@hobble-env/cli 3.1.0 → 3.3.1

package/dist/commands/login.js

@@ -1,223 +1,16 @@
 import { Command } from "commander";
-import inquirer from "inquirer";
-import { loadConfig, saveConfig, normalizeApiUrl, } from "../lib/config.js";
-import { success, error, debug, info } from "../lib/output.js";
-import { requestDeviceCode, pollForToken, normalizeExpiresAt, DeviceFlowDeniedError, DeviceFlowExpiredError, } from "../lib/browser-login.js";
-const DEFAULT_API_URL = "http://localhost:3000";
-async function getDefaultApiUrl() {
-    const existing = await loadConfig();
-    return existing?.apiUrl ?? DEFAULT_API_URL;
-}
-async function fetchWhoami(apiUrl, headers) {
-    const url = `${apiUrl}/api/v1/whoami`;
-    debug(`GET ${url}`);
-    const res = await fetch(url, { headers });
-    debug(`${res.status} ${res.statusText}`);
-    if (!res.ok)
-        throw new Error(`whoami failed (${res.status})`);
-    return (await res.json());
-}
-function printSuccess(data) {
-    const membership = data.memberships[0];
-    if (membership) {
-        success(`Logged in as ${data.user.email} (${membership.name ?? membership.organizationId}, ${membership.role})`);
-    }
-    else {
-        success(`Logged in as ${data.user.email}`);
-    }
-}
-async function readStdinLines(n) {
-    return new Promise((resolve) => {
-        const lines = [];
-        let buf = "";
-        process.stdin.setEncoding("utf-8");
-        process.stdin.on("data", (chunk) => {
-            buf += chunk;
-            const parts = buf.split("\n");
-            buf = parts.pop() ?? "";
-            for (const line of parts) {
-                lines.push(line);
-                if (lines.length >= n) {
-                    process.stdin.pause();
-                    resolve(lines);
-                    return;
-                }
-            }
-        });
-        process.stdin.on("end", () => {
-            if (buf.length > 0)
-                lines.push(buf);
-            resolve(lines);
-        });
-        process.stdin.resume();
-    });
-}
-async function loginWithApiKey() {
-    let answers;
-    const defaultApiUrl = await getDefaultApiUrl();
-    if (!process.stdin.isTTY) {
-        // Non-interactive mode: read two lines from stdin (apiKey, apiUrl)
-        const lines = await readStdinLines(2);
-        const apiKey = lines[0] ?? "";
-        const rawApiUrl = lines[1]?.trim() || defaultApiUrl;
-        if (!apiKey) {
-            error("API key is required");
-            process.exit(1);
-        }
-        answers = { apiKey, apiUrl: normalizeApiUrl(rawApiUrl) };
-    }
-    else {
-        const prompted = await inquirer.prompt([
-            {
-                type: "password",
-                name: "apiKey",
-                message: "API Key:",
-                mask: "*",
-                validate: (v) => (v.length > 0 ? true : "API key is required"),
-            },
-            {
-                type: "input",
-                name: "apiUrl",
-                message: "API URL:",
-                default: defaultApiUrl,
-            },
-        ]);
-        answers = { apiKey: prompted.apiKey, apiUrl: normalizeApiUrl(prompted.apiUrl) };
-    }
-    const headers = {
-        "x-api-key": answers.apiKey,
-        "Content-Type": "application/json",
-    };
-    let data;
-    try {
-        data = await fetchWhoami(answers.apiUrl, headers);
-    }
-    catch (err) {
-        const msg = err.message;
-        if (msg.includes("401") || msg.toLowerCase().includes("invalid")) {
-            error("API key is invalid or expired.");
-            process.exit(1);
-        }
-        if (msg.includes("fetch") ||
-            msg.includes("ECONNREFUSED") ||
-            msg.includes("ENOTFOUND")) {
-            error(`Could not reach the server at ${answers.apiUrl}. Check the URL and try again.`);
-            process.exit(1);
-        }
-        error(`Login failed: ${msg}`);
-        process.exit(1);
-    }
-    const credential = { type: "apiKey", token: answers.apiKey };
-    await saveConfig({ apiUrl: answers.apiUrl, auth: credential });
-    printSuccess(data);
-}
-async function loginWithBrowser(opts) {
-    const defaultApiUrl = await getDefaultApiUrl();
