@tapi-dev/sdk 0.1.4 → 0.1.6

package/dist/cli.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { spawn } from "node:child_process";
+import { createServer } from "node:http";
 import { createHash, randomUUID } from "node:crypto";
 import { createReadStream, createWriteStream, existsSync, readFileSync } from "node:fs";
 import { mkdir, readdir, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
@@ -9,10 +10,25 @@ import { performance } from "node:perf_hooks";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { fileURLToPath } from "node:url";
+import { TapiClient } from "./index";
 const DEFAULT_DOWNLOADS_BASE_URL = "https://d4xaf52nfwiok.cloudfront.net";
+const DEFAULT_STUDIO_API_BASE_URL = "https://determined-motivation-production.up.railway.app";
+const DEFAULT_STUDIO_AUTH_HTML_URL = "https://rsarlong-1f92fd.gitlab.io/auth.html";
+const DEFAULT_FIREBASE_API_KEY = "AIzaSyCDZR8lWyVQcWYfFdNZa4vuL4IWEC0h6gE";
 const DEFAULT_CHANNEL = "pilot";
 const SUPPORTED_STUDIO_PLATFORM = "windows-x86_64";
+const DEFAULT_INSTALL_AUTH_TIMEOUT_MS = 120_000;
 const MAX_WIDE_EVENT_PROCESS_ROOTS = 5;
+class StudioInstallApprovalError extends Error {
+    code;
+    status;
+    constructor(message, code, status) {
+        super(message);
+        this.code = code;
+        this.status = status;
+        this.name = "StudioInstallApprovalError";
+    }
+}
 const sdkVersion = readSdkVersion();
 export async function runCli(argv = process.argv.slice(2)) {
     const [command, subcommand, ...rest] = argv;
@@ -31,6 +47,18 @@ export async function runCli(argv = process.argv.slice(2)) {
         }
         return runDoctor(parseStudioOptions([subcommand, ...rest].filter(Boolean)));
     }
+    if (command === "apis") {
+        if (!subcommand || subcommand === "help" || subcommand === "--help" || subcommand === "-h" || hasHelpFlag(rest)) {
+            printApisHelp();
+            return 0;
+        }
+        if (subcommand === "describe") {
+            return describeApiOperation(rest);
+        }
+        console.error(`Unknown apis command: ${subcommand}`);
+        printApisHelp();
+        return 1;
+    }
     if (command !== "studio") {
         console.error(`Unknown command: ${command}`);
         printHelp();
@@ -74,11 +102,31 @@ export function parseStudioOptions(args) {
             continue;
         }
         if (arg === "--manifest") {
-            raw.manifestUrl = requireOptionValue(args, ++index, "--manifest");
+            raw.manifestUrlOverride = requireOptionValue(args, ++index, "--manifest");
             continue;
         }
         if (arg.startsWith("--manifest=")) {
-            raw.manifestUrl = arg.slice("--manifest=".length);
+            raw.manifestUrlOverride = arg.slice("--manifest=".length);
+            continue;
+        }
+        if (arg === "--api-base-url" || arg === "--server") {
+            raw.apiBaseUrl = requireOptionValue(args, ++index, arg);
+            continue;
+        }
+        if (arg.startsWith("--api-base-url=")) {
+            raw.apiBaseUrl = arg.slice("--api-base-url=".length);
+            continue;
+        }
+        if (arg.startsWith("--server=")) {
+            raw.apiBaseUrl = arg.slice("--server=".length);
+            continue;
+        }
+        if (arg === "--install-token") {
+            raw.installToken = requireOptionValue(args, ++index, "--install-token");
+            continue;
+        }
+        if (arg.startsWith("--install-token=")) {
+            raw.installToken = arg.slice("--install-token=".length);
             continue;
         }
         if (arg === "--cache-dir") {
@@ -111,20 +159,106 @@ export function parseStudioOptions(args) {
         throw new Error(`Unknown option: ${arg}`);
     }
     const channel = raw.channel ?? parseChannel(envString("TAPI_STUDIO_CHANNEL") ?? DEFAULT_CHANNEL);
+    const apiBaseUrl = normalizeHttpUrl(raw.apiBaseUrl
