironment(filter?: string, base?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
 /**
  * Persists code-first Ductape Features to the live product. Unlike `ductape db migrate` (which
  * executes declarative migration files directly), a Feature's handler is real application code

package/dist/commands/features-sync.js

@@ -3,6 +3,16 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { findProjectConfig } from '../lib/config.js';
 import { fail } from '../lib/output.js';
+export const DUCTAPE_CATALOGUE_SYNC_ENV = 'DUCTAPE_SYNC_MODE';
+export const DUCTAPE_FEATURE_FILTER_ENV = 'DUCTAPE_FEATURE_FILTER';
+export function buildFeaturesSyncEnvironment(filter, base = process.env) {
+    const env = { ...base, [DUCTAPE_CATALOGUE_SYNC_ENV]: '1' };
+    if (filter)
+        env[DUCTAPE_FEATURE_FILTER_ENV] = filter;
+    else
+        delete env[DUCTAPE_FEATURE_FILTER_ENV];
+    return env;
+}
 const CONVENTION_HINT = `
 Ductape convention for code-first Features:
   1. Define every Feature under ductape/features/ (e.g. ductape/features/src/my-feature.ts),
@@ -13,6 +23,11 @@ Ductape convention for code-first Features:
      construct real dependencies (no HTTP listener) and calls every registerXFeature(...) once.
   4. Run it explicitly with \`ductape features sync\` — never automatically on app boot.
 
+The CLI sets DUCTAPE_SYNC_MODE=1 for the child process. Ductape framework integrations use this
+official catalogue-only signal to skip serving-time consumers and provider readiness. Project
+readiness hooks should do the same. When a filter is supplied, it is also available as
+DUCTAPE_FEATURE_FILTER and must be applied before booting unrelated service modules.
+
 This mirrors \`ductape db migrate\`: Features are defined in source, but persisted to the live
 product via an explicit command, so a slow or unreachable Ductape API can never block your app
 from starting.
@@ -46,8 +61,12 @@ export async function runFeaturesSync(opts) {
     const npmArgs = ['run', 'features:sync'];
     if (opts.filter)
         npmArgs.push('--', opts.filter);
-    console.log(`Running "npm ${npmArgs.join(' ')}" in ${dir} ...\n`);
-    const result = spawnSync('npm', npmArgs, { cwd: dir, stdio: 'inherit' });
+    console.log(`Running "npm ${npmArgs.join(' ')}" in ${dir} (catalogue sync mode) ...\n`);
+    const result = spawnSync('npm', npmArgs, {
+        cwd: dir,
+        stdio: 'inherit',
+        env: buildFeaturesSyncEnvironment(opts.filter),
+    });
     if (result.status !== 0) {
         fail(`features:sync exited with code ${result.status ?? 1}.`);
     }

package/dist/commands/login.js

@@ -1,6 +1,8 @@
 import inputPrompt from '@inquirer/input';
 import passwordPrompt from '@inquirer/password';
 import { spawn } from 'node:child_process';
+import { createServer } from 'node:http';
+import { randomBytes } from 'node:crypto';
 import { getApiUrl, getActiveProfileName, saveCredentials } from '../lib/config.js';
 import { parseJsonResponse } from '../lib/http.js';
 import { finalizeLoginWorkspace } from '../lib/workspaces.js';
@@ -38,6 +40,58 @@ function openBrowser(url) {
             : 'xdg-open';
     spawn(cmd, [url], { detached: true, stdio: 'ignore' }).unref();
 }
+async function browserOAuthLogin(apiUrl, provider) {
+    const state = randomBytes(24).toString('base64url');
+    let timeout;
+    const tokenPromise = new Promise((resolve, reject) => {
+        const server = createServer((req, res) => {
+            const url = new URL(req.url || '/', 'http://127.0.0.1');
+            if (url.pathname !== '/callback') {
+                res.writeHead(404).end('Not found');
+                return;
+            }
+            const token = url.searchParams.get('token');
+            const returnedState = url.searchParams.get('state');
+            const error = url.searchParams.get('error');
+            const ok = !error && Boolean(token) && returnedState === state;
+            res.writeHead(ok ? 200 : 400, { 'Content-Type': 'text/html; charset=utf-8' });
+            res.end(ok
+                ? '<!doctype html><title>Ductape CLI</title><p>Login complete. You can close this window.</p>'
+                : '<!doctype html><title>Ductape CLI</title><p>Login failed. Return to your terminal.</p>');
+            server.close();
+            if (timeout)
+                clearTimeout(timeout);
+            if (error)
+                reject(new Error(`OAuth login failed: ${error}`));
+            else if (!token || returnedState !== state)
+                reject(new Error('OAuth callback validation failed'));
+            else
+                resolve(token);
+        });
+        server.on('error', reject);
+        server.listen(0, '127.0.0.1', () => {
+            const address = server.address();
+            if (!address || typeof address === 'string') {
+                server.close();
+                reject(new Error('Could not start OAuth callback listener'));
+                return;
+            }
+            const callback = `http://127.0.0.1:${address.port}/callback`;
+            const authUrl = new URL(`${apiUrl}/users/v1/auth/${provider}`);
+            authUrl.searchParams.set('cli_redirect', callback);
+            authUrl.searchParams.set('cli_state', state);
+            console.log(`Opening ${provider === 'github' ? 'GitHub' : 'Google'} in your browser…`);
+            console.log(`If the browser does not open, visit:\n  ${authUrl.toString()}\n`);
+            openBrowser(authUrl.toString());
+        });
+        timeout = setTimeout(() => {
+            server.close();
+            reject(new Error('OAuth login timed out after 5 minutes'));
+        }, 5 * 60 * 1000);
+        timeout.unref();
+    });
+    return exchangeOAuthToken(apiUrl, await tokenPromise);
+}
 export async function runLogin(opts) {
     const profileName = opts.profile ?? getActiveProfileName();
     const apiUrl = getApiUrl(opts.profile);
@@ -53,14 +107,14 @@ export async function runLogin(opts) {
         return;
     }
     if (opts.browser) {
-        const path = opts.browser === 'github' ? '/users/v1/auth/github' : '/users/v1/auth/google';
-        const authUrl = `${apiUrl}${path}`;
-        console.log('Opening browser for OAuth login…');
-        console.log(`If the browser does not open, visit:\n  ${authUrl}\n`);
-        console.log('After sign-in you will be redirected with ?loggedIn=true&token=… in the URL.\n' +
-            'Copy the token value and run:\n' +
-            '  ductape login --token "<paste-token-here>"\n');
-        openBrowser(authUrl);
+        const user = await browserOAuthLogin(apiUrl, opts.browser);
+        saveFromResult(user);
+        success(`Logged in as ${user.email} (OAuth)`);
+        await finalizeLoginWorkspace({
+            profile: opts.profile,
+            workspace: opts.workspace,
+            skipPrompt: opts.skipWorkspaceSelect,
+        });
         return;
     }
     let email = opts.email;

