@instafy/cli 0.1.8 → 0.1.10

package/dist/auth.js

@@ -1,7 +1,22 @@
 import kleur from "kleur";
+import { randomBytes } from "node:crypto";
+import * as http from "node:http";
+import { createRequire } from "node:module";
 import { createInterface } from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
-import { clearInstafyCliConfig, getInstafyConfigPath, resolveConfiguredStudioUrl, resolveControllerUrl, resolveUserAccessToken, writeInstafyCliConfig, } from "./config.js";
+import { clearInstafyCliConfig, clearInstafyProfileConfig, getInstafyConfigPath, getInstafyProfileConfigPath, resolveConfiguredControllerUrl, resolveConfiguredStudioUrl, resolveUserAccessToken, writeInstafyCliConfig, writeInstafyProfileConfig, } from "./config.js";
+import { installGitCredentialHelper, uninstallGitCredentialHelper } from "./git-setup.js";
+const require = createRequire(import.meta.url);
+const cliVersion = (() => {
+    try {
+        const pkg = require("../package.json");
+        return typeof pkg.version === "string" ? pkg.version : "";
+    }
+    catch {
+        return "";
+    }
+})();
+const isStagingCli = cliVersion.includes("-staging.");
 function normalizeUrl(raw) {
     const trimmed = typeof raw === "string" ? raw.trim() : "";
     if (!trimmed) {
@@ -20,6 +35,32 @@ function normalizeToken(raw) {
     }
     return trimmed;
 }
+async function loginWithPassword(params) {
+    const response = await fetch(`${params.supabaseUrl}/auth/v1/token?grant_type=password`, {
+        method: "POST",
+        headers: {
+            apikey: params.supabaseAnonKey,
+            "content-type": "application/json",
+        },
+        body: JSON.stringify({ email: params.email, password: params.password }),
+    });
+    if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        throw new Error(`Supabase login failed (${response.status}): ${text}`);
+    }
+    const body = (await response.json());
+    const accessToken = typeof body["access_token"] === "string" ? body["access_token"] : null;
+    if (!accessToken) {
+        throw new Error("Supabase login response missing access_token");
+    }
+    const refreshToken = typeof body["refresh_token"] === "string" ? body["refresh_token"] : null;
+    return {
+        accessToken,
+        refreshToken: normalizeToken(refreshToken),
+        supabaseUrl: normalizeUrl(params.supabaseUrl),
+        supabaseAnonKey: normalizeToken(params.supabaseAnonKey),
+    };
+}
 function looksLikeLocalControllerUrl(controllerUrl) {
     try {
         const parsed = new URL(controllerUrl);
@@ -30,50 +71,477 @@ function looksLikeLocalControllerUrl(controllerUrl) {
         return controllerUrl.includes("127.0.0.1") || controllerUrl.includes("localhost");
     }
 }
-function deriveDefaultStudioUrl(controllerUrl) {
-    if (looksLikeLocalControllerUrl(controllerUrl)) {
-        return "http://localhost:5173";
+async function isStudioHealthy(studioUrl, timeoutMs) {
+    const target = new URL("/cli/login", studioUrl).toString();
+    const abort = new AbortController();
+    const timeout = setTimeout(() => abort.abort(), timeoutMs);
+    timeout.unref?.();
+    try {
+        const response = await fetch(target, { signal: abort.signal });
+        return response.ok;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+async function resolveDefaultStudioUrl(controllerUrl) {
+    const hosted = "https://staging.instafy.dev";
+    if (isStagingCli) {
+        return hosted;
+    }
+    if (!looksLikeLocalControllerUrl(controllerUrl)) {
+        return hosted;
+    }
+    const local = "http://localhost:5173";
+    const healthy = await isStudioHealthy(local, 250);
+    return healthy ? local : hosted;
+}
+async function isControllerHealthy(controllerUrl, timeoutMs) {
+    const target = `${controllerUrl.replace(/\/$/, "")}/healthz`;
+    const abort = new AbortController();
+    const timeout = setTimeout(() => abort.abort(), timeoutMs);
+    timeout.unref?.();
+    try {
+        const response = await fetch(target, { signal: abort.signal });
+        return response.ok;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+function readRequestBody(request, maxBytes = 1000000) {
+    return new Promise((resolve, reject) => {
+        let buffer = "";
+        request.setEncoding("utf8");
+        request.on("data", (chunk) => {
+            buffer += chunk;
+            if (buffer.length > maxBytes) {
+                reject(new Error("Request body too large."));
+                request.destroy();
+            }
+        });
+        request.on("end", () => resolve(buffer));
+        request.on("error", (error) => reject(error));
+    });
+}
+function applyCorsHeaders(request, response) {
+    const origin = typeof request.headers.origin === "string" ? request.headers.origin : "";
+    if (origin) {
+        response.setHeader("access-control-allow-origin", origin);
+        response.setHeader("vary", "origin");
+    }
+    else {
+        response.setHeader("access-control-allow-origin", "*");
+    }
+    response.setHeader("access-control-allow-methods", "POST, OPTIONS");
+    response.setHeader("access-control-allow-headers", "content-type");
+    // Private Network Access preflight (Chrome): allow https -> http://127.0.0.1 callbacks.
