@trayai/tray-sync-cli 1.0.13 → 1.0.14

package/dist/api/resources/me.js

@@ -0,0 +1,14 @@
+import { AuthError } from "../errors.js";
+export async function getMe(client) {
+    try {
+        const body = (await client.request("GET", "/v1/me"));
+        const user = body.data ?? body;
+        return { id: user.id, email: user.email, name: user.name };
+    }
+    catch (err) {
+        if (err instanceof AuthError)
+            return null;
+        throw err;
+    }
+}
+//# sourceMappingURL=me.js.map

package/dist/commands/api/api.js

@@ -1,7 +1,11 @@
 import { Command } from "commander";
 import { projectCommand } from "./project.js";
 import { workflowCommand } from "./workflow.js";
+import { loginCommand } from "./login.js";
+import { logoutCommand } from "./logout.js";
 export const apiCommand = new Command("api").description("Direct, authenticated access to the Tray API");
 apiCommand.addCommand(projectCommand);
 apiCommand.addCommand(workflowCommand);
+apiCommand.addCommand(loginCommand);
+apiCommand.addCommand(logoutCommand);
 //# sourceMappingURL=api.js.map

package/dist/commands/api/login.js

@@ -0,0 +1,91 @@
+import { Command } from "commander";
+import { parseRegion } from "../../lib/regionParsing.js";
+import { generatePkcePair, generateState, authorizeUrl, exchangeAuthorizationCode, oauthClientId, OAUTH_SCOPE, apiResource } from "../../lib/oauth.js";
+import { startCallbackServer, DEFAULT_CALLBACK_TIMEOUT_MS } from "../../lib/oauthCallbackServer.js";
+import { openInBrowser } from "../../lib/browserOpener.js";
+import { toApiSession } from "../../lib/oauthRefresh.js";
+import { createApiSessionStore } from "../../lib/apiSessionStore.js";
+import { getMe } from "../../api/resources/me.js";
+import { createTrayClientForRegion } from "../../api/trayClient.js";
+import { FAILURE_ICON, SUCCESS_ICON } from "../../views/icons.js";
+export async function runApiLogin(deps, options) {
+    const { stdout, stderr } = deps;
+    if (!deps.isInteractive()) {
+        stderr(`${FAILURE_ICON} "tray api login" needs an interactive terminal: it opens a browser and waits for you to sign in. Run it directly in your terminal.`);
+        return 1;
+    }
+    const { region } = options;
+    const { verifier, challenge } = generatePkcePair();
+    const state = generateState();
+    const controller = new AbortController();
+    const onSigint = () => controller.abort();
+    const server = await deps.startCallback({
+        expectedState: state,
+        timeoutMs: DEFAULT_CALLBACK_TIMEOUT_MS,
+        signal: controller.signal,
+    });
+    process.once("SIGINT", onSigint);
+    try {
+        const url = new URL(authorizeUrl(region));
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", oauthClientId(region));
+        url.searchParams.set("redirect_uri", server.redirectUri);
+        url.searchParams.set("scope", OAUTH_SCOPE);
+        url.searchParams.set("resource", apiResource(region));
+        url.searchParams.set("state", state);
+        url.searchParams.set("code_challenge", challenge);
+        url.searchParams.set("code_challenge_method", "S256");
+        const authorizeUrlString = url.toString();
+        try {
+            await deps.openBrowser(authorizeUrlString);
+            stdout(`\n  Opened your browser to sign in to Tray (${region}).`);
+            stdout(`  Didn't open? Visit:\n\n      ${authorizeUrlString}\n`);
+        }
+        catch {
+            stdout(`\n  Couldn't open a browser automatically. To sign in, visit:\n\n      ${authorizeUrlString}\n`);
+        }
+        stdout("  Waiting for you to sign in... (Ctrl-C to cancel)");
+        const code = await server.waitForCode();
+        const pair = await deps.exchangeCode({
+            region,
+            code,
+            redirectUri: server.redirectUri,
+            codeVerifier: verifier,
+        });
+        const client = deps.createClient(region, pair.accessToken);
+        const user = await getMe(client);
+        if (user === null) {
+            stderr(`${FAILURE_ICON} Tray rejected the token from the browser sign-in. Run "tray api login" to try again.`);
+            return 1;
+        }
+        await deps.store.withLock(() => deps.store.set(toApiSession(region, pair, deps.now())));
+        const label = user.email ?? user.name ?? user.id ?? "your account";
+        stdout(`${SUCCESS_ICON} Logged in as ${label} (${region}).`);
+        return 0;
+    }
+    finally {
+        process.removeListener("SIGINT", onSigint);
+        await server.close();
+    }
+}
+function realDeps() {
+    return {
+        env: process.env,
+        stdout: (line) => console.log(line),
+        stderr: (line) => console.error(line),
+        store: createApiSessionStore(),
+        createClient: createTrayClientForRegion,
+        isInteractive: () => Boolean(process.stdin.isTTY && process.stdout.isTTY),
+        openBrowser: openInBrowser,
+        startCallback: startCallbackServer,
+        exchangeCode: exchangeAuthorizationCode,
+        now: Date.now,
+    };
+}
+export const loginCommand = new Command("login")
+    .description("Sign in via browser (OAuth2) and store the token for tray api commands")
+    .requiredOption("-r, --region <region>", "Tray region to sign in to", parseRegion)
+    .action(async (opts) => {
+    process.exitCode = await runApiLogin(realDeps(), { region: opts.region });
+});
+//# sourceMappingURL=login.js.map

