@anvil-works/anvil-cli 0.8.0-canary.12 → 0.8.0-canary.13

package/dist/api.d.ts

@@ -7,13 +7,17 @@ export type { WatchDiagnosticEventName, WatchDiagnosticEventPayload, WatchSessio
 export { branchFromEnvironmentVersion, readEnvironmentPid, requireEnvironmentBranch, writeEnvironmentPid, } from "./environment";
 export type { AnvilEnvironmentBinding, AnvilEnvironmentVersion, EnvBranchChangeMode } from "./environment";
 export { AppIdCandidate, AppIdWithContext, CheckoutAppListItem, detectAppIdsByCommitLookup, detectAppIdsFromAllRemotes, filterCandidates, formatCandidateLabel, getGitFetchUrl, getGitPushUrl, getLatestVersion, getWebSocketUrl, listAppsForCheckout, lookupRemoteInfoForAppId, lookupByCommit, saveUpdates, ValidateAppIdResponse, validateAppId, } from "./services/anvil-api";
-export { ANVIL_SYNC_CLIENT_ID, getAccountsForUrl, getAvailableAnvilUrls, getValidAuthToken, hasTokensForUrl, verifyAndStoreTokens, LoginResult, LogoutResult, logout, TokenData, clearInMemoryTokens, setInMemoryTokens, verifyAuth, } from "./services/auth";
+export { ANVIL_SYNC_CLIENT_ID, getAccountsForUrl, getAvailableAnvilUrls, getValidAuthToken, GetValidAuthTokenOptions, hasTokensForUrl, REFRESH_REQUEST_TIMEOUT_MS, verifyAndStoreTokens, LoginResult, LogoutResult, logout, TokenData, clearInMemoryTokens, setInMemoryTokens, verifyAuth, } from "./services/auth";
 export { DeviceAuthorizationResponse, OAuthTokenResponse, pollDeviceAuthorization, requestDeviceAuthorization, } from "./services/oauth-login";
 export { CheckoutCloneOptions, CheckoutExecutionDeps, CheckoutOptions, CheckoutResult, executeCheckout, getDefaultDestinationDirectory, isDirectoryNonEmpty, isPathInsideGitRepo, parseCheckoutInput, ParsedCheckoutInput, sanitizeDirectoryName, validateCheckoutDestination, } from "./commands/checkout";
 export { createCheckoutPickerSource, type CheckoutPickerDeps, type CheckoutPickerSourceController, type CheckoutPickerSourceOptions, } from "./commands/checkout-picker";
 export { buildGitAuthDoctorReport, formatGitAuthDoctorReport, inspectCredentialHelperCommand, parseCredentialHelperCommand, } from "./commands/gitAuth";
 export type { CredentialFillResult, GitAuthDoctorAppReport, GitAuthDoctorFinding, GitAuthDoctorRemote, GitAuthDoctorReport, GitAuthDoctorStatus, GitCredentialHelperDetails, GitCredentialSimulation, InspectCredentialHelperOptions, } from "./commands/gitAuth";
 export { executeGitCredentialOperation } from "./commands/gitCredential";
+export { executeModelTokenOperation, getModelToken, MODEL_TOKEN_LOCK_TIMEOUT_MS } from "./commands/modelToken";
+export type { ModelTokenDeps, ModelTokenOptions } from "./commands/modelToken";
+export { AUTH_FILE_LOCK_DEFAULTS, getModelTokenHelperScript, installModelTokenHelperScript, MODEL_TOKEN_HELPER_FILENAME, withRepoAuthFileLock, } from "./services/git-auth";
+export type { AuthFileLockOptions } from "./services/git-auth";
 export { deleteConfig, getAllConfig, getConfig, getInstalledPreferredEditors, getPreferredEditorCommand, getSettableConfigKeys, isCommandAvailable, normalizeAnvilUrl, parseConfigSetValue, preferredEditors, PreferredEditor, resetConfig, resolveAnvilUrl, setAuthTokensForAccount, setConfig, SettableConfigKey, } from "./config";
 export { BranchSyncStatus, ValidateBranchSyncStatusOptions, validateAnvilApp, validateBranchSyncStatus, } from "./services/validation";
 export { AnvilYamlValidationResult, FormTemplateValidationResult, ValidatePathResult, ValidationTarget, ValidationIssue, formatValidationPath, validatePath, validateAnvilYaml, validateFormTemplate, } from "./validators";

package/dist/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAkB,QAAQ,EAAgB,MAAM,UAAU,CAAC;AAI7E,OAAO,EAA4B,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACzF,OAAO,EACH,uBAAuB,EACvB,mBAAmB,EAQtB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,YAAY,EAAE,CAAC;AACxB,YAAY,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAChH,OAAO,EACH,4BAA4B,EAC5B,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,GACtB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAG3G,OAAO,EACH,cAAc,EACd,gBAAgB,EAChB,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,EAC1B,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,wBAAwB,EACxB,cAAc,EACd,WAAW,EACX,qBAAqB,EACrB,aAAa,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACH,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,MAAM,EACN,SAAS,EACT,mBAAmB,EACnB,iBAAiB,EACjB,UAAU,GACb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACH,2BAA2B,EAC3B,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACH,oBAAoB,EACpB,qBAAqB,EACrB,eAAe,EACf,cAAc,EACd,eAAe,EACf,8BAA8B,EAC9B,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,2BAA2B,GAC9B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACH,0BAA0B,EAC1B,KAAK,kBAAkB,EACvB,KAAK,8BAA8B,EACnC,KAAK,2BAA2B,GACnC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACH,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC/B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACR,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,8BAA8B,GACjC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EACH,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,4BAA4B,EAC5B,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,WAAW,EACX,eAAe,EACf,uBAAuB,EACvB,SAAS,EACT,iBAAiB,GACpB,MAAM,UAAU,CAAC;AAClB,OAAO,EACH,gBAAgB,EAChB,+BAA+B,EAC/B,gBAAgB,EAChB,wBAAwB,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACH,yBAAyB,EACzB,4BAA4B,EAC5B,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,YAAY,EACZ,iBAAiB,EACjB,oBAAoB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EACH,qBAAqB,EACrB,gCAAgC,EAChC,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,GAC3B,MAAM,qBAAqB,CAAC;AAQ7B,MAAM,WAAW,kBAAkB;IAC/B,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,sBAAsB,CAAC;AAEvE,MAAM,WAAW,mBAAmB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,uBAAuB,CAAC;IACtC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,eAAe,CAAC,EAAE,OAAO,CAAC;CAC7B;AAMD;;;GAGG;AACH,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAsB3F;AAMD;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CA2BjH;AAMD;;;GAGG;AACH,wBAAsB,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,YAAY,CAAC,CA8J9G"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAkB,QAAQ,EAAgB,MAAM,UAAU,CAAC;AAI7E,OAAO,EAA4B,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACzF,OAAO,EACH,uBAAuB,EACvB,mBAAmB,EAQtB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,YAAY,EAAE,CAAC;AACxB,YAAY,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAChH,OAAO,EACH,4BAA4B,EAC5B,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,GACtB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAG3G,OAAO,EACH,cAAc,EACd,gBAAgB,EAChB,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,EAC1B,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,wBAAwB,EACxB,cAAc,EACd,WAAW,EACX,qBAAqB,EACrB,aAAa,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACH,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,wBAAwB,EACxB,eAAe,EACf,0BAA0B,EAC1B,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,MAAM,EACN,SAAS,EACT,mBAAmB,EACnB,iBAAiB,EACjB,UAAU,GACb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACH,2BAA2B,EAC3B,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACH,oBAAoB,EACpB,qBAAqB,EACrB,eAAe,EACf,cAAc,EACd,eAAe,EACf,8BAA8B,EAC9B,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,2BAA2B,GAC9B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACH,0BAA0B,EAC1B,KAAK,kBAAkB,EACvB,KAAK,8BAA8B,EACnC,KAAK,2BAA2B,GACnC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACH,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC/B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACR,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,8BAA8B,GACjC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,aAAa,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAC/G,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EACH,uBAAuB,EACvB,yBAAyB,EACzB,6BAA6B,EAC7B,2BAA2B,EAC3B,oBAAoB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EACH,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,4BAA4B,EAC5B,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,WAAW,EACX,eAAe,EACf,uBAAuB,EACvB,SAAS,EACT,iBAAiB,GACpB,MAAM,UAAU,CAAC;AAClB,OAAO,EACH,gBAAgB,EAChB,+BAA+B,EAC/B,gBAAgB,EAChB,wBAAwB,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACH,yBAAyB,EACzB,4BAA4B,EAC5B,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,YAAY,EACZ,iBAAiB,EACjB,oBAAoB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EACH,qBAAqB,EACrB,gCAAgC,EAChC,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,GAC3B,MAAM,qBAAqB,CAAC;AAQ7B,MAAM,WAAW,kBAAkB;IAC/B,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,sBAAsB,CAAC;AAEvE,MAAM,WAAW,mBAAmB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,uBAAuB,CAAC;IACtC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,eAAe,CAAC,EAAE,OAAO,CAAC;CAC7B;AAMD;;;GAGG;AACH,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAsB3F;AAMD;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CA2BjH;AAMD;;;GAGG;AACH,wBAAsB,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,YAAY,CAAC,CA8J9G"}

