@glassly/cli 2.0.0-beta.4

package/README.md

@@ -0,0 +1,64 @@
+# @glassly/cli
+
+The `glassly` command: the one CLI for developing, releasing, and publishing
+Glassly miniapps. Scaffolded projects install it as a dev dependency, so
+`bun run dev`, `bun run release`, and `bun run pack` call it directly.
+
+The project-side commands (`dev`, `build`, `pack`, `release`, `manifest`,
+`permission`, `hardware`, `schema`) are implemented in
+[`@glassly/miniapp-cli`](https://www.npmjs.com/package/@glassly/miniapp-cli),
+which this package wraps. The account and Store commands (`login`, `org`,
+`miniapps`, `releases`, `listing`, `media`, `publish`) talk to the Glassly
+Developer Console.
+
+> **Bun-only.** This CLI ships as TypeScript and runs under [Bun](https://bun.sh)
+> (`#!/usr/bin/env bun`). Use `bun` / `bunx`, not `npx`/Node.
+
+## Install
+
+```bash
+bun add -g @glassly/cli
+glassly --help
+```
+
+Or run without installing:
+
+```bash
+bunx @glassly/cli --help
+```
+
+## Develop and test on a phone
+
+```bash
+glassly dev                  # hot-reload dev server + QR; signed dev identity when logged in
+glassly release              # build, pack, and serve a QR that installs on phones over LAN
+glassly build                # build both layers into dist/
+glassly pack                 # production-build and zip into build/<pkg>-<version>.zip
+glassly manifest             # interactive miniapp.json wizard
+glassly permission add MICROPHONE
+glassly hardware add DISPLAY REQUIRED
+glassly schema print         # the miniapp.json JSON Schema
+```
+
+`dev` and `release` take `--qr sm|md|lg` and `--qr-output <path>`. Every
+project command takes `--cwd <path>` to run against another directory.
+
+## Publish to the Glassly Miniapp Store
+
+```bash
+glassly login                # sign in to the Developer Console (opens a browser)
+glassly publish              # build, pack, sign, upload, and submit for review
+glassly miniapps list        # miniapps owned by your org
+glassly releases list <packageName>
+glassly listing set <packageName> --tagline "..."
+glassly media add <packageName> screenshot ./store/screenshots/01.png
+```
+
+Run `glassly <command> --help` for the full option set.
+
+## Backend selection
+
+The CLI talks to the production Glassly backend and Developer Console by
+default; nothing needs configuring. To point it at another deployment, set
+`CLOUD_CORE_URL`, `CLOUD_CONSOLE_URL`, and that backend's public WorkOS
+AuthKit client id in `WORKOS_CLIENT_ID`. Logins are stored per backend URL.

package/bin/glassly.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+// The CLI runs under Bun: the dev server, bundler plugins, and credential
+// store use Bun APIs. This launcher lets `npx @glassly/cli` and plain `node`
+// still work when Bun is installed, and explains what to do when it is not.
+import {spawnSync} from "node:child_process";
+import {fileURLToPath} from "node:url";
+
+const entry = fileURLToPath(new URL("../src/index.ts", import.meta.url));
+
+if (process.versions.bun) {
+  await import(entry);
+} else {
+  const result = spawnSync("bun", [entry, ...process.argv.slice(2)], {stdio: "inherit"});
+  if (result.error && result.error.code === "ENOENT") {
+    console.error("glassly runs on Bun, which is not installed or not on PATH.");
+    console.error("Install it from https://bun.sh, then run: bunx @glassly/cli --help");
+    process.exit(1);
+  }
+  process.exit(result.status ?? 1);
+}

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@glassly/cli",
+  "version": "2.0.0-beta.4",
+  "description": "The glassly command: develop, pack, release, and publish Glassly miniapps. Bun-only.",
+  "type": "module",
+  "bin": {
+    "glassly": "./bin/glassly.js"
+  },
+  "files": [
+    "bin",
+    "src"
+  ],
+  "engines": {
+    "bun": ">=1.0.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "tag": "dev"
+  },
+  "scripts": {
+    "dev": "bun src/index.ts",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@glassly/miniapp-cli": "0.1.0-beta.4",
+    "commander": "^14.0.2",
