@tutorflow/cli 0.1.2 → 0.2.0

package/README.md

@@ -1,17 +1,18 @@
 # @tutorflow/cli
 
-TutorFlow CLI for creating AI-powered educational content (slides, videos, courses) and evaluating student responses from the terminal. Wraps the TutorFlow Platform API (`/v1/platform/*`).
+TutorFlow CLI for creating AI-powered educational content (slides, videos, courses) and evaluating student responses from the terminal or from AI agents. Wraps the TutorFlow Platform API (`/v1/platform/*`).
 
 - **Binary:** `tutorflow`
-- **Version:** `0.1.0`
-- **Node:** `>= 18`
-- **Package:** `@tutorflow/cli`
+- **Package:** [`@tutorflow/cli`](https://www.npmjs.com/package/@tutorflow/cli) (current version in [`package.json`](package.json))
+- **Source:** [tutorflow-io/cli](https://github.com/tutorflow-io/cli) (private)
+- **Node:** `>= 18` for runtime, `>= 20` for development (Vitest 4 requirement)
+- **Agent-friendly:** every command supports `--json` output, env-var auth (`TUTORFLOW_API_KEY`), and proper exit codes — see [Non-interactive / agent usage](#non-interactive--agent-usage)
 
 ## Installation
 
-### A. End users (other machines)
+### A. End users (recommended)
 
-Once published to npm, install globally with any package manager:
+Install globally with any package manager:
 
 ```bash
 npm  install -g @tutorflow/cli
@@ -27,119 +28,211 @@ tutorflow auth login
 tutorflow slide create "My first deck"
 ```
 
-> **One-shot use without installing** (npm 5.2+):
->
-> ```bash
-> npx @tutorflow/cli slide create "My first deck"
-> ```
-
-If you publish to a private registry (e.g. GitHub Packages or a self-hosted Verdaccio), users first authenticate to that registry and scope the `@tutorflow` namespace to it:
+**One-shot use without installing**:
 
 ```bash
-npm config set @tutorflow:registry https://npm.pkg.github.com
-npm login --scope=@tutorflow --registry=https://npm.pkg.github.com
-npm install -g @tutorflow/cli
+npx @tutorflow/cli slide create "My first deck"
 ```
 
-### B. Local development (this monorepo)
+This is the recommended path for AI agents and CI environments — no install step, always pulls the latest published version.
 
-From the monorepo root:
+### B. Local development (this repo)
 
 ```bash
+git clone https://github.com/tutorflow-io/cli.git
+cd cli
 pnpm install
-pnpm --filter @tutorflow/cli build      # tsc → ./dist
-pnpm --filter @tutorflow/cli link       # npm link → exposes `tutorflow` globally
+pnpm build
+pnpm link              # exposes the `tutorflow` binary globally
 ```
 
 Verify:
 
 ```bash
-tutorflow --version       # 0.1.0
+tutorflow --version       # matches package.json
 tutorflow --help
 ```
 
 To unlink later: `npm unlink -g @tutorflow/cli`.
 
-## Publishing
+Run from source without building:
 
-The package is **scoped** (`@tutorflow/...`), so the first publish needs `--access public` (or a paid org plan for private packages).
+```bash
+pnpm dev -- <command> [options]
+# e.g. pnpm dev -- slide list --limit 5
+```
 
-### One-time setup
+## Releasing
 
-1. Make sure you're a member of the `@tutorflow` npm org with publish rights.
-2. Login from the CLI:
+Releases are fully automated via tag-driven GitHub Actions. Auth uses **npm OIDC Trusted Publishing** — no `NPM_TOKEN` secret in CI.
 
-   ```bash
-   npm login                         # public registry
-   # or:
-   npm login --scope=@tutorflow --registry=<your-private-registry>
-   ```
+```bash
+git checkout master
+git pull
+
+npm version patch                       # 0.1.2 → 0.1.3 (or minor / major)
+git push origin master --follow-tags    # tag triggers the Release workflow
+```
 
-3. Confirm `apps/cli/package.json` has the right metadata. Recommended fields to add before the first release:
+The [`Release` workflow](.github/workflows/release.yml) runs on tags matching `v*.*.*` and:
 
-   ```json
-   {
-     "files": ["dist", "README.md"],
-     "publishConfig": { "access": "public" },
-     "repository": "https://github.com/<org>/tutorflow-monorepo",
-     "license": "UNLICENSED"
-   }
-   ```
+1. Verifies `package.json` version matches the git tag
+2. `pnpm typecheck` + `pnpm build` + `pnpm test`
+3. `npm publish --access public` (auth via OIDC)
+4. Creates a GitHub Release with auto-generated notes
 
-   The `files` allowlist keeps `src/`, `node_modules/`, and `tsconfig.json` out of the tarball.
+For full setup (npm org, Trusted Publisher config) see [RELEASING.md](RELEASING.md).
 