+    if (request.headers["access-control-request-private-network"] === "true") {
+        response.setHeader("access-control-allow-private-network", "true");
+    }
+}
+async function startCliLoginCallbackServer() {
+    const state = randomBytes(16).toString("hex");
+    let resolved = false;
+    let resolveToken = null;
+    let rejectToken = null;
+    const tokenPromise = new Promise((resolve, reject) => {
+        resolveToken = resolve;
+        rejectToken = reject;
+    });
+    const server = http.createServer(async (request, response) => {
+        applyCorsHeaders(request, response);
+        if (request.method === "OPTIONS") {
+            response.statusCode = 204;
+            response.end();
+            return;
+        }
+        const url = new URL(request.url ?? "/", "http://127.0.0.1");
+        if (request.method !== "POST" || url.pathname !== "/callback") {
+            response.statusCode = 404;
+            response.setHeader("content-type", "application/json");
+            response.end(JSON.stringify({ ok: false, error: "Not found" }));
+            return;
+        }
+        if (resolved) {
+            response.statusCode = 409;
+            response.setHeader("content-type", "application/json");
+            response.end(JSON.stringify({ ok: false, error: "Already completed" }));
+            return;
+        }
+        try {
+            const body = await readRequestBody(request);
+            const contentType = typeof request.headers["content-type"] === "string" ? request.headers["content-type"] : "";
+            let parsedToken = null;
+            let parsedRefreshToken = null;
+            let parsedSupabaseUrl = null;
+            let parsedSupabaseAnonKey = null;
+            let parsedState = null;
+            if (contentType.includes("application/json")) {
+                const json = JSON.parse(body);
+                parsedToken =
+                    typeof json.token === "string"
+                        ? json.token
+                        : typeof json.accessToken === "string"
+                            ? json.accessToken
+                            : typeof json.access_token === "string"
+                                ? json.access_token
+                                : null;
+                parsedRefreshToken =
+                    typeof json.refreshToken === "string"
+                        ? json.refreshToken
+                        : typeof json.refresh_token === "string"
+                            ? json.refresh_token
+                            : null;
+                parsedSupabaseUrl = typeof json.supabaseUrl === "string" ? json.supabaseUrl : null;
+                parsedSupabaseAnonKey =
+                    typeof json.supabaseAnonKey === "string"
+                        ? json.supabaseAnonKey
+                        : typeof json.supabase_anon_key === "string"
+                            ? json.supabase_anon_key
+                            : null;
+                parsedState = typeof json.state === "string" ? json.state : null;
+            }
+            else {
+                const params = new URLSearchParams(body);
+                parsedToken = params.get("token");
+                parsedRefreshToken = params.get("refreshToken") ?? params.get("refresh_token");
+                parsedSupabaseUrl = params.get("supabaseUrl") ?? params.get("supabase_url");
+                parsedSupabaseAnonKey = params.get("supabaseAnonKey") ?? params.get("supabase_anon_key");
+                parsedState = params.get("state");
+            }
+            const token = normalizeToken(parsedToken);
+            const refreshToken = normalizeToken(parsedRefreshToken);
+            const supabaseUrl = normalizeUrl(parsedSupabaseUrl);
+            const supabaseAnonKey = normalizeToken(parsedSupabaseAnonKey);
+            const receivedState = normalizeToken(parsedState);
+            if (!token) {
