langctl 0.1.2 → 0.3.0

package/dist/commands/team.js

@@ -1,285 +1,81 @@
 import chalk from 'chalk';
-import ora from 'ora';
-import { isAuthenticated, getApiKey } from '../auth.js';
-const TEAM_MANAGEMENT_URL = 'https://bcgnmvkgkbhbxzzflwdb.supabase.co/functions/v1/manage-team-members';
-/**
- * List all team members
- */
+import { CliError, ExitCode, notFoundError, usageError } from '../core/errors.js';
+import { getSession } from '../core/http.js';
+import { log, printJson, runtime, table } from '../core/output.js';
+import { confirm } from '../core/prompts.js';
+const ROLES = ['viewer', 'member', 'admin'];
+async function members(session) {
+    return session.api.get(`/orgs/${session.orgId}/members`);
+}
+async function requireMember(session, email) {
+    const m = (await members(session)).find(x => x.email.toLowerCase() === email.toLowerCase());
+    if (!m)
+        throw notFoundError(`No team member with email ${email}.`, 'List members with "langctl team list".');
+    return m;
+}
+function checkRole(role) {
+    if (!ROLES.includes(role))
+        throw usageError(`Invalid role "${role}".`, `Use one of: ${ROLES.join(', ')} (ownership is transferred in the web app).`);
+}
 export async function listTeamCommand() {
-    if (!isAuthenticated()) {
-        console.log(chalk.red('✗ Not authenticated. Please run "langctl auth <api-key>" first.\n'));
-        return;
-    }
-    const apiKey = getApiKey();
-    const spinner = ora('Fetching team members...').start();
-    try {
-        const response = await fetch(TEAM_MANAGEMENT_URL, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'X-API-Key': apiKey
-            },
-            body: JSON.stringify({
-                action: 'list'
-            })
-        });
-        const data = await response.json();
-        if (!data.success) {
-            throw new Error(data.error);
-        }
-        spinner.stop();
-        if (!data.members || data.members.length === 0) {
-            console.log(chalk.yellow('\nNo team members found\n'));
-            return;
-        }
-        console.log(chalk.blue.bold(`\n👥 Team Members (${data.members.length})\n`));
-        data.members.forEach((member) => {
-            console.log(chalk.white.bold(member.email || member.user_id));
-            console.log(chalk.gray(`  Role: ${member.role}`));
-            if (member.joined_at) {
-                console.log(chalk.gray(`  Joined: ${new Date(member.joined_at).toLocaleDateString()}`));
-            }
-            console.log('');
-        });
-    }
-    catch (error) {
-        spinner.fail(chalk.red('Failed to list team members'));
-        console.error(chalk.red(`Error: ${error.message}\n`));
-    }
+    const session = await getSession();
+    const list = await members(session);
+    if (runtime.json)
+        return printJson(list);
+    table(list.map(m => [m.email, m.fullName ?? '', m.role, m.joinedAt ? new Date(m.joinedAt).toISOString().slice(0, 10) : '']), ['EMAIL', 'NAME', 'ROLE', 'JOINED']);
 }
-/**
- * Get team member details
- */
 export async function getTeamMemberCommand(email) {
-    if (!isAuthenticated()) {
-        console.log(chalk.red('✗ Not authenticated. Please run "langctl auth <api-key>" first.\n'));
-        return;
-    }
-    const apiKey = getApiKey();
-    const spinner = ora('Fetching member details...').start();
-    try {
-        const response = await fetch(TEAM_MANAGEMENT_URL, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'X-API-Key': apiKey
-            },
-            body: JSON.stringify({
-                action: 'get',
-                email
-            })
-        });
-        const data = await response.json();
-        if (!data.success) {
-            throw new Error(data.error);
-        }
-        spinner.stop();
-        const member = data.member;
-        console.log(chalk.blue.bold('\n👤 Team Member Details\n'));
-        console.log(chalk.white.bold(`Email: ${member.email}`));
-        console.log(chalk.gray(`Role: ${member.role}`));
