riskmodels 2.1.0 → 3.0.0

package/README.md

@@ -27,9 +27,8 @@ node dist/index.js install --dry-run
 ## Authentication
 
 - **API key (recommended):** `riskmodels config init` (billed mode) or `riskmodels config set apiKey <rm_agent_...>`.
-- **OAuth client credentials:** `riskmodels config set clientId …` and `config set clientSecret …`, or set `RISKMODELS_CLIENT_ID` / `RISKMODELS_CLIENT_SECRET` (optional `RISKMODELS_OAUTH_SCOPE`; default matches the Python SDK).
 - **Environment:** `RISKMODELS_API_KEY` works without a config file for REST commands.
-- **Direct (Supabase) mode** is for `query` + `schema` only. REST analytics need an API key or OAuth (config or env).
+- **Direct (Supabase) mode** is for `query` + `schema` only. REST analytics need an API key (config or env).
 
 Base URL: stored as `apiBaseUrl` (default `https://riskmodels.app`). The CLI calls paths under `…/api/...` (same as `OPENAPI_SPEC.yaml`).
 
@@ -51,7 +50,7 @@ Config file: `~/.config/riskmodels/config.json`
 
 | Command | Description |
 |--------|-------------|
-| `riskmodels config init \| set \| list` | API key, OAuth fields (`clientId`, `clientSecret`, `oauthScope`), `apiBaseUrl`, or Supabase (direct) |
+| `riskmodels config init \| set \| list` | API key, `apiBaseUrl`, or Supabase (direct) |
 | `riskmodels install` | Detect Claude, Cursor, Codex, and VS Code MCP targets, store the API key in shared config, merge MCP configs with backups, and run a connection test. |
 | `riskmodels status` | Show shared config and MCP client detection status. |
 | `riskmodels doctor` | Local install-readiness diagnostics: Node, npx, API credentials, and client detection. |

package/dist/commands/config.js

@@ -76,15 +76,12 @@ export function configCommand() {
     cmd
         .command("set")
         .description("Set a config value")
-        .argument("<key>", "apiKey | apiBaseUrl | clientId | clientSecret | oauthScope | supabaseUrl | serviceRoleKey")
+        .argument("<key>", "apiKey | apiBaseUrl | supabaseUrl | serviceRoleKey")
         .argument("<value>", "value to store")
         .action(async (key, value) => {
         const allowed = new Set([
             "apiKey",
             "apiBaseUrl",
-            "clientId",
-            "clientSecret",
-            "oauthScope",
             "supabaseUrl",
             "serviceRoleKey",
         ]);
@@ -101,18 +98,6 @@ export function configCommand() {
         else if (key === "apiBaseUrl") {
             cfg.apiBaseUrl = value.replace(/\/$/, "");
         }
-        else if (key === "clientId") {
-            cfg.mode = "billed";
-            cfg.clientId = value;
-        }
-        else if (key === "clientSecret") {
-            cfg.mode = "billed";
-            cfg.clientSecret = value;
-        }
-        else if (key === "oauthScope") {
-            cfg.mode = "billed";
-            cfg.oauthScope = value;
-        }
         else if (key === "supabaseUrl") {
             cfg.mode = "direct";
             cfg.supabaseUrl = value.replace(/\/$/, "");
@@ -140,9 +125,6 @@ export function configCommand() {
             mode: cfg.mode,
             apiBaseUrl: cfg.apiBaseUrl ?? DEFAULT_API_BASE,
             apiKey: maskSecret(cfg.apiKey),
-            clientId: maskSecret(cfg.clientId),
-            clientSecret: maskSecret(cfg.clientSecret),
-            oauthScope: cfg.oauthScope ?? "(not set)",
             supabaseUrl: cfg.supabaseUrl ?? "(not set)",
             serviceRoleKey: maskSecret(cfg.serviceRoleKey),
         };

package/dist/commands/doctor.js

@@ -31,7 +31,7 @@ export function doctorCommand() {
             },
             {
                 id: "api_credentials",
-                ok: !!cfg?.apiKey || !!process.env.RISKMODELS_API_KEY || (!!cfg?.clientId && !!cfg?.clientSecret),
+                ok: !!cfg?.apiKey || !!process.env.RISKMODELS_API_KEY,
                 detail: cfg?.apiKey
                     ? `Config API key ${maskSecret(cfg.apiKey)} in ${abbreviatePath(configPath())}`
                     : process.env.RISKMODELS_API_KEY

