indraq_cli 2.2.1 → 2.2.2

package/CHANGELOG_v2.1.0.md

@@ -0,0 +1,27 @@
+# IndraQ CLI v2.1.0
+
+## Highlights
+
+- Added unlimited named provider scopes for AWS, NPM, Jenkins DEV/PROD and GHCR.
+- Provider scopes are organization-owned and created only by admins.
+- Added USE/MANAGE scope membership with manager-limited delegation.
+- User creation now asks which manageable scopes to provision and supports multiple scopes at once.
+- Users see only assigned scopes and can safely describe account/server metadata without secrets.
+- Added per-user provider defaults and per-project/environment scope links.
+- Added self-service AWS key rotation and NPM/Jenkins password rotation.
+- Added audited scope add/remove/default/credential operations with mandatory reasons.
+- Jenkins project access uses exact Role Strategy Item Roles with Discover/Read/Build/Cancel/Workspace only.
+- Jenkins + GHCR are mandatory for deploy; Route53 and NPM are optional.
+- Optional DNS/NPM supports Skip, Create/reconcile and Link existing.
+- `--env` is explicitly an IndraQ project/resource environment selector, not a `.env` loader.
+- Cloud API endpoint changed to `https://cli.indraq.com`.
+- NPM networking/TLS/auth errors provide actionable diagnostics instead of only `fetch failed`.
+- Rewritten README and command help around the scope model.
+
+## Database
+
+Adds `cloud-api/sql/008_provider_scopes.sql`.
+
+## Compatibility
+
+`indraq provider configure` remains as an admin compatibility alias for `indraq scope create`.

package/CHANGELOG_v2.2.0.md

@@ -0,0 +1,60 @@
+# IndraQ CLI v2.2.0
+
+## Scope-first deployment completion
+
+- Prebuild now requires shared admin-created environments; the project-local custom IPv4 deployment target path was removed.
+- `prebuild` no longer exposes legacy `--host-port`, `--networks`, `--volumes`, or `--flags` options.
+- Required GHCR and Jenkins scopes are linked to `project_environment_scopes` during setup and reused afterwards.
+- `indraq deploy --env <env>` uses saved scope bindings without prompting on every deployment.
+- `--select-scopes` is the explicit deployment-time override.
+
+## Credential security
+
+- `USE` members can no longer resolve the organization AWS/NPM/Jenkins management credential.
+- AWS resolution returns the user's own IndraQ-managed IAM access key.
+- NPM/Jenkins resolution returns the user's own encrypted native-account password.
+- AWS key rotation and NPM/Jenkins password rotation are performed server-side with the scope management credential.
+- GHCR remains a deliberate shared deployment credential scoped to assigned members and used by the CLI through an isolated temporary Docker login.
+
+## Projects and authorization
+
+- Managers are no longer implicit WRITE users for every organization project.
+- Non-admin project visibility is limited to the creator or explicit project membership.
+- Added `project rename`, `project archive`, `project restore`, and permanent `project delete`.
+- Archived projects are blocked from scope mutation, infrastructure mutation, credential resolution for deployment, prebuild, and deploy until restored.
+- Manager resource-grant inspection is limited to projects the manager can actually manage.
+
+## User/scope operations
+
+- Added `indraq user scopes [email]`.
+- NPM/Jenkins scope-native account records now retain the user's encrypted password for personal resolution and self-rotation.
+- Existing Jenkins Role Strategy Item Role synchronization remains the project-pipeline authorization mechanism.
+
+## Database
+
+Added `cloud-api/sql/009_scope_user_secrets_and_project_lifecycle.sql`:
+
+- `scope_external_accounts.encrypted_secret`
+- `projects.archived_at`
+- `projects.archived_by`
+
+## Strict TypeScript build compatibility fix — 2026-09-10
+
+- Fixed 12 `exactOptionalPropertyTypes` build errors reported with the real AWS SDK 3.1123.0 declarations.
+- Removed hand-written callback parameter shapes for AWS SDK `ResourceRecord`, `Tag`, `HostedZone`, and `AttachedPolicy` values and now let TypeScript infer the SDK-native callback types.
+- Affected files:
+  - `src/modules/aws/commands/dns.command.ts`
+  - `src/modules/aws/commands/healthcheck.command.ts`
+  - `src/modules/aws/services/route53-lookup.service.ts`
+  - `src/modules/prebuild/commands/prebuild.command.ts`
+  - `src/modules/scopes/commands/scope.command.ts`
+  - `src/modules/users/providers/aws-user.provider.ts`
+- Runtime behavior is unchanged; this is a source/type compatibility correction.
+
+## Documentation/help synchronization
+
+- Focused `help scope` now lists personal AWS credential/key and NPM/Jenkins password rotation commands.
+- Focused `help users` now documents `user list`, `user scopes [email]`, and self-service Cloud password reset.
+- Focused `help deploy` now explains saved scope reuse and the explicit `--select-scopes` override.
+- Removed stale v2.1 wording from compatibility command descriptions.
+- README now explicitly states that provider-management secrets are never returned to normal `USE` members.