+        ?? envString("TAPI_STUDIO_API_BASE_URL")
+        ?? envString("TAPI_BASE_URL")
+        ?? envString("TAPI_STUDIO_SERVER_URL")
+        ?? DEFAULT_STUDIO_API_BASE_URL, "Studio API base URL");
     const downloadsBaseUrl = normalizeHttpUrl(envString("TAPI_DOWNLOADS_BASE_URL") ?? DEFAULT_DOWNLOADS_BASE_URL, "TAPI_DOWNLOADS_BASE_URL");
-    const explicitManifestUrl = raw.manifestUrl ?? envString("TAPI_STUDIO_MANIFEST_URL");
+    const explicitManifestUrl = raw.manifestUrlOverride ?? envString("TAPI_STUDIO_MANIFEST_URL");
     const manifestUrl = explicitManifestUrl
         ? normalizeHttpUrl(explicitManifestUrl, "Studio manifest URL")
         : `${downloadsBaseUrl.replace(/\/+$/, "")}/studio/channels/${channel}/latest.json`;
     return {
         channel,
+        apiBaseUrl,
         manifestUrl,
+        manifestUrlOverride: explicitManifestUrl ? normalizeHttpUrl(explicitManifestUrl, "Studio manifest URL") : undefined,
         cacheDir: raw.cacheDir ?? getDefaultStudioCacheDir(),
         downloadOnly: raw.downloadOnly ?? false,
         silent: raw.silent ?? false,
         exePath: raw.exePath ?? envString("TAPI_STUDIO_EXE"),
+        installToken: raw.installToken ?? envString("TAPI_STUDIO_INSTALL_TOKEN"),
+    };
+}
+function parseApiOptions(args) {
+    let operation = "";
+    let apiBaseUrl = envString("TAPI_BASE_URL") || DEFAULT_STUDIO_API_BASE_URL;
+    let apiKey = envString("TAPI_API_KEY") || "";
+    let appId = envString("TAPI_APP_ID");
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (!arg)
+            continue;
+        if (arg === "--api-base-url" || arg === "--server") {
+            apiBaseUrl = requireOptionValue(args, ++index, arg);
+            continue;
+        }
+        if (arg.startsWith("--api-base-url=")) {
+            apiBaseUrl = arg.slice("--api-base-url=".length);
+            continue;
+        }
+        if (arg.startsWith("--server=")) {
+            apiBaseUrl = arg.slice("--server=".length);
+            continue;
+        }
+        if (arg === "--api-key") {
+            apiKey = requireOptionValue(args, ++index, "--api-key");
+            continue;
+        }
+        if (arg.startsWith("--api-key=")) {
+            apiKey = arg.slice("--api-key=".length);
+            continue;
+        }
+        if (arg === "--app") {
+            appId = requireOptionValue(args, ++index, "--app");
+            continue;
+        }
+        if (arg.startsWith("--app=")) {
+            appId = arg.slice("--app=".length);
+            continue;
+        }
+        if (arg.startsWith("--")) {
+            throw new Error(`Unknown apis option: ${arg}`);
+        }
+        if (!operation) {
+            operation = arg;
+            continue;
+        }
+        throw new Error(`Unexpected apis argument: ${arg}`);
+    }
+    if (!operation) {
+        throw new Error("apis describe requires an operation like schwab.place_order.");
+    }
+    if (!apiKey) {
+        throw new Error("apis describe requires --api-key or TAPI_API_KEY.");
+    }
+    return {
+        operation,
+        options: {
+            apiBaseUrl: normalizeHttpUrl(apiBaseUrl, "Tapi API base URL"),
+            apiKey,
+            appId,
+        },
     };
 }
+async function describeApiOperation(args) {
+    try {
+        const { operation, options } = parseApiOptions(args);
+        const client = new TapiClient({
+            baseUrl: options.apiBaseUrl,
+            apiKey: options.apiKey,
+            appId: options.appId,
+        });
+        const description = await client.websiteApis.describe(operation);
+        console.log(JSON.stringify(description, null, 2));
+        return 0;
+    }
+    catch (error) {
+        console.error(formatError(error));
+        return 1;
+    }
+}
 export function getDefaultStudioCacheDir() {
     if (process.platform === "win32") {
         const localAppData = process.env.LOCALAPPDATA ??
