@meistrari/tela-cli 1.1.0 → 1.2.0

package/README.md

@@ -9,9 +9,12 @@ directly, and normal output must not print token material.
 
 ## Commands
 
-Current first-slice commands:
+Canonical commands:
 
 ```bash
+tela auth login --no-interactive
+tela auth logout --context <context-id>
+tela auth whoami --json
 tela auth token --json
 tela auth token --raw
 tela context current --json
@@ -19,14 +22,15 @@ tela context list --json
 tela context show <context-id> --json
 tela context use <context-id>
 tela env list --json
-tela update --json
-tela api <slug> <METHOD> <PATH> [args...] --env <slug> --body <json> --pretty
-tela docs endpoints <slug> --pretty
-tela docs reference <slug> [METHOD PATH|file-path] --pretty
-tela docs guide <slug> [path]
-tela env list <ingredient-slug> --pretty
-tela env set <ingredient-slug> <environment>
-tela whoami --pretty
+tela service update --json
+tela service list --json
+tela service show <slug> --json
+tela service api <slug> <METHOD> <PATH> [args...] --service-env <slug> --body <json> --pretty
+tela service docs endpoints <slug> --pretty
+tela service docs reference <slug> [METHOD PATH|file-path] --pretty
+tela service docs guide <slug> [path]
+tela service env list <slug> --pretty
+tela service env use <slug> <environment>
 tela doctor auth --json
 tela agent sync [repo] --current --all --dry-run --json --verbose
 tela agent run --input <name=path>... --plain --json --verbose
@@ -34,16 +38,15 @@ tela agent push --message <text> --claude --manual --dry-run --json --verbose
 tela agent feedback --list --apply <all|select> --json --verbose
 ```
 
-`context use` is the only normal config mutation in this slice. `auth token`
-may refresh a user-session credential in Keychain before returning metadata or
-printing a raw token. Creating, removing, editing, and repairing contexts are
-Dock-first workflows.
+`auth login` uses device flow and creates or updates a context backed by the
+same Keychain credential adapter as Dock. `auth token` may refresh that session
+before returning metadata or printing a raw token.
 
-The legacy `telactl` Pantry/service workflows are ported into this binary as
-top-level `update`, `api`, `docs`, `whoami`, and `token` commands. Ingredient
-cache and per-ingredient environment defaults live under `TELA_HOME` next to
-the Dock config, while credential material still comes from the selected Tela
-context through `@meistrari/tela-local-config`.
+The top-level `api`, `docs`, `update`, `whoami`, and `token` aliases on `tela`
+remain available during migration. Service catalog and per-service environment
+defaults live in validated `TELA_HOME/inventory.json`, with a dual-read path for
+the former `ingredients.json` files. Credential material continues to come from
+the selected Tela context.
 
 ## Development
 

package/dist/commands/auth.d.ts

@@ -1,2 +1,10 @@
 import type { CliIo, GlobalOptions } from '../output';
 export declare function runAuthCommand(args: string[], options: GlobalOptions, io: CliIo): Promise<number>;
+export declare function formatDeviceFlowInstructions(input: {
+    userCode: string;
+    verificationUriComplete: string;
+    deviceCode: string;
+    environmentId: string;
+    authUrl?: string;
+    contextId?: string;
+}): string;

