@velaro/cli 0.5.0 → 1.2.0

package/lib/config.js

@@ -1,83 +1,83 @@
-import { homedir } from 'os';
-import { join }    from 'path';
-import { readFileSync, writeFileSync, mkdirSync } from 'fs';
-
-const CONFIG_DIR  = join(homedir(), '.velaro');
-const CONFIG_FILE = join(CONFIG_DIR, 'config.json');
-
-export const ENVS = {
-  prod: {
-    adminApiBase:     'https://api-admin-us-east.velaro.com',
-    messagingApiBase: 'https://velaro-messaging-api-staging.azurewebsites.net',
-  },
-  staging: {
-    adminApiBase:     'https://velaro-admin-staging.azurewebsites.net',
-    messagingApiBase: 'https://velaro-messaging-api-staging.azurewebsites.net',
-  },
-};
-
-// Legacy single-entry config — migrate transparently on first read.
-function migrate(raw) {
-  if (raw.envs) return raw; // already multi-env
-  const apiBase = raw.apiBase || '';
-  const env = apiBase.includes('staging') ? 'staging' : 'prod';
-  return {
-    activeEnv: env,
-    envs: {
-      [env]: {
-        adminApiBase:      ENVS[env].adminApiBase,
-        messagingApiBase:  ENVS[env].messagingApiBase,
-        velaroToken:       raw.velaroToken,
-        velaroExpires:     raw.velaroExpires,
-        entraRefreshToken: raw.entraRefreshToken,
-        siteId:            raw.siteId,
-        userName:          raw.userName,
-      },
-    },
-    _lastUpdateCheck: raw._lastUpdateCheck,
-    _latestVersion:   raw._latestVersion,
-  };
-}
-
-export function readConfig() {
-  try {
-    const raw = JSON.parse(readFileSync(CONFIG_FILE, 'utf8'));
-    return migrate(raw);
-  } catch {
-    return { activeEnv: 'prod', envs: {} };
-  }
-}
-
-export function writeConfig(data) {
-  mkdirSync(CONFIG_DIR, { recursive: true });
-  writeFileSync(CONFIG_FILE, JSON.stringify(data, null, 2), { mode: 0o600 });
-}
-
-export function getActiveEnv() {
-  return readConfig().activeEnv || 'prod';
-}
-
-export function setActiveEnv(env) {
-  if (!ENVS[env]) throw new Error(`Unknown environment "${env}". Use: prod, staging`);
-  const cfg = readConfig();
-  cfg.activeEnv = env;
-  writeConfig(cfg);
-}
-
-export function getEnvCredentials(env) {
-  const cfg = readConfig();
-  return cfg.envs?.[env] || null;
-}
-
-export function setEnvCredentials(env, creds) {
-  if (!ENVS[env]) throw new Error(`Unknown environment "${env}". Use: prod, staging`);
-  const cfg = readConfig();
-  cfg.envs = cfg.envs || {};
-  cfg.envs[env] = { ...ENVS[env], ...creds };
-  cfg.activeEnv = cfg.activeEnv || env;
-  writeConfig(cfg);
-}
-
-export function clearConfig() {
-  writeConfig({ activeEnv: 'prod', envs: {} });
-}
+import { homedir } from 'os';
+import { join }    from 'path';
+import { readFileSync, writeFileSync, mkdirSync } from 'fs';
+
+const CONFIG_DIR  = join(homedir(), '.velaro');
+const CONFIG_FILE = join(CONFIG_DIR, 'config.json');
+
+export const ENVS = {
+  prod: {
+    adminApiBase:     'https://api-admin-us-east.velaro.com',
+    messagingApiBase: 'https://velaro-messaging-api-staging.azurewebsites.net',
+  },
+  staging: {
+    adminApiBase:     'https://velaro-admin-staging.azurewebsites.net',
+    messagingApiBase: 'https://velaro-messaging-api-staging.azurewebsites.net',
+  },
+};
+
+// Legacy single-entry config — migrate transparently on first read.
