clue2app-cli 0.2.7__tar.gz → 0.3.1__tar.gz

{clue2app_cli-0.2.7/src/clue2app_cli.egg-info → clue2app_cli-0.3.1}/PKG-INFO

@@ -1,9 +1,7 @@
 Metadata-Version: 2.4
 Name: clue2app-cli
-Version: 0.2.7
+Version: 0.3.1
 Summary: CLI application for clue2app using the clue2app-python-sdk
-Home-page: https://github.com/clue2solve/clue2app-cli
-Author: Clue2App CLI Team
 Author-email: Clue2App CLI Team <support@clue2app.com>
 License: MIT
 Project-URL: Homepage, https://github.com/clue2solve/clue2app-cli
@@ -33,6 +31,9 @@ Requires-Dist: pydantic>=1.10.0
 Requires-Dist: toml>=0.10.0
 Requires-Dist: questionary>=2.0.0
 Requires-Dist: textual>=0.40.0
+Requires-Dist: jsonschema>=4.18.0
+Requires-Dist: PyYAML>=6.0
+Requires-Dist: clue2app-mcp>=0.1.1; python_version >= "3.10"
 Provides-Extra: dev
 Requires-Dist: pytest>=7.0.0; extra == "dev"
 Requires-Dist: pytest-cov>=4.0.0; extra == "dev"
@@ -45,10 +46,7 @@ Provides-Extra: build
 Requires-Dist: pyinstaller>=6.0.0; extra == "build"
 Requires-Dist: invoke>=2.0.0; extra == "build"
 Requires-Dist: tox>=4.0.0; extra == "build"
-Dynamic: author
-Dynamic: home-page
 Dynamic: license-file
-Dynamic: requires-python
 
 # Clue2App CLI
 
@@ -59,31 +57,13 @@ Dynamic: requires-python
 [![Tests](https://img.shields.io/github/actions/workflow/status/clue2solve/clue2app-cli/tests.yml?label=tests)](https://github.com/clue2solve/clue2app-cli/actions/workflows/tests.yml)
 [![Release](https://img.shields.io/github/v/release/clue2solve/clue2app-cli)](https://github.com/clue2solve/clue2app-cli/releases)
 
-## Installation
-
-### Option 1: pip (Recommended)
+## Install
 
 ```bash
 pip install clue2app-cli
 ```
 
-### Option 2: Standalone Executable
-
-Download from [Releases](https://github.com/clue2solve/clue2app-cli/releases):
-
-```bash
-# macOS (Apple Silicon)
-curl -L https://github.com/clue2solve/clue2app-cli/releases/latest/download/clue2app-macos-arm64 -o c2a
-chmod +x c2a && sudo mv c2a /usr/local/bin/
-
-# macOS (Intel)
-curl -L https://github.com/clue2solve/clue2app-cli/releases/latest/download/clue2app-macos-x64 -o c2a
-chmod +x c2a && sudo mv c2a /usr/local/bin/
-
-# Linux
-curl -L https://github.com/clue2solve/clue2app-cli/releases/latest/download/clue2app-linux-x64 -o c2a
-chmod +x c2a && sudo mv c2a /usr/local/bin/
-```
+Requires Python 3.10+. Verify with `c2a --version`.
 
 ## Quick Start
 
@@ -128,9 +108,30 @@ c2a rebuild my-app
 | `c2a rebuild <app>` | Trigger app rebuild |
 | `c2a env set <app> KEY=value` | Set environment variables |
 | `c2a secrets create -n <name> -u <user> -p <token>` | Create a git credential secret |
+| `c2a user invite -e <email> -A <account_uuid> -P <project_uuid> -r <role>` | Invite a project member via the invitations flow (SCK-625) |
 | `c2a llm list` / `c2a llm create` / `c2a llm bind <app> <secret>` | Manage LLM Gateway bindings (see [Daari LLM](docs/daari-llm.md)) |
 | `c2a daari secrets list` / `bind <app> <secret>` | Manage Daari service bindings (see [Daari](docs/daari.md)) |
 