package/dist/commands/auth.js

@@ -1,6 +1,15 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runAuthCommand = runAuthCommand;
+exports.formatDeviceFlowInstructions = formatDeviceFlowInstructions;
+const node_child_process_1 = require("node:child_process");
+const promises_1 = require("node:fs/promises");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const node_process_1 = __importDefault(require("node:process"));
 const tela_local_config_1 = require("@meistrari/tela-local-config");
 const credentials_1 = require("../credentials");
 const output_1 = require("../output");
@@ -10,11 +19,226 @@ async function runAuthCommand(args, options, io) {
         writeAuthHelp(io);
         return 0;
     }
-    if (action === 'token')
-        return await authToken(rest, options, io);
+    if (action === 'token') {
+        if (rest[0] === 'list')
+            return await authTokenList(options, io);
+        else
+            return await authToken(rest, options, io);
+    }
+    if (action === 'login')
+        return await authLogin(rest, options, io);
+    if (action === 'logout')
+        return await authLogout(rest, options, io);
+    if (action === 'whoami')
+        return await authWhoami(rest, options, io);
     (0, output_1.writeError)(io, `Unknown auth command: ${action}`);
     return 1;
 }
+async function authLogin(args, options, io) {
+    const parsed = parseLoginOptions(args);
+    if ('error' in parsed) {
+        (0, output_1.writeError)(io, parsed.error);
+        return 1;
+    }
+    try {
+        const config = await (0, tela_local_config_1.loadConfig)();
+        const context = parsed.contextId ? (0, tela_local_config_1.resolveContext)(config, { contextId: parsed.contextId }) : null;
+        const environmentId = context?.context.environmentId ?? parsed.environmentId ?? 'production';
+        const environment = config.environments[environmentId];
+        if (!environment)
+            throw new Error(`Unknown Tela environment: ${environmentId}`);
+        const requesterApplicationId = environment.authApplication?.requesterApplicationId;
+        const targetApplicationId = environment.authApplication?.targetApplicationId;
+        if (!requesterApplicationId || !targetApplicationId) {
+            throw new Error(`Environment '${environmentId}' does not define auth application IDs. Configure them before logging in.`);
+        }
+        // auth-cli is ESM-only with no `require` export condition, so this
+        // CJS bundle can only reach it through a dynamic import.
+        const { DeviceFlow } = await import('@meistrari/auth-cli');
+        const storage = (0, tela_local_config_1.createTelaTokenStorage)();
+        const flowOptions = {
+            apiUrl: parsed.authUrl ?? environment.authApiUrl,
+            requesterApplicationId,
+            targetApplicationId,
+            storage,
+        };
+        const loginContext = {
+            environmentId,
+            contextId: context?.id,
+            // Both paths below issue the device code up front, which makes the
+            // SDK skip its cache branch anyway. Say so rather than relying on it.
+            cache: false,
+        };
+        if (parsed.deviceCode) {
+            const resumed = DeviceFlow.resume(flowOptions, { deviceCode: parsed.deviceCode });
+            const tokens = await resumed.authenticate(loginContext);
+            return reportLogin(tokens, storage, environmentId, options, io);
+        }
+        const flow = new DeviceFlow(flowOptions);
+        const init = await flow.init();
+        if (!parsed.interactive) {
+            (0, output_1.writeLine)(io, formatDeviceFlowInstructions({
+                userCode: init.userCode,
+                verificationUriComplete: init.verificationUriComplete,
+                deviceCode: init.deviceCode,
+                environmentId,
+                authUrl: parsed.authUrl,
+                contextId: parsed.contextId,
+            }));
+            return 0;
+        }
+        const verificationUrl = resolveSafeVerificationUrl(init.verificationUriComplete, {
+            allowLoopbackHttp: environment.kind === 'local',
+        });
+        if (!verificationUrl)
+            throw new Error('Tela auth returned an unsafe verification URL.');
+        (0, output_1.writeLine)(io, `Open ${verificationUrl}`);
+        (0, output_1.writeLine)(io, `Code: ${init.userCode}`);
+        openExternal(verificationUrl);
+        const tokens = await flow.authenticate(loginContext);
+        return reportLogin(tokens, storage, environmentId, options, io);
+    }
+    catch (error) {
+        (0, output_1.writeError)(io, error instanceof Error ? error.message : String(error));
+        return 1;
+    }
+}
+function reportLogin(tokens, storage, environmentId, options, io) {
+    const contextId = storage.resolvedContextId;
+    if (options.json) {
+        (0, output_1.writeJson)(io, {
+            authenticated: true,
+            contextId,
+            environmentId,
+            user: tokens.user,
+            organization: tokens.organization,
+        });
+    }
+    else {
+        (0, output_1.writeLine)(io, `Logged in as ${tokens.user.email}.`);
+        (0, output_1.writeLine)(io, `Active context: ${contextId}`);
+    }
+    return 0;
+}
+async function authLogout(args, options, io) {
+    let contextId;
+    let all = false;
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === '--all') {
+            all = true;
+            continue;
+        }
+        if (arg === '--context') {
+            contextId = args[index + 1];
+            if (!contextId) {
+                (0, output_1.writeError)(io, 'Usage: tela auth logout [--context <context-id>|--all]');
