@levr-one/cli 0.1.1 → 0.3.0

package/dist/cli.js

@@ -52,6 +52,68 @@ function buildContext(process$1) {
 	};
 }
 
+//#endregion
+//#region src/commands/mcp/add.ts
+const mcpAddCommand = buildCommand({
+	docs: {
+		brief: "Add the Levr MCP server to installed AI clients",
+		fullDescription: `Detect MCP-capable clients on this machine (Claude Desktop,
+Claude Code, Cursor, Windsurf, Zed) and write the Levr MCP server into each
+one's config. The entry is credential-free — the client opens a browser to
+authorize with Levr the first time it connects.
+
+Interactive by default; non-interactive when --all/--client/--yes is passed
+or when not running in a terminal (CI). Config edits preserve existing
+servers and comments, and re-running is a no-op.
+
+Examples:
+  npx @levr-one/cli mcp add        # detect clients and pick interactively
+  levr mcp add --all               # set up every detected client
+  levr mcp add --client cursor --yes
+  levr mcp add --dry-run           # preview without writing
+  levr mcp add --url <mcp-url>     # target a non-default MCP server`
+	},
+	parameters: {
+		flags: {
+			client: {
+				kind: "parsed",
+				parse: String,
+				brief: "Set up these client ids (comma-separated or repeated)",
+				placeholder: "id[,id]",
+				variadic: true,
+				optional: true
+			},
+			all: {
+				kind: "boolean",
+				default: false,
+				brief: "Set up every detected, installable client"
+			},
+			yes: {
+				kind: "boolean",
+				default: false,
+				brief: "Non-interactive; auto-select detected clients"
+			},
+			"dry-run": {
+				kind: "boolean",
+				default: false,
+				brief: "Show changes without writing"
+			},
+			url: {
+				kind: "parsed",
+				parse: String,
+				brief: "MCP server URL (default derived from the API server)",
+				placeholder: "url",
+				optional: true
+			}
+		},
+		aliases: { y: "yes" }
+	},
+	loader: async () => {
+		const { mcpAddHandler } = await import("./addHandler-boWTd9yY.js");
+		return mcpAddHandler;
+	}
+});
+
 //#endregion
 //#region src/commands/auth/login.ts
 const loginCommand = buildCommand({
@@ -68,15 +130,24 @@ Examples:
   levr auth login --device-code   # Device flow for SSH/headless`
 	},
 	parameters: {
-		flags: { "device-code": {
-			kind: "boolean",
-			default: false,
-			brief: "Use device code flow (for SSH/headless environments)"
-		} },
+		flags: {
+			"device-code": {
+				kind: "boolean",
+				default: false,
+				brief: "Use device code flow (for SSH/headless environments)"
+			},
+			url: {
+				kind: "parsed",
+				parse: String,
+				brief: "API base URL (default: https://api.levr.one)",
+				placeholder: "url",
+				optional: true
+			}
+		},
 		aliases: { d: "device-code" }
 	},
 	loader: async () => {
-		const { loginHandler } = await import("./loginHandler-BnokItPo.js");
+		const { loginHandler } = await import("./loginHandler-BfIUQJrC.js");
 		return loginHandler;
 	}
 });
@@ -95,7 +166,7 @@ Examples:
 	},
 	parameters: {},
 	loader: async () => {
-		const { logoutHandler } = await import("./logoutHandler-C3X9rqLP.js");
+		const { logoutHandler } = await import("./logoutHandler-BC8laIAB.js");
 		return logoutHandler;
 	}
 });
@@ -115,7 +186,7 @@ Examples:
 	},
 	parameters: {},
 	loader: async () => {
-		const { statusHandler } = await import("./statusHandler-LfrSN4uh.js");
+		const { statusHandler } = await import("./statusHandler-BaQB40t7.js");
 		return statusHandler;
 	}
 });
@@ -226,7 +297,7 @@ Examples:
 		}
 	},
 	loader: async () => {
-		const { pushHandler } = await import("./pushHandler-C3DteESD.js");
+		const { pushHandler } = await import("./pushHandler-DBBa6hKz.js");
 		return pushHandler;
 	}
 });
@@ -247,7 +318,7 @@ Examples:
 	},
 	parameters: {},
 	loader: async () => {
-		const { listHandler } = await import("./listHandler-gfnJbj60.js");
+		const { listHandler } = await import("./listHandler-EsB3AeOB.js");
 		return listHandler;
 	}
 });
@@ -280,7 +351,7 @@ Examples:
 		flags: {}
 	},
 	loader: async () => {
-		const { selectHandler } = await import("./selectHandler-BjM4LKYW.js");
+		const { selectHandler } = await import("./selectHandler-XOUHdyea.js");
 		return selectHandler;
 	}
 });
@@ -297,35 +368,41 @@ Examples:
 	},
 	parameters: {},
 	loader: async () => {
-		const { currentHandler } = await import("./currentHandler-DpWIqCBm.js");
+		const { currentHandler } = await import("./currentHandler-Bm7GFMkj.js");
 		return currentHandler;
 	}
 });
 
