@layoutplatforms/cli 0.2.0 → 0.3.0

package/README.md

@@ -13,14 +13,15 @@ Or run it once without installing: `npx @layoutplatforms/cli login`. Node 20 or
 
 | Command | What it does |
 |---|---|
+| `layout init [--name <name>]` | Pick or create an application, read its sandbox key, run a test order, and print `LAYOUT_APP` and `LAYOUT_SECRET_KEY` to keep. Safe to run again. |
 | `layout login [--live]` | Sign in with a code you approve in the console. `--live` adds 12 hours of production reads. |
 | `layout logout` | Revoke this CLI session and forget it here. |
 | `layout whoami` | Your developer account and this CLI session. |
 | `layout apps list`, `layout apps create` | Your applications. |
 | `layout keys list`, `layout keys create`, `layout keys revoke` | Your sandbox secret key. |
 | `layout webhooks list` | Your webhook endpoints. Add them in the console. |
-| `layout listen --forward-to <url>` | Forward events to your machine, signed like real webhooks. |
-| `layout trigger <event>` | Send a test event to your endpoints. |
+| `layout listen --forward-to <url>` | Forward sandbox events to your machine, signed like real webhooks. No endpoint needed: while it runs, Layout records the application's sandbox events for it. |
+| `layout trigger <event>` | Send a test event to your endpoints, or to a running `layout listen`. |
 | `layout api get /v1/places?query=coffee` | Call any REST endpoint and print the answer. |
 | `layout test-order` | Run a whole order against a sandbox test restaurant. |
 | `layout usage` | Your limits and what you have used today. |
@@ -30,10 +31,19 @@ Or run it once without installing: `npx @layoutplatforms/cli login`. Node 20 or
 
 Every command takes `--json`, so a coding agent can drive it. `listen`, `deliveries`, `keys list` and `webhooks list` take `--live`.
 
-In CI, set `LAYOUT_SECRET_KEY` to a sandbox key and `layout api` and `layout test-order` run without signing in.
+## Without a browser: agents and CI
+
+Make a CLI token in the console at https://developer.layout.link/console/cli (90 days by default, at most a year, shown once) and set it as `LAYOUT_CLI_TOKEN`. Every command then works with no `layout login`, in sandbox only. If both are present, `LAYOUT_CLI_TOKEN` wins. It is sent only to `https://api.layout.link`, so it is refused when `LAYOUT_API_BASE` points anywhere else. `layout logout` does not revoke it; revoke it in the console.
+
+```
+export LAYOUT_CLI_TOKEN=lcli_...
+layout init --name "My app" --json
+```
+
+`layout init --json` prints one object with `env.LAYOUT_APP`, `env.LAYOUT_SECRET_KEY` (a sandbox key) and `docs`. With only `LAYOUT_SECRET_KEY` set, `layout api` and `layout test-order` run too.
 
 ## What a CLI session can do
 
-In sandbox, everything you need to build. In production, with `layout login --live` approved from a fresh console sign-in, it reads live events, deliveries and key details for 12 hours. It never creates or shows live keys, changes production settings or places an order.
+In sandbox, everything you need to build. A `LAYOUT_CLI_TOKEN` is sandbox only, always. In production, with `layout login --live` approved from a fresh console sign-in, it reads live events, deliveries and key details for 12 hours. It never creates or shows live keys, changes production settings or places an order.
 