+                response.statusCode = 400;
+                response.setHeader("content-type", "application/json");
+                response.end(JSON.stringify({ ok: false, error: "Missing token" }));
+                return;
+            }
+            if (!receivedState || receivedState !== state) {
+                response.statusCode = 403;
+                response.setHeader("content-type", "application/json");
+                response.end(JSON.stringify({ ok: false, error: "Invalid state" }));
+                return;
+            }
+            resolved = true;
+            response.statusCode = 200;
+            response.setHeader("content-type", "application/json");
+            response.end(JSON.stringify({ ok: true }));
+            resolveToken?.({
+                accessToken: token,
+                refreshToken,
+                supabaseUrl,
+                supabaseAnonKey,
+            });
+            resolveToken = null;
+        }
+        catch (error) {
+            response.statusCode = 500;
+            response.setHeader("content-type", "application/json");
+            response.end(JSON.stringify({ ok: false, error: error instanceof Error ? error.message : String(error) }));
+        }
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => resolve());
+    });
+    const address = server.address();
+    if (!address || typeof address !== "object" || typeof address.port !== "number") {
+        server.close();
+        throw new Error("Failed to start login callback server.");
     }
-    return "https://staging.instafy.dev";
+    return {
+        callbackUrl: `http://127.0.0.1:${address.port}/callback`,
+        state,
+        waitForToken: async (timeoutMs) => {
+            if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+                return tokenPromise;
+            }
+            const timeout = setTimeout(() => {
+                if (resolved)
+                    return;
+                resolved = true;
+                rejectToken?.(new Error("Timed out waiting for browser login. Copy the token and paste it into the CLI instead."));
+                rejectToken = null;
+            }, timeoutMs);
+            timeout.unref?.();
+            try {
+                return await tokenPromise;
+            }
+            finally {
+                clearTimeout(timeout);
+            }
+        },
+        cancel: () => {
+            if (resolved)
+                return;
+            resolved = true;
+            rejectToken?.(new Error("Login cancelled."));
+            rejectToken = null;
+            resolveToken = null;
+        },
+        close: () => server.close(),
+    };
 }
 export async function login(options) {
-    const controllerUrl = resolveControllerUrl({ controllerUrl: options.controllerUrl ?? null });
+    const profile = typeof options.profile === "string" && options.profile.trim() ? options.profile.trim() : null;
+    const explicitControllerUrl = normalizeUrl(options.controllerUrl ?? null) ??
+        normalizeUrl(process.env["INSTAFY_SERVER_URL"] ?? null) ??
+        normalizeUrl(process.env["CONTROLLER_BASE_URL"] ?? null) ??
+        (isStagingCli ? null : resolveConfiguredControllerUrl({ profile }));
+    const defaultLocalControllerUrl = "http://127.0.0.1:8788";
+    const defaultHostedControllerUrl = "https://controller.instafy.dev";
+    const controllerUrl = explicitControllerUrl ??
+        (isStagingCli
+            ? defaultHostedControllerUrl
+            : (await isControllerHealthy(defaultLocalControllerUrl, 250))
+                ? defaultLocalControllerUrl
+                : defaultHostedControllerUrl);
     const studioUrl = normalizeUrl(options.studioUrl ?? null) ??
         normalizeUrl(process.env["INSTAFY_STUDIO_URL"] ?? null) ??
-        resolveConfiguredStudioUrl() ??
-        deriveDefaultStudioUrl(controllerUrl);
+        (isStagingCli ? null : resolveConfiguredStudioUrl({ profile })) ??