 //#endregion
 //#region package.json
-var version = "0.1.1";
+var version = "0.3.0";
 
 //#endregion
 //#region src/app.ts
+const authRoutes = buildRouteMap({
+	routes: {
+		login: loginCommand,
+		logout: logoutCommand,
+		status: statusCommand
+	},
+	docs: { brief: "Manage authentication" }
+});
+const workspaceRoutes = buildRouteMap({
+	routes: {
+		list: listCommand,
+		select: selectCommand,
+		current: currentCommand
+	},
+	docs: { brief: "Manage workspace selection" }
+});
 const routes = buildRouteMap({
 	routes: {
-		auth: buildRouteMap({
-			routes: {
-				login: loginCommand,
-				logout: logoutCommand,
-				status: statusCommand
-			},
-			docs: { brief: "Manage authentication" }
-		}),
-		workspace: buildRouteMap({
-			routes: {
-				list: listCommand,
-				select: selectCommand,
-				current: currentCommand
-			},
-			docs: { brief: "Manage workspace selection" }
+		mcp: buildRouteMap({
+			routes: { add: mcpAddCommand },
+			docs: { brief: "Wire the Levr MCP server into installed AI clients" }
 		}),
+		auth: authRoutes,
+		workspace: workspaceRoutes,
 		push: pushCommand,
 		install: buildInstallCommand("levr", { bash: "levr __complete" }),
 		uninstall: buildUninstallCommand("levr", { bash: true })

