@tiangong-lca/cli 0.1.6 → 0.1.8

package/README.md

@@ -28,18 +28,17 @@ checkPaths:
   - src/lib/oauth-pkce.ts
   - src/lib/supabase-session.ts
   - src/lib/lca-release.ts
-  - scripts/run-auth-identity-production-case.ts
   - test/auth-identity*.test.ts
   - test/public-auth-identity-receipt.test.ts
   - test/lca-release*.test.ts
-lastReviewedAt: 2026-08-31
-lastReviewedCommit: 499c910d07bb6a5e2e1cd8e4403a5a617d4269bb
-lastReviewedNote: 'Reviewed for Issue #257: CLI 0.1.6 is the release identity for the merged latest-compatible dependency graph; commands, exports, OAuth/session behavior, dependencies, and lock bytes stay fixed.'
+lastReviewedAt: 2026-09-02
+lastReviewedCommit: 3254d6167662121ca871090f6e57ff2a55578f28
+lastReviewedNote: 'Reviewed for Issue #266: published CLI 0.1.8 ships zero-config official Production login and complete custom/headless boundaries through the existing verified release path.'
 ---
 
 # TianGong LCA CLI
 
-Package: `@tiangong-lca/cli` Executable: `tiangong-lca` Current package version: `0.1.6` Node: `24.19.0`
+Package: `@tiangong-lca/cli` Executable: `tiangong-lca` Current package version: `0.1.8` Node: `24.19.0`
 
 Repository development is single-track on pnpm `11.24.0` and TypeScript `7.0.2`. The published package remains a clean, package-manager-neutral consumer artifact: it contains runtime files only, not pnpm, TypeScript, Oxlint, tests, source-only tooling, or repository lockfiles.
 
@@ -105,7 +104,8 @@ One-off published run:
 
 ```bash
 pnpm dlx @tiangong-lca/cli@latest --help
-pnpm dlx @tiangong-lca/cli@latest doctor
+pnpm dlx @tiangong-lca/cli@latest auth login
+pnpm dlx @tiangong-lca/cli@latest auth doctor-auth --json
 pnpm dlx @tiangong-lca/cli@latest flow --help
 ```
 
@@ -114,7 +114,8 @@ Install the published CLI:
 ```bash
 pnpm add --global @tiangong-lca/cli
 tiangong-lca --help
-tiangong-lca doctor
+tiangong-lca auth login
+tiangong-lca auth doctor-auth --json
 tiangong-lca flow --help
 ```
 
@@ -139,12 +140,17 @@ The packed ESM, CJS dynamic-import, and TypeScript consumers exercise every publ
 
 ## Env
 
-Remote commands require:
+Official Production requires **no environment setup**. Run `tiangong-lca auth login` from a trusted terminal and finish authorization in your browser. The CLI bundles the public Production project URL, publishable key, CLI OAuth client ID, registered loopback callback, and region as one profile in `src/lib/env.ts`. These are application configuration, not user credentials; no client secret is used. Skills and external consumers must reuse the CLI rather than copy this profile.
+
+Before the first login, `auth status --json` and `auth doctor-auth --json` return `login-required` (exit 1), not a missing-client configuration error. `doctor --json` reports the public profile fields as `source: "default"`; this is configuration readiness, not proof of a logged-in user.
+
+Only Dev, self-hosted, or a custom public client needs explicit configuration. Supply the complete matching tuple from that environment's administrator:
 
 ```bash
-TIANGONG_LCA_API_BASE_URL=
-TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY=
-TIANGONG_LCA_OAUTH_CLIENT_ID=
+TIANGONG_LCA_API_BASE_URL=https://<your-project>.supabase.co/functions/v1
+TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY=<that-project-publishable-key>
+TIANGONG_LCA_OAUTH_CLIENT_ID=<that-project-registered-public-client-id>
+TIANGONG_LCA_OAUTH_REDIRECT_URI=http://127.0.0.1:49191/oauth/callback
 TIANGONG_LCA_REGION=us-east-1
 ```
 
@@ -152,9 +158,10 @@ Notes:
 