package/CHANGELOG_v2.2.1.md

@@ -0,0 +1,19 @@
+# IndraQ CLI v2.2.1
+
+Bug-fix release for project scope selection and shared-environment deployment.
+
+## Fixed
+
+- Project scope linking now always displays the eligible scopes, even when only one scope is visible.
+- The selected scope is shown with provider/name/company/endpoint/access before it is linked.
+- The audit-reason prompt now comes after scope selection so the account being linked is clear.
+- `indraq deploy` now lists the available shared environments and lets the user choose one interactively.
+- `indraq deploy --env <environment>` validates and deploys the exact shared environment used by prebuild.
+- `indraq deployment run` can also prompt for an environment when `--env` is omitted.
+- `deploy:dev` and `deploy:prod` remain compatibility aliases. If no matching dev/prod environment exists, they open the shared-environment picker instead of trying to deploy a nonexistent environment.
+- Help and README examples now prefer real shared-environment names rather than assuming every organization has `dev` and `prod` environments.
+
+## Validation
+
+- 16/16 configured regression suites pass, including the new v2.2.1 environment/scope-selection regression.
+- Updated emitted JavaScript files pass `node --check`.

package/CHANGELOG_v2.2.2.md

@@ -0,0 +1,18 @@
+# IndraQ CLI v2.2.2
+
+## Persistent Cloud sessions
+
+- Replaced the single 12-hour login JWT with a persistent server-side CLI session.
+- Access JWTs are now short-lived (1 hour) and refresh automatically in the background.
+- A refresh/session token is stored alongside the access token in `~/.indraq/cloud.json`.
+- The refresh session has no time-based expiry: normal users stay signed in until they explicitly run `indraq logout`, their account is removed/disabled, or their Cloud password is reset.
+- `indraq logout` now revokes the server-side session as well as clearing local credentials.
+- Every session-backed Cloud request verifies that the server-side session has not been revoked.
+- Existing still-valid v2.2.1 JWTs are automatically upgraded to persistent sessions on the next Cloud request, avoiding an unnecessary login during upgrade when possible.
+- Cloud password reset/admin password reset revokes existing sessions. First-login password change keeps the current session and revokes any other temporary-password sessions.
+
+## Cloud API
+
+- Cloud API version: `0.8.0`.
+- Added migration `010_persistent_auth_sessions.sql`.
+- Added `/auth/session`, `/auth/refresh`, and `/auth/logout` endpoints.

package/README.md

@@ -212,7 +212,7 @@ indraq project link
 ### 7. Choose project provider defaults
 
 ```bash
-indraq project scopes --env dev
+indraq project scopes --env indraq-test-airtel
 ```
 
 A project may use a different scope than your personal default.
@@ -220,27 +220,33 @@ A project may use a different scope than your personal default.
 ### 8. Reconcile infrastructure
 
 ```bash
-indraq prebuild --env dev
+indraq prebuild
+# choose one of the shared environments shown by the CLI
 ```
 
 ### 9. Deploy
 
 ```bash
-indraq deploy:dev
-# or
-indraq deploy --env staging
+indraq deploy
+# choose one of the shared environments shown by the CLI
+# or deploy directly:
+indraq deploy --env indraq-test-airtel
 ```
 
 Normal deploys reuse the scopes already saved for that project/environment. Use `--select-scopes` only when you intentionally want to review or change those bindings:
 
 ```bash
-indraq deploy --env dev --select-scopes
+indraq deploy --env indraq-test-airtel --select-scopes
 ```
 
 ---
 
 ## Provider scopes
 
+### Scope selection is always visible
+
+When linking a project to a provider scope, the CLI prints the eligible scopes and asks you to choose one even when only one scope is available. This prevents silent account selection and lets you verify company/account/endpoint before linking.
+
 ### Unlimited named scopes
 
 ```text
@@ -348,7 +354,7 @@ flowchart LR
 Use:
 