package/dist/env-NxtzJJPk.js

@@ -0,0 +1,102 @@
+import { mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+
+//#region src/auth/credentials.ts
+const CREDENTIALS_PATH = join(join(homedir(), ".config", "levr"), "credentials.json");
+function readCredentials() {
+	try {
+		const raw = readFileSync(CREDENTIALS_PATH, "utf8");
+		return JSON.parse(raw);
+	} catch {
+		return null;
+	}
+}
+function writeCredentials(creds) {
+	mkdirSync(dirname(CREDENTIALS_PATH), { recursive: true });
+	writeFileSync(CREDENTIALS_PATH, JSON.stringify(creds, null, 2), { mode: 384 });
+}
+function deleteCredentials() {
+	try {
+		unlinkSync(CREDENTIALS_PATH);
+		return true;
+	} catch {
+		return false;
+	}
+}
+
+//#endregion
+//#region src/utils/env.ts
+const DEFAULT_API_URL = "https://api.levr.one";
+const KNOWN_AUTH_HOSTS = {
+	"api.levr.one": "auth.levr.one",
+	"api.levr.now": "auth.levr.now"
+};
+/** OAuth client ID for the CLI (seeded in oauth_clients table) */
+const CLI_CLIENT_ID = "3";
+let sessionApiUrl;
+function setSessionApiUrl(url) {
+	sessionApiUrl = normalizeUrl(url);
+}
+function normalizeUrl(url) {
+	return url.replace(/\/+$/, "");
+}
+/**
+* Resolve the API base URL: `--url` flag > `LEVR_URL` env var > the
+* `api_url` stored in credentials at login > production default.
+*
+* The stored-credentials fallback keeps every later command (push, refresh,
+* workspace list) pointed at the environment the user actually logged into,
+* instead of silently falling back to production when the env var is no
+* longer exported in the current shell.
+*/
+function getApiUrl() {
+	if (sessionApiUrl) return sessionApiUrl;
+	const env = process.env["LEVR_URL"];
+	if (env) return normalizeUrl(env);
+	if (!getPatToken()) {
+		const stored = readCredentials()?.api_url;
+		if (stored) return normalizeUrl(stored);
+	}
+	return DEFAULT_API_URL;
+}
+/**
+* Resolve the auth-server base URL (browser PKCE consent page only):
+* `LEVR_AUTH_URL` env var > derived from the resolved API URL for known
+* Levr hosts. Unrecognized hosts (e.g. localhost dev stacks) require the
+* explicit env var — throwing beats silently opening the production login
+* page for a token exchange that can never succeed.
+*/
+function getAuthUrl() {
+	const env = process.env["LEVR_AUTH_URL"];
+	if (env) return normalizeUrl(env);
+	const apiUrl = getApiUrl();
+	const derived = deriveAuthUrl(apiUrl);
+	if (derived) return derived;
+	throw new Error(`Cannot derive the auth server URL from API URL "${apiUrl}". Set LEVR_AUTH_URL to the auth server base URL (e.g. https://auth.levr.one).`);
+}
+function deriveAuthUrl(apiUrl) {
+	let parsed;
+	try {
+		parsed = new URL(apiUrl);
+	} catch {
+		return;
+	}
+	const authHost = KNOWN_AUTH_HOSTS[parsed.host];
+	return authHost ? `${parsed.protocol}//${authHost}` : void 0;
+}
+function getTeamId(flagValue) {
+	return flagValue || process.env["LEVR_TEAM_ID"] || void 0;
+}
+function getPatToken() {
+	return process.env["LEVR_TOKEN"];
+}
+function getSourceOverride() {
+	return process.env["LEVR_SOURCE"];
+}
+function getAutomationSourceIdOverride() {
+	return process.env["LEVR_AUTOMATION_SOURCE_ID"];
+}
+
+//#endregion
+export { CLI_CLIENT_ID, deleteCredentials, getApiUrl, getAuthUrl, getAutomationSourceIdOverride, getPatToken, getSourceOverride, getTeamId, readCredentials, setSessionApiUrl, writeCredentials };

package/dist/listHandler-EsB3AeOB.js

@@ -0,0 +1,51 @@
+import "./env-NxtzJJPk.js";
+import { authGetSitesV1, configureClient } from "./sdk-client-BeE6mXns.js";
+import { loadWorkspace } from "./workspace-store-4hfvsEHS.js";
+import "./token-refresh-Cz-FqDtC.js";
+import { resolveToken } from "./resolve-token-BRPrqdG-.js";
+
+//#region src/commands/workspace/listHandler.ts
+async function listHandler() {
+	let auth;
+	try {
+		auth = await resolveToken();
+	} catch (err) {
+		this.logger.error(err instanceof Error ? err.message : "Not authenticated. Run 'levr auth login' first.");
+		this.process.exitCode = 1;
+		return;
+	}
+	if (auth.type === "pat") {
+		this.logger.error("Workspace listing requires JWT auth. Run 'levr auth login'.");
+		this.process.exitCode = 1;
+		return;
+	}
+	configureClient(auth);
+	const result = await authGetSitesV1();
+	if (result.error) {
+		this.logger.error("Failed to list workspaces.");
+		this.process.exitCode = 1;
+		return;
+	}
+	const data = result.data;
+	printSites(this, data.sites);
+}
+/**
+* Print the workspace list with the current-workspace indicator. Shared
+* with `levr init` (ENG-2361).
+*/
+function printSites(ctx, sites) {
+	if (sites.length === 0) {
+		ctx.logger.info("No workspaces available.");
+		return;
+	}
+	const currentWs = loadWorkspace();
+	ctx.process.stdout.write("\nWorkspaces:\n\n");
+	for (const site of sites) {
+		const indicator = site.workspace_id === currentWs ? " *" : "";
+		ctx.process.stdout.write(`  ${site.workspace_name} (${site.workspace_id}) [${site.role}]${indicator}\n`);
+	}
+	ctx.process.stdout.write("\n");
+}
+
+//#endregion
+export { listHandler };

