oneclient 0.1.0 → 0.1.1

package/README.md

@@ -1,44 +1,74 @@
 # oneclient
 
-One package for the complete OneClient TypeScript SDK and its developer CLI.
+One package for the complete OneClient TypeScript SDK and developer CLI.
 
 ```bash
 npm install oneclient
 npx oneclient login --email you@company.com
-npx oneclient init
+npx oneclient init --project-name "My app"
 ```
 
-The same package works in code:
+The hosted CLI already knows the production control API. Set `ONECLIENT_API_URL` only when a command
+targets a project environment or a self-hosted/local control plane.
+
+## Browser application
+
+`oneclient init` shows the development API URL, environment ID, and initial `pk_*`/`sk_*` values
+once. A publishable key is safe to embed in browser code; server and deploy keys are not.
 
 ```ts
 import { createClient } from "oneclient";
 
 const one = createClient({
-  baseUrl: process.env.ONECLIENT_API_URL!,
-  serverKey: process.env.ONECLIENT_SERVER_KEY!,
+  baseUrl: import.meta.env.VITE_ONECLIENT_API_URL,
+  publishableKey: import.meta.env.VITE_ONECLIENT_PUBLISHABLE_KEY,
 });
 
-const notes = await one.from("notes").select("id", "title").limit(20).execute();
+await one.auth.sendOtp({ email: "developer@example.com" });
+```
+
+## Schema, policy, and local auth origin
+
+```bash
+export ONECLIENT_API_URL=https://dev_REFERENCE.api.one-client.com
+export ONECLIENT_SERVER_KEY=sk_REDACTED
+
+npx oneclient sql --file migrations/001_create_feedback.sql
+npx oneclient policy:publish --table feedback --file oneclient.policy.json
+npx oneclient auth-origin:add --environment env_DEVELOPMENT --origin http://localhost:5173
 ```
 
-Useful commands:
+Each SQL file contains one statement so its read, write, and retained-storage bounds are explicit.
+
+## Development deployment
 
 ```bash
-oneclient status
-oneclient projects
-oneclient usage
-oneclient deployments --environment env_...
-oneclient models
-oneclient billing:topup --usd 25
-oneclient doctor
-oneclient docs
-oneclient mcp
+npm run build
+npx oneclient artifact:create \
+  --directory . \
+  --manifest .oneclient/manifest.json \
+  --archive .oneclient/app.tar \
+  --framework vite \
+  --build-command "npm run build" \
+  --output-directory dist \
+  --lockfile npm
+
+npx oneclient deploy-token:create --environment env_DEVELOPMENT --name local-cli
+export ONECLIENT_DEPLOY_TOKEN=dp_VALUE_SHOWN_ONCE
+npx oneclient deploy \
+  --manifest .oneclient/manifest.json \
+  --archive .oneclient/app.tar \
+  --project prj_PROJECT \
+  --environment env_DEVELOPMENT \
+  --wait
+
+# The deploy token is an environment key; revoke it by the id returned at creation.
+npx oneclient key:revoke --environment env_DEVELOPMENT --key key_DEPLOY_TOKEN
 ```
 
-Interactive terminals receive a compact, colored interface. Pipes and CI receive stable JSON by
-default; `--json` makes that behavior explicit. Developer login credentials are stored in an
-owner-only local file. `sk_*` and `dp_*` credentials stay in environment variables and are never
-persisted by the CLI.
+Interactive terminals receive a compact interface. Pipes and CI receive stable JSON automatically;
+`--json` makes that behavior explicit. Developer sessions are stored in an owner-only local file.
+`sk_*` and `dp_*` values stay in environment variables and are never persisted by the CLI.
 
-Documentation: [one-client.com/docs](https://one-client.com/docs) · AI context:
-[one-client.com/llms.txt](https://one-client.com/llms.txt)
+Full quickstart: [one-client.com/docs/quickstart](https://one-client.com/docs/quickstart) · Agent
+context: [one-client.com/llms.txt](https://one-client.com/llms.txt)

package/dist/config.d.ts

@@ -0,0 +1,4 @@
+export declare const DEFAULT_CONTROL_API_URL = "https://control.one-client.com";
+export declare const DEFAULT_CONSOLE_ORIGIN = "https://console.one-client.com";
+export declare function developerAuthOrigin(apiUrl: string): string;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,uBAAuB,mCAAmC,CAAC;AACxE,eAAO,MAAM,sBAAsB,mCAAmC,CAAC;AAEvE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAG1D"}

package/dist/config.js

@@ -0,0 +1,6 @@
+export const DEFAULT_CONTROL_API_URL = "https://control.one-client.com";
+export const DEFAULT_CONSOLE_ORIGIN = "https://console.one-client.com";
+export function developerAuthOrigin(apiUrl) {
+    const origin = new URL(apiUrl).origin;
+    return origin === DEFAULT_CONTROL_API_URL ? DEFAULT_CONSOLE_ORIGIN : origin;
+}

