synomem 0.7.1 → 0.8.0

package/dist/cli.d.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { Command } from 'commander';
-import { type DiscoveredWorkspace } from './discover.js';
+import { type DiscoveredWorkspace, type WorkspaceMembership } from './discover.js';
 import { type PromptIo } from './prompt.js';
 import { type CredentialStore } from './credentials.js';
 import { type OAuthLoginOptions } from './oauth.js';
@@ -31,6 +31,14 @@ export interface CliDependencies {
         organizationId: string;
         workspaces: DiscoveredWorkspace[];
     }>;
+    /** Injected so `remote workspace list` can be tested without a network. */
+    discoverIdentity?: (options: {
+        baseUrl: string;
+        accessToken: string;
+    }) => Promise<{
+        workspaceId: string;
+        workspaces: WorkspaceMembership[];
+    }>;
     createImportBundle?: (home: string) => Promise<ImportBundle>;
     remoteImport?: (options: {
         baseUrl: string;

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAKA,OAAO,EAAE,OAAO,EAA0B,MAAM,WAAW,CAAC;AAkB5D,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,eAAe,CAAC;AAOvB,OAAO,EAA2B,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAA0C,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAIhG,OAAO,EAA4C,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE9F,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EAClB,MAAM,aAAa,CAAC;AASrB,OAAO,KAAK,EACV,aAAa,EASd,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAkB,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE1E,MAAM,WAAW,KAAK;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE;QACjC,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,aAAa,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,eAAe,CAAC;KAClC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAKpB,2BAA2B,CAAC,EAAE,CAAC,OAAO,EAAE;QACtC,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB,KAAK,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,mBAAmB,EAAE,CAAA;KAAE,CAAC,CAAC;IAC7E,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7D,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,aAAa,CAAC;QACrB,MAAM,EAAE,YAAY,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,KAAK,OAAO,CAAC,aAAa,GAAG,YAAY,CAAC,CAAC;CAC7C;AAuRD,wBAAgB,SAAS,CACvB,EAAE,GAAE,KAAiB,EACrB,cAAc,GAAE,qBAAgD,EAChE,YAAY,GAAE,eAAoB,EAClC,IAAI,GAAE,MAAM,EAAiB,GAC5B,OAAO,CAkyFT;AAED,wBAAsB,MAAM,CAC1B,IAAI,WAAe,EACnB,EAAE,GAAE,KAAiB,EACrB,cAAc,GAAE,qBAAgD,EAChE,YAAY,GAAE,eAAoB,GACjC,OAAO,CAAC,MAAM,CAAC,CAqBjB"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAKA,OAAO,EAAE,OAAO,EAA0B,MAAM,WAAW,CAAC;AAkB5D,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACzB,MAAM,eAAe,CAAC;AAOvB,OAAO,EAA2B,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAA0C,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAIhG,OAAO,EAA4C,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE9F,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EAClB,MAAM,aAAa,CAAC;AASrB,OAAO,KAAK,EACV,aAAa,EASd,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAkB,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE1E,MAAM,WAAW,KAAK;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,sBAAsB,CAAC,EAAE,CAAC,OAAO,EAAE;QACjC,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,aAAa,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,eAAe,CAAC;KAClC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAKpB,2BAA2B,CAAC,EAAE,CAAC,OAAO,EAAE;QACtC,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB,KAAK,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,mBAAmB,EAAE,CAAA;KAAE,CAAC,CAAC;IAC7E,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC3B,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB,KAAK,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,mBAAmB,EAAE,CAAA;KAAE,CAAC,CAAC;IAC1E,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7D,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,aAAa,CAAC;QACrB,MAAM,EAAE,YAAY,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,KAAK,OAAO,CAAC,aAAa,GAAG,YAAY,CAAC,CAAC;CAC7C;AAuRD,wBAAgB,SAAS,CACvB,EAAE,GAAE,KAAiB,EACrB,cAAc,GAAE,qBAAgD,EAChE,YAAY,GAAE,eAAoB,EAClC,IAAI,GAAE,MAAM,EAAiB,GAC5B,OAAO,CA81FT;AAED,wBAAsB,MAAM,CAC1B,IAAI,WAAe,EACnB,EAAE,GAAE,KAAiB,EACrB,cAAc,GAAE,qBAAgD,EAChE,YAAY,GAAE,eAAoB,GACjC,OAAO,CAAC,MAAM,CAAC,CAqBjB"}