+### Inviting a project member (SCK-625)
+
+Pass `-A <account_uuid>` to route through the invitations service
+(`POST /api/v1/invitations/project-member`, backed by SCK-622). The
+new endpoint mints an invitation row, sends the redemption email by
+default, and returns a redemption URL the CLI prints:
+
+```bash
+# Server sends the invitation email (default delivery).
+c2a user invite -e alice@corp.com -A <account_uuid> -P <project_uuid> -r CONTRIBUTOR
+
+# --copy-only skips the email; hand-deliver the printed URL yourself.
+c2a user invite -e alice@corp.com -A <account_uuid> -P <project_uuid> -r VIEWER --copy-only
+```
+
+`-r` accepts `VIEWER`, `CONTRIBUTOR`, or `PROJECT_ADMIN`. Without
+`-A`, `c2a user invite` keeps its legacy behaviour (invite-with-
+project-grants via `/api/accounts/{id}/members`, or the LOCAL user
+create flow with `-u`/`-p`).
+
 ## Configuration
 
 Config files are stored in `~/.c2a/`:

{clue2app_cli-0.2.7 → clue2app_cli-0.3.1}/README.md

@@ -7,31 +7,13 @@
 [![Tests](https://img.shields.io/github/actions/workflow/status/clue2solve/clue2app-cli/tests.yml?label=tests)](https://github.com/clue2solve/clue2app-cli/actions/workflows/tests.yml)
 [![Release](https://img.shields.io/github/v/release/clue2solve/clue2app-cli)](https://github.com/clue2solve/clue2app-cli/releases)
 
-## Installation
-
-### Option 1: pip (Recommended)
+## Install
 
 ```bash
 pip install clue2app-cli
 ```
 
-### Option 2: Standalone Executable
-
-Download from [Releases](https://github.com/clue2solve/clue2app-cli/releases):
-
-```bash
-# macOS (Apple Silicon)
-curl -L https://github.com/clue2solve/clue2app-cli/releases/latest/download/clue2app-macos-arm64 -o c2a
-chmod +x c2a && sudo mv c2a /usr/local/bin/
-
-# macOS (Intel)
-curl -L https://github.com/clue2solve/clue2app-cli/releases/latest/download/clue2app-macos-x64 -o c2a
-chmod +x c2a && sudo mv c2a /usr/local/bin/
-
-# Linux
-curl -L https://github.com/clue2solve/clue2app-cli/releases/latest/download/clue2app-linux-x64 -o c2a
-chmod +x c2a && sudo mv c2a /usr/local/bin/
-```
+Requires Python 3.10+. Verify with `c2a --version`.
 
 ## Quick Start
 
@@ -76,9 +58,30 @@ c2a rebuild my-app
 | `c2a rebuild <app>` | Trigger app rebuild |
 | `c2a env set <app> KEY=value` | Set environment variables |
 | `c2a secrets create -n <name> -u <user> -p <token>` | Create a git credential secret |
+| `c2a user invite -e <email> -A <account_uuid> -P <project_uuid> -r <role>` | Invite a project member via the invitations flow (SCK-625) |
 | `c2a llm list` / `c2a llm create` / `c2a llm bind <app> <secret>` | Manage LLM Gateway bindings (see [Daari LLM](docs/daari-llm.md)) |
 | `c2a daari secrets list` / `bind <app> <secret>` | Manage Daari service bindings (see [Daari](docs/daari.md)) |
 