-### Release flow
+### Pre-release / beta
 
 ```bash
-cd apps/cli
+npm version prerelease --preid=beta     # 0.1.3 → 0.1.4-beta.0
+git push origin master --follow-tags
+```
 
-# 1. bump version (creates a git tag)
-npm version patch          # 0.1.0 → 0.1.1
-# or: npm version minor / major / prerelease --preid=beta
+**Note:** the workflow currently publishes everything to `latest`. To route beta tags to a separate dist-tag, see the snippet in [RELEASING.md](RELEASING.md#pre-release-channels).
 
-# 2. clean build
-rm -rf dist
-pnpm build
+## ⚠️ Caveats & gotchas
+
+These tripped us up during initial setup. Read before changing release infrastructure.
+
+### Versioning
+
+- **Don't hardcode the version in `src/index.ts`.** It reads `version` from [`package.json`](package.json) via `resolveJsonModule`. Hardcoding will silently lie to users via `--version` after every `npm version` bump.
+- The `prepublishOnly` script in `package.json` rebuilds `dist/` before publish. Don't skip it.
+
+### npm Trusted Publishing (OIDC)
+
+- **npm CLI must be 11.5.1+** for OIDC auth. Node 20.x ships with npm 10.x, so the workflow runs `npm install -g npm@latest` before publish. Removing that step will break publishes with a misleading `404 Not Found` (npm hides auth failures as 404s to prevent enumeration).
+- The Trusted Publisher binding at [npmjs.com/package/@tutorflow/cli/access](https://www.npmjs.com/package/@tutorflow/cli/access) hardcodes:
+  - GitHub org: `tutorflow-io`
+  - Repo: `cli`
+  - Workflow filename: `release.yml`
+  - Environment: (none)
+
+  Renaming the repo, moving the workflow file, or adding an `environment:` to the publish job will break OIDC auth until the binding is updated.
+- Local manual publishes still need a token (set `NPM_TOKEN` in `.env` or run `npm login`). Use a Granular Access Token with **"Bypass two-factor authentication (2FA)"** checked, otherwise CI/scripts get `EOTP` errors.
+
+### Provenance
+
+- `--provenance` is **disabled** in [release.yml](.github/workflows/release.yml). npm only accepts provenance attestations from **public** GitHub repos. Add `--provenance` back to the `npm publish` command when this repo goes public.
+
+### Node + tooling
+
+- **Vitest 4.x requires Node 20+** (uses `node:util.styleText`). The CI matrix dropped Node 18 for this reason. The runtime CLI itself still supports Node 18 (declared in `package.json#engines`).
+- `actions/setup-node@v4` and friends emit Node 20 deprecation warnings. They'll be force-upgraded to Node 24 on June 2, 2026.
+
+### Tarball hygiene
+
+- `tsconfig.json` excludes `**/*.test.ts` so test files don't end up in `dist/` (and therefore not in the published tarball).
+- `package.json#files` is an allowlist (`dist`, `README.md`, `LICENSE`). Anything not listed is excluded.
+- Run `npm pack --dry-run` to inspect the tarball before publish.
+
+### Source maps and a private repo
+
+The published tarball currently includes `.js.map` and `.d.ts.map` files which embed paths from the build environment. While the source itself isn't shipped, this leaks file structure. If that matters, set `sourceMap: false` and `declarationMap: false` in [tsconfig.json](tsconfig.json) before going public.
+
+## Development
 
-# 3. (optional) inspect what will be published
-npm pack --dry-run
+Run with `tsx` (no build step):
 
-# 4. publish
-npm publish --access public
+```bash
+pnpm dev -- <command> [options]
+# e.g. pnpm dev -- slide list --limit 5
 ```
 