package/dist/cli.js

@@ -8,7 +8,7 @@ import { configuredServiceFactory, readSynomemConfig, writeSynomemBackend } from
 import { cloudApiUrl } from './cloud.js';
 import { resolveHome } from './config.js';
 import { assertInteractive, confirmPlan, credentialFingerprint, credentialStoreChoices, environmentInstructions, readAccessToken, runConfigWizard, writeCredentialFile, } from './configure.js';
-import { discoverAccessKeyWorkspaces, discoverOrganizations, workspaceChoices, } from './discover.js';
+import { discoverAccessKeyWorkspaces, discoverIdentity, } from './discover.js';
 import { DEFAULT_WORKSPACE, listLocalWorkspaces, localWorkspaceHome } from './workspaces.js';
 import { findProjectSelection, resolveWorkspaceSelection, writeProjectSelection, } from './project.js';
 import { defaultPromptIo, select } from './prompt.js';
@@ -305,6 +305,7 @@ export function createCli(io = defaultIo, serviceFactory = configuredServiceFact
     const credentialStore = dependencies.credentialStore ?? new OsCredentialStore();
     const oauthLogin = dependencies.oauthLogin ?? loginWithOAuth;
     const discoverWorkspaces = dependencies.discoverAccessKeyWorkspaces ?? discoverAccessKeyWorkspaces;
+    const discoverAccountIdentity = dependencies.discoverIdentity ?? discoverIdentity;
     const promptIo = dependencies.promptIo ?? defaultPromptIo();
     const verifyRemoteCredential = dependencies.verifyRemoteCredential ??
         (async (options) => {
@@ -410,17 +411,62 @@ export function createCli(io = defaultIo, serviceFactory = configuredServiceFact
         output(io, global.json, { name, home }, `Created workspace ${name} at ${home}.\nAct in it with --workspace ${name}.`);
     });
     const remoteCommand = program.command('remote').description('Administer a remote workspace');
+    const remoteWorkspaceCommand = remoteCommand
+        .command('workspace')
+        .description('List or switch the workspace this credential addresses');
+    /*
+     * Every workspace this credential's account belongs to, and which are
+     * reachable right now with it — no new token needed for any workspace
+     * flagged reachable, since a human credential authorizes its whole
+     * organization, not permanently one workspace (see `workspace use`). Data
+     * plane (`/v1/identity`), not `/v1/me`: the latter is a first-party
+     * control-plane route gated by a service secret this CLI never holds, and
+     * would 401 unconditionally against the real hosted API.
+     */
+    remoteWorkspaceCommand
+        .command('list')
+        .description("List this credential's account's workspaces, and which are reachable now")
+        .option('--url <url>', 'internal: alternate HTTPS origin')
+        .action(async (options, command) => {
+        const global = globals(command);
+        const config = readSynomemConfig(global.home, env);
+        const baseUrl = options.url ??
+            (config?.backend.kind === 'remote' ? config.backend.baseUrl : cloudApiUrl(env));
+        const accessToken = env.SYNOMEM_ACCESS_TOKEN;
+        if (!accessToken) {
+            throw new SynomemError('AUTH_REQUIRED', 'Set SYNOMEM_ACCESS_TOKEN, or run `synomem auth login` first.');
+        }
+        const identity = await discoverAccountIdentity({ baseUrl, accessToken });
+        const human = identity.workspaces.length
+            ? identity.workspaces
+                .map((workspace) => `${workspace.id}  ${workspace.displayName}` +
+                (workspace.addressableWithThisToken
+                    ? ''
+                    : '  (not reachable with this credential)'))
+                .join('\n')
+            : 'This credential belongs to no workspaces yet.';
+        output(io, global.json, identity, human);
+    });
     /*
-     * The browser counterpart to `discoverAccessKeyWorkspaces` — same purpose,
-     * different credential: a signed-in account may reach several
-     * organizations, each with several workspaces, so there is a genuine choice
-     * to make, and no way to make it without seeing the list. Printing the IDs
-     * alongside the names is the point: the ID is what `backend use remote
-     * --workspace` takes.
+     * A workspace flagged `addressableWithThisToken` by `workspace list` needs
+     * no new token or re-authentication — the credential already covers it.
+     * This only ever rewrites local config to point at it; see `backend use
+     * remote --workspace`, which this delegates to.
      */
+    remoteWorkspaceCommand
+        .command('use <workspace-id>')
+        .description('Address a different workspace with the current remote credential')
+        .option('--url <url>', 'internal: alternate HTTPS origin')
+        .action((workspaceId, options, command) => {
+        const global = globals(command);
+        const config = writeSynomemBackend({ kind: 'remote', baseUrl: options.url ?? cloudApiUrl(env), workspaceId }, global.home);
+        output(io, global.json, { backend: config.backend }, `Now addressing workspace ${workspaceId}.`);
+    });
+    // Deprecated alias for `remote workspace list`, kept working rather than
+    // breaking anyone who already scripted the old name.
     remoteCommand
         .command('workspaces')
-        .description('List the organizations and workspaces this credential can reach')
+        .description('Deprecated: use `remote workspace list`')
         .option('--url <url>', 'internal: alternate HTTPS origin')
         .action(async (options, command) => {
         const global = globals(command);
@@ -431,19 +477,16 @@ export function createCli(io = defaultIo, serviceFactory = configuredServiceFact
         if (!accessToken) {
             throw new SynomemError('AUTH_REQUIRED', 'Set SYNOMEM_ACCESS_TOKEN, or run `synomem auth login` first.');
         }
-        const organizations = await discoverOrganizations({ baseUrl, accessToken });
-        const choices = workspaceChoices(organizations);
-        const human = organizations.length
-            ? organizations
-                .map((organization) => [
-                `${organization.displayName} (${organization.slug}) — ${organization.role}`,
-                ...(organization.workspaces.length
-                    ? organization.workspaces.map((workspace) => `  ${workspace.id}  ${workspace.displayName}`)
-                    : ['  (no workspaces yet)']),
-            ].join('\n'))
+        const identity = await discoverAccountIdentity({ baseUrl, accessToken });
+        const human = identity.workspaces.length
+            ? identity.workspaces
+                .map((workspace) => `${workspace.id}  ${workspace.displayName}` +
+                (workspace.addressableWithThisToken
+                    ? ''
+                    : '  (not reachable with this credential)'))
                 .join('\n')
-            : 'This account belongs to no organizations yet.';
-        output(io, global.json, { organizations, choices }, human);
+            : 'This credential belongs to no workspaces yet.';
+        output(io, global.json, identity, human);
     });
     remoteCommand
         .command('import')