@trillioncore/cli 1.0.0-next.11 → 1.0.0-next.13

package/README.md

@@ -4,6 +4,20 @@ The `tc` CLI signs you into Trillioncore and reads the organizations and integra
 
 **Requirements:** Node.js 22+, a browser on any device, and a Trillioncore deployment with CLI device login enabled. This is a fresh v1 preview, not v0 command parity; v0 configuration is not imported.
 
+## For agents: install and set up Trillioncore for a person
+
+When a person asks you to install or set up Trillioncore, run these steps in order:
+
+1. Ask whether they already have a Trillioncore account. For a new organization, ask what to call it.
+2. New account: `npm exec --yes --package=@trillioncore/cli@next -- tc signup --organization-name '<name>'`.
+   Existing account, new organization: `... tc create-organization --name '<name>'`.
+   Existing account and organization: `... tc login`.
+3. The command waits up to five minutes for the browser. Run it in the background with output to a file, and add `--no-browser` when the person's browser is on another machine. Read the URL and the separate eight-character code from the output and relay both to the person. They sign up with their provider (for example Google or Microsoft), confirm the organization name, enter the code, and choose access. Wait for the command to print `Signed in`.
+4. Run `tc whoami --json` to confirm the identity.
+5. Relay the printed `Next:` link. The person connects data sources under Integrations in the app. Then use `tc index`, `tc search`, and `tc get`.
+
+Do not ask the person for tokens, passwords, or the verification code in chat. They enter the code only in their browser. Creating an organization makes the person its administrator; it does not approve CLI access by itself.
+
 ## Get started
 
 Once `@next` is published and the hosted login rollout is enabled:
@@ -20,13 +34,15 @@ npm exec --yes --package=@trillioncore/cli@next -- tc logout
 
 `tc login` registers a five-minute request and prints a browser URL plus a separate eight-character code. Open the URL on any device and enter the code shown in your terminal. Keep the code private and approve only a login you started. The CLI polls without a callback listener, tunnel, or copied token. After approval it verifies your identity, saves the private session, and acknowledges delivery.
 
-Browser sign-in lets you choose one or more organizations and explicitly select enabled accounts within each. Membership alone does not authorize a CLI connection; current organization and account permissions still apply. For a brand-new account, finish organization setup and connect your integrations in the app, then rerun `tc login` if prompted. No provider reconnection is required just to authorize the CLI.
+Browser sign-in lets you choose one or more organizations and explicitly select enabled accounts within each. Membership alone does not authorize a CLI connection; current organization and account permissions still apply. For a brand-new account, use `tc signup`; the browser asks for an organization name and continues without a rerun. No provider reconnection is required just to authorize the CLI.
 
 Prefer `npm exec` during evaluation. `npm install -g @trillioncore/cli@next` replaces your local `tc` executable, even though publishing `next` does not change the npm `latest` tag.
 
 ## Commands
 
 - `login [--no-browser] [--api-url <origin>]`: browser authorization, organization/account selection, and durable local session storage.
+- `signup [--organization-name <name>] [--no-browser] [--api-url <origin>]`: create an account on the sign-up screen, name a new organization (you become its administrator), then finish the same device approval as `login`.
+- `create-organization [--name <name>] [--no-browser] [--api-url <origin>]`: an existing account creates another organization in the browser and becomes its administrator. The CLI then signs in through the same device approval, because a new organization needs its own approval. `tc login` also asks a signed-in person with no organization to name one.
 - `whoami [--json]`: verify the signed-in identity without printing credentials.
 - `logout`: revoke the CLI connection on the server and remove its local session. `--local-only` only forgets local credentials; use the app's **Tokens** page to revoke server access if offline.
 - `organizations [--json]`: list only currently approved organizations, with `--limit` and `--cursor` pagination.

