@ycadence/cli 0.2.1 → 0.4.0

package/README.md

@@ -30,7 +30,27 @@ npm install -g @yarlisaisolutions/ycadence-cli
 The package installs two commands that behave the same: `ycadence`, and `devpulse`,
 the name from before the rename.
 
-## Configure
+## Sign in
+
+**Behind Google IAP** (the Yarlis instances): open the web app, go to **Settings →
+Account → Command line**, click **Copy command**, and run it. It looks like this:
+
+```sh
+ycadence login --setup ycs1.…
+```
+
+It prints a code and a google.com/device link. Approve it with your work account and the
+CLI finishes by itself: the instance issues this machine a personal token, and everything
+secret goes into your OS keychain. Then:
+
+```sh
+ycadence doctor
+```
+
+The full walkthrough, troubleshooting and the admin setup are in
+[docs/cli/getting-started.md](https://github.com/YarlisAISolutions/dev-pulse/blob/main/docs/cli/getting-started.md).
+
+**Anywhere else**, sign in with a personal token from **Settings → Account → API tokens**:
 
 ```sh
 ycadence login --url https://ycadence.example.com --api-key-stdin < key.txt
@@ -41,8 +61,7 @@ ycadence doctor                              # checks configuration and connecti
 Profiles live in `~/.config/ycadence/config.json` (`$XDG_CONFIG_HOME` aware); switch with
 `--profile <name>` or `ycadence config use <name>`. The API key is kept in the OS keychain
 (macOS Keychain, or the Secret Service through `secret-tool`), else in a `credentials.json`
-with mode 0600. For an instance behind Google IAP, `ycadence login --oauth-client-id …
---iap-audience …` signs in with Google and refreshes the identity token itself.
+with mode 0600.
 
 Environment variables still win, so CI needs nothing else:
 

package/dist/bin.js

@@ -168,7 +168,7 @@ async function* paginate(fetchPage, options = {}) {
 }
 
 // ../sdk/src/version.ts
-var SDK_VERSION = "0.2.0";
+var SDK_VERSION = "0.3.0";
 
 // ../sdk/src/client.ts
 var DEFAULT_RETRY = { retries: 2, baseDelayMs: 250, maxDelayMs: 8000 };
@@ -535,6 +535,7 @@ var PROFILE_KEYS = [
   "project",
   "format",
   "oauthClientId",
+  "oauthFlow",
   "iapAudience"
 ];
 var PROFILE_KEY_HELP = {
@@ -543,6 +544,7 @@ var PROFILE_KEY_HELP = {
   project: "Default project id (or identifier, once the server lists projects)",
   format: "Default output format: table, json or ndjson",
   oauthClientId: "Desktop OAuth client id used by `ycadence login` for IAP",
+  oauthFlow: "How `ycadence login` signs in to Google: device or loopback",
   iapAudience: "The IAP OAuth client id; the audience of the identity token"
 };
 function configDirectory(env) {
@@ -1683,6 +1685,17 @@ function closingState(states) {
   }
   return done;
 }
+async function resolveTypeId(client, projectId, value) {
+  if (isUuid(value))
+    return value;
+  const { types: types2 } = await client.listTypes(projectId);
+  const named = types2.filter((type) => typeof type.id === "string" && typeof type.name === "string");
+  const match = named.find((type) => type.name.toLowerCase() === value.toLowerCase());
+  if (match === undefined) {
+    throw new CliError(`No work item type "${value}" in this project. Types: ${named.map((type) => type.name).join(", ")}.`, "validation_failed", EXIT.validation);
+  }
+  return match.id;
+}
 var KEY_SCAN_LIMIT = 2000;
 async function resolveWorkItemId(client, value, projectId) {
   if (isUuid(value))
@@ -1859,6 +1872,40 @@ function completionScript(root, shell) {
   return fish(root);
 }
 
+// src/handlers/auth.ts
+import { hostname } from "node:os";
+
+// ../core/src/cli-setup.ts
+var SETUP_CODE_PREFIX = "ycs1.";
+function decodeSetupCode(code) {
+  const trimmed = code.trim();
+  if (!trimmed.startsWith(SETUP_CODE_PREFIX))
+    return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(Buffer.from(trimmed.slice(SETUP_CODE_PREFIX.length), "base64url").toString("utf8"));
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null)
+    return null;
+  const { u, c, s, f } = parsed;
+  if (typeof u !== "string" || typeof c !== "string" || typeof s !== "string")
+    return null;
+  if (f !== "device" && f !== "loopback")
+    return null;
+  try {
+    const url = new URL(u);
+    if (url.protocol !== "https:" && url.hostname !== "localhost")
+      return null;
+  } catch {
+    return null;
+  }
+  if (c === "" || s === "")
+    return null;
+  return { url: u.replace(/\/+$/, ""), oauthClientId: c, oauthClientSecret: s, flow: f };
+}
+
 // src/handlers/auth.ts
 function str(value) {
   return typeof value === "string" ? value : undefined;
@@ -1869,11 +1916,44 @@ function keyHint(key) {
 async function storedKey(context) {
   return readEnv("API_KEY", context.env) ?? await context.secrets.get(secretAccount.apiKey(context.config.profile));
 }
