@hobble-env/cli 3.1.0 → 3.3.1

package/dist/lib/auth-flow.js

@@ -0,0 +1,255 @@
+import inquirer from "inquirer";
+import { DEFAULT_API_URL, findCredential, getApiUrl, isExpired, loadConfig, normalizeApiUrl, saveCredential, } from "./config.js";
+import { loadProjectConfig } from "./project-config.js";
+import { success, error, debug, info } from "./output.js";
+import { requestDeviceCode, pollForToken, normalizeExpiresAt, DeviceFlowDeniedError, DeviceFlowExpiredError, } from "./browser-login.js";
+async function getDefaultApiUrl() {
+    const existing = await loadConfig();
+    return existing?.apiUrl ?? DEFAULT_API_URL;
+}
+async function fetchWhoami(apiUrl, headers) {
+    const url = `${apiUrl}/api/v1/whoami`;
+    debug(`GET ${url}`);
+    const res = await fetch(url, { headers });
+    debug(`${res.status} ${res.statusText}`);
+    if (!res.ok)
+        throw new Error(`whoami failed (${res.status})`);
+    return (await res.json());
+}
+function printSuccess(data) {
+    const membership = data.memberships[0];
+    if (membership) {
+        success(`Logged in as ${data.user.email} (${membership.name ?? membership.organizationId}, ${membership.role})`);
+    }
+    else {
+        success(`Logged in as ${data.user.email}`);
+    }
+}
+async function readStdinLines(n) {
+    return new Promise((resolve) => {
+        const lines = [];
+        let buf = "";
+        process.stdin.setEncoding("utf-8");
+        process.stdin.on("data", (chunk) => {
+            buf += chunk;
+            const parts = buf.split("\n");
+            buf = parts.pop() ?? "";
+            for (const line of parts) {
+                lines.push(line);
+                if (lines.length >= n) {
+                    process.stdin.pause();
+                    resolve(lines);
+                    return;
+                }
+            }
+        });
+        process.stdin.on("end", () => {
+            if (buf.length > 0)
+                lines.push(buf);
+            resolve(lines);
+        });
+        process.stdin.resume();
+    });
+}
+/**
+ * Resolve the URL a login flow should target: an explicit `--url` wins and
+ * skips the prompt entirely; otherwise the user is prompted with the saved
+ * default pre-filled.
+ */
+async function resolveLoginUrl(url) {
+    if (url)
+        return normalizeApiUrl(url);
+    const defaultApiUrl = await getDefaultApiUrl();
+    const { apiUrl: rawApiUrl } = await inquirer.prompt([
+        {
+            type: "input",
+            name: "apiUrl",
+            message: "API URL:",
+            default: defaultApiUrl,
+        },
+    ]);
+    return normalizeApiUrl(rawApiUrl);
+}
+export async function loginWithApiKey(opts = {}) {
+    let apiKey;
+    let apiUrl;
+    if (!process.stdin.isTTY) {
+        // Non-interactive mode. With --url only the key is read from stdin;
+        // without it, two lines: apiKey, then apiUrl.
+        if (opts.url) {
+            const lines = await readStdinLines(1);
+            apiKey = lines[0] ?? "";
+            apiUrl = normalizeApiUrl(opts.url);
+        }
+        else {
+            const defaultApiUrl = await getDefaultApiUrl();
+            const lines = await readStdinLines(2);
+            apiKey = lines[0] ?? "";
+            apiUrl = normalizeApiUrl(lines[1]?.trim() || defaultApiUrl);
+        }
+        if (!apiKey) {
+            error("API key is required");
+            process.exit(1);
+        }
+    }
+    else {
+        const prompted = await inquirer.prompt([
+            {
+                type: "password",
+                name: "apiKey",
+                message: "API Key:",
+                mask: "*",
+                validate: (v) => (v.length > 0 ? true : "API key is required"),
+            },
+        ]);
+        apiKey = prompted.apiKey;
+        apiUrl = await resolveLoginUrl(opts.url);
+    }
+    const headers = {
+        "x-api-key": apiKey,
+        "Content-Type": "application/json",
+    };
+    let data;
+    try {
+        data = await fetchWhoami(apiUrl, headers);
+    }
+    catch (err) {
+        const msg = err.message;
+        if (msg.includes("401") || msg.toLowerCase().includes("invalid")) {
+            error("API key is invalid or expired.");
+            process.exit(1);
+        }
+        if (msg.includes("fetch") ||
+            msg.includes("ECONNREFUSED") ||
+            msg.includes("ENOTFOUND")) {
+            error(`Could not reach the server at ${apiUrl}. Check the URL and try again.`);
+            process.exit(1);
+        }
+        error(`Login failed: ${msg}`);
+        process.exit(1);
+    }
+    const credential = { type: "apiKey", token: apiKey };
