@newly/cli 0.1.91 → 0.1.93

package/README.md

@@ -29,10 +29,28 @@ newly email status       # inspect Newly Email setup
 ```bash
 newly login          # opens a browser, stores a session token in ~/.newly/credentials
 newly login --manual # paste the credential instead of using the browser callback
+newly whoami         # show the stored credential: account, API, expiry, file
 newly logout         # delete stored credentials
 ```
 
-The token expires. Re-run `newly login` when commands report you're logged out.
+The token expires. Re-run `newly login` when commands report you're logged out —
+it reports the existing session first and offers to keep it, so running it out of
+habit no longer throws away a working credential.
+
+`newly whoami` reads the stored credential without calling the API, and exits
+non-zero when there is none or it has expired:
+
+```
+Account     you@example.com
+API         https://api.newly.app
+Expires     8/30/2026, 5:02:58 PM
+Credential  ~/.newly/credentials
+```
+
+It reports whatever would actually be sent, including a credential supplied
+through `NEWLY_API_TOKEN`, which takes precedence over the saved file. The
+account line is only filled in when the sign-in method revealed an address; the
+browser handoff never sees one.
 
 ## Project linking
 

package/README.runcloud.md

@@ -28,6 +28,7 @@ curl -fsSL https://run.cloud/install | sh
 
 ```bash
 runcloud login   # sign in with email, Google, or GitHub; stores a token in ~/.run-cloud/credentials
+runcloud whoami  # show the stored credential: account, API, expiry, file
 runcloud logout  # delete the stored credential
 runcloud account        # show your entitlement and metered balance
 ```
@@ -37,6 +38,23 @@ show a short code to confirm, so login works over SSH and on headless machines t
 pick with `--email`, `--google`, `--github`, or `--browser` to skip the prompt.
 
 The token expires — re-run `runcloud login` when a command reports you're logged out.
+Logging in while a valid session exists reports that session and offers to keep it,
+so running it out of habit no longer replaces a working credential.
+
+`runcloud whoami` answers which credential is in play without calling the API, and
+exits non-zero when there is none or it has expired:
+
+```
+Account     you@example.com
+API         https://api.run.cloud
+Expires     never
+Credential  ~/.run-cloud/credentials
+```
+
+It reports whatever would actually be sent, including a credential supplied through
+`RUN_CLOUD_API_KEY`, which takes precedence over the saved file. The account line is
+only filled in when the sign-in method revealed an address — email sign-in does, the
+browser and device handoffs do not.
 
