@illuminis/comprism 0.1.0

package/out/commands/login.js

@@ -0,0 +1,384 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.workspaceUrl = workspaceUrl;
+exports.cmdLogin = cmdLogin;
+/**
+ * `comprism login` — the whole sign in, asked one question at a time.
+ *
+ * ── Why this replaced what was there ──────────────────────────────────────
+ *
+ * Signing in used to mean typing this, correctly, from memory:
+ *
+ *     comprism connect --url https://base-tenant.completionprism.illuminis.ai --email you@company.com
+ *
+ * A new customer does not know their workspace address, has never seen that
+ * flag, and gets no second chance at a first impression. Worse, if their
+ * account required a second factor the command refused outright and told them
+ * to go and find a token in a browser, which meant the terminal product was
+ * unreachable for every account a security team had done the right thing to.
+ *
+ * So: one word, then two questions, then the code if their account asks for one.
+ *
+ *     comprism login
+ *       email:    you@acme.com
+ *       password: ••••••••
+ *       code:     123456
+ *
+ * THE WORKSPACE IS NOT ASKED FOR. It is looked up from the email's domain,
+ * which the product already does for the browser sign in: a domain maps to at
+ * most one workspace, enforced by a unique index, so there is never a choice to
+ * put in front of anybody. An unknown domain, which is what a personal email
+ * is, resolves to the shared individuals workspace, because that is exactly
+ * where signing up puts it.
+ *
+ * The lookup reads the workspace registry and never the user list, so it cannot
+ * be used to find out who has an account.
+ *
+ * `--workspace` still works, for a person whose company runs a workspace under
+ * a domain that is not in their email, and for our own testing.
+ */
+const node_os_1 = __importDefault(require("node:os"));
+const connection_1 = require("../lib/connection");
+const gateway_1 = require("../lib/gateway");
+const ui = __importStar(require("../lib/ui"));
+const prompt_1 = require("../lib/prompt");
+const out = (s = '') => process.stdout.write(s + '\n');
+/** Where a named workspace lives. One format, stated once. */
+const WORKSPACE_DOMAIN = 'completionprism.illuminis.ai';
+/**
+ * Turn what a person typed into the address of their workspace.
+ *
+ * Accepts the workspace name, which is the normal case, and also a full URL or
+ * a bare host, because somebody who was given a link will paste the link. All
+ * three arrive at the same place rather than at an error message.
+ */
+function workspaceUrl(typed) {
+    const value = typed.trim().replace(/\/+$/, '');
+    if (/^https?:\/\//i.test(value))
+        return value;
+    // A host with a port, or a machine on this network, is already an address.
+    // Without this, `localhost:8009` had our domain appended to it and the
+    // command reported a network problem for what was really a parsing one.
+    if (/^(localhost|127\.0\.0\.1)(:\d+)?$/i.test(value))
+        return `http://${value}`;
+    if (value.includes(':'))
+        return `http://${value}`;
+    if (value.includes('.'))
+        return `https://${value}`;
+    return `https://${value}.${WORKSPACE_DOMAIN}`;
+}
+/** Localhost needs the tenant named, because there is no subdomain to read. */
+function tenantFor(url, typed, flagged) {
+    if (flagged)
+        return flagged;
+    if (!/localhost|127\.0\.0\.1/.test(url))
+        return undefined;
+    // There is no subdomain on a local address to read the tenant from, so the
+    // developer tenant is assumed unless one was named.
+    return 'base-tenant';
+}
+async function post(url, path, body, tenant) {
+    const headers = { 'content-type': 'application/json' };
+    if (tenant)
+        headers['X-Tenant-ID'] = tenant;
+    const res = await fetch(`${url}${path}`, {
+        method: 'POST', headers, body: JSON.stringify(body),
+    });
+    let json = {};
+    try {
+        json = (await res.json());
+    }
+    catch { /* non-JSON body */ }
+    return { status: res.status, json };
+}
+async function runLogin(args) {
+    out(ui.banner('Sign in'));
+    out();
+    // Flags still work, for a script or a second machine. A person gets asked.
+    const flag = (name) => {
+        const i = args.indexOf(name);
+        return i >= 0 ? args[i + 1] : undefined;
+    };
+    const username = flag('--username') || flag('--email') || await (0, prompt_1.ask)('  email:    ');
+    if (!username) {
+        out(ui.fail('An email address is needed.'));
+        out();
+        process.exitCode = 1;
+        return;
+    }
+    // Where this person's workspace is. Asked of the product, not of them.
+    let typedWorkspace = flag('--workspace');
+    // Captured BEFORE the email lookup can fill it in. A workspace the product
+    // worked out is not a workspace the person typed, and only the second may be
+    // a local address. See the fence in `writeConnection`.
