@shoplifter/cli 0.1.0 → 0.1.1

package/README.md

@@ -1,7 +1,7 @@
 # Shoplifter CLI
 
-Requires Node 24. Install with `npm install --global @shoplifter/cli@0.1.0`.
-The public SDK, contract and CLI release versions match.
+Requires Node 24. Install with `npm install --global @shoplifter/cli@0.1.1`.
+It continues using SDK and contract `0.1.0`; CLI patches do not upgrade runtime inputs.
 
 ## Authoring
 
@@ -38,14 +38,22 @@ Set `SHOPLIFTER_API_URL=https://<platform-api-host>` before production operation
 runtime, verifies hashes and explicitly updates local archives and the lockfile.
 It preserves authored files. Run `npm ci --ignore-scripts` after synchronization.
 
-`shoplifter login` opens dashboard approval for a specific channel. One-hour credentials
+`shoplifter login combo-media` opens dashboard approval for that channel code.
+With `shoplifter login` alone, explicitly choose a channel on the approval page.
+Only channels accessible to your dashboard account can be selected; publishing must
+be enabled for the channel. Switching channels clears the reviewed request.
+One-hour credentials
 are stored with private permissions outside the project. Use `shoplifter logout` to revoke.
-`shoplifter publication upload <channel-id>` uploads source; `stage`, `preview`,
+`shoplifter publication upload <channel-code>` uploads source; `stage`, `preview`,
 `build`, `activate`, `publish`, `status`, `logs`, `retry`, `retry-deployment` and
 `rollback` operate on channel-scoped revisions. `preview-link` requests protected
 preview access. Source changes require exact-input preview and explicit activation.
 Downloading the SDK never grants publication permission. The loopback bypass is
 development-only and cannot be used remotely or in production.
+Older credentials resolve their channel code through the authenticated session API.
+Set `SHOPLIFTER_NO_BROWSER=1` to copy the approval link without opening a browser.
+Deploy the matching backend/dashboard changes before releasing CLI `0.1.1`;
+this patch requires the authenticated session endpoint and code-based operations.
 
 Shoplifter-owned code is Apache-2.0; separately installed dependencies retain their
 licenses. See `LICENSE`, `NOTICE` and `THIRD_PARTY_NOTICES`. This does not license

package/dist/auth.d.ts

@@ -2,8 +2,10 @@ export declare function apiOrigin(): URL;
 export declare function credentials(required?: boolean): Promise<{
     token: string;
     channelId: string;
+    channelCode?: string;
     expiresAt: string;
 } | undefined>;
-export declare function login(): Promise<void>;
+export declare function sessionChannel(token: string): Promise<string>;
+export declare function login(channelCode?: string): Promise<void>;
 export declare function logout(): Promise<void>;
 export declare function syncDependencies(): Promise<void>;

package/dist/auth.js

@@ -33,15 +33,25 @@ export async function credentials(required = true) {
 }
 async function response(value) { if (!value.ok)
     throw new Error(`CLI request failed (${value.status})`); return value.json(); }
-export async function login() {
+export async function sessionChannel(token) {
+    const result = await response(await fetch(new URL('/shoplifter-cli/session', apiOrigin()), { headers: { authorization: 'Bearer ' + token }, signal: AbortSignal.timeout(15000) }));
+    if (typeof result.channelCode !== 'string' || !result.channelCode.trim())
+        throw new Error('Invalid CLI channel response');
+    return result.channelCode;
+}
+export async function login(channelCode) {
+    if (channelCode !== undefined && (!channelCode.trim() || channelCode !== channelCode.trim() || channelCode.length > 255))
+        throw new Error('A channel code is required');
     const origin = apiOrigin();
     const grant = await response(await fetch(new URL('/shoplifter-cli/device', origin), { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ scopes: ['read', 'content', 'source'] }), signal: AbortSignal.timeout(15000) }));
     const url = new URL(grant.verificationUri);
     if (url.origin !== origin.origin || !/^[A-F0-9]{10}$/.test(grant.userCode))
         throw new Error('Invalid CLI approval response');
     url.searchParams.set('code', grant.userCode);
+    if (channelCode)
+        url.searchParams.set('channel', channelCode);
     console.log(`Approve code ${grant.userCode} in your dashboard: ${url}`);
-    if (['darwin', 'linux'].includes(process.platform)) {
+    if (process.env.SHOPLIFTER_NO_BROWSER !== '1' && ['darwin', 'linux'].includes(process.platform)) {
         const child = spawn(process.platform === 'darwin' ? 'open' : 'xdg-open', [url.href], { stdio: 'ignore', detached: true });
         child.on('error', () => undefined);
         child.unref();
@@ -57,12 +67,17 @@ export async function login() {
             || !Number.isFinite(Date.parse(result.expiresAt)) || Date.parse(result.expiresAt) <= Date.now()
             || Date.parse(result.expiresAt) > Date.now() + 3600000)
             throw new Error('Invalid CLI credential response');
+        const approvedCode = await sessionChannel(result.token);
+        if (channelCode && approvedCode !== channelCode) {
+            await response(await fetch(new URL('/shoplifter-cli/logout', origin), { method: 'POST', headers: { authorization: 'Bearer ' + result.token }, signal: AbortSignal.timeout(15000) }));
+            throw new Error('A different channel was approved; run shoplifter login with the intended channel code');
+        }
         await mkdir(directory(), { recursive: true, mode: 0o700 });
         await chmod(directory(), 0o700);
         const temporary = filename() + '.' + randomUUID();
-        await writeFile(temporary, JSON.stringify({ token: result.token, channelId: result.channelId, expiresAt: result.expiresAt }), { mode: 0o600, flag: 'wx' });
+        await writeFile(temporary, JSON.stringify({ token: result.token, channelId: result.channelId, channelCode: approvedCode, expiresAt: result.expiresAt }), { mode: 0o600, flag: 'wx' });
         await rename(temporary, filename());
-        console.log(`Authorized channel ${result.channelId} until ${result.expiresAt}`);
+        console.log(`Authorized channel ${approvedCode} until ${result.expiresAt}`);
         return;
     }
     throw new Error('CLI approval timed out');

