viza 1.6.35 → 1.6.41

package/dist/src/cli/program.js

@@ -7,6 +7,7 @@ import { whoamiCommand } from "../commands/whoami/index.js";
 import { registerAwsCommand } from "../commands/aws/register.js";
 import { registerInfraCommand } from "../commands/infra/register.js";
 import { registerAgeCommand } from "../commands/age/register.js";
+import { registerBillingCommand } from "../commands/billing/register.js";
 export function createProgram() {
     const program = new Command();
     program
@@ -14,11 +15,12 @@ export function createProgram() {
         .description("Viza Command Line Interface")
         .version(getCliVersion());
     registerGlobalOptions(program);
-    registerBootstrapCommand(program);
-    registerLoginCommand(program);
+    registerAgeCommand(program);
     registerAwsCommand(program);
+    registerBillingCommand(program);
+    registerBootstrapCommand(program);
     registerInfraCommand(program);
-    registerAgeCommand(program);
+    registerLoginCommand(program);
     program
         .command("whoami")
         .description("Show current GitHub identity and Viza team memberships (local only)")

package/dist/src/commands/aws/rolesanywhere/rotate/rotate.js

@@ -34,7 +34,7 @@ export async function rotateAwsRolesAnywhereCommand(options) {
     // 3) Dispatch intent (freeze)
     await dispatchIntentAndWait({
         intent,
-        commandType: "aws.rolesanywhere.rotate.manual",
+        commandType: "aws.rolesanywhere.rotate",
         infraKey: "core",
         targetEnv: env,
         allowedTeams,

package/dist/src/commands/billing/login/aws/aws.js

@@ -0,0 +1,72 @@
+import { resolveEnv } from "../../../../context/env.js";
+import { resolveRuntimeHubIntent } from "../../../../context/hubIntent.js";
+import { dispatchIntentAndWait } from "../../../../core/dispatch.js";
+import { showSsoLinkMenu } from "../../../../ui/sso/awsLoginMenu.js";
+/**
+ * Target teams for `viza login aws`.
+ * This is a CLI-only UX constraint for fail-fast validation.
+ * NOT a policy and MUST NOT be sent to gateway.
+ */
+const TARGET_TEAMS = {
+    dev: [
+        "viza-billing",
+        "viza-manager",
+        "viza-admin",
+        "viza-super",
+    ],
+    prod: [
+        "viza-billing",
+        "viza-admin",
+        "viza-super",
+    ]
+};
+/**
+ * viza login aws
+ *
+ * Flow:
+ * 1) Resolve env (deterministic)
+ * 2) Resolve user identity (trusted via gh auth)
+ * 3) CLI pre-check against target teams (fail-fast UX)
+ * 4) Derive ONE valid team (deterministic)
+ * 5) Dispatch frozen intent to gateway
+ */
+export async function loginBillingAwsCommand(options) {
+    // 1) Resolve environment
+    const env = resolveEnv(options, "prod");
+    const intent = resolveRuntimeHubIntent();
+    const allowedTeams = TARGET_TEAMS[env];
+    // 5) Dispatch intent (freeze)
+    const result = await dispatchIntentAndWait({
+        intent,
+        commandType: "billing.login.aws",
+        infraKey: "aws",
+        targetEnv: env,
+        allowedTeams,
+        selfHosted: options.selfHosted === true,
+        keepLog: options.removeLog !== true,
+        flowGates: {
+            secrets: false,
+        },
+        payload: {}
+    }, {
+        log: "hide",
+    });
+    if (!result)
+        return;
+    if (result.status !== "success") {
+        return;
+    }
+    if (result.kind !== "runtime") {
+        return;
+    }
+    if (!result.data) {
+        return;
+    }
+    const awsResult = result.data;
+    if (typeof awsResult.loginUrl !== "string" ||
+        typeof awsResult.shortUrl !== "string" ||
+        typeof awsResult.ttlHours !== "number") {
+        throw new Error("invalid_runtime_aws_login_result_shape");
+    }
+    await showSsoLinkMenu(awsResult.loginUrl, awsResult.shortUrl, awsResult.ttlHours);
+}

package/dist/src/commands/billing/login/aws/register.js

@@ -0,0 +1,19 @@
+import { Command } from "commander";
+import { loginBillingAwsCommand } from "./aws.js";
+import { getResolvedOptions } from "../../../../cli/resolveOptions.js";
+export function registerBillingLoginAwsCommand(parent) {
+    // billing login
+    const loginCommand = new Command("login")
+        .description("Login to billing services");
+    // billing login aws
+    const awsCommand = new Command("aws")
+        .description("Login to AWS billing console")
+        .option("--prod", "Use production environment")
+        .option("--dev", "Use development environment")
+        .action(async (_opts, command) => {
+        const fullOpts = getResolvedOptions(command);
+        await loginBillingAwsCommand(fullOpts);
+    });
+    loginCommand.addCommand(awsCommand);
+    parent.addCommand(loginCommand);
+}

package/dist/src/commands/billing/login/register.js

@@ -0,0 +1,4 @@
+import { registerBillingLoginAwsCommand } from "./aws/register.js";
+export function registerBillingLoginCommand(program) {
+    registerBillingLoginAwsCommand(program);
+}

