@tapestry-mud/cli 0.6.0 → 0.7.0

package/README.md

@@ -83,7 +83,11 @@ my-game/
 | `tapestry search [query]` | Search the registry by keyword |
 | `tapestry info [pack]` | Show pack metadata from the registry |
 | `tapestry register` | Create a registry account |
-| `tapestry login` | Authenticate with the registry |
+| `tapestry login` | Authenticate with the registry (interactive password login) |
+| `tapestry logout` | Revoke your session and remove `~/.tapestryrc` |
+| `tapestry trust add <scope> <repo>` | Authorize a GitHub repo to publish to a scope via OIDC |
+| `tapestry trust list` | List your trusted publishers |
+| `tapestry trust rm <id>` | Remove a trusted publisher binding |
 | `tapestry change-password` | Change your registry password |
 
 ### Pack Authoring
@@ -140,16 +144,23 @@ tapestry dist-tag set @yourscope/my-pack stable 0.1.0
 
 Players using `tapestry init` with a preset that references your pack will resolve to the tagged version.
 
-### CI Publishing
+### CI Publishing (GitHub Actions, OIDC)
 
-For automated pipelines, use token-based auth:
+`tapestry publish` auto-detects the GitHub Actions OIDC environment and exchanges a short-lived
+id-token for a registry access token — no stored secret, no `tapestry login` step. In your workflow:
+
+```yaml
+permissions:
+  id-token: write   # required for OIDC
+```
+
+Authorize the repo once (scope owner or admin):
 
 ```bash
-tapestry login --token $REGISTRY_CI_TOKEN
-tapestry publish
+tapestry trust add yourscope your-org/your-repo
 ```
 
-The CI token is a JWT issued by the registry bootstrap script. Store it as a secret in your CI environment.
+Then `tapestry publish` in CI just works. There is no `REGISTRY_CI_TOKEN` and no `--token` flag.
 
 ## Registry
 

package/bin/tapestry.js

@@ -11,6 +11,7 @@ const { update } = require('../src/commands/update');
 const { enable } = require('../src/commands/enable');
 const { disable } = require('../src/commands/disable');
 const { login } = require('../src/commands/login');
+const { logout } = require('../src/commands/logout');
 const { register } = require('../src/commands/register');
 const { validate } = require('../src/commands/validate');
 const { pack } = require('../src/commands/pack');
@@ -28,6 +29,7 @@ const { changePassword } = require('../src/commands/change-password');
 const { unpublish } = require('../src/commands/unpublish');
 const { distTagSet, distTagList } = require('../src/commands/dist-tag');
 const { presetSet, presetDelete } = require('../src/commands/preset');
+const { trustAdd, trustList, trustRm } = require('../src/commands/trust');
 
 const program = new Command();
 
@@ -53,12 +55,16 @@ program.configureHelp({
       },
       {
         title: 'Account',
-        commands: ['register', 'login', 'change-password'],
+        commands: ['register', 'login', 'logout', 'change-password'],
       },
       {
         title: 'Pack Authoring',
         commands: ['create', 'validate', 'pack', 'publish', 'unpublish'],
       },
+      {
+        title: 'Trusted Publishing',
+        commands: ['trust'],
+      },
       {
         title: 'Admin',
         commands: ['dist-tag', 'preset'],
@@ -243,11 +249,22 @@ program
 
 program
   .command('login')
-  .description('Authenticate with the registry and store token in ~/.tapestryrc')
-  .option('--token <token>', 'Save a raw token directly (for CI use, skips interactive login)')
-  .action(async (options) => {
+  .description('Authenticate with the registry (interactive password login)')
+  .action(async () => {
     try {
-      await login({}, { token: options.token });
+      await login();
+    } catch (e) {
+      console.error(`error: ${e.message}`);
+      process.exit(1);
+    }
+  });
+
+program
+  .command('logout')
+  .description('Revoke your session and remove ~/.tapestryrc')
+  .action(async () => {
+    try {
+      await logout();
     } catch (e) {
       console.error(`error: ${e.message}`);
       process.exit(1);
@@ -266,6 +283,47 @@ program
     }
   });
 