package/dist/commands/resources.js

@@ -291,7 +291,7 @@ export async function runResourceCrud(typeName, verb, opts, extraArgs) {
         }
     }
     const method = proxyMethodForVerb(crud);
-    const proxyMethod = module === 'models' && method === 'list' ? 'fetchAll' : method;
+    const proxyMethod = (module === 'models' || module === 'feature') && method === 'list' ? 'fetchAll' : method;
     const interactive = toInteractiveOpts(opts);
     let tag = opts.tag ?? extraArgs[0];
     if (!tag && ['get', 'update', 'delete'].includes(crud) && isInteractive(interactive)) {

package/dist/index.js

@@ -74,7 +74,7 @@ program
     .option('-e, --email <email>')
     .option('-p, --password <password>')
     .option('--token <token>', 'OAuth callback token from browser redirect URL')
-    .option('--browser [provider]', 'Open browser for Google OAuth (google|github)')
+    .option('--browser [provider]', 'Log in through browser OAuth (google|github)')
     .option('--profile <name>', 'API profile', 'cloud')
     .option('-w, --workspace <id>', 'Workspace index, name, or id (skips interactive picker)')
     .option('--skip-workspace-select', 'Keep prior active workspace or default without prompting')
@@ -83,7 +83,15 @@ program
     password: opts.password,
     profile: opts.profile,
     token: opts.token,
-    browser: opts.browser === true ? 'google' : opts.browser,
+    browser: opts.browser === undefined
+        ? undefined
+        : opts.browser === true
+            ? 'google'
+            : opts.browser === 'google' || opts.browser === 'github'
+                ? opts.browser
+                : (() => {
+                    throw new Error('--browser provider must be google or github');
+                })(),
     workspace: opts.workspace,
     skipWorkspaceSelect: Boolean(opts.skipWorkspaceSelect),
 })));

package/dist/lib/proxy/sdk-proxy.d.ts

@@ -1,4 +1,4 @@
-export type SDKModule = 'product' | 'app' | 'databases' | 'graph' | 'webhooks' | 'notifications' | 'messageBrokers' | 'storage' | 'vector' | 'caches' | 'sessions' | 'quotas' | 'actions' | 'features' | 'jobs' | 'logs' | 'resilience' | 'health' | 'fallback' | 'secrets' | 'models' | 'cloud';
+export type SDKModule = 'product' | 'app' | 'databases' | 'graph' | 'webhooks' | 'notifications' | 'messageBrokers' | 'storage' | 'vector' | 'caches' | 'sessions' | 'quotas' | 'actions' | 'feature' | 'jobs' | 'logs' | 'resilience' | 'health' | 'fallback' | 'secrets' | 'models' | 'cloud';
 export interface SdkProxyContext {
     apiUrl: string;
     workspaceId: string;

package/dist/lib/resources.js

@@ -11,8 +11,8 @@ export const RESOURCE_MODULES = {
     caches: 'caches',
     job: 'jobs',
     jobs: 'jobs',
-    feature: 'features',
-    features: 'features',
+    feature: 'feature',
+    features: 'feature',
     action: 'actions',
     actions: 'actions',
     notification: 'notifications',
@@ -31,7 +31,9 @@ export const RESOURCE_MODULES = {
     quotas: 'quotas',
     health: 'health',
     healthcheck: 'health',
+    healthchecks: 'health',
     fallback: 'fallback',
+    fallbacks: 'fallback',
     model: 'models',
     models: 'models',
     product: 'product',
@@ -125,6 +127,20 @@ export function buildCrudParams(module, method, productTag, args) {
         if (method === 'list')
             return [];
     }
+    if (module === 'feature') {
+        if (method === 'list' || method === 'fetchAll')
+            return [productTag];
+        if (method === 'fetch' || method === 'delete') {
+            if (!tag)
+                throw new Error('tag is required');
+            return [tag, productTag];
+        }
+        if (method === 'update') {
+            if (!tag)
+                throw new Error('tag is required');
+            return [tag, productTag, body ?? {}];
+        }
+    }
     // Default product-scoped components
     if (method === 'create')
         return [productTag, body ?? {}];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ductape/cli",
-  "version": "0.3.22",
+  "version": "0.3.24",
   "description": "Ductape CLI — local platform, login, link projects, and manage resources via the proxy (Workbench-compatible)",
   "type": "module",
   "main": "dist/index.js",