package/dist/commands/status.js

@@ -20,7 +20,6 @@ export function statusCommand() {
             configFound: !!cfg,
             apiBaseUrl: cfg?.apiBaseUrl ?? "https://riskmodels.app",
             apiKey: maskSecret(cfg?.apiKey),
-            oauthConfigured: !!cfg?.clientId && !!cfg?.clientSecret,
             mcpClients: detections,
         };
         if (json) {

package/dist/lib/api-client.js

@@ -1,4 +1,4 @@
-import { getAuthorizationHeader, invalidateAuthForRetry } from "./credentials.js";
+import { getAuthorizationHeader } from "./credentials.js";
 /** Thrown on non-2xx API responses so callers can inspect `status` (e.g. retries on 503). */
 export class ApiHttpError extends Error {
     status;
@@ -22,38 +22,33 @@ function errorMessageFromBody(body) {
 }
 export async function apiFetchJson(auth, method, path, options) {
     const url = buildUrl(auth.apiRoot, path, options?.query);
-    for (let attempt = 1; attempt <= 2; attempt += 1) {
-        const headers = await getAuthorizationHeader(auth);
-        const init = {
-            method,
-            headers: {
-                ...headers,
-                Accept: "application/json",
-                ...(options?.jsonBody !== undefined ? { "Content-Type": "application/json" } : {}),
-            },
-            body: options?.jsonBody !== undefined ? JSON.stringify(options.jsonBody) : undefined,
-        };
-        const res = await fetch(url, init);
-        if (res.status === 401 && attempt === 1 && auth.oauth) {
-            invalidateAuthForRetry(auth);
-            continue;
-        }
-        const costUsd = res.headers.get("x-api-cost-usd") ?? undefined;
-        const text = await res.text();
-        let body;
-        try {
-            body = text ? JSON.parse(text) : null;
-        }
-        catch {
-            body = { raw: text };
-        }
-        if (!res.ok) {
-            const msg = errorMessageFromBody(body) || `HTTP ${res.status}`;
-            throw new ApiHttpError(res.status, msg);
-        }
-        return { body, costUsd, status: res.status, headers: res.headers };
+    // Single attempt: the retry existed only to refresh an expiring OAuth access
+    // token, and auth is now a static API key with nothing to refresh.
+    const headers = await getAuthorizationHeader(auth);
+    const init = {
+        method,
+        headers: {
+            ...headers,
+            Accept: "application/json",
+            ...(options?.jsonBody !== undefined ? { "Content-Type": "application/json" } : {}),
+        },
+        body: options?.jsonBody !== undefined ? JSON.stringify(options.jsonBody) : undefined,
+    };
+    const res = await fetch(url, init);
+    const costUsd = res.headers.get("x-api-cost-usd") ?? undefined;
+    const text = await res.text();
+    let body;
+    try {
+        body = text ? JSON.parse(text) : null;
     }
-    throw new Error("Unreachable");
+    catch {
+        body = { raw: text };
+    }
+    if (!res.ok) {
+        const msg = errorMessageFromBody(body) || `HTTP ${res.status}`;
+        throw new ApiHttpError(res.status, msg);
+    }
+    return { body, costUsd, status: res.status, headers: res.headers };
 }
 export async function apiFetchOptionalAuth(apiRoot, method, path, options) {
     const url = buildUrl(apiRoot, path, options?.query);

package/dist/lib/cli-human-diagnostics.d.ts

@@ -15,7 +15,6 @@ export type StatusPayload = {
     configFound: boolean;
     apiBaseUrl: string;
     apiKey: string;
-    oauthConfigured: boolean;
     mcpClients: ClientDetection[];
 };
 export declare function printStatusHuman(payload: StatusPayload): void;

package/dist/lib/cli-human-diagnostics.js

@@ -38,7 +38,6 @@ export function printStatusHuman(payload) {
     logLine(`  ${BULLET} ${payload.configFound ? chalk.green("file present") : chalk.dim("file missing (run install or config init)")}`);
     logLine(`  ${BULLET} ${chalk.bold("apiBaseUrl")} ${chalk.dim(payload.apiBaseUrl)}`);
     logLine(`  ${BULLET} ${chalk.bold("API key")} ${payload.apiKey}`);
-    logLine(`  ${BULLET} ${chalk.bold("OAuth")} ${payload.oauthConfigured ? chalk.green("configured") : chalk.dim("not configured")}`);
     logLine("");
     logLine(chalk.bold("MCP-related clients:"));
     for (const d of payload.mcpClients) {