+const trustCmd = program.command('trust').description('Manage trusted publishers (OIDC CI publishing)');
+
+trustCmd
+  .command('add <scope> <repo>')
+  .description('Authorize a GitHub repo (owner/name) to publish to a scope via OIDC')
+  .option('--ref <ref>', 'Restrict to a git ref, e.g. refs/heads/master')
+  .option('--environment <env>', 'Restrict to a GitHub Actions environment')
+  .action(async (scope, repo, options) => {
+    try {
+      await trustAdd(scope, repo, { ref: options.ref, environment: options.environment });
+    } catch (e) {
+      console.error(`error: ${e.message}`);
+      process.exit(1);
+    }
+  });
+
+trustCmd
+  .command('list')
+  .description('List trusted publishers you own (all, if admin)')
+  .option('--scope <scope>', 'Filter by scope')
+  .action(async (options) => {
+    try {
+      await trustList(options.scope);
+    } catch (e) {
+      console.error(`error: ${e.message}`);
+      process.exit(1);
+    }
+  });
+
+trustCmd
+  .command('rm <id>')
+  .description('Remove a trusted publisher binding by id')
+  .action(async (id) => {
+    try {
+      await trustRm(id);
+    } catch (e) {
+      console.error(`error: ${e.message}`);
+      process.exit(1);
+    }
+  });
+
 program
   .command('validate')
   .description('Validate pack.yaml in the current directory')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tapestry-mud/cli",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "CLI for the Tapestry MUD engine",
   "repository": {
     "type": "git",

package/src/commands/change-password.js

@@ -1,12 +1,12 @@
 'use strict';
 
 const fetch = require('node-fetch');
-const { requireToken } = require('../lib/auth');
+const { requireAccess } = require('../lib/auth');
 const { DEFAULT_REGISTRY, throwIfError } = require('../lib/registry-client');
 const { createInterface, askPassword } = require('../util/prompt');
 
 async function changePassword({ registryUrl = DEFAULT_REGISTRY } = {}) {
-  const token = requireToken();
+  const token = await requireAccess();
   const rl = createInterface();
   try {
     const currentPassword = await askPassword(rl, 'Current password: ');

package/src/commands/dist-tag.js

@@ -1,10 +1,10 @@
 'use strict';
 
-const { requireToken } = require('../lib/auth');
+const { requireAccess } = require('../lib/auth');
 const { patchDistTag, listDistTags, DEFAULT_REGISTRY } = require('../lib/registry-client');
 
 async function distTagSet(packName, tag, version, { registryUrl = DEFAULT_REGISTRY } = {}) {
-  const token = requireToken();
+  const token = await requireAccess();
   await patchDistTag(packName, tag, version, token, registryUrl);
   console.log(`  ${packName}  ${tag} -> ${version}`);
   console.log('Done.');

package/src/commands/install.js

@@ -9,7 +9,7 @@ const { readLock, writeLock, hashDeps } = require('../lib/lock-file');
 const { fetchTarball, DEFAULT_REGISTRY } = require('../lib/registry-client');
 const { verifyIntegrity, saveTarball, extractTarball } = require('../lib/tarball');
 const { addPackageToBoot } = require('../lib/boot');
-const { loadToken } = require('../lib/auth');
+const { loadAccess } = require('../lib/auth');
 const { PACK_MANIFEST } = require('../lib/manifest');
 const { readLinks } = require('../lib/links');
 
@@ -85,7 +85,7 @@ async function install(packageArg, { cwd = process.cwd(), registryUrl = DEFAULT_
     throw new Error('No tapestry.yaml found. Run `tapestry init` first.');
   }
 