 - `TIANGONG_LCA_API_BASE_URL` accepts the project root, `/functions/v1`, or `/rest/v1`.
 - `TIANGONG_LCA_OAUTH_CLIENT_ID` is the environment-specific registered public CLI client; it is not a secret.
+- Blank public fields and the exact official Production URL aliases use the bundled profile. Any non-Production URL, client, key, or callback disables profile completion; incomplete custom configuration fails before browser/network access. An explicit custom URL cannot be combined with the known Production key or client. Changing `--base-url` also requires a matching complete environment.
 - Run `tiangong-lca auth login` once in a trusted terminal. All Edge Function and direct Supabase commands then reuse the OAuth access token and rotate the refresh token on demand.
-- For approved headless execution, set `TIANGONG_LCA_AUTH_MODE=access-token` and inject one short-lived `TIANGONG_LCA_ACCESS_TOKEN`. It is verified online, kept only in process memory, and never refreshed.
-- Transition-only compatibility uses `TIANGONG_LCA_AUTH_MODE=legacy-user-api-key` plus `TIANGONG_LCA_API_KEY`. OAuth failures never fall back to this password-equivalent credential.
+- For approved headless execution, explicitly set the destination `TIANGONG_LCA_API_BASE_URL`, its `TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY`, and `TIANGONG_LCA_AUTH_MODE=access-token`, then inject one short-lived `TIANGONG_LCA_ACCESS_TOKEN`. A token alone never selects Production. It is verified online, kept only in process memory, and never refreshed.
+- Bundled configuration does not enable implicit remote publishing. Local-first publish executor selection still requires explicit configured remote runtime; existing `--commit`, remote-lookup, identity, and approval gates are unchanged.
 
 Optional session control:
 