package/dist/cli.js

@@ -13384,9 +13384,10 @@ var __webpack_exports__ = {};
                 type: "auth_invalid",
                 message
             }),
-        refreshFailed: (message)=>({
+        refreshFailed: (message, status)=>({
                 type: "token_refresh_failed",
-                message
+                message,
+                status
             })
     };
     const createAppError = {
@@ -13600,6 +13601,19 @@ var __webpack_exports__ = {};
                 return "An unknown error occurred";
         }
     }
+    function getErrorCauseMessage(error) {
+        if ("object" != typeof error || null === error || !("cause" in error)) return null;
+        const cause = error.cause;
+        if (null == cause) return null;
+        const message = errors_getErrorMessage(cause);
+        const code = "object" == typeof cause && null !== cause && "code" in cause && "string" == typeof cause.code ? cause.code : null;
+        if (code && !message.includes(code)) return `${message} (${code})`;
+        return message;
+    }
+    function logErrorCause(error, ui) {
+        const causeMessage = getErrorCauseMessage(error);
+        if (causeMessage) ui.verbose(`Cause: ${causeMessage}`);
+    }
     const external_module_namespaceObject = require("module");
     const requireFromHere = (0, external_module_namespaceObject.createRequire)(__filename);
     const GIT_CREDENTIAL_HELPER_FILENAME = "anvil-credential-helper.cjs";
@@ -13820,6 +13834,76 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
     function getAuthFilePath(gitDir) {
         return external_path_default().join(gitDir, "anvil-auth.json");
     }
+    const AUTH_FILE_LOCK_DEFAULTS = {
+        staleMs: 30000,
+        timeoutMs: 60000,
+        retryDelayMs: 100,
+        heartbeatMs: 5000
+    };
+    function git_auth_delay(ms) {
+        return new Promise((resolve)=>setTimeout(resolve, ms));
+    }
+    async function acquireAuthFileLock(lockPath, options) {
+        const deadline = Date.now() + options.timeoutMs;
+        while(true){
+            try {
+                const handle = await external_fs_.promises.open(lockPath, "wx", 384);
+                try {
+                    await handle.writeFile(JSON.stringify({
+                        pid: process.pid,
+                        acquiredAt: new Date().toISOString()
+                    }));
+                } finally{
+                    await handle.close();
+                }
+                return;
+            } catch (e) {
+                if ("EEXIST" !== e.code) throw e;
+            }
+            try {
+                const lockStat = await external_fs_.promises.stat(lockPath);
+                if (Date.now() - lockStat.mtimeMs > options.staleMs) {
+                    await external_fs_.promises.rm(lockPath, {
+                        force: true
+                    });
+                    continue;
+                }
+            } catch  {
+                continue;
+            }
+            if (Date.now() >= deadline) throw new Error(`Timed out waiting for the Anvil auth file lock at ${lockPath}`);
+            await git_auth_delay(options.retryDelayMs);
+        }
+    }
+    async function withRepoAuthFileLock(repoPath, fn, options) {
+        const gitDir = await getRepositoryGitDir(repoPath);
+        const lockPath = `${getAuthFilePath(gitDir)}.lock`;
+        const lockOptions = {
+            ...AUTH_FILE_LOCK_DEFAULTS,
+            ...options
+        };
+        await external_fs_.promises.mkdir(external_path_default().dirname(lockPath), {
+            recursive: true
+        });
+        await acquireAuthFileLock(lockPath, lockOptions);
+        const heartbeat = startAuthFileLockHeartbeat(lockPath, lockOptions.heartbeatMs);
+        try {
+            return await fn();
+        } finally{
+            clearInterval(heartbeat);
+            await external_fs_.promises.rm(lockPath, {
+                force: true
+            });
+        }
+    }
+    function startAuthFileLockHeartbeat(lockPath, heartbeatMs) {
+        const heartbeat = setInterval(()=>{
+            const now = new Date();
+            external_fs_.promises.utimes(lockPath, now, now).catch(()=>{});
+        }, heartbeatMs);
+        heartbeat.unref();
+        return heartbeat;
+    }
     function decodeKey(b64key) {
         const key = Buffer.from(b64key, "base64");
         if (32 !== key.length) throw new Error("Encryption key must be a base64-encoded 32-byte key");
@@ -13864,10 +13948,19 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
             recursive: true
         });
         const authJson = JSON.stringify(auth, null, 2);
-        await external_fs_.promises.writeFile(authFilePath, encrypt(authJson, encryptionKey), {
-            mode: 384
-        });
-        await external_fs_.promises.chmod(authFilePath, 448);
+        const tempFilePath = `${authFilePath}.tmp-${external_node_crypto_default().randomBytes(6).toString("hex")}`;
+        try {
+            await external_fs_.promises.writeFile(tempFilePath, encrypt(authJson, encryptionKey), {
+                mode: 384
+            });
+            await external_fs_.promises.chmod(tempFilePath, 448);
+            await external_fs_.promises.rename(tempFilePath, authFilePath);
+        } catch (e) {
+            await external_fs_.promises.rm(tempFilePath, {
+                force: true
+            });
+            throw e;
+        }
         await git.raw([
             "config",
             "--local",
@@ -13876,7 +13969,7 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
         ]);
         return authFilePath;
     }
-    const readAuthFromRepo = async (repoPath)=>{
+    const git_auth_readAuthFromRepo = async (repoPath)=>{
         const git = esm_default(repoPath);
         const gitDir = await getRepositoryGitDir(repoPath, git);
         const authFilePath = getAuthFilePath(gitDir);
@@ -13889,12 +13982,13 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
         return resolveAnvilUrl();
     }
     const ANVIL_SYNC_CLIENT_ID = "anvil-sync";
+    const REFRESH_REQUEST_TIMEOUT_MS = 12000;
     let inMemoryAuth = null;
     function authMatches(auth, anvilUrl, username) {
         return auth.anvilUrl === normalizeAnvilUrl(anvilUrl) && (!username || auth.username === username);
     }
     let repoContext = null;
-    function setRepoContext(repoPath) {
+    function auth_setRepoContext(repoPath) {
         repoContext = repoPath;
     }
     const inFlightRefreshes = new Map();
@@ -13917,7 +14011,7 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
             throw errors_createAuthError.invalid(`Network error: ${e.message}`);
         }
     }
-    async function refreshAccessToken(refreshToken, anvilUrl = getDefaultAnvilUrl(), clientId = ANVIL_SYNC_CLIENT_ID) {
+    async function refreshAccessToken(refreshToken, anvilUrl = getDefaultAnvilUrl(), clientId = ANVIL_SYNC_CLIENT_ID, options) {
         try {
             const tokenResponse = await fetch(`${anvilUrl}/oauth/token`, {
                 method: "POST",
@@ -13928,11 +14022,12 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
                     grant_type: "refresh_token",
                     refresh_token: refreshToken,
                     client_id: clientId
-                })
+                }),
+                signal: AbortSignal.timeout(options?.timeoutMs ?? REFRESH_REQUEST_TIMEOUT_MS)
             });
             if (!tokenResponse.ok) {
                 const errorText = await tokenResponse.text();
-                throw errors_createAuthError.refreshFailed(`Failed to refresh token: ${tokenResponse.status} ${errorText}`);
+                throw errors_createAuthError.refreshFailed(`Failed to refresh token: ${tokenResponse.status} ${errorText}`, tokenResponse.status);
             }
             const tokenData = await tokenResponse.json();
             return tokenData;
@@ -13944,22 +14039,21 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
     async function hasTokensForUrl(anvilUrl, username) {
         if (inMemoryAuth) return authMatches(inMemoryAuth, anvilUrl, username);
         {
-            const repoAuth = repoContext ? await readAuthFromRepo(repoContext) : void 0;
+            const repoAuth = repoContext ? await git_auth_readAuthFromRepo(repoContext) : void 0;
             if (repoAuth && authMatches(repoAuth, anvilUrl, username)) return true;
             return hasTokens(anvilUrl, username);
         }
     }
-    async function auth_getValidAuthToken(anvilUrl = getDefaultAnvilUrl(), username) {
+    async function auth_getValidAuthToken(anvilUrl = getDefaultAnvilUrl(), username, options) {
         const normalized = normalizeAnvilUrl(anvilUrl);
         const source = await resolveTokenSource(normalized, username);
         const tokens = getSourceTokens(source);
         if (!tokens.authToken && !tokens.refreshToken) throw errors_createAuthError.required("Not logged in. Please log in first.");
-        const isExpired = null !== tokens.authTokenExpiresAt && tokens.authTokenExpiresAt <= Math.floor(Date.now() / 1000) + 60;
-        if (tokens.refreshToken && isExpired) {
+        if (tokens.refreshToken && isAccessTokenExpired(tokens)) {
             const refreshKey = getRefreshKey(normalized, username, source, tokens.refreshToken);
             const existingRefresh = inFlightRefreshes.get(refreshKey);
             if (existingRefresh) return existingRefresh;
-            const refreshPromise = refreshAndStoreAccessToken(normalized, username, source, tokens.refreshToken).finally(()=>{
+            const refreshPromise = refreshAndStoreAccessToken(normalized, username, source, tokens.refreshToken, options).finally(()=>{
                 inFlightRefreshes.delete(refreshKey);
             });
             inFlightRefreshes.set(refreshKey, refreshPromise);
@@ -13973,7 +14067,7 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
             type: "memory",
             auth: inMemoryAuth
         };
-        const repoAuth = repoContext ? await readAuthFromRepo(repoContext) : void 0;
+        const repoAuth = repoContext ? await git_auth_readAuthFromRepo(repoContext) : void 0;
         if (repoAuth && authMatches(repoAuth, normalizedUrl, username)) return {
             type: "repo",
             auth: repoAuth,
@@ -13989,6 +14083,9 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
     function getSourceTokens(source) {
         return "store" === source.type ? source.tokens : source.auth.tokens;
     }
+    function isAccessTokenExpired(tokens) {
+        return null !== tokens.authTokenExpiresAt && tokens.authTokenExpiresAt <= Math.floor(Date.now() / 1000) + 60;
+    }
     function getStoreAccountUsername(normalizedUrl, username, refreshToken) {
         if (username) return username;
         const urlTokens = getUrlTokens(normalizedUrl);
@@ -14007,11 +14104,43 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
                 return `store:${normalizedUrl}:${source.accountUsername ?? username ?? refreshToken}`;
         }
     }
-    async function refreshAndStoreAccessToken(normalizedUrl, username, source, refreshToken) {
+    async function refreshAndStoreAccessToken(normalizedUrl, username, source, refreshToken, options) {
+        if ("repo" === source.type) return refreshRepoAuthTokens(source.repoPath, {
+            anvilUrl: normalizedUrl,
+            username,
+            auth: source.auth,
+            refreshToken,
+            lock: options?.lock,
+            requestTimeoutMs: options?.requestTimeoutMs
+        });
+        return performTokenRefresh(normalizedUrl, username, source, refreshToken, options?.requestTimeoutMs);
+    }
+    async function refreshRepoAuthTokens(repoPath, options) {
+        const normalizedUrl = normalizeAnvilUrl(options.anvilUrl);
+        return withRepoAuthFileLock(repoPath, async ()=>{
+            let auth = options.auth;
+            let refreshToken = options.refreshToken;
+            const current = await git_auth_readAuthFromRepo(repoPath);
+            if (current && authMatches(current, normalizedUrl, options.username)) {
+                if (current.tokens.authToken && !isAccessTokenExpired(current.tokens)) return current.tokens.authToken;
+                auth = current;
+                refreshToken = current.tokens.refreshToken ?? refreshToken;
+            }
+            if (!auth || !refreshToken) throw errors_createAuthError.required("No repo auth tokens available to refresh.");
+            return performTokenRefresh(normalizedUrl, options.username, {
+                type: "repo",
+                auth,
+                repoPath
+            }, refreshToken, options.requestTimeoutMs);
+        }, options.lock);
+    }
+    async function performTokenRefresh(normalizedUrl, username, source, refreshToken, requestTimeoutMs) {
         try {
             const tokens = getSourceTokens(source);
             const clientId = tokens.clientId ?? ANVIL_SYNC_CLIENT_ID;
-            const tokenData = await refreshAccessToken(refreshToken, normalizedUrl, clientId);
+            const tokenData = await refreshAccessToken(refreshToken, normalizedUrl, clientId, {
+                timeoutMs: requestTimeoutMs
+            });
             const newTokens = {
                 authToken: tokenData.access_token,
                 refreshToken: tokenData.refresh_token,
@@ -14033,12 +14162,28 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
             }
             return tokenData.access_token;
         } catch (e) {
+            if ("repo" === source.type && isRefreshTokenRejection(e)) await clearRepoAuthTokens(source.repoPath, source.auth).catch(()=>{});
             await clearTokensForAccount(normalizedUrl, username, refreshToken);
             throw e;
         }
     }
+    function isRefreshTokenRejection(e) {
+        const error = e;
+        return error?.type === "token_refresh_failed" && (400 === error.status || 401 === error.status);
+    }
+    async function clearRepoAuthTokens(repoPath, auth) {
+        const encryptionKey = process.env["ANVIL_AUTH_FILE_ENCRYPTION_KEY"];
+        if (!encryptionKey) return;
+        auth.tokens = {
+            authToken: null,
+            refreshToken: null,
+            authTokenExpiresAt: null,
+            clientId: auth.tokens.clientId
+        };
+        await writeAuthToFile(repoPath, auth, encryptionKey);
+    }
     async function clearTokensForAccount(url, username, refreshToken) {
-        if (inMemoryAuth || repoContext && await readAuthFromRepo(repoContext)) return;
+        if (inMemoryAuth || repoContext && await git_auth_readAuthFromRepo(repoContext)) return;
         {
             const normalized = normalizeAnvilUrl(url);
             if (username) deleteAccountTokens(normalized, username);
@@ -14068,7 +14213,7 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
             loggedOut: false,
             message: "Cannot log out when using in-memory auth tokens"
         };
-        if (repoContext && await readAuthFromRepo(repoContext)) return {
+        if (repoContext && await git_auth_readAuthFromRepo(repoContext)) return {
             loggedOut: false,
             message: "Cannot log out when using auth tokens stored in the local git config."
         };
@@ -14099,7 +14244,7 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
             inMemoryAuth.username
         ] : [];
         {
-            const repoAuth = repoContext ? await readAuthFromRepo(repoContext) : void 0;
+            const repoAuth = repoContext ? await git_auth_readAuthFromRepo(repoContext) : void 0;
             if (repoAuth && authMatches(repoAuth, url)) return [
                 repoAuth.username
             ];
@@ -14111,7 +14256,7 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
             inMemoryAuth.anvilUrl
         ];
         {
-            const repoAuth = repoContext ? await readAuthFromRepo(repoContext) : void 0;
+            const repoAuth = repoContext ? await git_auth_readAuthFromRepo(repoContext) : void 0;
             if (repoAuth) return [
                 repoAuth.anvilUrl
             ];
@@ -21577,7 +21722,7 @@ print(json.dumps({"issues": issues}))
         ])).trim();
         const resolvedGitCommonDir = external_path_default().isAbsolute(rawGitCommonDir) ? rawGitCommonDir : external_path_default().resolve(inputPath, rawGitCommonDir);
         const gitCommonDir = external_fs_default().realpathSync(resolvedGitCommonDir);
-        setRepoContext(repoPath);
+        auth_setRepoContext(repoPath);
         const remotes = (await git.getRemotes(true)).map(detectAnvilRemote);
         const anvilRemotes = remotes.filter((remote)=>remote.appId && remote.anvilUrl && "https" === remote.transport);
         const findings = [];
@@ -21703,7 +21848,7 @@ print(json.dumps({"issues": issues}))
         const repoPath = options.repoPath ?? deps.cwd();
         if ("get" !== operation) return null;
         if (!request.protocol || !request.host) return null;
-        setRepoContext(repoPath);
+        auth_setRepoContext(repoPath);
         const appId = parseAppIdFromGitPath(request.path);
         if (!appId) return null;
         const requestUrl = normalizeAnvilUrl(`${request.protocol}://${request.host}`);
@@ -21785,7 +21930,7 @@ print(json.dumps({"issues": issues}))
     async function watch(repoPath, appId, options = {}) {
         const { anvilUrl = DEFAULT_ANVIL_URL, gitUrl = anvilUrl, stagedOnly = false, username } = options;
         repoPath = external_path_default().resolve(repoPath);
-        setRepoContext(repoPath);
+        auth_setRepoContext(repoPath);
         const storedEnvPid = options.environment?.envPid ? void 0 : await readEnvironmentPid(repoPath);
         const environment = options.environment ?? (storedEnvPid ? {
             envPid: storedEnvPid
@@ -22573,7 +22718,7 @@ print(json.dumps({"issues": issues}))
             process.exit(1);
         }
         const { path: repoPath = process.cwd(), appid: explicitAppId, useFirst = false, stagedOnly = false, dependencyWatch = true, autoMode = false, url: explicitUrl, user: explicitUsername, open: openAfterValidation = false } = options;
-        setRepoContext(repoPath);
+        auth_setRepoContext(repoPath);
         try {
             const validationResult = await validateAnvilApp(repoPath);
             if (validationResult.appName) logger_logger.info(external_chalk_default().green("Anvil app: ") + external_chalk_default().bold(validationResult.appName));
@@ -22780,6 +22925,7 @@ print(json.dumps({"issues": issues}))
                 logger_logger.success("Logged in as " + external_chalk_default().bold(result.email));
             } catch (e) {
                 logger_logger.error("Error: " + e.message);
+                logErrorCause(e, logger_logger);
                 process.exit(1);
             }
         });
@@ -23358,6 +23504,7 @@ print(json.dumps({"issues": issues}))
                 await runConfigureFlow(version, configure_defaultDeps);
             } catch (e) {
                 logger_logger.error("Error: " + errors_getErrorMessage(e));
+                logErrorCause(e, logger_logger);
                 process.exit(1);
             }
         });

