@ultikits/cli 1.2.0 → 2.0.1

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # Changelog
 
+## [2.0.1]
+
+### Changed
+
+- Release workflow now uses npm staged publishing via trusted publishing; no functional change. A tagged release
+  is staged on npm and becomes installable once a maintainer approves it on npmjs.com with 2FA.
+
+## [2.0.0]
+
+### Breaking
+
+- **Requires the new UltiCloud backend.** This version only talks to the UltiCloud machine API (`/v1/...`). It is
+  published on UltiCloud cutover day, after the production smoke passes. Versions 1.x stop working against
+  `https://api.ultikits.com` once the cutover has happened, so upgrade with `npm install -g @ultikits/cli@latest`
+  and run `ultikits login` again. Do not upgrade before the cutover: 2.0.0 does not work against the old backend.
+
+### Changed
+
+- **UltiCloud developer-client contract 1.1.0.** 对接 UltiCloud 机器客户端契约 1.1.0；识别已撤回版本的新状态，并在上传非 ZIP/JAR 文件时提示检查构建产物路径。
+- **UltiCloud API.** Every command now uses the UltiCloud machine API (`/v1/...`). Log in again: 1.x credentials and
+  developer access tokens do not work with it.
+- **Login** uses device authorization in the browser (`ultikits login`) or a `ucd_` developer key
+  (`ultikits login --token`, `ULTIKITS_TOKEN`). `ULTIKITS_API_URL` / `--api-url` select the API (https only).
+- **`modules list` / `info`** read your modules through the developer API, all pages.
+- **`versions list`** reads the public catalogue without sending a credential and marks withdrawn versions.
+- **`versions delete`** is now an alias of `versions withdraw` and says that a withdrawal cannot be undone.
+
+### Added
+
+- `ultikits modules create`, `modules update`, `modules restore` and `versions withdraw` (need a manage credential).
+- `ultikits modules delete` is a recoverable delete: the CLI prints the deadline (30 days) and the
+  `ultikits modules restore <identifier>` command. The web panel has no restore.
+- Destructive commands ask for the identifier (or `<identifier>@<version>`) to be typed again; without a terminal or
+  with `-y` they require `--confirm <same string>`, and exit with code 2 before sending anything when it does not match.
+- `ultikits whoami`, `ultikits logout` (revokes a CLI credential on the server).
+- `publish` creates a missing module and resumes a version still waiting for its upload.
+
+### Removed
+
+- The pre-UltiCloud API client and its endpoints.
+
 ## 1.0.0 (2026-02-14)
 
 Initial release.

package/README.md

@@ -10,6 +10,9 @@ npm install -g @ultikits/cli
 
 Requires Node.js 18 or later.
 
+> **2.0.0 is a breaking release.** It works only with the new UltiCloud backend (`https://api.ultikits.com` after the
+> cutover). Version 1.x stops working at the cutover; upgrade and run `ultikits login` again. See [CHANGELOG](CHANGELOG.md).
+
 ## Quick Start
 
 ```bash
@@ -25,25 +28,41 @@ ultikits publish
 
 ## Authentication
 
-### Interactive login (browser)
+The CLI talks to the UltiCloud API (`https://api.ultikits.com`). It accepts two kinds of credential:
+
+| Credential | Prefix | How you get it | Scope |
+|---|---|---|---|
+| CLI credential | `ucc_` | `ultikits login` (device authorization in the browser) | always **manage** |
+| Developer key | `ucd_` | the developer centre on the panel; `ultikits login --token` or `ULTIKITS_TOKEN` | **upload** (default) or **manage**, chosen when the key is rotated |
+
+An **upload** key can list your modules, publish versions and resume uploads. Creating, updating, deleting and
+restoring a module and withdrawing a version need a **manage** credential; with an upload key those commands fail
+with "此操作需要 manage 凭据" (`key_scope_insufficient`) and send nothing else.
+
+### Interactive login (device authorization)
 