@@ -209,9 +343,8 @@ export function getCliWideEventRoot() {
         return override;
     }
     if (process.platform === "win32") {
-        const localAppData = process.env.LOCALAPPDATA ??
-            (process.env.USERPROFILE ? join(process.env.USERPROFILE, "AppData", "Local") : join(homedir(), "AppData", "Local"));
-        return join(localAppData, "Tapi", "logs", "events");
+        const programData = process.env.PROGRAMDATA?.trim() || "C:\\ProgramData";
+        return join(programData, "Tapi", "logs", "events");
     }
     return join(process.env.XDG_STATE_HOME ?? join(homedir(), ".local", "state"), "tapi", "logs", "events");
 }
@@ -332,12 +465,35 @@ async function installStudio(options) {
             arch: process.arch,
         });
         ensureWindowsHost();
+        if (options.manifestUrlOverride) {
+            throw new Error("Direct Studio manifest overrides are no longer supported for install. "
+                + "Use --channel with the protected install flow instead.");
+        }
+        let installToken = options.installToken?.trim();
+        if (installToken) {
+            await event.phase("auth.install_token.provided", {
+                apiBaseUrl: options.apiBaseUrl,
+                channel: options.channel,
+            });
+        }
+        else {
+            console.log("Checking Studio install approval...");
+            await event.phase("auth.install_token.request.start", {
+                apiBaseUrl: options.apiBaseUrl,
+                channel: options.channel,
+            });
+            installToken = await obtainStudioInstallToken(options, event);
+            await event.phase("auth.install_token.request.success", {
+                apiBaseUrl: options.apiBaseUrl,
+                channel: options.channel,
+            });
+        }
         console.log(`Fetching Tapi Studio ${options.channel} manifest...`);
         await event.phase("manifest.fetch.start", {
-            manifestUrl: options.manifestUrl,
+            apiBaseUrl: options.apiBaseUrl,
             channel: options.channel,
         });
-        const manifest = await fetchStudioManifest(options.manifestUrl);
+        const manifest = await fetchProtectedStudioManifest(options.apiBaseUrl, options.channel, installToken);
         await event.phase("manifest.fetch.success", {
             manifest: manifestEventSummary(manifest),
         });
@@ -401,6 +557,49 @@ async function installStudio(options) {
         throw error;
     }
 }
+async function obtainStudioInstallToken(options, event) {
+    const cachedCreds = await refreshCachedFirebaseCredentials();
+    if (cachedCreds) {
+        await event.phase("auth.cache.refresh.success", {
+            uid: cachedCreds.uid,
+            authCachePath: getStudioAuthCachePath(),
+        });
+        await writeStudioAuthCache(cachedCreds);
+        try {
+            const issued = await requestStudioInstallToken(options.apiBaseUrl, options.channel, cachedCreds.idToken);
+            return issued.installToken;
+        }
+        catch (error) {
+            if (isApprovalTerminalError(error)) {
+                throw error;
+            }
+            await event.phase("auth.cache.install_token.retry_interactive", {
+                error: errorDetails(error),
+            });
+        }
+    }
+    else {
+        await event.phase("auth.cache.refresh.miss", {
+            authCachePath: getStudioAuthCachePath(),
+        });
+    }
+    const browserAuth = await browserGoogleSignIn();
+    await event.phase("auth.browser.callback.received", {
+        googleIdTokenPresent: Boolean(browserAuth.idToken),
+        googleAccessTokenPresent: Boolean(browserAuth.accessToken),
+    });
+    if (!browserAuth.idToken) {
+        throw new Error(browserAuth.error || browserAuth.detail || "Browser sign-in did not return a Google ID token.");
+    }
+    const firebaseCreds = await exchangeGoogleToFirebase(browserAuth.idToken, browserAuth.accessToken);
+    await writeStudioAuthCache(firebaseCreds);
+    await event.phase("auth.firebase.exchange.success", {
+        uid: firebaseCreds.uid,