+function migrate(raw) {
+  if (raw.envs) return raw; // already multi-env
+  const apiBase = raw.apiBase || '';
+  const env = apiBase.includes('staging') ? 'staging' : 'prod';
+  return {
+    activeEnv: env,
+    envs: {
+      [env]: {
+        adminApiBase:      ENVS[env].adminApiBase,
+        messagingApiBase:  ENVS[env].messagingApiBase,
+        velaroToken:       raw.velaroToken,
+        velaroExpires:     raw.velaroExpires,
+        entraRefreshToken: raw.entraRefreshToken,
+        siteId:            raw.siteId,
+        userName:          raw.userName,
+      },
+    },
+    _lastUpdateCheck: raw._lastUpdateCheck,
+    _latestVersion:   raw._latestVersion,
+  };
+}
+
+export function readConfig() {
+  try {
+    const raw = JSON.parse(readFileSync(CONFIG_FILE, 'utf8'));
+    return migrate(raw);
+  } catch {
+    return { activeEnv: 'prod', envs: {} };
+  }
+}
+
+export function writeConfig(data) {
+  mkdirSync(CONFIG_DIR, { recursive: true });
+  writeFileSync(CONFIG_FILE, JSON.stringify(data, null, 2), { mode: 0o600 });
+}
+
+export function getActiveEnv() {
+  return readConfig().activeEnv || 'prod';
+}
+
+export function setActiveEnv(env) {
+  if (!ENVS[env]) throw new Error(`Unknown environment "${env}". Use: prod, staging`);
+  const cfg = readConfig();
+  cfg.activeEnv = env;
+  writeConfig(cfg);
+}
+
+export function getEnvCredentials(env) {
+  const cfg = readConfig();
+  return cfg.envs?.[env] || null;
+}
+
+export function setEnvCredentials(env, creds) {
+  if (!ENVS[env]) throw new Error(`Unknown environment "${env}". Use: prod, staging`);
+  const cfg = readConfig();
+  cfg.envs = cfg.envs || {};
+  cfg.envs[env] = { ...ENVS[env], ...creds };
+  cfg.activeEnv = cfg.activeEnv || env;
+  writeConfig(cfg);
+}
+
+export function clearConfig() {
+  writeConfig({ activeEnv: 'prod', envs: {} });
+}

package/lib/oauth.js

@@ -1,135 +1,135 @@
-/**
- * OAuth 2.0 device authorization flow (RFC 8628) against the Velaro Entra CIAM tenant.
- *
- * Flow:
- *   1. POST /devicecode  → get user_code + verification_uri
- *   2. Show the user the code; poll /token until granted
- *   3. Exchange the Entra access_token for a Velaro JWT via /auth/entra/token
- *   4. Store { velaroToken, velaroExpires, entraRefreshToken } in ~/.velaro/config.json
- *
- * Refresh:
- *   When the Velaro JWT is within 5 minutes of expiring, silently use the stored
- *   Entra refresh_token to get a new access_token and re-exchange for a new Velaro JWT.
- *
- * One-time setup (run once in the Velaro CIAM tenant):
- *   az login --tenant 61de45b3-458d-49a5-913c-501247a6fe4f --allow-no-subscriptions
- *   az ad app create --display-name "Velaro CLI" --sign-in-audience AzureADMyOrg \
- *     --public-client-redirect-uris "https://login.microsoftonline.com/common/oauth2/nativeclient"
- *   az ad app update --id <appId> --set isFallbackPublicClient=true
- *   # Grant admin consent in Azure Portal:
- *   #   api://89bd2fb7-7020-4cfe-a153-1c1ee37903c2/access_as_user (Delegated)
- *   # Then set VELARO_CLI_CLIENT_ID=<appId> or update the constant below.
