@lotics/cli 0.34.0 → 0.36.0

package/dist/cli.js

@@ -3,9 +3,9 @@ import fs from "node:fs";
 import path from "node:path";
 import readline from "node:readline";
 import { LoticsClient, API_BASE_URL } from "./client.js";
-import { resolveAuth, loadConfig, saveConfig, deleteConfig, getConfigPath, checkForUpdate } from "./config.js";
+import { resolveContext, deleteConfig, getConfigPath, loadGlobalConfig, saveGlobalConfig, loadLocalConfig, upsertProfile, removeProfile, setActiveOrg, setSelectedWorkspace, resolveProfileByNameOrId, checkForUpdate, } from "./config.js";
 import { VERSION } from "./version.js";
-import { appCreate, appPull, appDeploy, appDev, appSetSubdomain } from "./app_commands.js";
+import { appCreate, appPull, appDeploy, appDev, appSetSubdomain, appRename } from "./app_commands.js";
 import { parseArgs } from "./args.js";
 import { runXlsxCommand } from "./xlsx.js";
 import { runDocxCommand } from "./docx.js";
@@ -24,20 +24,31 @@ Lotics is an AI-powered operations platform. Through this CLI you can:
 AUTHENTICATION
   lotics auth                          Show auth help
   lotics auth signup <email>           Create account (run "lotics auth" for details)
+  lotics auth api-key <key>            Save a key — registers its org as a profile
+
+ORGANIZATIONS
+  Each saved API key belongs to one org. Register a key per org once, then
+  switch between them with no re-pasting. Workspaces live inside an org.
+  lotics org                           List saved orgs (marks active)
+  lotics org use <name|id>             Switch the active org
+  lotics org use <name|id> --local     Pin THIS directory to an org (worktrees)
 
 USAGE
   1. lotics auth signup <email>        Create account or authenticate
-  2. lotics workspace                  Check current workspace (auto-selects if only one)
-  3. lotics tools                      List available tools by category
-  4. lotics tools <name>               Show tool description and full input schema
-  5. lotics run <tool> '<json>'        Execute a tool with JSON arguments
+  2. lotics org                        See saved orgs / which one is active
+  3. lotics workspace                  Check current workspace (auto-selects if only one)
+  4. lotics tools                      List available tools by category
+  5. lotics tools <name>               Show tool description and full input schema
+  6. lotics run <tool> '<json>'        Execute a tool with JSON arguments
 
   Always inspect the schema (step 4) before calling a tool.
   Tools are grouped by category (tables, records, views, etc.).
   Query tools return IDs used as arguments to other tools.
 
 COMMANDS
-  lotics workspace                     List workspaces (marks current)
+  lotics org                           List saved orgs (marks active)
+  lotics org use <name|id> [--local]   Switch active org (--local pins this dir)
+  lotics workspace                     List workspaces in the active org (marks current)
   lotics workspace select <id>         Switch to a different workspace
   lotics workspace create <name>       Create a new workspace (admin only)
   lotics tools                         List all available tools
@@ -54,6 +65,7 @@ COMMANDS
                                        (--force-workflow-sync wipes server-only
                                        workflow aliases; default refuses)
   lotics app subdomain <new-subdomain> Rename the app's public <slug>.lotics.app address
+  lotics app rename "<new name>"       Rename the app's display name (launcher title)
   lotics app dev [path]                Run the app locally with HMR (RPC forwarded to prod)
   lotics xlsx <subcommand> ...         Read/write/edit .xlsx files on your local filesystem
                                        (uses the bundled Lotics xlsx engine; prefer over
@@ -67,15 +79,23 @@ FLAGS
   --timeout <ms>     Timeout for tool execution (default: 60000)
   -o <path>          Output dir for downloads
   --as <name>        Override upload filename
-  --api-key <key>    API key (overrides saved config and LOTICS_API_KEY)
-  --local            (lotics auth) Save credentials to ./.lotics/config.json
+  --api-key <key>    One-off API key (overrides saved config + env)
+  --workspace <id>   One-off workspace override (alias: -w)
+  --local            Pin the current directory (lotics org use / auth api-key)
+  --all              (lotics auth logout) Remove every saved credential
   --version          Show version
 