 Full reference: https://developer.layout.link/reference/cli

package/dist/commands/init.js

@@ -0,0 +1,90 @@
+import { bool, str } from "../args.js";
+import { DOCS_BASE } from "../config.js";
+import { CliError, EXIT, usageError } from "../errors.js";
+import { authed, remember, sandboxSecret, SECRET_ENV, signedIn } from "../context.js";
+import { placeOf, runTestOrder } from "./test-order.js";
+export const QUICKSTART = `${DOCS_BASE}/reference/quickstart`;
+async function chooseApp(ctx) {
+    const name = str(ctx.args, "name")?.trim();
+    const flag = str(ctx.args, "app")?.trim();
+    const chosen = flag ?? (name ? undefined : ctx.env.LAYOUT_APP?.trim() || undefined);
+    const { apps } = await authed(ctx, "/v1/cli/apps");
+    if (chosen) {
+        const app = apps.find((a) => a.id === chosen);
+        if (!app)
+            throw new CliError("not_found", `No application ${chosen} in this account. Run layout apps list.`, EXIT.notFound);
+        if (name && app.name !== name)
+            throw usageError(`--app ${chosen} is named ${app.name}, not ${name}. Give one of --app or --name.`);
+        return { app, created: false, secret: null };
+    }
+    if (name) {
+        const same = apps.filter((a) => a.name === name);
+        if (same.length > 1)
+            throw usageError(`${same.length} applications are named ${name}. Pick one with --app:\n${same.map((a) => `  ${a.id}`).join("\n")}`);
+        if (same[0])
+            return { app: same[0], created: false, secret: null };
+        const made = await authed(ctx, "/v1/cli/apps", { method: "POST", body: { name }, idempotent: true, retry: true });
+        return { app: made.app, created: true, secret: made.sandboxKey.secret };
+    }
+    if (apps.length === 1)
+        return { app: apps[0], created: false, secret: null };
+    if (apps.length === 0)
+        throw usageError("This account has no applications. Run layout init --name <name> to create one.");
+    throw usageError(`This account has ${apps.length} applications. Pick one with --app or --name:\n${apps.map((a) => `  ${a.id}  ${a.name}`).join("\n")}`);
+}
+async function keyFor(ctx, app) {
+    try {
+        return await sandboxSecret(ctx, app);
+    }
+    catch (err) {
+        if (!(err instanceof CliError) || err.code !== "not_found")
+            throw err;
+    }
+    const made = await authed(ctx, `/v1/cli/apps/${encodeURIComponent(app)}/keys`, { method: "POST", body: { replace: false }, idempotent: true, retry: true });
+    return made.secret;
+}
+export async function init(ctx) {
+    const { out } = ctx;
+    const place = placeOf(ctx);
+    const skip = bool(ctx.args, "skip-test");
+    signedIn(ctx);
+    const { app, created, secret: minted } = await chooseApp(ctx);
+    if (app.status === "suspended")
+        throw new CliError("app_suspended", `${app.name} is suspended. Reply to your welcome email.`, EXIT.refused);
+    const secret = minted ?? await keyFor(ctx, app.id);
+    if (!secret.startsWith("sk_test_"))
+        throw new CliError("unexpected_key", "Layout returned something other than a sandbox key, so it was not used.", EXIT.error);
+    remember(ctx, app.id, secret);
+    const env = { LAYOUT_APP: app.id, [SECRET_ENV]: secret };
+    const summary = { app: { id: app.id, name: app.name, status: app.status }, created, env, docs: QUICKSTART };
+    if (!out.json) {
+        out.line(`${created ? "Created" : "Using"} ${app.name} (${app.id}).`);
+        out.line();
+        out.line("Add these to your environment. The key is sandbox only; keep it out of source control.");
+        for (const [k, v] of Object.entries(env))
+            out.line(`  ${k}=${k === SECRET_ENV ? out.accent(v) : v}`);
+        out.line();
+        out.line(`Docs: ${QUICKSTART}`);
+    }
+    let testOrder = null;
+    if (!skip) {
+        if (!out.json) {
+            out.line();
+            out.line(`Running a sandbox test order at ${place}.`);
+        }
+        const steps = [];
+        try {
+            testOrder = await runTestOrder(ctx, { app: app.id, place, steps, secret: { value: secret, from: "for layout init" } });
+        }
+        catch (err) {
+            if (out.json)
+                out.data({ ...summary, testOrder: { place, steps, order: null, ok: false }, ok: false });
+            throw err;
+        }
+    }
+    out.result({ ...summary, testOrder, ok: true }, () => {
+        if (testOrder)
+            out.line("Done. Nothing reached a restaurant and no money moved.");
+    });
+    return EXIT.ok;
+}