package/dist/index.js

@@ -3405,10 +3405,22 @@ function verificationUrl(value, requestId) {
     );
   }
 }
+function organizationSetupUrl(url, options) {
+  if (!options.signUp && !options.createOrganization) return url;
+  const next = new URL(url);
+  if (options.signUp) next.pathname = "/connect/cli/sign-up";
+  else next.searchParams.set("create", "organization");
+  if (options.organizationName)
+    next.searchParams.set("name", options.organizationName);
+  return next.toString();
+}
 async function login(options = {}, environment = process.env) {
   const issuer = loginOrigin(
     options.apiUrl ?? environment.TRILLIONCORE_CLI_API_URL ?? environment.TRILLIONCORE_API_URL ?? DEFAULT_API
   );
+  const organizationName = options.organizationName?.trim();
+  if (organizationName !== void 0 && (!organizationName || organizationName.length > 100 || /[\u0000-\u001f\u007f-\u009f]/.test(organizationName)))
+    throw new Error("Organization name must be 1-100 printable characters.");
   const abort = new AbortController();
   const verifier = randomBytes2(32).toString("base64url");
   const alphabet = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ";
@@ -3475,9 +3487,9 @@ async function login(options = {}, environment = process.env) {
       () => stop("Sign-in timed out. Run tc login again."),
       deadline - Date.now()
     );
-    const authorization = verificationUrl(
-      registration.verification_uri,
-      requestId
+    const authorization = organizationSetupUrl(
+      verificationUrl(registration.verification_uri, requestId),
+      { ...options, ...organizationName ? { organizationName } : {} }
     );
     if (options.onAuthorizationUrl)
       await options.onAuthorizationUrl(authorization, userCode);
@@ -3551,7 +3563,7 @@ Only approve a login you started. Keep the code private.`
           "Signed in, but delivery acknowledgement failed. The temporary delivery expires automatically."
         )
       );
-      return { issuer, ...who };
+      return { issuer, appUrl: new URL(authorization).origin, ...who };
     } catch (error) {
       if (!persisted)
         await revoke(credentials).catch(
@@ -3651,6 +3663,12 @@ async function logout(localOnly = false, environment = process.env) {
 
 // ../../packages/types/dist/integrations.js
 var INTEGRATION_PROVIDER_DEFINITIONS = {
+  beads: {
+    description: "Issues and project work",
+    nativeRecordKinds: ["beads_issue"],
+    modelVisibility: "declared",
+    identity: { source: "externalAccountId", kind: "account-id", prefix: "Tracker ID: ", unavailable: "Tracker identity unavailable" }
+  },
   fathom: {
     description: "Meeting transcripts",
     nativeRecordKinds: ["transcript"],
@@ -3682,6 +3700,13 @@ var INTEGRATION_PROVIDER_DEFINITIONS = {
     modelVisibility: "declared",
     identity: { source: "externalAccountId", kind: "email", prefix: "", unavailable: "Account email unavailable" }
   },
+  plaid: {
+    // SQL-only: one Plaid Item (bank login) publishes accounts and transactions tables.
+    description: "Bank accounts and transactions",
+    nativeRecordKinds: [],
+    modelVisibility: "declared",
+    identity: { source: "unavailable", unavailable: "Account identity unavailable" }
+  },
   slack: {
     // Slack workspace identity is retained in the Airbyte binding. The visible local account
     // identifier is deliberately unique so an organization can keep separate connections.
@@ -3719,7 +3744,7 @@ function integrationProviderDefinition(provider) {
 }
 