package/dist/commands/configure.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"configure.d.ts","sourceRoot":"","sources":["../../src/commands/configure.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAYpC,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAKnC,MAAM,WAAW,sBAAsB;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9B;AAcD,eAAO,MAAM,+BAA+B,6BAA6B,CAAC;AAC1E,eAAO,MAAM,oBAAoB,8BAA8B,CAAC;AAShE,wBAAsB,wBAAwB,CAC1C,aAAa,EAAE,MAAM,EACrB,gBAAgB,EAAE,SAAS,MAAM,EAAE,EACnC,EAAE,EAAE,IAAI,CAAC,OAAO,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC,GAC3E,OAAO,CAAC,MAAM,CAAC,CAkEjB;AAED,wBAAsB,yBAAyB,CAC3C,cAAc,EAAE,MAAM,EACtB,mBAAmB,GAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAoB,GACrE,OAAO,CAAC,sBAAsB,CAAC,CAuBjC;AAoGD,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAYhF"}
+{"version":3,"file":"configure.d.ts","sourceRoot":"","sources":["../../src/commands/configure.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAYpC,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAKnC,MAAM,WAAW,sBAAsB;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9B;AAcD,eAAO,MAAM,+BAA+B,6BAA6B,CAAC;AAC1E,eAAO,MAAM,oBAAoB,8BAA8B,CAAC;AAShE,wBAAsB,wBAAwB,CAC1C,aAAa,EAAE,MAAM,EACrB,gBAAgB,EAAE,SAAS,MAAM,EAAE,EACnC,EAAE,EAAE,IAAI,CAAC,OAAO,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC,GAC3E,OAAO,CAAC,MAAM,CAAC,CAkEjB;AAED,wBAAsB,yBAAyB,CAC3C,cAAc,EAAE,MAAM,EACtB,mBAAmB,GAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAoB,GACrE,OAAO,CAAC,sBAAsB,CAAC,CAuBjC;AAoGD,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAahF"}

package/dist/commands/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAsC3D"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAuC3D"}