-  const token = loadToken();
+  const token = await loadAccess();
   const manifest = readYaml(manifestPath);
   let resolved;
 

package/src/commands/link.js

@@ -10,7 +10,7 @@ const { addPackageToBoot, removePackageFromBoot } = require('../lib/boot');
 const { resolve } = require('../lib/semver-resolver');
 const { installResolved, packInstallPath } = require('./install');
 const { readLock, writeLock } = require('../lib/lock-file');
-const { loadToken } = require('../lib/auth');
+const { loadAccess } = require('../lib/auth');
 const { DEFAULT_REGISTRY } = require('../lib/registry-client');
 
 function requireProject(cwd) {
@@ -69,7 +69,7 @@ async function link(targetPath, { cwd = process.cwd(), noInstall = false, regist
 
   let toRollback = [];
   try {
-    const token = loadToken();
+    const token = await loadAccess();
     const resolved = await resolve(needsInstall, registryUrl, token);
 
     // New installs: not on disk yet. Upgrade targets: in needsInstall AND on disk

package/src/commands/login.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const fetch = require('node-fetch');
-const { saveToken } = require('../lib/auth');
+const { saveSession, decodeExp } = require('../lib/auth');
 const { DEFAULT_REGISTRY, throwIfError } = require('../lib/registry-client');
 const { createInterface, ask, askPassword } = require('../util/prompt');
 
@@ -16,12 +16,7 @@ async function promptCredentials() {
   }
 }
 
-async function login({ email, password } = {}, { registryUrl = DEFAULT_REGISTRY, token = null } = {}) {
-  if (token) {
-    saveToken(token);
-    console.log('Token saved.');
-    return;
-  }
+async function login({ email, password } = {}, { registryUrl = DEFAULT_REGISTRY } = {}) {
   if (!email || !password) {
     ({ email, password } = await promptCredentials());
   }
@@ -34,8 +29,8 @@ async function login({ email, password } = {}, { registryUrl = DEFAULT_REGISTRY,
 
   await throwIfError(res, 'Login failed');
 
-  const { token: authToken } = await res.json();
-  saveToken(authToken);
+  const { access_token, refresh_token } = await res.json();
+  saveSession({ registry: registryUrl, access: access_token, access_exp: decodeExp(access_token), refresh: refresh_token });
   console.log('Logged in.');
 }
 

package/src/commands/logout.js

@@ -0,0 +1,19 @@
+'use strict';
+
+const { readSession, clearSession, DEFAULT_REGISTRY } = require('../lib/auth');
+const { postLogout } = require('../lib/registry-client');
+
+async function logout() {
+  const s = readSession();
+  if (s && s.refresh) {
+    try {
+      await postLogout(s.refresh, s.registry || DEFAULT_REGISTRY);
+    } catch {
+      // Best-effort server revoke; always clear the local session below.
+    }
+  }
+  clearSession();
+  console.log('Logged out.');
+}
+
+module.exports = { logout };

package/src/commands/preset.js

@@ -1,17 +1,17 @@
 'use strict';
 
-const { requireToken } = require('../lib/auth');
+const { requireAccess } = require('../lib/auth');
 const { patchPreset, deletePreset, DEFAULT_REGISTRY } = require('../lib/registry-client');
 
 async function presetSet(name, version, engineChannel, packs, { registryUrl = DEFAULT_REGISTRY } = {}) {
-  const token = requireToken();
+  const token = await requireAccess();
   await patchPreset(name, { version, engine_channel: engineChannel, packs }, token, registryUrl);
   console.log(`  Updated preset '${name}' to v${version}`);
   console.log('Done.');
 }
 
 async function presetDelete(name, { registryUrl = DEFAULT_REGISTRY } = {}) {
-  const token = requireToken();
+  const token = await requireAccess();
   await deletePreset(name, token, registryUrl);
   console.log(`  Deleted preset '${name}'`);
   console.log('Done.');

