novence 0.1.4 → 0.2.0

package/README.md

@@ -75,13 +75,27 @@ novence checks [project]      # Lighthouse / axe / link results for the last dep
 novence domains add <host>    # attach a custom domain, prints the DNS records
 novence domains status        # custom domain state
 novence keys list             # API keys on the account
+novence keys create <name>    # extra named key (e.g. ci) that survives login --recover
 novence keys revoke <id>      # revoke a key (--force to revoke the one in use)
 novence projects              # list projects and their URLs
 novence login                 # sign in, verify email, or --recover a key
 novence claim                 # attach an email to an anonymous deploy
 novence whoami                # plan, verification, usage against quota
+novence dashboard             # local account console (alias: novence console)
 ```
 
+## Dashboard
+
+`novence dashboard` fetches your console-kit, writes `~/.novence/console/novence-console.html`
+(mode 0600), serves it on the first free `127.0.0.1` port from 8765, and opens the browser at
+that exact URL. Press Ctrl+C to stop; the file (it holds a live `mgmt_` token) is deleted.
+
+- Uses your saved API key. Without one, it signs you in with an email code instead.
+- `--port <n>` first port to try, `--no-open` print the URL only, `--email <email>` skip the prompt.
+- `--ttl <minutes>` session length 5–480 (default 30). Sessions over 30 minutes can view usage
+  and open billing, but cannot manage team members.
+- In the page, **Switch account** signs in with an email code when the session expires.
+
 Every command accepts `--json`. Unknown flags are rejected rather than ignored,
 so a typo like `--nmae` fails loudly instead of silently deploying under the
 default name.

package/dist/commands/dashboard.d.ts

@@ -0,0 +1,2 @@
+import { type ParsedArgs } from "../lib/args.js";
+export declare function dashboardCommand(args: ParsedArgs): Promise<void>;

package/dist/commands/dashboard.js

@@ -0,0 +1,182 @@
+import { chmodSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { createServer } from "node:http";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { CONSOLE_INJECT_MARKER, Novence, requestSessionOtp, verifySessionOtp, } from "@novence/sdk";
+import { flagBool, flagString } from "../lib/args.js";
+import { openInBrowser } from "../lib/browser.js";
+import { loadApiKey, resolveApiBase } from "../lib/config.js";
+import { explain } from "../lib/errors.js";
+import { fail, isJsonMode, json, prompt, result, step, withSpin } from "../lib/ui.js";
+const DEFAULT_PORT = 8765;
+/** Ports tried after the first before falling back to an ephemeral one. */
+const PORT_SCAN = 20;
+const CONSOLE_FILE = "novence-console.html";
+const CONSOLE_DIR = join(homedir(), ".novence", "console");
+export async function dashboardCommand(args) {
+    const apiBase = resolveApiBase(flagString(args.flags, "api"));
+    const startPort = parsePort(flagString(args.flags, "port"));
+    const ttlMinutes = parseTtl(flagString(args.flags, "ttl"));
+    let loaded;
+    try {
+        loaded = await loadKit(args, apiBase, ttlMinutes);
+    }
+    catch (err) {
+        fail(explain(err, { apiBase }));
+    }
+    const html = injectConsole(loaded.kit, loaded.token);
+    const filePath = writeConsoleFile(html);
+    const server = createServer((req, res) => serveConsole(req, res, html, server));
+    const port = await listenOnFreePort(server, startPort);
+    const url = `http://127.0.0.1:${port}/${CONSOLE_FILE}`;
+    const shutdown = () => {
+        server.close();
+        rmSync(filePath, { force: true });
+        process.exit(0);
+    };
+    process.on("SIGINT", shutdown);
+    process.on("SIGTERM", shutdown);
+    if (isJsonMode()) {
+        json({ ok: true, url, port, file: filePath, expiresAt: loaded.kit.session?.expiresAt ?? null });
+    }
+    else {
+        if (port !== startPort)
+            step(`Port ${startPort} is busy — using ${port}.`);
+        step(`Serving your console on 127.0.0.1:${port}. Press Ctrl+C to stop (deletes ${filePath}).`);
+        result(url);
+    }
+    if (!flagBool(args.flags, "no-open") && !openInBrowser(url)) {
+        step("Could not launch a browser — open the URL above.");
+    }
+}
+async function loadKit(args, apiBase, ttlMinutes) {
+    const apiKey = loadApiKey();
+    if (apiKey) {
+        const keyClient = new Novence({ apiKey, baseUrl: apiBase });
+        if (ttlMinutes === undefined) {
+            const kit = await withSpin("Fetching your console…", () => keyClient.account.consoleKit());
+            if (!kit.session?.token)