package/dist/commands/modelToken.d.ts

@@ -0,0 +1,33 @@
+import { getValidAuthToken } from "../services/auth";
+import { readAuthFromRepo } from "../services/git-auth";
+export interface ModelTokenDeps {
+    getValidAuthToken: typeof getValidAuthToken;
+    readAuthFromRepo: typeof readAuthFromRepo;
+    cwd: () => string;
+}
+export interface ModelTokenOptions {
+    deps?: ModelTokenDeps;
+    repoPath?: string;
+    /** How long to wait for the cross-process auth file lock; defaults to MODEL_TOKEN_LOCK_TIMEOUT_MS. */
+    lockTimeoutMs?: number;
+}
+/**
+ * Codex waits a bounded time for a command-based auth provider (the agent-host
+ * configures timeout_ms = 30000), so the helper must give up on the auth file
+ * lock well before then and fail loudly rather than be killed mid-wait.
+ */
+export declare const MODEL_TOKEN_LOCK_TIMEOUT_MS = 12000;
+/**
+ * Resolve a valid access token for the repo-local auth session. Refreshes a
+ * stale access token (persisting the rotated refresh token) under the
+ * cross-process auth file lock.
+ */
+export declare function getModelToken(options?: ModelTokenOptions): Promise<string>;
+/**
+ * Model-token helper entry point, invoked by the generated
+ * anvil-model-token-helper.cjs script: print a valid access token (and nothing
+ * else) to stdout. Any failure propagates so the helper script can exit
+ * non-zero with a message on stderr.
+ */
+export declare function executeModelTokenOperation(options?: ModelTokenOptions): Promise<void>;
+//# sourceMappingURL=modelToken.d.ts.map

package/dist/commands/modelToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"modelToken.d.ts","sourceRoot":"","sources":["../../src/commands/modelToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAkB,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,MAAM,WAAW,cAAc;IAC3B,iBAAiB,EAAE,OAAO,iBAAiB,CAAC;IAC5C,gBAAgB,EAAE,OAAO,gBAAgB,CAAC;IAC1C,GAAG,EAAE,MAAM,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAC9B,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sGAAsG;IACtG,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;GAIG;AAIH,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAQlD;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBpF;AAED;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAAC,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAG/F"}

package/dist/errors.d.ts

@@ -2,6 +2,7 @@
  * Typed error definitions for anvil-cli.
  * Uses discriminated unions for type-safe error handling.
  */
+import type { Logger } from "./logger";
 export type AuthError = {
     type: "auth_required";
     message?: string;
@@ -14,6 +15,7 @@ export type AuthError = {
 } | {
     type: "token_refresh_failed";
     message?: string;
+    status?: number;
 };
 export type AppError = {
     type: "app_not_found";
@@ -102,7 +104,7 @@ export declare const createAuthError: {
     required: (message?: string) => AuthError;
     expired: (message?: string) => AuthError;
     invalid: (message?: string) => AuthError;
-    refreshFailed: (message?: string) => AuthError;
+    refreshFailed: (message?: string, status?: number) => AuthError;
 };
 export declare const createAppError: {
     notFound: (appId: string) => AppError;
@@ -148,4 +150,12 @@ export declare function isNetworkError(error: AnvilError): error is NetworkError
 export declare function isValidationError(error: AnvilError): error is ValidationError;
 export declare function isSaveError(error: AnvilError): error is SaveError;
 export declare function getErrorMessage(error: unknown): string;
+/**
+ * Return the immediate underlying cause of an error in a form suitable for
+ * verbose CLI output. Native fetch errors use `cause` for the useful network
+ * or TLS failure while exposing only "fetch failed" as their main message.
+ */
+export declare function getErrorCauseMessage(error: unknown): string | null;
+/** Log useful nested error details without adding noise to normal CLI output. */
+export declare function logErrorCause(error: unknown, ui: Pick<Logger, "verbose">): void;
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,MAAM,MAAM,SAAS,GACf;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAGzD,MAAM,MAAM,QAAQ,GACd;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAG9D,MAAM,MAAM,SAAS,GACf;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,GACzB;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAGvD,MAAM,MAAM,QAAQ,GACd;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAGpD,MAAM,MAAM,YAAY,GAClB;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAG7C,MAAM,MAAM,eAAe,GACrB;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAG9D,MAAM,MAAM,SAAS,GACf;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GACtE;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GACzE;IAAE,IAAI,EAAE,kBAAkB,CAAA;CAAE,GAC5B;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAGxD,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,YAAY,GAAG,eAAe,GAAG,SAAS,CAAC;AAGlH,eAAO,MAAM,eAAe;yBACH,MAAM,KAAG,SAAS;wBACnB,MAAM,KAAG,SAAS;wBAClB,MAAM,KAAG,SAAS;8BACZ,MAAM,KAAG,SAAS;CAC/C,CAAC;AAEF,eAAO,MAAM,cAAc;sBACL,MAAM,KAAG,QAAQ;0BACb,MAAM,KAAG,QAAQ;qBACtB,MAAM,WAAW,MAAM,KAAG,QAAQ;CACtD,CAAC;AAEF,eAAO,MAAM,eAAe;6BACC,MAAM,KAAG,SAAS;6BAClB,MAAM,SAAS,MAAM,KAAG,SAAS;2BACnC,MAAM,KAAG,SAAS;yBACpB,MAAM,KAAG,SAAS;uBACpB,MAAM,SAAS,MAAM,KAAG,SAAS;wBAClC,SAAS;gCACC,MAAM,EAAE,KAAG,SAAS;CACnD,CAAC;AAEF,eAAO,MAAM,cAAc;2BACA,MAAM,KAAG,QAAQ;6BACf,MAAM,WAAW,MAAM,KAAG,QAAQ;2BACpC,MAAM,KAAG,QAAQ;CAC3C,CAAC;AAEF,eAAO,MAAM,kBAAkB;uBACR,MAAM,KAAG,YAAY;qBACvB,MAAM,WAAW,MAAM,KAAG,YAAY;yBAClC,MAAM,KAAG,YAAY;CAC7C,CAAC;AAEF,eAAO,MAAM,qBAAqB;uBACX,MAAM,WAAW,MAAM,KAAG,eAAe;wBACxC,MAAM,KAAG,eAAe;wBACxB,MAAM,WAAW,MAAM,KAAG,eAAe;CAChE,CAAC;AAEF,eAAO,MAAM,eAAe;+BACG,MAAM,cAAc,OAAO,KAAG,SAAS;+BAKvC,MAAM,iBAAiB,MAAM,KAAG,SAAS;0BAKhD,SAAS;kCACC,MAAM,KAAG,SAAS;CACnD,CAAC;AAsBF,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAMhE;AAGD,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,KAAK,IAAI,SAAS,CAEjE;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,KAAK,IAAI,QAAQ,CAE/D;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,KAAK,IAAI,SAAS,CAUjE;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,KAAK,IAAI,QAAQ,CAE/D;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,KAAK,IAAI,YAAY,CAEvE;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,UAAU,GAAG,KAAK,IAAI,eAAe,CAE7E;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,KAAK,IAAI,SAAS,CAEjE;AAGD,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAyFtD"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAGvC,MAAM,MAAM,SAAS,GACf;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAG1E,MAAM,MAAM,QAAQ,GACd;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAG9D,MAAM,MAAM,SAAS,GACf;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,GACzB;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAGvD,MAAM,MAAM,QAAQ,GACd;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAGpD,MAAM,MAAM,YAAY,GAClB;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAG7C,MAAM,MAAM,eAAe,GACrB;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAG9D,MAAM,MAAM,SAAS,GACf;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GACtE;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GACzE;IAAE,IAAI,EAAE,kBAAkB,CAAA;CAAE,GAC5B;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAGxD,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,YAAY,GAAG,eAAe,GAAG,SAAS,CAAC;AAGlH,eAAO,MAAM,eAAe;yBACH,MAAM,KAAG,SAAS;wBACnB,MAAM,KAAG,SAAS;wBAClB,MAAM,KAAG,SAAS;8BACZ,MAAM,WAAW,MAAM,KAAG,SAAS;CAChE,CAAC;AAEF,eAAO,MAAM,cAAc;sBACL,MAAM,KAAG,QAAQ;0BACb,MAAM,KAAG,QAAQ;qBACtB,MAAM,WAAW,MAAM,KAAG,QAAQ;CACtD,CAAC;AAEF,eAAO,MAAM,eAAe;6BACC,MAAM,KAAG,SAAS;6BAClB,MAAM,SAAS,MAAM,KAAG,SAAS;2BACnC,MAAM,KAAG,SAAS;yBACpB,MAAM,KAAG,SAAS;uBACpB,MAAM,SAAS,MAAM,KAAG,SAAS;wBAClC,SAAS;gCACC,MAAM,EAAE,KAAG,SAAS;CACnD,CAAC;AAEF,eAAO,MAAM,cAAc;2BACA,MAAM,KAAG,QAAQ;6BACf,MAAM,WAAW,MAAM,KAAG,QAAQ;2BACpC,MAAM,KAAG,QAAQ;CAC3C,CAAC;AAEF,eAAO,MAAM,kBAAkB;uBACR,MAAM,KAAG,YAAY;qBACvB,MAAM,WAAW,MAAM,KAAG,YAAY;yBAClC,MAAM,KAAG,YAAY;CAC7C,CAAC;AAEF,eAAO,MAAM,qBAAqB;uBACX,MAAM,WAAW,MAAM,KAAG,eAAe;wBACxC,MAAM,KAAG,eAAe;wBACxB,MAAM,WAAW,MAAM,KAAG,eAAe;CAChE,CAAC;AAEF,eAAO,MAAM,eAAe;+BACG,MAAM,cAAc,OAAO,KAAG,SAAS;+BAKvC,MAAM,iBAAiB,MAAM,KAAG,SAAS;0BAKhD,SAAS;kCACC,MAAM,KAAG,SAAS;CACnD,CAAC;AAsBF,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAMhE;AAGD,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,KAAK,IAAI,SAAS,CAEjE;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,KAAK,IAAI,QAAQ,CAE/D;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,KAAK,IAAI,SAAS,CAUjE;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,KAAK,IAAI,QAAQ,CAE/D;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,KAAK,IAAI,YAAY,CAEvE;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,UAAU,GAAG,KAAK,IAAI,eAAe,CAE7E;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,KAAK,IAAI,SAAS,CAEjE;AAGD,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAyFtD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAoBlE;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,IAAI,CAK/E"}