+                return 1;
+            }
+            index += 1;
+            continue;
+        }
+        (0, output_1.writeError)(io, `Unknown auth logout option: ${arg}`);
+        return 1;
+    }
+    try {
+        const config = await (0, tela_local_config_1.loadConfig)();
+        const targets = all
+            ? Object.entries(config.contexts)
+            : [[(0, tela_local_config_1.resolveContext)(config, { contextId }).id, (0, tela_local_config_1.resolveContext)(config, { contextId }).context]];
+        const credentials = (0, credentials_1.createCliCredentialAdapter)();
+        for (const [, context] of targets)
+            await credentials.delete(context.credentialRef);
+        if (options.json)
+            (0, output_1.writeJson)(io, { loggedOut: targets.map(([id]) => id) });
+        else
+            (0, output_1.writeLine)(io, `Logged out of ${targets.length} Tela context${targets.length === 1 ? '' : 's'}.`);
+        return 0;
+    }
+    catch (error) {
+        (0, output_1.writeError)(io, error instanceof Error ? error.message : String(error));
+        return 1;
+    }
+}
+async function authWhoami(args, options, io) {
+    const selector = parseContextSelector(args, 'whoami');
+    if ('error' in selector) {
+        (0, output_1.writeError)(io, selector.error);
+        return 1;
+    }
+    try {
+        const config = await (0, tela_local_config_1.loadConfig)();
+        const resolved = (0, tela_local_config_1.resolveContext)(config, selector);
+        const credential = await (0, credentials_1.createCliCredentialAdapter)().get(resolved.context.credentialRef);
+        if (!credential)
+            throw new Error(`Missing credential for Tela context ${resolved.id}`);
+        const raw = isRecord(credential.raw) ? credential.raw : {};
+        const payload = {
+            contextId: resolved.id,
+            environmentId: resolved.context.environmentId,
+            workspaceId: resolved.context.workspaceId,
+            accountEmail: credential.accountEmail ?? resolved.context.accountEmail,
+            user: raw.user ?? null,
+            organization: raw.organization ?? null,
+        };
+        if (options.json || args.includes('--pretty')) {
+            (0, output_1.writeJson)(io, payload);
+        }
+        else {
+            (0, output_1.writeLine)(io, payload.accountEmail ?? 'Authenticated');
+            (0, output_1.writeLine)(io, `Context: ${payload.contextId}`);
+            (0, output_1.writeLine)(io, `Workspace: ${payload.workspaceId}`);
+        }
+        return 0;
+    }
+    catch (error) {
+        (0, output_1.writeError)(io, error instanceof Error ? error.message : String(error));
+        return 1;
+    }
+}
+async function authTokenList(options, io) {
+    const config = await (0, tela_local_config_1.loadConfig)();
+    const publicConfig = await (0, tela_local_config_1.toPublicConfig)(config, (0, credentials_1.createCliCredentialAdapter)());
+    const tokens = Object.values(publicConfig.contexts).map(context => ({
+        contextId: context.id,
+        environmentId: context.environmentId,
+        accountEmail: context.accountEmail,
+        credential: context.credential,
+    }));
+    const legacyCredentials = await discoverLegacyTelactlCredentials();
+    if (options.json) {
+        (0, output_1.writeJson)(io, { tokens, legacyCredentials });
+    }
+    else if (tokens.length === 0 && legacyCredentials.length === 0) {
+        (0, output_1.writeLine)(io, 'No Tela credentials configured.');
+    }
+    else {
+        for (const token of tokens)
+            (0, output_1.writeLine)(io, `${token.contextId}  ${token.accountEmail ?? '-'}  ${token.credential.ok ? 'valid' : token.credential.problem ?? 'unknown'}`);
+        for (const legacy of legacyCredentials)
+            (0, output_1.writeLine)(io, `legacy:${legacy.environmentId}  discovered (not imported)  ${legacy.path}`);
+    }
+    return 0;
+}
+async function discoverLegacyTelactlCredentials() {
+    const root = (0, node_path_1.join)((0, node_os_1.homedir)(), '.telactl');
+    try {
+        const names = await (0, promises_1.readdir)(root);
+        return names
+            .filter(name => name.startsWith('credentials.') && name.endsWith('.json'))
+            .map(name => ({
+            environmentId: name.slice('credentials.'.length, -'.json'.length),
+            path: (0, node_path_1.join)(root, name),
+        }))
+            .filter(item => item.environmentId.length > 0)
+            .sort((left, right) => left.environmentId.localeCompare(right.environmentId));
+    }
+    catch (error) {
+        if (isNotFound(error))
+            return [];
+        throw error;
+    }
+}
 async function authToken(args, options, io) {
     const parsed = parseTokenOptions(args);
     if ('error' in parsed) {
@@ -60,7 +284,10 @@ async function authToken(args, options, io) {
 }
 async function resolveToken(options) {
     const config = await (0, tela_local_config_1.loadConfig)();
-    const resolved = (0, tela_local_config_1.resolveContext)(config, { contextId: options.contextId });
+    const resolved = (0, tela_local_config_1.resolveContext)(config, {
+        contextId: options.contextId,
+        environmentId: options.environmentId,
+    });
     const credentials = (0, credentials_1.createCliCredentialAdapter)();
     const credentialRef = resolved.context.credentialRef;
     const originalCredential = await credentials.get(credentialRef);
@@ -109,6 +336,14 @@ function parseTokenOptions(args) {
             index += 1;
             continue;
         }
+        if (arg === '--environment' || arg === '--auth-env') {
+            const value = args[index + 1];
+            if (!value)