 CONFIG
-  Credentials resolve from a .lotics/config.json found by walking up from the
-  current directory, else the global ~/.lotics/config.json. Run "lotics auth
-  api-key <key> --local" inside a directory (e.g. a worktree) to pin it to its
-  own account and workspace.
+  API keys are stored once per org in the global ~/.lotics/config.json as named
+  profiles. Switch with "lotics org use <name|id>" — no re-pasting. A directory
+  (e.g. a git worktree) can pin its own org/workspace with "lotics org use
+  <name|id> --local", which writes a .lotics/config.json pointer (the key is
+  resolved from the global store) — so a global switch never disturbs it.
+
+  Resolution precedence (highest first):
+    --api-key flag  >  LOTICS_API_KEY env  >  LOTICS_ORG env  >
+    local .lotics/config.json  >  global active profile
+  LOTICS_WORKSPACE (or --workspace) overrides the workspace at any level.
 
 OUTPUT
   Default output is a compact text summary optimized for AI agents —
@@ -104,25 +124,27 @@ function printAuthHelp() {
     console.log(`Authentication commands:
 
   lotics auth signup <email>           Create account, org, workspace, and API key
-  lotics auth api-key [key]            Save an existing API key (e.g. from the web app)
+  lotics auth api-key [key]            Save an API key — registers its org as a profile
   lotics auth web                      Send a magic link email to access the web app
-  lotics auth whoami                   Show the current account's name, email, and organization
-  lotics auth logout                   Remove saved credentials
+  lotics auth whoami                   Show the active account, org, workspace, and source
+  lotics auth logout [<name|id>]       Remove a saved credential (default: the active org,
+                                       or unpin the current directory)
+  lotics auth logout --all             Remove every saved credential
 
 Auth flags:
-  --local                Save credentials to ./.lotics/config.json (this directory)
-                         instead of the global ~/.lotics — applies to signup + api-key
+  --local                Pin the current directory instead of the global store.
+                         signup/api-key write a self-contained ./.lotics/config.json
+                         (inline key) — for a hermetic worktree or CI.
   --name <name>          (signup) Display name (defaults to email prefix)
   --timezone <timezone>  (signup) Workspace timezone (defaults to UTC, e.g. Asia/Ho_Chi_Minh)
 
-Signup sends a magic link email so you can access the Lotics web app.
-Use lotics auth web to request a new magic link at any time.
+API keys are stored once per org as named profiles in ~/.lotics/config.json.
+Registering a second key adds a profile — it does not overwrite the first.
+Switch active org with "lotics org use <name|id>".
 
