@freecodecamp/universe-cli 0.7.0 → 0.7.1

package/README.md

@@ -88,8 +88,8 @@ All commands support `--json` for CI integration.
 The CLI resolves a GitHub identity in this order — first match wins:
 
 1. `$GITHUB_TOKEN` / `$GH_TOKEN` env (CI explicit)
-1. `gh auth token` shell-out (laptop with `gh` installed)
-1. Device-flow stored token at `~/.config/universe-cli/token`
+1. Device-flow stored token at `~/.config/universe-cli/token` (`universe login`)
+1. `gh auth token` shell-out (laptop fallback when no `universe login` token)
 
 CI runners must export `$GITHUB_TOKEN` explicitly. artemis validates the bearer via GitHub `GET /user`, then authorizes server-side against the Valkey-backed registry. Run `universe whoami` to see which slot resolved; inspect the sites you can deploy to with `universe sites ls --mine`.
 
@@ -111,10 +111,10 @@ Full operator walkthrough (login → deploy → promote → rollback, CI shape,
 
 ## Environment overrides
 
-| Env                         | Default                          | Purpose                                                   |
-| --------------------------- | -------------------------------- | --------------------------------------------------------- |
-| `UNIVERSE_PROXY_URL`        | `https://uploads.freecode.camp`  | Override proxy host (staging etc.)                        |
-| `UNIVERSE_GH_CLIENT_ID`     | _baked-in freeCodeCamp OAuth id_ | Override GitHub OAuth App id (fork tenants, `login` only) |
-| `GITHUB_TOKEN` / `GH_TOKEN` | —                                | Slot 1 of identity chain                                  |
+| Env                         | Default                                        | Purpose                                                    |
+| --------------------------- | ---------------------------------------------- | ---------------------------------------------------------- |
+| `UNIVERSE_PROXY_URL`        | `https://uploads.freecode.camp`                | Override proxy host (staging etc.)                         |
+| `UNIVERSE_GH_CLIENT_ID`     | _baked-in freeCodeCamp-Universe GitHub App id_ | Override GitHub App client id (fork tenants, `login` only) |
+| `GITHUB_TOKEN` / `GH_TOKEN` | —                                              | Slot 1 of identity chain                                   |
 
-The shipped binary embeds the `freeCodeCamp` GitHub OAuth App client id (public; device flow uses no `client_secret`), so `universe login` works out of the box for staff. Fork operators and self-hosted mirror tenants set `UNIVERSE_GH_CLIENT_ID` to their own OAuth App's id — env value wins when set.
+The shipped binary embeds the `freeCodeCamp-Universe` GitHub App client id (public; device flow uses no `client_secret`), so `universe login` works out of the box for staff once the App is installed on their org. Fork operators and self-hosted mirror tenants set `UNIVERSE_GH_CLIENT_ID` to their own GitHub App's id — env value wins when set.

package/dist/index.cjs

@@ -8962,14 +8962,14 @@ async function resolveIdentity(opts = {}) {
   if (isNonEmpty(ghTokenEnv)) {
     return { token: ghTokenEnv.trim(), source: "env_GH_TOKEN" };
   }
-  const ghCli = await execGh();
-  if (isNonEmpty(ghCli)) {
-    return { token: ghCli.trim(), source: "gh_cli" };
-  }
   const stored = await loadStored();
   if (isNonEmpty(stored)) {
     return { token: stored.trim(), source: "device_flow" };
   }
+  const ghCli = await execGh();
+  if (isNonEmpty(ghCli)) {
+    return { token: ghCli.trim(), source: "gh_cli" };
+  }
   return null;
 }
 