+        (await resolveDefaultStudioUrl(controllerUrl));
     const url = new URL("/cli/login", studioUrl);
     url.searchParams.set("serverUrl", controllerUrl);
     if (options.json) {
-        console.log(JSON.stringify({ url: url.toString(), configPath: getInstafyConfigPath() }));
+        console.log(JSON.stringify({
+            url: url.toString(),
+            profile,
+            configPath: profile ? getInstafyProfileConfigPath(profile) : getInstafyConfigPath(),
+        }));
         return;
     }
+    const existing = resolveUserAccessToken({ profile });
+    const provided = normalizeToken(options.token ?? null);
+    let authPayload = provided
+        ? { accessToken: provided, refreshToken: null, supabaseUrl: null, supabaseAnonKey: null }
+        : null;
+    let usedPasswordGrant = false;
+    if (!authPayload) {
+        const email = normalizeToken(options.email ?? null) ?? normalizeToken(process.env["INSTAFY_LOGIN_EMAIL"] ?? null);
+        const password = normalizeToken(options.password ?? null) ??
+            normalizeToken(process.env["INSTAFY_LOGIN_PASSWORD"] ?? null);
+        if (email && password) {
+            const supabaseUrl = normalizeUrl(process.env["SUPABASE_URL"] ?? null) ??
+                normalizeUrl(process.env["VITE_SUPABASE_URL"] ?? null) ??
+                normalizeUrl(process.env["SUPABASE_PROJECT_URL"] ?? null);
+            const supabaseAnonKey = normalizeToken(process.env["SUPABASE_ANON_KEY"] ?? null) ??
+                normalizeToken(process.env["VITE_SUPABASE_ANON_KEY"] ?? null);
+            if (!supabaseUrl || !supabaseAnonKey) {
+                throw new Error("Email/password login requires Supabase env.\n\nSet:\n- SUPABASE_URL + SUPABASE_ANON_KEY (or VITE_SUPABASE_URL + VITE_SUPABASE_ANON_KEY)\n\nThen retry: instafy login --email <email> --password <password>");
+            }
+            authPayload = await loginWithPassword({ supabaseUrl, supabaseAnonKey, email, password });
+            usedPasswordGrant = true;
+        }
+    }
+    let callbackServer = null;
+    if (!authPayload) {
+        try {
+            callbackServer = await startCliLoginCallbackServer();
+            url.searchParams.set("cliCallbackUrl", callbackServer.callbackUrl);
+            url.searchParams.set("cliState", callbackServer.state);
+        }
+        catch {
+            callbackServer = null;
+        }
+    }
     console.log(kleur.green("Instafy CLI login"));
     console.log("");
-    console.log("1) Open this URL in your browser:");
-    console.log(kleur.cyan(url.toString()));
-    console.log("");
-    console.log("2) After you sign in, copy the token shown on that page.");
-    console.log("");
-    const provided = normalizeToken(options.token ?? null);
-    const existing = resolveUserAccessToken();
-    let token = provided;
-    if (!token) {
+    if (!authPayload) {
+        console.log("1) Open this URL in your browser:");
+        console.log(kleur.cyan(url.toString()));
+        console.log("");
+        if (callbackServer) {
+            console.log("2) Sign in — this terminal should continue automatically.");
+            console.log(kleur.gray("If it doesn't, copy the token shown on that page and paste it here."));
+        }
+        else {
+            console.log("2) After you sign in, copy the token shown on that page.");
+        }
+        console.log("");
+    }
+    else if (usedPasswordGrant) {
+        console.log(kleur.gray("Authenticated via email/password."));
+        console.log("");
+    }
+    if (!authPayload && callbackServer) {
+        if (input.isTTY) {
+            console.log(kleur.gray("Waiting for browser login…"));
+            console.log(kleur.gray("If it doesn't continue, paste the token here and press Enter."));
+            console.log("");
+            const rl = createInterface({ input, output });
+            const abort = new AbortController();
+            const manualTokenPromise = (async () => {
+                while (true) {
+                    const answer = await rl.question("Paste token (or wait): ", { signal: abort.signal });
+                    const candidate = normalizeToken(answer);
+                    if (!candidate)
+                        continue;
+                    if (candidate.startsWith("{")) {
+                        try {
+                            const json = JSON.parse(candidate);
+                            const accessToken = typeof json.accessToken === "string"
+                                ? json.accessToken
+                                : typeof json.access_token === "string"