+                throw new Error("console-kit did not return a session token");
+            return { kit, token: kit.session.token };
+        }
+        const session = await keyClient.account.createSession({ ttlMinutes });
+        return kitForSession(session.token, apiBase);
+    }
+    if (isJsonMode() || flagBool(args.flags, "no-input")) {
+        fail("No saved API key. Set NOVENCE_API_KEY, run `novence login`, or run `novence dashboard` interactively to sign in with an email code.");
+    }
+    step("No saved API key — sign in with an email code instead.");
+    const email = flagString(args.flags, "email") ?? (await prompt("  Email: "));
+    if (!email.includes("@"))
+        fail(`Not a valid email: ${email}`);
+    await withSpin(`Sending a code to ${email}…`, () => requestSessionOtp(email, apiBase));
+    const code = await prompt("  6-digit code from your email: ");
+    if (!/^[0-9]{6}$/.test(code))
+        fail("Enter the 6-digit code from the email.");
+    const session = await verifySessionOtp(email, code, { ttlMinutes, baseUrl: apiBase });
+    return kitForSession(session.token, apiBase);
+}
+/** console-kit with a mgmt_ token reuses that session instead of minting another. */
+async function kitForSession(token, apiBase) {
+    const mgmtClient = new Novence({ apiKey: token, baseUrl: apiBase });
+    const kit = await withSpin("Fetching your console…", () => mgmtClient.account.consoleKit());
+    return { kit, token };
+}
+function injectConsole(kit, token) {
+    const template = kit.htmlTemplate;
+    if (!template?.includes(CONSOLE_INJECT_MARKER)) {
+        fail("The console template is missing its injection marker. Update the CLI: npm i -g novence@latest");
+    }
+    const payload = `window.__NOVENCE_SNAPSHOT__=${scriptJson(kit.snapshot ?? null)};` +
+        `window.__NOVENCE_MGMT_TOKEN__=${scriptJson(token)};`;
+    return template.replace(CONSOLE_INJECT_MARKER, () => payload);
+}
+/** JSON that cannot close the surrounding <script> tag. */
+function scriptJson(value) {
+    return JSON.stringify(value)
+        .replace(/</g, "\\u003c")
+        .replace(/\u2028/g, "\\u2028")
+        .replace(/\u2029/g, "\\u2029");
+}
+/** Outside the working directory (agents commit scratch dirs); holds a live token, so 0600. */
+function writeConsoleFile(html) {
+    mkdirSync(CONSOLE_DIR, { recursive: true, mode: 0o700 });
+    const filePath = join(CONSOLE_DIR, CONSOLE_FILE);
+    writeFileSync(filePath, html, { mode: 0o600 });
+    chmodSync(filePath, 0o600);
+    return filePath;
+}
+function serveConsole(req, res, html, server) {
+    const port = server.address().port;
+    // DNS rebinding: a hostile page can resolve its own name to 127.0.0.1 and read this response.
+    const allowedHosts = new Set([`127.0.0.1:${port}`, `localhost:${port}`]);
+    if (!allowedHosts.has(req.headers.host ?? "")) {
+        res.writeHead(403, { "Content-Type": "text/plain" }).end("Forbidden");
+        return;
+    }
+    if (req.method !== "GET" && req.method !== "HEAD") {
+        res.writeHead(405, { Allow: "GET, HEAD" }).end();
+        return;
+    }
+    const path = (req.url ?? "/").split("?")[0];
+    if (path === "/") {
+        res.writeHead(302, { Location: `/${CONSOLE_FILE}` }).end();
+        return;
+    }
+    if (path !== `/${CONSOLE_FILE}`) {
+        res.writeHead(404, { "Content-Type": "text/plain" }).end("Not found");
+        return;
+    }
+    res.writeHead(200, {
+        "Content-Type": "text/html; charset=utf-8",
+        "Cache-Control": "no-store",
+        "X-Content-Type-Options": "nosniff",
+        "Referrer-Policy": "no-referrer",
+    });
+    res.end(req.method === "HEAD" ? undefined : html);
+}
+async function listenOnFreePort(server, startPort) {
+    const candidates = Array.from({ length: PORT_SCAN + 1 }, (_, i) => startPort + i).filter((p) => p <= 65535);
+    for (const port of [...candidates, 0]) {
+        try {
+            return await listen(server, port);
+        }
+        catch (err) {
+            if (err.code !== "EADDRINUSE")
+                throw err;
+        }
+    }
+    fail("Could not bind a local port for the console.");
+}
+function listen(server, port) {
+    return new Promise((resolve, reject) => {
+        const onError = (err) => {
+            server.off("listening", onListening);
+            reject(err);
+        };
+        const onListening = () => {
+            server.off("error", onError);
+            resolve(server.address().port);
+        };
+        server.once("error", onError);
+        server.once("listening", onListening);