-Auth priority: --api-key flag > LOTICS_API_KEY env > config file.
-Config file: .lotics/config.json found by walking up from the current directory,
-else ~/.lotics/config.json. A per-directory config pins a project or worktree to
-its own account and workspace; --local creates one. Note: an exported
-LOTICS_API_KEY env var overrides the config file's key.`);
+Resolution precedence (highest first):
+  --api-key flag > LOTICS_API_KEY env > LOTICS_ORG env > local .lotics/config.json
+  > global active profile. LOTICS_WORKSPACE / --workspace override the workspace.`);
 }
 function readStdin() {
     return new Promise((resolve, reject) => {
@@ -178,17 +200,25 @@ async function handleSignup(positionalEmail, flags) {
         }
         process.exit(1);
     }
-    const scope = flags.local ? "local" : "auto";
-    const existing = loadConfig(scope) ?? {};
-    saveConfig({
-        ...existing,
-        api_key: data.api_key,
-        email: data.email,
-        workspace_id: data.workspace_id,
-    }, scope);
+    const apiKey = data.api_key;
+    const orgId = data.organization_id;
+    const workspaceId = data.workspace_id;
+    // The org is created with the display name; mirror the server's email-prefix
+    // default when none was supplied. Use `||` (not `??`) so an empty-string name
+    // falls through exactly as the server's `if (name)` truthiness check does.
+    const orgName = name || email.split("@")[0];
+    // The key always lives in the global store as a profile; --local additionally
+    // pins this directory to it (a pointer), instead of making it the global default.
+    upsertProfile(orgId, { api_key: apiKey, org_name: orgName, workspace_id: workspaceId });
+    const existing = loadGlobalConfig() ?? {};
+    saveGlobalConfig({ ...existing, email });
+    setActiveOrg(orgId, flags.local ? "local" : "global");
     console.error(`Account created. You can now use the CLI.`);
-    console.error(`  Email:  ${data.email}`);
-    console.error(`  Config: ${getConfigPath(scope)}`);
+    console.error(`  Email:  ${email}`);
+    console.error(`  Org:    ${orgName} (${orgId})`);
+    console.error(flags.local
+        ? `  Pinned this directory: ${getConfigPath("local")}`
+        : `  Saved to the "${orgName}" profile in ~/.lotics (now active)`);
     console.error(`\nCheck your email for a magic link to access the Lotics web app.`);
     console.error(`Run "lotics auth web" to request a new link at any time.`);
 }
@@ -199,27 +229,24 @@ async function handleSetup(providedKey, local) {
         process.exit(1);
     }
     const client = new LoticsClient({ apiKey });
-    let email;
+    let info;
     try {
-        const info = await client.whoami();
-        email = info.email;
+        info = await client.whoami();
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
         console.error(`Authentication failed: ${message}`);
         process.exit(1);
     }
-    const scope = local ? "local" : "auto";
-    const existing = loadConfig(scope) ?? {};
-    const newConfig = { ...existing, api_key: apiKey, email };
-    // Auto-resolve workspace
+    // Auto-resolve workspace (only when the org has exactly one).
+    let workspaceId;
     try {
         const workspaces = await client.listWorkspaces();
         if (workspaces.length === 1) {
-            newConfig.workspace_id = workspaces[0].id;
+            workspaceId = workspaces[0].id;
         }
         else if (workspaces.length > 1) {
-            console.error(`\nMultiple workspaces found. Run "lotics workspace select <id>" to choose one:`);
+            console.error(`\nMultiple workspaces in ${info.organization_name}. Run "lotics workspace select <id>" to choose one:`);
             printWorkspaceList(workspaces);
         }
     }
@@ -227,29 +254,51 @@ async function handleSetup(providedKey, local) {
         const msg = error instanceof Error ? error.message : String(error);
         console.error(`Warning: could not resolve workspace: ${msg}`);
     }
-    saveConfig(newConfig, scope);
-    console.error("Authenticated.");
-    console.error(`  Config: ${getConfigPath(scope)}`);
+    // The key always lives in the global store as a profile; --local additionally
+    // pins this directory to it (a pointer), instead of making it the global default.
+    upsertProfile(info.organization_id, {
+        api_key: apiKey,
+        org_name: info.organization_name,
+        workspace_id: workspaceId,
+    });
+    const existing = loadGlobalConfig() ?? {};
+    saveGlobalConfig({ ...existing, email: info.email });
+    setActiveOrg(info.organization_id, local ? "local" : "global");
+    if (local) {
+        console.error(`Authenticated as ${info.email} in ${info.organization_name}.`);
+        console.error(`  Pinned this directory: ${getConfigPath("local")}`);
+    }
+    else {
+        console.error(`Authenticated as ${info.email} in ${info.organization_name} (now active).`);
