@rosthq/cli 0.7.157 → 0.7.159
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/acting-principal.d.ts +1 -1
- package/dist/acting-principal.d.ts.map +1 -1
- package/dist/commands/auth-device-status.d.ts +13 -0
- package/dist/commands/auth-device-status.d.ts.map +1 -0
- package/dist/commands/implementation-access.d.ts.map +1 -1
- package/dist/commands/onboarding-preflight.d.ts +1 -1
- package/dist/device-auth.d.ts +5 -1
- package/dist/device-auth.d.ts.map +1 -1
- package/dist/device-exchange-store.d.ts +49 -0
- package/dist/device-exchange-store.d.ts.map +1 -0
- package/dist/generated/command-discovery.d.ts.map +1 -1
- package/dist/generated/command-manifest.d.ts.map +1 -1
- package/dist/implementation-bootstrap.d.ts +42 -1
- package/dist/implementation-bootstrap.d.ts.map +1 -1
- package/dist/implementation-credential-store.d.ts.map +1 -1
- package/dist/index.d.ts +2 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1961 -1033
- package/dist/index.js.map +4 -4
- package/dist/signup.d.ts +33 -9
- package/dist/signup.d.ts.map +1 -1
- package/dist/skill-trust.d.ts +1 -1
- package/dist/token-store.d.ts +19 -0
- package/dist/token-store.d.ts.map +1 -1
- package/package.json +1 -1
package/dist/signup.d.ts
CHANGED
|
@@ -3,6 +3,39 @@ type CliIo = {
|
|
|
3
3
|
stdout: Pick<NodeJS.WriteStream, "write">;
|
|
4
4
|
stderr: Pick<NodeJS.WriteStream, "write">;
|
|
5
5
|
};
|
|
6
|
+
/**
|
|
7
|
+
* What one `user.tenants` round trip tells the CLI after a login.
|
|
8
|
+
*
|
|
9
|
+
* `resolved: false` means the read failed or came back in an unexpected shape —
|
|
10
|
+
* deliberately distinct from "this account has no active workspace", so a caller
|
|
11
|
+
* renders an unproven answer as unproven instead of as a confident "none".
|
|
12
|
+
*/
|
|
13
|
+
export type SignupBootstrapState = {
|
|
14
|
+
resolved: boolean;
|
|
15
|
+
hasActiveTenant: boolean;
|
|
16
|
+
/** Display name of the ACTIVE workspace the server marked `current`. */
|
|
17
|
+
activeTenantName: string | null;
|
|
18
|
+
};
|
|
19
|
+
/**
|
|
20
|
+
* Read the post-login bootstrap state in ONE round trip.
|
|
21
|
+
*
|
|
22
|
+
* Pairs with {@link printSignupBootstrapGuidance}: reading and printing are
|
|
23
|
+
* separate so a caller can put the identity line BETWEEN them. That split is why
|
|
24
|
+
* DER-2793 D6's login identity line gets the workspace name from exactly this
|
|
25
|
+
* call — adding a second `user.tenants` request would double the login round
|
|
26
|
+
* trips for a fact already on the wire.
|
|
27
|
+
*
|
|
28
|
+
* Best-effort by design — a transient failure must never break login (the user
|
|
29
|
+
* can re-run any command), so every failure resolves to `resolved: false`.
|
|
30
|
+
*/
|
|
31
|
+
export declare function readSignupBootstrapState(client: CommandClient): Promise<SignupBootstrapState>;
|
|
32
|
+
/**
|
|
33
|
+
* Print the "authenticated but no active tenant" next steps for an already-read
|
|
34
|
+
* {@link SignupBootstrapState}. Silent when the account is set up, and silent
|
|
35
|
+
* when the read did not resolve — guessing "you have no company" off a failed
|
|
36
|
+
* read would be a confident wrong answer.
|
|
37
|
+
*/
|
|
38
|
+
export declare function printSignupBootstrapGuidance(io: CliIo, appUrl: string, state: SignupBootstrapState): void;
|
|
6
39
|
export declare function signupUrl(appUrl: string): string;
|
|
7
40
|
/**
|
|
8
41
|
* Parse the optional `--company "<name>"` flag for `rost signup`. Returns
|
|
@@ -34,14 +67,5 @@ export declare function runTenantCreate(io: CliIo, client: CommandClient, args:
|
|
|
34
67
|
* is injectable so tests never spawn a real browser.
