@tiangong-lca/cli 0.1.6 → 0.1.7

package/README.md

@@ -28,18 +28,17 @@ checkPaths:
   - src/lib/oauth-pkce.ts
   - src/lib/supabase-session.ts
   - src/lib/lca-release.ts
-  - scripts/run-auth-identity-production-case.ts
   - test/auth-identity*.test.ts
   - test/public-auth-identity-receipt.test.ts
   - test/lca-release*.test.ts
 lastReviewedAt: 2026-08-31
 lastReviewedCommit: 499c910d07bb6a5e2e1cd8e4403a5a617d4269bb
-lastReviewedNote: 'Reviewed for Issue #257: CLI 0.1.6 is the release identity for the merged latest-compatible dependency graph; commands, exports, OAuth/session behavior, dependencies, and lock bytes stay fixed.'
+lastReviewedNote: 'Reviewed for Issue #260: CLI 0.1.7 removes the password-equivalent API-key bootstrap and historical runner; OAuth or an explicit verified headless token is required for every user-authenticated remote command.'
 ---
 
 # TianGong LCA CLI
 
-Package: `@tiangong-lca/cli` Executable: `tiangong-lca` Current package version: `0.1.6` Node: `24.19.0`
+Package: `@tiangong-lca/cli` Executable: `tiangong-lca` Current package version: `0.1.7` Node: `24.19.0`
 
 Repository development is single-track on pnpm `11.24.0` and TypeScript `7.0.2`. The published package remains a clean, package-manager-neutral consumer artifact: it contains runtime files only, not pnpm, TypeScript, Oxlint, tests, source-only tooling, or repository lockfiles.
 
@@ -154,7 +153,6 @@ Notes:
 - `TIANGONG_LCA_OAUTH_CLIENT_ID` is the environment-specific registered public CLI client; it is not a secret.
 - Run `tiangong-lca auth login` once in a trusted terminal. All Edge Function and direct Supabase commands then reuse the OAuth access token and rotate the refresh token on demand.
 - For approved headless execution, set `TIANGONG_LCA_AUTH_MODE=access-token` and inject one short-lived `TIANGONG_LCA_ACCESS_TOKEN`. It is verified online, kept only in process memory, and never refreshed.
-- Transition-only compatibility uses `TIANGONG_LCA_AUTH_MODE=legacy-user-api-key` plus `TIANGONG_LCA_API_KEY`. OAuth failures never fall back to this password-equivalent credential.
 
 Optional session control:
 