+                return { error: 'Usage: tela auth token --environment <environment-id>' };
+            options.environmentId = value;
+            index += 1;
+            continue;
+        }
         if (arg === '--kind') {
             const value = args[index + 1];
             if (value !== 'access-token' && value !== 'data-token') {
@@ -126,6 +361,133 @@ function parseTokenOptions(args) {
     }
     return options;
 }
+function parseLoginOptions(args) {
+    const parsed = {
+        interactive: Boolean(node_process_1.default.stdin.isTTY),
+    };
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === '--interactive') {
+            parsed.interactive = true;
+            continue;
+        }
+        if (arg === '--no-interactive') {
+            parsed.interactive = false;
+            continue;
+        }
+        if (arg === '--context' || arg === '--environment' || arg === '--auth-env' || arg === '--auth-url' || arg === '--device-code') {
+            const value = args[index + 1];
+            if (!value)
+                return { error: `Missing value for ${arg}.` };
+            if (arg === '--context')
+                parsed.contextId = value;
+            else if (arg === '--environment' || arg === '--auth-env')
+                parsed.environmentId = value;
+            else if (arg === '--auth-url')
+                parsed.authUrl = value;
+            else
+                parsed.deviceCode = value;
+            index += 1;
+            continue;
+        }
+        return { error: `Unknown auth login option: ${arg}` };
+    }
+    return parsed;
+}
+function parseContextSelector(args, action) {
+    const selector = {};
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === '--pretty' || arg === '-p' || arg === '--interactive' || arg === '--no-interactive')
+            continue;
+        if (arg === '--context') {
+            selector.contextId = args[index + 1];
+            if (!selector.contextId)
+                return { error: `Usage: tela auth ${action} [--context <context-id>]` };
+            index += 1;
+            continue;
+        }
+        if (arg === '--environment' || arg === '--auth-env') {
+            selector.environmentId = args[index + 1];
+            if (!selector.environmentId)
+                return { error: `Usage: tela auth ${action} [--environment <environment-id>]` };
+            index += 1;
+            continue;
+        }
+        if (arg === '--auth-url') {
+            if (!args[index + 1])
+                return { error: `Missing value for ${arg}.` };
+            index += 1;
+            continue;
+        }
+        return { error: `Unknown auth ${action} option: ${arg}` };
+    }
+    return selector;
+}
+function formatDeviceFlowInstructions(input) {
+    const environmentOption = input.environmentId === 'production'
+        ? ''
+        : ` --environment ${shellArg(input.environmentId)}`;
+    const contextOption = input.contextId ? ` --context ${shellArg(input.contextId)}` : '';
+    const authUrlOption = input.authUrl ? ` --auth-url ${shellArg(input.authUrl)}` : '';
+    return [
+        'To sign in, open this URL and authorize access:',
+        `  ${input.verificationUriComplete}`,
+        '',
+        'If asked for a code, enter:',
+        `  ${input.userCode}`,
+        '',
+        'Then run:',
+        `  tela auth login --device-code ${shellArg(input.deviceCode)}${environmentOption}${contextOption}${authUrlOption}`,
+    ].join('\n');
+}
+function openExternal(url) {
+    const command = node_process_1.default.platform === 'darwin'
+        ? 'open'
+        : node_process_1.default.platform === 'win32' ? 'rundll32' : 'xdg-open';
+    const args = node_process_1.default.platform === 'win32' ? ['url.dll,FileProtocolHandler', url] : [url];
+    const child = (0, node_child_process_1.spawn)(command, args, { detached: true, stdio: 'ignore' });
+    child.unref();
+}
+function resolveSafeVerificationUrl(rawUrl, { allowLoopbackHttp = false } = {}) {
+    const candidate = parseUrl(rawUrl);
+    if (!candidate || candidate.username || candidate.password)
+        return null;
+    if (candidate.protocol === 'https:')
+        return candidate.href;
+    if (candidate.protocol === 'http:' && allowLoopbackHttp && isLoopbackHostname(candidate.hostname))
+        return candidate.href;
+    return null;
+}
+function parseUrl(rawUrl) {
+    try {
+        return new URL(rawUrl);
+    }
+    catch {
+        return null;
+    }
+}
+function isLoopbackHostname(rawHostname) {
+    const hostname = rawHostname.toLowerCase().replace(/^\[|\]$/g, '');
+    return hostname === 'localhost'
+        || hostname.endsWith('.localhost')
+        || hostname === '::1'
+        || /^127(?:\.\d{1,3}){3}$/.test(hostname);
+}
+function shellArg(value) {
+    return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function isNotFound(error) {
+    return error !== null && typeof error === 'object' && 'code' in error && error.code === 'ENOENT';
+}
 function writeAuthHelp(io) {
-    (0, output_1.writeLine)(io, 'Usage: tela auth token [--context <context-id>] [--kind access-token|data-token] [--raw] [--json]');
+    (0, output_1.writeLine)(io, 'Usage: tela auth <command> [options]');
+    (0, output_1.writeLine)(io, '  login [--context <id>|--environment <id>] [--interactive|--no-interactive] [--device-code <code>]');
+    (0, output_1.writeLine)(io, '  logout [--context <id>|--all]');
+    (0, output_1.writeLine)(io, '  whoami [--context <id>] [--json]');
+    (0, output_1.writeLine)(io, '  token [--context <id>|--environment <id>] [--kind access-token|data-token] [--raw] [--json]');
+    (0, output_1.writeLine)(io, '  token list [--json]');
 }