@@ -23810,6 +23810,19 @@ async function runDeviceFlow(opts) {
 
 // src/commands/login.ts
 var DEFAULT_SCOPE = "read:org user:email";
+var DEFAULT_PROXY_URL2 = "https://uploads.freecode.camp";
+var NO_SITES_WARNING = [
+  "Logged in, but the proxy reports 0 authorized sites for your account.",
+  "This usually means the Universe CLI GitHub App is not installed on the org",
+  "that owns the registry-authz team (production: `freeCodeCamp-Universe`), or",
+  "your account is not on a team granted access to any site.",
+  "",
+  "Next steps:",
+  "  1. Run `universe whoami` to confirm the identity that resolved.",
+  "  2. Ask an org owner to install the Universe CLI GitHub App on the org.",
+  "  3. Confirm your team membership at",
+  "     https://github.com/orgs/freeCodeCamp-Universe/teams."
+].join("\n");
 function emitJson2(envelope) {
   process.stdout.write(JSON.stringify(envelope) + "\n");
 }
@@ -23881,10 +23894,46 @@ async function login(options, deps = {}) {
     return;
   }
   await save(token);
+  const selfCheck = await postLoginSelfCheck(token, env, deps);
   if (options.json) {
-    emitJson2(buildEnvelope("login", true, { stored: true }));
+    emitJson2(
+      buildEnvelope("login", true, {
+        stored: true,
+        ...selfCheck.checked ? {
+          authorizedSitesCount: selfCheck.authorizedSitesCount,
+          ...selfCheck.warning ? { warning: selfCheck.warning } : {}
+        } : {}
+      })
+    );
   } else {
     success2("Logged in. Token stored at ~/.config/universe-cli/token.");
+    if (selfCheck.checked && selfCheck.warning) {
+      const warn = deps.logWarn ?? ((s) => O2.warn(s));
+      warn(selfCheck.warning);
+    }
+  }
+}
+async function postLoginSelfCheck(token, env, deps) {
+  const mkClient = deps.createProxyClient ?? createProxyClient;
+  try {
+    const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL2;
+    const client = mkClient({
+      baseUrl,
+      getAuthToken: () => token,
+      timeoutMs: parseFetchTimeoutMs(env)
+    });
+    const result = await client.whoami();
+    const count = result.authorizedSites.length;
+    if (count === 0) {
+      return {
+        checked: true,
+        authorizedSitesCount: 0,
+        warning: NO_SITES_WARNING
+      };
+    }
+    return { checked: true, authorizedSitesCount: count };
+  } catch {
+    return { checked: false, authorizedSitesCount: 0 };
   }
 }
 
@@ -24296,7 +24345,7 @@ async function rollback(options, deps = {}) {
 }
 
 // src/commands/whoami.ts
-var DEFAULT_PROXY_URL2 = "https://uploads.freecode.camp";
+var DEFAULT_PROXY_URL3 = "https://uploads.freecode.camp";
 function emitJson7(envelope) {
   process.stdout.write(JSON.stringify(envelope) + "\n");
 }
@@ -24319,7 +24368,7 @@ async function whoami(options, deps = {}) {
     exit(EXIT_CREDENTIALS);
     return;
   }
-  const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL2;
+  const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL3;
   const client = mkClient({
     baseUrl,
     getAuthToken: () => identity.token,
@@ -24573,7 +24622,7 @@ async function update(options, deps = {}) {
 }
 
 // src/cli.ts
-var version2 = true ? "0.7.0" : "0.0.0";
+var version2 = true ? "0.7.1" : "0.0.0";
 function handleActionError(command, json2, err) {
   const ctx = { json: json2, command };
   const message = err instanceof Error ? err.message : "unknown error";

package/dist/index.js

@@ -221,14 +221,14 @@ async function resolveIdentity(opts = {}) {
   if (isNonEmpty(ghTokenEnv)) {
     return { token: ghTokenEnv.trim(), source: "env_GH_TOKEN" };
   }
-  const ghCli = await execGh();
-  if (isNonEmpty(ghCli)) {
-    return { token: ghCli.trim(), source: "gh_cli" };
-  }
   const stored = await loadStored();
   if (isNonEmpty(stored)) {
     return { token: stored.trim(), source: "device_flow" };
   }
+  const ghCli = await execGh();
+  if (isNonEmpty(ghCli)) {
+    return { token: ghCli.trim(), source: "gh_cli" };
+  }
   return null;
 }
 