package/dist/commands/listen.js

@@ -1,7 +1,7 @@
 import { join } from "node:path";
 import { bool, str } from "../args.js";
 import { configDir, hostKey, readJson, writePrivateJson } from "../config.js";
-import { EXIT, usageError } from "../errors.js";
+import { CliError, EXIT, usageError } from "../errors.js";
 import { authed, pickApp } from "../context.js";
 import { isLive, WEBHOOKS_PAGE } from "./resources.js";
 import { mintLocalSecret, runListener } from "../listen.js";
@@ -44,15 +44,16 @@ export async function listen(ctx) {
     else
         start = (await authed(ctx, `/v1/cli/apps/${enc}/events/cursor${envq ? `?${envq}` : ""}`)).cursor;
     const hooks = await authed(ctx, `/v1/cli/apps/${enc}/webhooks${envq ? `?${envq}` : ""}`);
+    const session = live ? null : await openListen(ctx, enc);
     const secret = mintLocalSecret();
     if (out.json)
-        out.data({ event: "listening", app, environment: live ? "live" : "sandbox", forwardTo, secret, resumed: Boolean(saved) && !bool(ctx.args, "from-start") });
+        out.data({ event: "listening", app, environment: live ? "live" : "sandbox", forwardTo, secret, resumed: Boolean(saved) && !bool(ctx.args, "from-start"), recordsWithoutEndpoint: Boolean(session) });
     else {
         out.line(`Forwarding ${live ? out.accent("production") : "sandbox"} events for ${app} to ${forwardTo}`);
         out.line(`Signing secret for this run  ${out.accent(secret)}`);
         out.line(saved && !bool(ctx.args, "from-start") ? "Resuming after the last event forwarded." : "Starting from now. Press Ctrl-C to stop.");
     }
-    if (!hooks.subscriptions.some((s) => s.enabled)) {
+    if (!session && !hooks.subscriptions.some((s) => s.enabled)) {
         out.note(`This application has no enabled webhook endpoint, so Layout records no events for it. Add one once in the console: ${WEBHOOKS_PAGE}`);
     }
     let stopped = false;
@@ -84,6 +85,7 @@ export async function listen(ctx) {
             },
             saveCursor: (cursor) => writePrivateJson(stateFile, { cursor, updatedAt: new Date(p.now()).toISOString() }),
             sleep: async (ms) => {
+                await session?.keepAlive().catch(() => undefined);
                 const until = p.now() + ms;
                 while (!stopped && p.now() < until)
                     await p.sleep(Math.min(250, until - p.now()));
@@ -96,6 +98,41 @@ export async function listen(ctx) {
     finally {
         spin.stop();
         off();
+        await session?.close();
     }
     return stopped ? EXIT.interrupted : EXIT.ok;
 }
+const RENEW_EVERY_MS = 45_000;
+/** Null before migration 0326, and listen then needs an enabled endpoint as before. */
+async function openListen(ctx, enc) {
+    const open = () => authed(ctx, `/v1/cli/apps/${enc}/listen`, { method: "POST", body: {}, idempotent: true, retry: true }).then((r) => r.listen.id);
+    let id;
+    try {
+        id = await open();
+    }
+    catch (err) {
+        if (err instanceof CliError && err.exit === EXIT.auth)
+            throw err;
+        return null;
+    }
+    let renewedAt = ctx.p.now();
+    return {
+        async keepAlive() {
+            if (ctx.p.now() - renewedAt < RENEW_EVERY_MS)
+                return;
+            try {
+                await authed(ctx, `/v1/cli/apps/${enc}/listen/${encodeURIComponent(id)}/renew`, { method: "POST", body: {}, idempotent: true, retry: true });
+                renewedAt = ctx.p.now();
+            }
+            catch (err) {
+                if (err instanceof CliError && err.code === "listen_expired") {
+                    id = await open().catch(() => id);
+                    renewedAt = ctx.p.now();
+                }
+            }
+        },
+        async close() {
+            await authed(ctx, `/v1/cli/apps/${enc}/listen/${encodeURIComponent(id)}/close`, { method: "POST", body: {}, idempotent: true, retry: false, timeoutMs: 5_000 }).catch(() => undefined);
+        },
+    };
+}

package/dist/commands/resources.js

@@ -100,6 +100,8 @@ export async function trigger(ctx) {
         method: "POST", body: { event, ...(order ? { orderId: order } : {}) }, idempotent: true, retry: true,
     });
     ctx.out.result({ app, ...data }, () => {
+        if (data.recorded)
+            return ctx.out.line(`Recorded ${data.event} for layout listen${data.order ? `, describing ${data.order.id}` : ""}. No endpoint was sent anything.`);
         ctx.out.line(`Sent ${data.event} to ${data.deliveries.length} endpoint${data.deliveries.length === 1 ? "" : "s"}${data.order ? `, describing ${data.order.id}` : ""}.`);
         ctx.out.table(data.deliveries.map((d) => [d.id, d.outcome, d.url]));
     });