package/dist/index.js

@@ -14,11 +14,12 @@ import { deployTokenFromEnvironment, parseServerKeyScopes, serverKeyFromEnvironm
 import { secretValueFromOptions } from "./secret-input.js";
 import { brand, formatOutput, statusLine } from "./presenter.js";
 import { slugify } from "./slug.js";
+import { DEFAULT_CONTROL_API_URL } from "./config.js";
 const program = new Command();
 program
     .name("oneclient")
     .description("Deploy and manage OneClient projects")
-    .version("0.1.0")
+    .version("0.1.1")
     .option("--api-url <url>", "Control or environment API URL", process.env.ONECLIENT_API_URL)
     .option("--organization <id>", "Organization ID", process.env.ONECLIENT_ORGANIZATION_ID)
     .option("--json", "Print stable JSON for scripts and agents", false)
@@ -29,7 +30,7 @@ program
     .description("Sign in as a platform developer with an email OTP")
     .requiredOption("--email <email>")
     .action(async (options) => {
-    const apiUrl = await resolveApiUrl();
+    const apiUrl = await resolveControlApiUrl();
     await runStep(`Sending a private sign-in code to ${options.email.trim()}`, () => sendDeveloperOtp(apiUrl, options.email));
     const otp = process.env.ONECLIENT_OTP ?? (await promptForOtp());
     const sessionToken = await runStep("Verifying your code", () => verifyDeveloperOtp(apiUrl, options.email, otp));
@@ -213,7 +214,9 @@ program
     .command("doctor")
     .description("Check local credentials and live OneClient connectivity")
     .action(async () => {
+    const options = program.opts();
     const credentials = await resolvedDeveloperCredentials();
+    const controlApi = options.apiUrl ?? credentials?.apiUrl ?? DEFAULT_CONTROL_API_URL;
     let account = null;
     let controlReachable = false;
     if (credentials) {
@@ -221,9 +224,20 @@ program
         account = response.user.email;
         controlReachable = true;
     }
+    else {
+        try {
+            const response = await fetch(new URL("/v1/me", `${controlApi}/`), {
+                headers: { Accept: "application/json" },
+            });
+            controlReachable = response.status < 500;
+        }
+        catch {
+            controlReachable = false;
+        }
+    }
     print({
         node: process.version,
-        controlApi: credentials?.apiUrl ?? null,
+        controlApi,
         signedIn: Boolean(credentials),
         account,
         controlReachable,
@@ -372,6 +386,53 @@ program
         .limit(Number(options.limit))
         .execute()));
 });
+program
+    .command("sql")
+    .description("Execute one bounded SQL statement or trusted server query from a file")
+    .requiredOption("--file <path>")
+    .option("--max-rows-read <rows>", "Maximum rows the statement may read", "1000")
+    .option("--max-rows-written <rows>", "Maximum rows the statement may write", "100")
+    .option("--max-storage-delta-bytes <bytes>", "Maximum retained storage increase", "65536")
+    .action(async (options) => {
+    const maxRowsRead = positiveInteger(options.maxRowsRead, "max-rows-read");
+    const maxRowsWritten = positiveInteger(options.maxRowsWritten, "max-rows-written");
+    const maxStorageDeltaBytes = nonNegativeInteger(options.maxStorageDeltaBytes, "max-storage-delta-bytes");
+    const sql = (await readFile(options.file, "utf8")).trim();
+    if (!sql)
+        throw new Error("SQL file cannot be empty");
+    print(await serverClient().then((api) => api.sql.execute({
+        sql,
+        maxRowsRead,
+        maxRowsWritten,
+        maxStorageDeltaBytes,
+    })), "SQL completed");
+});
+program
+    .command("policy:publish")
+    .description("Validate and activate a deny-by-default data policy from a JSON file")
+    .requiredOption("--table <table>")
+    .requiredOption("--file <path>")
+    .action(async (options) => {
+    const policy = JSON.parse(await readFile(options.file, "utf8"));
+    print(await serverClient().then((api) => api.data.publishPolicy(options.table, policy)), "Policy activated");
+});
+program
+    .command("auth-origin:list")
+    .description("List trusted browser and native authentication origins")
+    .requiredOption("--environment <id>")
+    .action(async (options) => print(await sessionClient().then((api) => api.authOrigins.list(options.environment))));
+program
+    .command("auth-origin:add")
+    .description("Trust a browser origin or native application scheme for authentication")
+    .requiredOption("--environment <id>")
+    .requiredOption("--origin <origin>")
+    .action(async (options) => print(await sessionClient().then((api) => api.authOrigins.create(options.environment, options.origin)), "Authentication origin added"));
+program
+    .command("auth-origin:delete")
+    .description("Remove a trusted authentication origin")
+    .requiredOption("--environment <id>")
+    .requiredOption("--origin-id <id>")
+    .action(async (options) => print(await sessionClient().then((api) => api.authOrigins.delete(options.environment, options.originId))));
 program
     .command("artifact:create")
     .description("Create a validated manifest and tar archive from a project directory")
@@ -517,7 +578,7 @@ async function deployClient() {
     if (!deployToken?.startsWith("dp_"))
         throw new Error("This command requires ONECLIENT_DEPLOY_TOKEN with a dp_* token");
     return createClient({
-        baseUrl: await resolveApiUrl(),
+        baseUrl: await resolveControlApiUrl(),
         deployToken,
         ...(options.organization ? { organizationId: options.organization } : {}),
     });
@@ -528,7 +589,7 @@ async function serverClient() {
     if (!serverKey?.startsWith("sk_"))
         throw new Error("This command requires ONECLIENT_SERVER_KEY with an sk_* key");
     return createClient({
-        baseUrl: await resolveApiUrl(),
+        baseUrl: resolveEnvironmentApiUrl(),
         serverKey,
         ...(options.organization ? { organizationId: options.organization } : {}),
     });
@@ -539,18 +600,32 @@ async function resolvedDeveloperCredentials() {
     const sessionToken = process.env.ONECLIENT_SESSION_TOKEN ?? stored?.sessionToken;
     if (!sessionToken)
         return null;
-    const apiUrl = options.apiUrl ?? stored?.apiUrl;
-    if (!apiUrl)
-        throw new Error("Set ONECLIENT_API_URL or pass --api-url");
+    const apiUrl = options.apiUrl ?? stored?.apiUrl ?? DEFAULT_CONTROL_API_URL;
     return { apiUrl, sessionToken };
 }
-async function resolveApiUrl() {
+async function resolveControlApiUrl() {
     const options = program.opts();
     const apiUrl = options.apiUrl ?? (await readDeveloperCredentials())?.apiUrl;
+    return apiUrl ?? DEFAULT_CONTROL_API_URL;
+}
+function resolveEnvironmentApiUrl() {
+    const apiUrl = program.opts().apiUrl;
     if (!apiUrl)
-        throw new Error("Set ONECLIENT_API_URL or pass --api-url");
+        throw new Error("Set ONECLIENT_API_URL to the environment API URL or pass --api-url https://<environment>.api.one-client.com");
     return apiUrl;
 }
+function positiveInteger(value, name) {
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed) || parsed < 1)
+        throw new Error(`${name} must be a positive integer`);
+    return parsed;
+}
+function nonNegativeInteger(value, name) {
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed) || parsed < 0)
+        throw new Error(`${name} must be a non-negative integer`);
+    return parsed;
+}
 async function promptForOtp() {
     if (!process.stdin.isTTY)
         throw new Error("Set ONECLIENT_OTP for a non-interactive login");