-For pre-release channels (so end users don't auto-pull untested versions):
+Build artifacts land in `dist/` (entry: `dist/index.js`, declared in `package.json#bin`).
+
+## Non-interactive / agent usage
+
+Every command supports the contract below so AI agents and CI scripts can use the CLI without a TTY.
+
+### Auth without prompts
 
 ```bash
-npm version prerelease --preid=beta    # 0.1.1 → 0.1.2-beta.0
-npm publish --tag beta --access public
-# users install with: npm install -g @tutorflow/cli@beta
+# Option 1: env var (preferred for one-shot calls)
+TUTORFLOW_API_KEY=tf_xxx tutorflow --json slide list
+
+# Option 2: persist to ~/.tutorflow/config.json once
+tutorflow auth login --api-key tf_xxx
+tutorflow --json slide create "Photosynthesis for 5th graders" -n 12
 ```
 
-### CI publishing (sketch)
+`TUTORFLOW_API_KEY` always wins over the config file. `tutorflow auth whoami --json` reports `source: "env" | "config"` so an agent can verify which credential is active.
+
+### Machine-readable output
 
-In GitHub Actions, after `pnpm build`:
+`--json` (or `TUTORFLOW_JSON=1`) makes every command emit a single JSON line on stdout. Errors emit JSON to stderr.
 
-```yaml
-- run: echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc
-- run: npm publish --access public
-  working-directory: apps/cli
-  env:
-    NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+```bash
+$ tutorflow --json auth whoami
+{"authenticated":true,"apiKeyPreview":"tf_xxxxxxx...","baseUrl":"https://api.tutorflow.io","source":"env"}
+
+$ tutorflow --json auth whoami    # without auth
+# stdout: (empty)
+# stderr: {"error":{"message":"Not authenticated","code":"EAUTH"}}
+# exit:   1
 ```
 
-Trigger on tags matching `cli-v*` or use `changesets` for monorepo-aware versioning.
+List commands return raw arrays:
 
-## Development
+```bash
+$ tutorflow --json slide list --limit 3
+[{"id":"...","title":"...","status":"ready","createdAt":"..."},...]
+```
 
-Run with `tsx` (no build step):
+Pipe into `jq` for downstream automation:
 
 ```bash
-pnpm --filter @tutorflow/cli dev -- <command> [options]
-# e.g. pnpm --filter @tutorflow/cli dev -- slide list --limit 5
+tutorflow --json slide list --status ready | jq -r '.[].id' | xargs -I{} tutorflow --json slide get {}
 ```
 
-Build artifacts land in `apps/cli/dist/` (entry: `dist/index.js`, declared in `package.json#bin`).
+### Exit codes
+
+| Code  | Meaning                                                           |
+| ----- | ----------------------------------------------------------------- |
+| `0`   | Success                                                           |
+| `1`   | Generic failure (auth, network, API error, etc.)                  |
+| `2`   | Bad input (invalid flag value, missing required input in non-TTY) |
+| `130` | User cancelled an interactive prompt (Ctrl+C)                     |
+
+The error JSON includes a stable `code`: `EAUTH`, `EINVAL`, `ENOINTERACTIVE`, `ENETWORK`, `EHTTP_<status>`, `ENOPREVIEW`, `ENOTFOUND`, `ECANCELLED`.
+
+### Required-input flags (no prompts)
+
+Commands that have required input expose every prompt as a flag:
+
+```bash
+# slide / video / course create — accept positional [prompt]
+tutorflow --json slide create "Photosynthesis" -n 12 -l en
+tutorflow --json video create "Newton's laws" -s 6 -r 16:9 -d 90
+tutorflow --json course create "Beginner Python" -l 10 -lang en
+
+# evaluate — every input is a flag
+tutorflow --json evaluate \
+  --type rubric \
+  --question "What is 2+2?" \
+  --student-answer "4" \
+  --expected-answer "4"
+
+# logout (skip confirmation)
+tutorflow auth logout --force
+```
+
+If a required input is missing **and** stdin is not a TTY, the command exits 2 with `ENOINTERACTIVE` and an error message naming the flag(s) to use. It never hangs waiting for input.
+
+### Globals
+
+| Flag                              | Env var                          | Effect                                          |
+| --------------------------------- | -------------------------------- | ----------------------------------------------- |
+| `--json`                          | `TUTORFLOW_JSON=1`               | JSON output to stdout, JSON errors to stderr    |
+| `--debug`                         | `DEBUG=1` or `TUTORFLOW_DEBUG=1` | Print stack traces on errors                    |
+| `--api-key <k>` (auth login only) | `TUTORFLOW_API_KEY`              | API key                                         |
+| (n/a)                             | `TUTORFLOW_BASE_URL`             | Override API base URL (staging, self-hosted)    |
+
+### MCP server
+
+A native MCP server (so agents can call tools directly without shelling out) is on the roadmap. For now, the `--json` shell contract is the recommended integration path.
 
 ## Authentication
 
@@ -403,33 +496,45 @@ class ApiClient {
 ## Project layout
 