package/dist/src/commands/billing/login-admin/aws/aws.js

@@ -0,0 +1,71 @@
+import { resolveEnv } from "../../../../context/env.js";
+import { resolveRuntimeHubIntent } from "../../../../context/hubIntent.js";
+import { dispatchIntentAndWait } from "../../../../core/dispatch.js";
+import { showSsoLinkMenu } from "../../../../ui/sso/awsLoginMenu.js";
+/**
+ * Target teams for `viza login aws`.
+ * This is a CLI-only UX constraint for fail-fast validation.
+ * NOT a policy and MUST NOT be sent to gateway.
+ */
+const TARGET_TEAMS = {
+    dev: [
+        "viza-billing",
+        "viza-admin",
+        "viza-super",
+    ],
+    prod: [
+        "viza-billing",
+        "viza-admin",
+        "viza-super",
+    ]
+};
+/**
+ * viza login aws
+ *
+ * Flow:
+ * 1) Resolve env (deterministic)
+ * 2) Resolve user identity (trusted via gh auth)
+ * 3) CLI pre-check against target teams (fail-fast UX)
+ * 4) Derive ONE valid team (deterministic)
+ * 5) Dispatch frozen intent to gateway
+ */
+export async function loginBillingAdminAwsCommand(options) {
+    // 1) Resolve environment
+    const env = resolveEnv(options, "prod");
+    const intent = resolveRuntimeHubIntent();
+    const allowedTeams = TARGET_TEAMS[env];
+    // 5) Dispatch intent (freeze)
+    const result = await dispatchIntentAndWait({
+        intent,
+        commandType: "billing.login-admin.aws",
+        infraKey: "aws",
+        targetEnv: env,
+        allowedTeams,
+        selfHosted: options.selfHosted === true,
+        keepLog: options.removeLog !== true,
+        flowGates: {
+            secrets: false,
+        },
+        payload: {}
+    }, {
+        log: "hide",
+    });
+    if (!result)
+        return;
+    if (result.status !== "success") {
+        return;
+    }
+    if (result.kind !== "runtime") {
+        return;
+    }
+    if (!result.data) {
+        return;
+    }
+    const awsResult = result.data;
+    if (typeof awsResult.loginUrl !== "string" ||
+        typeof awsResult.shortUrl !== "string" ||
+        typeof awsResult.ttlHours !== "number") {
+        throw new Error("invalid_runtime_aws_login_result_shape");
+    }
+    await showSsoLinkMenu(awsResult.loginUrl, awsResult.shortUrl, awsResult.ttlHours);
+}

package/dist/src/commands/billing/login-admin/aws/register.js

@@ -0,0 +1,19 @@
+import { Command } from "commander";
+import { loginBillingAdminAwsCommand } from "./aws.js";
+import { getResolvedOptions } from "../../../../cli/resolveOptions.js";
+export function registerBillingLoginAdminAwsCommand(parent) {
+    // billing login-admin
+    const loginAdminCommand = new Command("login-admin")
+        .description("Login to billing services with admin privileges");
+    // billing login-admin aws
+    const awsCommand = new Command("aws")
+        .description("Login to AWS billing console (admin)")
+        .option("--prod", "Use production environment")
+        .option("--dev", "Use development environment")
+        .action(async (_opts, command) => {
+        const fullOpts = getResolvedOptions(command);
+        await loginBillingAdminAwsCommand(fullOpts);
+    });
+    loginAdminCommand.addCommand(awsCommand);
+    parent.addCommand(loginAdminCommand);
+}

package/dist/src/commands/billing/login-admin/register.js

@@ -0,0 +1,4 @@
+import { registerBillingLoginAdminAwsCommand } from "./aws/register.js";
+export function registerBillingLoginAdminCommand(program) {
+    registerBillingLoginAdminAwsCommand(program);
+}

package/dist/src/commands/billing/register.js

@@ -0,0 +1,6 @@
+import { registerBillingLoginCommand } from "./login/register.js";
+import { registerBillingLoginAdminCommand } from "./login-admin/register.js";
+export function registerBillingCommand(program) {
+    registerBillingLoginCommand(program);
+    registerBillingLoginAdminCommand(program);
+}

package/dist/src/commands/login/aws/aws.js

@@ -2,20 +2,6 @@ import { resolveEnv } from "../../../context/env.js";
 import { resolveRuntimeHubIntent } from "../../../context/hubIntent.js";
 import { dispatchIntentAndWait } from "../../../core/dispatch.js";
 import { showSsoLinkMenu } from "../../../ui/sso/awsLoginMenu.js";
-function parseAwsLoginResult(buffer) {
-    try {
-        const json = JSON.parse(buffer.toString("utf8"));
-        if (typeof json?.loginUrl === "string" &&
-            typeof json?.shortUrl === "string" &&
-            typeof json?.ttlHours === "number") {
-            return json;
-        }
-        throw new Error("invalid_aws_login_result_shape");
-    }
-    catch (err) {
-        throw new Error("failed_to_parse_aws_login_result");
-    }
-}
 /**
  * Target teams for `viza login aws`.
  * This is a CLI-only UX constraint for fail-fast validation.

package/dist/src/context/env.js

@@ -1,13 +1,10 @@
-export function resolveEnv(flags) {
-    // Fail fast on conflicting deterministic flags
+export function resolveEnv(flags, defaultEnv = "dev") {
     if (flags.prod && flags.dev) {
         throw new Error("Conflicting flags: --prod and --dev cannot be used together");
     }
-    // Deterministic environment resolution
     if (flags.prod)
         return "prod";
     if (flags.dev)
         return "dev";
-    // Default fallback
-    return "dev";
+    return defaultEnv;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "viza",
-  "version": "1.6.35",
+  "version": "1.6.41",
   "type": "module",
   "description": "Viza unified command line interface",
   "bin": {