@@ -190,7 +188,7 @@ Use the identity receipt before a production-backed case or any later owner-draf
 tiangong-lca auth identity-receipt --expected-project-ref <project-ref> --expected-user-id <user-id> --json
 ```
 
-The command performs no dataset write. It resolves the selected OAuth, explicit headless, or transition-only legacy session, checks the canonical Supabase project, and makes a bounded live `GET /auth/v1/user`. A refreshable cached token that receives `401` or `403` may be refreshed and retried exactly once; an explicit headless access token is never refreshed. All other transport or response failures are terminal. A valid production guard requires:
+The command performs no dataset write. It resolves the selected OAuth or explicit headless session, checks the canonical Supabase project, and makes a bounded live `GET /auth/v1/user`. A refreshable cached token that receives `401` or `403` may be refreshed and retried exactly once; an explicit headless access token is never refreshed. All other transport or response failures are terminal. A valid production guard requires:
 
 - `schema` exactly `tiangong-lca.auth-identity-receipt.v1`;
 - `status: "passed"`, `operation: "current-user-read"`, and `remote_write_mode: "read-only"`;
@@ -199,14 +197,6 @@ The command performs no dataset write. It resolves the selected OAuth, explicit
 
 Calling without expectations is allowed for discovery but produces `assertions.mode: "observed"`; it is not an authorization guard. The safe display email is masked and must not be used as the account key. The receipt deliberately excludes credentials, full email, session-file details, raw response metadata, and all credential/token/path-derived fingerprints.
 
-For the explicitly authorized local production read case from a validated repository checkout, invoke the narrow TypeScript runner with a new private output directory:
-
-```text
-pnpm case:auth-identity:production -- --env-file <data-foundry-ignored-.env> --expected-project-ref <project-ref> --expected-user-id <user-id> --out-dir <new-private-case-directory>
-```
-
-The historical production-case runner remains a transition-only legacy fixture: it reads only `TIANGONG_LCA_API_BASE_URL`, `TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY`, and `TIANGONG_LCA_TEST_API_KEY`; the last is mapped to the child process's explicit legacy variable. It does not accept an alternate CLI path. The pnpm command first performs a clean TS7 build without the production env. Its plain-Node runner then single-reads source/config/lock and the freshly generated `dist/src/**/*.js`, hashes the source tree, runner, runtime, exact entrypoint, and pnpm lock, and copies those exact built buffers into a private snapshot before exposing the key. It forces reauthentication with session cache disabled, runs only the built snapshot from an exclusively created clean directory with an argv array and `shell:false`, cleans the snapshot before publishing success artifacts, and persists only the parsed receipt and case manifest. POSIX creates the case directory as `0700` and files as `0600`; Windows inherits ACLs from the caller-selected parent, so use a user-restricted parent because mode bits are not an ACL guarantee. The runner never stores raw child stdout/stderr and is intentionally not wired to CI secrets. New automation should use OAuth/headless mode instead. This receipt is locally hash-verifiable, not server-signed attestation.
-
 ## LCI/LCIA Data Release
 
 The `release` command family is the authenticated transport used by the standalone release control plane. It does not introduce a TIDAS schema variant: result packages reuse the existing Process exchange structure for LCI and the existing Process LCIA result fields, with a LifecycleModel referencing the resulting Process.

package/dist/src/cli.js

@@ -295,9 +295,6 @@ Required env:
 Headless alternative:
   TIANGONG_LCA_ACCESS_TOKEN (short-lived actor token; never cached or refreshed)
 
-Legacy compatibility:
-  TIANGONG_LCA_AUTH_MODE=legacy-user-api-key plus TIANGONG_LCA_API_KEY
-
 Optional session env:
   TIANGONG_LCA_SESSION_FILE
   TIANGONG_LCA_DISABLE_SESSION_CACHE
@@ -321,7 +318,6 @@ Options:
   --input <file>   JSON request file
   --json           Print compact JSON
   --dry-run        Print the planned HTTP request without sending it
-  --api-key <key>  Override TIANGONG_LCA_API_KEY
   --base-url <url> Override TIANGONG_LCA_API_BASE_URL
   --region <name>  Override TIANGONG_LCA_REGION
   --timeout-ms <n> Request timeout in milliseconds
@@ -329,13 +325,12 @@ Options:
 
 Required env:
   TIANGONG_LCA_API_BASE_URL
-  TIANGONG_LCA_API_KEY
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
+  TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
   TIANGONG_LCA_REGION (optional)
 
 Runtime note:
-  The CLI decodes TIANGONG_LCA_API_KEY as a user API key bootstrap, exchanges it for a user session,
-  and sends the resolved access token to Edge Functions.
+  The CLI resolves the OAuth session and sends only its access token to Edge Functions.
 `.trim();
 }
 function renderAdminHelp() {
@@ -346,19 +341,17 @@ Options:
   --input <file>   JSON request file
   --json           Print compact JSON
   --dry-run        Print the planned HTTP request without sending it
-  --api-key <key>  Override TIANGONG_LCA_API_KEY
   --base-url <url> Override TIANGONG_LCA_API_BASE_URL
   --timeout-ms <n> Request timeout in milliseconds
   -h, --help
 
 Required env:
   TIANGONG_LCA_API_BASE_URL
-  TIANGONG_LCA_API_KEY
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
+  TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
 
 Runtime note:
-  The CLI decodes TIANGONG_LCA_API_KEY as a user API key bootstrap, exchanges it for a user session,
-  and sends the resolved access token to Edge Functions.
+  The CLI resolves the OAuth session and sends only its access token to Edge Functions.
 `.trim();
 }
 function renderLcaReleaseHelp() {
@@ -391,19 +384,18 @@ Options:
   --force                 Replace an existing output file
   --dry-run               Validate and print the masked planned request without network writes
   --json                  Print the stable compact JSON report; otherwise print Summary and Next
-  --api-key <key>         Override TIANGONG_LCA_API_KEY; environment use is preferred
   --base-url <url>        Override TIANGONG_LCA_API_BASE_URL
   --timeout-ms <n>        Request timeout in milliseconds (default 60000)
   -h, --help
 