+    await saveCredential(apiUrl, credential);
+    printSuccess(data);
+}
+export async function loginWithBrowser(opts = {}) {
+    const apiUrl = await resolveLoginUrl(opts.url);
+    let codeRes;
+    try {
+        codeRes = await requestDeviceCode(apiUrl);
+    }
+    catch (err) {
+        const msg = err.message;
+        if (msg.includes("fetch") ||
+            msg.includes("ECONNREFUSED") ||
+            msg.includes("ENOTFOUND")) {
+            error(`Could not reach the server at ${apiUrl}. Check the URL and try again.`);
+            process.exit(1);
+        }
+        error(`Could not start device login: ${msg}`);
+        process.exit(1);
+    }
+    const verificationUrl = codeRes.verification_uri_complete ?? codeRes.verification_uri;
+    const absoluteUrl = verificationUrl.startsWith("http")
+        ? verificationUrl
+        : `${apiUrl}${verificationUrl}`;
+    info(`First copy your one-time code: ${codeRes.user_code}`);
+    if (opts.noBrowser) {
+        info(`Open this URL in your browser to continue:`);
+        info(absoluteUrl);
+    }
+    else {
+        info(`Press Enter to open ${absoluteUrl} in your browser…`);
+        await inquirer.prompt([{ type: "input", name: "_", message: "" }]);
+        if (process.env.HOBBLE_NO_OPEN !== "1") {
+            try {
+                const { default: open } = await import("open");
+                await open(absoluteUrl);
+            }
+            catch (err) {
+                debug(`open() failed: ${err.message}`);
+                // URL is already on stdout — no further action needed
+            }
+        }
+    }
+    info(`Waiting for authorization…`);
+    let token;
+    try {
+        token = await pollForToken({
+            apiUrl,
+            deviceCode: codeRes.device_code,
+            intervalSeconds: codeRes.interval ?? 5,
+        });
+    }
+    catch (err) {
+        if (err instanceof DeviceFlowDeniedError) {
+            error("Authorization denied.");
+            process.exit(1);
+        }
+        if (err instanceof DeviceFlowExpiredError) {
+            error("The login code expired. Run `hobble login` to try again.");
+            process.exit(1);
+        }
+        error(`Login failed: ${err.message}`);
+        process.exit(1);
+    }
+    // Better-Auth's device token endpoint returns `expires_in` (seconds) rather than
+    // `expires_at`. Fall back to computing the absolute expiry from `expires_in` when
+    // `expires_at` is absent.
+    const rawExpiresAt = token.expires_at !== undefined
+        ? token.expires_at
+        : token.expires_in !== undefined
+            ? Date.now() / 1000 + token.expires_in
+            : Date.now() / 1000 + 604800; // default: 7 days
+    const expiresAt = normalizeExpiresAt(rawExpiresAt);
+    const headers = {
+        Authorization: `Bearer ${token.access_token}`,
+        "Content-Type": "application/json",
+    };
+    let data;
+    try {
+        data = await fetchWhoami(apiUrl, headers);
+    }
+    catch (err) {
+        error(`Token validation failed: ${err.message}`);
+        process.exit(1);
+    }
+    await saveCredential(apiUrl, {
+        type: "session",
+        token: token.access_token,
+        expiresAt,
+    });
+    printSuccess(data);
+}
+/**
+ * Make sure the user is authenticated against the effective instance,
+ * starting the browser login flow inline when they aren't.
+ *
+ * Resolution order for the instance: explicit `url` (e.g. `init --url`) >
+ * HOBBLE_API_URL > .hobble apiUrl > global default. Returns the resolved URL.
+ *
+ * Only prompts on a TTY — non-interactive callers (CI) get the classic
+ * "Not logged in" error instead of a hung device-flow poll. HOBBLE_ASSUME_TTY=1
+ * lets the e2e harness exercise the interactive path through pipes.
+ */
+export async function ensureAuthenticated(opts = {}) {
+    const config = await loadConfig();
+    const projectConfig = await loadProjectConfig();
+    const apiUrl = opts.url
+        ? normalizeApiUrl(opts.url)
+        : getApiUrl(config, projectConfig?.apiUrl ?? null);
+    if (process.env.HOBBLE_API_KEY)
+        return apiUrl;
+    const credential = await findCredential(apiUrl);
+    if (credential && !isExpired(credential))
+        return apiUrl;
+    const interactive = process.stdin.isTTY || process.env.HOBBLE_ASSUME_TTY === "1";
+    if (!interactive) {
+        throw new Error(`Not logged in to ${apiUrl}. Run \`hobble login\` first.`);
+    }
+    info(credential
+        ? `Your session for ${apiUrl} has expired — signing in again.`
+        : `You're not logged in to ${apiUrl} yet — signing in first.`);
+    await loginWithBrowser({ url: apiUrl });
+    return apiUrl;
+}