-    const { apiUrl: rawApiUrl } = await inquirer.prompt([
-        {
-            type: "input",
-            name: "apiUrl",
-            message: "API URL:",
-            default: defaultApiUrl,
-        },
-    ]);
-    const apiUrl = normalizeApiUrl(rawApiUrl);
-    let codeRes;
-    try {
-        codeRes = await requestDeviceCode(apiUrl);
-    }
-    catch (err) {
-        const msg = err.message;
-        if (msg.includes("fetch") ||
-            msg.includes("ECONNREFUSED") ||
-            msg.includes("ENOTFOUND")) {
-            error(`Could not reach the server at ${apiUrl}. Check the URL and try again.`);
-            process.exit(1);
-        }
-        error(`Could not start device login: ${msg}`);
-        process.exit(1);
-    }
-    const verificationUrl = codeRes.verification_uri_complete ?? codeRes.verification_uri;
-    const absoluteUrl = verificationUrl.startsWith("http")
-        ? verificationUrl
-        : `${apiUrl}${verificationUrl}`;
-    info(`First copy your one-time code: ${codeRes.user_code}`);
-    if (opts.noBrowser) {
-        info(`Open this URL in your browser to continue:`);
-        info(absoluteUrl);
-    }
-    else {
-        info(`Press Enter to open ${absoluteUrl} in your browser…`);
-        await inquirer.prompt([{ type: "input", name: "_", message: "" }]);
-        if (process.env.HOBBLE_NO_OPEN !== "1") {
-            try {
-                const { default: open } = await import("open");
-                await open(absoluteUrl);
-            }
-            catch (err) {
-                debug(`open() failed: ${err.message}`);
-                // URL is already on stdout — no further action needed
-            }
-        }
-    }
-    info(`Waiting for authorization…`);
-    let token;
-    try {
-        token = await pollForToken({
-            apiUrl,
-            deviceCode: codeRes.device_code,
-            intervalSeconds: codeRes.interval ?? 5,
-        });
-    }
-    catch (err) {
-        if (err instanceof DeviceFlowDeniedError) {
-            error("Authorization denied.");
-            process.exit(1);
-        }
-        if (err instanceof DeviceFlowExpiredError) {
-            error("The login code expired. Run `hobble login` to try again.");
-            process.exit(1);
-        }
-        error(`Login failed: ${err.message}`);
-        process.exit(1);
-    }
-    // Better-Auth's device token endpoint returns `expires_in` (seconds) rather than
-    // `expires_at`. Fall back to computing the absolute expiry from `expires_in` when
-    // `expires_at` is absent.
-    const rawExpiresAt = token.expires_at !== undefined
-        ? token.expires_at
-        : token.expires_in !== undefined
-            ? Date.now() / 1000 + token.expires_in
-            : Date.now() / 1000 + 604800; // default: 7 days
-    const expiresAt = normalizeExpiresAt(rawExpiresAt);
-    const headers = {
-        Authorization: `Bearer ${token.access_token}`,
-        "Content-Type": "application/json",
-    };
-    let data;
-    try {
-        data = await fetchWhoami(apiUrl, headers);
-    }
-    catch (err) {
-        error(`Token validation failed: ${err.message}`);
-        process.exit(1);
-    }
-    await saveConfig({
-        apiUrl,
-        auth: { type: "session", token: token.access_token, expiresAt },
-    });
-    printSuccess(data);
-}
+import { loginWithApiKey, loginWithBrowser } from "../lib/auth-flow.js";
 export const loginCommand = new Command("login")
     .description("Authenticate with the secret management API")
+    .option("--url <url>", "Instance URL to sign in to (skips the URL prompt)")
     .option("--api-key", "Sign in with a long-lived API key (instead of browser session)")
     .option("--no-browser", "Skip opening the browser; print the URL only")
     .action(async (opts) => {
     // Commander represents `--no-browser` as `opts.browser === false`
     const noBrowser = opts.browser === false;
     if (opts.apiKey) {
-        await loginWithApiKey();
+        await loginWithApiKey({ url: opts.url });
         return;
     }
-    await loginWithBrowser({ noBrowser });
+    await loginWithBrowser({ url: opts.url, noBrowser });
 });