package/dist/commands/session.js

@@ -2,7 +2,7 @@ import { bool, str } from "../args.js";
 import { hostKey, readSession, writeSession } from "../config.js";
 import { chooseStore, fileStore, storeOfKind } from "../credentials.js";
 import { CliError, EXIT } from "../errors.js";
-import { authed, forget } from "../context.js";
+import { authed, envToken, forget, TOKEN_ENV } from "../context.js";
 const GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 function localTime(iso) {
     const d = new Date(iso);
@@ -100,17 +100,21 @@ async function finishLogin(ctx, tok) {
     if (previousToken?.startsWith("lcli_") && previous?.sessionId !== tok.session_id) {
         await ctx.api.request("/v1/cli/logout", { method: "POST", body: {}, auth: previousToken, retry: false }).catch(() => undefined);
     }
-    const who = await authed(ctx, "/v1/cli/whoami");
+    const who = await authed(ctx.env[TOKEN_ENV] ? { ...ctx, env: { ...ctx.env, [TOKEN_ENV]: "" } } : ctx, "/v1/cli/whoami");
     const liveUntil = who.session.liveUntil ?? null;
     writeSession(ctx.env, ctx.base, { sessionId: tok.session_id, accountId: who.account.id, accountName: who.account.name, store: store.kind, expiresAt: who.session.expiresAt, liveUntil });
     out.result({ event: "signed_in", account: who.account, session: who.session }, () => {
         out.line(`Signed in to ${who.account.name ?? "your developer account"}.`);
         out.line(liveUntil ? `Production read access until ${localTime(liveUntil)}. Add --live to a command to use it.` : "Sandbox. Run layout login --live to read production.");
     });
+    if (ctx.env[TOKEN_ENV]?.trim())
+        out.note(`${TOKEN_ENV} is set, and commands use it instead of this sign-in until it is unset.`);
     return EXIT.ok;
 }
 export async function logout(ctx) {
     const { out } = ctx;
+    if (envToken(ctx))
+        throw new CliError("token_in_env", `${TOKEN_ENV} is set, and logout does not revoke it. Revoke it in the console at https://developer.layout.link/console/cli, or unset it.`, EXIT.usage);
     const record = readSession(ctx.env, ctx.base);
     let revoked = false;
     if (record) {
@@ -135,7 +139,8 @@ export async function whoami(ctx) {
     const who = await authed(ctx, "/v1/cli/whoami");
     ctx.out.result(who, () => {
         ctx.out.line(`${who.account.name ?? "Developer account"} (${who.account.id})`);
-        ctx.out.line(`Session ${who.session.deviceName ? `on ${who.session.deviceName}, ` : ""}expires ${who.session.expiresAt.slice(0, 10)}`);
+        const label = who.session.kind === "token" ? `${TOKEN_ENV} ${who.session.deviceName ?? ""}`.trim() : `Session${who.session.deviceName ? ` on ${who.session.deviceName}` : ""}`;
+        ctx.out.line(`${label}, expires ${who.session.expiresAt.slice(0, 10)}`);
         ctx.out.line(who.session.liveUntil ? `Production read access until ${localTime(who.session.liveUntil)}` : "Sandbox. Run layout login --live to read production.");
     });
     return EXIT.ok;