 Required environment:
   TIANGONG_LCA_API_BASE_URL
-  TIANGONG_LCA_API_KEY
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
+  TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
 
 Authorization and safety:
-  The User API key is exchanged for a user session. Database RPCs then check that the live account
-  has data_product_manager. The service-role key never enters this CLI. Large bundle projections,
+  The OAuth session identifies the live account, and Database RPCs check that it has
+  data_product_manager. The service-role key never enters this CLI. Large bundle projections,
   ZIPs, and chunks are written to files and verified against exact byte size and SHA-256.
 
 Examples:
@@ -1057,7 +1049,7 @@ Options:
   -h, --help
 
 Environment:
-  TIANGONG_LCA_API_BASE_URL, TIANGONG_LCA_API_KEY, and TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
+  TIANGONG_LCA_API_BASE_URL, TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY, and a configured OAuth session
 
 Outputs written under --out-dir:
   - outputs/remote-verification-report.json
@@ -1273,7 +1265,7 @@ Options:
 
 Environment:
   none for local dry-run
-  TIANGONG_LCA_API_BASE_URL, TIANGONG_LCA_API_KEY, and TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
+  TIANGONG_LCA_API_BASE_URL, TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY, and a configured OAuth session
   when --commit executes remote writes
 
 Outputs written under --out-dir:
@@ -1389,7 +1381,7 @@ Options:
 
 Required env:
   TIANGONG_LCA_API_BASE_URL
-  TIANGONG_LCA_API_KEY
+  TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
 
 Runtime note:
@@ -1417,7 +1409,7 @@ Options:
 
 Required env:
   TIANGONG_LCA_API_BASE_URL
-  TIANGONG_LCA_API_KEY
+  TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
 
 Runtime note:
@@ -1458,7 +1450,7 @@ Options:
 
 Required env:
   TIANGONG_LCA_API_BASE_URL
-  TIANGONG_LCA_API_KEY
+  TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
 
 Outputs written under --out-dir:
@@ -1505,7 +1497,7 @@ Options:
 
 Environment:
   TIANGONG_LCA_API_BASE_URL
-  TIANGONG_LCA_API_KEY
+  TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
 
 Outputs written under --out-dir:
@@ -1535,7 +1527,7 @@ Options:
 
 Environment:
   none for local dry-run
-  TIANGONG_LCA_API_BASE_URL, TIANGONG_LCA_API_KEY, and TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
+  TIANGONG_LCA_API_BASE_URL, TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY, and a configured OAuth session
   when --commit publishes prepared rows
 
 Outputs written under --out-dir:
@@ -1770,7 +1762,7 @@ Options:
 
 Remote lookup env (only when process_sources.allow_remote_lookup=true):
   TIANGONG_LCA_API_BASE_URL
-  TIANGONG_LCA_API_KEY
+  TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
 `.trim();
 }
@@ -1800,7 +1792,7 @@ Options:
 
 Environment:
   none for local dry-run
-  TIANGONG_LCA_API_BASE_URL, TIANGONG_LCA_API_KEY, and TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
+  TIANGONG_LCA_API_BASE_URL, TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY, and a configured OAuth session
   when --commit executes remote writes
 
 Local gate:
@@ -1966,7 +1958,7 @@ Options:
 
 Required env:
   TIANGONG_LCA_API_BASE_URL
-  TIANGONG_LCA_API_KEY
+  TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
 
 Runtime note:
@@ -1993,7 +1985,7 @@ Options:
 
 Required env:
   TIANGONG_LCA_API_BASE_URL
-  TIANGONG_LCA_API_KEY
+  TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
 
 Runtime note:
@@ -2143,7 +2135,7 @@ Options:
 
 Environment:
   none for local dry-run
-  TIANGONG_LCA_API_BASE_URL, TIANGONG_LCA_API_KEY, and TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
+  TIANGONG_LCA_API_BASE_URL, TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY, and a configured OAuth session
   when --commit executes remote writes
 
 Local gate:
@@ -2199,7 +2191,7 @@ Options:
 
 Required env:
   TIANGONG_LCA_API_BASE_URL
-  TIANGONG_LCA_API_KEY
+  TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
 
 Guardrails:
@@ -2551,7 +2543,6 @@ function parseRemoteFlags(args) {
                 json: { type: 'boolean' },
                 'dry-run': { type: 'boolean' },
                 input: { type: 'string' },
-                'api-key': { type: 'string' },
                 'base-url': { type: 'string' },
                 region: { type: 'string' },
                 'timeout-ms': { type: 'string' },
@@ -2577,7 +2568,6 @@ function parseRemoteFlags(args) {
         json: Boolean(values.json),
         dryRun: Boolean(values['dry-run']),
         inputPath: typeof values.input === 'string' ? values.input : '',
-        apiKey: typeof values['api-key'] === 'string' ? values['api-key'] : null,
         apiBaseUrl: typeof values['base-url'] === 'string' ? values['base-url'] : null,
         region: typeof values.region === 'string' ? values.region : null,
         timeoutMs,
@@ -2601,7 +2591,6 @@ function parseLcaReleaseFlags(args) {
                 'package-id': { type: 'string' },
                 'artifact-id': { type: 'string' },
                 'artifact-path': { type: 'string' },
-                'api-key': { type: 'string' },
                 'base-url': { type: 'string' },
                 'timeout-ms': { type: 'string' },
             },
@@ -2633,7 +2622,6 @@ function parseLcaReleaseFlags(args) {
         packageId: optionalString(values['package-id']),
         artifactId: optionalString(values['artifact-id']),
         artifactPath: optionalString(values['artifact-path']),
-        apiKey: optionalString(values['api-key']),
         apiBaseUrl: optionalString(values['base-url']),
         timeoutMs,
     };
@@ -5705,7 +5693,6 @@ function applyRemoteOverrides(env, overrides) {
     return {
         ...env,
         TIANGONG_LCA_API_BASE_URL: overrides.apiBaseUrl ?? runtimeEnv.apiBaseUrl ?? undefined,
-        TIANGONG_LCA_API_KEY: overrides.apiKey ?? runtimeEnv.apiKey ?? undefined,
         TIANGONG_LCA_REGION: overrides.region ?? runtimeEnv.region,
     };
 }
@@ -7934,9 +7921,6 @@ export async function executeCli(argv, deps) {
             }
             const action = requireLcaReleaseAction(subcommand);
             const env = { ...deps.env };
-            if (releaseFlags.apiKey !== null) {
-                env.TIANGONG_LCA_API_KEY = releaseFlags.apiKey;
-            }
             if (releaseFlags.apiBaseUrl !== null) {
                 env.TIANGONG_LCA_API_BASE_URL = releaseFlags.apiBaseUrl;
             }