+        authCachePath: getStudioAuthCachePath(),
+    });
+    const issued = await requestStudioInstallToken(options.apiBaseUrl, options.channel, firebaseCreds.idToken);
+    return issued.installToken;
+}
 async function openStudio(options) {
     ensureWindowsHost();
     const exePath = options.exePath ?? getStudioExecutableCandidates().find((candidate) => existsSync(candidate));
@@ -422,6 +621,7 @@ async function runDoctor(options) {
     console.log(`Tapi SDK: ${sdkVersion}`);
     console.log(`Node: ${process.version}`);
     console.log(`Platform: ${process.platform}/${process.arch}`);
+    console.log(`Studio API: ${options.apiBaseUrl}`);
     console.log(`Studio channel: ${options.channel}`);
     console.log(`Studio manifest: ${options.manifestUrl}`);
     console.log(`Studio cache: ${options.cacheDir}`);
@@ -438,6 +638,22 @@ async function runDoctor(options) {
     }
     return 0;
 }
+async function fetchProtectedStudioManifest(apiBaseUrl, channel, installToken, fetchImpl = fetch) {
+    const response = await fetchImpl(`${apiBaseUrl.replace(/\/+$/, "")}/api/sdk/v1/studio/releases/${channel}`, {
+        headers: {
+            Accept: "application/json",
+            Authorization: `Bearer ${installToken}`,
+        },
+    });
+    const responseBody = await readJsonBody(response);
+    if (!response.ok) {
+        const detail = typeof responseBody?.detail === "string" ? responseBody.detail : "";
+        throw new Error(detail
+            ? `Failed to fetch protected Studio manifest: HTTP ${response.status} (${detail})`
+            : `Failed to fetch protected Studio manifest: HTTP ${response.status}`);
+    }
+    return validateStudioManifest(responseBody);
+}
 async function fetchStudioManifest(manifestUrl, fetchImpl = fetch) {
     const response = await fetchImpl(manifestUrl, {
         headers: {
@@ -449,6 +665,37 @@ async function fetchStudioManifest(manifestUrl, fetchImpl = fetch) {
     }
     return validateStudioManifest(await response.json());
 }
+async function requestStudioInstallToken(apiBaseUrl, channel, firebaseIdToken, fetchImpl = fetch) {
+    const response = await fetchImpl(`${apiBaseUrl.replace(/\/+$/, "")}/api/sdk/v1/studio/install-token`, {
+        method: "POST",
+        headers: {
+            Accept: "application/json",
+            Authorization: `Bearer ${firebaseIdToken}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({ channel }),
+    });
+    const responseBody = await readJsonBody(response);
+    if (!response.ok) {
+        const detail = typeof responseBody?.detail === "string" ? responseBody.detail : "";
+        if (detail === "pending_approval" || detail === "access_pending") {
+            throw new StudioInstallApprovalError("Access request submitted. Check your email for approval, then rerun `npx tapi studio install`.", detail, response.status);
+        }
+        if (detail === "access_rejected") {
+            throw new StudioInstallApprovalError("Studio install access was rejected. Contact the Tapi admin if this is unexpected.", detail, response.status);
+        }
+        throw new StudioInstallApprovalError(detail || `Failed to request Studio install token: HTTP ${response.status}`, detail || "install_token_request_failed", response.status);
+    }
+    const payload = responseBody;
+    const installToken = typeof payload?.installToken === "string" ? payload.installToken.trim() : "";
+    if (!installToken) {
+        throw new Error("Studio install token response did not include installToken.");
+    }
+    return {
+        installToken,
+        expiresAt: typeof payload?.expiresAt === "string" ? payload.expiresAt : undefined,
+    };
+}
 async function downloadAndVerify(url, destination, expectedSha256) {
     const partialPath = `${destination}.partial`;
     await downloadFile(url, partialPath);
@@ -470,6 +717,198 @@ async function downloadFile(url, destination) {
     }
     await pipeline(Readable.fromWeb(response.body), createWriteStream(destination));
 }
+async function browserGoogleSignIn(timeoutMs = DEFAULT_INSTALL_AUTH_TIMEOUT_MS) {
+    ensureWindowsHost();