 ```bash
-indraq project scopes --env dev
+indraq project scopes --env indraq-test-airtel
 indraq project scopes --env prod
 ```
 
@@ -515,7 +521,7 @@ indraq help aws
 | Command | Use |
 |---|---|
 | `indraq login` | Sign in |
-| `indraq logout` | Remove local Cloud token |
+| `indraq logout` | Revoke the persistent Cloud session and remove local session credentials |
 | `indraq whoami` | Show current identity |
 | `indraq doctor` | Diagnose Node/Java/Git/tar/PATH |
 | `indraq logs` | Audit/log access where permitted |
@@ -572,9 +578,10 @@ indraq help aws
 | Command | Use |
 |---|---|
 | `indraq prebuild --env <env>` | Reconcile infrastructure |
-| `indraq deploy:dev` | Dev deploy |
-| `indraq deploy:prod` | Prod deploy |
-| `indraq deploy --env <env>` | Named environment deploy using saved scope bindings |
+| `indraq deploy` | Interactively choose an available shared environment and deploy |
+| `indraq deploy --env <env>` | Deploy an exact shared environment using its saved scope bindings |
+| `indraq deploy:dev` | Convenience alias if `dev`/`development` exists; otherwise opens the environment picker |
+| `indraq deploy:prod` | Convenience alias if `prod`/`production` exists; otherwise opens the environment picker |
 | `indraq deploy --env <env> --select-scopes` | Explicitly review/change project scope bindings before deploy |
 | `indraq jenkins pipelines --stage dev` | List visible pipelines |
 | `indraq jenkins run [job] --stage dev` | Run pipeline with discovered parameters |
@@ -596,6 +603,12 @@ indraq proxy create api.example.com
 
 ---
 
+### Persistent login sessions
+
+`indraq login` creates a persistent CLI session. The access token is refreshed automatically by the CLI, so normal users do **not** need to log in again every few hours or before each build/deployment. The session continues until `indraq logout` is run, the Cloud account is removed/disabled, or the Cloud password is reset. `indraq logout` revokes the server-side session and removes the local session credentials.
+
+Existing v2.2.1 tokens are upgraded automatically when still valid; if an old token has already expired, one final login is required after upgrading.
+
 ## Common workflows
 
 ### Admin adds a new customer server
@@ -621,7 +634,7 @@ The manager can choose only a scope where they already have MANAGE access and ca
 ```bash
 indraq scope list
 indraq scope describe "AWS Client ABC"
-indraq project scopes --env dev
+indraq project scopes --env indraq-test-airtel
 indraq prebuild --env dev
 indraq deploy:dev
 ```
@@ -677,7 +690,7 @@ indraq scope add-user
 Those two are mandatory. Add the user to the required scope and link/select it:
 
