@sequenceholdings/studio-cli 0.1.13 → 0.1.21

package/dist/atlas-client.js

@@ -4,6 +4,7 @@
  * consistent across both Sequence CLIs. Token + baseUrl are passed in by
  * the caller — this file knows nothing about token files or config TOMLs.
  */
+import { authenticatedRequestUrl } from '@sequenceholdings/artifact-studio/deployment-validation';
 import { PREVIEW_DOMAIN } from './preview.js';
 const MAX_503_RETRIES = 5;
 const DEFAULT_RETRY_AFTER_SECONDS = 2;
@@ -34,6 +35,18 @@ async function fetchWith503Retry(input, init) {
         await new Promise((resolve) => setTimeout(resolve, retryAfter * 1000));
     }
 }
+async function authenticatedFetch({ baseUrl, init = {}, path, token, }) {
+    const url = authenticatedRequestUrl({ baseUrl, path });
+    return fetchWith503Retry(url, {
+        ...init,
+        redirect: 'manual',
+        headers: {
+            ...previewAccessHeaders(baseUrl),
+            ...init.headers,
+            Authorization: `Bearer ${token}`,
+        },
+    });
+}
 function previewAccessHeaders(baseUrl) {
     const secret = process.env.PREVIEW_ACCESS_HEADER?.trim();
     if (!secret)
@@ -89,17 +102,13 @@ async function responseError(response, path) {
     return new AtlasApiError(response.status, message, path, response.statusText, body);
 }
 export async function getJson({ baseUrl, token, path, }) {
-    const response = await fetchWith503Retry(`${baseUrl}${path}`, {
-        headers: { ...previewAccessHeaders(baseUrl), Authorization: `Bearer ${token}` },
-    });
+    const response = await authenticatedFetch({ baseUrl, token, path });
     if (!response.ok)
         throw await responseError(response, path);
     return response.json();
 }
 export async function getJsonOr404({ baseUrl, token, path, }) {
-    const response = await fetchWith503Retry(`${baseUrl}${path}`, {
-        headers: { ...previewAccessHeaders(baseUrl), Authorization: `Bearer ${token}` },
-    });
+    const response = await authenticatedFetch({ baseUrl, token, path });
     if (response.status === 404)
         return null;
     if (!response.ok)
@@ -107,56 +116,60 @@ export async function getJsonOr404({ baseUrl, token, path, }) {
     return response.json();
 }
 export async function postJson({ baseUrl, token, path, body, }) {
-    const response = await fetchWith503Retry(`${baseUrl}${path}`, {
-        method: 'POST',
-        headers: {
-            ...previewAccessHeaders(baseUrl),
-            Authorization: `Bearer ${token}`,
-            'Content-Type': 'application/json',
+    const response = await authenticatedFetch({
+        baseUrl,
+        token,
+        path,
+        init: {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: body === undefined ? undefined : JSON.stringify(body),
         },
-        body: body === undefined ? undefined : JSON.stringify(body),
     });
     if (!response.ok)
         throw await responseError(response, path);
     return response.json();
 }
 export async function putJson({ baseUrl, token, path, body, }) {
-    const response = await fetchWith503Retry(`${baseUrl}${path}`, {
-        method: 'PUT',
-        headers: {
-            ...previewAccessHeaders(baseUrl),
-            Authorization: `Bearer ${token}`,
-            'Content-Type': 'application/json',
+    const response = await authenticatedFetch({
+        baseUrl,
+        token,
+        path,
+        init: {
+            method: 'PUT',
+            headers: { 'Content-Type': 'application/json' },
+            body: body === undefined ? undefined : JSON.stringify(body),
         },
-        body: body === undefined ? undefined : JSON.stringify(body),
     });
     if (!response.ok)
         throw await responseError(response, path);
     return response.json();
 }
 export async function patchJson({ baseUrl, token, path, body, }) {
-    const response = await fetchWith503Retry(`${baseUrl}${path}`, {
-        method: 'PATCH',
-        headers: {
-            ...previewAccessHeaders(baseUrl),
-            Authorization: `Bearer ${token}`,
-            'Content-Type': 'application/json',
+    const response = await authenticatedFetch({
+        baseUrl,
+        token,
+        path,
+        init: {
+            method: 'PATCH',
+            headers: { 'Content-Type': 'application/json' },
+            body: body === undefined ? undefined : JSON.stringify(body),
         },
-        body: body === undefined ? undefined : JSON.stringify(body),
     });
     if (!response.ok)
         throw await responseError(response, path);
     return response.json();
 }
 export async function deleteJson({ baseUrl, token, path, body, }) {
-    const response = await fetchWith503Retry(`${baseUrl}${path}`, {
-        method: 'DELETE',
-        headers: {
-            ...previewAccessHeaders(baseUrl),
-            Authorization: `Bearer ${token}`,
-            'Content-Type': 'application/json',
+    const response = await authenticatedFetch({
+        baseUrl,
+        token,
+        path,
+        init: {
+            method: 'DELETE',
+            headers: { 'Content-Type': 'application/json' },
+            body: body === undefined ? undefined : JSON.stringify(body),
         },
-        body: body === undefined ? undefined : JSON.stringify(body),
     });
     if (!response.ok)
         throw await responseError(response, path);
@@ -164,9 +177,11 @@ export async function deleteJson({ baseUrl, token, path, body, }) {
 }
 /** DELETE for endpoints that return 204 with an empty body (deleteJson would choke on it). */
 export async function deleteNoContent({ baseUrl, token, path, }) {
-    const response = await fetchWith503Retry(`${baseUrl}${path}`, {
-        method: 'DELETE',
-        headers: { ...previewAccessHeaders(baseUrl), Authorization: `Bearer ${token}` },
+    const response = await authenticatedFetch({
+        baseUrl,
+        token,
+        path,
+        init: { method: 'DELETE' },
     });
     if (!response.ok)
         throw await responseError(response, path);

