@gravity-rail/cli 0.1.0 → 0.3.0

package/README.md

@@ -141,7 +141,7 @@ cat member.json | gr members update -w $WORKSPACE --id 42 --allow-write
 
 | Domain | Description |
 |---|---|
-| `tasks` | Workflow tasks — CRUD, archive, clone, convert-to-abilities |
+| `tasks` | Workflow tasks — CRUD, archive, clone |
 | `chats` | Conversations — CRUD, labels, filters, messages, export, summaries |
 | `members` | Contacts and team — CRUD, labels, filters, roles, fields, import/export |
 | `workspaces` | Workspace management — CRUD, features, themes, invitations, export/import |

package/dist/auth-DBspA1Dh.d.ts

@@ -0,0 +1,86 @@
+/**
+ * CLI configuration for remote environments
+ */
+interface EnvironmentConfig {
+    apiUrl: string;
+    frontendUrl: string;
+}
+declare const ENVIRONMENTS: Record<string, EnvironmentConfig>;
+declare const CALLBACK_PORT = 31337;
+declare const CALLBACK_PATH = "/oauth/callback";
+declare const REDIRECT_URI = "http://localhost:31337/oauth/callback";
+declare function getEnvironmentConfig(env: string): EnvironmentConfig;
+
+/**
+ * CLI OAuth2 authentication utilities
+ *
+ * Provides OAuth2 with PKCE flow for CLI tools, including:
+ * - Credential caching (per environment)
+ * - Dynamic client registration
+ * - Token refresh
+ * - Browser-based authorization
+ */
+
+interface CLICredentials {
+    clientId: string;
+    clientSecret: string;
+    accessToken?: string;
+    refreshToken?: string;
+    expiresAt?: string;
+}
+interface AuthResult {
+    accessToken: string;
+    credentials?: CLICredentials;
+}
+/**
+ * Manages CLI credentials storage (flat format, one file per environment)
+ */
+declare class CredentialsManager {
+    private cacheDir;
+    private apiUrl?;
+    constructor(rootDir: string, apiUrl?: string);
+    private getCredentialsPath;
+    load(env: string): CLICredentials | null;
+    save(env: string, creds: CLICredentials): void;
+    clear(env: string): void;
+    getCacheDir(): string;
+}
+/**
+ * Generate PKCE code verifier and challenge
+ */
+declare function generatePKCE(): {
+    codeVerifier: string;
+    codeChallenge: string;
+};
+/**
+ * Open a URL in the default browser
+ */
+declare function openBrowser(url: string): void;
+/**
+ * Start a local HTTP server to receive the OAuth callback
+ */
+declare function startCallbackServer(): Promise<{
+    code: string;
+    state: string;
+}>;
+interface OAuthFlowOptions {
+    env: string;
+    envConfig: EnvironmentConfig;
+    credentialsManager: CredentialsManager;
+    clientName?: string;
+}
+/**
+ * Perform the full OAuth2 browser-based flow with PKCE.
+ *
+ * This always opens the browser for authorization. It never returns a cached
+ * token — that's the job of createAuthenticatedContext.  The only thing reused
+ * is the registered OAuth client ID (which is identity, not auth).
+ */
+declare function performOAuthFlow(options: OAuthFlowOptions): Promise<AuthResult>;
+/**
+ * Refresh an access token using a stored refresh token.
+ * Returns updated credentials on success, null on failure.
+ */
+declare function refreshAccessToken(envConfig: EnvironmentConfig, creds: CLICredentials, credentialsManager: CredentialsManager, env: string): Promise<CLICredentials | null>;
+
+export { type AuthResult as A, CredentialsManager as C, type EnvironmentConfig as E, type OAuthFlowOptions as O, REDIRECT_URI as R, CALLBACK_PATH as a, CALLBACK_PORT as b, type CLICredentials as c, ENVIRONMENTS as d, getEnvironmentConfig as e, generatePKCE as g, openBrowser as o, performOAuthFlow as p, refreshAccessToken as r, startCallbackServer as s };