 ## Remote simulators
 

package/dist/commands/login.js

@@ -3,7 +3,7 @@ import crypto from 'node:crypto';
 import { hostname } from 'node:os';
 import { spawn } from 'node:child_process';
 import { ApiClient, ApiError } from '../api.js';
-import { clearCredentials, credentialsDisplayPath, loadCredentials, normalizeApiUrl, saveCredentials, } from '../config.js';
+import { clearCredentials, credentialsDisplayPath, loadCredentials, loginCommandName, normalizeApiUrl, sanitizeAccount, saveCredentials, } from '../config.js';
 import { acquirePromptIO, ask, PromptAbortedError, select, } from '../prompt.js';
 import { AuthError, createApiKey, fetchProviders, isValidEmail, isValidOtp, normalizeOtp, sendEmailCode, verifyEmailCode, } from '../runCloudAuth.js';
 const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
@@ -91,7 +91,13 @@ export async function startCallbackServer(state, appOrigin, timeoutMs) {
                 res.writeHead(200, { ...corsHeaders, 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ ok: true }));
                 clearTimeout(timer);
-                resolvePayload(parsed);
+                const account = sanitizeAccount(parsed.account);
+                resolvePayload({
+                    token: parsed.token,
+                    expiresIn: parsed.expiresIn,
+                    apiUrl: parsed.apiUrl,
+                    ...(account ? { account } : {}),
+                });
             }
             catch {
                 res.writeHead(400, corsHeaders);
@@ -186,7 +192,13 @@ export function parseManualCredential(blob) {
         throw new Error('Pasted credential is missing required fields (expected JSON with token, expiresIn, apiUrl). ' +
             'Copy the entire blob shown in the browser.');
     }
-    return { token: c.token, expiresIn: c.expiresIn, apiUrl: c.apiUrl };
+    const account = sanitizeAccount(c.account);
+    return {
+        token: c.token,
+        expiresIn: c.expiresIn,
+        apiUrl: c.apiUrl,
+        ...(account ? { account } : {}),
+    };
 }
 export async function verifyRunCloudCredential(apiUrl, token) {
     try {
@@ -215,12 +227,25 @@ export async function revokeRunCloudCredential(apiUrl, token) {
             'revoke it from the run.cloud dashboard.');
     }
 }
+function expiresAtLabel(creds) {
+    if (creds.expiresAt >= Number.MAX_SAFE_INTEGER)
+        return null;
+    return new Date(creds.expiresAt * 1000).toLocaleString();
+}
 export function existingLoginSummary(creds) {
     const who = creds.account ? ` as ${creds.account}` : '';
-    const expiry = creds.expiresAt < Number.MAX_SAFE_INTEGER
-        ? `, valid until ${new Date(creds.expiresAt * 1000).toLocaleString()}`
-        : '';
-    return `You are already logged in${who} (${creds.apiUrl}${expiry}).`;
+    const expires = expiresAtLabel(creds);
+    return `You are already logged in${who} (${creds.apiUrl}${expires ? `, valid until ${expires}` : ''}).`;
+}
+export function whoamiReport(creds) {
+    const rows = [
+        ['Account', creds.account ?? 'not recorded (browser sign-in never sees an address)'],
+        ['API', creds.apiUrl],
+        ['Expires', expiresAtLabel(creds) ?? 'never'],
+        ['Credential', credentialsDisplayPath()],
+    ];
+    const width = Math.max(...rows.map(([label]) => label.length));
+    return rows.map(([label, value]) => `${label.padEnd(width + 2)}${value}`).join('\n');
 }
 export async function confirmReplaceExistingLogin(creds) {
     if (!creds)
@@ -305,6 +330,7 @@ export function registerLogin(program) {
                     apiUrl: parsed.apiUrl,
                     appUrl: opts.appUrl,
                     expiresAt: Math.floor(Date.now() / 1000) + parsed.expiresIn,
+                    ...(parsed.account ? { account: parsed.account } : {}),
                 });
                 console.log('Logged in.');
                 return;
@@ -367,6 +393,7 @@ export function registerLogin(program) {
                     appUrl: opts.appUrl,
                     expiresAt: Math.floor(Date.now() / 1000) + payload.expiresIn,
                     revocable: true,
+                    ...(payload.account ? { account: payload.account } : {}),
                 });
                 console.log(`Logged in. Credentials saved to ${credentialsDisplayPath()}`);
                 return;
@@ -387,8 +414,10 @@ export function registerLogin(program) {
                     apiUrl: payload.apiUrl,
                     appUrl: opts.appUrl,
                     expiresAt: Math.floor(Date.now() / 1000) + payload.expiresIn,
+                    ...(payload.account ? { account: payload.account } : {}),
                 });
-                console.log(`Logged in. Credentials saved to ${credentialsDisplayPath()}`);
+                console.log(`Logged in${payload.account ? ` as ${payload.account}` : ''}. ` +
+                    `Credentials saved to ${credentialsDisplayPath()}`);
             }
             finally {
                 close();
@@ -404,6 +433,20 @@ export function registerLogin(program) {
             process.exitCode = 1;
         }
     });
+    program
+        .command('whoami')
+        .description(isRunCloud
+        ? 'Show which run.cloud account this machine is signed in as'
+        : 'Show which Newly account this machine is signed in as')
+        .action(() => {
+        const creds = loadCredentials();
+        if (!creds) {
+            console.error(`Not logged in. Run \`${loginCommandName()}\`.`);
+            process.exitCode = 1;
+            return;
+        }
+        console.log(whoamiReport(creds));
+    });
     program
         .command('logout')
         .description(isRunCloud

package/dist/config.js

@@ -1,6 +1,15 @@
 import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { basename, join } from 'node:path';
+const MAX_ACCOUNT_LENGTH = 320;
+export function sanitizeAccount(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    const trimmed = value.trim();
+    if (trimmed.length === 0 || trimmed.length > MAX_ACCOUNT_LENGTH)
+        return undefined;
+    return trimmed;
+}
 export function isRunCloud() {
     const names = [process.argv[1], process.execPath].map((path) => basename(path ?? ''));
     return names.some((name) => name === 'runcloud' || name === 'run-cloud' || name === 'run-cloud.js');

package/dist/deviceLogin.js

@@ -1,4 +1,4 @@
-import { normalizeApiUrl } from "./config.js";
+import { normalizeApiUrl, sanitizeAccount } from "./config.js";
 export async function runDeviceLogin(deps) {
     const fetchFn = deps.fetchFn ?? fetch;
     const log = deps.log ?? ((m) => console.log(m));
@@ -32,7 +32,13 @@ export async function runDeviceLogin(deps) {
         });
         if (res.ok) {
             const body = (await res.json());
-            return { token: body.token, apiUrl: body.apiUrl, expiresIn: body.expiresIn };
+            const account = sanitizeAccount(body.account);
+            return {
+                token: body.token,
+                apiUrl: body.apiUrl,
+                expiresIn: body.expiresIn,
+                ...(account ? { account } : {}),
+            };
         }
         const { error } = (await res.json().catch(() => ({ error: "unknown" })));
         if (error === "authorization_pending")

package/dist/version.js

@@ -1 +1 @@
-export const CLI_VERSION = '0.1.91';
+export const CLI_VERSION = '0.1.93';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newly/cli",
-  "version": "0.1.91",
+  "version": "0.1.93",
   "description": "Develop, provision, and deploy Newly backends from your terminal",
   "license": "UNLICENSED",
   "type": "module",