package/dist/commands/api/logout.js

@@ -0,0 +1,39 @@
+import { Command } from "commander";
+import { revokeToken } from "../../lib/oauth.js";
+import { createApiSessionStore } from "../../lib/apiSessionStore.js";
+import { SUCCESS_ICON, INFO_ICON } from "../../views/icons.js";
+export async function runApiLogout(deps) {
+    const { stdout, store } = deps;
+    const session = await store.withLock(async () => {
+        const current = await store.get();
+        await store.clear();
+        return current;
+    });
+    if (!session) {
+        stdout(`${INFO_ICON} Not logged in.`);
+        return 0;
+    }
+    if (session.method === "oauth") {
+        try {
+            await deps.revokeToken(session.region, session.token);
+        }
+        catch {
+        }
+    }
+    stdout(`${SUCCESS_ICON} Logged out (${session.region}).`);
+    return 0;
+}
+function realDeps() {
+    return {
+        stdout: (line) => console.log(line),
+        stderr: (line) => console.error(line),
+        store: createApiSessionStore(),
+        revokeToken,
+    };
+}
+export const logoutCommand = new Command("logout")
+    .description("Log out of tray api (remove the stored token and revoke it server-side)")
+    .action(async () => {
+    process.exitCode = await runApiLogout(realDeps());
+});
+//# sourceMappingURL=logout.js.map

package/dist/commands/api/project.js

@@ -21,7 +21,7 @@ function parseProjectId(value) {
     return value;
 }
 export async function runProjectRollback(deps, options) {
-    const client = apiClientFor(deps, options);
+    const client = await apiClientFor(deps, options);
     await rollbackProject(client, options.projectId, options.versionNumber);
     if (options.format === OutputFormats.JSON) {
         printConfirmationJson(deps.stdout, {
@@ -36,7 +36,7 @@ export async function runProjectRollback(deps, options) {
     return 0;
 }
 export async function runProjectVersionList(deps, options) {
-    const client = apiClientFor(deps, options);
+    const client = await apiClientFor(deps, options);
     const result = await listProjectVersions(client, options.projectId, {
         last: options.limit ?? DEFAULT_VERSION_LIST_LIMIT,
     });