- */
-
-const TENANT_ID  = '61de45b3-458d-49a5-913c-501247a6fe4f';
-// CIAM tenant uses login.velaro.com, not login.microsoftonline.com
-const AUTHORITY  = `https://login.velaro.com/${TENANT_ID}`;
-const CLIENT_ID  = process.env.VELARO_CLI_CLIENT_ID || 'c0fdce54-e9b4-4427-a021-b2605855ff8b';
-
-const SCOPE = [
-  'api://89bd2fb7-7020-4cfe-a153-1c1ee37903c2/access_as_user',
-  'offline_access',
-  'openid',
-  'profile',
-  'email',
-].join(' ');
-
-const DEVICE_CODE_URL = `${AUTHORITY}/oauth2/v2.0/devicecode`;
-const TOKEN_URL       = `${AUTHORITY}/oauth2/v2.0/token`;
-const FETCH_TIMEOUT   = 10_000;
-
-export async function requestDeviceCode() {
-  const res = await fetch(DEVICE_CODE_URL, {
-    method:  'POST',
-    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-    body:    new URLSearchParams({ client_id: CLIENT_ID, scope: SCOPE }),
-    signal:  AbortSignal.timeout(FETCH_TIMEOUT),
-  });
-
-  const data = await res.json();
-  if (data.error) throw new Error(`Device code request failed: ${data.error_description || data.error}`);
-  return data; // { device_code, user_code, verification_uri, expires_in, interval, message }
-}
-
-export async function pollForToken(deviceCode, intervalSeconds) {
-  let interval = intervalSeconds;
-
-  while (true) {
-    const res = await fetch(TOKEN_URL, {
-      method:  'POST',
-      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-      body:    new URLSearchParams({
-        grant_type:  'urn:ietf:params:oauth:grant-type:device_code',
-        client_id:   CLIENT_ID,
-        device_code: deviceCode,
-      }),
-      signal: AbortSignal.timeout(FETCH_TIMEOUT),
-    });
-
-    const data = await res.json();
-
-    if (data.access_token) return data; // { access_token, refresh_token, expires_in }
-
-    if (data.error === 'authorization_pending') {
-      // normal — keep waiting
-    } else if (data.error === 'slow_down') {
-      interval += 5 + Math.random() * 2; // RFC 8628 §3.5 — add jitter to avoid lockstep
-    } else if (data.error === 'expired_token') {
-      throw new Error('Login timed out — please run velaro login again.');
-    } else if (data.error === 'access_denied') {
-      throw new Error('Login cancelled.');
-    } else {
-      throw new Error(data.error_description || data.error);
-    }
-
-    await sleep(interval * 1000); // sleep at end so first attempt fires immediately
-  }
-}
-
-export async function exchangeForVelaroToken(entraAccessToken, apiBase) {
-  const res = await fetch(`${apiBase}/auth/entra/token`, {
-    method:  'POST',
-    headers: { Authorization: `Bearer ${entraAccessToken}` },
-    signal:  AbortSignal.timeout(FETCH_TIMEOUT),
-  });
-
-  if (!res.ok) {
-    const body = await res.text().catch(() => res.status.toString());
-    throw new Error(`Velaro token exchange failed (${res.status}): ${body}`);
-  }
-
-  return res.json(); // { token: { token, expires }, profile: { SiteId, Name, UserName, ... } }
-}
-
-export async function refreshVelaroToken(credentials) {
-  const res = await fetch(TOKEN_URL, {
-    method:  'POST',
-    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-    body:    new URLSearchParams({
-      grant_type:    'refresh_token',
-      client_id:     CLIENT_ID,
-      refresh_token: credentials.entraRefreshToken,
-    }),
-    signal: AbortSignal.timeout(FETCH_TIMEOUT),
-  });
-
-  const data = await res.json();
-  if (!data.access_token) {
-    throw new Error(`Token refresh failed: ${data.error_description || data.error}`);
-  }
-
-  const velaro = await exchangeForVelaroToken(data.access_token, credentials.apiBase);
-
-  return {
-    ...credentials,
-    velaroToken:       velaro.token.token,
-    velaroExpires:     velaro.token.expires,
-    entraRefreshToken: data.refresh_token || credentials.entraRefreshToken,
-    siteId:            velaro.profile?.SiteId ?? credentials.siteId,
-    userName:          velaro.profile?.Name   ?? credentials.userName,
-  };
-}
-
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
+/**
+ * OAuth 2.0 device authorization flow (RFC 8628) against the Velaro Entra CIAM tenant.
