@purveyors/cli 0.31.0 → 0.32.1

package/README.md

@@ -69,7 +69,7 @@ purvey auth login
 # For agents, CI, or remote machines, use headless flow:
 # purvey auth login --headless
 
-# If automatic browser callback handling fails or you paste a bad URL, paste the full callback URL back into the terminal. The CLI keeps waiting until a valid callback is received.
+# Headless login prints an approval URL. Approve it in any browser; the CLI completes automatically.
 
 # 2. Confirm the stored API key and role
 purvey auth status
@@ -158,12 +158,12 @@ Headless login for agents, CI, and remote machines:
 
 ```bash
 purvey auth login --headless
-# CLI prints a Google OAuth URL
-# Open it in any browser and sign in
-# Paste the full callback URL back into the terminal
+# CLI prints a purveyors.io approval URL
+# Open it in any browser, sign in, and approve access
+# The CLI completes automatically
 ```
 
-If the browser cannot return to the CLI during interactive login, paste the full callback URL back into the terminal. Invalid pasted URLs are ignored, and the CLI keeps waiting until a valid callback is received. Use `purvey auth login --headless` when you need the CLI to print the OAuth URL for another browser.
+Both modes use Parchment's short-lived device authorization flow. The CLI keeps its PKCE verifier in memory, receives a scoped Parchment API key after browser approval, and never runs a localhost callback server or asks you to paste a callback URL. If browser launch fails, the interactive command prints the approval URL and keeps waiting.
 
 Status:
 
@@ -293,8 +293,8 @@ purvey auth logout
 
 Notes:
 
-- `auth login` uses browser-based Google OAuth, listens for the localhost callback, and also accepts a pasted callback URL if the browser cannot return to the CLI. Invalid pasted callback URLs are ignored so you can paste again while the CLI keeps waiting.
-- `auth login --headless` prints an OAuth URL and accepts a pasted callback URL.
+- `auth login` opens a short-lived purveyors.io approval request and completes automatically after approval. If browser launch fails, it prints the same URL and keeps polling.
+- `auth login --headless` prints the approval URL without trying to open a local browser. Approve it from any browser; nothing is pasted back.
 - `auth status --json` is the safest mode for scripts.
 - `auth status --csv` is supported for spreadsheet-style checks, but JSON remains the better integration format.
 
@@ -883,7 +883,6 @@ Use the right ID for the right command.
 
 ## Environment variables
 
-- `PURVEYORS_SUPABASE_URL`: override the Supabase Auth issuer used only for OAuth bootstrap
 - `PURVEYORS_BASE_URL`: override the Purveyors web base URL
 - `PURVEYORS_API_KEY`: explicit API-key override for canonical Parchment commands
 - `PARCHMENT_API_KEY`: preferred API-key variable for SDK-backed Parchment commands; also accepted for API-backed proof and paid-tier similarity paths
@@ -906,7 +905,7 @@ Why this CLI works well for agents:
 
 - stable command names
 - structured stdout by default
-- browser auth with pasted-callback fallback and headless auth
+- browser approval with automatic polling and a first-class headless mode
 - documented exit codes and role boundaries
 - dedicated machine-readable manifest command
 - dedicated dense human-readable reference command
@@ -920,7 +919,7 @@ Agent integration rules of thumb:
 
 - Discover first with `purvey manifest`, then call the narrowest command or package subpath that fits the job.
 - Use `purvey context` when a human-readable operator summary is useful before tool selection.
-- Use `purvey auth login` for normal user workflows. OAuth is used only to bootstrap a machine-scoped Parchment API key; the CLI does not retain Supabase session or refresh tokens. Environment `PURVEYORS_API_KEY` or `PARCHMENT_API_KEY` values remain available for explicit automation overrides.
+- Use `purvey auth login` for normal user workflows. Parchment coordinates browser approval and returns a machine-scoped API key; the CLI stores no web session, request token, or PKCE verifier. Environment `PURVEYORS_API_KEY` or `PARCHMENT_API_KEY` values remain available for explicit automation overrides.
 - Treat `--include-proof` as API output, not a local scoring feature. If a filter cannot round-trip through `/v1/catalog?include=proof`, the CLI rejects that invocation instead of returning misleading proof data.
 - Treat `catalog similar` as the canonical `/v1/catalog/{id}/similar` contract. Preserve the distinction between `canonical_candidates` and `similar_recommendations`; do not flatten or re-sort grouped results unless you have a specific downstream reason.
 - Treat `market`, `price-index`, and `procurement` as SDK-backed canonical API reads. Do not add procurement create/write behavior to this command group until the Phase 2 write contract ships.