package/dist/commands/logout.js

@@ -1,25 +1,56 @@
 import { Command } from "commander";
 import inquirer from "inquirer";
-import { deleteConfig, loadConfig } from "../lib/config.js";
+import { deleteConfig, getApiUrl, loadConfig, removeCredential, } from "../lib/config.js";
+import { loadProjectConfig } from "../lib/project-config.js";
 import { success, info } from "../lib/output.js";
 export const logoutCommand = new Command("logout")
-    .description("Remove stored credentials")
-    .action(async () => {
+    .description("Remove stored credentials for the current instance")
+    .option("--all", "Remove stored credentials for every instance")
+    .action(async (opts) => {
     const config = await loadConfig();
-    if (!config) {
+    const instances = config ? Object.keys(config.credentials) : [];
+    if (!config || instances.length === 0) {
         info("Not logged in.");
         return;
     }
+    if (opts.all) {
+        const { confirm } = await inquirer.prompt([
+            {
+                type: "confirm",
+                name: "confirm",
+                message: `Remove stored credentials for ${instances.length === 1 ? "1 instance" : `${instances.length} instances`}?`,
+                default: false,
+            },
+        ]);
+        if (!confirm)
+            return;
+        await deleteConfig();
+        success("Logged out everywhere.");
+        return;
+    }
+    const projectConfig = await loadProjectConfig();
+    const apiUrl = getApiUrl(config, projectConfig?.apiUrl ?? null);
+    if (!config.credentials[apiUrl]) {
+        info(`Not logged in to ${apiUrl}.`);
+        if (instances.length > 0) {
+            info(`Stored credentials exist for: ${instances.join(", ")} — use \`hobble logout --all\` to remove them.`);
+        }
+        return;
+    }
     const { confirm } = await inquirer.prompt([
         {
             type: "confirm",
             name: "confirm",
-            message: "Remove stored credentials?",
+            message: `Remove stored credentials for ${apiUrl}?`,
             default: false,
         },
     ]);
     if (!confirm)
         return;
-    await deleteConfig();
-    success("Logged out.");
+    await removeCredential(apiUrl);
+    const remaining = instances.filter((u) => u !== apiUrl);
+    success(`Logged out of ${apiUrl}.`);
+    if (remaining.length > 0) {
+        info(`Still logged in to: ${remaining.join(", ")} — use \`hobble logout --all\` to remove everything.`);
+    }
 });

package/dist/commands/set.js

@@ -3,13 +3,7 @@ import { api } from "../lib/api.js";
 import { resolveContext } from "../lib/project-config.js";
 import { resolveProjectId } from "./list.js";
 import { success, error } from "../lib/output.js";
-async function readStdin() {
-    const chunks = [];
-    for await (const chunk of process.stdin) {
-        chunks.push(chunk);
-    }
-    return Buffer.concat(chunks).toString("utf-8").trimEnd();
-}
+import { readStdin } from "../lib/stdin.js";
 export const setCommand = new Command("set")
     .description("Create or update a secret")
     .argument("<key>", "Secret key name")

package/dist/commands/switch.js

@@ -1,6 +1,6 @@
 import { Command } from "commander";
 import { api } from "../lib/api.js";
-import { saveProjectConfig } from "../lib/project-config.js";
+import { loadProjectConfig, saveProjectConfig } from "../lib/project-config.js";
 import { success, error } from "../lib/output.js";
 export const switchCommand = new Command("switch")
     .description("Switch project and environment")
@@ -27,7 +27,13 @@ export const switchCommand = new Command("switch")
             error(`Environment "${envName}" not found in project "${projectName}".`);
             process.exit(1);
         }
-        await saveProjectConfig({ project: projectName, environment: envName });
+        // Keep an instance pin from a previous `init --url` intact.
+        const existing = await loadProjectConfig();
+        await saveProjectConfig({
+            project: projectName,
+            environment: envName,
+            ...(existing?.apiUrl ? { apiUrl: existing.apiUrl } : {}),
+        });
         success(`Switched to ${projectName}/${envName}`);
     }
     catch (err) {