package/dist/lib/config.d.ts

@@ -1,3 +1,4 @@
+export declare const DEFAULT_API_URL = "http://localhost:3000";
 export type AuthCredential = {
     type: "apiKey";
     token: string;
@@ -7,14 +8,40 @@ export type AuthCredential = {
     expiresAt: string;
 };
 export interface GlobalConfig {
+    /** Default instance, used when neither HOBBLE_API_URL nor .hobble names one. */
     apiUrl: string;
-    auth: AuthCredential;
+    /** Credentials keyed by instance URL, so logins to different instances coexist. */
+    credentials: Record<string, AuthCredential>;
 }
 export declare function loadConfig(): Promise<GlobalConfig | null>;
 export declare function saveConfig(config: GlobalConfig): Promise<void>;
+/**
+ * Store a credential for one instance. The instance also becomes the global
+ * default, so the most recent login is what URL-less commands talk to.
+ * Credentials for other instances are preserved.
+ */
+export declare function saveCredential(apiUrl: string, credential: AuthCredential): Promise<void>;
+/**
+ * Drop the credential for one instance. Removes the config file entirely when
+ * it was the last credential; otherwise re-points the default at a remaining
+ * instance if the removed one was the default.
+ */
+export declare function removeCredential(apiUrl: string): Promise<void>;
 export declare function deleteConfig(): Promise<void>;
-export declare function getAuthCredential(): Promise<AuthCredential>;
-export declare function getApiUrl(config: GlobalConfig | null): string;
+/** A session credential past its expiry. API-key credentials never expire here. */
+export declare function isExpired(credential: AuthCredential): boolean;
+/**
+ * Credential for one instance: HOBBLE_API_KEY always wins (CI escape hatch),
+ * otherwise the per-instance entry in the global config.
+ */
+export declare function findCredential(apiUrl: string): Promise<AuthCredential | null>;
+export declare function getAuthCredential(apiUrl: string): Promise<AuthCredential>;
+/**
+ * Effective instance URL: HOBBLE_API_URL env > .hobble override (passed in by
+ * the caller) > global default > localhost. Callers with a .hobble in scope
+ * pass its apiUrl as `projectApiUrl`.
+ */
+export declare function getApiUrl(config: GlobalConfig | null, projectApiUrl?: string | null): string;
 /**
  * Normalize a user-supplied API URL. If the input lacks a scheme (no `://`),
  * `https://` is assumed — typing `secrets.example.com` becomes
@@ -26,4 +53,3 @@ export declare function getApiUrl(config: GlobalConfig | null): string;
  * (typically by falling back to a default).
  */
 export declare function normalizeApiUrl(input: string): string;
-export declare function requireConfig(): Promise<GlobalConfig>;

