@vincentt-xr/cli 0.1.5 → 0.3.0

package/dist/lib/lifecycle.js

@@ -3,119 +3,107 @@
 // lower-level pieces (backend calls, scaffold, preview, diagnostics); no CLI or
 // MCP SDK concerns leak in here. Both surfaces render the returned data their
 // own way.
-import path from "node:path";
-import { BackendError, createProject, gitHeadSha, publishUpload } from "./backend.js";
-import { slugify } from "./slug.js";
+import { getMe } from "./backend.js";
+import { createCommand } from "./projects.js";
+import { publishCommand } from "../publish/command.js";
+import { activeOrgSlug, resolveActiveOrg } from "./org.js";
 import { filterErrors, httpRelayClient, renderResult, } from "./diagnostics.js";
-import { clearRelayInfo, readRelayInfo, writeRelayInfo } from "./relayInfo.js";
-import { clearProjectBinding, loadProjectBinding, resolveConfig, writeProjectBinding, } from "../shared/config.js";
-import { detectPackageManager, installDependencies, needsScaffold, scaffoldFromTemplate, } from "../scaffold/index.js";
-import { startPreview } from "../preview/index.js";
+import { clearRelayInfo, readLivePreview, readRelayInfo, writeRelayInfo, } from "./relayInfo.js";
+import { loadMachineConfig, locateProjectBinding, resolveConfig, } from "../shared/config.js";
+import { startPreview, } from "../preview/index.js";
+/**
+ * The shared `create` orchestration behind both `vincentt create` and the MCP
+ * `project_create` tool, so the two surfaces can never diverge in behavior OR in
+ * what they tell the caller.
+ *
+ * It does NOT scaffold — that is `vincentt init`, which needs no account. See
+ * `initCommand`.
+ */
 export async function projectCreate(projectCwd, opts = {}) {
-    const progress = opts.onProgress ?? (() => { });
-    const existing = await loadProjectBinding(projectCwd);
-    if (existing && !opts.force) {
-        return {
-            message: `This directory is already bound to project ${existing.projectId} (slug ${existing.slug}).\n` +
-                `Run \`vincentt create --force\` to rebind, or \`vincentt unbind\` to detach.`,
-            alreadyBound: true,
-            slug: existing.slug,
-            projectId: existing.projectId,
-        };
-    }
-    if (existing)
-        await clearProjectBinding(projectCwd);
-    // Resolve config first so a missing PAT fails before any clone/side effect.
-    const cfg = await resolveConfig(projectCwd);
-    let scaffolded = false;
-    if (opts.scaffold !== false && (await needsScaffold(projectCwd))) {
-        progress("Scaffolding the v2-template starter…");
-        await scaffoldFromTemplate(projectCwd);
-        scaffolded = true;
-    }
-    const name = opts.name ?? path.basename(projectCwd);
-    progress("Registering the project…");
-    const created = await createProjectPreferringSlug(cfg, name, opts.slug);
-    const bindingPath = await writeProjectBinding(projectCwd, {
-        projectId: created.projectId,
-        slug: created.slug,
-    });
-    const steps = [];
-    if (scaffolded) {
-        steps.push("Scaffolded v2-template into this directory.");
-        const pm = await detectPackageManager(projectCwd);
-        progress(`Installing dependencies (${pm} install — this can take a minute)…`);
-        try {
-            await installDependencies(projectCwd);
-            steps.push(`Installed dependencies (${pm}).`);
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            steps.push(`Dependencies NOT installed (${msg}) — run \`${pm} install\` before preview.`);
-        }
-    }
-    const preamble = steps.length ? steps.map((s) => `✓ ${s}`).join("\n") + "\n" : "";
-    return {
-        message: preamble +
-            `✓ Created "${created.name}" — slug: ${created.slug} (id ${created.projectId})\n` +
-            `  Live URL after publish: https://${created.slug}.vincentt.app\n` +
-            `  Binding: ${bindingPath} (gitignored)\n\n` +
-            `Next:\n` +
-            `  vincentt preview     open a live URL on your phone\n` +
-            `  vincentt publish     go live at ${created.slug}.vincentt.app`,
-        alreadyBound: false,
-        slug: created.slug,
-        projectId: created.projectId,
+    const lines = [];
+    const print = (line) => {
+        lines.push(line);
+        opts.onLine?.(line);
+    };
+    // Resolved once, lazily: a create refused by a local guard must not require a
+    // PAT and must not reach the network at all.