package/dist/index.js

@@ -17,9 +17,19 @@ import { initialize, editProject, scaffold } from './author.js';
 import { generate, validateImages } from './files.js';
 import { publication, previewUpload } from './publication.js';
 import { login, logout, syncDependencies } from './auth.js';
+// commander-ts exits on async command failures without reporting the error.
+async function reportFailure(work) {
+    try {
+        await work();
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        throw error;
+    }
+}
 let Shoplifter = class Shoplifter {
     async files() { await previewUpload(); }
-    async login() { await login(); }
+    async login(channelCode) { await reportFailure(() => login(channelCode)); }
     async logout() { await logout(); }
     async dependencies(action) { if (action !== 'sync')
         throw new Error('Choose dependencies sync'); await syncDependencies(); }
@@ -59,7 +69,7 @@ let Shoplifter = class Shoplifter {
             throw new Error(`Astro exited with status ${code}`);
     }
     async publication(action, channel, revision, language) {
-        await publication(action, channel, revision, language);
+        await reportFailure(() => publication(action, channel, revision, language));
     }
 };
 __decorate([
@@ -70,8 +80,9 @@ __decorate([
 ], Shoplifter.prototype, "files", null);
 __decorate([
     command(),
+    __param(0, optionalArg('channel-code')),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", []),
+    __metadata("design:paramtypes", [String]),
     __metadata("design:returntype", Promise)
 ], Shoplifter.prototype, "login", null);
 __decorate([
@@ -196,7 +207,7 @@ __decorate([
 ], Shoplifter.prototype, "publication", null);
 Shoplifter = __decorate([
     program(),
-    version('0.1.0'),
+    version('0.1.1'),
     description('Author and publish independent Shoplifter presentations')
 ], Shoplifter);
 if (Number(process.versions.node.split('.')[0]) !== 24)