|
|
35
68
|
*/
|
|
36
69
|
export declare function runSignup(io: CliIo, appUrl: string, openBrowser?: (url: string) => Promise<boolean>): Promise<number>;
|
|
37
|
-
/**
|
|
38
|
-
* After a successful login, detect "authenticated but no active tenant" and
|
|
39
|
-
* print clear, redaction-safe next steps. Resumable by design: a later command
|
|
40
|
-
* re-fetches tenant state and proceeds once the account is provisioned.
|
|
41
|
-
*
|
|
42
|
-
* Best-effort only — a transient failure to read tenants must never break the
|
|
43
|
-
* login flow, so failures are swallowed (the user can re-run any command).
|
|
44
|
-
*/
|
|
45
|
-
export declare function maybePrintSignupBootstrap(io: CliIo, client: CommandClient, appUrl: string): Promise<void>;
|
|
46
70
|
export {};
|
|
47
71
|
//# sourceMappingURL=signup.d.ts.map
|
package/dist/signup.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"signup.d.ts","sourceRoot":"","sources":["../src/signup.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;
|
|
1
|
+
{"version":3,"file":"signup.d.ts","sourceRoot":"","sources":["../src/signup.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAoBF;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,OAAO,CAAC;IAClB,eAAe,EAAE,OAAO,CAAC;IACzB,wEAAwE;IACxE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC,CAAC;AAQF;;;;;;;;;;;GAWG;AACH,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAqBnG;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,EAAE,EAAE,KAAK,EACT,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,oBAAoB,GAC1B,IAAI,CASN;AAED,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG;IAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAWhG;AAED,KAAK,aAAa,GAAG,CACnB,EAAE,EAAE,KAAK,EACT,MAAM,EAAE,aAAa,EACrB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,OAAO,KACV,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC;AAiBrD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,KAAK,EACT,MAAM,EAAE,aAAa,EACrB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,aAAa,EAClB,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/B,OAAO,CAAC,MAAM,CAAC,CAwBjB;AAED,wBAAsB,eAAe,CACnC,EAAE,EAAE,KAAK,EACT,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,MAAM,CAAC,CA6BjB;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,EAAE,EAAE,KAAK,EACT,MAAM,EAAE,MAAM,EACd,WAAW,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAkB,GAC9D,OAAO,CAAC,MAAM,CAAC,CAMjB"}
|
package/dist/skill-trust.d.ts
CHANGED
|
@@ -28,8 +28,8 @@ export declare const skillManifestSchema: z.ZodObject<{
|
|
|
28
28
|
maxCli: z.ZodNullable<z.ZodString>;
|
|
29
29
|
}, z.core.$strict>;
|
|
30
30
|
supportedClients: z.ZodArray<z.ZodEnum<{
|
|
31
|
-
codex: "codex";
|
|
32
31
|
"claude-code": "claude-code";
|
|
32
|
+
codex: "codex";
|
|
33
33
|
cursor: "cursor";
|
|
34
34
|
}>>;
|
|
35
35
|
doctrine: z.ZodObject<{
|
package/dist/token-store.d.ts
CHANGED
|
@@ -47,6 +47,25 @@ export declare const KEYCHAIN_WRITE_TIMEOUT_MS = 10000;
|
|
|
47
47
|
* blocking, and (invariant #5) the secret never appears on this path either
|
|
48
48
|
* way, since `clear()` takes no secret and only classifies structural fields. */
|
|
49
49
|
export declare const KEYCHAIN_CLEAR_TIMEOUT_MS = 10000;
|
|
50
|
+
/** gh-style bound on a keychain read — `security find-generic-password -w`
|
|
51
|
+
* (DER-3276/DER-3281) — never wait longer than this before treating the
|
|
52
|
+
* keychain as unusable. A locked keychain, an ACL "Always Allow" prompt with
|
|
53
|
+
* no attended user, or a wedged `securityd` blocks this call on an
|
|
54
|
+
* authorization prompt that can never be answered; unlike a write or a
|
|
55
|
+
* best-effort clear, this read (and the identically-shaped capability probe
|
|
56
|
+
* that selects the keychain vs. file backend before every read/write) sits
|
|
57
|
+
* on paths a human or a script is actively waiting on: the device-exchange
|
|
58
|
+
* persist that follows `login --device`'s mint print (device-auth.ts —
|
|
59
|
+
* DER-3276 moved that print ahead of the persist, but the persist itself,
|
|
60
|
+
* and entering the poll loop behind it, are still gated on this bound; a
|
|
61
|
+
* later `auth device status` reprint on another terminal still reads before
|
|
62
|
+
* it prints anything at all), the CLI-session `store.write()` that runs
|
|
63
|
+
* immediately after approval (index.ts:751), and the session `store.read()`
|
|
64
|
+
* gating every other CLI command's dispatch (index.ts:767). Same value as
|
|
65
|
+
* KEYCHAIN_CLEAR_TIMEOUT_MS for the same reason: generous enough for a
|
|
66
|
+
* legitimate slow read (GUI unlock prompt) to complete, short enough that a