 ```bash
 ultikits login
-# Choose "Browser login (magic link)"
-# A browser window opens — approve the request
+# Prints a code and opens the panel; approve the request there.
 ```
 
-### Access token (developer portal)
+The CLI credential lasts 90 days, is listed (and can be revoked) on your account's device list, and is revoked
+when you change your password. `ultikits logout` revokes it on the server and deletes the local file.
+
+### Developer key
 
 ```bash
-ultikits login
-# Choose "Access token (from developer portal)"
-# Paste your access token from panel.ultikits.com/developer
+ultikits login --token            # prompts for the key
+ultikits login --token ucd_...    # or pass it directly
 ```
 
+`ultikits logout` only deletes the local file for a developer key; it does not revoke the key, because the same key
+usually also lives in CI.
+
 ### CI/CD (environment variable)
 
-Set the `ULTIKITS_TOKEN` environment variable with your developer access token. No `login` step is needed.
+Set `ULTIKITS_TOKEN` to a developer key; no `login` step is needed. Use an **upload**-scoped key in CI: a leaked
+upload key cannot delete or withdraw anything.
 
 ```yaml
 # GitHub Actions example
@@ -53,10 +72,33 @@ Set the `ULTIKITS_TOKEN` environment variable with your developer access token.
   run: ultikits publish --yes
 ```
 
-Credentials are stored in `~/.ultikits/credentials.json`.
+### Choosing the API
+
+`--api-url <url>` (every command) or `ULTIKITS_API_URL` selects the API, for example the staging API
+`https://api-staging.ultikits.com`. Only `https://` URLs are accepted (plain `http://` only for `127.0.0.1` and
+`localhost`). The stored login remembers the API it was made against.
+
+Credentials are stored in `~/.ultikits/credentials.json` (readable only by you). `ULTIKITS_TOKEN` wins over the file.
 
 ## Commands
 
+| Command | Credential | What it does |
+|---|---|---|
+| `ultikits create [dir]` | none | Scaffold a module project |
+| `ultikits login` / `logout` / `whoami` | — | See [Authentication](#authentication) |
+| `ultikits init` | none | Write `ultikits.json` |
+| `ultikits publish [jar]` | upload | Publish a version (creates the module first if it does not exist — that step needs manage) |
+| `ultikits modules list` / `info <id>` | upload | Your modules |
+| `ultikits modules create` | **manage** | Create a module |
+| `ultikits modules update <id>` | **manage** | Change name, short description, description, category |
+| `ultikits modules delete <id>` | **manage** | Delete; **restorable for 30 days** |
+| `ultikits modules restore <id>` | **manage** | Undo a delete within 30 days |
+| `ultikits versions list <id>` | none | Published and withdrawn versions (public catalogue) |
+| `ultikits versions withdraw <id> <version>` | **manage** | Withdraw a version; **irreversible** |
+
+Every command takes `--api-url <url>`. Exit codes: `0` success, `1` the request failed (the message says why and
+carries the server's `requestId`), `2` a usage error or a refused confirmation — nothing was sent.
+
 ### `ultikits create`
 
 Scaffold a new UltiTools module project. Interactive prompts collect module name, package name, description, author, and API version, then generate a complete project with:
@@ -81,15 +123,15 @@ The generated project compiles immediately with `mvn compile`.
 
 ### `ultikits login`
 
-Authenticate with UltiKits. Choose between browser-based magic link or pasting an access token.
+Device authorization in the browser, or `--token [ucd_...]` to store a developer key. See [Authentication](#authentication).
 
 ### `ultikits logout`
 
-Remove stored credentials.
+Delete the stored credential; a CLI credential is also revoked on the server.
 
 ### `ultikits whoami`
 
-Check current authentication status.
+Show the account, the credential in use (masked), its kind and scope, and the API.
 
 ### `ultikits init`
 
@@ -106,55 +148,104 @@ Create an `ultikits.json` project config in the current directory. Interactive p
 
 ### `ultikits publish [jar-path]`
 
-Publish a plugin module JAR to UltiCloud.
+Publish a plugin module JAR to UltiCloud. Uploading is publishing: there is no separate review step in the CLI.
 
-If no JAR path is given, automatically finds the built JAR in `./target/` (skips `-sources.jar` and `-javadoc.jar`).
-
-**Options:**
+If no JAR path is given, the built JAR in `./target/` is used (skips `-sources.jar` and `-javadoc.jar`). If the module
+does not exist yet, `publish` creates it first (needs a manage credential and a name from `--name`, `ultikits.json`
+or `plugin.yml`). If the version already exists and is still waiting for its upload, `publish` resumes the upload.
 
 | Flag | Description |
 |------|-------------|
-| `--id <string>` | Module identify string |
-| `--name <string>` | Module display name |
-| `--version <string>` | Module version |
+| `--id <identifier>` | Module identifier |
+| `--name <name>` | Display name (only used when the module has to be created) |
+| `--module-version <version>` | Version (default: `plugin.yml`) |
 | `--changelog <text>` | Version changelog |
-| `--short-description <text>` | Short description |
-| `-y, --yes` | Skip confirmation prompts |
+| `--short-description <text>` | Short description (only used when the module has to be created) |
+| `--api-url <url>` | API to publish to |
+| `-y, --yes` | Skip prompts |
 
 **Metadata resolution priority:** CLI flags > `ultikits.json` > `plugin.yml` from JAR.
 
-**Example:**
-
 ```bash
-# Auto-detect JAR and metadata from plugin.yml + ultikits.json
 ultikits publish
+ultikits publish target/MyPlugin-1.0.0.jar --module-version 1.0.1 --changelog "Bug fix"
+ultikits publish --yes          # CI
+```
+
+### `ultikits modules list` / `ultikits modules info <identifier>`
+
+List your modules (all pages), or show one of them: name, identifier, short description, category, latest version,
+downloads, last update.
+
+### `ultikits modules create`
 
