@vex-chat/cli 0.3.0 → 0.5.0

package/README.md

@@ -6,12 +6,18 @@ Terminal chat client for Vex backed by `@vex-chat/libvex`.
 pnpm vex
 ```
 
-On first run, `vex` prompts for a username and registers a local device key.
-After that it opens straight into a live chat session.
+On first run, `vex` prompts for a username and password, registers a local
+device key, and opens straight into a live chat session.
 
 By default the CLI connects to production at `api.vex.wtf`. For local Spire development, pass `--local` to use `127.0.0.1:16777` over http/ws. Custom targets can use `--api-url <url>` to set both the host and protocol, or `--host <host:port> --http` to set them separately.
 
-When creating a new account, the CLI opens a browser passkey page to attach the account's first passkey before connecting. When adding this machine to an account that already exists, the same page can restore the pending device with a saved passkey. Use `--passkey-url <url>` or `VEX_CHAT_PASSKEY_URL` when the WebAuthn page is hosted somewhere other than the API origin; use `--no-browser` or `VEX_CHAT_NO_BROWSER=1` to print the URL without launching a browser.
+New accounts use the password you set during registration. Passkeys can be added
+later as a supplemental recovery/sign-in method. When adding this machine to an
+account that already exists, the browser passkey page can restore the pending
+device with a saved passkey. Use `--passkey-url <url>` or
+`VEX_CHAT_PASSKEY_URL` when the WebAuthn page is hosted somewhere other than the
+API origin; use `--no-browser` or `VEX_CHAT_NO_BROWSER=1` to print the URL
+without launching a browser.
 
 Inside the app:
 
@@ -43,8 +49,8 @@ Inside the app:
 Scriptable helpers still exist:
 
 ```sh
-pnpm vex auth register alice
-pnpm vex auth register bob
+pnpm vex auth register alice alice-password
+pnpm vex auth register bob bob-password
 pnpm vex alice
 pnpm vex bob
 pnpm vex auth accounts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vex-chat/cli",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Terminal client for vex-chat.",
   "type": "module",
   "bin": {
@@ -31,7 +31,7 @@
   "dependencies": {
     "better-sqlite3": "11.10.0",
     "msgpackr": "^1.11.9",
-    "@vex-chat/libvex": "^7.1.2"
+    "@vex-chat/libvex": "^8.0.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",

package/src/vex-chat.js

@@ -145,6 +145,9 @@ async function main() {
             case "invite":
                 await inviteCommand(ctx, positionals);
                 break;
+            case "entitlements":
+                await entitlementsCommand(ctx, positionals);
+                break;
             case "group":
                 await groupCommand(ctx, positionals);
                 break;
@@ -176,6 +179,7 @@ function isCommand(command) {
         "channels",
         "chat",
         "dm",
+        "entitlements",
         "group",
         "help",
         "invite",
@@ -285,6 +289,7 @@ async function createContext(flags) {
     return {
         dataDir,
         configPath,
+        flags,
         clientOptions: {
             dbFolder: path.join(dataDir, "db"),
             deviceName: "vex-chat-cli",
@@ -377,6 +382,11 @@ function httpFromApiUrl(raw) {
     }
 }
 
+function apiBaseUrl(ctx) {
+    const scheme = ctx.clientOptions.unsafeHttp ? "http" : "https";
+    return `${scheme}://${ctx.clientOptions.host}`;
+}
+
 function normalizeAccountHost(host) {
     return String(host ?? DEFAULT_HOST)
         .trim()
@@ -583,96 +593,6 @@ function isRemovedStoredDeviceError(err) {
     return err?.name === "RemovedStoredDeviceError";
 }
 