@@ -1308,6 +1308,19 @@ async function runDeviceFlow(opts) {
 
 // src/commands/login.ts
 var DEFAULT_SCOPE = "read:org user:email";
+var DEFAULT_PROXY_URL2 = "https://uploads.freecode.camp";
+var NO_SITES_WARNING = [
+  "Logged in, but the proxy reports 0 authorized sites for your account.",
+  "This usually means the Universe CLI GitHub App is not installed on the org",
+  "that owns the registry-authz team (production: `freeCodeCamp-Universe`), or",
+  "your account is not on a team granted access to any site.",
+  "",
+  "Next steps:",
+  "  1. Run `universe whoami` to confirm the identity that resolved.",
+  "  2. Ask an org owner to install the Universe CLI GitHub App on the org.",
+  "  3. Confirm your team membership at",
+  "     https://github.com/orgs/freeCodeCamp-Universe/teams."
+].join("\n");
 function emitJson2(envelope) {
   process.stdout.write(JSON.stringify(envelope) + "\n");
 }
@@ -1379,10 +1392,46 @@ async function login(options, deps = {}) {
     return;
   }
   await save(token);
+  const selfCheck = await postLoginSelfCheck(token, env, deps);
   if (options.json) {
-    emitJson2(buildEnvelope("login", true, { stored: true }));
+    emitJson2(
+      buildEnvelope("login", true, {
+        stored: true,
+        ...selfCheck.checked ? {
+          authorizedSitesCount: selfCheck.authorizedSitesCount,
+          ...selfCheck.warning ? { warning: selfCheck.warning } : {}
+        } : {}
+      })
+    );
   } else {
     success("Logged in. Token stored at ~/.config/universe-cli/token.");
+    if (selfCheck.checked && selfCheck.warning) {
+      const warn = deps.logWarn ?? ((s) => log3.warn(s));
+      warn(selfCheck.warning);
+    }
+  }
+}
+async function postLoginSelfCheck(token, env, deps) {
+  const mkClient = deps.createProxyClient ?? createProxyClient;
+  try {
+    const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL2;
+    const client = mkClient({
+      baseUrl,
+      getAuthToken: () => token,
+      timeoutMs: parseFetchTimeoutMs(env)
+    });
+    const result = await client.whoami();
+    const count = result.authorizedSites.length;
+    if (count === 0) {
+      return {
+        checked: true,
+        authorizedSitesCount: 0,
+        warning: NO_SITES_WARNING
+      };
+    }
+    return { checked: true, authorizedSitesCount: count };
+  } catch {
+    return { checked: false, authorizedSitesCount: 0 };
   }
 }
 
@@ -1799,7 +1848,7 @@ async function rollback(options, deps = {}) {
 
 // src/commands/whoami.ts
 import { log as log8 } from "@clack/prompts";
-var DEFAULT_PROXY_URL2 = "https://uploads.freecode.camp";
+var DEFAULT_PROXY_URL3 = "https://uploads.freecode.camp";
 function emitJson7(envelope) {
   process.stdout.write(JSON.stringify(envelope) + "\n");
 }
@@ -1822,7 +1871,7 @@ async function whoami(options, deps = {}) {
     exit(EXIT_CREDENTIALS);
     return;
   }
-  const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL2;
+  const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL3;
   const client = mkClient({
     baseUrl,
     getAuthToken: () => identity.token,
@@ -2082,7 +2131,7 @@ async function update(options, deps = {}) {
 }
 
 // src/cli.ts
-var version = true ? "0.7.0" : "0.0.0";
+var version = true ? "0.7.1" : "0.0.0";
 function handleActionError(command, json, err) {
   const ctx = { json, command };
   const message = err instanceof Error ? err.message : "unknown error";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@freecodecamp/universe-cli",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "main": "dist/index.js",
   "scripts": {
     "test": "vitest run",