-# Explicit JAR path with overrides
-ultikits publish target/MyPlugin-1.0.0.jar --version 1.0.1 --changelog "Bug fix"
+```bash
+ultikits modules create --id my.plugin --name "My Plugin" [--short-description "..."] [--category-id 3]
+```
+
+`--id`, `--name`, `--short-description` and `--category-id` default to `ultikits.json`. Needs manage.
+
+### `ultikits modules update <identifier>`
+
+```bash
+ultikits modules update my.plugin --name "New Name" --description-file README.md
+```
+
+Sends only the options given (`--name`, `--short-description`, `--description-file <path>`, `--category-id`); with none
+of them it exits 2 without sending anything. Needs manage.
+
+### `ultikits modules delete <identifier>`
+
+Deletes the module: it disappears from the catalogue, downloads and your module list at once, and is **kept for 30
+days**. On success the CLI prints the deadline and the restore command:
 
-# CI/CD mode (no prompts)
-ultikits publish --yes
 ```
+已删除 my.plugin。2026-12-01T12:00:00.000Z 前可用 ultikits modules restore my.plugin 恢复（网页面板不提供恢复）。
+```
+
+The identifier and name stay taken during those 30 days; after that the module is purged for good. The owner's
+e-mail address is notified. Deletions and withdrawals are rate-limited per account (10 per hour together).
 
-### `ultikits modules list`
+### `ultikits modules restore <identifier>`
 
-List all your published modules.
+Undoes a delete made in the last 30 days. **The web panel has no restore button — the CLI (or the API's
+`POST /v1/developer/modules/<identifier>/restore`) is the only way back.** After 30 days it reports that there is
+nothing to restore.
 
-### `ultikits modules info <identifyString>`
+### `ultikits versions list <identifier>`
 
-Show details of a specific module.
+Reads the public catalogue (no credential is sent) and lists published and withdrawn versions; withdrawn rows are
+marked `已撤回 / withdrawn`. Versions still waiting for their upload are not listed.
 
-### `ultikits modules delete <identifyString>`
+### `ultikits versions withdraw <identifier> <version>`
 
-Delete a module (with confirmation prompt).
+Withdraws a published version. **This cannot be undone**: the version stays as a read-only record, its storage is
+returned to your quota, and that version number and every lower one can never be published again. Already
+downloaded copies are not affected. `ultikits versions delete` is kept as an alias of this command and prints that it
+is an irreversible withdrawal.
 
-### `ultikits versions list <identifyString>`
+### Confirming `modules delete` and `versions withdraw`
 
-List all versions of a module.
+On a terminal the CLI asks you to type the target again: the identifier for a delete, `<identifier>@<version>` for a
+withdrawal. Anything else cancels. Without a terminal, or with `-y`, you must pass `--confirm` with exactly the same
+string (case-sensitive) — `-y` alone is refused. A refused confirmation exits with code 2 before any request is sent.
 
-### `ultikits versions delete <identifyString> <version>`
+```bash
+# CI / scripts
+ultikits modules delete my.plugin --confirm my.plugin
+ultikits versions withdraw my.plugin 1.2.3 -y --confirm my.plugin@1.2.3
+```
 
-Delete a specific version (with confirmation prompt).
+## Upgrading from 1.x