+### Inviting a project member (SCK-625)
+
+Pass `-A <account_uuid>` to route through the invitations service
+(`POST /api/v1/invitations/project-member`, backed by SCK-622). The
+new endpoint mints an invitation row, sends the redemption email by
+default, and returns a redemption URL the CLI prints:
+
+```bash
+# Server sends the invitation email (default delivery).
+c2a user invite -e alice@corp.com -A <account_uuid> -P <project_uuid> -r CONTRIBUTOR
+
+# --copy-only skips the email; hand-deliver the printed URL yourself.
+c2a user invite -e alice@corp.com -A <account_uuid> -P <project_uuid> -r VIEWER --copy-only
+```
+
+`-r` accepts `VIEWER`, `CONTRIBUTOR`, or `PROJECT_ADMIN`. Without
+`-A`, `c2a user invite` keeps its legacy behaviour (invite-with-
+project-grants via `/api/accounts/{id}/members`, or the LOCAL user
+create flow with `-u`/`-p`).
+
 ## Configuration
 
 Config files are stored in `~/.c2a/`:

{clue2app_cli-0.2.7 → clue2app_cli-0.3.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "clue2app-cli"
-version = "0.2.7"
+version = "0.3.1"
 description = "CLI application for clue2app using the clue2app-python-sdk"
 readme = "README.md"
 requires-python = ">=3.8"
@@ -36,6 +36,9 @@ dependencies = [
     "toml>=0.10.0",
     "questionary>=2.0.0",   # Interactive prompts for wizard
     "textual>=0.40.0",      # Modern TUI framework with CSS animations
+    "jsonschema>=4.18.0",   # .c2a-tests.yaml validator (SCK-463); needs Draft 2020-12 support
+    "PyYAML>=6.0",          # Parse .c2a-tests.yaml for `c2a tests validate`
+    "clue2app-mcp>=0.1.1; python_version>='3.10'",  # Bundle MCP server transitively (v0.3.0); MCP requires Python 3.10+
 ]
 
 [project.optional-dependencies]
@@ -70,6 +73,12 @@ where = ["src"]
 [tool.setuptools.package-dir]
 "" = "src"
 
+# Ship the bundled .c2a-tests.yaml v1 schema (SCK-463). `c2a tests validate`
+# needs it at runtime; without an explicit package-data line, sdists ship it
+# but wheels can drop it depending on setuptools version. Belt-and-braces.
+[tool.setuptools.package-data]
+"clue2app_cli.tests_schema" = ["*.json"]
+
 [tool.black]
 line-length = 88
 target-version = ['py38']

{clue2app_cli-0.2.7 → clue2app_cli-0.3.1}/src/clue2app_cli/creds_module.py

@@ -109,23 +109,51 @@ def trigger_kpack_rebuild(image_name: str, namespace: str) -> tuple[bool, str]:
 class CredStatus:
     """Result of probing one git secret's PAT against GitHub.
 
-    `alive`: bool — token authenticated successfully against GitHub.
-    `reason`: short tag for grouping (e.g. "ok", "401-unauthorized",
-              "saml-required", "no-password", "unreachable").
-    `detail`: human-readable extra info (which scope was missing, etc.).
+    `alive`:      token authenticated successfully against GitHub.
+    `reason`:     short tag for grouping (e.g. "ok", "401-unauthorized",
+                  "saml-required", "no-password", "unreachable",
+                  "expiring-soon").
+    `detail`:     human-readable extra info (which scope was missing, etc.).
+    `expires_at`: ISO-8601 expiry timestamp from GitHub's
+                  `github-authentication-token-expiration` response header,
+                  if present. Returned by GitHub for classic + fine-grained
+                  PATs (`ghp_*` / `github_pat_*`). Absent for `gho_*` OAuth
+                  tokens (incl. `gh auth token`) and GitHub App installation
+                  tokens — those return None and the caller can't predict
+                  expiry.
+    `days_to_expiry`: integer days from now until `expires_at`. Negative
+                  means already expired. None when `expires_at` is None.
     """
 
     alive: bool
     reason: str
     detail: str = ""
+    expires_at: Optional[str] = None
+    days_to_expiry: Optional[int] = None
+
+
+# Tokens within this many days of expiry get the `expiring-soon` reason
+# even though they're still alive. Picked at 14d so a weekly check cycle
+# always catches them at least twice before they break.
+EXPIRY_WARN_DAYS = 14
 