+async function requestCliToken(context, url, idToken) {
+  let response;
+  try {
+    response = await context.fetch(`${url}/api/auth/iap/cli-token`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${idToken}`,
+        "Content-Type": "application/json",
+        Accept: "application/json"
+      },
+      body: JSON.stringify({ organization: context.config.org, host: hostname() })
+    });
+  } catch (error) {
+    throw new CliError(`Could not reach ${new URL(url).host}: ${error instanceof Error ? error.message : "error"}`, "network_error", EXIT.tempfail);
+  }
+  if (response.status === 404)
+    return null;
+  const body = await response.json().catch(() => ({}));
+  if (!response.ok || body.token === undefined || body.organization === undefined) {
+    throw new CliError(`Signed in, but no token was issued: ${body.error ?? `HTTP ${response.status}`}`, body.code ?? "token_refused");
+  }
+  return { token: body.token, organization: body.organization };
+}
 var loginHandler = async (context) => {
   const profile = context.config.profile;
   assertProfileName(profile);
   const file = await context.configStore.load();
   const stored = { ...file.profiles[profile] ?? {} };
+  const setupFlag = str(context.flags.setup);
+  const setup = setupFlag === undefined ? undefined : decodeSetupCode(setupFlag);
+  if (setup === null) {
+    throw new UsageError("That setup code could not be read. Copy the command again from Settings → Account → Command line.");
+  }
+  if (setup !== undefined) {
+    stored.url = setup.url;
+    stored.oauthClientId = setup.oauthClientId;
+    stored.oauthFlow = setup.flow;
+  }
   const url = str(context.flags.url);
   if (url !== undefined) {
     try {
@@ -1907,12 +1987,12 @@ var loginHandler = async (context) => {
   } else if (clientId === undefined) {
     context.notice("No OAuth client is configured, so the IAP sign-in is skipped. That is right for an instance that is not behind IAP. For one that is, a person must first create the Desktop OAuth client (see docs/cli/work-management.md), then run `ycadence login --oauth-client-id <id> --iap-audience <IAP client id>`.");
   } else {
-    const clientSecret = context.env.YCADENCE_OAUTH_CLIENT_SECRET || await context.secrets.get(secretAccount.oauthClientSecret(profile));
+    const clientSecret = context.env.YCADENCE_OAUTH_CLIENT_SECRET || setup?.oauthClientSecret || await context.secrets.get(secretAccount.oauthClientSecret(profile));
     if (clientSecret === undefined || clientSecret === "") {
-      throw new ConfigError("The OAuth client secret is missing. Set YCADENCE_OAUTH_CLIENT_SECRET for this login; it is then kept in the credential store.");
+      throw new ConfigError("The OAuth client secret is missing. Copy the sign-in command from Settings → Account → Command line, or set YCADENCE_OAUTH_CLIENT_SECRET for this login; it is then kept in the credential store.");
     }
     const client = oauthClientFrom({ clientId, clientSecret, env: context.env });
-    const tokens = context.flags.device === true ? await deviceLogin({
+    const tokens = context.flags.device === true || stored.oauthFlow === "device" ? await deviceLogin({
       client,
       fetch: context.fetch,
       print: (message) => context.notice(message),
@@ -1943,6 +2023,19 @@ var loginHandler = async (context) => {
       await context.secrets.set(secretAccount.identityToken(profile), JSON.stringify({ token: identity.idToken, expiresAt: identity.expiresAt }));
     }
     signedIn = true;
+    if (apiKey === undefined && identity !== undefined && stored.url !== undefined) {
+      const issued = await requestCliToken(context, stored.url, identity.idToken);
+      if (issued === null) {
+        context.notice("This server cannot issue CLI tokens yet. Create a personal token under Settings → Account → API tokens, then run `ycadence login --api-key-stdin` with it on stdin.");
+      } else {
+        apiKey = issued.token;
+        if (stored.org === undefined) {
+          stored.org = issued.organization;
+          file.profiles[profile] = stored;
+          await context.configStore.save(file);
+        }
+      }
+    }
   }
   if (apiKey !== undefined)
     await context.secrets.set(secretAccount.apiKey(profile), apiKey);
@@ -2144,7 +2237,7 @@ var configPathHandler = async (context) => {
 };
 
 // src/version.ts
-var CLI_VERSION = "0.2.1";
+var CLI_VERSION = "0.4.0";
 
 // src/handlers/doctor.ts
 function legacyNote(name, env) {
@@ -2545,6 +2638,12 @@ var WORK_FIELD_FLAGS = {
     placeholder: "<name|id>",
     description: "State, by name or id"
   },
+  type: {
+    name: "type",
+    type: "string",
+    placeholder: "<name|id>",
+    description: "Work item type, by name or id"
+  },
   parent: {
     name: "parent",
     type: "string",