package/dist/commands/ingredients.d.ts

@@ -1,38 +1,10 @@
+import type { StoredCredential, TelaServiceIngredient } from '@meistrari/tela-local-config';
+import { extractGitHubFilePath, joinUrl, parseHttpieArg, resolveGuidePath } from '@meistrari/tela-pantry';
 import type { CliIo, GlobalOptions } from '../output';
-export type CachedEnvironment = {
-    slug: string;
-    url: string;
-};
-export type CachedIngredient = {
-    slug: string;
-    name: string;
-    description: string;
-    type: 'api' | 'library' | 'skill';
-    status: string;
-    environments: CachedEnvironment[];
-};
-type ParsedArg = {
-    kind: 'query';
-    key: string;
-    value: string;
-} | {
-    kind: 'header';
-    key: string;
-    value: string;
-} | {
-    kind: 'field';
-    key: string;
-    value: string;
-} | {
-    kind: 'rawField';
-    key: string;
-    value: string;
-};
+export { extractGitHubFilePath, joinUrl, parseHttpieArg, resolveGuidePath, };
+export type CachedEnvironment = TelaServiceIngredient['environments'][number];
+export type CachedIngredient = TelaServiceIngredient;
+export declare function runServiceCommand(args: string[], options: GlobalOptions, io: CliIo): Promise<number>;
 export declare function runTelactlCommand(command: string, args: string[], options: GlobalOptions, io: CliIo): Promise<number>;
 export declare function runIngredientEnvCommand(args: string[], options: GlobalOptions, io: CliIo): Promise<number | null>;
-export declare function fetchIngredientCatalog(headers: Record<string, string>, fetchImpl?: typeof fetch): Promise<CachedIngredient[]>;
-export declare function joinUrl(base: string, routePath: string): string;
-export declare function parseHttpieArg(arg: string): ParsedArg | null;
-export declare function extractGitHubFilePath(url: string): string | null;
-export declare function resolveGuidePath(rootFilePath: string, providedPath?: string): string;
-export {};
+export declare function fetchIngredientCatalog(credential: StoredCredential, baseUrl?: string): Promise<TelaServiceIngredient[]>;