package/dist/auth-cmds/commands.d.ts

@@ -1,7 +1,7 @@
 import type { ParsedArgs } from '../process/commands.js';
 declare const PAT_SCOPES: readonly ["repo:read", "repo:write", "repo:admin"];
 type PatScope = (typeof PAT_SCOPES)[number];
-export declare const AUTH_USAGE = "usage:\n  seq-studio auth pat create --name <n> [--scopes repo:read,repo:write] [-e env]\n                             [--expires 7d|30d|90d|1y|never] [--store-credentials]\n  seq-studio auth pat list [-e env]\n  seq-studio auth pat revoke <id> [-e env] [--yes]\n\n  Issue a personal access token for git clone / git push against the platform\n  git service.\n\n  Authenticate with `seq-studio login`, then run `auth pat create`.\n  Alternatively, open Atlas \u2192 Settings \u2192 Tokens:\n    https://<atlas-host>/settings/tokens\n  Sign in, create a token (repo:read / repo:write), copy once, then:\n    export ATLAS_GIT_PAT=<token>\n\n  On create the raw token is printed ONCE \u2014 store it; Atlas cannot re-show it.\n  Git Basic auth: any username (e.g. git), PAT as the password.\n\n  Flags: -e/--env <env>  (see: seq-studio envs list)\n";
+export declare const AUTH_USAGE = "usage:\n  seq-studio auth pat create --name <n> -e <env> [--scopes repo:read,repo:write]\n                             [--expires 7d|30d|90d|1y|never] [--store-credentials]\n  seq-studio auth pat list -e <env>\n  seq-studio auth pat revoke <id> -e <env> [--yes]\n\n  Issue a personal access token for git clone / git push against the platform\n  git service.\n\n  Authenticate with `seq-studio login`, then run `auth pat create -e <env>`.\n  Alternatively, open Atlas \u2192 Settings \u2192 Tokens:\n    https://<atlas-host>/settings/tokens\n  Sign in, create a token (repo:read / repo:write), copy once, then:\n    export ATLAS_GIT_PAT=<token>\n\n  On create the raw token is printed ONCE \u2014 store it; Atlas cannot re-show it.\n  Git Basic auth: any username (e.g. git), PAT as the password.\n\n  Flags: -e/--env <env> (required; see: seq-studio envs list)\n";
 export declare function parsePatScopes(raw: string | undefined): PatScope[];
 /**
  * Map UI-style duration choices to an absolute ISO-8601 expiresAt, or undefined

