@raster-app/cli 0.3.0 → 0.3.2

package/README.md

@@ -16,13 +16,13 @@ npx -p @raster-app/cli raster whoami
 
 ## Authenticate
 
-There are two ways to sign in: an interactive OAuth login tied to your user account, or an organization API key for CI.
+**OAuth is the default** — an interactive login tied to your user account. For CI and automation, use an organization API key instead.
 
 ```sh
 raster auth login
 ```
 
-With no `--api-key`, `raster auth login` signs you in over OAuth. When a browser is available (an interactive session with a display) it opens a **browser authorization-code flow** with a local loopback redirect; otherwise — over SSH or on a headless machine — it falls back to the **device authorization grant**, printing a short code and a URL you approve in a browser on any device. Pass `--browser` or `--device` to force either.
+`raster auth login` signs you in over OAuth (no API key needed). When a browser is available — an interactive session with a display — it opens a **browser authorization-code flow** with a local loopback redirect; otherwise, over SSH or on a headless machine, it falls back to the **device authorization grant**, printing a short code and a URL you approve in a browser on any device. Pass `--browser` or `--device` to force either.
 
 OAuth tokens (access + refresh) are stored in `~/.config/raster/config.json` with owner-only permissions. The CLI refreshes the access token automatically before it expires and rotates the refresh token; when the saved login can no longer be refreshed, it asks you to run `raster auth login` again.
 