 
 def probe_github_pat(token: str, *, timeout_s: float = 10.0) -> CredStatus:
-    """Hit `GET https://api.github.com/user` with the token. 200 means the
-    token is valid AND has at least basic identity scope. 401 means
-    expired/revoked. 403 with `X-GitHub-SSO` header means the org needs
-    SAML SSO authorization for this token (the most common 'silent break'
-    in clue2solve's setup)."""
+    """Hit `GET https://api.github.com/user` with the token. Classifies
+    the response:
+
+      - 200 + no expiry header           -> alive, reason="ok"
+      - 200 + expiry header > 14d        -> alive, reason="ok", expires_at set
+      - 200 + expiry header within 14d   -> alive, reason="expiring-soon"
+      - 401                              -> dead, reason="401-unauthorized"
+      - 403 + X-GitHub-SSO header        -> dead, reason="saml-required"
+      - 403 generic                      -> dead, reason="403-forbidden"
+      - URLError / timeout               -> unknown, reason="unreachable"
+
+    Expiry header (`github-authentication-token-expiration`) is only
+    populated for classic + fine-grained PATs. `gho_*` OAuth tokens
+    don't expose it; we can only detect them after they break.
+    """
     import urllib.error
     import urllib.request
 
@@ -143,7 +171,16 @@ def probe_github_pat(token: str, *, timeout_s: float = 10.0) -> CredStatus:
     try:
         with urllib.request.urlopen(req, timeout=timeout_s) as r:
             if r.status == 200:
-                return CredStatus(True, "ok")
+                exp_raw = r.headers.get("github-authentication-token-expiration")
+                expires_at, days = _parse_expiry_header(exp_raw)
+                if days is not None and days <= EXPIRY_WARN_DAYS:
+                    return CredStatus(
+                        True, "expiring-soon",
+                        f"expires in {days} day(s)",
+                        expires_at=expires_at,
+                        days_to_expiry=days,
+                    )
+                return CredStatus(True, "ok", expires_at=expires_at, days_to_expiry=days)
             return CredStatus(False, f"unexpected-{r.status}", "")
     except urllib.error.HTTPError as e:
         if e.code == 401:
@@ -160,6 +197,46 @@ def probe_github_pat(token: str, *, timeout_s: float = 10.0) -> CredStatus:
         return CredStatus(False, "unreachable", str(e))
 
 
+def _parse_expiry_header(raw: Optional[str]) -> tuple[Optional[str], Optional[int]]:
+    """Parse GitHub's `github-authentication-token-expiration` header.
+
+    Format example: `2026-08-15 14:30:00 UTC`. Returns
+    (iso_string, days_to_expiry). Both None if header is absent or
+    unparseable — we want this to be a soft signal, never a crash."""
+    if not raw:
+        return None, None
+    import datetime
+
+    raw = raw.strip()
+    formats = [
+        "%Y-%m-%d %H:%M:%S %Z",
+        "%Y-%m-%dT%H:%M:%SZ",
+        "%Y-%m-%d %H:%M:%S UTC",
+    ]
+    parsed: Optional[datetime.datetime] = None
+    for fmt in formats:
+        try:
+            parsed = datetime.datetime.strptime(raw, fmt)
+            break
+        except ValueError:
+            continue
+    if parsed is None:
+        # Last resort: try fromisoformat after Z->+00:00
+        try:
+            parsed = datetime.datetime.fromisoformat(raw.replace("Z", "+00:00"))
+        except ValueError:
+            return None, None
+
+    # Make tz-aware in UTC if naive (GitHub header is always UTC)
+    if parsed.tzinfo is None:
+        parsed = parsed.replace(tzinfo=datetime.timezone.utc)
+
+    now = datetime.datetime.now(datetime.timezone.utc)
+    delta = parsed - now
+    days = int(delta.total_seconds() // 86400)  # truncate to whole days; can be negative
+    return parsed.isoformat(), days
+
+
 # ---------------------------------------------------------------------------
 # Cluster discovery — find all kpack Image -> git secret references
 # ---------------------------------------------------------------------------