+    let cached;
+    const config = async () => {
+        cached ??= await resolveConfig(projectCwd, {
+            allowCustomApi: opts.allowCustomApi,
+            warn: print,
+        });
+        return cached;
     };
+    const exitCode = await createCommand({
+        print,
+        cwd: projectCwd,
+        config,
+        org: async () => resolveOrgForCommand(await config(), { flag: opts.org }),
+    }, { name: opts.name, slug: opts.slug, force: opts.force });
+    return { message: lines.join("\n"), exitCode };
 }
 /**
- * Create the backend project, preferring a slug derived from the name so the live
- * URL reads like the app (`my-app.vincentt.app`) instead of a random one. An
- * explicit `slug` is authoritative — a collision surfaces so the caller re-asks.
- * A derived slug is best-effort: on any 4xx we fall back to a platform-assigned
- * slug rather than failing create over a name we chose.
+ * Resolve which org a create acts in: the named one if it is an ACTIVE membership,
+ * else the personal org when nothing is named. A named org the caller is not an
+ * active member of resolves to nothing rather than silently falling back — acting
+ * in an org the creator did not ask for is the retargeting the binding rules forbid.
  */
-async function createProjectPreferringSlug(cfg, name, explicitSlug) {
-    if (explicitSlug)
-        return createProject(cfg, name, explicitSlug);
-    const candidate = slugify(name);
-    if (!candidate)
-        return createProject(cfg, name);
-    try {
-        return await createProject(cfg, name, candidate);
-    }
-    catch (err) {
-        if (err instanceof BackendError &&
-            err.status !== undefined &&
-            err.status >= 400 &&
-            err.status < 500) {
-            return createProject(cfg, name); // taken/invalid derived slug → let the platform pick
-        }
-        throw err;
-    }
+export async function resolveOrgForCommand(cfg, input) {
+    const machine = await loadMachineConfig();
+    const named = {
+        flag: input.flag,
+        env: process.env.VINCENTT_ORG,
+        config: machine.activeOrg,
+    };
+    const me = await getMe(cfg);
+    const org = resolveActiveOrg(me, named);
+    if (org)
+        return { ok: true, org };
+    const asked = activeOrgSlug(named);
+    return {
+        ok: false,
+        message: asked
+            ? `✗ You are not an active member of "${asked.slug}".\n\n  Run \`vincentt whoami\` to see which organizations you belong to.`
+            : "✗ No active organization.\n\n  Run `vincentt whoami` to see which organizations you belong to,\n  then re-run with `--org <slug>`.",
+    };
 }
+/**
+ * The shared `publish` orchestration behind both `vincentt publish` and the MCP
+ * `project_publish` tool, so the two surfaces can never diverge.
+ *
+ * MCP has no terminal, so it is a non-TTY caller: the command refuses without
+ * `--yes` rather than assuming consent, and refuses `--yes` outright on a first
+ * publish. An agent cannot make an address permanent.
+ */
 export async function projectPublish(projectCwd, opts = {}) {
-    const binding = await loadProjectBinding(projectCwd);
-    if (!binding) {
-        return {
-            message: "No project is bound to this directory. Run `vincentt create` first.",
-            notBound: true,
-        };
-    }
-    const cfg = await resolveConfig(projectCwd);
-    const dist = path.resolve(projectCwd, opts.distDir ?? "dist");
-    const commitSha = await gitHeadSha(projectCwd);
-    const result = await publishUpload(cfg, binding.projectId, dist, {
-        note: opts.note,
-        commitSha,
-    });
-    return {
-        message: `Published v${result.version}. Live at ${result.liveUrl}`,
-        notBound: false,
-        version: result.version,
-        liveUrl: result.liveUrl,
-        url: result.url,
+    const lines = [];
+    const print = (line) => {
+        lines.push(line);
     };
+    const exitCode = await publishCommand({
+        print,
+        write: () => {
+            // No redraw off a terminal; the degraded path emits whole lines.