-function getClientBearerToken(client) {
-    if (typeof client.token === "string" && client.token.length > 0) {
-        return client.token;
-    }
-    const authorization =
-        client.http?.defaults?.headers?.common?.Authorization ??
-        client.http?.defaults?.headers?.common?.authorization;
-    if (typeof authorization !== "string") {
-        return null;
-    }
-    const match = /^Bearer\s+(.+)$/i.exec(authorization.trim());
-    return match?.[1] ?? null;
-}
-
-function responseBodyMessage(data) {
-    if (!data || typeof data !== "object" || ArrayBuffer.isView(data)) {
-        return null;
-    }
-    if (data instanceof ArrayBuffer) {
-        return null;
-    }
-    const error = data.error;
-    if (typeof error === "string") return error;
-    if (error && typeof error === "object") {
-        const nestedMessage = error.message;
-        if (typeof nestedMessage === "string") return nestedMessage;
-    }
-    const message = data.message;
-    return typeof message === "string" ? message : null;
-}
-
-function bytesFromResponseBody(data) {
-    if (ArrayBuffer.isView(data)) {
-        return new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
-    }
-    if (data instanceof ArrayBuffer) {
-        return new Uint8Array(data);
-    }
-    return null;
-}
-
-function decodeBinaryResponseBody(data) {
-    const bytes = bytesFromResponseBody(data);
-    if (!bytes) return null;
-    try {
-        return unpack(bytes);
-    } catch {
-        // Express JSON error bodies also arrive as ArrayBuffer with fetch.
-    }
-    const text = new TextDecoder("utf-8", { fatal: false })
-        .decode(bytes)
-        .trim();
-    if (!text) return null;
-    if (text.startsWith("{") || text.startsWith("[")) {
-        try {
-            return JSON.parse(text);
-        } catch {
-            return text;
-        }
-    }
-    return text;
-}
-
-function errorResponseMessage(err) {
-    const data = err?.response?.data;
-    const binaryBody = decodeBinaryResponseBody(data);
-    const binaryMessage = responseBodyMessage(binaryBody);
-    if (binaryMessage) return binaryMessage;
-    if (typeof binaryBody === "string") return binaryBody;
-    const objectMessage = responseBodyMessage(data);
-    if (objectMessage) return objectMessage;
-    if (typeof data === "string") {
-        try {
-            const parsed = JSON.parse(data);
-            const jsonMessage = responseBodyMessage(parsed);
-            if (jsonMessage) return jsonMessage;
-        } catch {
-            return data;
-        }
-    }
-    return err instanceof Error ? err.message : String(err ?? "");
-}
-
-function isInitialPasskeySetupRequired(err) {
-    if (err?.response?.status !== 403) return false;
-    return /passkey must be registered|passkey setup is required/i.test(
-        errorResponseMessage(err),
-    );
-}
-
 async function removeStoredDeviceAccount(ctx, config, accountRef) {
     delete config.accounts[accountRef.key];
     if (config.lastUsername === accountRef.key) {
@@ -687,11 +607,34 @@ function removedStoredDeviceError(ctx, username) {
     return err;
 }
 
+async function resolveRegistrationPassword(ctx, args, rl = null) {
+    const provided = args[1] ?? ctx.password;
+    if (typeof provided === "string" && provided.trim().length > 0) {
+        return provided;
+    }
+    if (input.isTTY && output.isTTY) {
+        if (rl) {
+            const password = await askText(rl, "password");
+            if (password) return password;
+        } else {
+            const prompt = createInterface({ input, output });
+            try {
+                const password = await askText(prompt, "password");
+                if (password) return password;
+            } finally {
+                prompt.close();
+            }
+        }
+    }
+    throw new Error(
+        "Password is required to register a new account. Usage: vex auth register <username> <password> or pass --password <password>.",
+    );
+}
+
 async function register(ctx, args) {
     const requestedUsername = args[0] ?? ctx.username;
-    const password = args[1] ?? ctx.password;
     if (!requestedUsername) {
-        throw new Error("Usage: vex-chat register <username> [password]");
+        throw new Error("Usage: vex-chat register <username> <password>");
     }
     const config = await readConfig(ctx.configPath);
     const accountRef = resolveAccountEntry(ctx, config, requestedUsername);
@@ -703,6 +646,7 @@ async function register(ctx, args) {
             `Local account already exists for ${username}. Use login or remove it from ${ctx.configPath}.`,
         );
     }
+    const password = await resolveRegistrationPassword(ctx, args);
     const privateKey = Client.generateSecretKey();
     const client = await Client.create(privateKey, ctx.clientOptions);
     attachDebugClientEvents(ctx, client, `register:${username}`);
@@ -790,20 +734,6 @@ function buildPasskeyLoginUrl(ctx, { code, pending, username }) {
     return url.toString();
 }
 