@@ -190,7 +197,7 @@ Use the identity receipt before a production-backed case or any later owner-draf
 tiangong-lca auth identity-receipt --expected-project-ref <project-ref> --expected-user-id <user-id> --json
 ```
 
-The command performs no dataset write. It resolves the selected OAuth, explicit headless, or transition-only legacy session, checks the canonical Supabase project, and makes a bounded live `GET /auth/v1/user`. A refreshable cached token that receives `401` or `403` may be refreshed and retried exactly once; an explicit headless access token is never refreshed. All other transport or response failures are terminal. A valid production guard requires:
+The command performs no dataset write. It resolves the selected OAuth or explicit headless session, checks the canonical Supabase project, and makes a bounded live `GET /auth/v1/user`. A refreshable cached token that receives `401` or `403` may be refreshed and retried exactly once; an explicit headless access token is never refreshed. All other transport or response failures are terminal. A valid production guard requires:
 
 - `schema` exactly `tiangong-lca.auth-identity-receipt.v1`;
 - `status: "passed"`, `operation: "current-user-read"`, and `remote_write_mode: "read-only"`;
@@ -199,14 +206,6 @@ The command performs no dataset write. It resolves the selected OAuth, explicit
 
 Calling without expectations is allowed for discovery but produces `assertions.mode: "observed"`; it is not an authorization guard. The safe display email is masked and must not be used as the account key. The receipt deliberately excludes credentials, full email, session-file details, raw response metadata, and all credential/token/path-derived fingerprints.
 
-For the explicitly authorized local production read case from a validated repository checkout, invoke the narrow TypeScript runner with a new private output directory:
-
-```text
-pnpm case:auth-identity:production -- --env-file <data-foundry-ignored-.env> --expected-project-ref <project-ref> --expected-user-id <user-id> --out-dir <new-private-case-directory>
-```
-
-The historical production-case runner remains a transition-only legacy fixture: it reads only `TIANGONG_LCA_API_BASE_URL`, `TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY`, and `TIANGONG_LCA_TEST_API_KEY`; the last is mapped to the child process's explicit legacy variable. It does not accept an alternate CLI path. The pnpm command first performs a clean TS7 build without the production env. Its plain-Node runner then single-reads source/config/lock and the freshly generated `dist/src/**/*.js`, hashes the source tree, runner, runtime, exact entrypoint, and pnpm lock, and copies those exact built buffers into a private snapshot before exposing the key. It forces reauthentication with session cache disabled, runs only the built snapshot from an exclusively created clean directory with an argv array and `shell:false`, cleans the snapshot before publishing success artifacts, and persists only the parsed receipt and case manifest. POSIX creates the case directory as `0700` and files as `0600`; Windows inherits ACLs from the caller-selected parent, so use a user-restricted parent because mode bits are not an ACL guarantee. The runner never stores raw child stdout/stderr and is intentionally not wired to CI secrets. New automation should use OAuth/headless mode instead. This receipt is locally hash-verifiable, not server-signed attestation.
-
 ## LCI/LCIA Data Release
 
 The `release` command family is the authenticated transport used by the standalone release control plane. It does not introduce a TIDAS schema variant: result packages reuse the existing Process exchange structure for LCI and the existing Process LCIA result fields, with a LifecycleModel referencing the resulting Process.

package/dist/src/cli.js

@@ -243,7 +243,8 @@ Options:
   --json            Print compact JSON; default output is pretty JSON
   -h, --help
 
-Required env:
+Official Production requires no environment configuration. Run auth login directly.
+For a custom environment, configure its complete public tuple (never mix projects):
   TIANGONG_LCA_API_BASE_URL
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
   TIANGONG_LCA_OAUTH_CLIENT_ID
@@ -287,7 +288,8 @@ Safety:
   tokens, full email addresses, session paths, or credential-derived fingerprints. Production guards
   must pass both expected assertions and require assertions.mode="intent-bound".
 
-Required env:
+Official Production uses the bundled public profile and a prior "tiangong-lca auth login".
+For a custom environment, configure:
   TIANGONG_LCA_API_BASE_URL
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
   TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
@@ -295,9 +297,6 @@ Required env:
 Headless alternative:
   TIANGONG_LCA_ACCESS_TOKEN (short-lived actor token; never cached or refreshed)
 
-Legacy compatibility:
-  TIANGONG_LCA_AUTH_MODE=legacy-user-api-key plus TIANGONG_LCA_API_KEY
-
 Optional session env:
   TIANGONG_LCA_SESSION_FILE
   TIANGONG_LCA_DISABLE_SESSION_CACHE
@@ -321,21 +320,20 @@ Options:
   --input <file>   JSON request file
   --json           Print compact JSON
   --dry-run        Print the planned HTTP request without sending it