-        console.log(chalk.gray(`User ID: ${member.user_id}`));
-        if (member.joined_at) {
-            console.log(chalk.gray(`Joined: ${new Date(member.joined_at).toLocaleString()}`));
-        }
-        console.log('');
-    }
-    catch (error) {
-        spinner.fail(chalk.red('Failed to get member details'));
-        console.error(chalk.red(`Error: ${error.message}\n`));
-    }
+    const session = await getSession();
+    const m = await requireMember(session, email);
+    if (runtime.json)
+        return printJson(m);
+    log.out(`${chalk.bold(m.email)}  ${m.role}${m.fullName ? `  ${m.fullName}` : ''}`);
 }
-/**
- * Invite team member
- */
-export async function inviteTeamMemberCommand(email, options) {
-    if (!isAuthenticated()) {
-        console.log(chalk.red('✗ Not authenticated. Please run "langctl auth <api-key>" first.\n'));
-        return;
-    }
-    const apiKey = getApiKey();
-    const spinner = ora(`Inviting ${email}...`).start();
-    try {
-        const response = await fetch(TEAM_MANAGEMENT_URL, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'X-API-Key': apiKey
-            },
-            body: JSON.stringify({
-                action: 'invite',
-                email,
-                role: options.role || 'member'
-            })
-        });
-        const data = await response.json();
-        if (!data.success) {
-            throw new Error(data.error);
-        }
-        spinner.succeed(chalk.green(data.message));
-        console.log('');
-    }
-    catch (error) {
-        spinner.fail(chalk.red('Failed to invite member'));
-        console.error(chalk.red(`Error: ${error.message}\n`));
-    }
+export async function inviteTeamMemberCommand(email, opts) {
+    checkRole(opts.role);
+    const session = await getSession();
+    const inv = await session.api.post(`/orgs/${session.orgId}/invitations`, { email, role: opts.role });
+    if (runtime.json)
+        return printJson(inv);
+    log.success(`Invited ${chalk.bold(email)} as ${opts.role}`);
 }
-/**
- * Remove team member
- */
 export async function removeTeamMemberCommand(email) {
-    if (!isAuthenticated()) {
-        console.log(chalk.red('✗ Not authenticated. Please run "langctl auth <api-key>" first.\n'));
-        return;
-    }
-    const apiKey = getApiKey();
-    const spinner = ora(`Removing ${email}...`).start();
-    try {
-        const response = await fetch(TEAM_MANAGEMENT_URL, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'X-API-Key': apiKey
-            },
-            body: JSON.stringify({
-                action: 'remove',
-                email
-            })
-        });
-        const data = await response.json();
-        if (!data.success) {
-            throw new Error(data.error);
-        }
-        spinner.succeed(chalk.green(data.message));
-        console.log('');
-    }
-    catch (error) {
-        spinner.fail(chalk.red('Failed to remove member'));
-        console.error(chalk.red(`Error: ${error.message}\n`));
-    }
+    const session = await getSession();
+    const m = await requireMember(session, email);
+    if (!(await confirm(`Remove ${m.email} from the organization?`)))
+        throw new CliError('Cancelled.', ExitCode.Error);
+    await session.api.delete(`/orgs/${session.orgId}/members/${m.id}`);
+    if (runtime.json)
+        return printJson({ removed: m.email });
+    log.success(`Removed ${chalk.bold(m.email)}`);
 }
-/**
- * Update team member role
- */
 export async function updateTeamRoleCommand(email, role) {
-    if (!isAuthenticated()) {
-        console.log(chalk.red('✗ Not authenticated. Please run "langctl auth <api-key>" first.\n'));
-        return;
-    }
-    const validRoles = ['viewer', 'member', 'admin', 'owner'];
-    if (!validRoles.includes(role)) {
-        console.log(chalk.red(`✗ Invalid role. Must be one of: ${validRoles.join(', ')}\n`));
-        return;
-    }
-    const apiKey = getApiKey();