+        },
+        confirm: async () => false,
+        cwd: projectCwd,
+        config: () => resolveConfig(projectCwd, {
+            allowCustomApi: opts.allowCustomApi,
+            warn: opts.warn ?? print,
+        }),
+        binding: async () => {
+            const located = await locateProjectBinding(projectCwd);
+            return located
+                ? { projectId: located.binding.projectId, slug: located.binding.slug }
+                : undefined;
+        },
+        token: async () => process.env.VINCENTT_PAT ?? (await loadMachineConfig()).pat,
+        isTTY: false,
+        now: () => Date.now(),
+        sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+    }, { distDir: opts.distDir, note: opts.note, yes: opts.yes });
+    return { message: lines.join("\n"), exitCode };
 }
 // ---- preview (one per process) ----------------------------------------------
 let activePreview = null;
@@ -123,10 +111,28 @@ let activeProjectCwd = null;
 export function getActivePreview() {
     return activePreview;
 }
-export async function previewStart(projectCwd, onLog) {
+/**
+ * Resolve the binding and the config, then start. The binding is a HINT and
+ * never an authority (B12): the projectId it carries is presented to the API,
+ * which resolves the org itself and answers 404 for every unreachable cause.
+ */
+export async function previewStart(projectCwd, onLog, extra = {}) {
     if (activePreview)
         return { preview: activePreview, started: false };
-    const preview = await startPreview({ projectCwd, onLog });
+    const located = await locateProjectBinding(projectCwd);
+    if (!located) {
+        throw new Error("This folder isn't linked to a project.\n\n" +
+            "  vincentt link <project-id>   (copy it from the console)\n" +
+            "  vincentt create             Register a new project for this folder");
+    }
+    const config = await resolveConfig(projectCwd, { warn: onLog });
+    const preview = await startPreview({
+        ...extra,
+        projectCwd,
+        config,
+        projectId: located.binding.projectId,
+        onLog,
+    });
     activePreview = preview;
     activeProjectCwd = projectCwd;
     // Record the OS-assigned relay port so a separate `vincentt logs`/`feedback`
@@ -135,7 +141,6 @@ export async function previewStart(projectCwd, onLog) {
         relayPort: preview.relayPort,
         url: preview.url,
         pid: process.pid,
-        tunnelPid: preview.tunnelPid,
         harnessPath: "/__harness",
     });
     return { preview, started: true };
@@ -164,11 +169,14 @@ function isAlive(pid) {
 /**
  * Stop a preview started by a *different* process (the common case: `vincentt
  * preview` runs in the background and the agent later wants it down). Reads the
- * pidfile and signals the recorded pids rather than the in-process `activePreview`.
- * SIGTERM to the preview process runs its graceful handler (which reaps the tunnel
- * + backend DNS route); if that process is already gone, its cloudflared child may
- * be orphaned to init, so kill the recorded tunnel pid directly. Either way, clear
- * the (now stale) relay info.
+ * pidfile and signals the recorded pid rather than the in-process
+ * `activePreview`.
+ *
+ * There is NO orphaned-tunnel case any more, and that is the point of the edge
+ * repoint: the tunnel is a socket this process owns rather than a child process
+ * that could be reparented to init. When the preview process dies the socket
+ * closes, the edge sees the tunnel go, and the session drains on its own — so
+ * SIGTERM plus clearing the stale relay info is the whole of the cleanup.
  */
 export async function previewStopSignal(projectCwd) {
     const info = await readRelayInfo(projectCwd);
@@ -176,36 +184,30 @@ export async function previewStopSignal(projectCwd) {
         return { stopped: false, message: "No preview is running for this directory." };
     }
     const previewAlive = info.pid !== undefined && isAlive(info.pid);
-    const reaped = [];
     if (previewAlive) {
         try {
             process.kill(info.pid, "SIGTERM");
-            reaped.push("preview process");
+            await clearRelayInfo(projectCwd);
+            return { stopped: true, message: "✓ Preview stopped. The link no longer works." };
         }
         catch {
-            /* raced with its own exit — fall through to tunnel cleanup */
-        }
-    }
-    // Only force-kill the tunnel directly when no live preview process will reap it.