@@ -32,7 +32,7 @@ For CI and scripts, use an organization API key instead (create one in Raster un
 raster auth login --api-key pk_…
 ```
 
-Or set `RASTER_API_KEY`. The bearer credential resolves from the `--api-key` flag, then a stored OAuth token, then `RASTER_API_KEY`, then a stored config API key. `raster auth status` shows which credential is active. `raster auth logout` revokes an OAuth token and removes stored credentials.
+Or set `RASTER_API_KEY`. The bearer credential resolves from the `--api-key` flag, then `RASTER_API_KEY`, then a stored OAuth token, then a stored config API key. `raster auth status` shows which credential is active. `raster auth logout` revokes an OAuth token and removes stored credentials.
 
 ## Org and library are derived from the key
 
@@ -135,7 +135,7 @@ Human-readable tables print to stdout; progress and notes go to stderr, so stdou
 
 | Variable | Purpose |
 | --- | --- |
-| `RASTER_API_KEY` | API key (sits below a stored OAuth token, above a config-file key) |
+| `RASTER_API_KEY` | API key (overrides a stored OAuth token; sits below `--api-key`, above a config-file key) |
 | `RASTER_ORG` | Default organization id for an OAuth login when `--org` is omitted |
 | `RASTER_CONFIG_HOME` | Config directory override (default `~/.config/raster`) |
 | `RASTER_AUTH_ISSUER` | OAuth authorization-server issuer (default `https://raster.app`; a `raster.app` host or localhost only) |

package/dist/index.js

@@ -16337,7 +16337,7 @@ config(en_default());
 // package.json
 var package_default = {
   name: "@raster-app/cli",
-  version: "0.3.0",
+  version: "0.3.2",
   description: "Command-line client for the Raster API",
   license: "Apache-2.0",
   type: "module",
@@ -17410,16 +17410,26 @@ async function ensureFreshOAuthSession(options) {
 function resolveCredential(options) {
   if (options.flagKey)
     return { kind: "apiKey", key: options.flagKey, source: "flag" };
-  if (options.config.oauth)
-    return { kind: "oauth", tokens: options.config.oauth };
   if (options.env.RASTER_API_KEY)
     return { kind: "apiKey", key: options.env.RASTER_API_KEY, source: "env" };
+  if (options.config.oauth)
+    return { kind: "oauth", tokens: options.config.oauth };
   if (options.config.apiKey)
     return { kind: "apiKey", key: options.config.apiKey, source: "config" };
   return null;
 }
 
 // src/lib/output.ts
+var ANSI = { reset: "\x1B[0m", bold: "\x1B[1m", dim: "\x1B[2m", cyan: "\x1B[36m" };
+function paint(text, code, enabled) {
+  return enabled ? `${code}${text}${ANSI.reset}` : text;
+}
+function bold(text, enabled) {
+  return paint(text, ANSI.bold, enabled);
+}
+function dim(text, enabled) {
+  return paint(text, ANSI.dim, enabled);
+}
 function printJson(output, payload) {
   output.stdout(`${JSON.stringify(payload, null, 2)}
 `);
@@ -17544,6 +17554,7 @@ async function createCommandContext(globals, overrides = {}) {
   const output = {
     json: globals.json === true,
     verbose: globals.verbose === true,
+    color: overrides.stderr === undefined && process.stderr.isTTY === true && env.NO_COLOR === undefined,
     stdout: overrides.stdout ?? ((text) => void process.stdout.write(text)),
     stderr: overrides.stderr ?? ((text) => void process.stderr.write(text))
   };
@@ -17920,7 +17931,7 @@ async function removeAssetsCommand(context, assetIds, options) {
     printJson(context, result);
     return;
   }
-  note(context, `Moved ${assetIds.length} asset(s) to trash. They are recoverable from the library trash.`);
+  note(context, `Moved ${assetIds.length} asset(s) to trash.`);
 }
 var describeOptionsSchema = exports_external.object({
   text: exports_external.string().min(1)
@@ -18001,14 +18012,14 @@ async function startLoopbackServer() {
     const code = url2.searchParams.get("code");
     const state = url2.searchParams.get("state");
     if (code && state) {
-      response.writeHead(200, { "Content-Type": "text/html" }).end(SUCCESS_PAGE);
+      response.writeHead(200, { "Content-Type": "text/html", Connection: "close" }).end(SUCCESS_PAGE);
       if (!settled) {
         settled = true;
         resolveCallback({ code, state });
       }
       return;
     }
-    response.writeHead(400, { "Content-Type": "text/html" }).end(FAILURE_PAGE);
+    response.writeHead(400, { "Content-Type": "text/html", Connection: "close" }).end(FAILURE_PAGE);
     if (!settled) {
       settled = true;
       const error51 = url2.searchParams.get("error");
@@ -18027,6 +18038,7 @@ async function startLoopbackServer() {
     waitForCallback: () => callbackPromise,
     close: () => {
       server.close();
+      server.closeAllConnections?.();
     }
   };
 }
@@ -18088,6 +18100,7 @@ async function runBrowserLogin(options) {
       challenge: pkce.challenge,
       state
     });
+    options.onAuthorizeUrl?.(authorizeUrl);
     await options.openBrowser(authorizeUrl);
     const callback = await withDeadline(server.waitForCallback(), options.loginTimeoutMs ?? DEFAULT_LOGIN_TIMEOUT_MS);
     if (callback.state !== state) {
@@ -18220,7 +18233,8 @@ async function runOAuthLogin(method, deps) {