package/dist/{loginHandler-BnokItPo.js → loginHandler-BfIUQJrC.js}

@@ -1,7 +1,7 @@
-import { CLI_CLIENT_ID, getApiUrl, getAuthUrl, writeCredentials } from "./credentials-Ciq9mA7N.js";
-import { configureClient } from "./sdk-client-rpUEykDw.js";
+import { CLI_CLIENT_ID, getApiUrl, getAuthUrl, setSessionApiUrl, writeCredentials } from "./env-NxtzJJPk.js";
+import { configureClient } from "./sdk-client-BeE6mXns.js";
 import "./workspace-store-4hfvsEHS.js";
-import { autoSelectWorkspace } from "./resolve-workspace-BPMkU_SK.js";
+import { autoSelectWorkspace } from "./resolve-workspace-Dj7jgtE3.js";
 import chalk from "chalk";
 import { createHash, randomBytes } from "node:crypto";
 import { createServer } from "node:http";
@@ -166,14 +166,19 @@ function sleep(ms) {
 */
 async function requestDeviceCode() {
 	const apiUrl = getApiUrl();
-	const res = await fetch(`${apiUrl}/v1/oauth/device/authorize`, {
-		method: "POST",
-		headers: { "Content-Type": "application/x-www-form-urlencoded" },
-		body: new URLSearchParams({
-			client_id: CLI_CLIENT_ID,
-			scope: "read:own write:own"
-		})
-	});
+	let res;
+	try {
+		res = await fetch(`${apiUrl}/v1/oauth/device/authorize`, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				client_id: CLI_CLIENT_ID,
+				scope: "read:own write:own"
+			})
+		});
+	} catch {
+		throw new Error(`Could not reach ${apiUrl} — check the URL and your network connection.`);
+	}
 	if (!res.ok) {
 		const body = await res.text();
 		throw new Error(`Failed to request device code (${res.status}): ${body}`);
@@ -223,15 +228,31 @@ function formatCountdown(ms) {
 	return `${Math.floor(totalSec / 60)}:${(totalSec % 60).toString().padStart(2, "0")}`;
 }
 async function loginHandler(flags) {
-	if (flags["device-code"]) {
-		await deviceCodeLogin(this);
-		return;
-	}
-	await pkceLogin(this);
+	await performLogin(this, {
+		deviceCode: flags["device-code"],
+		url: flags.url
+	});
+}
+/**
+* Run the login flow (PKCE or device code). Reusable outside the Stricli
+* handler (levr init composes it). Returns true on success; on failure the
+* error has been printed and `exitCode` set.
+*/
+async function performLogin(ctx, options) {
+	if (options.url) setSessionApiUrl(options.url);
+	if (options.deviceCode) return deviceCodeLogin(ctx);
+	return pkceLogin(ctx);
 }
 async function pkceLogin(ctx) {
 	const apiUrl = getApiUrl();
-	const authUrl = getAuthUrl();
+	let authUrl;
+	try {
+		authUrl = getAuthUrl();
+	} catch (err) {
+		ctx.logger.error(err instanceof Error ? err.message : "Invalid auth server configuration.");
+		ctx.process.exitCode = 1;
+		return false;
+	}
 	const codeVerifier = generateCodeVerifier();
 	const codeChallenge = generateCodeChallenge(codeVerifier);
 	const state = randomBytes(16).toString("hex");
@@ -240,7 +261,7 @@ async function pkceLogin(ctx) {
 		expectedState: state
 	});
 	const redirectUri = `http://127.0.0.1:${await portPromise}/callback`;
