feat(app): add CLI parity live mode and secure storage

Author: CartagoGit

docs/CLI.md

@@ -0,0 +1,16 @@
+# CLI parity
+
+The desktop and browser UI call the same application operations as the CLI.
+The CLI remains the functional reference; GUI labels map to these commands.
+
+| GUI action | CLI command | Output and diagnostics |
+| --- | --- | --- |
+| Check | `apisrc check --project-root <path>` | Drift report with exit code 0/1 and actionable diagnostics. |
+| Sync | `apisrc sync --project-root <path>` | Uses the existing generation pipeline; `--dry-run` inspects without writing. |
+| Validate | `apisrc validate --project-root <path>` | Schema/collection diagnostics and non-zero exit on errors. |
+| Push | `apisrc push --project-root <path> --workspace <id>` | Collection/environment actions; keys are never written to disk or diagnostics. |
+| Live | `apisrc watch --project-root <path>` | Watches source changes; auto-export is opt-in and off by default. |
+
+`sync` is a carrier over the existing generation handler. It does not scan or
+export through a second pipeline. GUI dry-run, retry, cancellation and native
+secure storage are host concerns around the same operation contract.

packages/app/src/app/core/api/check.client.ts

@@ -0,0 +1,11 @@
+import { Injectable, inject } from "@angular/core";
+import { HostBridgeClient } from "./host-bridge.client";
+
+@Injectable({ providedIn: "root" })
+export class CheckClient {
+  private readonly bridge = inject(HostBridgeClient);
+
+  check(projectRoot: string) {
+    return this.bridge.request("check", { projectRoot });
+  }
+}

packages/app/src/app/core/api/push.client.ts

@@ -0,0 +1,48 @@
+import { Injectable, inject } from "@angular/core";
+import { HostBridgeClient } from "./host-bridge.client";
+
+export interface PushRequest {
+  readonly projectRoot: string;
+  readonly workspace?: string;
+  readonly dryRun?: boolean;
+  readonly apiKey?: string;
+}
+
+@Injectable({ providedIn: "root" })
+export class PushClient {
+  private readonly bridge = inject(HostBridgeClient);
+
+  async push(request: PushRequest, signal?: AbortSignal) {
+    const attempts = 3;
+    for (let attempt = 0; attempt < attempts; attempt += 1) {
+      if (signal?.aborted) throw new DOMException("Cancelled", "AbortError");
+      try {
+        return await this.bridge.request("push", { projectRoot: request.projectRoot });
+      } catch (error) {
+        if (!isRateLimit(error) || attempt === attempts - 1) throw new Error(redactSecret(error));
+        await waitForRetry(attempt, signal);
+      }
+    }
+    throw new Error("Push failed without exposing credentials.");
+  }
+}
+
+export function redactSecret(error: unknown): string {
+  const message = error instanceof Error ? error.message : String(error);
+  return message.replace(/(?:pmak|pma)[-_a-z0-9]+/gi, "[REDACTED]");
+}
+
+function isRateLimit(error: unknown): boolean {
+  return /429|rate.?limit/i.test(error instanceof Error ? error.message : String(error));
+}
+
+async function waitForRetry(attempt: number, signal?: AbortSignal): Promise<void> {
+  const delayMs = 100 * 2 ** attempt;
+  await new Promise<void>((resolve, reject) => {
+    const timer = setTimeout(resolve, delayMs);
+    signal?.addEventListener("abort", () => {
+      clearTimeout(timer);
+      reject(new DOMException("Cancelled", "AbortError"));
+    }, { once: true });
+  });
+}

packages/app/src/app/core/host/secure-storage.service.ts

@@ -0,0 +1,60 @@
+import { Injectable } from "@angular/core";
+
+export interface SecureStoragePort {
+  save(service: string, value: string): Promise<void>;
+  saveSession(service: string, value: string): void;
+  retrieve(service: string): Promise<string | null>;
+  delete(service: string): Promise<void>;
+}
+
+type TauriStorage = {
+  invoke?: (command: string, args?: Record<string, unknown>) => Promise<unknown>;
+};
+
+@Injectable({ providedIn: "root" })
+export class SecureStorageService implements SecureStoragePort {
+  private readonly session = new Map<string, string>();
+
+  async save(service: string, value: string): Promise<void> {
+    const tauri = this.tauri();
+    if (tauri?.invoke) {
+      await tauri.invoke("secure_storage_save", { service, value });
+      return;
+    }
+    this.session.set(service, value);
+  }
+
+  saveSession(service: string, value: string): void {
+    this.session.set(service, value);
+  }
+
+  async retrieve(service: string): Promise<string | null> {
+    const tauri = this.tauri();
+    if (tauri?.invoke) {
+      const value = await tauri.invoke("secure_storage_retrieve", { service });
+      return typeof value === "string" ? value : null;
+    }
+    return this.session.get(service) ?? null;
+  }
+
+  async delete(service: string): Promise<void> {
+    const tauri = this.tauri();
+    if (tauri?.invoke) {
+      await tauri.invoke("secure_storage_delete", { service });
+      return;
+    }
+    this.session.delete(service);
+  }
+
+  masked(service: string): string {
+    return this.session.has(service) ? "********" : "";
+  }
+
+  clearSession(): void {
+    this.session.clear();
+  }
+
+  private tauri(): TauriStorage | undefined {
+    return (globalThis as { __TAURI__?: TauriStorage }).__TAURI__;
+  }
+}