package/dist/lib/config.js

@@ -3,15 +3,11 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 const CONFIG_DIR = join(homedir(), ".config", "hobble");
 const CONFIG_FILE = join(CONFIG_DIR, "config.json");
-function isGlobalConfig(value) {
+export const DEFAULT_API_URL = "http://localhost:3000";
+function isAuthCredential(value) {
     if (!value || typeof value !== "object")
         return false;
-    const v = value;
-    if (typeof v.apiUrl !== "string")
-        return false;
-    if (!v.auth || typeof v.auth !== "object")
-        return false;
-    const a = v.auth;
+    const a = value;
     if (a.type === "apiKey")
         return typeof a.token === "string";
     if (a.type === "session") {
@@ -19,14 +15,36 @@ function isGlobalConfig(value) {
     }
     return false;
 }
+function isGlobalConfig(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const v = value;
+    if (typeof v.apiUrl !== "string")
+        return false;
+    if (!v.credentials || typeof v.credentials !== "object")
+        return false;
+    return Object.values(v.credentials).every(isAuthCredential);
+}
 function migrateLegacy(parsed) {
-    if (typeof parsed.apiKey !== "string" || typeof parsed.apiUrl !== "string") {
+    if (!parsed || typeof parsed !== "object")
         return null;
+    const authShape = parsed;
+    if (typeof authShape.apiUrl === "string" && isAuthCredential(authShape.auth)) {
+        return {
+            apiUrl: authShape.apiUrl,
+            credentials: { [authShape.apiUrl]: authShape.auth },
+        };
     }
-    return {
-        apiUrl: parsed.apiUrl,
-        auth: { type: "apiKey", token: parsed.apiKey },
-    };
+    const keyShape = parsed;
+    if (typeof keyShape.apiKey === "string" && typeof keyShape.apiUrl === "string") {
+        return {
+            apiUrl: keyShape.apiUrl,
+            credentials: {
+                [keyShape.apiUrl]: { type: "apiKey", token: keyShape.apiKey },
+            },
+        };
+    }
+    return null;
 }
 export async function loadConfig() {
     let raw;
@@ -56,6 +74,39 @@ export async function saveConfig(config) {
     await mkdir(CONFIG_DIR, { recursive: true });
     await writeFile(CONFIG_FILE, JSON.stringify(config, null, 2) + "\n", "utf-8");
 }
+/**
+ * Store a credential for one instance. The instance also becomes the global
+ * default, so the most recent login is what URL-less commands talk to.
+ * Credentials for other instances are preserved.
+ */
+export async function saveCredential(apiUrl, credential) {
+    const existing = await loadConfig();
+    await saveConfig({
+        apiUrl,
+        credentials: { ...existing?.credentials, [apiUrl]: credential },
+    });
+}
+/**
+ * Drop the credential for one instance. Removes the config file entirely when
+ * it was the last credential; otherwise re-points the default at a remaining
+ * instance if the removed one was the default.
+ */
+export async function removeCredential(apiUrl) {
+    const config = await loadConfig();
+    if (!config)
+        return;
+    const credentials = { ...config.credentials };
+    delete credentials[apiUrl];
+    const remaining = Object.keys(credentials);
+    if (remaining.length === 0) {
+        await deleteConfig();
+        return;
+    }
+    await saveConfig({
+        apiUrl: config.apiUrl === apiUrl ? remaining[0] : config.apiUrl,
+        credentials,
+    });
+}