       clientId,
       fetch: deps.fetch,
       openBrowser: deps.openBrowser,
-      now: deps.now
+      now: deps.now,
+      onAuthorizeUrl: deps.onAuthorizeUrl
     });
   }
   const device = await requestDeviceCode({ metadata, clientId, fetch: deps.fetch });
@@ -18276,13 +18290,6 @@ async function loginCommand(context, options = {}) {
     await apiKeyLogin(context, context.apiKey.key);
     return;
   }
-  if (!options.device && !options.browser && context.isInteractive) {
-    const promptedKey = await context.promptSecret("Paste your Raster API key (or press Enter to use OAuth)");
-    if (promptedKey) {
-      await apiKeyLogin(context, promptedKey);
-      return;
-    }
-  }
   if (context.env.RASTER_API_KEY && !context.isInteractive && !options.device && !options.browser) {
     await apiKeyLogin(context, context.env.RASTER_API_KEY);
     return;
@@ -18304,7 +18311,7 @@ async function apiKeyLogin(context, key) {
     return;
   }
   const organizationLabel = viewer?.organizationName ?? viewer?.organizationId ?? "your organization";
-  note(context, `Logged in to ${organizationLabel} as ${maskApiKey(key)}. Key stored in ${configPath(context.env)}.`);
+  note(context, `Logged in to ${organizationLabel}.`);
 }
 function chooseLoginMethod(context, options) {
   if (options.device && options.browser) {
@@ -18330,11 +18337,17 @@ async function oauthLogin(context, options) {
     now: context.now,
     openBrowser: context.openBrowser,
     onDevicePrompt: (prompt) => {
-      note(context, `To sign in, visit ${prompt.verificationUri} and enter the code: ${prompt.userCode}`);
-      if (prompt.verificationUriComplete) {
-        note(context, `Or open this link directly: ${prompt.verificationUriComplete}`);
-      }
-      note(context, "Waiting for you to finish signing in…");
+      const target = prompt.verificationUriComplete ? bold(prompt.verificationUriComplete, context.color) : `${bold(prompt.verificationUri, context.color)} and enter code ${bold(prompt.userCode, context.color)}`;
+      note(context, "");
+      note(context, `Visit ${target}`);
+      note(context, "");
+      note(context, dim("Waiting for authentication…", context.color));
+    },
+    onAuthorizeUrl: (url2) => {
+      note(context, "");
+      note(context, `Visit ${bold(url2, context.color)}`);
+      note(context, "");
+      note(context, dim("Waiting for authentication…", context.color));
     }
   });
   await writeOAuthTokens(tokens, context.env);
@@ -18342,7 +18355,7 @@ async function oauthLogin(context, options) {
     printJson(context, { issuer: tokens.issuer, scope: tokens.scope, resource: tokens.resource });
     return;
   }
-  note(context, `Logged in via OAuth (${tokens.scope} scope). Tokens stored in ${configPath(context.env)}. ` + "Pass --org <id> or set RASTER_ORG to choose an organization; run `raster whoami` to list them.");
+  note(context, "Logged in.");
 }
 async function logoutCommand(context) {
   const config2 = await readConfig(context.env);
@@ -18358,7 +18371,7 @@ async function logoutCommand(context) {
   delete cleared.apiKey;
   delete cleared.oauth;
   await writeConfig(cleared, context.env);
-  note(context, "Logged out. Stored credentials removed.");
+  note(context, "Logged out.");
 }
 async function statusCommand(context) {
   if (!context.credential) {
@@ -18366,7 +18379,7 @@ async function statusCommand(context) {
       printJson(context, { authenticated: false });
       return;
     }
-    note(context, "Not authenticated. Run `raster auth login` or set RASTER_API_KEY.");
+    note(context, "Not authenticated. Run `raster auth login`.");
     return;
   }
   if (context.credential.kind === "oauth") {
@@ -18381,8 +18394,8 @@ function statusForOAuth(context, tokens) {
     printJson(context, { authenticated: true, kind: "oauth", issuer: tokens.issuer, scope: tokens.scope, fresh });
     return;
   }
-  note(context, `OAuth login on ${tokens.issuer} (${tokens.scope} scope).`);
-  note(context, fresh ? "Access token is fresh." : "Access token will be refreshed on the next request.");
+  note(context, `OAuth login on ${tokens.issuer}, ${tokens.scope} scope.`);
+  note(context, fresh ? "Token fresh." : "Token refreshes on next use.");
 }
 async function statusForApiKey(context, key, source) {
   let viewer = null;
@@ -18396,7 +18409,7 @@ async function statusForApiKey(context, key, source) {
     printJson(context, { authenticated: true, kind: "apiKey", source, keyPrefix: maskApiKey(key), organization: viewer ?? null });
     return;
   }
-  note(context, `API key ${maskApiKey(key)} (from ${source}).`);
+  note(context, `API key ${maskApiKey(key)}, from ${source}.`);
   if (viewer) {
     note(context, `Organization: ${viewer.organizationName ?? viewer.organizationId ?? "unknown"} · plan: ${viewer.plan ?? "unknown"}`);
     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@raster-app/cli",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Command-line client for the Raster API",
   "license": "Apache-2.0",
   "type": "module",