+    return new Promise((resolvePromise, rejectPromise) => {
+        let timeoutHandle;
+        const cleanup = () => {
+            if (timeoutHandle) {
+                clearTimeout(timeoutHandle);
+                timeoutHandle = undefined;
+            }
+            try {
+                server.close();
+            }
+            catch {
+                // ignore close races
+            }
+        };
+        const server = createServer((req, res) => {
+            const requestUrl = new URL(req.url || "/", "http://127.0.0.1");
+            const idToken = requestUrl.searchParams.get("idToken") || "";
+            const accessToken = requestUrl.searchParams.get("accessToken") || "";
+            const error = requestUrl.searchParams.get("error") || "";
+            const detail = requestUrl.searchParams.get("detail") || "";
+            const ok = Boolean(idToken);
+            res.statusCode = 200;
+            res.setHeader("Content-Type", "text/html; charset=utf-8");
+            res.end(renderBrowserSignInResponseHtml(ok));
+            cleanup();
+            if (!ok) {
+                rejectPromise(new Error(error || detail || "Browser sign-in did not return Google credentials."));
+                return;
+            }
+            resolvePromise({
+                accessToken: accessToken || undefined,
+                detail: detail || undefined,
+                idToken,
+            });
+        });
+        timeoutHandle = setTimeout(() => {
+            cleanup();
+            rejectPromise(new Error("Browser sign-in timed out or was cancelled."));
+        }, timeoutMs);
+        server.once("error", (error) => {
+            cleanup();
+            rejectPromise(error);
+        });
+        server.listen(0, "127.0.0.1", () => {
+            const address = server.address();
+            const port = typeof address === "object" && address ? address.port : 0;
+            if (!port) {
+                cleanup();
+                rejectPromise(new Error("Could not start local callback server for Studio sign-in."));
+                return;
+            }
+            try {
+                openBrowser(`${getStudioAuthHtmlUrl()}?port=${port}`);
+            }
+            catch (error) {
+                cleanup();
+                rejectPromise(error);
+            }
+        });
+    });
+}
+async function exchangeGoogleToFirebase(googleIdToken, googleAccessToken, fetchImpl = fetch) {
+    const postBody = [
+        `id_token=${encodeURIComponent(googleIdToken)}`,
+        "providerId=google.com",
+        googleAccessToken ? `access_token=${encodeURIComponent(googleAccessToken)}` : "",
+    ].filter(Boolean).join("&");
+    const response = await fetchImpl(`https://identitytoolkit.googleapis.com/v1/accounts:signInWithIdp?key=${getFirebaseApiKey()}`, {
+        method: "POST",
+        headers: {
+            Accept: "application/json",
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+            postBody,
+            requestUri: "http://127.0.0.1",
+            returnSecureToken: true,
+            returnIdpCredential: true,
+        }),
+    });
+    const responseBody = await readJsonBody(response);
+    if (!response.ok) {
+        throw new Error(`Firebase exchange failed: HTTP ${response.status}`);
+    }
+    const uid = typeof responseBody?.localId === "string" ? responseBody.localId.trim() : "";
+    const idToken = typeof responseBody?.idToken === "string" ? responseBody.idToken.trim() : "";
+    const refreshToken = typeof responseBody?.refreshToken === "string" ? responseBody.refreshToken.trim() : "";
+    if (!uid || !idToken || !refreshToken) {
+        throw new Error("Firebase exchange response is missing uid, idToken, or refreshToken.");
+    }
+    return { uid, idToken, refreshToken };
+}
+async function refreshCachedFirebaseCredentials(fetchImpl = fetch) {
+    const cache = readStudioAuthCache();
+    if (!cache?.refreshToken) {
+        return null;
+    }
+    const response = await fetchImpl(`https://securetoken.googleapis.com/v1/token?key=${getFirebaseApiKey()}`, {
+        method: "POST",
+        headers: {