package/dist/commands/test-order.js

@@ -20,18 +20,37 @@ export function testPhone(appId) {
     return `+1500555${String(100 + n).padStart(4, "0")}`;
 }
 const money = (minor) => (typeof minor === "number" ? `$${(minor / 100).toFixed(2)}` : "unknown");
-export async function testOrder(ctx) {
-    const { out, api, p } = ctx;
+export function placeOf(ctx) {
     const place = str(ctx.args, "place") ?? "test_place_placed";
-    const expected = EXPECTED[place];
-    if (!expected)
+    if (!EXPECTED[place])
         throw usageError(`test-order runs a test restaurant that builds a cart on its own: ${Object.keys(EXPECTED).join(", ")}.`);
+    return place;
+}
+export async function testOrder(ctx) {
+    const place = placeOf(ctx);
     const fromEnv = envSecret(ctx);
     if (fromEnv?.startsWith("sk_live_"))
         throw usageError(`test-order runs in sandbox only, and ${SECRET_ENV} is a live secret.`);
     const app = fromEnv ? null : await pickApp(ctx);
-    const seed = app ?? createHash("sha256").update(fromEnv).digest("hex").slice(0, 16);
     const steps = [];
+    try {
+        const outcome = await runTestOrder(ctx, { app, place, steps, secret: fromEnv ? { value: fromEnv, from: `from ${SECRET_ENV}` } : null });
+        ctx.out.result(outcome, () => ctx.out.line(outcome.order ? "Done. Nothing reached a restaurant and no money moved." : `Done. ${place} ended as scripted.`));
+        return EXIT.ok;
+    }
+    catch (err) {
+        if (ctx.out.json && err instanceof CliError && typeof err.detail.step === "string")
+            ctx.out.data({ app, place, steps, order: null, ok: false });
+        throw err;
+    }
+}
+/** A failed step throws with `detail.step` and leaves the steps so far in `steps`. */
+export async function runTestOrder(ctx, o) {
+    const { out, api, p } = ctx;
+    const { app, place, steps } = o;
+    const expected = EXPECTED[place];
+    const fromEnv = o.secret?.value ?? null;
+    const seed = app ?? createHash("sha256").update(fromEnv).digest("hex").slice(0, 16);
     const run = `cli-${randomUUID()}`;
     let current = out.spinner("Reading the sandbox key");
     const done = (step, detail) => {
@@ -45,9 +64,7 @@ export async function testOrder(ctx) {
         const e = err instanceof CliError ? err : new CliError("error", String(err), EXIT.error);
         steps.push({ step, status: "failed", detail: e.message });
         current.stop();
-        if (out.json)
-            out.data({ app, place, steps, order: null, ok: false });
-        else
+        if (!out.json)
             out.line(`failed  ${step}  ${e.message}`);
         throw new CliError(e.code, e.message, e.exit, { step });
     };
@@ -63,14 +80,14 @@ export async function testOrder(ctx) {
         }
     };
     let sk = fromEnv ?? await sandboxSecret(ctx, app).catch((err) => fail("Read the sandbox key", err));
-    done("Read the sandbox key", fromEnv ? `from ${SECRET_ENV}` : "from this computer's credential store");
+    done("Read the sandbox key", o.secret?.from ?? "from this computer's credential store");
     next("Provisioning a sandbox test user");
     const phone = testPhone(seed);
     const provision = () => api.request("/v1/users", {
         method: "POST", auth: sk, idempotent: true, retry: true, body: { firstName: "Layout", lastName: "CLI test", phone },
     }).then((r) => r.data);
     const user = await provision().catch(async (err) => {
-        if (!(err instanceof CliError) || err.exit !== EXIT.auth || !app)
+        if (!(err instanceof CliError) || err.exit !== EXIT.auth || !app || o.secret)
             throw err;
         dropSandboxSecret(ctx, app);
         sk = await sandboxSecret(ctx, app, true);
@@ -107,8 +124,7 @@ export async function testOrder(ctx) {
         const code = cart.failure?.code ?? "UNKNOWN";
         if (expected === "failed" && place === "test_place_closed") {
             done("Build a cart", `failed with ${code}, as ${place} scripts`);
-            out.result({ app, place, steps, order: null, ok: true }, () => out.line(`Done. ${place} ended as scripted.`));
-            return EXIT.ok;
+            return { app, place, steps, order: null, ok: true };
         }
         fail("Build a cart", new CliError("cart_failed", `The cart failed with ${code}.`, EXIT.error));
     }
@@ -132,6 +148,5 @@ export async function testOrder(ctx) {
     if (!okOutcome)
         fail("Wait for the outcome", new CliError("unexpected_outcome", `The order ended ${final.state}; ${place} scripts ${expected}.`, EXIT.error));
     done("Wait for the outcome", `${final.state}${final.failure_code ? ` (${final.failure_code})` : ""}, as ${place} scripts`);
-    out.result({ app, place, steps, order: { id: order.id, status: final.state }, ok: true }, () => out.line("Done. Nothing reached a restaurant and no money moved."));
-    return EXIT.ok;
+    return { app, place, steps, order: { id: order.id, status: final.state }, ok: true };
 }