 ```
-apps/cli/
-├── package.json          # bin: { tutorflow: ./dist/index.js }
+.
+├── package.json              # bin: { tutorflow: ./dist/index.js }
 ├── tsconfig.json
+├── vitest.config.ts
+├── .github/workflows/
+│   ├── ci.yml                # typecheck + build + test on PRs and master
+│   └── release.yml           # OIDC publish on v*.*.* tags
+├── RELEASING.md              # full release procedure + Trusted Publisher setup
 └── src/
-    ├── index.ts          # commander entrypoint, registers all commands
-    ├── client.ts         # undici-based ApiClient
-    ├── config.ts         # ~/.tutorflow/config.json read/write/update/delete
+    ├── index.ts              # commander entrypoint, registers all commands
+    ├── client.ts             # undici-based ApiClient
+    ├── client.test.ts
+    ├── config.ts             # ~/.tutorflow/config.json read/write/update/delete
+    ├── config.test.ts
+    ├── types.ts              # API response interfaces (SlideResource, etc.)
     ├── commands/
-    │   ├── auth.ts       # login / logout / whoami
-    │   ├── config.ts     # get / set
-    │   ├── course.ts     # create / list / open
-    │   ├── evaluate.ts   # interactive evaluation
-    │   ├── slide.ts      # create / list / open
-    │   └── video.ts      # create / list / open
+    │   ├── auth.ts           # login / logout / whoami
+    │   ├── config.ts         # get / set
+    │   ├── course.ts         # create / list / open
+    │   ├── evaluate.ts       # interactive evaluation
+    │   ├── slide.ts          # create / list / open
+    │   └── video.ts          # create / list / open
     └── utils/
-        ├── output.ts     # formatTable, formatJson
+        ├── output.ts         # formatTable, formatJson
         └── spinner.ts
 ```
 
 ## npm scripts
 
-| Script  | Command             | Purpose                      |
-| ------- | ------------------- | ---------------------------- |
-| `dev`   | `tsx src/index.ts`  | Run from source              |
-| `build` | `tsc --outDir dist` | Emit JS + `.d.ts` to `dist/` |
-| `link`  | `npm link`          | Symlink `tutorflow` globally |
-| `test`  | `jest`              | (No tests committed yet)     |
+| Script           | Command                 | Purpose                                 |
+| ---------------- | ----------------------- | --------------------------------------- |
+| `dev`            | `tsx src/index.ts`      | Run from source                         |
+| `build`          | `tsc --outDir dist`     | Emit JS + `.d.ts` to `dist/`            |
+| `link`           | `npm link`              | Symlink `tutorflow` globally            |
+| `typecheck`      | `tsc --noEmit`          | Type-check without emitting             |
+| `test`           | `vitest run`            | Run all tests once                      |
+| `test:watch`     | `vitest`                | Watch-mode tests                        |
+| `test:coverage`  | `vitest run --coverage` | Generate coverage report                |
+| `prepublishOnly` | `rm -rf dist && build`  | Auto-runs before `npm publish`          |
 
 ## Stack
 
@@ -438,4 +543,5 @@ apps/cli/
 - **HTTP:** [undici](https://github.com/nodejs/undici) `^5.27.0`
 - **Color:** [chalk](https://github.com/chalk/chalk) `^5.3.0`
 - **Browser open:** [open](https://github.com/sindresorhus/open) `^9.0.0`
+- **Tests:** [Vitest](https://vitest.dev) `^4.1.5`
 - **Dev:** TypeScript `^5.0.0`, tsx `^3.0.0`, `@types/node` `^20.0.0`

package/dist/client.d.ts

@@ -6,6 +6,12 @@ export declare class ApiClient {
     private config;
     constructor(config?: IClientConfig);
     static create(): Promise<ApiClient>;
+    /**
+     * Like `create` but throws CliError if no API key is resolvable. Use this
+     * in any command that talks to the API so we get a single, consistent
+     * "not authenticated" path.
+     */
+    static createAuthenticated(): Promise<ApiClient>;
     request<T>(method: string, endpoint: string, body?: Record<string, unknown>): Promise<T>;
     setApiKey(apiKey: string): void;
     setBaseUrl(baseUrl: string): void;