-    const spinner = ora(`Updating role for ${email}...`).start();
-    try {
-        const response = await fetch(TEAM_MANAGEMENT_URL, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'X-API-Key': apiKey
-            },
-            body: JSON.stringify({
-                action: 'update-role',
-                email,
-                role
-            })
-        });
-        const data = await response.json();
-        if (!data.success) {
-            throw new Error(data.error);
-        }
-        spinner.succeed(chalk.green(data.message));
-        console.log('');
-    }
-    catch (error) {
-        spinner.fail(chalk.red('Failed to update role'));
-        console.error(chalk.red(`Error: ${error.message}\n`));
-    }
+    checkRole(role);
+    const session = await getSession();
+    const m = await requireMember(session, email);
+    await session.api.patch(`/orgs/${session.orgId}/members/${m.id}`, { role });
+    if (runtime.json)
+        return printJson({ email: m.email, role });
+    log.success(`${chalk.bold(m.email)} is now ${role}`);
 }
-/**
- * List invitations
- */
-export async function listInvitationsCommand(options) {
-    if (!isAuthenticated()) {
-        console.log(chalk.red('✗ Not authenticated. Please run "langctl auth <api-key>" first.\n'));
-        return;
-    }
-    const apiKey = getApiKey();
-    const spinner = ora('Fetching invitations...').start();
-    try {
-        const response = await fetch(TEAM_MANAGEMENT_URL, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'X-API-Key': apiKey
-            },
-            body: JSON.stringify({
-                action: 'list-invitations',
-                pending: options.pending || false
-            })
-        });
-        const data = await response.json();
-        if (!data.success) {
-            throw new Error(data.error);
-        }
-        spinner.stop();
-        if (!data.invitations || data.invitations.length === 0) {
-            console.log(chalk.yellow('\nNo invitations found\n'));
-            return;
-        }
-        console.log(chalk.blue.bold(`\n✉️  Invitations (${data.invitations.length})\n`));
-        data.invitations.forEach((invitation) => {
-            console.log(chalk.white.bold(invitation.email));
-            console.log(chalk.gray(`  Role: ${invitation.role}`));
-            console.log(chalk.gray(`  Status: ${invitation.status}`));
-            if (invitation.invited_at) {
-                console.log(chalk.gray(`  Invited: ${new Date(invitation.invited_at).toLocaleDateString()}`));
-            }
-            if (invitation.expires_at) {
-                console.log(chalk.gray(`  Expires: ${new Date(invitation.expires_at).toLocaleDateString()}`));
-            }
-            console.log('');
-        });
-    }
-    catch (error) {
-        spinner.fail(chalk.red('Failed to list invitations'));
-        console.error(chalk.red(`Error: ${error.message}\n`));
-    }
+export async function listInvitationsCommand(opts) {
+    const session = await getSession();
+    const status = opts.pending ? 'pending' : opts.status;
+    const { invitations } = await session.api.get(`/orgs/${session.orgId}/invitations`, { status });
+    if (runtime.json)
+        return printJson(invitations);
+    if (!invitations.length)
+        return log.info('No invitations.');
+    table(invitations.map(i => [i.email, i.role, i.status, i.expiresAt.slice(0, 10)]), ['EMAIL', 'ROLE', 'STATUS', 'EXPIRES']);
 }
-/**
- * Revoke invitation
- */
 export async function revokeInvitationCommand(email) {
-    if (!isAuthenticated()) {
-        console.log(chalk.red('✗ Not authenticated. Please run "langctl auth <api-key>" first.\n'));
-        return;
-    }
-    const apiKey = getApiKey();
-    const spinner = ora(`Revoking invitation for ${email}...`).start();
-    try {
-        const response = await fetch(TEAM_MANAGEMENT_URL, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'X-API-Key': apiKey
-            },
-            body: JSON.stringify({