package/dist/index.js

@@ -7376,22 +7376,25 @@ var __webpack_exports__ = {};
         validateCheckoutDestination: ()=>validateCheckoutDestination,
         DeviceAuthorizationResponse: ()=>oauth_login_namespaceObject.DeviceAuthorizationResponse,
         OAuthTokenResponse: ()=>oauth_login_namespaceObject.OAuthTokenResponse,
+        REFRESH_REQUEST_TIMEOUT_MS: ()=>REFRESH_REQUEST_TIMEOUT_MS,
         WatchSession: ()=>WatchSession_WatchSession,
         parseConfigSetValue: ()=>parseConfigSetValue,
-        requestDeviceAuthorization: ()=>requestDeviceAuthorization,
         getGitPushUrl: ()=>anvil_api_getGitPushUrl,
+        requestDeviceAuthorization: ()=>requestDeviceAuthorization,
         requireEnvironmentBranch: ()=>requireEnvironmentBranch,
         setAuthTokensForAccount: ()=>setAccountTokens,
-        validateAnvilApp: ()=>validation_validateAnvilApp,
         ValidateAppIdResponse: ()=>anvil_api_namespaceObject.ValidateAppIdResponse,
-        verifyAndStoreTokens: ()=>auth_verifyAndStoreTokens,
+        getModelToken: ()=>getModelToken,
         formatValidationPath: ()=>formatValidationPath,
         resolveAnvilUrl: ()=>resolveAnvilUrl,
         createCheckoutPickerSource: ()=>createCheckoutPickerSource,
         buildGitAuthDoctorReport: ()=>buildGitAuthDoctorReport,
         parseCheckoutInput: ()=>parseCheckoutInput,
         formatGitAuthDoctorReport: ()=>formatGitAuthDoctorReport,
+        validateAnvilApp: ()=>validation_validateAnvilApp,
         resetConfig: ()=>resetConfig,
+        MODEL_TOKEN_HELPER_FILENAME: ()=>MODEL_TOKEN_HELPER_FILENAME,
+        verifyAndStoreTokens: ()=>auth_verifyAndStoreTokens,
         FormTemplateValidationResult: ()=>validators_namespaceObject.FormTemplateValidationResult,
         createWatchDiagnostic: ()=>createWatchDiagnostic,
         ValidationTarget: ()=>validators_namespaceObject.ValidationTarget,
@@ -7406,8 +7409,10 @@ var __webpack_exports__ = {};
         CheckoutExecutionDeps: ()=>checkout_namespaceObject.CheckoutExecutionDeps,
         validateFormTemplateHtml: ()=>validateFormTemplateHtml,
         ValidateBranchSyncStatusOptions: ()=>validation_namespaceObject.ValidateBranchSyncStatusOptions,
+        withRepoAuthFileLock: ()=>withRepoAuthFileLock,
         BranchSyncStatus: ()=>validation_namespaceObject.BranchSyncStatus,
         getLatestVersion: ()=>getLatestVersion,
+        getModelTokenHelperScript: ()=>getModelTokenHelperScript,
         isDirectoryNonEmpty: ()=>isDirectoryNonEmpty,
         syncToLatest: ()=>src_api_syncToLatest,
         filterCandidates: ()=>anvil_api_filterCandidates,
@@ -7434,6 +7439,7 @@ var __webpack_exports__ = {};
         logout: ()=>logout,
         TokenData: ()=>auth_namespaceObject.TokenData,
         detectAppIdsFromAllRemotes: ()=>anvil_api_detectAppIdsFromAllRemotes,
+        executeModelTokenOperation: ()=>executeModelTokenOperation,
         getWebSocketUrl: ()=>getWebSocketUrl,
         getAllConfig: ()=>getAllConfig,
         isCommandAvailable: ()=>config_isCommandAvailable,
@@ -7443,6 +7449,7 @@ var __webpack_exports__ = {};
         getValidAuthToken: ()=>auth_getValidAuthToken,
         watch: ()=>src_api_watch,
         deleteConfig: ()=>deleteConfig,
+        installModelTokenHelperScript: ()=>installModelTokenHelperScript,
         getGitFetchUrl: ()=>anvil_api_getGitFetchUrl,
         PreferredEditor: ()=>config_namespaceObject.PreferredEditor,
         getAvailableAnvilUrls: ()=>getAvailableAnvilUrls,
@@ -7455,8 +7462,11 @@ var __webpack_exports__ = {};
         CheckoutResult: ()=>checkout_namespaceObject.CheckoutResult,
         ParsedCheckoutInput: ()=>checkout_namespaceObject.ParsedCheckoutInput,
         parseCredentialHelperCommand: ()=>parseCredentialHelperCommand,
+        MODEL_TOKEN_LOCK_TIMEOUT_MS: ()=>MODEL_TOKEN_LOCK_TIMEOUT_MS,
+        GetValidAuthTokenOptions: ()=>auth_namespaceObject.GetValidAuthTokenOptions,
         clearInMemoryTokens: ()=>clearInMemoryTokens,
         getDefaultDestinationDirectory: ()=>getDefaultDestinationDirectory,
+        AUTH_FILE_LOCK_DEFAULTS: ()=>AUTH_FILE_LOCK_DEFAULTS,
         lookupByCommit: ()=>lookupByCommit,
         AppIdCandidate: ()=>anvil_api_namespaceObject.AppIdCandidate,
         verifyAuth: ()=>auth_verifyAuth
@@ -7485,6 +7495,7 @@ var __webpack_exports__ = {};
     __webpack_require__.r(auth_namespaceObject);
     __webpack_require__.d(auth_namespaceObject, {
         fg: ()=>ANVIL_SYNC_CLIENT_ID,
+        ru: ()=>REFRESH_REQUEST_TIMEOUT_MS,
         Ou: ()=>clearInMemoryTokens,
         Fr: ()=>auth_getAccountsForUrl,
         u5: ()=>getAvailableAnvilUrls,
@@ -13365,9 +13376,10 @@ var __webpack_exports__ = {};
                 type: "auth_invalid",
                 message
             }),
-        refreshFailed: (message)=>({
+        refreshFailed: (message, status)=>({
                 type: "token_refresh_failed",
-                message
+                message,
+                status
             })
     };
     const createAppError = {
@@ -13584,6 +13596,7 @@ var __webpack_exports__ = {};
     const external_module_namespaceObject = require("module");
     const requireFromHere = (0, external_module_namespaceObject.createRequire)(__filename);
     const GIT_CREDENTIAL_HELPER_FILENAME = "anvil-credential-helper.cjs";
+    const MODEL_TOKEN_HELPER_FILENAME = "anvil-model-token-helper.cjs";
     const GIT_CREDENTIAL_HELPER_LOCATOR = `$(git rev-parse --git-common-dir)/${GIT_CREDENTIAL_HELPER_FILENAME}`;
     function getUrlConfigKey(appId) {
         return `anvil.auth.${appId}.url`;
@@ -13674,6 +13687,38 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
 });
 `;
     }
+    function getModelTokenHelperScript(modulePath) {
+        return `#!/usr/bin/env node
+"use strict";
+
+const { execFileSync } = require("child_process");
+const { executeModelTokenOperation } = require(${JSON.stringify(modulePath)});
+
+function resolveRepoPath() {
+    return execFileSync("git", ["rev-parse", "--show-toplevel"], {
+        cwd: process.cwd(),
+        encoding: "utf8",
+    }).trim();
+}
+
+Promise.resolve()
+    .then(() => executeModelTokenOperation({ repoPath: resolveRepoPath() }))
+    .catch((e) => {
+        process.stderr.write("anvil model token helper failed: " + ((e && e.message) || e) + "\\n");
+        process.exit(1);
+    });
+`;
+    }
+    async function installModelTokenHelperScript(helperPath, options) {
+        await external_fs_.promises.mkdir(external_path_default().dirname(helperPath), {
+            recursive: true
+        });
+        await external_fs_.promises.writeFile(helperPath, getModelTokenHelperScript(options?.modulePath ?? getCredentialHelperModulePath()), {
+            mode: 448
+        });
+        await external_fs_.promises.chmod(helperPath, 448);
+        return helperPath;
+    }
     function findPackageRoot(startPath) {
         let dir = external_fs_default().existsSync(startPath) && external_fs_default().statSync(startPath).isDirectory() ? startPath : external_path_default().dirname(startPath);
         while(true){
@@ -13801,6 +13846,76 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
     function getAuthFilePath(gitDir) {
         return external_path_default().join(gitDir, "anvil-auth.json");
     }
+    const AUTH_FILE_LOCK_DEFAULTS = {
+        staleMs: 30000,
+        timeoutMs: 60000,
+        retryDelayMs: 100,
+        heartbeatMs: 5000
+    };
+    function git_auth_delay(ms) {
+        return new Promise((resolve)=>setTimeout(resolve, ms));
+    }
+    async function acquireAuthFileLock(lockPath, options) {
+        const deadline = Date.now() + options.timeoutMs;
+        while(true){
+            try {
+                const handle = await external_fs_.promises.open(lockPath, "wx", 384);
+                try {
+                    await handle.writeFile(JSON.stringify({
+                        pid: process.pid,
+                        acquiredAt: new Date().toISOString()
+                    }));
+                } finally{
+                    await handle.close();
+                }
+                return;
+            } catch (e) {
+                if ("EEXIST" !== e.code) throw e;
+            }
+            try {
+                const lockStat = await external_fs_.promises.stat(lockPath);
+                if (Date.now() - lockStat.mtimeMs > options.staleMs) {
+                    await external_fs_.promises.rm(lockPath, {
+                        force: true
+                    });
+                    continue;
+                }
+            } catch  {
+                continue;
+            }
+            if (Date.now() >= deadline) throw new Error(`Timed out waiting for the Anvil auth file lock at ${lockPath}`);
+            await git_auth_delay(options.retryDelayMs);
+        }
+    }
+    async function withRepoAuthFileLock(repoPath, fn, options) {
+        const gitDir = await getRepositoryGitDir(repoPath);
+        const lockPath = `${getAuthFilePath(gitDir)}.lock`;
+        const lockOptions = {
+            ...AUTH_FILE_LOCK_DEFAULTS,
+            ...options
+        };
+        await external_fs_.promises.mkdir(external_path_default().dirname(lockPath), {
+            recursive: true
+        });
+        await acquireAuthFileLock(lockPath, lockOptions);
+        const heartbeat = startAuthFileLockHeartbeat(lockPath, lockOptions.heartbeatMs);
+        try {
+            return await fn();
+        } finally{
+            clearInterval(heartbeat);
+            await external_fs_.promises.rm(lockPath, {
+                force: true
+            });
+        }
+    }
+    function startAuthFileLockHeartbeat(lockPath, heartbeatMs) {
+        const heartbeat = setInterval(()=>{
+            const now = new Date();
+            external_fs_.promises.utimes(lockPath, now, now).catch(()=>{});
+        }, heartbeatMs);
+        heartbeat.unref();
+        return heartbeat;
+    }
     function decodeKey(b64key) {
         const key = Buffer.from(b64key, "base64");
         if (32 !== key.length) throw new Error("Encryption key must be a base64-encoded 32-byte key");
@@ -13845,10 +13960,19 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
             recursive: true
         });
         const authJson = JSON.stringify(auth, null, 2);
-        await external_fs_.promises.writeFile(authFilePath, encrypt(authJson, encryptionKey), {
-            mode: 384
-        });
-        await external_fs_.promises.chmod(authFilePath, 448);
+        const tempFilePath = `${authFilePath}.tmp-${external_node_crypto_default().randomBytes(6).toString("hex")}`;
+        try {
+            await external_fs_.promises.writeFile(tempFilePath, encrypt(authJson, encryptionKey), {
+                mode: 384
+            });
+            await external_fs_.promises.chmod(tempFilePath, 448);
+            await external_fs_.promises.rename(tempFilePath, authFilePath);
+        } catch (e) {
+            await external_fs_.promises.rm(tempFilePath, {
+                force: true
+            });
+            throw e;
+        }
         await git.raw([
             "config",
             "--local",
@@ -13870,6 +13994,7 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
         return resolveAnvilUrl();
     }
     const ANVIL_SYNC_CLIENT_ID = "anvil-sync";
+    const REFRESH_REQUEST_TIMEOUT_MS = 12000;
     let inMemoryAuth = null;
     function setInMemoryTokens(anvilUrl, username, tokens) {
         inMemoryAuth = {
@@ -13908,7 +14033,7 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
             throw createAuthError.invalid(`Network error: ${e.message}`);
         }
     }
-    async function refreshAccessToken(refreshToken, anvilUrl = getDefaultAnvilUrl(), clientId = ANVIL_SYNC_CLIENT_ID) {
+    async function refreshAccessToken(refreshToken, anvilUrl = getDefaultAnvilUrl(), clientId = ANVIL_SYNC_CLIENT_ID, options) {
         try {
             const tokenResponse = await fetch(`${anvilUrl}/oauth/token`, {
                 method: "POST",
@@ -13919,11 +14044,12 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
                     grant_type: "refresh_token",
                     refresh_token: refreshToken,
                     client_id: clientId
-                })
+                }),
+                signal: AbortSignal.timeout(options?.timeoutMs ?? REFRESH_REQUEST_TIMEOUT_MS)
             });
             if (!tokenResponse.ok) {
                 const errorText = await tokenResponse.text();
-                throw createAuthError.refreshFailed(`Failed to refresh token: ${tokenResponse.status} ${errorText}`);
+                throw createAuthError.refreshFailed(`Failed to refresh token: ${tokenResponse.status} ${errorText}`, tokenResponse.status);
             }
             const tokenData = await tokenResponse.json();
             return tokenData;
@@ -13940,17 +14066,16 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