 // ../../packages/types/dist/agent.js
-var AGENT_SOURCE_TYPES = ["fathom", "fireflies", "harvest", "outlook", "gmail", "slack", "postgres", "github", "google_analytics"];
+var AGENT_SOURCE_TYPES = ["fathom", "fireflies", "harvest", "outlook", "gmail", "slack", "postgres", "github", "google_analytics", "plaid", "beads"];
 var AGENT_SEARCH_FILTER_TYPES = [...AGENT_SOURCE_TYPES, "email"];
 function presentAgentIndex(result, resourceKey) {
   if (resourceKey !== void 0)
@@ -3860,6 +3885,7 @@ function agentRecovery(code) {
     join_not_approved: "This ordered join does not match exactly one approved FK. Inspect the target schemas and relationships with index. Query each approved table separately with projected columns and LIMIT, then correlate observed keys outside SQL. Similar column names do not establish a relationship.",
     dataset_unavailable: "The synchronized dataset is unavailable. Inspect account index operations and freshness; retry after a published dataset is available. Do not fall back to live.",
     forbidden: "The request is not authorized. Select an approved organization and connection; do not infer whether another resource exists.",
+    subscription_required: "This organization needs an active subscription. An administrator can start one at app.trillioncore.com. Tell the person this, and do not retry.",
     not_found: "The resource is unavailable in the authorized catalog. Return to index and use a returned path or key.",
     unsupported: "This operation is unsupported. Use the operations advertised by index.",
     unavailable: "The request could not be completed. Check arguments and access, or retry later."
@@ -4018,7 +4044,7 @@ function parseErrorEnvelope(value) {
   if (typeof record.code !== "string" || typeof record.message !== "string") {
     return null;
   }
-  if (["invalid_path", "account_required", "sql_rejected", "dataset_unavailable"].includes(record.code)) return agentRecovery(record.code);
+  if (["invalid_path", "account_required", "sql_rejected", "dataset_unavailable", "subscription_required"].includes(record.code)) return agentRecovery(record.code);
   if (!["organization_required", "invalid_input", "forbidden", "not_found", "unsupported", "unavailable"].includes(
     record.code
   )) {
@@ -4604,17 +4630,19 @@ function createProgram(overrides = {}) {
   };
   const program2 = new Command();
   program2.name("tc").description("Trillioncore CLI \u2014 authorized integration record access").version(CLI_VERSION).helpCommand(false);
-  program2.command("login").description(
-    "Sign in through your browser and choose an organization and accounts"
-  ).option("--api-url <origin>", "Trillioncore API origin").option("--no-browser", "Print the sign-in URL without opening a browser").action(async (options) => {
+  const signIn = async (options, setup = {}) => {
     try {
       const result = await login({
-        apiUrl: options.apiUrl,
-        noBrowser: options.browser === false
+        ...options.apiUrl !== void 0 ? { apiUrl: options.apiUrl } : {},
+        noBrowser: options.browser === false,
+        ...setup,
+        ...options.organizationName !== void 0 ? { organizationName: options.organizationName } : {}
       });
       console.log(
         `Signed in as ${result.email.replace(/[\u0000-\u001f\u007f-\u009f]/g, "")} to ${(result.organizationName ?? "your approved organizations").replace(/[\u0000-\u001f\u007f-\u009f]/g, "")}.`
       );
+      if (setup.signUp || setup.createOrganization)
+        console.log(`Next: connect your data sources under Integrations at ${result.appUrl}`);
       if (process.env.TRILLIONCORE_TOKEN || process.env.TRILLIONCORE_ORG_ID)
         console.error(
           "Manual token/organization environment overrides are set. Unset both to use this browser session."
@@ -4622,7 +4650,16 @@ function createProgram(overrides = {}) {
     } catch (error) {
       writeError(error, false);
     }
-  });
+  };
+  program2.command("login").description(
+    "Sign in through your browser and choose an organization and accounts"
+  ).option("--api-url <origin>", "Trillioncore API origin").option("--no-browser", "Print the sign-in URL without opening a browser").action((options) => signIn(options));
+  program2.command("signup").description(
+    "Create a Trillioncore account and organization in your browser, then sign in this CLI"
+  ).option("--api-url <origin>", "Trillioncore API origin").option("--no-browser", "Print the sign-up URL without opening a browser").option("--organization-name <name>", "Suggested organization name; the browser asks to confirm it").action((options) => signIn(options, { signUp: true }));
+  program2.command("create-organization").description(
+    "Create another organization in your browser; you become its administrator and this CLI signs in to it"
+  ).option("--name <name>", "Suggested organization name; the browser asks to confirm it").option("--api-url <origin>", "Trillioncore API origin").option("--no-browser", "Print the URL without opening a browser").action((options) => signIn({ ...options, organizationName: options.name }, { createOrganization: true }));
   program2.command("whoami").description("Verify your current CLI identity").option("-j, --json", "Output identity without credentials").action(async (options) => {
     try {
       const result = await whoami();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trillioncore/cli",
-  "version": "1.0.0-next.11",
+  "version": "1.0.0-next.13",
   "description": "Trillioncore v1 CLI: sign in and read your authorized integration records",
   "type": "module",
   "license": "MIT",