-                action: 'revoke-invitation',
-                email
-            })
-        });
-        const data = await response.json();
-        if (!data.success) {
-            throw new Error(data.error);
-        }
-        spinner.succeed(chalk.green(data.message));
-        console.log('');
-    }
-    catch (error) {
-        spinner.fail(chalk.red('Failed to revoke invitation'));
-        console.error(chalk.red(`Error: ${error.message}\n`));
-    }
+    const session = await getSession();
+    const { invitations } = await session.api.get(`/orgs/${session.orgId}/invitations`, { status: 'pending' });
+    const inv = invitations.find(i => i.email.toLowerCase() === email.toLowerCase());
+    if (!inv)
+        throw notFoundError(`No pending invitation for ${email}.`);
+    await session.api.post(`/orgs/${session.orgId}/invitations/${inv.id}/revoke`);
+    if (runtime.json)
+        return printJson({ revoked: inv.email });
+    log.success(`Revoked invitation for ${chalk.bold(inv.email)}`);
 }
-//# sourceMappingURL=team.js.map

package/dist/core/config.js

@@ -0,0 +1,130 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, unlinkSync } from 'fs';
+import { homedir } from 'os';
+import { dirname, join, resolve } from 'path';
+import { CliError, ExitCode, usageError } from './errors.js';
+export const DEFAULT_API_URL = 'https://api.langctl.com/api/v1';
+export function configDir() {
+    return process.env.LANGCTL_CONFIG_DIR ? resolve(process.env.LANGCTL_CONFIG_DIR) : join(homedir(), '.langctl');
+}
+export function configPath() {
+    return join(configDir(), 'config.json');
+}
+export function readUserConfig() {
+    const path = configPath();
+    if (!existsSync(path))
+        return {};
+    try {
+        const raw = JSON.parse(readFileSync(path, 'utf-8'));
+        delete raw.__internal__; // left behind by the 0.2.x `conf` store
+        return raw;
+    }
+    catch {
+        throw new CliError(`Config file ${path} is not valid JSON.`, ExitCode.Error, 'Fix or delete it, then run "langctl auth --stdin" again.');
+    }
+}
+/** Write atomically with owner-only permissions — the file contains an API key. */
+export function writeUserConfig(next) {
+    const path = configPath();
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const tmp = `${path}.${process.pid}.tmp`;
+    const clean = Object.fromEntries(Object.entries(next).filter(([, v]) => v !== undefined && v !== ''));
+    writeFileSync(tmp, JSON.stringify(clean, null, 2) + '\n', { mode: 0o600 });
+    renameSync(tmp, path);
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch { /* not supported on Windows */ }
+}
+export function clearCredentials() {
+    const current = readUserConfig();
+    if (!current.apiKey)
+        return false;
+    const { apiKey: _k, organizationId: _o, organizationName: _n, ...rest } = current;
+    if (Object.keys(rest).length === 0) {
+        try {
+            unlinkSync(configPath());
+        }
+        catch { /* already gone */ }
+    }
+    else {
+        writeUserConfig(rest);
+    }
+    return true;
+}
+export const flagOverrides = {};
+export function resolveApiUrl() {
+    return (flagOverrides.apiUrl || process.env.LANGCTL_API_URL || readUserConfig().apiBaseUrl || DEFAULT_API_URL).replace(/\/+$/, '');
+}
+export function resolveCredentials() {
+    const apiUrl = resolveApiUrl();
+    if (flagOverrides.apiKey)
+        return { apiKey: normalizeApiKey(flagOverrides.apiKey), source: 'flag', apiUrl };
+    if (process.env.LANGCTL_API_KEY)
+        return { apiKey: normalizeApiKey(process.env.LANGCTL_API_KEY), source: 'env', apiUrl };
+    const cfg = readUserConfig();
+    if (cfg.apiKey)
+        return { apiKey: cfg.apiKey, source: 'config', apiUrl, organizationId: cfg.organizationId };
+    return null;
+}
+export function requireCredentials() {
+    const creds = resolveCredentials();
+    if (!creds) {