+
+- **Log in again.** 1.x credentials (`type: oauth` / `type: access_token` in `credentials.json`) and the old developer
+  access tokens do not work with the UltiCloud API. Run `ultikits login`, or put a new `ucd_` developer key into
+  `ULTIKITS_TOKEN`.
+- **`versions delete` is now a withdrawal.** It calls `versions withdraw`, which cannot be undone, and it needs
+  `--confirm <identifier>@<version>` when not answered on a terminal.
+- **`modules delete` is restorable for 30 days** and needs the identifier typed again (or `--confirm`).
+- **`publish --version` is `--module-version`.**
+- **`versions list`** shows the public catalogue: published and withdrawn versions only.
 
 ## Project Config (`ultikits.json`)
 
@@ -190,6 +281,56 @@ npm run build
 npm test
 ```
 
+## Releasing
+
+Releases are staged on npm by `.github/workflows/release.yml` through
+[npm Trusted Publishing](https://docs.npmjs.com/trusted-publishers) and
+[staged publishing](https://docs.npmjs.com/cli/v11/commands/npm-stage): the workflow's
+GitHub Actions OIDC token is exchanged for a short-lived credential, so no npm token is
+stored in the repository or its secrets. That credential can only stage a version; a
+maintainer makes it public by approving it with 2FA.
+
+1. Open a PR that bumps `version` in `package.json` (and `package-lock.json`, e.g. with
+   `npm version X.Y.Z --no-git-tag-version`) and adds the `CHANGELOG.md` entry.
+2. Merge it into `master` once CI is green.
+3. Tag the merge commit and push the tag:
+
+   ```bash
+   git checkout master && git pull
+   git tag -a vX.Y.Z -m "vX.Y.Z"
+   git push origin vX.Y.Z
+   ```
+
+4. The **Release** workflow builds, tests, refuses to continue unless the tag minus `v`
+   equals `package.json`'s version and that version is not yet on npm, upgrades npm to
+   at least 11.15.0, then runs `npm stage publish --access public`. The run's summary
+   shows the stage id. It can also be started by hand (Actions → Release → Run workflow)
+   with a `version` input that must equal `package.json`'s version.
+5. Approve the staged version: on npmjs.com open the `@ultikits/cli` package, find the
+   staged X.Y.Z, and approve it with your 2FA code (or run `npm stage approve <stage-id>`
+   while logged in). Until then the version is not installable and `latest` does not move.
+   A wrong build can be discarded with `npm stage reject <stage-id>`.
+
+### One-time npmjs.com setup
+
+On npmjs.com, open the `@ultikits/cli` package → **Settings** → **Trusted Publisher**,
+choose **GitHub Actions**, and enter:
+
+| Field | Value |
+|-------|-------|
+| Organization or user | `UltiKits` |
+| Repository | `ultikits-cli` |
+| Workflow filename | `release.yml` |
+| Environment name | *(leave empty)* |
+| Allowed command | **stage publish only** (`npm stage publish`; `npm publish` is refused) |
+
+After the first approved staged release, npm recommends setting **Settings →
+Publishing access** to "Require two-factor authentication and disallow tokens".
+
+Because this repository is private, npm does not attach a provenance attestation to
+releases ("Provenance generation is not supported for private repositories, even when
+publishing public packages"); trusted publishing itself still applies.
+
 ## License
 