package/dist/lib/config.d.ts

@@ -5,9 +5,6 @@ export interface RiskmodelsConfig {
     /** Base URL without trailing slash, e.g. https://riskmodels.app */
     apiBaseUrl?: string;
     /** OAuth client credentials (billed mode); scope defaults match the Python SDK. */
-    clientId?: string;
-    clientSecret?: string;
-    oauthScope?: string;
     supabaseUrl?: string;
     serviceRoleKey?: string;
 }

package/dist/lib/config.js

@@ -42,7 +42,7 @@ export function maskSecret(value, visible = 6) {
 export function isBilledReady(cfg) {
     return (!!cfg &&
         cfg.mode === "billed" &&
-        (!!cfg.apiKey?.trim() || (!!cfg.clientId?.trim() && !!cfg.clientSecret?.trim())));
+        !!cfg.apiKey?.trim());
 }
 export function isDirectReady(cfg) {
     return (!!cfg &&

package/dist/lib/credentials.d.ts

@@ -1,15 +1,18 @@
 import type { RiskmodelsConfig } from "./config.js";
-/** Matches sdk/riskmodels/client.py DEFAULT_SCOPE. */
-export declare const DEFAULT_OAUTH_SCOPE = "ticker-returns risk-decomposition batch-analysis factor-correlation macro-factor-series rankings";
+/**
+ * Auth is a static Bearer API key. There is no token exchange.
+ *
+ * Removed in 3.0.0: the OAuth client-credentials path. It POSTed a
+ * `client_credentials` grant to `{apiRoot}/auth/token`, an endpoint that was
+ * documented but never implemented — it returns 404, so any invocation
+ * configured that way failed on its first request. The API's only OAuth flow is
+ * authorization-code + PKCE for MCP clients, which issues an `rm_user_*` key
+ * that is used here as a plain API key.
+ */
 export type ResolvedApiAuth = {
     apiRoot: string;
-    /** Static Bearer (API key) — preferred when set */
-    apiKey?: string;
-    oauth?: {
-        clientId: string;
-        clientSecret: string;
-        scope: string;
-    };
+    /** Static Bearer (`rm_agent_*` or `rm_user_*`). */
+    apiKey: string;
 };
 export declare function resolveApiAuth(cfg: RiskmodelsConfig | null): ResolvedApiAuth | null;
 /** True when user has API key or OAuth credentials (config and/or env). */
@@ -21,6 +24,5 @@ export declare function assertRestApiAuth(cfg: RiskmodelsConfig | null, chalkYel
 /** Returns auth or sets process.exitCode and prints via assertRestApiAuth. */
 export declare function requireResolvedAuth(cfg: RiskmodelsConfig | null, chalkYellow: (s: string) => string): ResolvedApiAuth | null;
 export declare function getAuthorizationHeader(auth: ResolvedApiAuth): Promise<Record<string, string>>;
-export declare function invalidateAuthForRetry(auth: ResolvedApiAuth): void;
 /** Public origin for docs (no `/api` suffix). */
 export declare function displayApiOrigin(cfg: RiskmodelsConfig | null): string;