package/dist/commands/api/shared.js

@@ -1,5 +1,6 @@
 import { createTrayClientForRegion } from "../../api/trayClient.js";
-import { resolveApiRegion, resolveApiToken } from "../../lib/apiAuth.js";
+import { resolveApiCredentials } from "../../lib/apiAuth.js";
+import { createApiSessionStore } from "../../lib/apiSessionStore.js";
 import { parseRegion } from "../../lib/regionParsing.js";
 import { OutputFormats, parseFormat } from "../../lib/outputFormat.js";
 import { FAILURE_ICON } from "../../views/icons.js";
@@ -9,6 +10,7 @@ export function realDeps() {
         createClient: createTrayClientForRegion,
         stdout: (line) => console.log(line),
         stderr: (line) => console.error(line),
+        apiSessionStore: createApiSessionStore(),
     };
 }
 export function addCommonApiOptions(command) {
@@ -27,9 +29,13 @@ export async function runApiAction(deps, run) {
         process.exitCode = 1;
     }
 }
-export function apiClientFor(deps, options) {
-    const token = resolveApiToken({ tokenFlag: options.token, env: deps.env });
-    const region = resolveApiRegion({ regionFlag: options.region, env: deps.env });
+export async function apiClientFor(deps, options) {
+    const { token, region } = await resolveApiCredentials({
+        tokenFlag: options.token,
+        regionFlag: options.region,
+        env: deps.env,
+        store: deps.apiSessionStore,
+    });
     return deps.createClient(region, token);
 }
 //# sourceMappingURL=shared.js.map

package/dist/commands/api/workflow.js

@@ -9,7 +9,7 @@ import { FAILURE_ICON } from "../../views/icons.js";
 import { COMMAND_COLOR } from "../../views/help.js";
 import { addCommonApiOptions, apiClientFor, realDeps, runApiAction, } from "./shared.js";
 async function runWorkflowSetEnabled(deps, options, enabled) {
-    const client = apiClientFor(deps, options);
+    const client = await apiClientFor(deps, options);
     await setWorkflowEnabled(client, options.workflowId, enabled);
     if (options.format === OutputFormats.JSON) {
         printConfirmationJson(deps.stdout, { workflowId: options.workflowId, enabled });
@@ -26,7 +26,7 @@ export async function runWorkflowDisable(deps, options) {
     return runWorkflowSetEnabled(deps, options, false);
 }
 export async function runWorkflowShow(deps, options) {
-    const client = apiClientFor(deps, options);
+    const client = await apiClientFor(deps, options);
     const workflow = await getWorkflow(client, options.workflowId);
     if (options.format === OutputFormats.JSON) {
         deps.stdout(JSON.stringify(workflow, null, 2));
@@ -37,7 +37,7 @@ export async function runWorkflowShow(deps, options) {
     return 0;
 }
 export async function runWorkflowDelete(deps, options) {
-    const client = apiClientFor(deps, options);
+    const client = await apiClientFor(deps, options);
     await deleteWorkflow(client, options.workflowId);
     if (options.format === OutputFormats.JSON) {
         printConfirmationJson(deps.stdout, { workflowId: options.workflowId, deleted: true });
@@ -52,7 +52,7 @@ export async function runWorkflowEdit(deps, options) {
         deps.stderr(`${FAILURE_ICON} Nothing to edit — payload has no fields.`);
         return 1;
     }
-    const client = apiClientFor(deps, options);
+    const client = await apiClientFor(deps, options);
     await updateWorkflowUnversioned(client, options.workflowId, options.payload);
     if (options.format === OutputFormats.JSON) {
         printConfirmationJson(deps.stdout, { workflowId: options.workflowId, edited: true });