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAgB;gBAElB,MAAM,CAAC,EAAE,aAAa;WAOrB,MAAM,IAAI,OAAO,CAAC,SAAS,CAAC;IAQnC,OAAO,CAAC,CAAC,EACb,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,CAAC,CAAC;IA0Bb,SAAS,CAAC,MAAM,EAAE,MAAM;IAIxB,UAAU,CAAC,OAAO,EAAE,MAAM;CAG3B"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAqBD,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAgB;gBAElB,MAAM,CAAC,EAAE,aAAa;WAIrB,MAAM,IAAI,OAAO,CAAC,SAAS,CAAC;IAIzC;;;;OAIG;WACU,mBAAmB,IAAI,OAAO,CAAC,SAAS,CAAC;IAWhD,OAAO,CAAC,CAAC,EACb,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,CAAC,CAAC;IAuCb,SAAS,CAAC,MAAM,EAAE,MAAM;IAIxB,UAAU,CAAC,OAAO,EAAE,MAAM;CAG3B"}

package/dist/client.js

@@ -3,37 +3,70 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ApiClient = void 0;
 const undici_1 = require("undici");
 const config_1 = require("./config");
+const runtime_1 = require("./utils/runtime");
+const DEFAULT_BASE_URL = 'https://api.tutorflow.io';
+/**
+ * Resolution order (env wins so CI/agents can override config without
+ * touching ~/.tutorflow/config.json):
+ *
+ *   1. TUTORFLOW_API_KEY / TUTORFLOW_BASE_URL env vars
+ *   2. ~/.tutorflow/config.json
+ *   3. baseUrl default
+ */
+async function resolveConfig() {
+    const fileConfig = await (0, config_1.readConfig)();
+    return {
+        apiKey: process.env.TUTORFLOW_API_KEY ?? fileConfig.apiKey ?? '',
+        baseUrl: process.env.TUTORFLOW_BASE_URL ?? fileConfig.baseUrl ?? DEFAULT_BASE_URL,
+    };
+}
 class ApiClient {
     constructor(config) {
-        this.config = config || {
-            apiKey: '',
-            baseUrl: 'https://api.tutorflow.io',
-        };
+        this.config = config || { apiKey: '', baseUrl: DEFAULT_BASE_URL };
     }
     static async create() {
-        const config = await (0, config_1.readConfig)();
-        return new ApiClient({
-            apiKey: config.apiKey || '',
-            baseUrl: config.baseUrl || 'https://api.tutorflow.io',
-        });
+        return new ApiClient(await resolveConfig());
+    }
+    /**
+     * Like `create` but throws CliError if no API key is resolvable. Use this
+     * in any command that talks to the API so we get a single, consistent
+     * "not authenticated" path.
+     */
+    static async createAuthenticated() {
+        const config = await resolveConfig();
+        if (!config.apiKey) {
+            throw new runtime_1.CliError('Not authenticated. Run "tutorflow auth login --api-key <key>" or set TUTORFLOW_API_KEY.', { code: 'EAUTH', exitCode: 1 });
+        }
+        return new ApiClient(config);
     }
     async request(method, endpoint, body) {
         const url = `${this.config.baseUrl}${endpoint}`;
-        const headers = {
-            'Content-Type': 'application/json',
-            'X-API-Key': this.config.apiKey,
-        };
         const init = {
             method,
-            headers,
+            headers: {
+                'Content-Type': 'application/json',
+                'X-API-Key': this.config.apiKey,
+            },
         };
-        if (body) {
+        if (body)
             init.body = JSON.stringify(body);
+        let response;
+        try {
+            response = await (0, undici_1.fetch)(url, init);
+        }
+        catch (err) {
+            throw new runtime_1.CliError(`Network error reaching ${url}: ${err instanceof Error ? err.message : String(err)}`, { code: 'ENETWORK' });
+        }
+        const text = await response.text();
+        let data = text;
+        try {
+            data = text.length ? JSON.parse(text) : {};
+        }
+        catch {
+            // non-JSON response; keep as text
         }
-        const response = await (0, undici_1.fetch)(url, init);
-        const data = await response.json();
         if (!response.ok) {
-            throw new Error(`API Error: ${response.status} ${JSON.stringify(data)}`);
+            throw new runtime_1.CliError(`API error ${response.status}: ${typeof data === 'string' ? data : JSON.stringify(data)}`, { code: `EHTTP_${response.status}` });
         }
         return data;
     }