package/src/commands/publish.js

@@ -9,14 +9,25 @@ const { readYaml } = require('../util/yaml');
 const { validate } = require('./validate');
 const { buildTarball, computeIntegrity } = require('../lib/tarball-builder');
 const { PACK_MANIFEST } = require('../lib/manifest');
-const { requireToken } = require('../lib/auth');
-const { DEFAULT_REGISTRY, throwIfError } = require('../lib/registry-client');
+const { requireAccess } = require('../lib/auth');
+const { DEFAULT_REGISTRY, throwIfError, exchangeOIDCForAccess } = require('../lib/registry-client');
+const { detectCI, fetchGitHubIdToken, AUDIENCE } = require('../lib/oidc');
 
 async function publish({ cwd = process.cwd(), registryUrl = DEFAULT_REGISTRY } = {}) {
   validate({ cwd });
 
   const manifest = readYaml(path.join(cwd, PACK_MANIFEST));
-  const token = requireToken();
+
+  const scope = manifest.name.match(/^@([^/]+)\//)[1];
+  const ciMode = detectCI();
+  let token;
+  if (ciMode) {
+    console.log('Detected GitHub Actions OIDC environment — exchanging id-token...');
+    const idToken = await fetchGitHubIdToken(AUDIENCE);
+    token = await exchangeOIDCForAccess(scope, idToken, registryUrl);
+  } else {
+    token = await requireAccess();
+  }
 
   const shortName = manifest.name.split('/')[1];
   const tmpPath = path.join(
@@ -37,6 +48,10 @@ async function publish({ cwd = process.cwd(), registryUrl = DEFAULT_REGISTRY } =
     });
     form.append('metadata', JSON.stringify({ ...manifest, integrity }));
 
+    if (ciMode) {
+      form.append('tag', 'stable');
+    }
+
     const res = await fetch(`${registryUrl}/v1/publish`, {
       method: 'POST',
       headers: {

package/src/commands/register.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const fetch = require('node-fetch');
-const { saveToken } = require('../lib/auth');
+const { saveSession, decodeExp } = require('../lib/auth');
 const { DEFAULT_REGISTRY, throwIfError } = require('../lib/registry-client');
 const { createInterface, ask, askPassword } = require('../util/prompt');
 
@@ -30,8 +30,8 @@ async function register({ handle, email, password } = {}, { registryUrl = DEFAUL
 
   await throwIfError(res, 'Registration failed');
 
-  const { token } = await res.json();
-  saveToken(token);
+  const { access_token, refresh_token } = await res.json();
+  saveSession({ registry: registryUrl, access: access_token, access_exp: decodeExp(access_token), refresh: refresh_token });
   console.log(`Registered as ${handle}. Logged in.`);
 }
 

package/src/commands/trust.js

@@ -0,0 +1,42 @@
+'use strict';
+
+const { requireAccess, readSession, DEFAULT_REGISTRY } = require('../lib/auth');
+const {
+  createTrustedPublisher, listTrustedPublishers, deleteTrustedPublisher,
+} = require('../lib/registry-client');
+
+function registryUrl() {
+  const s = readSession();
+  return (s && s.registry) || DEFAULT_REGISTRY;
+}
+
+async function trustAdd(scope, repo, { ref, environment } = {}) {
+  const token = await requireAccess();
+  const body = { scope, repo };
+  if (ref) { body.ref = ref; }
+  if (environment) { body.environment = environment; }
+  const row = await createTrustedPublisher(body, token, registryUrl());
+  console.log(`Trusted publisher #${row.id}: @${row.scope} <- ${row.repo}`);
+}
+
+async function trustList(scope) {
+  const token = await requireAccess();
+  const rows = await listTrustedPublishers(scope, token, registryUrl());
+  if (!rows.length) {
+    console.log('No trusted publishers.');
+    return;
+  }
+  for (const r of rows) {
+    const extra = [r.ref ? `ref=${r.ref}` : null, r.environment ? `env=${r.environment}` : null]
+      .filter(Boolean).join(' ');
+    console.log(`#${r.id}  @${r.scope} <- ${r.repo}${extra ? `  (${extra})` : ''}`);
+  }
+}
+
+async function trustRm(id) {
+  const token = await requireAccess();
+  await deleteTrustedPublisher(id, token, registryUrl());
+  console.log(`Removed trusted publisher #${id}.`);
+}
+
+module.exports = { trustAdd, trustList, trustRm };