package/dist/platform-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-auth.d.ts","sourceRoot":"","sources":["../src/platform-auth.ts"],"names":[],"mappings":"AAOA,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,OAAO,UAAU,CAAC,KAAwB,GAClD,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,OAAO,UAAU,CAAC,KAAwB,GAClD,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,OAAO,UAAU,CAAC,KAAwB,GAClD,OAAO,CAAC,IAAI,CAAC,CAEf"}
+{"version":3,"file":"platform-auth.d.ts","sourceRoot":"","sources":["../src/platform-auth.ts"],"names":[],"mappings":"AAQA,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,OAAO,UAAU,CAAC,KAAwB,GAClD,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,OAAO,UAAU,CAAC,KAAwB,GAClD,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,OAAO,UAAU,CAAC,KAAwB,GAClD,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/dist/platform-auth.js

@@ -1,4 +1,5 @@
 import { validateApiUrl } from "./credentials.js";
+import { developerAuthOrigin } from "./config.js";
 export async function sendDeveloperOtp(apiUrl, email, fetcher = globalThis.fetch) {
     await authRequest(fetcher, apiUrl, "/v1/platform/auth/email-otp/send-verification-otp", {
         email: normalizeEmail(email),
@@ -24,6 +25,7 @@ async function authRequest(fetcher, apiUrl, path, body, sessionToken) {
         headers: {
             Accept: "application/json",
             "Content-Type": "application/json",
+            Origin: developerAuthOrigin(apiUrl),
             ...(sessionToken ? { Authorization: `Bearer ${sessionToken}` } : {}),
         },
         body: JSON.stringify(body),

package/llms.txt

@@ -11,6 +11,14 @@ MCP: https://control.one-client.com/mcp
 
 Install: npm install oneclient
 CLI login: npx oneclient login --email you@company.com
+Control API configuration is automatic for the hosted service.
+
+First project flow:
+1. npx oneclient init --project-name "My app"
+2. Capture the shown-once development pk_* and sk_* values.
+3. Apply SQL with `oneclient sql` and policy with `oneclient policy:publish`.
+4. Add local/custom auth origins with `oneclient auth-origin:add`.
+5. Build, run `oneclient artifact:create`, create a dp_* token, then run `oneclient deploy --wait`.
 
 Use pk_* only in browser/mobile clients, sk_* only on trusted servers, and dp_* only for deploys.
 Never expose sk_* or dp_* values in client bundles or model output. Every mutation is idempotent and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oneclient",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "One package for the complete OneClient TypeScript SDK and developer CLI.",
   "license": "UNLICENSED",
   "homepage": "https://one-client.com",