package/dist/context.js

@@ -1,6 +1,6 @@
 import { Api, defaultHttpDeps } from "./http.js";
 import { Output } from "./output.js";
-import { apiBase, hostKey, readSession, writeSession } from "./config.js";
+import { apiBase, DEFAULT_API_BASE, hostKey, readSession, writeSession } from "./config.js";
 import { chooseStore, spawnRunner, storeOfKind } from "./credentials.js";
 import { CliError, EXIT, usageError } from "./errors.js";
 import { str } from "./args.js";
@@ -25,14 +25,30 @@ export function defaultPlatform(streams) {
         sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
     };
 }
+export const TOKEN_ENV = "LAYOUT_CLI_TOKEN";
+/** LAYOUT_CLI_TOKEN, checked: it is minted by the console for the Layout API, so it is sent there and nowhere else. */
+export function envToken(ctx) {
+    const v = ctx.env[TOKEN_ENV]?.trim();
+    if (!v)
+        return null;
+    if (!/^lcli_[A-Za-z0-9_-]{43}$/.test(v))
+        throw usageError(`${TOKEN_ENV} is not a Layout CLI token (lcli_...). Make one in the console: https://developer.layout.link/console/cli`);
+    if (ctx.base !== DEFAULT_API_BASE) {
+        throw usageError(`${TOKEN_ENV} is sent only to ${DEFAULT_API_BASE}, the API that issues it, and LAYOUT_API_BASE is ${ctx.base}. Unset one of them, or run layout login for ${hostKey(ctx.base)}.`);
+    }
+    return v;
+}
 export function signedIn(ctx) {
+    const fromEnv = envToken(ctx);
+    if (fromEnv)
+        return { token: fromEnv, record: null, source: "env" };
     const record = readSession(ctx.env, ctx.base);
     if (!record)
-        throw new CliError("not_signed_in", "Not signed in. Run layout login.", EXIT.auth);
+        throw new CliError("not_signed_in", `Not signed in. Run layout login, or set ${TOKEN_ENV}.`, EXIT.auth);
     const token = storeOfKind(record.store, ctx.env, ctx.p.run).get(hostKey(ctx.base));
     if (!token?.startsWith("lcli_"))
-        throw new CliError("not_signed_in", "Not signed in. Run layout login.", EXIT.auth);
-    return { token, record };
+        throw new CliError("not_signed_in", `Not signed in. Run layout login, or set ${TOKEN_ENV}.`, EXIT.auth);
+    return { token, record, source: "login" };
 }
 export function forget(ctx, record) {
     if (record) {
@@ -50,8 +66,8 @@ function keyAccount(base, app) {
 /** The application's sandbox secret, from this computer's credential store or read once from Layout and kept there. Never a live secret. */
 export async function sandboxSecret(ctx, app, fresh = false) {
     const s = signedIn(ctx);
-    const store = storeOfKind(s.record.store, ctx.env, ctx.p.run);
-    const cacheable = APP_ID.test(app);
+    const store = s.record ? storeOfKind(s.record.store, ctx.env, ctx.p.run) : null;
+    const cacheable = store !== null && APP_ID.test(app);
     if (cacheable && !fresh) {
         const cached = store.get(keyAccount(ctx.base, app));
         if (cached?.startsWith("sk_test_"))
@@ -60,12 +76,20 @@ export async function sandboxSecret(ctx, app, fresh = false) {
     const key = await authed(ctx, `/v1/cli/apps/${encodeURIComponent(app)}/keys/reveal`, { method: "POST", body: {}, retry: true });
     if (!key.secret?.startsWith("sk_test_"))
         throw new CliError("unexpected_key", "Layout returned something other than a sandbox key, so it was not used.", EXIT.error);
-    if (cacheable && store.set(keyAccount(ctx.base, app), key.secret)) {
-        const record = readSession(ctx.env, ctx.base);
-        if (record && !(record.keys ?? []).includes(app))
+    remember(ctx, app, key.secret);
+    return key.secret;
+}
+/** Keeps a sandbox secret in this computer's credential store for a `layout login` session; with LAYOUT_CLI_TOKEN nothing is stored. */
+export function remember(ctx, app, secret) {
+    if (envToken(ctx) || !secret.startsWith("sk_test_") || !APP_ID.test(app))
+        return;
+    const record = readSession(ctx.env, ctx.base);
+    if (!record)
+        return;
+    if (storeOfKind(record.store, ctx.env, ctx.p.run).set(keyAccount(ctx.base, app), secret)) {
+        if (!(record.keys ?? []).includes(app))
             writeSession(ctx.env, ctx.base, { ...record, keys: [...(record.keys ?? []), app] });
     }
-    return key.secret;
 }
 export function dropSandboxSecret(ctx, app) {
     const record = readSession(ctx.env, ctx.base);
@@ -87,6 +111,9 @@ export async function authed(ctx, path, opts = {}) {
         return (await ctx.api.request(path, { ...opts, auth: s.token })).data;
     }
     catch (err) {
+        if (err instanceof CliError && err.exit === EXIT.auth && s.source === "env") {
+            throw new CliError(err.code, `${TOKEN_ENV} is expired or revoked. Make another in the console: https://developer.layout.link/console/cli`, EXIT.auth);
+        }
         if (err instanceof CliError && err.exit === EXIT.auth) {
             forget(ctx, s.record);
             throw new CliError(err.code, `${err.message.replace(/\s*Sign in with layout login\.?$/, "")} Run layout login.`.trim(), EXIT.auth);