@@ -2677,6 +2776,9 @@ var createWork = async (context) => {
   if (stateValue !== undefined) {
     body.stateId = isUuid(stateValue) ? stateValue : findState(await listStates(client, projectId), stateValue).id;
   }
+  const typeValue = str6(context.flags.type);
+  if (typeValue !== undefined)
+    body.typeId = await resolveTypeId(client, projectId, typeValue);
   const assignees = list(context.flags.assignee);
   for (const assignee of assignees) {
     if (!isUuid(assignee)) {
@@ -2725,6 +2827,10 @@ var updateWork = async (context) => {
   if (stateValue !== undefined) {
     body.stateId = isUuid(stateValue) ? stateValue : findState(await listStates(client, await context.projectId()), stateValue).id;
   }
+  const typeValue = str6(context.flags.type);
+  if (typeValue !== undefined) {
+    body.typeId = isUuid(typeValue) ? typeValue : await resolveTypeId(client, await context.projectId(), typeValue);
+  }
   if (context.flags["no-parent"] === true)
     body.parentId = null;
   const parent = str6(context.flags.parent);
@@ -2737,7 +2843,7 @@ var updateWork = async (context) => {
   if (targetDate !== undefined)
     body.targetDate = targetDate;
   if (Object.keys(body).length === 0) {
-    throw new UsageError("Nothing to update. Pass at least one of --title, --description, --priority, --state, --parent, --start-date, --target-date.");
+    throw new UsageError("Nothing to update. Pass at least one of --title, --description, --priority, --state, --type, --parent, --start-date, --target-date.");
   }
   const version = context.flags["expect-version"];
   const updated = await client.updateWorkItem(id, body, context.mutationOptions(version === undefined ? {} : { expectedVersion: version }));
@@ -2812,6 +2918,12 @@ var legacyProjectArg = {
   description: "Project id (the older positional form of --project)"
 };
 var LOGIN_FLAGS = [
+  {
+    name: "setup",
+    type: "string",
+    placeholder: "<code>",
+    description: "Setup code from Settings → Account → Command line (URL, OAuth client, flow)"
+  },
   { name: "url", type: "string", placeholder: "<url>", description: "The instance URL" },
   { name: "api-key-stdin", type: "boolean", description: "Read the API key from stdin" },
   { name: "device", type: "boolean", description: "Use the device flow (no local browser)" },
@@ -2924,6 +3036,7 @@ var TREE = {
             WORK_FIELD_FLAGS.descriptionFile,
             WORK_FIELD_FLAGS.priority,
             WORK_FIELD_FLAGS.state,
+            WORK_FIELD_FLAGS.type,
             {
               name: "assignee",
               type: "string",
@@ -2944,7 +3057,8 @@ var TREE = {
           ],
           examples: [
             'ycadence work create --project <projectId> --title "Fix login redirect" --priority high',
-            'ycadence work create --title "Spike" --description-file notes.md --idempotency-key spike-1'
+            'ycadence work create --title "Spike" --description-file notes.md --idempotency-key spike-1',
+            'ycadence work create --project <projectId> --title "Pick a billing provider" --type Decision --label decisions'
           ],
           run: createWork
         },
@@ -2959,6 +3073,7 @@ var TREE = {
             WORK_FIELD_FLAGS.descriptionFile,
             WORK_FIELD_FLAGS.priority,
             WORK_FIELD_FLAGS.state,
+            WORK_FIELD_FLAGS.type,
             WORK_FIELD_FLAGS.parent,
             { name: "no-parent", type: "boolean", description: "Remove the parent" },
             WORK_FIELD_FLAGS.startDate,
@@ -3301,10 +3416,11 @@ var TREE = {
     {
       name: "login",
       summary: "Save a profile, sign in for IAP, and store an API key",
-      description: "Signs in with Google (loopback, or --device) against the configured Desktop OAuth client for an IAP identity token, when one is configured. The API key is read from stdin and kept in the OS keychain.",
+      description: "Behind IAP, run the command from Settings → Account → Command line: `--setup` carries the URL and OAuth client, the device flow signs you in to Google, and the instance issues this machine a personal token. Elsewhere, pass --url and an API key on stdin. Credentials are kept in the OS keychain.",
       needsClient: false,
       flags: LOGIN_FLAGS,
       examples: [
+        "ycadence login --setup ycs1.…",
         "ycadence login --url https://ycadence.example.com --api-key-stdin < key.txt",
         "ycadence login --profile yarlis --oauth-client-id <desktop client id> --iap-audience <iap client id>"
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ycadence/cli",
-  "version": "0.2.1",
+  "version": "0.4.0",
   "description": "YCadence from the command line: work items, states, cycles and imports.",
   "keywords": [
     "ycadence",