 ```bash
-indraq project scopes --env dev
+indraq project scopes --env indraq-test-airtel
 ```
 
 ### DNS is missing but deployment should continue
@@ -726,7 +739,7 @@ npm --prefix cloud-api run build
 <div align="center">
   <img src="docs/assets/indraq-mark.png" alt="IndraQ mark" width="70" />
 
-  **IndraQ CLI v2.2.0**
+  **IndraQ CLI v2.2.2**
 
   Scope-based infrastructure access. Durable projects. Safer deployments.
 </div>

package/RELEASE_CHECKS_v2.2.0.md

@@ -0,0 +1,27 @@
+# IndraQ CLI v2.2.0 Release Checks
+
+## Completed in the release workspace
+
+- `npm run build` passed under the project's real strict TypeScript configuration. The sandbox used declaration-only shims for unavailable package typings because DNS could not reach `registry.npmjs.org`; strictness was not disabled for this final build.
+- `npm --prefix cloud-api run build` passed under its real TypeScript configuration using the same temporary declaration-only offline shim approach.
+- `npm test` passed all configured regression suites after rebuilding `dist/`.
+- The prebuild integration regression executes the rebuilt `dist/modules/prebuild/...` implementation and validates create/reuse/repair behavior.
+- v2.2 regression checks cover the scope-secret boundary, personal AWS/NPM/Jenkins credential paths, project membership visibility, archive blocking, project lifecycle commands, saved scope deployment, and Jenkins Item Role preservation.
+- `npm pack --dry-run` completed successfully in the offline build workspace before temporary shims were removed.
+- All emitted CLI + Cloud API JavaScript is syntax-checked during final packaging.
+
+## Publication / deployment gate
+
+On a machine with npm registry access, run one clean dependency-backed verification before publishing:
+
+```bash
+rm -rf node_modules cloud-api/node_modules
+npm ci
+npm --prefix cloud-api ci
+npm run build
+npm run build:cloud
+npm test
+npm pack --dry-run
+```
+
+The registry-access check is an environment/reproducibility gate; it does not change the v2.2 source included in this archive.

package/RELEASE_CHECKS_v2.2.2.md

@@ -0,0 +1,26 @@
+# Release checks — v2.2.2
+
+## Persistent login/session behavior
+
+- [x] Login stores an access token plus a persistent refresh/session token.
+- [x] Expired access token receives HTTP 401, refreshes through `/auth/refresh`, and retries the original Cloud request automatically.
+- [x] `indraq logout` revokes the server-side session when Cloud is reachable and always clears local session credentials.
+- [x] Server checks session revocation on every request for session-backed access tokens.
+- [x] Existing still-valid v2.2.1 JWTs can upgrade via `/auth/session` without a password prompt.
+- [x] Cloud password reset/admin password reset revokes existing sessions.
+- [x] First-login password change keeps the current session and revokes other temporary-password sessions.
+- [x] Refresh tokens are stored hashed in PostgreSQL, never plaintext.
+- [x] Migration `010_persistent_auth_sessions.sql` is included and applied by the existing migration runner.
+
+## Regression validation
+
+- [x] Existing v2.2.1 environment/scope-selection regression remains green.
+- [x] New v2.2.2 persistent-session source regression passes.
+- [x] New v2.2.2 runtime regression passes against compiled `dist` and verifies login → expiry/refresh/retry → logout → legacy-session upgrade.
+- [x] Full configured regression chain passes (18 commands/suites).
+- [x] Changed CLI session core (`cloud-config.ts` + `cloud-api.service.ts`) passes strict TypeScript checking with `exactOptionalPropertyTypes` enabled.
+- [x] Emitted changed JavaScript and Cloud API `dist/index.js` pass `node --check`.
+
+## Build-environment note
+
+The sandbox npm registry install timed out and left external dependency directories incomplete, so a dependency-backed full root/cloud `npm run build` could not be repeated here. The changed session core was strict-type-checked independently, Cloud API source was syntax-transpiled with TypeScript, and runtime/regression tests use the rebuilt changed `dist`. Run the normal clean build on the release machine before deployment/publish.

package/TEST_RESULTS_v2.2.1.txt

@@ -0,0 +1,11 @@
+IndraQ CLI v2.2.1 validation
+============================
+
+Result: PASS
+
+Configured regression suites: 16/16 PASS
+New regression: v2.2.1 environment/scope-selection PASS
+Updated emitted JavaScript syntax checks: PASS
+
+Environment note:
+A fully clean npm install could not complete inside the packaging sandbox because package-registry access timed out. The source package uses the same dependency versions as v2.2.0. Run `npm i && npm run build && npm test` on a normal machine with npm registry access before publishing.

package/TEST_RESULTS_v2.2.2.txt

@@ -0,0 +1,39 @@
+IndraQ CLI v2.2.2 test results
+================================
+
+PASS test:cloud-endpoint
+PASS test:user-credentials
+PASS test:infrastructure
+PASS test:platform
+PASS test:project-access
+PASS test:project-create
+PASS test:jenkins-crumb