+ *
+ * Flow:
+ *   1. POST /devicecode  → get user_code + verification_uri
+ *   2. Show the user the code; poll /token until granted
+ *   3. Exchange the Entra access_token for a Velaro JWT via /auth/entra/token
+ *   4. Store { velaroToken, velaroExpires, entraRefreshToken } in ~/.velaro/config.json
+ *
+ * Refresh:
+ *   When the Velaro JWT is within 5 minutes of expiring, silently use the stored
+ *   Entra refresh_token to get a new access_token and re-exchange for a new Velaro JWT.
+ *
+ * One-time setup (run once in the Velaro CIAM tenant):
+ *   az login --tenant 61de45b3-458d-49a5-913c-501247a6fe4f --allow-no-subscriptions
+ *   az ad app create --display-name "Velaro CLI" --sign-in-audience AzureADMyOrg \
+ *     --public-client-redirect-uris "https://login.microsoftonline.com/common/oauth2/nativeclient"
+ *   az ad app update --id <appId> --set isFallbackPublicClient=true
+ *   # Grant admin consent in Azure Portal:
+ *   #   api://89bd2fb7-7020-4cfe-a153-1c1ee37903c2/access_as_user (Delegated)
+ *   # Then set VELARO_CLI_CLIENT_ID=<appId> or update the constant below.
+ */
+
+const TENANT_ID  = '61de45b3-458d-49a5-913c-501247a6fe4f';
+// CIAM tenant uses login.velaro.com, not login.microsoftonline.com
+const AUTHORITY  = `https://login.velaro.com/${TENANT_ID}`;
+const CLIENT_ID  = process.env.VELARO_CLI_CLIENT_ID || 'c0fdce54-e9b4-4427-a021-b2605855ff8b';
+
+const SCOPE = [
+  'api://89bd2fb7-7020-4cfe-a153-1c1ee37903c2/access_as_user',
+  'offline_access',
+  'openid',
+  'profile',
+  'email',
+].join(' ');
+
+const DEVICE_CODE_URL = `${AUTHORITY}/oauth2/v2.0/devicecode`;
+const TOKEN_URL       = `${AUTHORITY}/oauth2/v2.0/token`;
+const FETCH_TIMEOUT   = 10_000;
+
+export async function requestDeviceCode() {
+  const res = await fetch(DEVICE_CODE_URL, {
+    method:  'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body:    new URLSearchParams({ client_id: CLIENT_ID, scope: SCOPE }),
+    signal:  AbortSignal.timeout(FETCH_TIMEOUT),
+  });
+
+  const data = await res.json();
+  if (data.error) throw new Error(`Device code request failed: ${data.error_description || data.error}`);
+  return data; // { device_code, user_code, verification_uri, expires_in, interval, message }
+}
+
+export async function pollForToken(deviceCode, intervalSeconds) {
+  let interval = intervalSeconds;
+
+  while (true) {
+    const res = await fetch(TOKEN_URL, {
+      method:  'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body:    new URLSearchParams({
+        grant_type:  'urn:ietf:params:oauth:grant-type:device_code',
+        client_id:   CLIENT_ID,
+        device_code: deviceCode,
+      }),
+      signal: AbortSignal.timeout(FETCH_TIMEOUT),
+    });
+
+    const data = await res.json();
+
+    if (data.access_token) return data; // { access_token, refresh_token, expires_in }
+
+    if (data.error === 'authorization_pending') {
+      // normal — keep waiting
+    } else if (data.error === 'slow_down') {
+      interval += 5 + Math.random() * 2; // RFC 8628 §3.5 — add jitter to avoid lockstep
+    } else if (data.error === 'expired_token') {
+      throw new Error('Login timed out — please run velaro login again.');
+    } else if (data.error === 'access_denied') {
+      throw new Error('Login cancelled.');