package/src/commands/unpublish.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const fetch = require('node-fetch');
-const { requireToken } = require('../lib/auth');
+const { requireAccess } = require('../lib/auth');
 const { DEFAULT_REGISTRY } = require('../lib/registry-client');
 const { createInterface, ask } = require('../util/prompt');
 
@@ -16,7 +16,7 @@ function parsePackageArg(arg) {
 }
 
 async function unpublish(packageArg, { force = false, registryUrl = DEFAULT_REGISTRY } = {}) {
-  const token = requireToken();
+  const token = await requireAccess();
   const { pkg, version } = parsePackageArg(packageArg);
 
   if (!/^@[a-z0-9-]+\/[a-z0-9-]+$/.test(pkg)) {

package/src/lib/auth.js

@@ -4,31 +4,81 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const yaml = require('js-yaml');
+const fetch = require('node-fetch');
 
 const RC_PATH = path.join(os.homedir(), '.tapestryrc');
+const DEFAULT_REGISTRY = process.env.TAPESTRY_REGISTRY || 'https://registry.tapestryengine.com';
+const REFRESH_SKEW_SECONDS = 60; // refresh slightly before actual expiry
 
-function loadToken() {
+function readSession() {
   if (!fs.existsSync(RC_PATH)) {
     return null;
   }
   try {
-    const data = yaml.load(fs.readFileSync(RC_PATH, 'utf8'));
-    return data?.token ?? null;
+    return yaml.load(fs.readFileSync(RC_PATH, 'utf8')) || null;
   } catch {
     return null;
   }
 }
 
-function saveToken(token) {
-  fs.writeFileSync(RC_PATH, yaml.dump({ token }, { lineWidth: -1 }), { mode: 0o600 });
+function saveSession({ registry, access, access_exp, refresh }) {
+  fs.writeFileSync(
+    RC_PATH,
+    yaml.dump({ registry, access, access_exp, refresh }, { lineWidth: -1 }),
+    { mode: 0o600 }
+  );
 }
 
-function requireToken() {
-  const token = loadToken();
-  if (!token) {
+function clearSession() {
+  if (fs.existsSync(RC_PATH)) {
+    fs.unlinkSync(RC_PATH);
+  }
+}
+
+function decodeExp(jwtString) {
+  try {
+    const payload = JSON.parse(Buffer.from(jwtString.split('.')[1], 'base64url').toString('utf8'));
+    return typeof payload.exp === 'number' ? payload.exp : null;
+  } catch {
+    return null;
+  }
+}
+
+async function loadAccess() {
+  const s = readSession();
+  if (!s || !s.access || !s.refresh) {
+    return null; // absent, or legacy token-only rc
+  }
+  const now = Math.floor(Date.now() / 1000);
+  if (typeof s.access_exp === 'number' && now < s.access_exp - REFRESH_SKEW_SECONDS) {
+    return s.access;
+  }
+  // Access expired (or near it): silently refresh.
+  const registry = s.registry || DEFAULT_REGISTRY;
+  const res = await fetch(`${registry}/v1/auth/refresh`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ refresh_token: s.refresh }),
+  });
+  if (!res.ok) {
+    clearSession();
+    return null;
+  }
+  const { access_token, refresh_token } = await res.json();
+  saveSession({ registry, access: access_token, access_exp: decodeExp(access_token), refresh: refresh_token });
+  return access_token;
+}
+
+async function requireAccess() {
+  const access = await loadAccess();
+  if (!access) {
     throw new Error('Not logged in. Run: tapestry login');
   }
-  return token;
+  return access;
 }
 