+        server.listen(port, "127.0.0.1");
+    });
+}
+function parsePort(raw) {
+    if (raw === undefined)
+        return DEFAULT_PORT;
+    const port = Number(raw);
+    if (!Number.isInteger(port) || port < 1 || port > 65535)
+        fail(`Invalid --port: ${raw}`);
+    return port;
+}
+function parseTtl(raw) {
+    if (raw === undefined)
+        return undefined;
+    const minutes = Number(raw);
+    if (!Number.isInteger(minutes) || minutes < 5 || minutes > 480) {
+        fail(`Invalid --ttl: ${raw} (minutes, 5–480)`);
+    }
+    return minutes;
+}

package/dist/commands/deploy.js

@@ -42,9 +42,12 @@ async function waitUntilLive(client, projectId) {
         let lastStatus = "";
         while (Date.now() - startedAt < POLL_TIMEOUT_MS) {
             const { deployment } = await client.deployments.latest(projectId);
-            if (deployment.status !== lastStatus) {
-                spinner.update(`${deployment.status}…`);
-                lastStatus = deployment.status;
+            const label = deployment.status === "queued" && deployment.queuePosition
+                ? `queued for checks (position ${deployment.queuePosition})`
+                : deployment.status;
+            if (label !== lastStatus) {
+                spinner.update(`${label}…`);
+                lastStatus = label;
             }
             if (deployment.status === "live") {
                 spinner.stop("Live");
@@ -81,6 +84,8 @@ function reportChecks(deployment) {
     else if (checks.passed === true) {
         step("Checks passed");
     }
+    for (const warning of checks.warnings ?? [])
+        warn(warning);
 }
 export async function deployCommand(args) {
     const apiBase = resolveApiBase(flagString(args.flags, "api"));

package/dist/commands/keys.js

@@ -33,6 +33,20 @@ export async function keysCommand(args) {
             }
             return;
         }
+        if (sub === "create") {
+            const name = args.positionals[1];
+            if (!name)
+                fail("Usage: novence keys create <name> [--project <id>]\n  e.g.  novence keys create ci");
+            const res = await client.apiKeys.create({ name, projectId: flagString(args.flags, "project") });
+            if (isJsonMode()) {
+                json({ ok: true, ...res });
+                return;
+            }
+            result(res.apiKey);
+            step(`Key "${res.key.name}" (${res.key.scope}) — shown once. Store it in a secret manager or NOVENCE_API_KEY.`);
+            step("It keeps working when `novence login --recover` replaces your primary key.");
+            return;
+        }
         if (sub === "revoke") {
             const id = args.positionals[1];
             if (!id)
@@ -48,7 +62,7 @@ export async function keysCommand(args) {
                 step("That was the key this machine uses — run `novence login` to get a new one.");
             return;
         }
-        fail(`Unknown subcommand: ${sub}\n  Usage: novence keys list | novence keys revoke <id>`);
+        fail(`Unknown subcommand: ${sub}\n  Usage: novence keys list | novence keys create <name> | novence keys revoke <id>`);
     }
     catch (err) {
         fail(explain(err, { apiBase }));

package/dist/commands/login.js

@@ -2,8 +2,8 @@ import { Novence } from "@novence/sdk";
 import { claimAndMaybeVerify, ensureApiKey } from "../lib/auth.js";
 import { credentialsPath, loadApiKey, resolveApiBase, saveApiKey } from "../lib/config.js";
 import { reissueApiKey, resendVerification, verifyEmail } from "@novence/sdk";
-import { flagString } from "../lib/args.js";
-import { fail, prompt, result, withSpin } from "../lib/ui.js";
+import { flagBool, flagString } from "../lib/args.js";
+import { fail, prompt, result, step, withSpin } from "../lib/ui.js";
 export async function loginCommand(args) {
     const apiBase = resolveApiBase(flagString(args.flags, "api"));
     const emailFlag = flagString(args.flags, "email");
@@ -29,9 +29,15 @@ export async function loginCommand(args) {
     if (!code)
         fail("No code entered.");
     if (flagString(args.flags, "recover") !== undefined || args.flags.recover === true) {
-        const issued = await reissueApiKey(address, code, apiBase);
+        const issued = await reissueApiKey(address, code, apiBase, {
+            revokeAll: flagBool(args.flags, "revoke-all"),
+        });
         saveApiKey(issued.apiKey);
         result(`Key reissued for account ${issued.accountId} → ${credentialsPath()}`);
+        if (issued.remainingKeys.length) {