+    } else {
+      throw new Error(data.error_description || data.error);
+    }
+
+    await sleep(interval * 1000); // sleep at end so first attempt fires immediately
+  }
+}
+
+export async function exchangeForVelaroToken(entraAccessToken, apiBase) {
+  const res = await fetch(`${apiBase}/auth/entra/token`, {
+    method:  'POST',
+    headers: { Authorization: `Bearer ${entraAccessToken}` },
+    signal:  AbortSignal.timeout(FETCH_TIMEOUT),
+  });
+
+  if (!res.ok) {
+    const body = await res.text().catch(() => res.status.toString());
+    throw new Error(`Velaro token exchange failed (${res.status}): ${body}`);
+  }
+
+  return res.json(); // { token: { token, expires }, profile: { SiteId, Name, UserName, ... } }
+}
+
+export async function refreshVelaroToken(credentials) {
+  const res = await fetch(TOKEN_URL, {
+    method:  'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body:    new URLSearchParams({
+      grant_type:    'refresh_token',
+      client_id:     CLIENT_ID,
+      refresh_token: credentials.entraRefreshToken,
+    }),
+    signal: AbortSignal.timeout(FETCH_TIMEOUT),
+  });
+
+  const data = await res.json();
+  if (!data.access_token) {
+    throw new Error(`Token refresh failed: ${data.error_description || data.error}`);
+  }
+
+  const velaro = await exchangeForVelaroToken(data.access_token, credentials.apiBase);
+
+  return {
+    ...credentials,
+    velaroToken:       velaro.token.token,
+    velaroExpires:     velaro.token.expires,
+    entraRefreshToken: data.refresh_token || credentials.entraRefreshToken,
+    siteId:            velaro.profile?.SiteId ?? credentials.siteId,
+    userName:          velaro.profile?.Name   ?? credentials.userName,
+  };
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}

package/lib/run.js

@@ -1,16 +1,16 @@
-import { track } from './track.js';
-
-/** Wraps a yargs command handler with consistent error reporting and usage tracking. */
-export function runCommand(fn) {
-  return async (argv) => {
-    try {
-      await fn(argv);
-      // Fire-and-forget tracking after successful command — never awaited, never blocks
-      const action = argv._.join('.') || 'unknown';
-      track(action);
-    } catch (err) {
-      console.error(`Error: ${err.message}`);
-      process.exit(1);
-    }
-  };
-}
+import { track } from './track.js';
+
+/** Wraps a yargs command handler with consistent error reporting and usage tracking. */
+export function runCommand(fn) {
+  return async (argv) => {
+    try {
+      await fn(argv);
+      // Fire-and-forget tracking after successful command — never awaited, never blocks
+      const action = argv._.join('.') || 'unknown';
+      track(action);
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  };
+}

package/lib/subscription.js

@@ -1,39 +1,39 @@
-/**
- * Subscription helpers for CLI commands.
- * Provides a clean gate that prints a plan upgrade message instead of
- * throwing a confusing 403/400 from the API.
- */
-
-import { get } from './api.js';
-
-let _cachedSub = null;
-
-export async function getSubscription() {
-  if (!_cachedSub) {
-    _cachedSub = await get('/Subscription');
-  }
-  return _cachedSub;
-}
-
-/**
- * Throws an Error with a friendly upgrade message if the feature flag is off.