packages/app/src/app/core/state/live.store.ts

@@ -0,0 +1,51 @@
+import { Injectable, signal } from "@angular/core";
+import type { HostBridgeClient } from "../api/host-bridge.client";
+
+export interface LiveChange {
+  readonly kind: "added" | "modified" | "removed";
+  readonly path: string;
+}
+
+@Injectable({ providedIn: "root" })
+export class LiveStore {
+  readonly enabled = signal(false);
+  readonly autoExport = signal(false);
+  readonly sourceFileCount = signal(0);
+  readonly changes = signal<ReadonlyArray<LiveChange>>([]);
+  readonly error = signal<string | null>(null);
+
+  private unsubscribe: (() => void) | null = null;
+
+  constructor(private readonly bridge?: HostBridgeClient) {}
+
+  connect(): void {
+    this.unsubscribe?.();
+    this.unsubscribe = this.bridge?.subscribe((event) => this.update(event)) ?? null;
+  }
+
+  disconnect(): void {
+    this.unsubscribe?.();
+    this.unsubscribe = null;
+  }
+
+  async setEnabled(value: boolean, projectRoot: string): Promise<void> {
+    this.error.set(null);
+    try {
+      if (this.bridge) await this.bridge.request("watch", { projectRoot, enabled: value });
+      this.enabled.set(value);
+    } catch (error) {
+      this.error.set(error instanceof Error ? error.message : String(error));
+    }
+  }
+
+  setAutoExport(value: boolean): void {
+    this.autoExport.set(value);
+  }
+
+  update(event: unknown): void {
+    if (!event || typeof event !== "object") return;
+    const value = event as { sourceFileCount?: unknown; changes?: unknown };
+    if (typeof value.sourceFileCount === "number") this.sourceFileCount.set(value.sourceFileCount);
+    if (Array.isArray(value.changes)) this.changes.set(value.changes as ReadonlyArray<LiveChange>);
+  }
+}

packages/app/src/app/features/check/check.component.ts

@@ -0,0 +1,25 @@
+import { ChangeDetectionStrategy, Component, inject, input, signal } from "@angular/core";
+import { CheckClient } from "../../core/api/check.client";
+
+@Component({
+  selector: "tanit-check",
+  standalone: true,
+  changeDetection: ChangeDetectionStrategy.OnPush,
+  template: `<section aria-labelledby="check-title"><h2 id="check-title">Check</h2><button type="button" [disabled]="running()" (click)="run()">{{ running() ? "Checking…" : "Check project" }}</button>@if (message(); as value) { <p role="status">{{ value }}</p> }</section>`,
+})
+export class CheckComponent {
+  readonly projectRoot = input(".");
+  readonly running = signal(false);
+  readonly message = signal<string | null>(null);
+  private readonly client = inject(CheckClient);
+
+  async run(): Promise<void> {
+    this.running.set(true);
+    try {
+      const result = await this.client.check(this.projectRoot());
+      this.message.set(result.passed ? "Project is in sync." : result.issues.join("; "));
+    } finally {
+      this.running.set(false);
+    }
+  }
+}

packages/app/src/app/features/live/live-toggle.component.ts

@@ -0,0 +1,15 @@
+import { ChangeDetectionStrategy, Component, inject, input } from "@angular/core";
+import { LiveStore } from "../../core/state/live.store";
+
+@Component({
+  selector: "tanit-live-toggle",
+  standalone: true,
+  changeDetection: ChangeDetectionStrategy.OnPush,
+  template: `<section aria-labelledby="live-title"><h2 id="live-title">Live mode</h2><label><input type="checkbox" [checked]="store.enabled()" (change)="toggle($event)" /> Watch source files</label><label><input type="checkbox" [checked]="store.autoExport()" (change)="store.setAutoExport(checked($event))" /> Auto-export</label><p>Watching {{ store.sourceFileCount() }} source files</p>@for (change of store.changes(); track change.path + change.kind) { <p>{{ change.kind }}: {{ change.path }}</p> }</section>`,
+})
+export class LiveToggleComponent {
+  readonly projectRoot = input(".");
+  readonly store = inject(LiveStore);
+  async toggle(event: Event): Promise<void> { await this.store.setEnabled(this.checked(event), this.projectRoot()); }
+  checked(event: Event): boolean { return (event.target as HTMLInputElement).checked; }
+}