-    if (!previewAlive && info.tunnelPid !== undefined && isAlive(info.tunnelPid)) {
-        try {
-            process.kill(info.tunnelPid, "SIGKILL");
-            reaped.push("orphaned tunnel");
-        }
-        catch {
-            /* already gone */
+            // Raced with its own exit; the socket is gone either way.
         }
     }
     await clearRelayInfo(projectCwd);
-    return reaped.length > 0
-        ? { stopped: true, message: `Stopped preview (${reaped.join(", ")}).` }
-        : { stopped: false, message: "No live preview process found; cleared stale relay info." };
+    return {
+        stopped: false,
+        message: "No live preview process found; cleared stale relay info.",
+    };
 }
 /** Resolve the relay client for a project's running preview, or throw a hint. */
 async function relayForProject(projectCwd, override) {
     if (override)
         return override;
-    const info = await readRelayInfo(projectCwd);
+    // VALIDATED, for the same reason `vincentt preview` validates it: a stale
+    // marker would point these reads at a dead port and surface a connection
+    // error instead of the one sentence that tells the creator what to do.
+    const info = await readLivePreview(projectCwd);
     if (!info) {
         throw new Error("No running preview for this project — run `vincentt preview` first.");
     }
@@ -216,9 +218,10 @@ export async function diagQuery(projectCwd, kind, opts = {}, relay) {
     const client = await relayForProject(projectCwd, relay);
     const q = {
         kind,
-        sessionId: opts.sessionId,
+        tester: opts.tester,
         since: opts.since,
         limit: opts.limit,
+        viewer: opts.viewer,
     };
     const result = await client.query(q);
     return kind === "log" && opts.errorsOnly ? filterErrors(result) : result;

package/dist/lib/org.d.ts

@@ -0,0 +1,29 @@
+import type { Me } from "./backend.js";
+export type OrgSource = "flag" | "env" | "config";
+export interface ActiveOrgInput {
+    /** --org <slug> */
+    flag?: string;
+    /** VINCENTT_ORG */
+    env?: string;
+    /** ~/.vincentt/config.json activeOrg */
+    config?: string;
+}
+/** flag → env → machine config. Nothing else; no inference, no folder-derived default. */
+export declare function activeOrgSlug(input: ActiveOrgInput): {
+    slug: string;
+    source: OrgSource;
+} | undefined;
+export interface ResolvedOrg {
+    slug: string;
+    name: string;
+    kind: "personal" | "team";
+}
+/**
+ * Pair a resolved slug with the membership `/me` reports for it. A slug that
+ * names no membership resolves to NOTHING rather than to a plausible default —
+ * acting in an org the creator did not name is silent retargeting.
+ *
+ * With no slug configured at all, the personal org is the fallback, matching what
+ * `vincentt login` already prints as the active org on a fresh machine.
+ */
+export declare function resolveActiveOrg(me: Me, input: ActiveOrgInput): ResolvedOrg | undefined;

package/dist/lib/org.js

@@ -0,0 +1,45 @@
+// Which org does a command act in? Resolved by PRECEDENCE, from sources the person
+// running the command controls — never from the folder's binding.
+//
+// `whoami` answers "who am I", so reading the binding would make it answer a
+// question about the folder instead, which is precisely the mystery a creator
+// running it is trying to escape.
+/** flag → env → machine config. Nothing else; no inference, no folder-derived default. */
+export function activeOrgSlug(input) {
+    if (input.flag)
+        return { slug: input.flag, source: "flag" };
+    if (input.env)
+        return { slug: input.env, source: "env" };
+    if (input.config)
+        return { slug: input.config, source: "config" };
+    return undefined;
+}
+/**
+ * Pair a resolved slug with the membership `/me` reports for it. A slug that
+ * names no membership resolves to NOTHING rather than to a plausible default —
+ * acting in an org the creator did not name is silent retargeting.
+ *
+ * With no slug configured at all, the personal org is the fallback, matching what
+ * `vincentt login` already prints as the active org on a fresh machine.