+    "qrcode": "^1.5.4"
+  },
+  "devDependencies": {
+    "@types/bun": "1.3.14",
+    "@types/qrcode": "^1.5.5"
+  },
+  "keywords": [
+    "glassly",
+    "glassly",
+    "cli",
+    "miniapp"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/tetramo-labs/glassly.git",
+    "directory": "sdk/cli"
+  },
+  "homepage": "https://github.com/tetramo-labs/glassly/tree/dev/sdk/cli#readme",
+  "bugs": {
+    "url": "https://github.com/tetramo-labs/glassly/issues"
+  }
+}

package/src/api.ts

@@ -0,0 +1,469 @@
+import type { CliConfig } from "./config";
+import type { CliCredentials } from "./credentials";
+
+const DEVICE_AUTH_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+
+export type CliJwk = Record<string, unknown> & {
+  kty?: string;
+  crv?: string;
+  x?: string;
+  d?: string;
+};
+
+export interface DeviceAuthorizationResponse {
+  device_code: string;
+  user_code: string;
+  verification_uri: string;
+  verification_uri_complete: string;
+  expires_in: number;
+  interval: number;
+}
+
+export interface LoginTokenResponse {
+  access_token: string;
+  refresh_token?: string;
+  token_type?: "Bearer";
+  expires_in?: number;
+  authentication_method?: string;
+  organization_id?: string | null;
+  user: {
+    id: string;
+    email: string;
+    first_name?: string | null;
+    last_name?: string | null;
+  };
+}
+
+export interface PendingDeviceAuthorization {
+  status: "pending";
+  interval?: number;
+}
+
+export interface SlowDownDeviceAuthorization {
+  status: "slow_down";
+  interval?: number;
+}
+
+export interface DeveloperApp {
+  id: string;
+  packageName: string;
+  name: string;
+  description: string | null;
+  status: "active" | "archived" | "suspended";
+  activeRelease: DeveloperRelease | null;
+  latestRelease: DeveloperRelease | null;
+  releaseCount: number;
+  createdAt: string | null;
+  updatedAt: string | null;
+}
+
+export interface DeveloperRelease {
+  id: string;
+  version: string;
+  status: "draft" | "submitted" | "in_review" | "accepted" | "rejected" | "published" | "suspended";
+  releaseBundleAssetId: string | null;
+  bundleSha256: string | null;
+  bundleSizeBytes: number | null;
+  manifestSha256?: string | null;
+  signingKeyId?: string | null;
+  signedAt?: string | null;
+  reviewedBy?: string | null;
+  reviewNotes?: string | null;
+  createdAt: string | null;
+  updatedAt: string | null;
+}
+
+export type MediaRole = "store_icon" | "gallery_screenshot";
+
+export interface MediaUpload {
+  role: MediaRole;
+  fileName: string;
+  contentType: string;
+  dataBase64: string;
+}
+
+export interface MediaAsset {
+  id: string;
+  role: MediaRole;
+  fileName: string;
+  contentType: string;
+  sizeBytes: number;
+  sha256: string;
+  width: number | null;
+  height: number | null;
+  sortOrder: number | null;
+  releaseId: string | null;
+  createdAt: string | null;
+}
+
+export interface ListingOverride {
+  tagline: string | null;
+  description: string | null;
+  tags: string[] | null;
+  featured: boolean;
+  featuredAt: string | null;
+}
+
+export interface DeveloperOrg {
+  id: string;
+  ownerUserId: string;
+  workosOrgId: string | null;
+  name: string;
+  packagePrefix: string;
+  packagePrefixStatus: "unverified" | "verified" | "rejected";
+  createdAt: string | null;
+  updatedAt: string | null;
+}
+
+export interface DeveloperSigningKey {
+  id: string;
+  orgId: string;
+  workosUserId: string;
+  publicKeyJwk: CliJwk;
+  status: "active" | "revoked";
+  lastUsedAt: string | null;
+  createdAt: string | null;
+  updatedAt: string | null;
+}
+
+export interface SignedBundleMetadata {
+  signingKeyId: string;
+  signature: string;
+  payload: {
+    packageName: string;
+    version: string;
+    bundleSha256: string;
+    manifestSha256: string;
+    createdAt: string;
+  };
+}
+
+export type PreinstallEnvironment = "debug" | "dev" | "staging" | "prod";
+export type PreinstallPolicy = "install_once" | "keep_updated" | "mandatory";
+
+export interface AdminUser {
+  developerId: string;
+  email: string;