package/dist/main.js

@@ -7,6 +7,7 @@ import { login, logout, whoami } from "./commands/session.js";
 import { appsCreate, appsList, deliveries, docs, keysCreate, keysList, keysRevoke, requestLiveAccess, trigger, usage, webhooksList, } from "./commands/resources.js";
 import { listen } from "./commands/listen.js";
 import { testOrder } from "./commands/test-order.js";
+import { init } from "./commands/init.js";
 import { api } from "./commands/api.js";
 import { checkForUpdate } from "./update.js";
 const s = (name) => ({ name, type: "string" });
@@ -15,6 +16,9 @@ const LIVE = ["--live", "Production instead of sandbox. Needs layout login --liv
 export const COMMANDS = [
     { path: ["login"], usage: "layout login [--live] [--device-name <name>] [--no-browser]", summary: "Sign in with a code you approve in the console.", flags: [s("device-name"), b("no-browser"), b("live")],
         flagHelp: [["--live", "Also read production for 12 hours. The console asks you to sign in again first."], ["--device-name <name>", "What the console shows as the computer asking. Default: this computer's name."], ["--no-browser", "Print the link without opening a browser."]], run: login },
+    { path: ["init"], usage: "layout init [--app <id> | --name <name>] [--skip-test] [--place <test_place_id>]", summary: "Set up an application: pick or create it, read its sandbox key, run a test order, print the env vars.",
+        flags: [s("name"), b("skip-test"), s("place")],
+        flagHelp: [["--name <name>", "The application with this name, created if there is none."], ["--skip-test", "Do not run the sandbox test order."], ["--place <id>", "The sandbox test restaurant. Default: test_place_placed."]], run: init },
     { path: ["logout"], usage: "layout logout", summary: "Revoke this CLI session and forget it here.", flags: [], run: logout },
     { path: ["whoami"], usage: "layout whoami", summary: "The developer account and this CLI session.", flags: [], run: whoami },
     { path: ["apps", "list"], usage: "layout apps list", summary: "Your applications.", flags: [], run: appsList },
@@ -99,7 +103,12 @@ function help(o, cmd, sub) {
         o.line(l);
     o.line();
     o.line("Environment:");
-    for (const l of pad([["LAYOUT_SECRET_KEY", "A key for api and test-order without signing in, as in CI."], ["LAYOUT_APP", "The application, instead of --app."], ["NO_COLOR", "No colour."]]))
+    for (const l of pad([
+        ["LAYOUT_CLI_TOKEN", "A CLI token from the console, for agents and CI. Wins over layout login; sent only to api.layout.link."],
+        ["LAYOUT_SECRET_KEY", "A key for api and test-order without signing in, as in CI."],
+        ["LAYOUT_APP", "The application, instead of --app."],
+        ["NO_COLOR", "No colour."],
+    ]))
         o.line(l);
     o.line();
     o.line("Docs: https://developer.layout.link/reference/cli");

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "0.2.0";
+export const VERSION = "0.3.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@layoutplatforms/cli",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "private": false,
   "description": "The Layout developer CLI: sign in, sandbox apps and keys, forward webhooks, run test orders.",
   "type": "module",