package/dist/auth-cmds/commands.js

@@ -10,6 +10,7 @@
  */
 import { deleteNoContent, getJson, postJson } from '../atlas-client.js';
 import { printCliError } from '../cli-errors.js';
+import { REQUIRE_EXPLICIT_ENV_MESSAGE } from '../env-flags.js';
 import { buildContext, clientOptions, flagBool, LOG, } from '../functions/commands.js';
 import { readConfig } from '../config.js';
 import { confirmYes } from '../prompt.js';
@@ -38,15 +39,15 @@ function stringFlag(flags, key) {
     return value;
 }
 export const AUTH_USAGE = `usage:
-  seq-studio auth pat create --name <n> [--scopes repo:read,repo:write] [-e env]
+  seq-studio auth pat create --name <n> -e <env> [--scopes repo:read,repo:write]
                              [--expires 7d|30d|90d|1y|never] [--store-credentials]
-  seq-studio auth pat list [-e env]
-  seq-studio auth pat revoke <id> [-e env] [--yes]
+  seq-studio auth pat list -e <env>
+  seq-studio auth pat revoke <id> -e <env> [--yes]
 
   Issue a personal access token for git clone / git push against the platform
   git service.
 
-  Authenticate with \`seq-studio login\`, then run \`auth pat create\`.
+  Authenticate with \`seq-studio login\`, then run \`auth pat create -e <env>\`.
   Alternatively, open Atlas → Settings → Tokens:
     https://<atlas-host>/settings/tokens
   Sign in, create a token (repo:read / repo:write), copy once, then:
@@ -55,7 +56,7 @@ export const AUTH_USAGE = `usage:
   On create the raw token is printed ONCE — store it; Atlas cannot re-show it.
   Git Basic auth: any username (e.g. git), PAT as the password.
 
-  Flags: -e/--env <env>  (see: seq-studio envs list)
+  Flags: -e/--env <env> (required; see: seq-studio envs list)
 `;
 async function authContext(args) {
     if (args.flags.env === true || args.flags.e === true) {
@@ -66,6 +67,10 @@ async function authContext(args) {
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
+        // Missing `-e` is actionable on its own — don't bury it under login/PAT
+        // setup advice (that wrap is for real auth/token failures).
+        if (message === REQUIRE_EXPLICIT_ENV_MESSAGE)
+            throw err;
         // buildContext failed before we know the env URL; offer CLI login and
         // render the tokens-page URLs from the environments visible to this
         // identity (third-party / OpCo developers only see their own hosts).
@@ -119,7 +124,7 @@ export function resolveExpiresAt(choice) {
 export async function authPatCreateCommand(args) {
     const name = stringFlag(args.flags, 'name');
     if (!name) {
-        console.error('usage: seq-studio auth pat create --name <n> [--scopes ...] [-e env]');
+        console.error('usage: seq-studio auth pat create --name <n> -e <env> [--scopes ...]');
         return 1;
     }
     if (name.length < 3) {
@@ -193,7 +198,7 @@ export async function authPatListCommand(args) {
 export async function authPatRevokeCommand(args) {
     const id = args.positional[0];
     if (!id) {
-        console.error('usage: seq-studio auth pat revoke <id> [-e env] [--yes]');
+        console.error('usage: seq-studio auth pat revoke <id> -e <env> [--yes]');
         return 1;
     }
     const ctx = await authContext(args);