package/dist/lib/apiAuth.js

@@ -1,12 +1,15 @@
+import ansis from "ansis";
 import { REGIONS, PUBLIC_REGIONS } from "./regionParsing.js";
 import { describeRegion } from "./regionDisplay.js";
+import { createApiSessionStore } from "./apiSessionStore.js";
+import { getValidApiSession } from "./oauthRefresh.js";
 export function resolveApiToken(options) {
     const { tokenFlag, env = process.env } = options;
     if (tokenFlag)
         return tokenFlag;
     if (env.TRAY_API_TOKEN)
         return env.TRAY_API_TOKEN;
-    throw new Error("No API token provided. Pass -t/--token <token> or set TRAY_API_TOKEN.");
+    throw new Error(`Not authenticated. Run ${ansis.bold("tray api login -r <region>")} to sign in, pass ${ansis.bold("-t/--token <token>")}, or set the ${ansis.bold("TRAY_API_TOKEN")} environment variable in your terminal.`);
 }
 export function resolveApiRegion(options) {
     const { regionFlag, env = process.env } = options;
@@ -19,9 +22,29 @@ export function resolveApiRegion(options) {
         }
         return envRegion;
     }
-    throw new Error("No region provided. Pass -r/--region <region> or set TRAY_API_REGION.");
+    throw new Error(`No region provided. Run ${ansis.bold("tray api login -r <region>")} to sign in, pass ${ansis.bold("-r/--region <region>")}, or set the ${ansis.bold("TRAY_API_REGION")} environment variable in your terminal.`);
 }
 export function isApiEnabled(env = process.env) {
     return env.TRAY_CLI_API_ENABLE === "true";
 }
+export async function resolveApiCredentials(options) {
+    const { tokenFlag, regionFlag, env = process.env } = options;
+    if (tokenFlag && regionFlag) {
+        return { token: tokenFlag, region: regionFlag };
+    }
+    if (tokenFlag || regionFlag) {
+        return {
+            token: resolveApiToken({ tokenFlag, env }),
+            region: resolveApiRegion({ regionFlag, env }),
+        };
+    }
+    const store = options.store ?? createApiSessionStore();
+    const session = await getValidApiSession(store);
+    if (session)
+        return session;
+    return {
+        token: resolveApiToken({ env }),
+        region: resolveApiRegion({ env }),
+    };
+}
 //# sourceMappingURL=apiAuth.js.map

package/dist/lib/apiSessionStore.js

@@ -0,0 +1,104 @@
+import { mkdir, open, readFile, rename, unlink } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { homedir } from "node:os";
+import { join, dirname } from "node:path";
+import { lock } from "proper-lockfile";
+import { REGIONS } from "./regionParsing.js";
+import { upsertDotEnv, removeDotEnvKey, readDotEnvKey } from "./dotenvEdit.js";
+const KEY_TOKEN = "TCLI_TOKEN";
+const KEY_REGION = "TCLI_REGION";
+const KEY_REFRESH_TOKEN = "TCLI_REFRESH_TOKEN";
+const KEY_EXPIRES_AT = "TCLI_TOKEN_EXPIRES_AT";
+const KEY_METHOD = "TCLI_TOKEN_METHOD";
+export function defaultApiSessionPath(env = process.env) {
+    return env.TRAY_CONFIG_PATH ?? join(homedir(), ".tray.config");
+}
+function writeOptionalKey(source, key, value) {
+    return value !== undefined ? upsertDotEnv(source, key, value) : removeDotEnvKey(source, key);
+}
+async function readFileOrEmpty(path) {
+    try {
+        return await readFile(path, "utf-8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return "";
+        throw err;
+    }
+}
+async function writeFileAtomic(path, content) {
+    await mkdir(dirname(path), { recursive: true });
+    const tmp = `${path}.${randomUUID()}.tmp`;
+    try {
+        const fh = await open(tmp, "w", 0o600);
+        try {
+            await fh.writeFile(content, "utf-8");
+            await fh.sync();
+        }
+        finally {
+            await fh.close();
+        }
+        await rename(tmp, path);
+    }
+    catch (err) {
+        await unlink(tmp).catch(() => { });
+        throw err;
+    }
+}
+export function createApiSessionStore(path = defaultApiSessionPath()) {
+    async function setSession(session) {
+        let source = await readFileOrEmpty(path);
+        source = upsertDotEnv(source, KEY_TOKEN, session.token);
+        source = upsertDotEnv(source, KEY_REGION, session.region);
+        source = writeOptionalKey(source, KEY_REFRESH_TOKEN, session.refreshToken);
+        source = writeOptionalKey(source, KEY_EXPIRES_AT, session.expiresAt !== undefined ? String(session.expiresAt) : undefined);
+        source = writeOptionalKey(source, KEY_METHOD, session.method);
+        await writeFileAtomic(path, source);
+    }
+    return {
+        async get() {
+            const source = await readFileOrEmpty(path);
+            const token = readDotEnvKey(source, KEY_TOKEN);
+            const regionRaw = readDotEnvKey(source, KEY_REGION);
+            if (!token || !regionRaw || !REGIONS.includes(regionRaw))
+                return null;
+            const region = regionRaw;
+            const refreshToken = readDotEnvKey(source, KEY_REFRESH_TOKEN) ?? undefined;
+            const expiresAtRaw = readDotEnvKey(source, KEY_EXPIRES_AT);
+            let expiresAt;
+            if (expiresAtRaw) {
+                const parsed = Number(expiresAtRaw);
+                if (Number.isFinite(parsed))
+                    expiresAt = parsed;
+            }
+            const methodRaw = readDotEnvKey(source, KEY_METHOD);
+            const method = methodRaw === "oauth" ? "oauth" : undefined;
+            return { token, region, refreshToken, expiresAt, method };
+        },
+        set: setSession,
+        async clear() {
+            let source = await readFileOrEmpty(path);
+            source = removeDotEnvKey(source, KEY_TOKEN);
+            source = removeDotEnvKey(source, KEY_REGION);
+            source = removeDotEnvKey(source, KEY_REFRESH_TOKEN);
+            source = removeDotEnvKey(source, KEY_EXPIRES_AT);
+            source = removeDotEnvKey(source, KEY_METHOD);
+            await writeFileAtomic(path, source);
+        },
+        async withLock(fn) {
+            await mkdir(dirname(path), { recursive: true });
+            const release = await lock(path, {
+                realpath: false,
+                stale: 60_000,
+                retries: { retries: 35, minTimeout: 100, maxTimeout: 2_000 },
+            });
+            try {
+                return await fn();
+            }
+            finally {
+                await release();
+            }
+        },
+    };
+}
+//# sourceMappingURL=apiSessionStore.js.map