-function buildPasskeyRegistrationUrl(ctx, { token, userID, username }) {
-    const url = new URL(ctx.passkeyLoginUrl ?? defaultPasskeyLoginUrl(ctx));
-    url.hash = new URLSearchParams({
-        api: apiBaseUrl(ctx),
-        device: ctx.clientOptions.deviceName ?? "vex-chat-cli",
-        mode: "register",
-        name: ctx.clientOptions.deviceName ?? "vex-chat-cli",
-        token,
-        user: userID,
-        username,
-    }).toString();
-    return url.toString();
-}
-
 async function openExternalUrl(url) {
     const [command, args] =
         process.platform === "darwin"
@@ -853,68 +783,6 @@ async function launchPasskeyLogin(ctx, username, pending, code) {
     }
 }
 
-async function launchInitialPasskeySetup(ctx, client, username) {
-    const token = getClientBearerToken(client);
-    if (!token) {
-        throw new Error(
-            "Passkey setup is required, but the CLI could not read the registration token.",
-        );
-    }
-    const userID = client.me.user().userID;
-    let url;
-    try {
-        url = buildPasskeyRegistrationUrl(ctx, {
-            token,
-            userID,
-            username,
-        });
-    } catch (err) {
-        throw new Error(
-            `Could not build passkey setup URL: ${err instanceof Error ? err.message : String(err)}`,
-        );
-    }
-
-    console.log(
-        `${color(ROOT_ACCENT, "passkey setup")} ${color("dim", "opens in your browser")}`,
-    );
-    console.log(
-        color(
-            "dim",
-            "New accounts must add a passkey before the CLI can connect.",
-        ),
-    );
-    console.log(`${color("dim", "url")} ${url}`);
-    if (ctx.openBrowser) {
-        const opened = await openExternalUrl(url);
-        if (!opened) {
-            console.log(
-                color(
-                    "yellow",
-                    "Could not open a browser. Copy the URL above.",
-                ),
-            );
-        }
-    }
-
-    console.log(color(ROOT_ACCENT, "waiting for passkey setup..."));
-    for (let attempt = 0; attempt < 300; attempt++) {
-        await sleep(2000);
-        const passkeys = await client.passkeys.list().catch((err) => {
-            debugLog(ctx, "passkey.register.poll.error", {
-                error: err,
-                username,
-            });
-            return [];
-        });
-        if (passkeys.length > 0) {
-            if (input.isTTY && output.isTTY) output.write("\n");
-            return;
-        }
-        if (input.isTTY && output.isTTY) output.write(color("dim", "."));
-    }
-    throw new Error("Timed out waiting for passkey setup.");
-}
-
 async function persistPendingLocalAccount(
     ctx,
     config,
@@ -1265,7 +1133,7 @@ async function authCommand(ctx, args) {
             return;
         default:
             throw new Error(
-                "Usage: vex auth register <username> | login <username> [password] | requests | use <username> | accounts | status",
+                "Usage: vex auth register <username> <password> | login <username> [password] | requests | use <username> | accounts | status",
             );
     }
 }
@@ -1495,6 +1363,47 @@ async function inviteCommand(ctx, args) {
     });
 }
 