package/dist/commands/whoami.js

@@ -1,6 +1,7 @@
 import { Command } from "commander";
 import { api } from "../lib/api.js";
-import { loadConfig } from "../lib/config.js";
+import { getApiUrl, loadConfig } from "../lib/config.js";
+import { loadProjectConfig } from "../lib/project-config.js";
 import { error } from "../lib/output.js";
 function describeExpiry(expiresAt) {
     const ms = Date.parse(expiresAt);
@@ -31,10 +32,16 @@ export const whoamiCommand = new Command("whoami")
             console.log("Org:   (no memberships)");
         }
         const config = await loadConfig();
-        if (config?.auth.type === "session") {
-            console.log(`Auth:  session (${describeExpiry(config.auth.expiresAt)})`);
+        const projectConfig = await loadProjectConfig();
+        const apiUrl = getApiUrl(config, projectConfig?.apiUrl ?? null);
+        console.log(`Instance: ${apiUrl}`);
+        const credential = process.env.HOBBLE_API_KEY
+            ? { type: "apiKey" }
+            : config?.credentials[apiUrl];
+        if (credential?.type === "session") {
+            console.log(`Auth:  session (${describeExpiry(credential.expiresAt)})`);
         }
-        else if (config?.auth.type === "apiKey") {
+        else if (credential?.type === "apiKey") {
             console.log(`Auth:  api key`);
         }
     }

package/dist/lib/api.d.ts

@@ -1,7 +1,20 @@
 export declare class ApiError extends Error {
     status: number;
-    constructor(status: number, message: string);
+    body?: unknown | undefined;
+    /**
+     * `body` is the parsed JSON error body (when the server sent one). The
+     * thrown `message` strings are unchanged — commands that need structured
+     * fields (e.g. the credentials multi-org 400's `candidates` array, or the
+     * zero-org 403's distinct `error` string) inspect `status` + `body`.
+     */
+    constructor(status: number, message: string, body?: unknown | undefined);
 }
+/**
+ * Pin the instance URL for the rest of this process. Used by `hobble init
+ * --url` so its API calls hit the instance it just authenticated against,
+ * before any .hobble file exists to record it.
+ */
+export declare function setApiUrlOverride(url: string): void;
 export declare const api: {
     get: (path: string) => Promise<unknown>;
     post: (path: string, body: unknown) => Promise<unknown>;