package/dist/auth.d.ts

@@ -5,27 +5,66 @@
  *
  * Two token sources, in the SAME precedence order as seqapi's
  * `get_access_token` (`shared/seqapi/seqapi/auth.py`):
- *   1. M2M service account — Auth0 client-credentials grant, used when
- *      `AUTH0_M2M_CLIENT_SECRET` is set. This is the headless path: CI /
- *      cloud agents with no interactive login can still push.
+ *   1. Cached user access token — read from the seqapi token file. When it
+ *      expires, an interactive session performs a bounded PKCE login again.
+ *   2. M2M service account — Auth0 client-credentials grant when the realm's
+ *      `AUTH0_M2M_CLIENT_SECRET` (or suffixed OpCo variant) is set. Used when
+ *      no valid user session exists, or when `SEQAPI_AUTH_MODE=m2m` forces it.
  *      (M2M carries app scopes but NO user identity / workspace membership
  *      — see the `atlas-test-access` rule.)
- *   2. Cached user token — read from the seqapi token file and refreshed
- *      via the Auth0 refresh-token grant when near expiry.
  *
- * Login and refresh both write the shared file. This mirrors
- * `seqapi._save_tokens` exactly:
+ * Login writes the shared file. This mirrors `seqapi._save_tokens` exactly:
  * same fields, same shape, same 0o600 permissions, atomic write via
- * tmpfile + rename. The M2M token is in-memory only (never persisted).
+ * tmpfile + rename. M2M tokens are cached in-process and also under the
+ * token file's `m2m` key so short-lived CLI processes reuse a grant.
  */
 export declare const AUTH0_DOMAIN = "dev-n1t8ts403fp8oyxp.us.auth0.com";
 export declare const AUTH0_CLIENT_ID = "GD9riCDWocfc66odpWBjwBiX43qqAX8r";
 export declare const AUTH0_AUDIENCE = "https://api.studio.com";
+/** The realm name the built-in Sequence environments' tokens live under —
+ * also the implicit realm of the legacy flat fields in tokens.json. */
+export declare const SEQUENCE_REALM = "sequence";
+export declare function isSequenceAuthEnvName(envName: string): boolean;
+/**
+ * One Auth0 login context. Mirrors seqapi's `AuthRealm`
+ * (`shared/seqapi/seqapi/config.py`): the Sequence realm is hard-coded;
+ * OpCo-environment realms are read from seqapi's config.json registry,
+ * written by `seq-studio envs add` or `seqapi env add` — both CLIs share one
+ * registry and one token file, so either can log in and the other picks the
+ * session up.
+ */
+export interface AuthRealm {
+    name: string;
+    domain: string;
+    clientId: string;
+    audience: string;
+    organization?: string;
+    m2mClientId?: string;
+}
+/**
+ * A discovery response is not a trust anchor for the host that receives an
+ * M2M client secret. Even another valid *.auth0.com tenant is untrusted;
+ * additional Auth0 tenants/custom domains require an explicit code-reviewed
+ * allowlist entry.
+ */
+export declare function validateAuth0Domain(domain: string): string;
+export declare const SEQUENCE_AUTH_REALM: AuthRealm;
 export interface SeqapiTokens {
-    refresh_token?: string;
     access_token?: string;
     expires_at?: number;
 }
+/**
+ * Resolve the auth realm for an environment name. Undefined, built-ins, and
+ * per-PR preview targets map to the shared Sequence realm. Preview URLs are
+ * constrained to Sequence's preview domain by the environment resolver. Every
+ * other explicit name must have a valid seqapi registry entry; otherwise fail
+ * closed so a shared Sequence bearer token can never be sent to a tenant URL.
+ */
+export declare function realmForEnv(envName?: string): Promise<AuthRealm>;
+/** Env var(s) carrying a realm's M2M client secret — the Sequence realm keeps
+ * the legacy bare name; OpCo realms use a suffixed name so one shell can hold
+ * several credentials unambiguously. Mirrors seqapi's `_m2m_secret_env_names`. */
+export declare function m2mSecretEnvName(realm: AuthRealm): string;
 /**
  * A configured M2M credential failed to mint a token. Typed so callers that
  * normally swallow discovery errors (lazy catalog refresh) can still surface
@@ -38,38 +77,79 @@ export declare function seqapiTokenDir(): string;
 export declare function seqapiTokenPath(): string;
 export declare class NotLoggedInError extends Error {
     readonly name = "NotLoggedInError";
-    constructor();