 [MIT](LICENSE)

package/dist/bin/ultikits.js

@@ -12,7 +12,7 @@ const program = new Command();
 program
     .name('ultikits')
     .description('CLI for publishing UltiTools plugin modules to UltiCloud')
-    .version('1.2.0');
+    .version('2.0.1');
 registerLoginCommand(program);
 registerLogoutCommand(program);
 registerWhoamiCommand(program);
@@ -21,5 +21,7 @@ registerPublishCommand(program);
 registerModulesCommand(program);
 registerVersionsCommand(program);
 registerCreateCommand(program);
+program.addHelpText('after', '\nDeleted a module by mistake? Run `ultikits modules restore <identifier>` within 30 days\n' +
+    '(the web panel has no restore). Withdrawing a version cannot be undone.');
 program.parse();
 //# sourceMappingURL=ultikits.js.map

package/dist/src/commands/login.d.ts

@@ -1,2 +1,15 @@
 import { Command } from 'commander';
+import type { CommandDeps } from './publish.js';
+export interface LoginOptions {
+    apiUrl?: string;
+    /** --token <value>, or true for "--token" without a value (prompt). */
+    token?: string | boolean;
+}
+export interface LoginDeps extends CommandDeps {
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+    openBrowser?: (url: string) => Promise<unknown>;
+    hostname?: () => string;
+}
 export declare function registerLoginCommand(program: Command): void;
+export declare function runLogin(options: LoginOptions, deps?: LoginDeps): Promise<number>;