-module.exports = { RC_PATH, loadToken, saveToken, requireToken };
+module.exports = {
+  RC_PATH, DEFAULT_REGISTRY,
+  readSession, saveSession, clearSession, decodeExp,
+  loadAccess, requireAccess,
+};

package/src/lib/oidc.js

@@ -0,0 +1,26 @@
+'use strict';
+
+const fetch = require('node-fetch');
+
+const AUDIENCE = 'https://registry.tapestryengine.com';
+
+function detectCI() {
+  return !!(process.env.ACTIONS_ID_TOKEN_REQUEST_URL && process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN);
+}
+
+async function fetchGitHubIdToken(audience = AUDIENCE) {
+  const base = process.env.ACTIONS_ID_TOKEN_REQUEST_URL;
+  const reqToken = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+  const url = `${base}&audience=${encodeURIComponent(audience)}`;
+  const res = await fetch(url, { headers: { Authorization: `Bearer ${reqToken}` } });
+  if (!res.ok) {
+    throw new Error(`failed to fetch GitHub OIDC id-token (HTTP ${res.status})`);
+  }
+  const { value } = await res.json();
+  if (!value) {
+    throw new Error('GitHub OIDC response had no token value');
+  }
+  return value;
+}
+
+module.exports = { detectCI, fetchGitHubIdToken, AUDIENCE };

package/src/lib/registry-client.js

@@ -128,7 +128,59 @@ async function deletePreset(name, token, registryUrl = DEFAULT_REGISTRY) {
   return res.json();
 }
 
+async function postLogout(refreshToken, registryUrl = DEFAULT_REGISTRY) {
+  const res = await fetch(`${registryUrl.replace(/\/$/, '')}/v1/auth/logout`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ refresh_token: refreshToken }),
+  });
+  await throwIfError(res, 'Logout failed');
+  return res.json();
+}
+
+async function createTrustedPublisher(body, token, registryUrl = DEFAULT_REGISTRY) {
+  const res = await fetch(`${registryUrl.replace(/\/$/, '')}/v1/trusted-publishers`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
+    body: JSON.stringify(body),
+  });
+  await throwIfError(res, 'Failed to create trusted publisher');
+  return res.json();
+}
+
+async function listTrustedPublishers(scope, token, registryUrl = DEFAULT_REGISTRY) {
+  const q = scope ? `?scope=${encodeURIComponent(scope)}` : '';
+  const res = await fetch(`${registryUrl.replace(/\/$/, '')}/v1/trusted-publishers${q}`, {
+    headers: { Authorization: `Bearer ${token}` },
+  });
+  await throwIfError(res, 'Failed to list trusted publishers');
+  return res.json();
+}
+
+async function deleteTrustedPublisher(id, token, registryUrl = DEFAULT_REGISTRY) {
+  const res = await fetch(`${registryUrl.replace(/\/$/, '')}/v1/trusted-publishers/${id}`, {
+    method: 'DELETE',
+    headers: { Authorization: `Bearer ${token}` },
+  });
+  await throwIfError(res, 'Failed to delete trusted publisher');
+  return res.json();
+}
+
+async function exchangeOIDCForAccess(scope, idToken, registryUrl = DEFAULT_REGISTRY) {
+  const res = await fetch(`${registryUrl.replace(/\/$/, '')}/v1/token`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${idToken}` },
+    body: JSON.stringify({ scope }),
+  });
+  await throwIfError(res, 'OIDC token exchange failed');
+  const { access_token } = await res.json();
+  return access_token;
+}
+
 module.exports = {
   fetchPackageMetadata, fetchTarball, throwIfError, DEFAULT_REGISTRY,
   fetchPreset, fetchPresetList, patchDistTag, listDistTags, patchPreset, deletePreset,
+  postLogout,
+  createTrustedPublisher, listTrustedPublishers, deleteTrustedPublisher,
+  exchangeOIDCForAccess,
 };