             return hasTokens(anvilUrl, username);
         }
     }
-    async function auth_getValidAuthToken(anvilUrl = getDefaultAnvilUrl(), username) {
+    async function auth_getValidAuthToken(anvilUrl = getDefaultAnvilUrl(), username, options) {
         const normalized = config_normalizeAnvilUrl(anvilUrl);
         const source = await resolveTokenSource(normalized, username);
         const tokens = getSourceTokens(source);
         if (!tokens.authToken && !tokens.refreshToken) throw createAuthError.required("Not logged in. Please log in first.");
-        const isExpired = null !== tokens.authTokenExpiresAt && tokens.authTokenExpiresAt <= Math.floor(Date.now() / 1000) + 60;
-        if (tokens.refreshToken && isExpired) {
+        if (tokens.refreshToken && isAccessTokenExpired(tokens)) {
             const refreshKey = getRefreshKey(normalized, username, source, tokens.refreshToken);
             const existingRefresh = inFlightRefreshes.get(refreshKey);
             if (existingRefresh) return existingRefresh;
-            const refreshPromise = refreshAndStoreAccessToken(normalized, username, source, tokens.refreshToken).finally(()=>{
+            const refreshPromise = refreshAndStoreAccessToken(normalized, username, source, tokens.refreshToken, options).finally(()=>{
                 inFlightRefreshes.delete(refreshKey);
             });
             inFlightRefreshes.set(refreshKey, refreshPromise);
@@ -13980,6 +14105,9 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
     function getSourceTokens(source) {
         return "store" === source.type ? source.tokens : source.auth.tokens;
     }
+    function isAccessTokenExpired(tokens) {
+        return null !== tokens.authTokenExpiresAt && tokens.authTokenExpiresAt <= Math.floor(Date.now() / 1000) + 60;
+    }
     function getStoreAccountUsername(normalizedUrl, username, refreshToken) {
         if (username) return username;
         const urlTokens = getUrlTokens(normalizedUrl);
@@ -13998,11 +14126,43 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
                 return `store:${normalizedUrl}:${source.accountUsername ?? username ?? refreshToken}`;
         }
     }
-    async function refreshAndStoreAccessToken(normalizedUrl, username, source, refreshToken) {
+    async function refreshAndStoreAccessToken(normalizedUrl, username, source, refreshToken, options) {
+        if ("repo" === source.type) return refreshRepoAuthTokens(source.repoPath, {
+            anvilUrl: normalizedUrl,
+            username,
+            auth: source.auth,
+            refreshToken,
+            lock: options?.lock,
+            requestTimeoutMs: options?.requestTimeoutMs
+        });
+        return performTokenRefresh(normalizedUrl, username, source, refreshToken, options?.requestTimeoutMs);
+    }
+    async function refreshRepoAuthTokens(repoPath, options) {
+        const normalizedUrl = config_normalizeAnvilUrl(options.anvilUrl);
+        return withRepoAuthFileLock(repoPath, async ()=>{
+            let auth = options.auth;
+            let refreshToken = options.refreshToken;
+            const current = await readAuthFromRepo(repoPath);
+            if (current && authMatches(current, normalizedUrl, options.username)) {
+                if (current.tokens.authToken && !isAccessTokenExpired(current.tokens)) return current.tokens.authToken;
+                auth = current;
+                refreshToken = current.tokens.refreshToken ?? refreshToken;
+            }
+            if (!auth || !refreshToken) throw createAuthError.required("No repo auth tokens available to refresh.");
+            return performTokenRefresh(normalizedUrl, options.username, {
+                type: "repo",
+                auth,
+                repoPath
+            }, refreshToken, options.requestTimeoutMs);
+        }, options.lock);
+    }
+    async function performTokenRefresh(normalizedUrl, username, source, refreshToken, requestTimeoutMs) {
         try {
             const tokens = getSourceTokens(source);
             const clientId = tokens.clientId ?? ANVIL_SYNC_CLIENT_ID;
-            const tokenData = await refreshAccessToken(refreshToken, normalizedUrl, clientId);
+            const tokenData = await refreshAccessToken(refreshToken, normalizedUrl, clientId, {
+                timeoutMs: requestTimeoutMs
+            });
             const newTokens = {
                 authToken: tokenData.access_token,
                 refreshToken: tokenData.refresh_token,
@@ -14024,10 +14184,26 @@ Promise.resolve(executeGitCredentialOperation(process.argv[2] || "get", {
             }
             return tokenData.access_token;
         } catch (e) {
+            if ("repo" === source.type && isRefreshTokenRejection(e)) await clearRepoAuthTokens(source.repoPath, source.auth).catch(()=>{});
             await clearTokensForAccount(normalizedUrl, username, refreshToken);
             throw e;
         }
     }
+    function isRefreshTokenRejection(e) {
+        const error = e;
+        return error?.type === "token_refresh_failed" && (400 === error.status || 401 === error.status);
+    }
+    async function clearRepoAuthTokens(repoPath, auth) {
+        const encryptionKey = process.env["ANVIL_AUTH_FILE_ENCRYPTION_KEY"];
+        if (!encryptionKey) return;
+        auth.tokens = {
+            authToken: null,
+            refreshToken: null,
+            authTokenExpiresAt: null,
+            clientId: auth.tokens.clientId
+        };
+        await writeAuthToFile(repoPath, auth, encryptionKey);
+    }
     async function clearTokensForAccount(url, username, refreshToken) {
         if (inMemoryAuth || repoContext && await readAuthFromRepo(repoContext)) return;
         {
@@ -20537,6 +20713,29 @@ print(json.dumps({"issues": issues}))
         const response = await buildGitCredentialResponse(operation, request, options);
         writeGitCredentialResponse(response);
     }
+    const MODEL_TOKEN_LOCK_TIMEOUT_MS = 12000;
+    const modelToken_defaultDeps = {
+        getValidAuthToken: auth_getValidAuthToken,
+        readAuthFromRepo: readAuthFromRepo,
+        cwd: ()=>process.cwd()
+    };
+    async function getModelToken(options = {}) {
+        const deps = options.deps ?? modelToken_defaultDeps;
+        const repoPath = options.repoPath ?? deps.cwd();
+        auth_setRepoContext(repoPath);
+        if (!process.env["ANVIL_AUTH_FILE_ENCRYPTION_KEY"]) throw new Error("ANVIL_AUTH_FILE_ENCRYPTION_KEY is not set; cannot read repo auth tokens.");
+        const auth = await deps.readAuthFromRepo(repoPath);
+        if (!auth) throw new Error(`No Anvil auth tokens found for the repository at ${repoPath}.`);
+        return deps.getValidAuthToken(auth.anvilUrl, auth.username, {
+            lock: {
+                timeoutMs: options.lockTimeoutMs ?? MODEL_TOKEN_LOCK_TIMEOUT_MS
+            }
+        });
+    }
+    async function executeModelTokenOperation(options = {}) {
+        const token = await getModelToken(options);
+        process.stdout.write(`${token}\n`);
+    }
     resolveAnvilUrl();
     async function watch_decideFallbackUrl(explicitUrl, availableUrls) {
         if (explicitUrl) return {
@@ -20914,6 +21113,7 @@ print(json.dumps({"issues": issues}))
     }
 })();
 exports.ANVIL_SYNC_CLIENT_ID = __webpack_exports__.ANVIL_SYNC_CLIENT_ID;
+exports.AUTH_FILE_LOCK_DEFAULTS = __webpack_exports__.AUTH_FILE_LOCK_DEFAULTS;
 exports.AnvilYamlValidationResult = __webpack_exports__.AnvilYamlValidationResult;
 exports.AppIdCandidate = __webpack_exports__.AppIdCandidate;
 exports.AppIdWithContext = __webpack_exports__.AppIdWithContext;
@@ -20925,11 +21125,15 @@ exports.CheckoutOptions = __webpack_exports__.CheckoutOptions;
 exports.CheckoutResult = __webpack_exports__.CheckoutResult;
 exports.DeviceAuthorizationResponse = __webpack_exports__.DeviceAuthorizationResponse;
 exports.FormTemplateValidationResult = __webpack_exports__.FormTemplateValidationResult;
+exports.GetValidAuthTokenOptions = __webpack_exports__.GetValidAuthTokenOptions;
 exports.LoginResult = __webpack_exports__.LoginResult;
 exports.LogoutResult = __webpack_exports__.LogoutResult;
+exports.MODEL_TOKEN_HELPER_FILENAME = __webpack_exports__.MODEL_TOKEN_HELPER_FILENAME;
+exports.MODEL_TOKEN_LOCK_TIMEOUT_MS = __webpack_exports__.MODEL_TOKEN_LOCK_TIMEOUT_MS;
 exports.OAuthTokenResponse = __webpack_exports__.OAuthTokenResponse;
 exports.ParsedCheckoutInput = __webpack_exports__.ParsedCheckoutInput;
 exports.PreferredEditor = __webpack_exports__.PreferredEditor;
+exports.REFRESH_REQUEST_TIMEOUT_MS = __webpack_exports__.REFRESH_REQUEST_TIMEOUT_MS;
 exports.SettableConfigKey = __webpack_exports__.SettableConfigKey;
 exports.TokenData = __webpack_exports__.TokenData;
 exports.ValidateAppIdResponse = __webpack_exports__.ValidateAppIdResponse;
@@ -20950,6 +21154,7 @@ exports.detectAppIdsByCommitLookup = __webpack_exports__.detectAppIdsByCommitLoo
 exports.detectAppIdsFromAllRemotes = __webpack_exports__.detectAppIdsFromAllRemotes;
 exports.executeCheckout = __webpack_exports__.executeCheckout;
 exports.executeGitCredentialOperation = __webpack_exports__.executeGitCredentialOperation;
+exports.executeModelTokenOperation = __webpack_exports__.executeModelTokenOperation;
 exports.filterCandidates = __webpack_exports__.filterCandidates;
 exports.formatCandidateLabel = __webpack_exports__.formatCandidateLabel;
 exports.formatGitAuthDoctorReport = __webpack_exports__.formatGitAuthDoctorReport;
@@ -20963,12 +21168,15 @@ exports.getGitFetchUrl = __webpack_exports__.getGitFetchUrl;
 exports.getGitPushUrl = __webpack_exports__.getGitPushUrl;
 exports.getInstalledPreferredEditors = __webpack_exports__.getInstalledPreferredEditors;
 exports.getLatestVersion = __webpack_exports__.getLatestVersion;
+exports.getModelToken = __webpack_exports__.getModelToken;
+exports.getModelTokenHelperScript = __webpack_exports__.getModelTokenHelperScript;
 exports.getPreferredEditorCommand = __webpack_exports__.getPreferredEditorCommand;
 exports.getSettableConfigKeys = __webpack_exports__.getSettableConfigKeys;
 exports.getValidAuthToken = __webpack_exports__.getValidAuthToken;
 exports.getWebSocketUrl = __webpack_exports__.getWebSocketUrl;
 exports.hasTokensForUrl = __webpack_exports__.hasTokensForUrl;
 exports.inspectCredentialHelperCommand = __webpack_exports__.inspectCredentialHelperCommand;
+exports.installModelTokenHelperScript = __webpack_exports__.installModelTokenHelperScript;
 exports.isCommandAvailable = __webpack_exports__.isCommandAvailable;
 exports.isDirectoryNonEmpty = __webpack_exports__.isDirectoryNonEmpty;
 exports.isPathInsideGitRepo = __webpack_exports__.isPathInsideGitRepo;
@@ -21004,9 +21212,11 @@ exports.validatePath = __webpack_exports__.validatePath;
 exports.verifyAndStoreTokens = __webpack_exports__.verifyAndStoreTokens;
 exports.verifyAuth = __webpack_exports__.verifyAuth;
 exports.watch = __webpack_exports__.watch;
+exports.withRepoAuthFileLock = __webpack_exports__.withRepoAuthFileLock;
 exports.writeEnvironmentPid = __webpack_exports__.writeEnvironmentPid;
 for(var __rspack_i in __webpack_exports__)if (-1 === [
     "ANVIL_SYNC_CLIENT_ID",
+    "AUTH_FILE_LOCK_DEFAULTS",
     "AnvilYamlValidationResult",
     "AppIdCandidate",
     "AppIdWithContext",
@@ -21018,11 +21228,15 @@ for(var __rspack_i in __webpack_exports__)if (-1 === [
     "CheckoutResult",
     "DeviceAuthorizationResponse",
     "FormTemplateValidationResult",
+    "GetValidAuthTokenOptions",
     "LoginResult",
     "LogoutResult",
+    "MODEL_TOKEN_HELPER_FILENAME",
+    "MODEL_TOKEN_LOCK_TIMEOUT_MS",
     "OAuthTokenResponse",
     "ParsedCheckoutInput",
     "PreferredEditor",
+    "REFRESH_REQUEST_TIMEOUT_MS",
     "SettableConfigKey",
     "TokenData",
     "ValidateAppIdResponse",
@@ -21043,6 +21257,7 @@ for(var __rspack_i in __webpack_exports__)if (-1 === [
     "detectAppIdsFromAllRemotes",
     "executeCheckout",
     "executeGitCredentialOperation",
+    "executeModelTokenOperation",
     "filterCandidates",
     "formatCandidateLabel",
     "formatGitAuthDoctorReport",
@@ -21056,12 +21271,15 @@ for(var __rspack_i in __webpack_exports__)if (-1 === [
     "getGitPushUrl",
     "getInstalledPreferredEditors",
     "getLatestVersion",
+    "getModelToken",
+    "getModelTokenHelperScript",
     "getPreferredEditorCommand",
     "getSettableConfigKeys",
     "getValidAuthToken",
     "getWebSocketUrl",
     "hasTokensForUrl",
     "inspectCredentialHelperCommand",
+    "installModelTokenHelperScript",
     "isCommandAvailable",
     "isDirectoryNonEmpty",
     "isPathInsideGitRepo",
@@ -21097,6 +21315,7 @@ for(var __rspack_i in __webpack_exports__)if (-1 === [
     "verifyAndStoreTokens",
     "verifyAuth",
     "watch",
+    "withRepoAuthFileLock",
     "writeEnvironmentPid"
 ].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
 Object.defineProperty(exports, '__esModule', {