+}
+
+export interface AdminRegistry {
+  id: string;
+  name: string;
+  environment: PreinstallEnvironment;
+  tenantId: string | null;
+  status: "draft" | "active" | "archived";
+  activeRevisionId: string | null;
+  createdAt: string | null;
+  updatedAt: string | null;
+}
+
+export interface AdminReleaseSummary {
+  id: string;
+  miniAppId?: string;
+  packageName: string;
+  displayName: string;
+  version: string;
+  status: DeveloperRelease["status"];
+  bundleSha256: string | null;
+  bundleSizeBytes: number | null;
+  createdAt: string | null;
+}
+
+export interface AdminRegistryRevision {
+  id: string;
+  registryId: string;
+  status: "draft" | "active" | "archived";
+  reason: string | null;
+  entries: Array<{
+    id: string;
+    miniAppId: string;
+    releaseId: string;
+    required: boolean;
+    installPolicy: PreinstallPolicy;
+    minMobileVersion: string | null;
+    maxMobileVersion: string | null;
+    priority: number;
+  }>;
+  promotedAt: string | null;
+  createdAt: string | null;
+  updatedAt: string | null;
+}
+
+export async function startLogin(config: CliConfig): Promise<DeviceAuthorizationResponse> {
+  assertWorkosClientId(config);
+  const body = new URLSearchParams({ client_id: config.workosClientId });
+  const response = await fetch(`${config.workosApiBaseUrl}/user_management/authorize/device`, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+    body,
+  });
+  if (!response.ok) throw new Error(await errorMessage(response));
+  return (await response.json()) as DeviceAuthorizationResponse;
+}
+
+export async function pollLoginToken(
+  config: CliConfig,
+  deviceCode: string,
+): Promise<LoginTokenResponse | PendingDeviceAuthorization | SlowDownDeviceAuthorization> {
+  assertWorkosClientId(config);
+  const body = new URLSearchParams({
+    grant_type: DEVICE_AUTH_GRANT_TYPE,
+    device_code: deviceCode,
+    client_id: config.workosClientId,
+  });
+  const response = await fetch(`${config.workosApiBaseUrl}/user_management/authenticate`, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+    body,
+  });
+  if (response.status === 400 || response.status === 403) {
+    const result = await response.json().catch(() => ({})) as { error?: string; error_description?: string };
+    if (result.error === "authorization_pending") return { status: "pending" };
+    if (result.error === "slow_down") return { status: "slow_down" };
+    throw new Error(result.error_description || result.error || `HTTP ${response.status}`);
+  }
+  if (!response.ok) throw new Error(await errorMessage(response));
+  return (await response.json()) as LoginTokenResponse;
+}
+
+export async function refreshLoginToken(
+  config: CliConfig,
+  refreshToken: string,
+  organizationId?: string | null,
+): Promise<LoginTokenResponse> {
+  assertWorkosClientId(config);
+  const body: Record<string, string> = {
+    client_id: config.workosClientId,
+    grant_type: "refresh_token",
+    refresh_token: refreshToken,
+  };
+  if (organizationId) body.organization_id = organizationId;
+
+  const response = await fetch(`${config.workosApiBaseUrl}/user_management/authenticate`, {
+    method: "POST",
+    headers: { "content-type": "application/json", accept: "application/json" },
+    body: JSON.stringify(body),
+  });
+  if (!response.ok) throw new Error(await errorMessage(response));
+  return (await response.json()) as LoginTokenResponse;
+}
+
+export async function listApps(credentials: CliCredentials): Promise<{ apps: DeveloperApp[] }> {
+  return coreRequest(credentials, "/api/console/apps");
+}
+
+export async function getAdminMe(credentials: CliCredentials): Promise<{ authenticated: true; admin: true; user: AdminUser | null }> {
+  return coreRequest(credentials, "/api/admin/me");
+}
+
+export async function listAdminRegistries(credentials: CliCredentials): Promise<{ registries: AdminRegistry[] }> {
+  return coreRequest(credentials, "/api/admin/preinstalled/registries");
+}
+
+export async function ensureAdminRegistry(
+  credentials: CliCredentials,