+    const typedByHand = Boolean(typedWorkspace);
+    if (!typedWorkspace) {
+        const live = new ui.LiveIndicator();
+        live.start('finding your workspace');
+        typedWorkspace = (await resolveWorkspace(username)) || undefined;
+        live.stop();
+        // The indicator clears its own line but leaves the cursor mid-row, so the
+        // next prompt landed after a run of blanks.
+        process.stdout.write('\r');
+        if (!typedWorkspace) {
+            out();
+            out(ui.fail('No workspace is registered for that email address.'));
+            out(`      ${ui.c.dim('if your company uses a different domain, pass --workspace <name>')}`);
+            out();
+            process.exitCode = 1;
+            return;
+        }
+    }
+    const url = workspaceUrl(typedWorkspace);
+    const tenant = tenantFor(url, typedWorkspace, flag('--tenant'));
+    const password = await (0, prompt_1.askHidden)('  password: ');
+    if (!password) {
+        out(ui.fail('A password is needed.'));
+        out();
+        process.exitCode = 1;
+        return;
+    }
+    // EVERYTHING BELOW GOES THROUGH THE ONE SERVICE.
+    //
+    // This used to call three separate addresses in sequence: sign in, second
+    // factor, then machine enrollment. Three doors for one act, and the tool had
+    // to know the order to knock on them in, which is product logic living on a
+    // customer's laptop. It is now one question, asked twice only when a second
+    // factor is genuinely required.
+    let signedIn = null;
+    let signInMessage = '';
+    {
+        let reply = await (0, gateway_1.askAt)(url, {
+            intent: 'sign_in', prompt: username, password,
+            machineLabel: `comprism on ${node_os_1.default.hostname()}`,
+        }, tenant);
+        if (reply.served === false) {
+            out();
+            out(ui.fail('That workspace is running a build that cannot sign you in yet.'));
+            out(`      ${ui.c.dim(reply.message || 'the workspace is behind this copy of the tool')}`);
+            out();
+            process.exitCode = 1;
+            return;
+        }
+        if (!reply.ok) {
+            out();
+            out(ui.fail(`Could not reach ${url}.`));
+            out(`      ${ui.c.dim('check the workspace name, and that you are on the network')}`);
+            out();
+            process.exitCode = 1;
+            return;
+        }
+        // A second factor is a normal ANSWER, not a failure. This is the whole
+        // reason the command exists: an older one gave up here and sent people to a
+        // browser to find a token by hand.
+        if (reply.sign_in?.needs_second_factor && reply.sign_in.challenge) {
+            out();
+            out(ui.info('This account uses a second step. Check your authenticator app or your email.'));
+            const code = await (0, prompt_1.ask)('  code:      ');
+            if (!code) {
+                out(ui.fail('A code is needed to finish signing in.'));
+                out();
+                process.exitCode = 1;
+                return;
+            }
+            reply = await (0, gateway_1.askAt)(url, {
+                intent: 'sign_in', prompt: username,
+                challenge: reply.sign_in.challenge, code,
+                machineLabel: `comprism on ${node_os_1.default.hostname()}`,
+            }, tenant);
+            if (!reply.ok || !reply.sign_in?.token) {
+                out();
+                out(ui.fail(reply.message || 'That code was not accepted. Codes expire after a few minutes.'));
+                out();
+                process.exitCode = 1;
+                return;
+            }
+        }
+        if (!reply.sign_in?.token) {
+            out();
+            out(ui.fail(reply.message || 'That username and password were not accepted.'));
+            out(`      ${ui.c.dim('check the workspace name too: a right password in the wrong workspace looks the same')}`);
+            out();
+            process.exitCode = 1;
+            return;
+        }
+        signedIn = reply.sign_in;
+        signInMessage = reply.message || '';
+        if (reply.complete === false && reply.message) {
+            // Signed in, but something about it is incomplete. Said, not swallowed.
+            out();
+            out(ui.warn(reply.message));
+        }
+    }
+    const token = signedIn?.token;
+    if (!token) {
+        out();
+        out(ui.fail('Sign in succeeded but no session came back.'));
+        out();
+        process.exitCode = 1;
+        return;
+    }
+    // Enrol the machine while we still hold the session, so signing in is one
+    // step rather than a sign in followed by something else to remember.
+    // The machine credential came back WITH the sign in, from the one service,
+    // which is why there is no second call here any more. An existing one is
+    // kept: signing in twice must not leave two entries in the workspace's own
+    // list of machines.
+    const existing = (0, connection_1.readConnection)();
+    // The key this sign in just issued wins.
+    //
+    // This used to prefer whatever was already on the machine, so that signing
+    // in twice did not leave two entries in the workspace's own list of
+    // machines. The rule was right for the same person signing in again and
+    // wrong for every other case: sign in as a different account, or into a
+    // different workspace, and the machine carried on holding the OLD key. The
+    // sign in reported success, the header then said the workspace could not be
+    // reached, and nothing anywhere said that the credential belonged to
+    // somebody else. A revoked key behaved the same way.