+        console.error(`  Saved to the "${info.organization_name}" profile in ~/.lotics`);
+    }
 }
 function requireClient(flags) {
-    const auth = resolveAuth(flags);
-    if (!auth) {
-        console.error('Not authenticated. Run "lotics auth signup" or set LOTICS_API_KEY.');
+    const ctx = resolveContext(flags);
+    if (!ctx) {
+        console.error('Not authenticated. Run "lotics auth signup", "lotics auth api-key <key>", or set LOTICS_API_KEY.');
         process.exit(1);
     }
-    const config = loadConfig();
-    return new LoticsClient({ apiKey: auth.apiKey, workspaceId: config?.workspace_id });
+    return { client: new LoticsClient({ apiKey: ctx.apiKey, workspaceId: ctx.workspaceId }), ctx };
 }
+const SOURCE_LABELS = {
+    flag: "--api-key flag",
+    env_key: "LOTICS_API_KEY env",
+    env_org: "LOTICS_ORG env",
+    local_pointer: "local .lotics/config.json (pin)",
+    global_profile: "global active profile",
+};
 function printWorkspaceList(workspaces, currentId) {
     for (const ws of workspaces) {
         const marker = ws.id === currentId ? " (current)" : "";
         console.error(`  ${ws.id}  ${ws.name}  ${ws.timezone}  ${ws.default_currency}${marker}`);
     }
 }
-async function resolveWorkspace(client) {
-    const config = loadConfig();
-    if (config?.workspace_id)
+async function resolveWorkspace(client, ctx) {
+    if (ctx.workspaceId) {
+        client.setWorkspaceId(ctx.workspaceId);
         return;
+    }
     let workspaces;
     try {
         workspaces = await client.listWorkspaces();
@@ -264,8 +313,9 @@ async function resolveWorkspace(client) {
         process.exit(1);
     }
     if (workspaces.length === 1) {
-        const existing = config ?? {};
-        saveConfig({ ...existing, workspace_id: workspaces[0].id });
+        // Persist the auto-resolution where the credential lives; null means it
+        // came from --api-key/env with no profile, so it's an in-memory selection.
+        setSelectedWorkspace(workspaces[0].id);
         client.setWorkspaceId(workspaces[0].id);
         return;
     }
@@ -319,33 +369,66 @@ async function main() {
             return;
         }
         if (subcommand === "whoami") {
-            const auth = resolveAuth(flags);
-            if (!auth) {
-                console.error('Not authenticated. Run "lotics auth signup" or set LOTICS_API_KEY.');
+            const ctx = resolveContext(flags);
+            if (!ctx) {
+                console.error('Not authenticated. Run "lotics auth signup", "lotics auth api-key <key>", or set LOTICS_API_KEY.');
                 process.exit(1);
             }
-            const client = new LoticsClient({ apiKey: auth.apiKey });
+            const client = new LoticsClient({ apiKey: ctx.apiKey });
             const info = await client.whoami();
-            const existing = loadConfig() ?? {};
-            saveConfig({ ...existing, email: info.email });
+            const existing = loadGlobalConfig() ?? {};
+            saveGlobalConfig({ ...existing, email: info.email });
             if (flags.json) {
-                console.log(JSON.stringify(info, null, 2));
+                console.log(JSON.stringify({ ...info, workspace_id: ctx.workspaceId ?? null, source: ctx.source }, null, 2));
             }
             else {
-                console.log(`Name:    ${info.name}`);
-                console.log(`Email:   ${info.email}`);
-                console.log(`Org:     ${info.organization_name} (${info.organization_id})`);
+                console.log(`Name:       ${info.name}`);
+                console.log(`Email:      ${info.email}`);
+                console.log(`Org:        ${info.organization_name} (${info.organization_id})`);
+                console.log(`Workspace:  ${ctx.workspaceId ?? "(none selected)"}`);
+                console.log(`Source:     ${SOURCE_LABELS[ctx.source]}`);
             }
-            console.error(`Config:  ${getConfigPath()}`);
             return;
         }
         if (subcommand === "logout") {
-            deleteConfig();
-            console.error("Logged out. Credentials removed.");
+            const local = loadLocalConfig();
+            // Bare logout inside a pinned directory just unpins it.
+            if (local && !flags.all && !toolArgs) {
+                deleteConfig();
+                console.error("Removed the local pin for this directory.");
+                return;
+            }
+            if (flags.all) {
+                const g = loadGlobalConfig();
+                saveGlobalConfig({ last_update_check: g?.last_update_check, latest_version: g?.latest_version });
+                console.error("Removed all saved credentials.");
+                return;
+            }
+            const g = loadGlobalConfig() ?? {};
+            const profiles = g.profiles ?? {};
+            let resolved;
+            if (toolArgs) {