+  input: { environment: PreinstallEnvironment; name?: string; tenantId?: string | null },
+): Promise<{ registry: AdminRegistry }> {
+  return coreRequest(credentials, "/api/admin/preinstalled/registries", {
+    method: "POST",
+    body: JSON.stringify(input),
+  });
+}
+
+export async function listAdminPreinstallReleases(
+  credentials: CliCredentials,
+): Promise<{ releases: AdminReleaseSummary[] }> {
+  return coreRequest(credentials, "/api/admin/preinstalled/releases");
+}
+
+export async function listAdminRegistryRevisions(
+  credentials: CliCredentials,
+  registryId: string,
+): Promise<{ revisions: AdminRegistryRevision[] }> {
+  return coreRequest(credentials, `/api/admin/preinstalled/registries/${encodeURIComponent(registryId)}/revisions`);
+}
+
+export async function createAdminRegistryRevision(
+  credentials: CliCredentials,
+  registryId: string,
+  input: {
+    reason?: string | null;
+    entries: Array<{
+      releaseId: string;
+      required?: boolean;
+      installPolicy?: PreinstallPolicy;
+      minMobileVersion?: string | null;
+      maxMobileVersion?: string | null;
+      priority?: number;
+    }>;
+  },
+): Promise<{ revision: AdminRegistryRevision }> {
+  return coreRequest(credentials, `/api/admin/preinstalled/registries/${encodeURIComponent(registryId)}/revisions`, {
+    method: "POST",
+    body: JSON.stringify(input),
+  });
+}
+
+export async function promoteAdminRegistryRevision(
+  credentials: CliCredentials,
+  registryId: string,
+  revisionId: string,
+): Promise<{ registry: AdminRegistry; revision: AdminRegistryRevision }> {
+  return coreRequest(
+    credentials,
+    `/api/admin/preinstalled/registries/${encodeURIComponent(registryId)}/revisions/${encodeURIComponent(revisionId)}/promote`,
+    { method: "POST" },
+  );
+}
+
+export async function getOrg(credentials: CliCredentials): Promise<{ org: DeveloperOrg | null }> {
+  return coreRequest(credentials, "/api/console/org");
+}
+
+export async function upsertOrg(
+  credentials: CliCredentials,
+  input: { displayName: string; packagePrefix: string },
+): Promise<{ org: DeveloperOrg }> {
+  return coreRequest(credentials, "/api/console/org", {
+    method: "PUT",
+    body: JSON.stringify(input),
+  });
+}
+
+export async function createApp(
+  credentials: CliCredentials,
+  input: { packageName: string; displayName: string; description?: string | null },
+): Promise<{ app: DeveloperApp }> {
+  return coreRequest(credentials, "/api/console/apps", {
+    method: "POST",
+    body: JSON.stringify(input),
+  });
+}
+
+export async function deleteApp(credentials: CliCredentials, packageName: string): Promise<{ ok: true }> {
+  return coreRequest(credentials, `/api/console/apps/${encodeURIComponent(packageName)}`, {
+    method: "DELETE",
+  });
+}
+
+export async function listReleases(
+  credentials: CliCredentials,
+  packageName: string,
+): Promise<{ releases: DeveloperRelease[] }> {
+  return coreRequest(credentials, `/api/console/apps/${encodeURIComponent(packageName)}/releases`);
+}
+
+export async function updateListing(
+  credentials: CliCredentials,
+  packageName: string,
+  input: { tagline?: string | null; description?: string | null; tags?: string[] | null },
+): Promise<{ listing: ListingOverride }> {
+  return coreRequest(credentials, `/api/console/apps/${encodeURIComponent(packageName)}/listing`, {
+    method: "PUT",
+    body: JSON.stringify(input),
+  });
+}
+
+export async function listMedia(credentials: CliCredentials, packageName: string): Promise<{ media: MediaAsset[] }> {
+  return coreRequest(credentials, `/api/console/apps/${encodeURIComponent(packageName)}/media`);
+}
+
+export async function addMedia(
+  credentials: CliCredentials,
+  packageName: string,
+  input: MediaUpload,
+): Promise<{ asset: MediaAsset }> {
+  return coreRequest(credentials, `/api/console/apps/${encodeURIComponent(packageName)}/media`, {
+    method: "POST",
+    body: JSON.stringify(input),
+  });
+}
+
+export async function deleteMedia(credentials: CliCredentials, packageName: string, assetId: string): Promise<{ ok: true }> {