package/dist/src/commands/login.js

@@ -1,120 +1,141 @@
 import inquirer from 'inquirer';
 import open from 'open';
-import { writeCredentials } from '../lib/config.js';
-import { ApiClient } from '../lib/api-client.js';
-import * as log from '../lib/logger.js';
-const POLL_INTERVAL_MS = 2000;
-const API_URL = 'https://api.ultikits.com';
+import os from 'node:os';
+import path from 'node:path';
+import { DEVELOPER_KEY_PATTERN, getConfigDir, resolveApiUrl, writeCredentials } from '../lib/config.js';
+import { ApiClient, ApiError } from '../lib/api-client.js';
+import { maskCredential, redact } from '../lib/mask.js';
+import { consoleIo } from '../lib/logger.js';
+import { describeAuthError } from './whoami.js';
+/** RFC 8628: add 5 seconds to the polling interval after slow_down. */
+const SLOW_DOWN_STEP_SECONDS = 5;
 export function registerLoginCommand(program) {
     program
         .command('login')
-        .description('Authenticate with UltiKits')
-        .action(async () => {
-        const { method } = await inquirer.prompt([
-            {
-                type: 'list',
-                name: 'method',
-                message: 'How would you like to authenticate?',
-                choices: [
-                    { name: 'Browser login (magic link)', value: 'magic-link' },
-                    { name: 'Access token (from developer portal)', value: 'access-token' },
-                ],
-            },
-        ]);
-        if (method === 'magic-link') {
-            await loginWithMagicLink();
+        .description('Log in with device authorization (browser), or store a developer key with --token')
+        .option('--token [value]', 'Store a developer key (ucd_…) instead; prompts when no value is given')
+        .option('--api-url <url>', 'UltiCloud API URL (default: ULTIKITS_API_URL or https://api.ultikits.com)')
+        .action(async (options) => {
+        process.exitCode = await runLogin(options);
+    });
+}
+export async function runLogin(options, deps = {}) {
+    const io = deps.io ?? consoleIo;
+    const env = deps.env ?? process.env;
+    let apiUrl;
+    try {
+        apiUrl = resolveApiUrl(options.apiUrl, env);
+    }
+    catch (err) {
+        io.err(err.message);
+        return 1;
+    }
+    if (options.token !== undefined && options.token !== false) {
+        return loginWithDeveloperKey(apiUrl, options.token, deps);
+    }
+    return loginWithDeviceAuthorization(apiUrl, deps);
+}
+async function loginWithDeviceAuthorization(apiUrl, deps) {
+    const io = deps.io ?? consoleIo;
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const now = deps.now ?? Date.now;
+    const openBrowser = deps.openBrowser ?? ((url) => open(url));
+    const hostname = (deps.hostname ?? os.hostname)();
+    const suggestedName = `ultikits-cli on ${hostname}`.slice(0, 64);
+    const client = new ApiClient({ apiUrl });
+    let authorization;
+    try {
+        authorization = await client.deviceAuthorize(suggestedName);
+    }
+    catch (err) {
+        if (err instanceof ApiError && err.code === 'rate_limited') {
+            io.err(`请求过于频繁，请 ${err.retryAfterSeconds ?? '稍'} 秒后再运行 ultikits login。`);
         }
         else {
-            await loginWithAccessToken();
+            io.err(`无法开始登录：${err.message}`);
         }
-    });
-}
-async function loginWithMagicLink() {
-    const spin = log.spinner('Requesting authentication...');
-    spin.start();
+        return 1;
+    }
+    io.out('');
+    io.out(`  用户码 / User code: ${authorization.userCode}`);
+    io.out(`  在浏览器中确认 / Confirm in your browser: ${authorization.verificationUriComplete}`);
+    io.out('');
     try {
-        const response = await fetch(`${API_URL}/auth/cli/request`, { method: 'POST' });
-        const body = await response.json();
-        if (body.code !== '200') {
-            spin.fail('Failed to create auth request: ' + body.msg);
-            return;
+        await openBrowser(authorization.verificationUriComplete);
+    }
+    catch {
+        // No browser available; the URL is printed above.
+    }
+    io.out('等待在浏览器中确认… / Waiting for confirmation...');
+    let intervalSeconds = authorization.interval;
+    const deadline = now() + authorization.expiresIn * 1000;
+    for (;;) {
+        if (now() + intervalSeconds * 1000 > deadline) {
+            io.err('登录请求已过期，请重新运行 ultikits login。');
+            return 1;
         }
-        const { requestId, code, url } = body.data;
-        spin.stop();
-        console.log();
-        log.info(`Opening browser to authenticate...`);
-        log.info(`If it doesn't open, visit: ${url}`);
-        console.log();
+        await sleep(intervalSeconds * 1000);
         try {
-            await open(url);
-        }
-        catch {
-            // Browser didn't open — user has the URL
+            const result = await client.deviceToken(authorization.deviceCode);
+            writeCredentials({ version: 2, kind: 'cli', credential: result.credential, credentialId: result.credentialId, apiUrl }, deps.configDir);