+            Accept: "application/json",
+            "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body: `grant_type=refresh_token&refresh_token=${encodeURIComponent(cache.refreshToken)}`,
+    });
+    const responseBody = await readJsonBody(response);
+    if (!response.ok) {
+        return null;
+    }
+    const uid = typeof responseBody?.user_id === "string" ? responseBody.user_id.trim() : "";
+    const idToken = typeof responseBody?.id_token === "string" ? responseBody.id_token.trim() : "";
+    const refreshToken = typeof responseBody?.refresh_token === "string" ? responseBody.refresh_token.trim() : "";
+    if (!uid || !idToken || !refreshToken) {
+        return null;
+    }
+    return { uid, idToken, refreshToken };
+}
+function readStudioAuthCache() {
+    const cachePath = getStudioAuthCachePath();
+    if (!existsSync(cachePath)) {
+        return null;
+    }
+    try {
+        const payload = JSON.parse(readFileSync(cachePath, "utf8"));
+        const uid = typeof payload.uid === "string" ? payload.uid.trim() : "";
+        const idToken = typeof payload.id_token === "string" ? payload.id_token.trim() : "";
+        const refreshToken = typeof payload.refresh_token === "string" ? payload.refresh_token.trim() : "";
+        if (!uid || !refreshToken) {
+            return null;
+        }
+        return { uid, idToken, refreshToken };
+    }
+    catch {
+        return null;
+    }
+}
+async function writeStudioAuthCache(credentials) {
+    await mkdir(getDefaultTapiDataDir(), { recursive: true });
+    await writeFile(getStudioAuthCachePath(), `${JSON.stringify({
+        uid: credentials.uid,
+        refresh_token: credentials.refreshToken,
+        id_token: credentials.idToken,
+    }, null, 2)}\n`, "utf8");
+}
+function getStudioAuthCachePath() {
+    return join(getDefaultTapiDataDir(), "auth.json");
+}
+function getDefaultTapiDataDir() {
+    if (process.platform === "win32") {
+        const localAppData = process.env.LOCALAPPDATA
+            ?? (process.env.USERPROFILE ? join(process.env.USERPROFILE, "AppData", "Local") : join(homedir(), "AppData", "Local"));
+        return join(localAppData, "Tapi");
+    }
+    return join(process.env.XDG_DATA_HOME ?? join(homedir(), ".local", "share"), "tapi");
+}
+function getStudioAuthHtmlUrl() {
+    return normalizeHttpUrl(envString("TAPI_STUDIO_AUTH_HTML_URL") ?? DEFAULT_STUDIO_AUTH_HTML_URL, "TAPI_STUDIO_AUTH_HTML_URL");
+}
+function getFirebaseApiKey() {
+    return (envString("TAPI_FIREBASE_API_KEY") ?? DEFAULT_FIREBASE_API_KEY).trim();
+}
+function openBrowser(url) {
+    const child = spawn("cmd", ["/c", "start", "", url], {
+        detached: true,
+        stdio: "ignore",
+        windowsHide: true,
+    });
+    child.unref();
+}
+async function readJsonBody(response) {
+    const text = await response.text();
+    if (!text.trim()) {
+        return null;
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}
+function isApprovalTerminalError(error) {
+    return error instanceof StudioInstallApprovalError
+        && (error.code === "pending_approval" || error.code === "access_pending" || error.code === "access_rejected");
+}
+function renderBrowserSignInResponseHtml(success) {
+    return success
+        ? "<!DOCTYPE html><html><body style='font-family:system-ui;text-align:center;padding:80px'><h2 style='color:#22c55e'>&#10003; Signed in!</h2><p>Return to your terminal.</p><script>setTimeout(()=>window.close(),1600)</script></body></html>"
+        : "<!DOCTYPE html><html><body style='font-family:system-ui;text-align:center;padding:80px'><h2 style='color:#ef4444'>&#9888; Sign-in failed</h2><p>Return to your terminal for details.</p></body></html>";
+}
 async function hasVerifiedCachedInstaller(path, expectedSha256) {
     if (!existsSync(path)) {
         return false;
@@ -518,11 +957,14 @@ function cachedInstallerName(manifest) {
 function installEventOptions(options) {
     return {
         channel: options.channel,
+        apiBaseUrl: options.apiBaseUrl,
         manifestUrl: options.manifestUrl,
+        manifestUrlOverride: options.manifestUrlOverride,