package/dist/lib/credentials.js

@@ -1,8 +1,5 @@
 import { apiRootFromUserBase } from "./api-url.js";
 import { DEFAULT_API_BASE } from "./config.js";
-import { fetchOAuthAccessToken, invalidateOAuthToken } from "./oauth.js";
-/** Matches sdk/riskmodels/client.py DEFAULT_SCOPE. */
-export const DEFAULT_OAUTH_SCOPE = "ticker-returns risk-decomposition batch-analysis factor-correlation macro-factor-series rankings";
 function trimEnv(key) {
     const v = process.env[key];
     return v?.trim() || undefined;
@@ -13,12 +10,6 @@ export function resolveApiAuth(cfg) {
     if (apiKey) {
         return { apiRoot, apiKey };
     }
-    const clientId = cfg?.clientId?.trim() || trimEnv("RISKMODELS_CLIENT_ID");
-    const clientSecret = cfg?.clientSecret?.trim() || trimEnv("RISKMODELS_CLIENT_SECRET");
-    const scope = cfg?.oauthScope?.trim() || trimEnv("RISKMODELS_OAUTH_SCOPE") || DEFAULT_OAUTH_SCOPE;
-    if (clientId && clientSecret) {
-        return { apiRoot, oauth: { clientId, clientSecret, scope } };
-    }
     return null;
 }
 /** True when user has API key or OAuth credentials (config and/or env). */
@@ -33,7 +24,7 @@ export function assertRestApiAuth(cfg, chalkYellow) {
         return;
     if (cfg?.mode === "direct") {
         console.error(chalkYellow("REST API commands need an API key or OAuth client credentials. " +
-            "Set RISKMODELS_API_KEY (or RISKMODELS_CLIENT_ID + RISKMODELS_CLIENT_SECRET), " +
+            "Set RISKMODELS_API_KEY — get a key at https://riskmodels.app/get-key — " +
             "or run `riskmodels config init` in billed mode."));
         process.exitCode = 1;
         return;
@@ -50,19 +41,7 @@ export function requireResolvedAuth(cfg, chalkYellow) {
     return null;
 }
 export async function getAuthorizationHeader(auth) {
-    if (auth.apiKey) {
-        return { Authorization: `Bearer ${auth.apiKey}` };
-    }
-    if (auth.oauth) {
-        const token = await fetchOAuthAccessToken(auth.apiRoot, auth.oauth.clientId, auth.oauth.clientSecret, auth.oauth.scope);
-        return { Authorization: `Bearer ${token}` };
-    }
-    throw new Error("No API credentials");
-}
-export function invalidateAuthForRetry(auth) {
-    if (auth.oauth) {
-        invalidateOAuthToken(auth.apiRoot, auth.oauth.clientId, auth.oauth.scope);
-    }
+    return { Authorization: `Bearer ${auth.apiKey}` };
 }
 /** Public origin for docs (no `/api` suffix). */
 export function displayApiOrigin(cfg) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "riskmodels",
-  "version": "2.1.0",
+  "version": "3.0.0",
   "description": "RiskModels CLI — REST API, SQL query, schema, billing, and agent manifests",
   "type": "module",
   "bin": {
@@ -11,7 +11,7 @@
     "README.md"
   ],
   "scripts": {
-    "build": "tsc",
+    "build": "rm -rf dist && tsc",
     "prepublishOnly": "npm run build",
     "install:global": "npm run build && npm link"
   },

package/dist/lib/oauth.d.ts

@@ -1,2 +0,0 @@
-export declare function invalidateOAuthToken(apiRoot: string, clientId: string, scope: string): void;
-export declare function fetchOAuthAccessToken(apiRoot: string, clientId: string, clientSecret: string, scope: string): Promise<string>;

package/dist/lib/oauth.js

@@ -1,47 +0,0 @@
-const skewSeconds = 60;
-const cache = new Map();
-function cacheKey(apiRoot, clientId, scope) {
-    return `${apiRoot}\0${clientId}\0${scope}`;
-}
-export function invalidateOAuthToken(apiRoot, clientId, scope) {
-    cache.delete(cacheKey(apiRoot, clientId, scope));
-}
-export async function fetchOAuthAccessToken(apiRoot, clientId, clientSecret, scope) {
-    const key = cacheKey(apiRoot, clientId, scope);
-    const now = performance.now();
-    const hit = cache.get(key);
-    if (hit && now < hit.expiresAtMono - skewSeconds * 1000) {
-        return hit.token;
-    }
-    const url = `${apiRoot.replace(/\/$/, "")}/auth/token`;
-    const res = await fetch(url, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-            grant_type: "client_credentials",
-            client_id: clientId,
-            client_secret: clientSecret,
-            scope,
-        }),
-    });
-    const text = await res.text();
-    let data;
-    try {
-        data = JSON.parse(text);
-    }
-    catch {
-        throw new Error(`OAuth token: HTTP ${res.status}: ${text.slice(0, 200)}`);
-    }
-    if (!res.ok) {
-        throw new Error(data?.error ?? `OAuth token: HTTP ${res.status}: ${text.slice(0, 200)}`);
-    }
-    if (!data.access_token) {
-        throw new Error("OAuth token response missing access_token");
-    }
-    const expiresIn = Math.max(30, Number(data.expires_in ?? 900));
-    cache.set(key, {
-        token: data.access_token,
-        expiresAtMono: now + expiresIn * 1000,
-    });
-    return data.access_token;
-}