-  --api-key <key>  Override TIANGONG_LCA_API_KEY
   --base-url <url> Override TIANGONG_LCA_API_BASE_URL
   --region <name>  Override TIANGONG_LCA_REGION
   --timeout-ms <n> Request timeout in milliseconds
   -h, --help
 
-Required env:
+Official Production: run "tiangong-lca auth login" with no env setup.
+Custom environment (complete matching tuple required):
   TIANGONG_LCA_API_BASE_URL
-  TIANGONG_LCA_API_KEY
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
+  TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
   TIANGONG_LCA_REGION (optional)
 
 Runtime note:
-  The CLI decodes TIANGONG_LCA_API_KEY as a user API key bootstrap, exchanges it for a user session,
-  and sends the resolved access token to Edge Functions.
+  The CLI resolves the OAuth session and sends only its access token to Edge Functions.
 `.trim();
 }
 function renderAdminHelp() {
@@ -346,19 +344,18 @@ Options:
   --input <file>   JSON request file
   --json           Print compact JSON
   --dry-run        Print the planned HTTP request without sending it
-  --api-key <key>  Override TIANGONG_LCA_API_KEY
   --base-url <url> Override TIANGONG_LCA_API_BASE_URL
   --timeout-ms <n> Request timeout in milliseconds
   -h, --help
 
-Required env:
+Official Production: run "tiangong-lca auth login" with no env setup.
+Custom environment (complete matching tuple required):
   TIANGONG_LCA_API_BASE_URL
-  TIANGONG_LCA_API_KEY
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
+  TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
 
 Runtime note:
-  The CLI decodes TIANGONG_LCA_API_KEY as a user API key bootstrap, exchanges it for a user session,
-  and sends the resolved access token to Edge Functions.
+  The CLI resolves the OAuth session and sends only its access token to Edge Functions.
 `.trim();
 }
 function renderLcaReleaseHelp() {
@@ -391,19 +388,19 @@ Options:
   --force                 Replace an existing output file
   --dry-run               Validate and print the masked planned request without network writes
   --json                  Print the stable compact JSON report; otherwise print Summary and Next
-  --api-key <key>         Override TIANGONG_LCA_API_KEY; environment use is preferred
   --base-url <url>        Override TIANGONG_LCA_API_BASE_URL
   --timeout-ms <n>        Request timeout in milliseconds (default 60000)
   -h, --help
 
-Required environment:
+Official Production: run "tiangong-lca auth login" with no env setup.
+Custom environment (complete matching tuple required):
   TIANGONG_LCA_API_BASE_URL
-  TIANGONG_LCA_API_KEY
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
+  TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
 
 Authorization and safety:
-  The User API key is exchanged for a user session. Database RPCs then check that the live account
-  has data_product_manager. The service-role key never enters this CLI. Large bundle projections,
+  The OAuth session identifies the live account, and Database RPCs check that it has
+  data_product_manager. The service-role key never enters this CLI. Large bundle projections,
   ZIPs, and chunks are written to files and verified against exact byte size and SHA-256.
 
 Examples:
@@ -1057,7 +1054,7 @@ Options:
   -h, --help
 
 Environment:
-  TIANGONG_LCA_API_BASE_URL, TIANGONG_LCA_API_KEY, and TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
+  Official Production profile (no env setup), or a complete custom URL/key/client; prior auth login
 
 Outputs written under --out-dir:
   - outputs/remote-verification-report.json
@@ -1273,7 +1270,7 @@ Options:
 
 Environment:
   none for local dry-run
-  TIANGONG_LCA_API_BASE_URL, TIANGONG_LCA_API_KEY, and TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
+  Official Production profile (no env setup), or a complete custom URL/key/client; prior auth login
   when --commit executes remote writes
 
 Outputs written under --out-dir:
@@ -1387,9 +1384,10 @@ Options:
   --json                Print compact JSON
   -h, --help
 
-Required env:
+Official Production: run "tiangong-lca auth login" with no env setup.
+Custom environment (complete matching tuple required):
   TIANGONG_LCA_API_BASE_URL
-  TIANGONG_LCA_API_KEY
+  TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
 
 Runtime note:
@@ -1415,9 +1413,10 @@ Options:
   --json                          Print compact JSON
   -h, --help
 
-Required env:
+Official Production: run "tiangong-lca auth login" with no env setup.
+Custom environment (complete matching tuple required):
   TIANGONG_LCA_API_BASE_URL
-  TIANGONG_LCA_API_KEY
+  TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
 
 Runtime note:
@@ -1456,9 +1455,10 @@ Options:
   --json                     Print compact JSON
   -h, --help
 
-Required env:
+Official Production: run "tiangong-lca auth login" with no env setup.
+Custom environment (complete matching tuple required):
   TIANGONG_LCA_API_BASE_URL
-  TIANGONG_LCA_API_KEY
+  TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
 
 Outputs written under --out-dir:
@@ -1503,9 +1503,10 @@ Options:
   --json                    Print compact JSON
   -h, --help
 
-Environment:
+Official Production: run "tiangong-lca auth login" with no env setup.