package/dist/services/auth.d.ts

@@ -3,7 +3,15 @@
  * Handles token management, refresh, validation, and account management.
  */
 import { AccountTokens } from "../config";
+import { AuthFileLockOptions } from "./git-auth";
 export declare const ANVIL_SYNC_CLIENT_ID = "anvil-sync";
+/**
+ * Upper bound on a single /oauth/token refresh request. Must stay comfortably
+ * below the auth file lock's stale threshold (AUTH_FILE_LOCK_DEFAULTS.staleMs)
+ * so a refresh can never outlive its own lock; the lock heartbeat is the other
+ * half of that guarantee.
+ */
+export declare const REFRESH_REQUEST_TIMEOUT_MS = 12000;
 /** Token data returned from OAuth token endpoint */
 export interface TokenData {
     access_token: string;
@@ -40,16 +48,41 @@ export declare function verifyAuth(authToken: string, anvilUrl?: string): Promis
  * Refresh the access token using a refresh token.
  * @throws {AuthError} if refresh fails
  */
-export declare function refreshAccessToken(refreshToken: string, anvilUrl?: string, clientId?: string): Promise<TokenData>;
+export declare function refreshAccessToken(refreshToken: string, anvilUrl?: string, clientId?: string, options?: {
+    timeoutMs?: number;
+}): Promise<TokenData>;
 /**
  * Check if we have tokens for a specific URL and username.
  */
 export declare function hasTokensForUrl(anvilUrl: string, username?: string): Promise<boolean>;
+export interface GetValidAuthTokenOptions {
+    /** Cross-process auth file lock settings, used when the tokens live in a repo auth file. */
+    lock?: AuthFileLockOptions;
+    /** Upper bound on the refresh request; defaults to REFRESH_REQUEST_TIMEOUT_MS. */
+    requestTimeoutMs?: number;
+}
 /**
  * Get a valid access token, refreshing it if necessary.
  * @throws {AuthError} if no valid token can be obtained
  */
-export declare function getValidAuthToken(anvilUrl?: string, username?: string): Promise<string>;
+export declare function getValidAuthToken(anvilUrl?: string, username?: string, options?: GetValidAuthTokenOptions): Promise<string>;
+export interface RefreshRepoAuthTokensOptions {
+    anvilUrl: string;
+    username?: string;
+    /** Auth data already read from the repo; used if the locked re-read finds nothing newer. */
+    auth?: AuthData;
+    refreshToken?: string;
+    lock?: AuthFileLockOptions;
+    /** Upper bound on the refresh request; defaults to REFRESH_REQUEST_TIMEOUT_MS. */
+    requestTimeoutMs?: number;
+}
+/**
+ * Refresh repo-stored auth tokens under the cross-process auth file lock.
+ * After acquiring the lock the auth file is re-read: another process may have
+ * already refreshed (and rotated the refresh token) while we waited, in which
+ * case the fresh token is returned without another refresh call.
+ */
+export declare function refreshRepoAuthTokens(repoPath: string, options: RefreshRepoAuthTokensOptions): Promise<string>;
 /**
  * Log in with token data from OAuth flow.
  * @throws {AuthError} if verification fails

