@verentis/cli 0.2.8 → 0.2.10

package/README.md

@@ -28,15 +28,17 @@ Point `VERENTIS_UPDATE_REGISTRY` at a mirror if you install from a private regis
 ## Sign in
 
 ```bash
-verentis login --api-url https://api.verentis.dev
+verentis login
 ```
 
-With no credential flags this starts a **device sign-in**: open the printed URL in any browser (works over SSH), confirm the code, done. Non-interactive alternatives:
+The CLI targets **production** (`https://api.verentis.io`) by default — third-party developers need no
+extra configuration. With no credential flags this starts a **device sign-in**: open the printed URL in any
+browser (works over SSH), confirm the code, done. Non-interactive alternatives:
 
 ```bash
-verentis login --api-url … --api-key vrt_xxx     # CI / scripts (create one with `verentis apikey create`)
-verentis login --api-url … --token <identity token>
-# VERENTIS_API_URL / VERENTIS_API_KEY / VERENTIS_TOKEN env vars also work
+verentis login --api-key vrt_xxx     # CI / scripts (create one with `verentis apikey create`)
+verentis login --token <identity token>
+# VERENTIS_API_KEY / VERENTIS_TOKEN env vars also work
 ```
 
 A device sign-in also stores a **refresh token**, so you stay signed in: when the 1-hour identity token

package/dist/index.js

@@ -1,7 +1,6 @@
 #!/usr/bin/env node
-import { Command } from 'commander';
+import { Command, Option } from 'commander';
 import { mkdir, stat, writeFile, readFile, readdir, realpath, mkdtemp, rm, glob } from 'fs/promises';
-import { Agent } from 'https';
 import { tmpdir, homedir } from 'os';
 import { resolve, basename, dirname, posix, join, isAbsolute, extname, relative, sep } from 'path';
 import { spawn, spawnSync } from 'child_process';
@@ -13,13 +12,16 @@ import { pipeline } from 'stream/promises';
 import * as tar from 'tar';
 import { fileURLToPath } from 'url';
 
-var insecureAgent = new Agent({ rejectUnauthorized: false });
 function insecureFetchOptions(insecure) {
-  return insecure ? { dispatcher: insecureAgent } : {};
+  if (insecure) {
+    process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
+  }
+  return {};
 }
 var configDir = () => process.env.VERENTIS_CONFIG_DIR ?? join(homedir(), ".verentis");
 var configPath = () => join(configDir(), "config.json");
 var keysDir = () => join(configDir(), "keys");
+var PRODUCTION_API_URL = "https://api.verentis.io";
 async function loadConfig() {
   try {
     return JSON.parse(await readFile(configPath(), "utf8"));
@@ -32,10 +34,7 @@ async function saveConfig(config) {
   await writeFile(configPath(), JSON.stringify(config, null, 2) + "\n", { mode: 384 });
 }
 function requireApiUrl(config) {
-  const url = process.env.VERENTIS_API_URL ?? config.apiUrl;
-  if (!url) {
-    throw new Error("No API URL configured. Run `verentis login --api-url <url>` first (or set VERENTIS_API_URL).");
-  }
+  const url = process.env.VERENTIS_API_URL ?? config.apiUrl ?? PRODUCTION_API_URL;
   return url.replace(/\/+$/, "");
 }
 
@@ -1992,22 +1991,20 @@ function registerKeygen(program2) {
     console.log(`Revoked key ${kid}.`);
   });
 }
-
-// src/commands/login.ts
 function registerLogin(program2) {
-  program2.command("login").description("Sign in to Verentis (browser device flow by default; --api-key/--token for non-interactive use)").option("--api-url <url>", "Verentis API gateway URL").option("--api-key <key>", "Verentis API key (vrt_...)").option("--token <token>", "Verentis identity token (exchanged per request for scoped access tokens)").option("--sealing-key <key>", "the platform's base64 X25519 sealing PUBLIC key (used by `pack --encrypt`)").option("--insecure", "skip TLS certificate verification (for local dev with self-signed certs)").action(async (options) => {
+  program2.command("login").description("Sign in to Verentis (browser device flow by default; --api-key/--token for non-interactive use)").addOption(new Option("--api-url <url>", "Verentis API gateway URL (defaults to production)").hideHelp()).option("--api-key <key>", "Verentis API key (vrt_...)").option("--token <token>", "Verentis identity token (exchanged per request for scoped access tokens)").option("--sealing-key <key>", "the platform's base64 X25519 sealing PUBLIC key (used by `pack --encrypt`)").option("--insecure", "skip TLS certificate verification (for local dev with self-signed certs)").action(async (options) => {
     const config = await loadConfig();
     if (options.apiUrl) config.apiUrl = options.apiUrl;
     if (options.sealingKey) config.sealingPublicKey = options.sealingKey;
     if (options.insecure !== void 0) config.insecure = options.insecure;
-    if (!config.apiUrl) throw new Error("An API URL is required. Pass --api-url <url>.");
+    const apiUrl = (options.apiUrl ?? process.env.VERENTIS_API_URL ?? config.apiUrl ?? PRODUCTION_API_URL).replace(/\/+$/, "");
     if (options.apiKey) {
       if (!options.apiKey.startsWith("vrt_")) throw new Error('API keys start with "vrt_".');
       config.apiKey = options.apiKey;
       delete config.identityToken;
       delete config.refreshToken;
       await saveConfig(config);
-      console.log(`Configuration saved (API key @ ${config.apiUrl}).`);
+      console.log(`Configuration saved (API key @ ${apiUrl}).`);
       return;
     }
     if (options.token) {
@@ -2015,10 +2012,9 @@ function registerLogin(program2) {
       delete config.apiKey;
       delete config.refreshToken;
       await saveConfig(config);
-      console.log(`Configuration saved (identity token @ ${config.apiUrl}).`);
+      console.log(`Configuration saved (identity token @ ${apiUrl}).`);
       return;
     }
-    const apiUrl = config.apiUrl.replace(/\/+$/, "");
     const insecure = config.insecure;
     const authorization = await startDeviceAuthorization(apiUrl, insecure);
     console.log("To sign in, open this URL in a browser:");
@@ -2035,7 +2031,7 @@ function registerLogin(program2) {
     delete config.apiKey;
     await saveConfig(config);
     const claims = decodeJwtPayload(identity.idToken);
-    console.log(`Signed in as ${claims?.name ?? claims?.email ?? claims?.sub ?? "unknown"} @ ${config.apiUrl}.`);
+    console.log(`Signed in as ${claims?.name ?? claims?.email ?? claims?.sub ?? "unknown"} @ ${apiUrl}.`);
     if (!claims?.account_id) {
       console.log("Note: no unambiguous account context \u2014 admin commands may need --account <id>.");
     }