@mediaruntime/cli 0.1.0 → 0.2.1

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.2.1 — 2026-08-16
+
+- Show an elapsed-time activity spinner during interactive local upload, job waiting,
+  and verified bundle download.
+- Keep progress on `stderr` and disable it for JSON and non-interactive execution.
+- Clarify that both relative and absolute local file paths are uploaded automatically.
+
+## 0.2.0 — 2026-08-16
+
+- Add browser-assisted `login`, `auth status`, and revoking `logout` commands.
+- Store dedicated CLI credentials only in the operating-system credential vault.
+- Keep `MEDIARUNTIME_API_KEY` as the higher-priority permanent automation interface.
+- Bind the one-time exchange with PKCE and redact credentials from all CLI output.
+
 ## 0.1.0 — 2026-08-16
 
 - Add `run` with local uploads, frozen output aliases, safe waiting, and atomic canonical

package/README.md

@@ -11,24 +11,36 @@ npm install --global @mediaruntime/cli
 mediaruntime --version
 ```
 
-Node.js 20 or newer is required. Authenticated commands read the API key from the
-environment; the hosted API URL is built in.
+Node.js 20 or newer is required. For interactive use, authorize through the browser once:
+
+```bash
+mediaruntime login
+mediaruntime auth status
+```
+
+The CLI stores its dedicated revocable key in the operating-system credential vault; it
+never writes the key to a plaintext configuration file. Use `mediaruntime logout` to
+revoke and remove it.
+
+For CI, servers, containers, and deliberate account overrides, continue setting:
 
 ```bash
 export MEDIARUNTIME_API_KEY="sk_..."
 ```
 
-Do not pass credentials as command-line arguments. `--base-url` and
+An explicit `MEDIARUNTIME_API_KEY` permanently remains supported and takes precedence
+over the stored login. Do not pass credentials as command-line arguments. `--base-url` and
 `MEDIARUNTIME_API_URL` are development/staging overrides, not normal client setup.
 
 ## Run a job
 
 ```bash
+# Relative and absolute local paths are uploaded automatically.
 mediaruntime run ./launch.mp4 --output video.web --wait
 
-mediaruntime run ./launch.mp4 \
-  --output video.streaming \
-  --output audio.transcription \
+mediaruntime run "/Users/you/Videos/launch.mp4" \
+  -o video.streaming \
+  -o audio.transcription \
   --metadata '{"asset_id":"launch-01"}' \
   --idempotency-key 'asset:launch-01:v1' \
   --download ./launch-01.zip
@@ -39,6 +51,11 @@ temporary file, validates its advertised size and SHA-256 when available, and pu
 it atomically. Existing files are preserved unless `--force` is explicit. Signed download
 URLs are never printed.
 
+In an interactive terminal, `run` displays an elapsed-time spinner while it uploads a
+local source, waits for the terminal job state, and downloads and verifies the bundle.
+The indicator uses `stderr` and is automatically disabled for `--json`, redirected
+output, and other non-interactive execution.
+
 Supported frozen output aliases:
 
 - `video.web`
@@ -104,6 +121,7 @@ The full implementation contract is in [docs/CLI_SDD.md](docs/CLI_SDD.md).
 
 ## Scope
 
-The first release intentionally does not implement `listen`, `login`, credential storage,
-or a webhook relay. Production completion continues to use the account destination under
-Account → Webhooks. The ZIP remains the canonical completed-job result.
+The CLI does not implement `listen` or a webhook relay. Production completion continues
+to use the account destination under Account → Webhooks. The ZIP remains the canonical
+completed-job result. See [browser authentication](docs/AUTH.md) for the complete login,
+credential precedence, and security contract.

package/dist/cli.d.ts

@@ -1,5 +1,18 @@
 import { ListJobsParams, JobPage, JobDetails, CreateJobParams, JobReceiptData, WaitForJobOptions } from '@mediaruntime/node';
 
+interface StoredCredential {
+    apiKey: string;
+    accountId: string;
+    keyId: string;
+    baseUrl: string;
+    createdAt: string;
+}
+interface CredentialStore {
+    get(baseUrl: string): Promise<StoredCredential | null>;
+    set(credential: StoredCredential): Promise<void>;
+    delete(baseUrl: string): Promise<void>;
+}
+
 interface JobsReadClient {
     list(params?: ListJobsParams): Promise<JobPage>;
     get(jobId: string): Promise<JobDetails>;
@@ -53,6 +66,24 @@ declare function signSyntheticWebhook(payload: Readonly<Record<string, unknown>>
     secret: string;
 }): SignedWebhook;
 
+interface AuthCommandDependencies {
+    credentialStore?: CredentialStore;
+    openBrowser?: (url: string) => Promise<void>;
+    sleep?: (milliseconds: number) => Promise<void>;
+    now?: () => number;
+    randomVerifier?: () => string;
+    writeStdout?: (text: string) => void;
+}
+declare function resolveCredential(baseUrl: string, dependencies?: AuthCommandDependencies): Promise<{
+    apiKey: string;
+    source: "environment" | "keychain";
+    stored?: StoredCredential;
+} | null>;
+declare function runLoginCommand(args: string[], baseUrl: string, dependencies?: AuthCommandDependencies): Promise<number>;
+declare function runAuthStatusCommand(args: string[], baseUrl: string, dependencies?: AuthCommandDependencies): Promise<number>;
+declare function runLogoutCommand(args: string[], baseUrl: string, dependencies?: AuthCommandDependencies): Promise<number>;
+declare function runAuthCommand(args: string[], baseUrl: string, dependencies?: AuthCommandDependencies): Promise<number>;
+
 type CliJobsClient = RunJobsClient & JobsReadClient;
 interface CliClient {
     jobs: CliJobsClient;
@@ -60,6 +91,7 @@ interface CliClient {
 interface CliDependencies {
     createClient?(options: {
         baseUrl?: string;
+        apiKey?: string;
     }): CliClient;
     downloadBundle?(url: string, destination: string, options: {
         force: boolean;
@@ -68,6 +100,12 @@ interface CliDependencies {
     }): Promise<void>;
     writeStdout?(text: string): void;
     writeStderr?(text: string): void;
+    isStderrTTY?: boolean;
+    credentialStore?: CredentialStore;
+    openBrowser?(url: string): Promise<void>;
+    sleep?(milliseconds: number): Promise<void>;
+    now?(): number;
+    randomVerifier?(): string;
 }
 declare function downloadBundleAtomically(url: string, destination: string, options: {
     force: boolean;
@@ -76,4 +114,4 @@ declare function downloadBundleAtomically(url: string, destination: string, opti
 }): Promise<void>;
 declare function executeCli(argv: string[], dependencies?: CliDependencies): Promise<number>;
 
-export { type CliClient, type CliDependencies, createSyntheticTerminalEvent, downloadBundleAtomically, executeCli, parseTriggerArguments, runTriggerCommand, signSyntheticWebhook };
+export { type CliClient, type CliDependencies, createSyntheticTerminalEvent, downloadBundleAtomically, executeCli, parseTriggerArguments, resolveCredential, runAuthCommand, runAuthStatusCommand, runLoginCommand, runLogoutCommand, runTriggerCommand, signSyntheticWebhook };