+        throw new CliError('Not authenticated.', ExitCode.Auth, 'Run "langctl auth --stdin" (or "langctl init"), or set LANGCTL_API_KEY in CI.');
+    }
+    return creds;
+}
+const KEY_RE = /^lc_[a-f0-9]{64}$/;
+/** Trim whitespace/quotes that commonly sneak in from copy-paste or CI secret stores. */
+export function normalizeApiKey(input) {
+    const key = input.trim().replace(/^['"]|['"]$/g, '').trim();
+    if (!KEY_RE.test(key)) {
+        throw new CliError('That does not look like a Langctl API key (expected "lc_" followed by 64 hex characters).', ExitCode.Auth, 'Copy the key from https://app.langctl.com/organization/api-keys — it is shown only once.');
+    }
+    return key;
+}
+export function maskApiKey(key) {
+    return `${key.slice(0, 7)}…${key.slice(-4)}`;
+}
+// ── Project config (langctl.json) ──────────────────────────────
+export const PROJECT_CONFIG_FILE = 'langctl.json';
+const KNOWN_KEYS = new Set(['$schema', 'project', 'format', 'output', 'languages', 'sourceLanguage', 'includeDrafts', 'module']);
+/** Find langctl.json in the current directory or the nearest parent. */
+export function loadProjectConfig(cwd = process.cwd()) {
+    let dir = resolve(cwd);
+    for (;;) {
+        const candidate = join(dir, PROJECT_CONFIG_FILE);
+        if (existsSync(candidate)) {
+            let config;
+            try {
+                config = JSON.parse(readFileSync(candidate, 'utf-8'));
+            }
+            catch (e) {
+                throw usageError(`${candidate} is not valid JSON: ${e.message}`);
+            }
+            const unknown = Object.keys(config).filter(k => !KNOWN_KEYS.has(k));
+            if (unknown.length) {
+                throw usageError(`${candidate} has unknown field(s): ${unknown.join(', ')}`, `Allowed: ${[...KNOWN_KEYS].filter(k => k !== '$schema').join(', ')}`);
+            }
+            if (config.languages !== undefined && !Array.isArray(config.languages)) {
+                throw usageError(`${candidate}: "languages" must be an array of language codes`);
+            }
+            return { config, path: candidate, root: dir };
+        }
+        const parent = dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+export function writeProjectConfig(path, config) {
+    const ordered = {
+        project: config.project,
+        format: config.format,
+        output: config.output,
+        ...(config.languages ? { languages: config.languages } : {}),
+        ...(config.sourceLanguage ? { sourceLanguage: config.sourceLanguage } : {}),
+        ...(config.includeDrafts ? { includeDrafts: true } : {}),
+        ...(config.module ? { module: config.module } : {}),
+    };
+    writeFileSync(path, JSON.stringify(ordered, null, 2) + '\n');
+}

package/dist/core/errors.js

@@ -0,0 +1,67 @@
+/**
+ * Exit codes are part of the CLI's contract — CI scripts branch on them. Keep in sync with README.
+ */
+export const ExitCode = {
+    Ok: 0,
+    Error: 1,
+    Usage: 2,
+    Auth: 3,
+    NotFound: 4,
+    Network: 5,
+    Limit: 6,
+    Drift: 7,
+};
+export class CliError extends Error {
+    constructor(message, exitCode = ExitCode.Error, hint, status) {
+        super(message);
+        this.exitCode = exitCode;
+        this.hint = hint;
+        this.status = status;
+        this.name = 'CliError';
+    }
+}
+export const usageError = (message, hint) => new CliError(message, ExitCode.Usage, hint);
+export const notFoundError = (message, hint) => new CliError(message, ExitCode.NotFound, hint);
+/** Map an HTTP error response from the API to a CliError with the right exit code and a useful hint. */
+export function httpError(status, serverMessage, method, path) {
+    const msg = serverMessage || `HTTP ${status}`;
+    if (status === 401) {
+        return new CliError('Your API key is invalid or has been revoked.', ExitCode.Auth, 'Create a new key at https://app.langctl.com/organization/api-keys and run "langctl auth --stdin", or set LANGCTL_API_KEY.', status);
+    }
+    if (status === 403) {
+        if (/limit/i.test(msg))