+                                    ? json.access_token
+                                    : typeof json.token === "string"
+                                        ? json.token
+                                        : "";
+                            if (accessToken.trim()) {
+                                return {
+                                    accessToken: accessToken.trim(),
+                                    refreshToken: typeof json.refreshToken === "string"
+                                        ? json.refreshToken.trim()
+                                        : typeof json.refresh_token === "string"
+                                            ? json.refresh_token.trim()
+                                            : null,
+                                    supabaseUrl: typeof json.supabaseUrl === "string" ? json.supabaseUrl.trim() : null,
+                                    supabaseAnonKey: typeof json.supabaseAnonKey === "string"
+                                        ? json.supabaseAnonKey.trim()
+                                        : typeof json.supabase_anon_key === "string"
+                                            ? json.supabase_anon_key.trim()
+                                            : null,
+                                };
+                            }
+                        }
+                        catch {
+                            // ignore and fall back to treating this as an access token
+                        }
+                    }
+                    return { accessToken: candidate, refreshToken: null, supabaseUrl: null, supabaseAnonKey: null };
+                }
+            })();
+            try {
+                const result = await Promise.race([
+                    callbackServer
+                        .waitForToken(10 * 60000)
+                        .then((tokenValue) => ({ source: "browser", token: tokenValue })),
+                    manualTokenPromise.then((tokenValue) => ({ source: "manual", token: tokenValue })),
+                ]);
+                authPayload = result.token;
+                if (result.source === "browser") {
+                    abort.abort();
+                }
+                else {
+                    callbackServer.cancel();
+                }
+            }
+            catch (_error) {
+                // If browser login fails, keep waiting for a pasted token.
+                authPayload = await manualTokenPromise;
+                callbackServer.cancel();
+            }
+            finally {
+                try {
+                    rl.close();
+                }
+                catch {
+                    // ignore
+                }
+                callbackServer.close();
+                callbackServer = null;
+            }
+        }
+        else {
+            try {
+                authPayload = await callbackServer.waitForToken(10 * 60000);
+            }
+            catch (_error) {
+                // Ignore and fall back to manual copy/paste if possible.
+            }
+            finally {
+                callbackServer.close();
+                callbackServer = null;
+            }
+        }
+    }
+    if (!authPayload?.accessToken) {
+        if (!input.isTTY) {
+            throw new Error("No token provided.");
+        }
         const rl = createInterface({ input, output });
         try {
-            token = normalizeToken(await rl.question("Paste token: "));
+            const raw = normalizeToken(await rl.question("Paste token: "));
+            if (raw) {
+                if (raw.startsWith("{")) {
+                    try {
+                        const json = JSON.parse(raw);
+                        const accessToken = typeof json.accessToken === "string"
+                            ? json.accessToken
+                            : typeof json.access_token === "string"
+                                ? json.access_token
+                                : typeof json.token === "string"
+                                    ? json.token
+                                    : "";
+                        if (accessToken.trim()) {
+                            authPayload = {
+                                accessToken: accessToken.trim(),
+                                refreshToken: typeof json.refreshToken === "string"
+                                    ? json.refreshToken.trim()
+                                    : typeof json.refresh_token === "string"
+                                        ? json.refresh_token.trim()
+                                        : null,