package/dist/lib/browserOpener.js

@@ -0,0 +1,24 @@
+export class BrowserOpenError extends Error {
+    cause;
+    constructor(message, cause) {
+        super(message);
+        this.cause = cause;
+        this.name = "BrowserOpenError";
+    }
+}
+export async function openInBrowser(url) {
+    let open;
+    try {
+        open = (await import("open")).default;
+    }
+    catch (err) {
+        throw new BrowserOpenError("Could not load the browser opener. Open the printed URL manually.", err);
+    }
+    try {
+        await open(url);
+    }
+    catch (err) {
+        throw new BrowserOpenError("Could not open a browser automatically. Open the printed URL manually.", err);
+    }
+}
+//# sourceMappingURL=browserOpener.js.map

package/dist/lib/dotenvEdit.js

@@ -0,0 +1,31 @@
+import { parse as dotenvParse } from "dotenv";
+function detectEol(source) {
+    return source.includes("\r\n") ? "\r\n" : "\n";
+}
+function escapeKey(key) {
+    return key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+export function upsertDotEnv(source, key, value) {
+    if (/[\r\n]/.test(value)) {
+        throw new Error(`Refusing to write a value containing a newline for ${key}`);
+    }
+    const eol = detectEol(source);
+    const line = `${key}=${value}`;
+    const re = new RegExp(`^${escapeKey(key)}=.*$`, "m");
+    if (re.test(source)) {
+        return source.replace(re, line);
+    }
+    if (source.length === 0)
+        return line + eol;
+    const endsWithNewline = source.endsWith("\n") || source.endsWith("\r");
+    return source + (endsWithNewline ? "" : eol) + line + eol;
+}
+export function removeDotEnvKey(source, key) {
+    const re = new RegExp(`^${escapeKey(key)}=.*(?:\\r?\\n)?`, "m");
+    return source.replace(re, "");
+}
+export function readDotEnvKey(source, key) {
+    const parsed = dotenvParse(source);
+    return Object.prototype.hasOwnProperty.call(parsed, key) ? parsed[key] : null;
+}
+//# sourceMappingURL=dotenvEdit.js.map