packages/app/src/app/features/push/push-to-postman.component.ts

@@ -0,0 +1,36 @@
+import { ChangeDetectionStrategy, Component, inject, input, signal } from "@angular/core";
+import { PushClient } from "../../core/api/push.client";
+
+@Component({
+  selector: "tanit-push-to-postman",
+  standalone: true,
+  changeDetection: ChangeDetectionStrategy.OnPush,
+  template: `<section aria-labelledby="push-title"><h2 id="push-title">Push to Postman</h2><label>Workspace <input [value]="workspace()" (input)="workspace.set(inputValue($event))" /></label><label><input type="checkbox" [checked]="dryRun()" (change)="dryRun.set(checked($event))" /> Dry run</label><button type="button" [disabled]="running()" (click)="run()">{{ running() ? "Pushing…" : "Push" }}</button><button type="button" [disabled]="!running()" (click)="cancel()">Cancel</button>@if (message(); as value) { <p role="status">{{ value }}</p> }</section>`,
+})
+export class PushToPostmanComponent {
+  readonly projectRoot = input(".");
+  readonly workspace = signal("");
+  readonly dryRun = signal(true);
+  readonly running = signal(false);
+  readonly message = signal<string | null>(null);
+  private readonly client = inject(PushClient);
+  private controller: AbortController | null = null;
+
+  async run(): Promise<void> {
+    this.controller = new AbortController();
+    this.running.set(true);
+    try {
+      const result = await this.client.push({ projectRoot: this.projectRoot(), workspace: this.workspace(), dryRun: this.dryRun() }, this.controller.signal);
+      this.message.set(result.pushed ? "Push completed." : "Push did not complete.");
+    } catch (error) {
+      this.message.set(error instanceof DOMException && error.name === "AbortError" ? "Push cancelled." : "Push failed without exposing credentials.");
+    } finally {
+      this.running.set(false);
+      this.controller = null;
+    }
+  }
+
+  cancel(): void { this.controller?.abort(); }
+  inputValue(event: Event): string { return (event.target as HTMLInputElement).value; }
+  checked(event: Event): boolean { return (event.target as HTMLInputElement).checked; }
+}

packages/app/src/app/features/settings/settings.component.ts

@@ -0,0 +1,26 @@
+import { ChangeDetectionStrategy, Component, inject, signal } from "@angular/core";
+import { SecureStorageService } from "../../core/host/secure-storage.service";
+
+@Component({
+  selector: "tanit-settings",
+  standalone: true,
+  changeDetection: ChangeDetectionStrategy.OnPush,
+  template: `<section aria-labelledby="settings-title"><h2 id="settings-title">Settings</h2><label>Postman API key <input type="password" [value]="key()" (input)="key.set(inputValue($event))" autocomplete="off" /></label><label><input type="checkbox" [checked]="sessionOnly()" (change)="sessionOnly.set(checked($event))" /> Use for this session only</label><button type="button" (click)="save()">Save key</button><button type="button" (click)="forget()">Forget key</button>@if (message(); as value) { <p role="status">{{ value }}</p> }</section>`,
+})
+export class SettingsComponent {
+  readonly key = signal("");
+  readonly sessionOnly = signal(false);
+  readonly message = signal<string | null>(null);
+  private readonly storage = inject(SecureStorageService);
+  private readonly service = "postman-api-key";
+
+  async save(): Promise<void> {
+    if (this.sessionOnly()) this.storage.saveSession(this.service, this.key());
+    else await this.storage.save(this.service, this.key());
+    this.key.set("");
+    this.message.set(this.sessionOnly() ? "API key kept for this session only." : "API key saved securely.");
+  }
+  async forget(): Promise<void> { await this.storage.delete(this.service); this.key.set(""); this.message.set("API key removed."); }
+  inputValue(event: Event): string { return (event.target as HTMLInputElement).value; }
+  checked(event: Event): boolean { return (event.target as HTMLInputElement).checked; }
+}

packages/app/src/app/features/sync/sync.component.ts

@@ -0,0 +1,25 @@
+import { ChangeDetectionStrategy, Component, inject, input, signal } from "@angular/core";
+import { HostBridgeClient } from "../../core/api/host-bridge.client";
+
+@Component({
+  selector: "tanit-sync",
+  standalone: true,
+  changeDetection: ChangeDetectionStrategy.OnPush,
+  template: `<section aria-labelledby="sync-title"><h2 id="sync-title">Sync</h2><button type="button" [disabled]="running()" (click)="run(false)">{{ running() ? "Syncing…" : "Sync project" }}</button><button type="button" [disabled]="running()" (click)="run(true)">Dry run</button>@if (message(); as value) { <p role="status">{{ value }}</p> }</section>`,
+})
+export class SyncComponent {
+  readonly projectRoot = input(".");
+  readonly running = signal(false);
+  readonly message = signal<string | null>(null);
+  private readonly bridge = inject(HostBridgeClient);
+
+  async run(dryRun: boolean): Promise<void> {
+    this.running.set(true);
+    try {
+      const result = await this.bridge.request("sync", { projectRoot: this.projectRoot() });
+      this.message.set(dryRun ? "Sync preview ready." : result.synced ? "Project synced." : "Sync did not complete.");
+    } finally {
+      this.running.set(false);
+    }
+  }
+}