+ */
+export function resolveActiveOrg(me, input) {
+    const memberships = (me.memberships ?? []).filter(isActive);
+    const named = activeOrgSlug(input);
+    if (named) {
+        const match = memberships.find((m) => m.orgSlug === named.slug);
+        return match ? toOrg(match) : undefined;
+    }
+    const personal = memberships.find((m) => m.orgKind === "personal");
+    return personal ? toOrg(personal) : undefined;
+}
+/**
+ * An invited-but-never-accepted membership carries its INTENDED role from the
+ * moment the invite is sent, so a bare role read would treat a pending invite as
+ * a real one. Only active rows are memberships as far as the CLI is concerned.
+ */
+function isActive(m) {
+    return m.status === "active";
+}
+function toOrg(m) {
+    return { slug: m.orgSlug, name: m.orgName, kind: m.orgKind };
+}

package/dist/lib/projects.d.ts

@@ -0,0 +1,82 @@
+import { type ResolvedConfig } from "../shared/config.js";
+export interface ProjectCommandDeps {
+    /** Print a transcript line. */
+    print: (line: string) => void;
+    /** The directory the command acts in. */
+    cwd: string;
+    /** Resolve the API host + PAT (the apiUrl gate lives here). */
+    config: () => Promise<ResolvedConfig>;
+}
+export interface CreateCommandDeps extends ProjectCommandDeps {
+    /**
+     * The org to create in, resolved LAZILY: every local guard (already linked,
+     * unusable name) runs before this is called, so a refused create makes no
+     * server request at all.
+     */
+    org: () => Promise<{
+        ok: true;
+        org: {
+            slug: string;
+            name: string;
+        };
+    } | {
+        ok: false;
+        message: string;
+    }>;
+}
+export interface CreateCommandOptions {
+    name?: string;
+    slug?: string;
+    /** Replace a binding this folder already has. */
+    force?: boolean;
+}
+/**
+ * `vincentt create` — register a project and link this folder to it.
+ *
+ * It does NOT scaffold. An unscaffolded folder gets a `!` advisory and the command
+ * PROCEEDS: the server accepts a create from any folder or none, and blocking here
+ * would put the open template behind the auth gate, which is the one thing the
+ * init/create split exists to prevent.
+ */
+export declare function createCommand(deps: CreateCommandDeps, opts?: CreateCommandOptions): Promise<number>;
+/**
+ * `vincentt link <project-id>` — one verb for four situations (console-first
+ * birth, a fresh clone, a folder that lost its binding, a re-link after
+ * `login --force`). It is a READ plus a local write: the server has no notion of
+ * "which folder", so linking is entirely client-side, gated only by the server's
+ * willingness to return the project at all.
+ */
+export declare function linkCommand(deps: ProjectCommandDeps, projectId: string | undefined): Promise<number>;
+/**
+ * The API's error messages are lowercase and unpunctuated by convention
+ * (`that handle is taken`, `this project is not available to you`), while both
+ * client surfaces present them as sentences. Casing is the ONLY thing either
+ * surface may change — the words are the server's, so a creator moving between
+ * the CLI and the console reads one sentence and support can match a screenshot
+ * to a log line without a translation table.
+ */
+export declare function asSentence(message: string): string;
+/**
+ * Flow L10. Line 1 is the API's message; the body names both candidate causes and
+ * resolves neither (that is the maximum the anti-oracle contract permits, and it
+ * is accurate for all four real causes). `whoami` is offered first because it is
+ * the one diagnosis that discloses nothing about the project.
+ */
+export declare function printUnreachable(print: (line: string) => void, message: string): void;
+/**
+ * `vincentt unlink` — deletes the local binding. NO server call: the binding is a
+ * local pointer and the project is untouched, so there is nothing to tell the
+ * server about.
+ */
+export declare function unlinkCommand(deps: ProjectCommandDeps): Promise<number>;
+/**
+ * The advisory's trigger: a package.json that depends on @vincentt-xr/sdk. It is a
+ * HINT only — create proceeds either way — so a false negative costs one extra
+ * line of output, never a refused command.
+ */
+export declare function looksLikeVincenttApp(cwd: string): Promise<boolean>;
+/** Resolve the bound project for a project-scoped verb, or explain why not. */
+export declare function requireBinding(deps: ProjectCommandDeps): Promise<{
+    projectId: string;
+    slug: string;
+} | undefined>;