+Custom environment (complete matching tuple required):
   TIANGONG_LCA_API_BASE_URL
-  TIANGONG_LCA_API_KEY
+  TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
 
 Outputs written under --out-dir:
@@ -1535,7 +1536,7 @@ Options:
 
 Environment:
   none for local dry-run
-  TIANGONG_LCA_API_BASE_URL, TIANGONG_LCA_API_KEY, and TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
+  Official Production profile (no env setup), or a complete custom URL/key/client; prior auth login
   when --commit publishes prepared rows
 
 Outputs written under --out-dir:
@@ -1769,8 +1770,10 @@ Options:
   -h, --help
 
 Remote lookup env (only when process_sources.allow_remote_lookup=true):
+  Official Production uses its bundled profile and a prior "tiangong-lca auth login".
+  A custom environment requires the complete matching tuple:
   TIANGONG_LCA_API_BASE_URL
-  TIANGONG_LCA_API_KEY
+  TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
 `.trim();
 }
@@ -1800,7 +1803,7 @@ Options:
 
 Environment:
   none for local dry-run
-  TIANGONG_LCA_API_BASE_URL, TIANGONG_LCA_API_KEY, and TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
+  Official Production profile (no env setup), or a complete custom URL/key/client; prior auth login
   when --commit executes remote writes
 
 Local gate:
@@ -1964,9 +1967,10 @@ Options:
   --json               Print compact JSON
   -h, --help
 
-Required env:
+Official Production: run "tiangong-lca auth login" with no env setup.
+Custom environment (complete matching tuple required):
   TIANGONG_LCA_API_BASE_URL
-  TIANGONG_LCA_API_KEY
+  TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
 
 Runtime note:
@@ -1991,9 +1995,10 @@ Options:
   --json                          Print compact JSON
   -h, --help
 
-Required env:
+Official Production: run "tiangong-lca auth login" with no env setup.
+Custom environment (complete matching tuple required):
   TIANGONG_LCA_API_BASE_URL
-  TIANGONG_LCA_API_KEY
+  TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
 
 Runtime note:
@@ -2143,7 +2148,7 @@ Options:
 
 Environment:
   none for local dry-run
-  TIANGONG_LCA_API_BASE_URL, TIANGONG_LCA_API_KEY, and TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
+  Official Production profile (no env setup), or a complete custom URL/key/client; prior auth login
   when --commit executes remote writes
 
 Local gate:
@@ -2197,9 +2202,10 @@ Options:
   --json               Print compact JSON
   -h, --help
 
-Required env:
+Official Production: run "tiangong-lca auth login" with no env setup.
+Custom environment (complete matching tuple required):
   TIANGONG_LCA_API_BASE_URL
-  TIANGONG_LCA_API_KEY
+  TIANGONG_LCA_OAUTH_CLIENT_ID and a prior "tiangong-lca auth login"
   TIANGONG_LCA_SUPABASE_PUBLISHABLE_KEY
 
 Guardrails:
@@ -2551,7 +2557,6 @@ function parseRemoteFlags(args) {
                 json: { type: 'boolean' },
                 'dry-run': { type: 'boolean' },
                 input: { type: 'string' },
-                'api-key': { type: 'string' },
                 'base-url': { type: 'string' },
                 region: { type: 'string' },
                 'timeout-ms': { type: 'string' },
@@ -2577,7 +2582,6 @@ function parseRemoteFlags(args) {
         json: Boolean(values.json),
         dryRun: Boolean(values['dry-run']),
         inputPath: typeof values.input === 'string' ? values.input : '',
-        apiKey: typeof values['api-key'] === 'string' ? values['api-key'] : null,
         apiBaseUrl: typeof values['base-url'] === 'string' ? values['base-url'] : null,
         region: typeof values.region === 'string' ? values.region : null,
         timeoutMs,
@@ -2601,7 +2605,6 @@ function parseLcaReleaseFlags(args) {
                 'package-id': { type: 'string' },
                 'artifact-id': { type: 'string' },
                 'artifact-path': { type: 'string' },
-                'api-key': { type: 'string' },
                 'base-url': { type: 'string' },
                 'timeout-ms': { type: 'string' },
             },
@@ -2633,7 +2636,6 @@ function parseLcaReleaseFlags(args) {
         packageId: optionalString(values['package-id']),
         artifactId: optionalString(values['artifact-id']),
         artifactPath: optionalString(values['artifact-path']),
-        apiKey: optionalString(values['api-key']),
         apiBaseUrl: optionalString(values['base-url']),
         timeoutMs,
     };
@@ -5705,7 +5707,6 @@ function applyRemoteOverrides(env, overrides) {
     return {
         ...env,
         TIANGONG_LCA_API_BASE_URL: overrides.apiBaseUrl ?? runtimeEnv.apiBaseUrl ?? undefined,
-        TIANGONG_LCA_API_KEY: overrides.apiKey ?? runtimeEnv.apiKey ?? undefined,
         TIANGONG_LCA_REGION: overrides.region ?? runtimeEnv.region,
     };
 }
@@ -7934,9 +7935,6 @@ export async function executeCli(argv, deps) {
             }
             const action = requireLcaReleaseAction(subcommand);
             const env = { ...deps.env };
-            if (releaseFlags.apiKey !== null) {
-                env.TIANGONG_LCA_API_KEY = releaseFlags.apiKey;
-            }
             if (releaseFlags.apiBaseUrl !== null) {
                 env.TIANGONG_LCA_API_BASE_URL = releaseFlags.apiBaseUrl;
             }