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":";;;AAAA,mCAAyC;AACzC,qCAAsC;AAOtC,MAAa,SAAS;IAGpB,YAAY,MAAsB;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI;YACtB,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,0BAA0B;SACpC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,MAAM;QACjB,MAAM,MAAM,GAAG,MAAM,IAAA,mBAAU,GAAE,CAAC;QAClC,OAAO,IAAI,SAAS,CAAC;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,0BAA0B;SACtD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CACX,MAAc,EACd,QAAgB,EAChB,IAA8B;QAE9B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC;QAChD,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;SAChC,CAAC;QAEF,MAAM,IAAI,GAAuE;YAC/E,MAAM;YACN,OAAO;SACR,CAAC;QAEF,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAA,cAAM,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,cAAc,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,IAAS,CAAC;IACnB,CAAC;IAED,SAAS,CAAC,MAAc;QACtB,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAC9B,CAAC;IAED,UAAU,CAAC,OAAe;QACxB,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IAChC,CAAC;CACF;AAvDD,8BAuDC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":";;;AAAA,mCAAyC;AACzC,qCAAsC;AACtC,6CAA2C;AAO3C,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AAEpD;;;;;;;GAOG;AACH,KAAK,UAAU,aAAa;IAC1B,MAAM,UAAU,GAAG,MAAM,IAAA,mBAAU,GAAE,CAAC;IACtC,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,UAAU,CAAC,MAAM,IAAI,EAAE;QAChE,OAAO,EACL,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,UAAU,CAAC,OAAO,IAAI,gBAAgB;KAC3E,CAAC;AACJ,CAAC;AAED,MAAa,SAAS;IAGpB,YAAY,MAAsB;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,MAAM;QACjB,OAAO,IAAI,SAAS,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,KAAK,CAAC,mBAAmB;QAC9B,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,kBAAQ,CAChB,yFAAyF,EACzF,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAC/B,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,OAAO,CACX,MAAc,EACd,QAAgB,EAChB,IAA8B;QAE9B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,GAAuE;YAC/E,MAAM;YACN,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;aAChC;SACF,CAAC;QACF,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAE3C,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAA,cAAM,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,kBAAQ,CAChB,0BAA0B,GAAG,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACpF,EAAE,IAAI,EAAE,UAAU,EAAE,CACrB,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,IAAI,GAAY,IAAI,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,kBAAQ,CAChB,aAAa,QAAQ,CAAC,MAAM,KAAK,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EACzF,EAAE,IAAI,EAAE,SAAS,QAAQ,CAAC,MAAM,EAAE,EAAE,CACrC,CAAC;QACJ,CAAC;QAED,OAAO,IAAS,CAAC;IACnB,CAAC;IAED,SAAS,CAAC,MAAc;QACtB,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAC9B,CAAC;IAED,UAAU,CAAC,OAAe;QACxB,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IAChC,CAAC;CACF;AA7ED,8BA6EC"}

package/dist/commands/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,wBAAgB,WAAW,IAAI,OAAO,CAoErC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAUpC,wBAAgB,WAAW,IAAI,OAAO,CAiFrC"}

package/dist/commands/auth.js

@@ -1,72 +1,75 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.authCommand = authCommand;
 const commander_1 = require("commander");
 const prompts_1 = require("@clack/prompts");
-const chalk_1 = __importDefault(require("chalk"));
 const config_1 = require("../config");
+const runtime_1 = require("../utils/runtime");
+const output_1 = require("../utils/output");
 function authCommand() {
     const auth = new commander_1.Command('auth').description('Manage authentication');
     auth
         .command('login')
         .description('Authenticate with your API key')
-        .action(async () => {
-        try {
-            const apiKey = await (0, prompts_1.password)({
-                message: 'Enter your TutorFlow API key:',
-            });
-            if (typeof apiKey === 'symbol') {
-                console.log(chalk_1.default.red('Authentication cancelled'));
-                return;
+        .option('--api-key <key>', 'API key (overrides interactive prompt; also reads TUTORFLOW_API_KEY)')
+        .action((0, runtime_1.command)(async (options) => {
+        let apiKey = options.apiKey ?? process.env.TUTORFLOW_API_KEY;
+        if (!apiKey) {