package/dist/publication.js

@@ -1,4 +1,4 @@
-import { apiOrigin, credentials } from './auth.js';
+import { apiOrigin, credentials, sessionChannel } from './auth.js';
 import { readProject } from './files.js';
 import { collectUploadFiles } from './upload-files.js';
 export async function previewUpload(directory = process.cwd()) {
@@ -11,13 +11,15 @@ export async function publication(action, channel, revision, languageCode) {
     if (!['upload', 'stage', 'preview', 'preview-link', 'build', 'publish', 'status', 'logs', 'retry', 'retry-deployment', 'activate', 'rollback'].includes(action))
         throw new Error('Unknown publication operation');
     const base = apiOrigin(), session = await credentials(false);
-    if (session && session.channelId !== channel)
-        throw new Error('CLI session belongs to another channel; run shoplifter login');
+    const channelCode = session ? await sessionChannel(session.token) : channel;
+    if (session && channel !== channelCode && channel !== session.channelId)
+        throw new Error('CLI session belongs to another channel; run shoplifter login with the intended channel code');
     if (!session && !['localhost', '127.0.0.1', '[::1]'].includes(base.hostname))
         throw new Error('Run shoplifter login before publishing remotely');
     if (!['http:', 'https:'].includes(base.protocol) || base.username || base.password)
         throw new Error('Invalid API origin');
-    const body = { channelId: channel, revisionId: revision, ...(languageCode ? { languageCode } : {}) };
+    const selector = !session && /^\d+$/.test(channel) ? { channelId: channel } : { channelCode };
+    const body = { ...selector, revisionId: revision, ...(languageCode ? { languageCode } : {}) };
     if (action === 'upload') {
         body.project = await readProject();
         body.files = (await collectUploadFiles(process.cwd(), body.project)).map(file => ({ path: file.path, bytes: file.bytes.toString('base64') }));
@@ -30,7 +32,7 @@ export async function publication(action, channel, revision, languageCode) {
     const response = await fetch(new URL(session ? '/shoplifter-cli/operation' : '/shoplifter-development/' + operation, base), {
         method: 'POST',
         headers: { 'content-type': 'application/json', ...(session ? { authorization: 'Bearer ' + session.token } : {}) },
-        body: JSON.stringify(session ? { channelId: channel, languageCode, action: operation, input: body } : body),
+        body: JSON.stringify(session ? { channelCode, languageCode, action: operation, input: body } : body),
         signal: AbortSignal.timeout(120000),
     });
     const result = await response.text();

package/dist/release-manifest.json

@@ -7,11 +7,11 @@
     },
     {
       "path": "auth.d.ts",
-      "sha256": "796dd7dad86e0c8865d78e10cdad471948121fa5d838f9f7f88c162d8e3f6734"
+      "sha256": "ff98d7cbeca5a9fc2985acf804d18fcfe18e54cdac63a4484367b3e1638d349a"
     },
     {
       "path": "auth.js",
-      "sha256": "0f91582d678556c8d16f9f6be10993d5a47989914c06358c20ed25c213d90f6a"
+      "sha256": "282c5df5cc768f33e2f96052fb21758f74ca3875bc5c9c582c439a490ceed15e"
     },
     {
       "path": "author.d.ts",
@@ -35,7 +35,7 @@
     },
     {
       "path": "index.js",
-      "sha256": "69c7e98bf5dbcd110c84e975ae90837cd05d8364fbdbdb13bc8ca97f492ee867"
+      "sha256": "4b85f13c321650f3a35e9cdee6df2eb8608d815750886b99a5850b224441e3c4"
     },
     {
       "path": "publication.d.ts",
@@ -43,7 +43,7 @@
     },
     {
       "path": "publication.js",
-      "sha256": "cfba2d5a39d1e1c3f713493f4fd58b886adc26573ee3691a660b23d827ca9d98"
+      "sha256": "c9d689a9cc90d61207c4f48c1489fafeda8d1016d7ec0e5a12fb885ddb4abac4"
     },
     {
       "path": "runtime.d.ts",
@@ -51,7 +51,7 @@
     },
     {
       "path": "runtime.js",
-      "sha256": "134ba8b055ace5ee9ca375915a24848ba1cf677685da051462b6319cc1d637f7"
+      "sha256": "f278ffc0d417812adbba6ac0dd742b0c5a3fc91c5089c310c9914dbb8a98f1d2"
     },
     {
       "path": "upload-files.d.ts",

package/dist/runtime.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
-import { readFile } from 'node:fs/promises';
 import { createHash } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
 const maximumArchive = 12 * 1024 * 1024;
 async function bytes(response, maximum) {
     if (!response.ok || !response.body)
@@ -33,7 +33,10 @@ export async function downloadRuntime(origin) {
                 throw new Error('Invalid platform runtime archive');
         return runtime;
     }
-    const { version } = JSON.parse(await readFile(new URL('../package.json', import.meta.url), 'utf8'));
+    // CLI-only patches do not require new platform runtime releases.
+    const { shoplifterRuntimeVersion: version } = JSON.parse(await readFile(new URL('../package.json', import.meta.url), 'utf8'));
+    if (!/^\d+\.\d+\.\d+$/.test(version ?? ''))
+        throw new Error('Invalid platform runtime version');
     const archive = async (kind) => {
         const name = '@shoplifter/presentation-' + kind;
         const metadata = JSON.parse((await bytes(await get(`https://registry.npmjs.org/${encodeURIComponent(name)}/${version}`), 512 * 1024)).toString());

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@shoplifter/cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
+  "shoplifterRuntimeVersion": "0.1.0",
   "private": false,
   "license": "Apache-2.0",
   "description": "Author, validate and publish independent Shoplifter Astro presentations",