-	const authorizeUrl = `${authUrl}/auth/oauth/authorize?${new URLSearchParams({
+	const params = new URLSearchParams({
 		response_type: "code",
 		client_id: CLI_CLIENT_ID,
 		redirect_uri: redirectUri,
@@ -248,7 +269,8 @@ async function pkceLogin(ctx) {
 		code_challenge_method: "S256",
 		scope: "read:own write:own",
 		state
-	}).toString()}`;
+	});
+	const authorizeUrl = `${authUrl}/auth/oauth/authorize?${params.toString()}`;
 	ctx.process.stdout.write("Opening browser to authenticate...\n\n");
 	ctx.process.stdout.write(`  If the browser doesn't open, visit:\n  ${chalk.cyan(authorizeUrl)}\n\n`);
 	try {
@@ -270,7 +292,7 @@ async function pkceLogin(ctx) {
 		ctx.process.stdout.write("\n");
 		ctx.logger.error(err instanceof Error ? err.message : "Authentication failed.");
 		ctx.process.exitCode = 1;
-		return;
+		return false;
 	}
 	clearInterval(countdownTimer);
 	try {
@@ -289,11 +311,12 @@ async function pkceLogin(ctx) {
 			const errBody = await tokenRes.text();
 			throw new Error(`Token exchange failed (${tokenRes.status}): ${errBody}`);
 		}
-		await saveTokensAndFinish(ctx, await tokenRes.json());
+		return await saveTokensAndFinish(ctx, await tokenRes.json());
 	} catch (err) {
 		ctx.process.stdout.write("\n");
 		ctx.logger.error(err instanceof Error ? err.message : "Token exchange failed.");
 		ctx.process.exitCode = 1;
+		return false;
 	}
 }
 async function deviceCodeLogin(ctx) {
@@ -319,11 +342,12 @@ async function deviceCodeLogin(ctx) {
 			throw err;
 		}
 		clearInterval(deviceTimer);
-		await saveTokensAndFinish(ctx, tokenData);
+		return await saveTokensAndFinish(ctx, tokenData);
 	} catch (err) {
 		ctx.process.stdout.write("\n");
 		ctx.logger.error(err instanceof Error ? err.message : "Device flow failed.");
 		ctx.process.exitCode = 1;
+		return false;
 	}
 }
 async function saveTokensAndFinish(ctx, tokenData) {
@@ -337,7 +361,7 @@ async function saveTokensAndFinish(ctx, tokenData) {
 		ctx.process.stdout.write("\n");
 		ctx.logger.error("Token response missing user data.");
 		ctx.process.exitCode = 1;
-		return;
+		return false;
 	}
 	writeCredentials({
 		version: 1,
@@ -357,6 +381,7 @@ async function saveTokensAndFinish(ctx, tokenData) {
 	const wsResult = await autoSelectWorkspace();
 	if (wsResult.kind === "single") ctx.process.stdout.write(`Workspace: ${chalk.bold(wsResult.workspaceName)}\n`);
 	else if (wsResult.kind === "multiple") ctx.process.stdout.write(`\n${wsResult.count} workspaces available. Run ${chalk.cyan("'levr workspace list'")} to see them.\n`);
+	return true;
 }
 
 //#endregion

package/dist/{logoutHandler-C3X9rqLP.js → logoutHandler-BC8laIAB.js}

@@ -1,4 +1,4 @@
-import { deleteCredentials, getPatToken } from "./credentials-Ciq9mA7N.js";
+import { deleteCredentials, getPatToken } from "./env-NxtzJJPk.js";
 import { clearWorkspace } from "./workspace-store-4hfvsEHS.js";
 