+    constructor(realmName?: string, reason?: string);
 }
 /**
- * Return a valid access token. Tries the M2M service account first when
- * `AUTH0_M2M_CLIENT_SECRET` is set, then falls back to the cached user
- * token (refreshed via the Auth0 refresh-token grant when within 60s of
- * expiry). Same precedence as seqapi's `get_access_token`, so both CLIs
- * resolve the same identity for the same environment.
+ * Return a valid access token for an environment's auth realm.
+ *
+ * Precedence (default `SEQAPI_AUTH_MODE=auto`), matching seqapi:
+ *   1. Valid cached user access token
+ *   2. M2M client-credentials when the realm's secret env var is set
+ *   3. Bounded PKCE login when browser auto-login is enabled
+ *
+ * Set `SEQAPI_AUTH_MODE=m2m` to skip the user token. No `env` (or a built-in
+ * Sequence env) means the shared Sequence realm.
  */
-export declare function getAccessToken(): Promise<string>;
+export declare class UnsafeAuthTargetError extends Error {
+}
+export type AuthMode = 'm2m' | 'user';
+export interface ResolvedAccessToken {
+    authMode: AuthMode;
+    token: string;
+}
+export declare function getAccessTokenWithMode(options?: {
+    /** Disable browser PKCE fallback for probe-only and other non-interactive callers. */
+    allowInteractiveLogin?: boolean;
+    env?: string;
+    targetUrl?: string;
+}): Promise<ResolvedAccessToken>;
+export declare function getAccessToken(options?: {
+    /** Disable browser PKCE fallback for probe-only and other non-interactive callers. */
+    allowInteractiveLogin?: boolean;
+    env?: string;
+    targetUrl?: string;
+}): Promise<string>;
 /**
  * Try to load a token without throwing. Returns `null` for any error
  * condition (missing file, parse error, no token fields). Used by
  * `doctor` for non-fatal "are you logged in?" checks.
  */
-export declare function tryGetAccessToken(options?: {
+export declare function tryGetAccessTokenWithMode(options?: {
     /**
      * When the M2M secret is configured, failing to mint an M2M token should fail
      * closed (avoid silently falling back to some other cached identity).
      */
     failClosedForM2m?: boolean;
+    /** Environment name — selects the auth realm (default: Sequence). */
+    env?: string;
+    /** Resolved request origin — checked against the realm before returning credentials. */
+    targetUrl?: string;
+}): Promise<ResolvedAccessToken | null>;
+export declare function tryGetAccessToken(options?: {
+    failClosedForM2m?: boolean;
+    env?: string;
+    targetUrl?: string;
 }): Promise<string | null>;
 /**
- * Decode the `sub` claim from a JWT without verification. Verification is the
- * server's job — this is only used to compare identities locally (e.g. to
- * bind the cached environment catalog to the identity that fetched it).
+ * Refuse to persist a token minted for another audience or Auth0
+ * organization. Auth0/server-side JWT verification remains authoritative;
+ * this local decode is only a cross-realm confusion check on a token received
+ * directly from the configured Auth0 tenant over TLS.
  */
+export declare function verifyTokenMatchesRealm({ accessToken, realm, requireOrganization, }: {
+    accessToken: string;
+    realm: AuthRealm;
+    requireOrganization?: boolean;
+}): void;
 export declare function decodeJwtSub(token: string): string | null;
 /**
  * The Auth0 subject the CLI would authenticate as right now, without any
- * network call: the fixed M2M client subject when the secret is configured,
- * else the `sub` of the cached user token, else null (anonymous).
+ * network call. Matches token resolution precedence: a valid user session
+ * wins over an ambient M2M secret unless `SEQAPI_AUTH_MODE=m2m`.
  */
-export declare function currentIdentitySubject(): Promise<string | null>;
-export declare function saveTokens(tokens: SeqapiTokens): Promise<void>;
+export declare function currentIdentitySubject(options?: {
+    env?: string;
+}): Promise<string | null>;
+export declare function loadCachedUserTokens(realmName?: string): Promise<SeqapiTokens | null>;
+export declare function saveTokens(tokens: SeqapiTokens, realmName?: string): Promise<void>;
+export declare function deleteRealmTokens(realmName: string): Promise<void>;