+            (0, runtime_1.requireInteractive)('Pass --api-key <key> or set TUTORFLOW_API_KEY.');
+            const result = await (0, prompts_1.password)({ message: 'Enter your TutorFlow API key:' });
+            if (typeof result === 'symbol') {
+                throw new runtime_1.CliError('Authentication cancelled', { code: 'ECANCELLED', exitCode: 130 });
             }
-            await (0, config_1.updateConfig)({ apiKey });
-            console.log(chalk_1.default.green('✓ Authentication successful!'));
-            console.log(chalk_1.default.gray(`API key saved to ~/.tutorflow/config.json`));
+            apiKey = result;
         }
-        catch (error) {
-            console.error(chalk_1.default.red('✗ Authentication failed'), error);
+        if (!apiKey || !apiKey.trim()) {
+            throw new runtime_1.CliError('API key is empty', { code: 'EINVAL', exitCode: 2 });
         }
-    });
+        await (0, config_1.updateConfig)({ apiKey });
+        (0, output_1.printStatus)('Authentication successful', 'success');
+        (0, output_1.printResult)({ ok: true, apiKeyPreview: `${apiKey.slice(0, 10)}...` });
+    }));
     auth
         .command('logout')
         .description('Remove stored credentials')
-        .action(async () => {
-        try {
-            const confirmed = await (0, prompts_1.confirm)({
-                message: 'Remove stored credentials?',
-            });
-            if (!confirmed) {
-                console.log(chalk_1.default.gray('Cancelled'));
+        .option('-f, --force', 'Skip confirmation prompt')
+        .action((0, runtime_1.command)(async (options) => {
+        if (!options.force) {
+            // In non-interactive mode require --force so we never block silently.
+            if (!process.stdin.isTTY) {
+                throw new runtime_1.CliError('Pass --force to logout in non-interactive mode.', {
+                    code: 'ENOINTERACTIVE',
+                    exitCode: 2,
+                });
+            }
+            const confirmed = await (0, prompts_1.confirm)({ message: 'Remove stored credentials?' });
+            if (!confirmed || typeof confirmed === 'symbol') {
+                (0, output_1.printStatus)('Cancelled');
                 return;
             }
-            await (0, config_1.deleteConfig)();
-            console.log(chalk_1.default.green('✓ Credentials removed'));
-        }
-        catch (error) {
-            console.error(chalk_1.default.red('✗ Failed to logout'), error);
         }
-    });
+        await (0, config_1.deleteConfig)();
+        (0, output_1.printStatus)('Credentials removed', 'success');
+        if ((0, runtime_1.isJsonMode)())
+            (0, output_1.printResult)({ ok: true });
+    }));
     auth
         .command('whoami')
         .description('Show current authenticated workspace')
-        .action(async () => {
-        try {
-            const config = await (0, config_1.readConfig)();
-            if (!config.apiKey) {
-                console.log(chalk_1.default.yellow('Not authenticated'));
-                return;
-            }
-            console.log(chalk_1.default.green('✓ Authenticated as:'));
-            console.log(chalk_1.default.gray(`  API Key: ${config.apiKey.slice(0, 10)}...`));
-            console.log(chalk_1.default.gray(`  Base URL: ${config.baseUrl || 'https://api.tutorflow.io'}`));
-        }
-        catch (error) {
-            console.error(chalk_1.default.red('✗ Error:'), error);
+        .action((0, runtime_1.command)(async () => {
+        const fileConfig = await (0, config_1.readConfig)();
+        const apiKey = process.env.TUTORFLOW_API_KEY ?? fileConfig.apiKey;
+        const baseUrl = process.env.TUTORFLOW_BASE_URL ?? fileConfig.baseUrl ?? 'https://api.tutorflow.io';
+        if (!apiKey) {
+            throw new runtime_1.CliError('Not authenticated', { code: 'EAUTH', exitCode: 1 });
         }
-    });
+        (0, output_1.printResult)({
+            authenticated: true,
+            apiKeyPreview: `${apiKey.slice(0, 10)}...`,
+            baseUrl,
+            source: process.env.TUTORFLOW_API_KEY ? 'env' : 'config',
+        });
+    }));
     return auth;
 }
 //# sourceMappingURL=auth.js.map