+    //
+    // The server already ends the previous credential for this machine when it
+    // issues one, so taking the new key does not leave two live. The old one is
+    // kept only when the server issued nothing at all, which is the case where
+    // there is nothing better to hold.
+    const workspaceKey = signedIn?.machine_credential
+        || existing?.workspaceKey
+        || undefined;
+    // `typedByHand` is the second half of the fence in `writeConnection`. It is
+    // true only when the person put the address on this command line, in this
+    // run. A workspace resolved from their email domain, or an address a server
+    // handed back, can never install a laptop address however convincingly it
+    // asks.
+    try {
+        (0, connection_1.writeConnection)({
+            // The address the SERVER says it answers on, UNLESS the person named one
+            // themselves on this command line.
+            //
+            // Preferring the server is right for everybody who did not type an
+            // address: a tool that stores its own guess can never be told by anybody
+            // that the guess was wrong, which is how a machine sat pointed at a dead
+            // port for an evening. It is exactly wrong for somebody who DID type one.
+            // They typed it because they meant it, and the server, being asked where
+            // it lives, answers with its public address and quietly replaces the one
+            // they chose. That made testing a change against a local copy impossible:
+            // sign in, and the tool went straight back to production.
+            url: (typedByHand && url) || signedIn?.workspace_url || url,
+            token,
+            ...(tenant ? { tenant } : {}),
+            ...(workspaceKey ? { workspaceKey } : {}),
+            everyMinutes: existing?.everyMinutes ?? 5,
+            connectedAt: existing?.connectedAt || new Date().toISOString(),
+        }, typedByHand);
+    }
+    catch (err) {
+        out();
+        out(ui.fail(err instanceof Error ? err.message : 'the workspace address was refused'));
+        out();
+        process.exitCode = 1;
+        return;
+    }
+    out();
+    out(ui.ok(`Signed in to ${ui.c.bold(url)}`));
+    if (workspaceKey) {
+        out(`      ${ui.c.dim('this machine is enrolled and revocable on its own')}`);
+        // Straight into the welcome screen, so the first thing after signing in is
+        // where they are rather than another instruction.
+        const { showWelcome } = await Promise.resolve().then(() => __importStar(require('./welcome')));
+        await showWelcome();
+    }
+    else {
+        out(ui.warn('Signed in, but this machine could not be enrolled.'));
+        // The workspace's OWN reason, carried back with the sign in. It used to
+        // come from a local variable set by a separate call, which meant a blank
+        // line whenever that call had not been the thing that failed.
+        out(`      ${ui.c.dim(signInMessage || 'the workspace did not say why')}`);
+        out(`      ${ui.c.dim('you are signed in; this machine cannot ask for work until it is enrolled')}`);
+    }
+    out();
+}
+/**
+ * Which workspace an email belongs to.
+ *
+ * Asked of the app root, which is tenant-agnostic by design and serves this
+ * exact question for the browser sign in. Returns the workspace name, or null
+ * when the product cannot place the address.
+ */
+async function resolveWorkspace(email) {
+    // ONE root, and it is production.
+    //
+    // This list used to put `http://localhost:8009` first whenever COMPRISM_DEV
+    // was set. An environment variable exported once, in a shell profile or by a
+    // test, then silently redirected every future sign in on that machine to a
+    // port that is usually not listening. That is half of how a developer's own
+    // machine came to be pointed at his laptop on 17 September 2026, reporting
+    // that his account had no keys while four were stored and active.
+    //
+    // Working against a local server is still supported and is now something a
+    // person SAYS rather than something an environment does to them:
+    // `comprism login --workspace localhost:8009`.
+    // ASKED OF THE ONE SERVICE, at the product's own address.
+    //
+    // This used to post to the authentication route directly, which made the
+    // lookup a second door the tool had to know about and knock on in the right
+    // order. It is now an intent like every other, answered without a credential
+    // because a person looking for their workspace does not have one yet.
+    const root = `https://${WORKSPACE_DOMAIN}`;
+    const reply = await (0, gateway_1.askAt)(root, { intent: 'resolve_workspace', prompt: email });
+    if (!reply.ok || reply.served === false)
+        return null;
+    const url = reply.session?.workspace_url;
+    if (!url)
+        return null;
+    try {
+        // The answer is a sign-in address. Its host is the workspace address.
+        return new URL(url).host;
+    }
+    catch {
+        return null;
+    }
+}
+async function cmdLogin(args) {
+    try {
+        await runLogin(args);
+    }
+    finally {
+        // Always, on every path. A reader left open holds the terminal and the
+        // command appears to hang after it has finished its work.
+        (0, prompt_1.closePrompt)();
+    }
+}

package/out/commands/repl.d.ts

@@ -0,0 +1 @@
+export declare function runRepl(): Promise<void>;