@gravity-rail/cli 0.2.0 → 0.4.0

package/README.md

@@ -141,7 +141,7 @@ cat member.json | gr members update -w $WORKSPACE --id 42 --allow-write
 
 | Domain | Description |
 |---|---|
-| `tasks` | Workflow tasks — CRUD, archive, clone, convert-to-abilities |
+| `tasks` | Workflow tasks — CRUD, archive, clone |
 | `chats` | Conversations — CRUD, labels, filters, messages, export, summaries |
 | `members` | Contacts and team — CRUD, labels, filters, roles, fields, import/export |
 | `workspaces` | Workspace management — CRUD, features, themes, invitations, export/import |
@@ -198,7 +198,7 @@ cat member.json | gr members update -w $WORKSPACE --id 42 --allow-write
 | `apps` | OAuth app management |
 | `oauth` | OAuth provider connections |
 | `auth` | Two-factor authentication, credentials, and password management |
-| `org` | Organization membership and invitations |
+| `org` | Organization membership, invitations, and org domains |
 
 ## Recipes
 
@@ -208,6 +208,34 @@ cat member.json | gr members update -w $WORKSPACE --id 42 --allow-write
 gr chats list -w $WORKSPACE -o json > chats.json
 ```
 
+### List chat messages with pagination
+
+```sh
+# Default returns up to 100 messages (API max)
+gr chats messages list -w $WORKSPACE --id $CHAT_ID
+
+# Paginate with --limit and --offset
+gr chats messages list -w $WORKSPACE --id $CHAT_ID --limit 50 --offset 100
+```
+
+### Register and verify an org domain
+
+```sh
+# Register the domain and get the ownership TXT record
+gr org domains register --org-uuid $ORG_UUID --domain example.com --allow-write
+
+# Verify ownership TXT
+gr org domains verify-ownership --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID --allow-write
+
+# Email DNS: enable records, then verify SPF/DKIM/DMARC/MX/return-path
+gr org domains email enable --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID --allow-write
+gr org domains email verify-mx --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID --allow-write
+
+# Site DNS: enable custom site routing, then verify CNAME
+gr org domains site enable --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID --allow-write
+gr org domains site verify-cname --org-uuid $ORG_UUID --domain-uuid $DOMAIN_UUID --allow-write
+```
+
 ### Find members by label
 
 ```sh

package/dist/auth-DBspA1Dh.d.ts

@@ -0,0 +1,86 @@
+/**
+ * CLI configuration for remote environments
+ */
+interface EnvironmentConfig {
+    apiUrl: string;
+    frontendUrl: string;
+}
+declare const ENVIRONMENTS: Record<string, EnvironmentConfig>;
+declare const CALLBACK_PORT = 31337;
+declare const CALLBACK_PATH = "/oauth/callback";
+declare const REDIRECT_URI = "http://localhost:31337/oauth/callback";
+declare function getEnvironmentConfig(env: string): EnvironmentConfig;
+
+/**
+ * CLI OAuth2 authentication utilities
+ *
+ * Provides OAuth2 with PKCE flow for CLI tools, including:
+ * - Credential caching (per environment)
+ * - Dynamic client registration
+ * - Token refresh
+ * - Browser-based authorization
+ */
+
+interface CLICredentials {
+    clientId: string;
+    clientSecret: string;
+    accessToken?: string;
+    refreshToken?: string;
+    expiresAt?: string;
+}
+interface AuthResult {
+    accessToken: string;
+    credentials?: CLICredentials;
+}
+/**
+ * Manages CLI credentials storage (flat format, one file per environment)
+ */
+declare class CredentialsManager {
+    private cacheDir;
+    private apiUrl?;
+    constructor(rootDir: string, apiUrl?: string);
+    private getCredentialsPath;
+    load(env: string): CLICredentials | null;
+    save(env: string, creds: CLICredentials): void;
+    clear(env: string): void;
+    getCacheDir(): string;
+}
+/**
+ * Generate PKCE code verifier and challenge
+ */
+declare function generatePKCE(): {
+    codeVerifier: string;
+    codeChallenge: string;
+};
+/**
+ * Open a URL in the default browser
+ */
+declare function openBrowser(url: string): void;
+/**
+ * Start a local HTTP server to receive the OAuth callback
+ */
+declare function startCallbackServer(): Promise<{
+    code: string;
+    state: string;
+}>;
+interface OAuthFlowOptions {
+    env: string;
+    envConfig: EnvironmentConfig;
+    credentialsManager: CredentialsManager;
+    clientName?: string;
+}
+/**
+ * Perform the full OAuth2 browser-based flow with PKCE.
+ *
+ * This always opens the browser for authorization. It never returns a cached
+ * token — that's the job of createAuthenticatedContext.  The only thing reused
+ * is the registered OAuth client ID (which is identity, not auth).
+ */
+declare function performOAuthFlow(options: OAuthFlowOptions): Promise<AuthResult>;
+/**
+ * Refresh an access token using a stored refresh token.
+ * Returns updated credentials on success, null on failure.
+ */
+declare function refreshAccessToken(envConfig: EnvironmentConfig, creds: CLICredentials, credentialsManager: CredentialsManager, env: string): Promise<CLICredentials | null>;
+
+export { type AuthResult as A, CredentialsManager as C, type EnvironmentConfig as E, type OAuthFlowOptions as O, REDIRECT_URI as R, CALLBACK_PATH as a, CALLBACK_PORT as b, type CLICredentials as c, ENVIRONMENTS as d, getEnvironmentConfig as e, generatePKCE as g, openBrowser as o, performOAuthFlow as p, refreshAccessToken as r, startCallbackServer as s };