+async function entitlementsCommand(ctx, args) {
+    const sub = args.shift() ?? "status";
+    if (sub === "set" || sub === "grant") {
+        const userID = requireArg(args, 0, "user id");
+        const tier = requireArg(args, 1, "tier");
+        if (!["free", "plus", "pro"].includes(tier)) {
+            throw new Error("Tier must be one of: free, plus, pro.");
+        }
+        const devKey = ctx.clientOptions.devApiKey;
+        if (!devKey) {
+            throw new Error(
+                "A dev key is required. Pass --dev-key or set DEV_API_KEY.",
+            );
+        }
+        const expiresAt = ctx.flags["expires-at"]
+            ? String(ctx.flags["expires-at"])
+            : null;
+        const res = await fetch(`${apiBaseUrl(ctx)}/__dev/billing/grants`, {
+            body: JSON.stringify({ expiresAt, tier, userID }),
+            headers: {
+                "Content-Type": "application/json",
+                "x-dev-api-key": devKey,
+            },
+            method: "POST",
+        });
+        if (!res.ok) {
+            throw new Error(
+                `Entitlement grant failed with HTTP ${String(res.status)}: ${await res.text()}`,
+            );
+        }
+        const body = await res.json();
+        console.log(
+            `${color(ROOT_ACCENT, "granted")} ${color("bold", tier)} ${color("dim", `to ${userID}`)} ${color("dim", `source=${body.source ?? "unknown"}`)}`,
+        );
+        return;
+    }
+    throw new Error(
+        "Usage: vex entitlements set <user-id> <free|plus|pro> [--expires-at <iso>] --dev-key <key>",
+    );
+}
+
 async function groupCommand(ctx, args) {
     const sub = args[0];
     if (sub === "send") {
@@ -3366,11 +3275,12 @@ async function authenticateOrRegister(ctx, explicitUsername) {
         if (answer && answer !== "y" && answer !== "yes") {
             throw new Error("No local account selected.");
         }
+        const password = await resolveRegistrationPassword(ctx, [entered], rl);
         const privateKey = Client.generateSecretKey();
         const client = await Client.create(privateKey, ctx.clientOptions);
         attachDebugClientEvents(ctx, client, `register:${entered}`);
         try {
-            const [, registerErr] = await client.register(entered);
+            const [, registerErr] = await client.register(entered, password);
             if (registerErr) throw registerErr;
             await persistNewLocalAccount(
                 ctx,
@@ -3423,21 +3333,7 @@ async function connectAndWait(client, ctx = null, label = "client") {
         debugLog(ctx, "client.connect.skip.connected", { label });
         return;
     }
-    try {
-        await connectOnceAndWait(client, ctx, label);
-        return;
-    } catch (err) {
-        if (!ctx || !isInitialPasskeySetupRequired(err)) {
-            throw err;
-        }
-        const username = client.me.user().username ?? "account";
-        debugLog(ctx, "client.connect.passkeySetup.required", {
-            label,
-            username,
-        });
-        await launchInitialPasskeySetup(ctx, client, username);
-        await connectOnceAndWait(client, ctx, `${label}:passkey`);
-    }
+    await connectOnceAndWait(client, ctx, label);
 }
 
 async function connectOnceAndWait(client, ctx = null, label = "client") {
@@ -4637,17 +4533,18 @@ Commands:
   vex                         open the live terminal chat app
   vex <username>              open as a specific local user
   vex chat [username]          open the live terminal chat app
-  vex auth register <username>
+  vex auth register <username> <password>
   vex auth login <username>    request approval as a second device
   vex auth requests            list pending device login requests
   vex auth accounts
   vex auth use <username>
+  vex entitlements set <user-id> <free|plus|pro> --dev-key <key>
   vex whoami
 
 Flags:
   --username <name>      local account to use
   --user <name>          alias for --username
-  --password <password>  fallback password for login
+  --password <password>  fallback password for register/login
   --api-url <url>        API base URL, e.g. http://127.0.0.1:16777
   --host <host:port>     API host, default api.vex.wtf
   --local                connect to local Spire at 127.0.0.1:16777 over http/ws