+                resolved = resolveProfileByNameOrId(profiles, toolArgs);
+            }
+            else if (g.active_org && profiles[g.active_org]) {
+                resolved = [g.active_org, profiles[g.active_org]];
+            }
+            else {
+                resolved = null;
+            }
+            if (!resolved) {
+                console.error(toolArgs
+                    ? `No saved credential matches "${toolArgs}".`
+                    : 'No active credential to remove. Pass an org name/id, or use --all.');
+                process.exit(1);
+            }
+            const [orgId, profile] = resolved;
+            removeProfile(orgId);
+            console.error(`Removed the "${profile.org_name}" credential (${orgId}).`);
             return;
         }
         if (subcommand === "web") {
-            const client = requireClient(flags);
+            const { client } = requireClient(flags);
             const { email } = await client.login();
             console.error(`Magic link sent to ${email}. Check your email to access the Lotics web app.`);
             return;
@@ -365,6 +448,63 @@ async function main() {
         await runDocxCommand(subcommand, toolArgs, restArgs);
         return;
     }
+    // --- lotics org [list | use <name|id> [--local]] — credential store, config-only ---
+    if (command === "org") {
+        const global = loadGlobalConfig() ?? {};
+        const profiles = global.profiles ?? {};
+        const local = loadLocalConfig();
+        if (subcommand === "use") {
+            if (!toolArgs) {
+                console.error("Usage: lotics org use <name|id> [--local]");
+                process.exit(1);
+            }
+            const resolved = resolveProfileByNameOrId(profiles, toolArgs);
+            if (!resolved) {
+                console.error(`No saved credential for "${toolArgs}". Run "lotics auth api-key <key>" while authenticated to that org, or "lotics org" to list.`);
+                process.exit(1);
+            }
+            const [orgId, profile] = resolved;
+            if (flags.local) {
+                setActiveOrg(orgId, "local");
+                console.error(`Pinned this directory to ${profile.org_name} (${orgId}).`);
+            }
+            else {
+                setActiveOrg(orgId, "global");
+                console.error(`Switched active org to ${profile.org_name} (${orgId}).`);
+                if (local?.active_org) {
+                    console.error("Note: a local pin (.lotics/config.json) overrides the global default in this directory. Use --local to change the pin here.");
+                }
+            }
+            return;
+        }
+        if (subcommand && subcommand !== "list") {
+            console.error(`Unknown org subcommand: ${subcommand}`);
+            console.error("Usage: lotics org [list | use <name|id> [--local]]");
+            process.exit(1);
+        }
+        const orgIds = Object.keys(profiles);
+        if (orgIds.length === 0) {
+            console.error('No saved orgs. Run "lotics auth api-key <key>" to add one.');
+            return;
+        }
+        // The active org in THIS directory: a local pin wins over the global default.
+        const effectiveActive = local?.active_org ?? global.active_org;
+        if (flags.json) {
+            console.log(JSON.stringify(orgIds.map((id) => ({
+                org_id: id,
+                org_name: profiles[id].org_name,
+                workspace_id: profiles[id].workspace_id ?? null,
+                active: id === effectiveActive,
+            })), null, 2));
+        }
+        else {
+            for (const id of orgIds) {
+                const marker = id === effectiveActive ? " (active)" : "";
+                console.log(`${id}  ${profiles[id].org_name}${marker}`);
+            }
+        }
+        return;
+    }
     // --- Validate command before auth ---
     if (command !== "tools" && command !== "upload" && command !== "run" && command !== "download" && command !== "workspace" && command !== "app") {
         console.error(`Unknown command: ${command}`);
@@ -378,6 +518,7 @@ async function main() {
         console.error("  lotics app deploy [-m <message>] [--force-workflow-sync]");
         console.error("                                       Build + upload the current directory");
         console.error("  lotics app subdomain <new-subdomain> Rename the app's public <slug>.lotics.app address");
+        console.error("  lotics app rename \"<new name>\"        Rename the app's display name (launcher title)");
         console.error("  lotics app dev [path]                Run the app locally with HMR + RPC forwarding");
         process.exit(1);
     }
@@ -403,11 +544,11 @@ async function main() {
         console.error('Downloads every file on the given file field into the output dir.');
         process.exit(1);
     }
-    const client = requireClient(flags);
+    const { client, ctx } = requireClient(flags);