package/dist/commands/auth.d.ts

@@ -1,27 +1,31 @@
 import { Command } from 'commander';
-import type { StoredCredentials } from '../types/index.js';
 import { type ParchmentClient } from '@purveyors/sdk';
-interface CallbackResult {
-    accessToken: string;
-    refreshToken: string;
-    expiresIn: number;
-}
-interface ManualCallbackReader {
-    promise: Promise<CallbackResult>;
-    close: () => void;
+import type { StoredCredentials } from '../types/index.js';
+type CliAuthClient = Pick<ParchmentClient, 'cliAuth'>;
+interface DeviceLoginOptions {
+    headless: boolean;
+    client?: CliAuthClient;
+    machineName?: string;
+    openBrowser?: (url: string) => Promise<boolean>;
+    sleep?: (milliseconds: number, signal?: AbortSignal) => Promise<void>;
+    signal?: AbortSignal;
+    exchangeCancellationTimeoutMs?: number;
+    onExchangeCancellationWait?: () => void;
 }
-type ManualCallbackQuestion = (query: string, callback: (answer: string) => void) => void;
-export declare function createOAuthUrl(redirectTo: string): string;
-export declare function exchangeOAuthSessionForApiKey(accessToken: string, clientOverride?: ParchmentClient): Promise<StoredCredentials>;
-/**
- * Extract Supabase OAuth tokens from a full callback URL, URL fragment, or
- * query string. Exported for auth-flow contract tests.
- */
-export declare function parseOAuthCallbackUrl(callbackUrl: string, expectedState?: string): CallbackResult;
-export declare function createManualCallbackReaderForQuestion(question: ManualCallbackQuestion, closeQuestion: () => void, canRead: boolean, expectedState?: string): ManualCallbackReader | null;
+/** Generate an RFC 7636 verifier and its S256 challenge. */
+export declare function createPkcePair(): {
+    verifier: string;
+    challenge: string;
+};
+/** Normalize hostnames to Parchment's stable, human-readable machine-name contract. */
+export declare function normalizeMachineName(value: string): string;
+/** Open the verification page, returning false when no browser command is available. */
+export declare function openVerificationPage(url: string): Promise<boolean>;
 /**
- * Build and return the `auth` command subtree.
+ * Run the Parchment-owned browser/device authorization protocol.
+ * The verifier and signed request token remain memory-only and are discarded on exit.
  */
+export declare function performDeviceLogin(options: DeviceLoginOptions): Promise<StoredCredentials>;
 export declare function buildAuthCommand(): Command;
 export {};
 //# sourceMappingURL=auth.d.ts.map

package/dist/commands/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC,OAAO,KAAK,EAAiB,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAI1E,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAwB7E,UAAU,cAAc;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AASD,UAAU,oBAAoB;IAC5B,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACjC,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAED,KAAK,sBAAsB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,KAAK,IAAI,CAAC;AAE1F,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAKzD;AAiBD,wBAAsB,6BAA6B,CACjD,WAAW,EAAE,MAAM,EACnB,cAAc,CAAC,EAAE,eAAe,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CAwC5B;AAsHD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,cAAc,CA2CjG;AAED,wBAAgB,qCAAqC,CACnD,QAAQ,EAAE,sBAAsB,EAChC,aAAa,EAAE,MAAM,IAAI,EACzB,OAAO,EAAE,OAAO,EAChB,aAAa,CAAC,EAAE,MAAM,GACrB,oBAAoB,GAAG,IAAI,CAwC7B;AAsLD;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAmF1C"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAQ7E,OAAO,KAAK,EAAiB,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAK1E,KAAK,aAAa,GAAG,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;AAEtD,UAAU,kBAAkB;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC,0BAA0B,CAAC,EAAE,MAAM,IAAI,CAAC;CACzC;AAWD,4DAA4D;AAC5D,wBAAgB,cAAc,IAAI;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAIxE;AAUD,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAS1D;AAuFD,wFAAwF;AACxF,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiBxE;AAeD;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAiGhG;AAiFD,wBAAgB,gBAAgB,IAAI,OAAO,CA0E1C"}