+PASS test:jenkins-port
+PASS test:prebuild
+PASS test:docker-context
+PASS test:identity-security
+PASS test:user-lifecycle-jenkins
+PASS test:v2-lifecycle
+PASS test:v21-scopes
+PASS test:v22
+PASS test:v221
+PASS test:v222
+PASS test:v222-runtime
+
+Persistent-session runtime coverage:
+- login stores access + refresh tokens
+- expired access token -> /auth/refresh -> original request retry
+- refreshed access token persisted locally
+- logout calls /auth/logout and removes local credentials
+- still-valid legacy v2.2.1 JWT upgrades through /auth/session without password prompt
+
+Focused strict TypeScript check:
+PASS src/modules/cloud/config/cloud-config.ts
+PASS src/modules/cloud/services/cloud-api.service.ts
+
+JavaScript syntax checks:
+PASS changed CLI dist files
+PASS cloud-api/dist/index.js
+
+Environment limitation:
+A clean npm dependency install could not complete in this sandbox because registry access timed out. See RELEASE_CHECKS_v2.2.2.md.

package/UPGRADE_v2.0_to_v2.1.md

@@ -0,0 +1,68 @@
+# Upgrade: IndraQ CLI v2.0 → v2.1
+
+v2.1 changes provider credentials from one-user/one-provider assumptions to organization provider scopes.
+
+## 1. Back up Cloud DB
+
+Back up the production IndraQ Cloud database before applying the migration.
+
+## 2. Deploy the v2.1 Cloud API
+
+Apply migrations in numeric order, including:
+
+```text
+cloud-api/sql/008_provider_scopes.sql
+```
+
+Build and restart the Cloud API.
+
+## 3. Install/link CLI v2.1
+
+```bash
+npm install
+npm run build
+npm test
+npm link
+indraq --version
+```
+
+Expected: `2.1.0`.
+
+## 4. Create scopes
+
+Admins create named scopes for each real provider account/server:
+
+```bash
+indraq scope create aws
+indraq scope create npm
+indraq scope create jenkins-dev
+indraq scope create jenkins-prod
+indraq scope create ghcr
+```
+
+## 5. Add managers/users
+
+Use `indraq scope add-user`. Admins may grant MANAGE to managers. Managers may grant USE to normal users only inside scopes they manage.
+
+## 6. Link project environments
+
+For every actively deployed project/environment:
+
+```bash
+indraq project scopes --env dev
+indraq project scopes --env prod
+```
+
+Jenkins and GHCR are required. AWS/NPM can stay unlinked.
+
+## 7. Reconcile
+
+```bash
+indraq prebuild --env dev
+```
+
+For existing DNS/proxy resources choose Link existing or Skip instead of creating duplicates.
+
+## 8. Jenkins
+
+Jenkins must use Role-Based Strategy. IndraQ grants project pipelines through Item Roles; do not manually give normal users Overall/Administer.

package/UPGRADE_v2.1_to_v2.2.md

@@ -0,0 +1,62 @@
+# Upgrade: IndraQ CLI v2.1 → v2.2
+
+Upgrade the CLI and Cloud API together.
+
+## 1. Back up the Cloud database
+
+Take a PostgreSQL backup before deploying the new Cloud API.
+
+## 2. Deploy Cloud API v0.7.0
+
+The Cloud API migration runner automatically applies SQL files in numeric order. On first v0.7.0 startup it will apply:
+
+```text
+009_scope_user_secrets_and_project_lifecycle.sql
+```
+
+This adds encrypted per-user NPM/Jenkins scope secrets and project archive metadata.
+
+## 3. Upgrade the CLI
+
+```bash
+npm install
+npm run build
+npm link
+indraq --version
+```
+
+Expected CLI version: `2.2.0`.
+
+## 4. Re-provision old NPM/Jenkins memberships when necessary
+
+v2.1 scope-native NPM/Jenkins rows did not store a personal encrypted password. If a v2.1 member receives an "identity is not fully provisioned" message after upgrade, a scope manager should remove and re-add that member, or have the member rotate the password after the native account is repaired.
+
+AWS scope credentials already have a dedicated encrypted per-user credential table and do not require this migration step.
+
+## 5. Save project scope bindings
+
+For each environment, run once if bindings are missing:
+
+```bash
+indraq project scopes --env dev
+indraq prebuild --env dev
+```
+
+Normal deploys then use:
+
+```bash
+indraq deploy --env dev
+```
+
+Use `--select-scopes` only when intentionally changing the saved bindings.
+
+## 6. Project lifecycle
+
+```bash
+indraq project rename <name>
+indraq project archive
+indraq project restore
+indraq project delete
+```
+
+Archive blocks infrastructure/deployment mutation until the project is restored. Permanent delete remains manager/admin restricted and requires WRITE access to the project.

package/UPGRADE_v2.2.1_to_v2.2.2.md

@@ -0,0 +1,15 @@
+# Upgrade v2.2.1 → v2.2.2
+
+1. Deploy the updated `cloud-api` first.
+2. Ensure startup migrations apply `cloud-api/sql/010_persistent_auth_sessions.sql`.
+3. Install/link the v2.2.2 CLI.
+4. Existing v2.2.1 logins that still have a valid 12-hour JWT are automatically converted into persistent sessions on the next Cloud request.
+5. If the old JWT had already expired before the upgrade, log in one final time. After that the CLI automatically refreshes its access token until `indraq logout` is run.
+
+Normal usage:
+
+```bash
+indraq login
+# ... use the CLI for days/weeks without logging in again ...
+indraq logout
+```