+            io.out(`已登录，CLI 凭据 ${maskCredential(result.credential)} 已保存到 ${credentialsPath(deps)}`);
+            return 0;
         }
-        spin.text = 'Waiting for authentication...';
-        spin.start();
-        // Poll for completion
-        const deadline = Date.now() + 10 * 60 * 1000; // 10 minute timeout
-        while (Date.now() < deadline) {
-            await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
-            const pollRes = await fetch(`${API_URL}/auth/cli/poll?requestId=${requestId}`);
-            const pollBody = await pollRes.json();
-            if (pollBody.data?.status === 'completed') {
-                writeCredentials({
-                    type: 'oauth',
-                    access_token: pollBody.data.access_token,
-                    refresh_token: pollBody.data.refresh_token,
-                    expires_at: new Date(Date.now() + 3600 * 1000).toISOString(),
-                    api_url: API_URL,
-                });
-                spin.succeed('Logged in successfully');
-                log.info('Credentials saved to ~/.ultikits/credentials.json');
-                return;
+        catch (err) {
+            if (!(err instanceof ApiError)) {
+                io.err(`登录失败：${err.message}`);
+                return 1;
             }
-            if (pollBody.data?.status === 'expired') {
-                spin.fail('Authentication request expired. Run `ultikits login` again.');
-                return;
+            switch (err.code) {
+                case 'authorization_pending':
+                    continue;
+                case 'slow_down':
+                    intervalSeconds += SLOW_DOWN_STEP_SECONDS;
+                    continue;
+                case 'rate_limited':
+                    intervalSeconds = Math.max(intervalSeconds, err.retryAfterSeconds ?? intervalSeconds);
+                    continue;
+                case 'expired_token':
+                    io.err('登录请求已过期，请重新运行 ultikits login。');
+                    return 1;
+                case 'access_denied':
+                    io.err('登录已在浏览器中被拒绝。');
+                    return 1;
+                default:
+                    io.err(`登录失败：${err.message} [${err.code}]`);
+                    return 1;
             }
         }
-        spin.fail('Authentication timed out.');
-    }
-    catch (err) {
-        spin.fail('Login failed: ' + err.message);
     }
 }
-async function loginWithAccessToken() {
-    const { token } = await inquirer.prompt([
-        {
-            type: 'password',
-            name: 'token',
-            message: 'Paste your access token:',
-            mask: '●',
-        },
-    ]);
-    const spin = log.spinner('Validating token...');
-    spin.start();
+async function loginWithDeveloperKey(apiUrl, token, deps) {
+    const io = deps.io ?? consoleIo;
+    const prompt = deps.prompt ?? ((q) => inquirer.prompt(q));
+    let value = typeof token === 'string' ? token : '';
+    if (token === true) {
+        const answer = await prompt([
+            { type: 'password', name: 'token', message: 'Paste your developer key (ucd_…):', mask: '●' },
+        ]);
+        value = String(answer.token ?? '');
+    }
+    value = value.trim();
+    if (!DEVELOPER_KEY_PATTERN.test(value)) {
+        io.err('这不是开发者密钥（应为 ucd_ 开头、共 47 个字符）。请在开发者中心复制密钥，或直接运行 ultikits login。');
+        return 1;
+    }
+    const client = new ApiClient({ apiUrl, credential: value });
     try {
-        // Validate by trying to list developer modules
-        const client = new ApiClient({
-            type: 'access_token',
-            token,
-            api_url: API_URL,
-        });
-        const res = await client.get('/developer/modules');
-        if (res.code !== '200') {
-            spin.fail('Invalid token. Get yours at panel.ultikits.com/developer');
-            return;
-        }
-        writeCredentials({
-            type: 'access_token',
-            token,
-            api_url: API_URL,
-        });
-        spin.succeed('Token verified — logged in');
-        log.info('Credentials saved to ~/.ultikits/credentials.json');
+        const me = await client.whoami();
+        writeCredentials({ version: 2, kind: 'developer', credential: value, apiUrl }, deps.configDir);
+        io.out(`开发者密钥 ${maskCredential(value)} 已验证（${me.username} / ${me.developerName}），已保存到 ${credentialsPath(deps)}`);
+        return 0;
     }
     catch (err) {
-        spin.fail('Token validation failed: ' + err.message);
+        io.err(redact(describeAuthError(err, apiUrl), value));
+        return 1;
     }
 }
+function credentialsPath(deps) {
+    return path.join(deps.configDir ?? getConfigDir(), 'credentials.json');
+}
 //# sourceMappingURL=login.js.map

package/dist/src/commands/logout.d.ts

@@ -1,2 +1,4 @@
 import { Command } from 'commander';
+import type { CommandDeps } from './publish.js';
 export declare function registerLogoutCommand(program: Command): void;
+export declare function runLogout(_options: Record<string, never>, deps?: CommandDeps): Promise<number>;