- * Usage: await requireFeature('enableAI', 'AI Bots');
- */
-export async function requireFeature(flag, featureName) {
-  const sub = await getSubscription();
-  if (!sub[flag]) {
-    throw new Error(
-      `${featureName} is not enabled on your plan.\n` +
-      `  Upgrade at https://velaro.com/pricing or contact sales@velaro.com.`
-    );
-  }
-  return sub;
-}
-
-/**
- * Returns true/false without throwing — for check/status commands.
- */
-export async function hasFeature(flag) {
-  const sub = await getSubscription();
-  return sub[flag] === true;
-}
+/**
+ * Subscription helpers for CLI commands.
+ * Provides a clean gate that prints a plan upgrade message instead of
+ * throwing a confusing 403/400 from the API.
+ */
+
+import { get } from './api.js';
+
+let _cachedSub = null;
+
+export async function getSubscription() {
+  if (!_cachedSub) {
+    _cachedSub = await get('/Subscription');
+  }
+  return _cachedSub;
+}
+
+/**
+ * Throws an Error with a friendly upgrade message if the feature flag is off.
+ * Usage: await requireFeature('enableAI', 'AI Bots');
+ */
+export async function requireFeature(flag, featureName) {
+  const sub = await getSubscription();
+  if (!sub[flag]) {
+    throw new Error(
+      `${featureName} is not enabled on your plan.\n` +
+      `  Upgrade at https://velaro.com/pricing or contact sales@velaro.com.`
+    );
+  }
+  return sub;
+}
+
+/**
+ * Returns true/false without throwing — for check/status commands.
+ */
+export async function hasFeature(flag) {
+  const sub = await getSubscription();
+  return sub[flag] === true;
+}

package/lib/track.js

@@ -1,35 +1,35 @@
-/**
- * Fire-and-forget CLI usage tracker.
- * Posts a single event to /ToolUsage/cli after each command.
- * Never throws, never blocks — silently dropped on any failure.
- */
-import { readConfig } from './config.js';
-import { createRequire } from 'module';
-
-const require = createRequire(import.meta.url);
-const { version: CLI_VERSION } = require('../package.json');
-
-/**
- * Track a CLI action. Call after a command succeeds.
- * @param {string} action  e.g. "login", "bot.push", "workflow.pull"
- */
-export function track(action) {
-  setImmediate(async () => {
-    try {
-      const creds = readConfig();
-      if (!creds?.velaroToken || !creds?.apiBase) return;
-
-      await fetch(`${creds.apiBase}/ToolUsage/cli`, {
-        method: 'POST',
-        headers: {
-          Authorization: `Bearer ${creds.velaroToken}`,
-          'Content-Type': 'application/json',
-        },
-        body: JSON.stringify({ action, cliVersion: CLI_VERSION }),
-        signal: AbortSignal.timeout(3000),
-      });
-    } catch {
-      // Silently drop — tracking must never surface errors to the user
-    }
-  });
-}
+/**
+ * Fire-and-forget CLI usage tracker.
+ * Posts a single event to /ToolUsage/cli after each command.
+ * Never throws, never blocks — silently dropped on any failure.
+ */
+import { readConfig } from './config.js';
+import { createRequire } from 'module';
+
+const require = createRequire(import.meta.url);
+const { version: CLI_VERSION } = require('../package.json');
+
+/**
+ * Track a CLI action. Call after a command succeeds.
+ * @param {string} action  e.g. "login", "bot.push", "workflow.pull"
+ */
+export function track(action) {
+  setImmediate(async () => {
+    try {
+      const creds = readConfig();
+      if (!creds?.velaroToken || !creds?.apiBase) return;
+
+      await fetch(`${creds.apiBase}/ToolUsage/cli`, {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${creds.velaroToken}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ action, cliVersion: CLI_VERSION }),
+        signal: AbortSignal.timeout(3000),
+      });
+    } catch {
+      // Silently drop — tracking must never surface errors to the user
+    }
+  });
+}