 export async function deleteConfig() {
     try {
         await rm(CONFIG_FILE);
@@ -64,17 +115,38 @@ export async function deleteConfig() {
         // already gone
     }
 }
-export async function getAuthCredential() {
+/** A session credential past its expiry. API-key credentials never expire here. */
+export function isExpired(credential) {
+    if (credential.type !== "session")
+        return false;
+    const ms = Date.parse(credential.expiresAt);
+    return Number.isFinite(ms) && ms <= Date.now();
+}
+/**
+ * Credential for one instance: HOBBLE_API_KEY always wins (CI escape hatch),
+ * otherwise the per-instance entry in the global config.
+ */
+export async function findCredential(apiUrl) {
     const envKey = process.env.HOBBLE_API_KEY;
     if (envKey)
         return { type: "apiKey", token: envKey };
     const config = await loadConfig();
-    if (!config?.auth)
-        throw new Error("Not logged in. Run `hobble login` first.");
-    return config.auth;
+    return config?.credentials[apiUrl] ?? null;
+}
+export async function getAuthCredential(apiUrl) {
+    const credential = await findCredential(apiUrl);
+    if (!credential) {
+        throw new Error(`Not logged in to ${apiUrl}. Run \`hobble login\` first.`);
+    }
+    return credential;
 }
-export function getApiUrl(config) {
-    return process.env.HOBBLE_API_URL ?? config?.apiUrl ?? "http://localhost:3000";
+/**
+ * Effective instance URL: HOBBLE_API_URL env > .hobble override (passed in by
+ * the caller) > global default > localhost. Callers with a .hobble in scope
+ * pass its apiUrl as `projectApiUrl`.
+ */
+export function getApiUrl(config, projectApiUrl) {
+    return (process.env.HOBBLE_API_URL ?? projectApiUrl ?? config?.apiUrl ?? DEFAULT_API_URL);
 }
 /**
  * Normalize a user-supplied API URL. If the input lacks a scheme (no `://`),
@@ -93,10 +165,3 @@ export function normalizeApiUrl(input) {
     const withScheme = trimmed.includes("://") ? trimmed : `https://${trimmed}`;
     return withScheme.replace(/\/+$/, "");
 }
-export async function requireConfig() {
-    const config = await loadConfig();
-    if (!config) {
-        throw new Error("Not logged in. Run `hobble login` first.");
-    }
-    return config;
-}

package/dist/lib/project-config.d.ts

@@ -1,6 +1,12 @@
 export interface ProjectConfig {
     project: string;
     environment: string;
+    /**
+     * Optional per-directory instance override. Takes precedence over the
+     * global default apiUrl (but not over HOBBLE_API_URL). Never holds
+     * credentials — those live in the user-scoped global config, keyed by URL.
+     */
+    apiUrl?: string;
 }
 export declare function loadProjectConfig(): Promise<ProjectConfig | null>;
 export declare function saveProjectConfig(config: ProjectConfig): Promise<void>;

package/dist/lib/stdin.d.ts

@@ -0,0 +1,2 @@
+/** Read all of stdin as UTF-8, trimming the trailing newline. */
+export declare function readStdin(): Promise<string>;

package/dist/lib/stdin.js

@@ -0,0 +1,8 @@
+/** Read all of stdin as UTF-8, trimming the trailing newline. */
+export async function readStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks).toString("utf-8").trimEnd();
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hobble-env/cli",
-  "version": "3.1.0",
+  "version": "3.3.1",
   "description": "CLI for managing secrets via hobble",
   "type": "module",
   "bin": {