package/dist/lib/api.js

@@ -1,15 +1,33 @@
 import { loadConfig, getApiUrl, getAuthCredential } from "./config.js";
+import { loadProjectConfig } from "./project-config.js";
 import { debug } from "./output.js";
 export class ApiError extends Error {
     status;
-    constructor(status, message) {
+    body;
+    /**
+     * `body` is the parsed JSON error body (when the server sent one). The
+     * thrown `message` strings are unchanged — commands that need structured
+     * fields (e.g. the credentials multi-org 400's `candidates` array, or the
+     * zero-org 403's distinct `error` string) inspect `status` + `body`.
+     */
+    constructor(status, message, body) {
         super(message);
         this.status = status;
+        this.body = body;
         this.name = "ApiError";
     }
 }
-async function getHeaders() {
-    const credential = await getAuthCredential();
+let apiUrlOverride = null;
+/**
+ * Pin the instance URL for the rest of this process. Used by `hobble init
+ * --url` so its API calls hit the instance it just authenticated against,
+ * before any .hobble file exists to record it.
+ */
+export function setApiUrlOverride(url) {
+    apiUrlOverride = url;
+}
+async function getHeaders(baseUrl) {
+    const credential = await getAuthCredential(baseUrl);
     if (credential.type === "apiKey") {
         return {
             headers: {
@@ -29,13 +47,24 @@ async function getHeaders() {
 }
 let _baseUrlLogged = false;
 async function getBaseUrl() {
+    if (apiUrlOverride) {
+        if (!_baseUrlLogged) {
+            _baseUrlLogged = true;
+            debug(`Config: API URL pinned for this run (${apiUrlOverride})`);
+        }
+        return apiUrlOverride;
+    }
     const config = await loadConfig();
-    const url = getApiUrl(config);
+    const projectConfig = await loadProjectConfig();
+    const url = getApiUrl(config, projectConfig?.apiUrl ?? null);
     if (!_baseUrlLogged) {
         _baseUrlLogged = true;
         if (process.env.HOBBLE_API_URL) {
             debug(`Config: API URL from HOBBLE_API_URL (${url})`);
         }
+        else if (projectConfig?.apiUrl) {
+            debug(`Config: API URL from .hobble (${url})`);
+        }
         else if (config?.apiUrl) {
             debug(`Config: API URL from ~/.config/hobble/config.json (${url})`);
         }
@@ -47,7 +76,7 @@ async function getBaseUrl() {
 }
 async function request(method, path, body) {
     const baseUrl = await getBaseUrl();
-    const { headers, credentialType } = await getHeaders();
+    const { headers, credentialType } = await getHeaders(baseUrl);
     const fullUrl = `${baseUrl}${path}`;
     debug(`${method} ${fullUrl}`);
     let res;
@@ -63,18 +92,22 @@ async function request(method, path, body) {
         throw new Error(`Could not reach the server at ${baseUrl}. Check your connection or run \`hobble login\` to update the URL.`);
     }
     debug(`${res.status} ${res.statusText}`);
-    if (res.status === 401) {
-        if (credentialType === "session") {
-            throw new ApiError(401, "Your session has expired. Run `hobble login` to sign in again.");
-        }
-        throw new ApiError(401, "API key is invalid or expired. Run `hobble login` to update.");
-    }
-    if (res.status === 403) {
-        throw new ApiError(403, "You don't have permission to perform this action.");
-    }
     if (!res.ok) {
+        // Parse the error body once, up front, so structured fields survive the
+        // canned-message short-circuits below (attached as ApiError.body).
         const data = await res.json().catch(() => ({}));
-        throw new ApiError(res.status, data.error ?? `Request failed with status ${res.status}`);
+        if (res.status === 401) {
+            if (credentialType === "session") {
+                throw new ApiError(401, "Your session has expired. Run `hobble login` to sign in again.", data);
+            }
+            throw new ApiError(401, "API key is invalid or expired. Run `hobble login` to update.", data);
+        }
+        if (res.status === 403) {
+            // Keep the canned message: the server's generic 403 body is just
+            // {"error":"Forbidden"} — preferring it would regress every command.
+            throw new ApiError(403, "You don't have permission to perform this action.", data);
+        }
+        throw new ApiError(res.status, data.error ?? `Request failed with status ${res.status}`, data);
     }
     if (res.status === 204)
         return {};

package/dist/lib/auth-flow.d.ts

@@ -0,0 +1,21 @@
+export declare function loginWithApiKey(opts?: {
+    url?: string;
+}): Promise<void>;
+export declare function loginWithBrowser(opts?: {
+    url?: string;
+    noBrowser?: boolean;
+}): Promise<void>;
+/**
+ * Make sure the user is authenticated against the effective instance,
+ * starting the browser login flow inline when they aren't.
+ *
+ * Resolution order for the instance: explicit `url` (e.g. `init --url`) >
+ * HOBBLE_API_URL > .hobble apiUrl > global default. Returns the resolved URL.
+ *
+ * Only prompts on a TTY — non-interactive callers (CI) get the classic
+ * "Not logged in" error instead of a hung device-flow poll. HOBBLE_ASSUME_TTY=1
+ * lets the e2e harness exercise the interactive path through pipes.
+ */
+export declare function ensureAuthenticated(opts?: {
+    url?: string;
+}): Promise<string>;