         cacheDir: options.cacheDir,
         downloadOnly: options.downloadOnly,
         silent: options.silent,
         exePath: options.exePath,
+        installTokenProvided: Boolean(options.installToken),
     };
 }
 function manifestEventSummary(manifest) {
@@ -623,36 +1065,54 @@ function readSdkVersion() {
     return packageJson.version;
 }
 function printHelp() {
-    console.log(`Tapi CLI
-
-Usage:
-  tapi studio install [--channel pilot] [--manifest URL]
-  tapi studio open
-  tapi studio doctor
-  tapi doctor
-
-Commands:
-  studio install  Download, verify, and run the Tapi Studio installer
-  studio open     Open an installed Tapi Studio desktop app
-  studio doctor   Check local SDK and Studio release configuration
-  doctor          Alias for studio doctor
+    console.log(`Tapi CLI
+
+Usage:
+  tapi studio install [--channel pilot] [--api-base-url URL]
+  tapi studio open
+  tapi studio doctor
+  tapi apis describe <namespace.operation>
+  tapi doctor
+
+Commands:
+  studio install  Download, verify, and run the Tapi Studio installer
+  studio open     Open an installed Tapi Studio desktop app
+  studio doctor   Check local SDK and Studio release configuration
+  apis describe   Print a generated website API input/output contract
+  doctor          Alias for studio doctor
+`);
+}
+function printApisHelp() {
+    console.log(`Tapi generated website API commands
+
+Usage:
+  tapi apis describe <namespace.operation> [--api-base-url URL] [--api-key KEY] [--app APP]
+
+Options:
+  --api-base-url <url>   Tapi API base URL
+  --server <url>         Alias for --api-base-url
+  --api-key <key>        Tapi API key; defaults to TAPI_API_KEY
+  --app <id>             SDK app/project id; defaults to TAPI_APP_ID
 `);
 }
 function printStudioHelp() {
-    console.log(`Tapi Studio commands
-
-Usage:
-  tapi studio install [options]
-  tapi studio open [options]
-  tapi studio doctor [options]
-
-Options:
-  --channel <name>      Release channel: pilot, stable, or nightly
-  --manifest <url>      Exact release manifest URL
-  --cache-dir <path>    Installer download cache directory
-  --download-only       Download and verify without running the installer
-  --silent              Run the NSIS installer with /S
-  --exe <path>          Tapi Studio executable path for open/doctor
+    console.log(`Tapi Studio commands
+
+Usage:
+  tapi studio install [options]
+  tapi studio open [options]
+  tapi studio doctor [options]
+
+Options:
+  --channel <name>       Release channel: pilot, stable, or nightly
+  --api-base-url <url>   Tapi API base URL for approval and protected downloads
+  --server <url>         Alias for --api-base-url
+  --install-token <tok>  Preissued Studio install token (skips browser sign-in)
+  --manifest <url>       Exact release manifest URL for doctor only
+  --cache-dir <path>     Installer download cache directory
+  --download-only        Download and verify without running the installer
+  --silent               Run the NSIS installer with /S
+  --exe <path>           Tapi Studio executable path for open/doctor
 `);
 }
 function formatError(error) {

package/dist/cloud-runs.d.ts

@@ -0,0 +1,22 @@
+import type { HttpClient } from "./client";
+import type { CloudBatchRun, CloudBalance, CloudCreditCheckout, CloudCreditCheckoutRequest, CloudRunEvent, CloudRunResults, CloudRunUser } from "./types";
+export declare class CloudRunsResource {
+    private readonly http;
+    constructor(http: HttpClient);
+    get(runId: string): Promise<CloudBatchRun>;
+    events(runId: string): Promise<{
+        events: CloudRunEvent[];
+    }>;
+    results(runId: string): Promise<CloudRunResults>;
+    cancel(runId: string): Promise<CloudBatchRun>;
+    balance(user?: CloudRunUser): Promise<CloudBalance>;
+    checkout(request: CloudCreditCheckoutRequest): Promise<CloudCreditCheckout>;
+    wait(runId: string, options?: {
+        intervalMs?: number;
+        timeoutMs?: number;
+    }): Promise<CloudBatchRun>;
+    stream(runId: string, options?: {
+        intervalMs?: number;
+        timeoutMs?: number;
+    }): AsyncGenerator<CloudRunEvent, void, unknown>;
+}