+  return coreRequest(
+    credentials,
+    `/api/console/apps/${encodeURIComponent(packageName)}/media/${encodeURIComponent(assetId)}`,
+    { method: "DELETE" },
+  );
+}
+
+export async function createRelease(
+  credentials: CliCredentials,
+  input: {
+    packageName: string;
+    version: string;
+    manifest: Record<string, unknown>;
+    bundleBase64: string;
+    fileName?: string;
+    signedBundle: SignedBundleMetadata;
+    media?: MediaUpload[];
+  },
+): Promise<{ release: DeveloperRelease }> {
+  return coreRequest(credentials, `/api/console/apps/${encodeURIComponent(input.packageName)}/releases`, {
+    method: "POST",
+    body: JSON.stringify(input),
+  });
+}
+
+export async function listSigningKeys(credentials: CliCredentials): Promise<{ keys: DeveloperSigningKey[] }> {
+  return coreRequest(credentials, "/api/console/signing-keys");
+}
+
+export async function registerSigningKey(
+  credentials: CliCredentials,
+  input: { publicKeyJwk: CliJwk },
+): Promise<{ key: DeveloperSigningKey }> {
+  return coreRequest(credentials, "/api/console/signing-keys", {
+    method: "POST",
+    body: JSON.stringify(input),
+  });
+}
+
+export async function submitRelease(
+  credentials: CliCredentials,
+  input: {
+    packageName: string;
+    releaseId: string;
+  },
+): Promise<{ release: DeveloperRelease }> {
+  return coreRequest(
+    credentials,
+    `/api/console/apps/${encodeURIComponent(input.packageName)}/releases/${encodeURIComponent(input.releaseId)}/submit`,
+    { method: "POST" },
+  );
+}
+
+async function coreRequest<T>(
+  credentials: CliCredentials,
+  path: string,
+  init?: RequestInit,
+): Promise<T> {
+  const response = await fetch(`${credentials.coreUrl}${path}`, {
+    ...init,
+    headers: {
+      accept: "application/json",
+      authorization: `Bearer ${credentials.token}`,
+      ...(init?.body ? { "content-type": "application/json" } : {}),
+      ...init?.headers,
+    },
+  });
+  if (!response.ok) throw new Error(await errorMessage(response));
+  return await response.json() as T;
+}
+
+function assertWorkosClientId(config: CliConfig): void {
+  if (!config.workosClientId) {
+    throw new Error(
+      "WORKOS_CLIENT_ID is set but empty. Unset it to use the production login, or set it to the AuthKit client id of the backend in CLOUD_CORE_URL.",
+    );
+  }
+}
+
+async function errorMessage(response: Response): Promise<string> {
+  try {
+    const body = (await response.json()) as { error?: string; error_description?: string };
+    return body.error_description || body.error || `HTTP ${response.status}`;
+  } catch {
+    return `HTTP ${response.status}`;
+  }
+}

package/src/config.ts

@@ -0,0 +1,34 @@
+export interface CliConfig {
+  coreUrl: string;
+  consoleUrl: string;
+  workosClientId: string;
+  workosApiBaseUrl: string;
+}
+
+// Production is the default so a developer can run `glassly login` with no
+// setup. The WorkOS client id is the public AuthKit identifier of the
+// production environment, not a secret. Internal use against dev or staging
+// overrides all three through the environment (see the glassly:* scripts in
+// cloud-v2/package.json, which take them from Doppler).
+const PRODUCTION = {
+  coreUrl: "https://core.glassly.ai",
+  consoleUrl: "https://console.glassly.ai",
+  workosClientId: "client_01KY5EVQT1PE8V11ZKZ1Q56XTK",
+};
+
+export function getConfig(): CliConfig {
+  return {
+    coreUrl: normalizeUrl(process.env.CLOUD_CORE_URL || PRODUCTION.coreUrl),
+    consoleUrl: normalizeUrl(process.env.CLOUD_CONSOLE_URL || PRODUCTION.consoleUrl),
+    workosClientId: process.env.WORKOS_CLIENT_ID || PRODUCTION.workosClientId,
+    workosApiBaseUrl: normalizeUrl(process.env.WORKOS_API_BASE_URL || "https://api.workos.com"),
+  };
+}
+
+function normalizeUrl(value: string): string {
+  const url = new URL(value);
+  url.pathname = url.pathname.replace(/\/+$/, "");
+  url.search = "";
+  url.hash = "";
+  return url.toString().replace(/\/$/, "");
+}