+            return new CliError(msg, ExitCode.Limit, 'See your plan limits with "langctl org plan".', status);
+        if (/scope/i.test(msg)) {
+            return new CliError(msg, ExitCode.Auth, 'Create an API key with the required permission at https://app.langctl.com/organization/api-keys.', status);
+        }
+        return new CliError(msg, ExitCode.Auth, undefined, status);
+    }
+    if (status === 404)
+        return new CliError(msg, ExitCode.NotFound, undefined, status);
+    if (status === 400 || status === 409 || status === 422)
+        return new CliError(msg, ExitCode.Usage, undefined, status);
+    if (status === 429)
+        return new CliError('Rate limited by the Langctl API.', ExitCode.Network, 'Wait a moment and retry.', status);
+    if (status >= 500) {
+        return new CliError(`The Langctl API failed (${status}) on ${method} ${path}.`, ExitCode.Network, 'This is usually temporary — retry in a minute. If it persists, contact hello@langctl.com.', status);
+    }
+    return new CliError(msg, ExitCode.Error, undefined, status);
+}
+/** Map a fetch/network failure (no HTTP response) to a CliError. */
+export function networkError(err, baseUrl, timeoutMs) {
+    const e = err;
+    const code = e?.cause?.code;
+    if (e?.name === 'TimeoutError' || e?.name === 'AbortError') {
+        return new CliError(`Request to ${baseUrl} timed out after ${Math.round(timeoutMs / 1000)}s.`, ExitCode.Network, 'Check your connection, or raise the limit with --timeout <seconds> / LANGCTL_TIMEOUT.');
+    }
+    if (code === 'ENOTFOUND' || code === 'EAI_AGAIN') {
+        return new CliError(`Cannot resolve ${new URL(baseUrl).host}.`, ExitCode.Network, 'Check your network/DNS, or LANGCTL_API_URL if you set it.');
+    }
+    if (code === 'ECONNREFUSED' || code === 'ECONNRESET' || code === 'UND_ERR_SOCKET') {
+        return new CliError(`Could not connect to ${baseUrl} (${code}).`, ExitCode.Network, 'Check your network, proxy, or LANGCTL_API_URL.');
+    }
+    if (code === 'CERT_HAS_EXPIRED' || code === 'UNABLE_TO_VERIFY_LEAF_SIGNATURE' || code === 'SELF_SIGNED_CERT_IN_CHAIN') {
+        return new CliError(`TLS error talking to ${baseUrl} (${code}).`, ExitCode.Network, 'If you are behind a corporate proxy, set NODE_EXTRA_CA_CERTS to its CA bundle.');
+    }
+    return new CliError(`Network error: ${e?.cause?.message || e?.message || String(err)}`, ExitCode.Network);
+}

package/dist/core/files.js

@@ -0,0 +1,38 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'fs';
+import { dirname } from 'path';
+/**
+ * Write a file only if its content changed (atomic temp-file + rename).
+ * With `dryRun`, report what would happen without touching disk (used by --check / --dry-run).
+ */
+export function syncFile(path, content, dryRun, 
+/** Parse function of the file's format: if the existing file holds the same translations, leave it alone */
+parse) {
+    const exists = existsSync(path);
+    if (exists) {
+        const current = readFileSync(path, 'utf-8');
+        if (current === content)
+            return 'unchanged';
+        // A hand-edited file (other key order, indentation, no trailing newline) with the same
+        // translations is not drift — keep the user's formatting and don't fail `pull --check`
+        if (parse && sameTranslations(current, content, parse))
+            return 'unchanged';
+    }
+    if (!dryRun) {
+        mkdirSync(dirname(path), { recursive: true });
+        const tmp = `${path}.langctl-${process.pid}.tmp`;
+        writeFileSync(tmp, content, 'utf-8');
+        renameSync(tmp, path);
+    }
+    return exists ? 'updated' : 'created';
+}
+function sameTranslations(a, b, parse) {
+    try {
+        const x = parse(a);
+        const y = parse(b);
+        const kx = Object.keys(x);
+        return kx.length === Object.keys(y).length && kx.every(k => x[k] === y[k]);
+    }
+    catch {
+        return false; // unparseable existing file → rewrite it
+    }
+}