package/dist/lib/oauth.js

@@ -0,0 +1,125 @@
+import { createHash, randomBytes } from "node:crypto";
+import { urlsForRegion } from "./region.js";
+import { NetworkError, IncompatibleApiError } from "../api/errors.js";
+const AUTHORIZE_PATH = "/server/oauth2/authorize";
+const TOKEN_PATH = "/server/oauth2/token";
+const REVOKE_PATH = "/server/oauth2/revoke";
+export const OAUTH_SCOPE = "api:full";
+export function oauthClientId(region) {
+    return `${urlsForRegion(region).authBaseUrl}/client/oauth2/tray-cli-client-metadata`;
+}
+export function authorizeUrl(region) {
+    return `${urlsForRegion(region).authBaseUrl}${AUTHORIZE_PATH}`;
+}
+export function tokenEndpoint(region) {
+    return `${urlsForRegion(region).authBaseUrl}${TOKEN_PATH}`;
+}
+export function revokeEndpoint(region) {
+    return `${urlsForRegion(region).authBaseUrl}${REVOKE_PATH}`;
+}
+export function generatePkcePair() {
+    const verifier = randomBytes(32).toString("base64url");
+    const challenge = createHash("sha256").update(verifier).digest("base64url");
+    return { verifier, challenge };
+}
+export function generateState() {
+    return randomBytes(16).toString("base64url");
+}
+export function apiResource(region) {
+    const api = urlsForRegion(region).apiBaseUrl;
+    return api.endsWith("/") ? api : `${api}/`;
+}
+export class OAuthTokenError extends Error {
+    errorCode;
+    status;
+    constructor(message, errorCode, status) {
+        super(message);
+        this.errorCode = errorCode;
+        this.status = status;
+        this.name = "OAuthTokenError";
+    }
+    get requiresReauth() {
+        return this.errorCode === "invalid_grant";
+    }
+}
+function isOAuthErrorBody(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        typeof value.error === "string");
+}
+function isTokenResponse(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const body = value;
+    return (typeof body.access_token === "string" &&
+        body.access_token.length > 0 &&
+        typeof body.refresh_token === "string" &&
+        body.refresh_token.length > 0 &&
+        typeof body.expires_in === "number" &&
+        body.expires_in > 0);
+}
+async function requestTokenPair(endpoint, form, fetchImpl) {
+    let response;
+    try {
+        response = await fetchImpl(endpoint, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams(form),
+            signal: AbortSignal.timeout(30_000),
+        });
+    }
+    catch (err) {
+        throw new NetworkError(`Request to ${endpoint} failed: ${err.message}`);
+    }
+    const text = await response.text();
+    let body;
+    try {
+        body = text === "" ? undefined : JSON.parse(text);
+    }
+    catch {
+        throw new IncompatibleApiError(`Could not parse response from ${endpoint}`);
+    }
+    if (!response.ok) {
+        if (isOAuthErrorBody(body)) {
+            throw new OAuthTokenError(`Tray login service rejected the request (${body.error}${body.error_description ? `: ${body.error_description}` : ""}).`, body.error, response.status);
+        }
+        throw new OAuthTokenError(`Tray login service returned HTTP ${response.status}.`, undefined, response.status);
+    }
+    if (!isTokenResponse(body)) {
+        throw new OAuthTokenError("Tray login service returned an unexpected token response.");
+    }
+    return {
+        accessToken: body.access_token,
+        refreshToken: body.refresh_token,
+        expiresInSeconds: body.expires_in,
+    };
+}
+export function exchangeAuthorizationCode(params) {
+    return requestTokenPair(tokenEndpoint(params.region), {
+        grant_type: "authorization_code",
+        code: params.code,
+        redirect_uri: params.redirectUri,
+        client_id: oauthClientId(params.region),
+        code_verifier: params.codeVerifier,
+    }, params.fetchImpl ?? fetch);
+}
+export function refreshAccessToken(params) {
+    return requestTokenPair(tokenEndpoint(params.region), {
+        grant_type: "refresh_token",
+        refresh_token: params.refreshToken,
+        client_id: oauthClientId(params.region),
+    }, params.fetchImpl ?? fetch);
+}
+export async function revokeToken(region, token, fetchImpl = fetch) {
+    await fetchImpl(revokeEndpoint(region), {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            token,
+            token_type_hint: "access_token",
+            client_id: oauthClientId(region),
+        }),
+        signal: AbortSignal.timeout(15_000),
+    });
+}
+//# sourceMappingURL=oauth.js.map