     // lotics workspace / lotics workspace list / lotics workspace select <id>
     if (command === "workspace") {
         const workspaces = await client.listWorkspaces();
-        const config = loadConfig();
+        const currentWorkspaceId = ctx.workspaceId;
         if (subcommand === "select") {
             const targetId = toolArgs;
             if (!targetId) {
@@ -417,12 +558,16 @@ async function main() {
             const target = workspaces.find((ws) => ws.id === targetId);
             if (!target) {
                 console.error(`Workspace not found: ${targetId}\n\nAvailable workspaces:`);
-                printWorkspaceList(workspaces, config?.workspace_id);
+                printWorkspaceList(workspaces, currentWorkspaceId);
                 process.exit(1);
             }
-            const existing = config ?? {};
-            saveConfig({ ...existing, workspace_id: target.id });
-            console.error(`Switched to workspace: ${target.name} (${target.id})`);
+            const written = setSelectedWorkspace(target.id);
+            if (!written) {
+                console.error(`Switched to ${target.name} (${target.id}) for this command, but it could not be saved — credentials came from --api-key/LOTICS_API_KEY with no saved profile. Run "lotics auth api-key <key>" to persist a default.`);
+                return;
+            }
+            const where = written.scope === "local" ? " (pinned to this directory)" : "";
+            console.error(`Switched to workspace: ${target.name} (${target.id})${where}`);
             return;
         }
         if (subcommand === "create") {
@@ -433,8 +578,7 @@ async function main() {
             }
             const timezone = flags.timezone;
             const created = await client.createWorkspace({ name, timezone });
-            const existing = config ?? {};
-            saveConfig({ ...existing, workspace_id: created.id });
+            setSelectedWorkspace(created.id);
             client.setWorkspaceId(created.id);
             if (flags.json) {
                 console.log(JSON.stringify(created, null, 2));
@@ -460,16 +604,17 @@ async function main() {
             }
             else {
                 for (const ws of workspaces) {
-                    const marker = ws.id === config?.workspace_id ? " (current)" : "";
+                    const marker = ws.id === currentWorkspaceId ? " (current)" : "";
                     console.log(`${ws.id}  ${ws.name}  ${ws.timezone}  ${ws.default_currency}${marker}`);
                 }
             }
         }
-        console.error(`Config: ${getConfigPath()}`);
+        if (ctx.orgName)
+            console.error(`Org: ${ctx.orgName}`);
         return;
     }
     // Ensure workspace is resolved for all remaining commands
-    await resolveWorkspace(client);
+    await resolveWorkspace(client, ctx);
     // lotics app create / pull / deploy
     if (command === "app") {
         if (subcommand === "create") {
@@ -510,6 +655,16 @@ async function main() {
             await appSetSubdomain(client, { subdomain: newSubdomain });
             return;
         }
+        if (subcommand === "rename") {
+            const newName = toolArgs;
+            if (!newName) {
+                console.error('Usage: lotics app rename "<new name>"');
+                console.error("Changes the app's display name (run inside the app directory).");
+                process.exit(1);
+            }
+            await appRename(client, { name: newName });
+            return;
+        }
         if (subcommand === "dev") {
             // First positional is an optional project path (defaults to cwd).
             // --port and --vite-port can override the wrapper / Vite ports.

package/dist/client.js

@@ -262,10 +262,15 @@ export class LoticsClient {
         return absolutePath;
     }
     async downloadFileById(fileId, outputDir, options) {
-        const url = `${this.baseUrl}/v1/files/${encodeURIComponent(fileId)}/download`;
-        const response = await fetch(url, {
-            headers: this.buildHeaders(),
-        });
+        // Resolve a presigned URL (the file proxy is auth-gated and served by an
+        // edge Worker that doesn't accept the API key). The signed_url endpoint
+        // takes the API key and returns a short-lived, directly-fetchable URL
+        // whose Content-Disposition carries the original filename.
+        const signedUrlRes = await fetch(`${this.baseUrl}/v1/files/${encodeURIComponent(fileId)}/signed_url`, { headers: this.buildHeaders() });
+        if (!signedUrlRes.ok)
+            await this.throwResponseError(signedUrlRes);
+        const { url } = (await signedUrlRes.json());
+        const response = await fetch(url);
         if (!response.ok)
             await this.throwResponseError(response);
         const disposition = response.headers.get("content-disposition") ?? "";