+            step(`Still active: ${issued.remainingKeys.map((k) => `${k.name} (${k.keyPrefix})`).join(", ")}. ` +
+                "Use --revoke-all if a key may have leaked.");
+        }
         return;
     }
     await verifyEmail(address, code, apiBase);

package/dist/commands/open.js

@@ -1,21 +1,9 @@
-import { spawn } from "node:child_process";
 import { Novence } from "@novence/sdk";
 import { loadApiKey, resolveApiBase } from "../lib/config.js";
 import { flagString } from "../lib/args.js";
+import { openInBrowser } from "../lib/browser.js";
 import { explain } from "../lib/errors.js";
 import { fail, isJsonMode, json, result, siteUrl, step } from "../lib/ui.js";
-/** Platform opener; falls back to printing the URL when there is no GUI. */
-function openInBrowser(url) {
-    const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-    try {
-        const child = spawn(cmd, [url], { stdio: "ignore", detached: true });
-        child.unref();
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
 export async function openCommand(args) {
     const apiBase = resolveApiBase(flagString(args.flags, "api"));
     const apiKey = loadApiKey();

package/dist/index.js

@@ -18,6 +18,7 @@ import { checksCommand } from "./commands/checks.js";
 import { rollbackCommand } from "./commands/rollback.js";
 import { dataCommand } from "./commands/data.js";
 import { siteMcpCommand } from "./commands/site-mcp.js";
+import { dashboardCommand } from "./commands/dashboard.js";
 const HELP = `
   novence — deploy a static site to the edge
 
@@ -31,11 +32,20 @@ const HELP = `
     novence domains add <host>  Attach a custom domain (prints DNS records)
     novence domains status      Custom domain state
     novence keys list           API keys on the account
+    novence keys create <name>  Extra named key (e.g. ci) that survives login --recover
     novence keys revoke <id>    Revoke a key
     novence projects            List projects and their URLs
     novence login               Sign in, verify email, or recover a key
     novence claim               Attach an email to an anonymous deploy
     novence whoami              Plan, verification, and usage
+    novence dashboard           Open your local account console (alias: console)
+
+  Dashboard
+    novence dashboard           Serve the console on the first free 127.0.0.1 port from 8765
+    --port <n>                  First port to try (default 8765)
+    --no-open                   Print the URL without opening a browser
+    --email <email>             Email for code sign-in when no API key is saved
+    --ttl <minutes>             Session length 5–480 (default 30; >30 drops member management)
 
   Deploy
     novence deploy              Auto-detects dist, build, out, public, _site
@@ -100,11 +110,13 @@ async function main() {
         keys: ["project", "include-revoked", "force"],
         projects: [],
         ls: [],
-        login: ["email", "recover"],
+        login: ["email", "recover", "revoke-all"],
         whoami: [],
         rollback: ["project", "deployment"],
         data: ["project"],
         "site-mcp": ["project"],
+        dashboard: ["port", "no-open", "email", "ttl"],
+        console: ["port", "no-open", "email", "ttl"],
     };
     const allowed = ALLOWED[args.command];
     if (allowed) {
@@ -138,6 +150,9 @@ async function main() {
             return dataCommand(args);
         case "site-mcp":
             return siteMcpCommand(args);
+        case "dashboard":
+        case "console":
+            return dashboardCommand(args);
         default:
             fail(`Unknown command: ${args.command}\n  Run \`novence --help\` for usage.`);
     }

package/dist/lib/browser.d.ts

@@ -0,0 +1,2 @@
+/** Platform opener; falls back to printing the URL when there is no GUI. */
+export declare function openInBrowser(url: string): boolean;

package/dist/lib/browser.js

@@ -0,0 +1,13 @@
+import { spawn } from "node:child_process";
+/** Platform opener; falls back to printing the URL when there is no GUI. */
+export function openInBrowser(url) {
+    const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+    try {
+        const child = spawn(cmd, [url], { stdio: "ignore", detached: true });
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "novence",
-  "version": "0.1.4",
+  "version": "0.2.0",
   "description": "CLI for Novence — deploy a static site to the edge in one command.",
   "license": "MIT",
   "type": "module",
@@ -40,7 +40,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@novence/sdk": "^0.2.6"
+    "@novence/sdk": "^0.3.0"
   },
   "devDependencies": {
     "@types/node": "^22.10.2",