+                                supabaseUrl: typeof json.supabaseUrl === "string" ? json.supabaseUrl.trim() : null,
+                                supabaseAnonKey: typeof json.supabaseAnonKey === "string"
+                                    ? json.supabaseAnonKey.trim()
+                                    : typeof json.supabase_anon_key === "string"
+                                        ? json.supabase_anon_key.trim()
+                                        : null,
+                            };
+                        }
+                    }
+                    catch {
+                        // ignore and fall through to raw token
+                    }
+                }
+                authPayload ?? (authPayload = { accessToken: raw, refreshToken: null, supabaseUrl: null, supabaseAnonKey: null });
+            }
         }
         finally {
             rl.close();
         }
     }
-    if (!token) {
+    if (!authPayload?.accessToken) {
         throw new Error("No token provided.");
     }
     if (!options.noStore) {
-        writeInstafyCliConfig({ controllerUrl, studioUrl, accessToken: token });
+        const update = {
+            controllerUrl,
+            studioUrl,
+            accessToken: authPayload.accessToken,
+            refreshToken: authPayload.refreshToken ?? undefined,
+            supabaseUrl: authPayload.supabaseUrl ?? undefined,
+            supabaseAnonKey: authPayload.supabaseAnonKey ?? undefined,
+        };
+        if (profile) {
+            writeInstafyProfileConfig(profile, update);
+        }
+        else {
+            writeInstafyCliConfig(update);
+        }
         console.log("");
-        console.log(kleur.green(`Saved token to ${getInstafyConfigPath()}`));
+        console.log(kleur.green(`Saved token to ${profile ? getInstafyProfileConfigPath(profile) : getInstafyConfigPath()}`));
+        if (options.gitSetup !== false) {
+            try {
+                const result = installGitCredentialHelper();
+                if (result.changed) {
+                    console.log(kleur.green("Enabled git auth (credential helper installed)."));
+                }
+            }
+            catch (error) {
+                console.log(kleur.yellow(`Warning: failed to configure git credential helper: ${error instanceof Error ? error.message : String(error)}`));
+            }
+        }
     }
     else if (existing) {
         console.log("");
@@ -81,14 +549,30 @@ export async function login(options) {
     }
     console.log("");
     console.log("Next:");
-    console.log(`- ${kleur.cyan("instafy project:init")}`);
-    console.log(`- ${kleur.cyan("instafy runtime:start")}`);
+    console.log(`- ${kleur.cyan("instafy project init")}`);
+    console.log(`- ${kleur.cyan("instafy runtime start")}`);
 }
 export async function logout(options) {
-    clearInstafyCliConfig(["accessToken"]);
+    if (options?.profile) {
+        clearInstafyProfileConfig(options.profile, ["accessToken", "refreshToken", "supabaseUrl", "supabaseAnonKey"]);
+    }
+    else {
+        clearInstafyCliConfig(["accessToken", "refreshToken", "supabaseUrl", "supabaseAnonKey"]);
+        try {
+            uninstallGitCredentialHelper();
+        }
+        catch {
+            // ignore git helper cleanup failures
+        }
+    }
     if (options?.json) {
         console.log(JSON.stringify({ ok: true }));
         return;
     }
-    console.log(kleur.green("Logged out (cleared saved access token)."));
+    if (options?.profile) {
+        console.log(kleur.green(`Logged out (cleared saved access token for profile "${options.profile}").`));
+    }
+    else {
+        console.log(kleur.green("Logged out (cleared saved access token)."));
+    }
 }

package/dist/config-command.js

@@ -51,6 +51,7 @@ export function configList(options) {
         controllerUrl: config.controllerUrl ?? null,
         studioUrl: config.studioUrl ?? null,
         accessTokenSet: Boolean(config.accessToken),
+        refreshTokenSet: Boolean(config.refreshToken),
         updatedAt: config.updatedAt ?? null,
     };
     if (options?.json) {
@@ -62,6 +63,7 @@ export function configList(options) {
     console.log(`controller-url: ${payload.controllerUrl ?? kleur.yellow("(not set)")}`);
     console.log(`studio-url: ${payload.studioUrl ?? kleur.yellow("(not set)")}`);
     console.log(`access-token: ${payload.accessTokenSet ? kleur.green("(set)") : kleur.yellow("(not set)")}`);
+    console.log(`refresh-token: ${payload.refreshTokenSet ? kleur.green("(set)") : kleur.yellow("(not set)")}`);
     if (payload.updatedAt) {
         console.log(`updated-at: ${payload.updatedAt}`);
     }