package/dist/services/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/services/auth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,aAAa,EAAsC,MAAM,WAAW,CAAC;AAS9E,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAMjD,oDAAoD;AACpD,MAAM,WAAW,SAAS;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,sBAAsB;AACtB,MAAM,WAAW,WAAW;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,uBAAuB;AACvB,MAAM,WAAW,YAAY;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,QAAQ;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,aAAa,CAAC;CACzB;AAaD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,IAAI,CAMjG;AAED,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAYD,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAErD;AAQD;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,SAAuB,GAAG,OAAO,CAAC,MAAM,CAAC,CAqBpG;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACpC,YAAY,EAAE,MAAM,EACpB,QAAQ,SAAuB,EAC/B,QAAQ,SAAuB,GAChC,OAAO,CAAC,SAAS,CAAC,CA2BpB;AAMD;;GAEG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAY3F;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,SAAuB,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAkC3G;AA8HD;;;GAGG;AACH,wBAAsB,oBAAoB,CACtC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/F,OAAO,CAAC,WAAW,CAAC,CAetB;AAED;;GAEG;AACH,wBAAsB,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CA0CxF;AAMD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAYtE;AAED;;GAEG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAW/D"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/services/auth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,aAAa,EAAsC,MAAM,WAAW,CAAC;AAG9E,OAAO,EAAE,mBAAmB,EAA2D,MAAM,YAAY,CAAC;AAM1G,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAEjD;;;;;GAKG;AAIH,eAAO,MAAM,0BAA0B,QAAS,CAAC;AAMjD,oDAAoD;AACpD,MAAM,WAAW,SAAS;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,sBAAsB;AACtB,MAAM,WAAW,WAAW;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,uBAAuB;AACvB,MAAM,WAAW,YAAY;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,QAAQ;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,aAAa,CAAC;CACzB;AAaD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,IAAI,CAMjG;AAED,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAYD,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAErD;AAQD;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,SAAuB,GAAG,OAAO,CAAC,MAAM,CAAC,CAqBpG;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACpC,YAAY,EAAE,MAAM,EACpB,QAAQ,SAAuB,EAC/B,QAAQ,SAAuB,EAC/B,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC,OAAO,CAAC,SAAS,CAAC,CAiCpB;AAMD;;GAEG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAY3F;AAED,MAAM,WAAW,wBAAwB;IACrC,4FAA4F;IAC5F,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACnC,QAAQ,SAAuB,EAC/B,QAAQ,CAAC,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,wBAAwB,GACnC,OAAO,CAAC,MAAM,CAAC,CA8BjB;AAwFD,MAAM,WAAW,4BAA4B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,MAAM,CAAC,CA+BpH;AAmGD;;;GAGG;AACH,wBAAsB,oBAAoB,CACtC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/F,OAAO,CAAC,WAAW,CAAC,CAetB;AAED;;GAEG;AACH,wBAAsB,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CA0CxF;AAMD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAYtE;AAED;;GAEG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAW/D"}

package/dist/services/git-auth.d.ts

@@ -1,5 +1,6 @@
 import type { AuthData } from "./auth";
 export declare const GIT_CREDENTIAL_HELPER_FILENAME = "anvil-credential-helper.cjs";
+export declare const MODEL_TOKEN_HELPER_FILENAME = "anvil-model-token-helper.cjs";
 export declare const GIT_CREDENTIAL_HELPER_LOCATOR = "$(git rev-parse --git-common-dir)/anvil-credential-helper.cjs";
 export interface AppAuthBinding {
     url?: string;
@@ -14,6 +15,17 @@ export declare function getAppAuthBinding(repoPath: string, appId: string): Prom
 export declare function setAppAuthBinding(repoPath: string, appId: string, binding: AppAuthBinding): Promise<void>;
 export declare function getCleanGitRemoteUrl(appId: string, gitUrl: string): string;
 export declare function getCredentialHelperScript(modulePath: string): string;
+export declare function getModelTokenHelperScript(modulePath: string): string;
+/**
+ * Generate the model-token helper script and install it at the given absolute
+ * path (e.g. once per host into an agent home directory). The script resolves
+ * its repo from the invoking process's cwd via git rev-parse, prints a valid
+ * access token to stdout, and exits non-zero with a message on stderr on any
+ * failure.
+ */
+export declare function installModelTokenHelperScript(helperPath: string, options?: {
+    modulePath?: string;
+}): Promise<string>;
 export declare function getCredentialHelperModulePath(options?: {
     currentModulePath?: string;
     resolvePackageEntry?: () => string;
@@ -34,6 +46,29 @@ export declare function hardenCheckoutGitAuth(options: {
     cleanRemoteUrl: string;
 }>;
 export declare function parseAppIdFromGitPath(pathValue?: string): string | undefined;
+export interface AuthFileLockOptions {
+    /**
+     * Take over locks whose mtime is older than this. A live holder keeps its
+     * lockfile's mtime fresh (see heartbeatMs), so only a dead holder's lock
+     * ever reaches this age.
+     */
+    staleMs?: number;
+    /** Give up waiting for another process after this long. */
+    timeoutMs?: number;
+    /** Delay between acquisition attempts while another process holds the lock. */
+    retryDelayMs?: number;
+    /** How often the holder touches the lockfile's mtime to prove it is still alive. */
+    heartbeatMs?: number;
+}
+export declare const AUTH_FILE_LOCK_DEFAULTS: Required<AuthFileLockOptions>;
+/**
+ * Run `fn` while holding the cross-process lockfile beside the repo's
+ * anvil-auth.json. Every read-refresh-write cycle for repo-backed auth must go
+ * through this lock: the refresh token rotates on use and server-side reuse
+ * revokes the whole token family, so two processes racing a refresh would
+ * permanently kill the session's auth.
+ */
+export declare function withRepoAuthFileLock<T>(repoPath: string, fn: () => Promise<T>, options?: AuthFileLockOptions): Promise<T>;
 export declare function writeAuthToFile(repoPath: string, auth: AuthData, encryptionKey: string): Promise<string>;
 export declare const readAuthFromRepo: (repoPath: string) => Promise<AuthData | undefined>;
 //# sourceMappingURL=git-auth.d.ts.map

package/dist/services/git-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-auth.d.ts","sourceRoot":"","sources":["../../src/services/git-auth.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,QAAQ,CAAC;AAIrC,eAAO,MAAM,8BAA8B,gCAAgC,CAAC;AAC5E,eAAO,MAAM,6BAA6B,kEAAwE,CAAC;AAEnH,MAAM,WAAW,cAAc;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAkBD,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC9B,GAAG,MAAM,CAkBT;AAWD,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAUhG;AAED,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ/G;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAI1E;AAED,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAoBpE;AAiCD,wBAAgB,6BAA6B,CAAC,OAAO,CAAC,EAAE;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,MAAM,CAAC;CACtC,GAAG,MAAM,CAYT;AAsCD,wBAAsB,+BAA+B,CACjD,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IACN,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC9B,GACF,OAAO,CAAC,IAAI,CAAC,CA2Cf;AAED,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBtC;AAED,wBAAgB,qBAAqB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK5E;AA+DD,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,mBAe5F;AAED,eAAO,MAAM,gBAAgB,GAAU,UAAU,MAAM,KAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAiBrF,CAAC"}
+{"version":3,"file":"git-auth.d.ts","sourceRoot":"","sources":["../../src/services/git-auth.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,QAAQ,CAAC;AAIrC,eAAO,MAAM,8BAA8B,gCAAgC,CAAC;AAC5E,eAAO,MAAM,2BAA2B,iCAAiC,CAAC;AAC1E,eAAO,MAAM,6BAA6B,kEAAwE,CAAC;AAEnH,MAAM,WAAW,cAAc;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAkBD,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC9B,GAAG,MAAM,CAkBT;AAWD,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAUhG;AAED,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ/G;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAI1E;AAED,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAoBpE;AAED,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAqBpE;AAED;;;;;;GAMG;AACH,wBAAsB,6BAA6B,CAC/C,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAClC,OAAO,CAAC,MAAM,CAAC,CAWjB;AAiCD,wBAAgB,6BAA6B,CAAC,OAAO,CAAC,EAAE;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,MAAM,CAAC;CACtC,GAAG,MAAM,CAYT;AAsCD,wBAAsB,+BAA+B,CACjD,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IACN,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC9B,GACF,OAAO,CAAC,IAAI,CAAC,CA2Cf;AAED,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBtC;AAED,wBAAgB,qBAAqB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK5E;AAWD,MAAM,WAAW,mBAAmB;IAChC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,mBAAmB,CAKjE,CAAC;AAgDF;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,EACxC,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,OAAO,CAAC,EAAE,mBAAmB,GAC9B,OAAO,CAAC,CAAC,CAAC,CAaZ;AA2ED,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,mBAwB5F;AAED,eAAO,MAAM,gBAAgB,GAAU,UAAU,MAAM,KAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAiBrF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anvil-works/anvil-cli",
-  "version": "0.8.0-canary.12",
+  "version": "0.8.0-canary.13",
   "description": "CLI tool for developing Anvil apps locally",
   "main": "dist/index.js",
   "types": "dist/api.d.ts",