|
|
67
|
+
* wedged keychain never blocks a login or an ordinary command. */
|
|
68
|
+
export declare const KEYCHAIN_READ_TIMEOUT_MS = 10000;
|
|
50
69
|
/**
|
|
51
70
|
* Escapes `value` for embedding inside a double-quoted argument on a
|
|
52
71
|
* `security -i` command line: backslash first (a bare trailing backslash
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,QAAA,MAAM,aAAa;;;;kBAIR,CAAC;AAEZ,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEvD,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACnC,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,QAAQ,IAAI,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,KAAK,eAAe,GAAG;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAChF,MAAM,MAAM,QAAQ,GAAG,CACrB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE,eAAe,KACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEjD,eAAO,MAAM,WAAW,EAAE,QAqBtB,CAAC;AAKL;;;2EAG2E;AAC3E,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD;;;;;;;;;iFASiF;AACjF,eAAO,MAAM,yBAAyB,QAAS,CAAC;
|
|
1
|
+
{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,QAAA,MAAM,aAAa;;;;kBAIR,CAAC;AAEZ,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEvD,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACnC,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,QAAQ,IAAI,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,KAAK,eAAe,GAAG;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAChF,MAAM,MAAM,QAAQ,GAAG,CACrB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE,eAAe,KACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEjD,eAAO,MAAM,WAAW,EAAE,QAqBtB,CAAC;AAKL;;;2EAG2E;AAC3E,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD;;;;;;;;;iFASiF;AACjF,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD;;;;;;;;;;;;;;;;;kEAiBkE;AAClE,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAc/C;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oCAAoC,CAClD,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,MAAM,GAAG,IAAI,CAYf;AAED;;;;mCAImC;AACnC,qBAAa,6BAA8B,SAAQ,KAAK;gBAC1C,OAAO,EAAE,MAAM;CAI5B;AAoBD;;;;;;GAMG;AACH,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,QAAQ,EACb,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,MAAkC,GAC5C,OAAO,CAAC,IAAI,CAAC,CAcf;AAED,qBAAa,kBAAmB,YAAW,UAAU;IACvC,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ;gBAAb,GAAG,GAAE,QAAsB;IAEpD,IAAI,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAiBlC,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAUzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAe5B,QAAQ,IAAI,MAAM;CAGnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,gBAAiB,SAAQ,kBAAkB;IAcpD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAdzB,OAAO,CAAC,OAAO,CAAoC;IACnD,OAAO,CAAC,iBAAiB,CAA2D;IAOpF,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,SAAS,CAA+B;gBAG9C,GAAG,GAAE,QAAsB,EACV,QAAQ,CAAC,EAAE,MAAM,YAAA,EACjB,MAAM,GAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAkB;IAK9D,IAAI,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAelC,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAoDzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAS5B,QAAQ,IAAI,MAAM;IAoB3B,OAAO,CAAC,IAAI;YAIE,uBAAuB;YAiBvB,sBAAsB;IASpC,OAAO,CAAC,2BAA2B;IAQnC,OAAO,CAAC,uBAAuB;YAWjB,aAAa;CA0B5B;AAED;;;;;;;;;GASG;AACH,qBAAa,2BAA4B,YAAW,UAAU;IAChD,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,GAAE,QAAsB;IAElD,IAAI,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAalC,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IASzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ5B,QAAQ,IAAI,MAAM;CAGnB;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,YAAW,UAAU;IAC5C,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,GAAE,QAAsB;IAElD,IAAI,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAalC,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IASzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ5B,QAAQ,IAAI,MAAM;CAGnB;AAED,qBAAa,cAAe,YAAW,UAAU;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,SAAqB;IAEpD,IAAI,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAelC,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAOzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B,QAAQ,IAAI,MAAM;YAIJ,cAAc;CAI7B;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC5C,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,uBAA4B,GAAG,UAAU,CA0ClF;AAUD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAK/D;AA+BD,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAEhE;AAoCD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAmBzD;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAWxD;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAKzD"}
|