 //#region src/commands/auth/logoutHandler.ts

package/dist/{pushHandler-C3DteESD.js → pushHandler-DBBa6hKz.js}

@@ -1,9 +1,9 @@
-import { getApiUrl, getAutomationSourceIdOverride, getSourceOverride, getTeamId } from "./credentials-Ciq9mA7N.js";
-import { client, configureClient, uploadAutomationIngest, uploadImport } from "./sdk-client-rpUEykDw.js";
+import { getApiUrl, getAutomationSourceIdOverride, getSourceOverride, getTeamId } from "./env-NxtzJJPk.js";
+import { client, configureClient, uploadAutomationIngest, uploadImport } from "./sdk-client-BeE6mXns.js";
 import "./workspace-store-4hfvsEHS.js";
-import { resolveWorkspace } from "./resolve-workspace-BPMkU_SK.js";
-import "./token-refresh-Pl6Adngb.js";
-import { resolveToken } from "./resolve-token-CQU55U6J.js";
+import { resolveWorkspace } from "./resolve-workspace-Dj7jgtE3.js";
+import "./token-refresh-Cz-FqDtC.js";
+import { resolveToken } from "./resolve-token-BRPrqdG-.js";
 import { readFileSync, statSync } from "node:fs";
 import { basename } from "node:path";
 import ora from "ora";

package/dist/resolve-token-BRPrqdG-.js

@@ -0,0 +1,48 @@
+import { getApiUrl, getPatToken, readCredentials } from "./env-NxtzJJPk.js";
+import { isTokenExpired, refreshToken } from "./token-refresh-Cz-FqDtC.js";
+
+//#region src/auth/resolve-token.ts
+/**
+* Stored credentials exist but were issued by a different server than the
+* one this command targets (`--url`/`LEVR_URL`). Callers that can recover
+* (e.g. `levr init` re-logging-in against the new target) match on this
+* class instead of string-sniffing the message.
+*/
+var CredentialsMismatchError = class extends Error {
+	constructor(storedUrl, activeUrl) {
+		super(`Stored credentials are for ${storedUrl}, but this command targets ${activeUrl}. Run 'levr auth login' to authenticate against this server.`);
+		this.name = "CredentialsMismatchError";
+	}
+};
+/**
+* Resolve auth token in priority order:
+* 1. LEVR_TOKEN env var (PAT) — long-lived, no refresh
+* 2. Stored credentials (JWT) — auto-refresh if expired
+* 3. Error — not authenticated
+*/
+async function resolveToken() {
+	const pat = getPatToken();
+	if (pat) return {
+		token: pat,
+		type: "pat"
+	};
+	let creds = readCredentials();
+	if (creds) {
+		const activeUrl = getApiUrl();
+		const storedUrl = creds.api_url.replace(/\/+$/, "");
+		if (storedUrl !== activeUrl) throw new CredentialsMismatchError(storedUrl, activeUrl);
+		if (isTokenExpired(creds)) {
+			const refreshed = await refreshToken(creds);
+			if (!refreshed) throw new Error("Token expired and refresh failed. Run 'levr auth login' to re-authenticate.");
+			creds = refreshed;
+		}
+		return {
+			token: creds.access_token,
+			type: "jwt"
+		};
+	}
+	throw new Error("Not authenticated. Run 'levr auth login' or set LEVR_TOKEN environment variable.");
+}
+
+//#endregion
+export { resolveToken };

package/dist/{resolve-workspace-BPMkU_SK.js → resolve-workspace-Dj7jgtE3.js}

@@ -1,4 +1,4 @@
-import { authGetSitesV1 } from "./sdk-client-rpUEykDw.js";
+import { authGetSitesV1 } from "./sdk-client-BeE6mXns.js";
 import { clearWorkspace, loadWorkspace, saveWorkspace } from "./workspace-store-4hfvsEHS.js";
 
 //#region src/workspace/resolve-workspace.ts