@aventurevc/aventure-cli 0.7.295 → 0.7.296

package/README.md

@@ -23,25 +23,33 @@ aventure auth login
 aventure entities list --entity-name Stripe
 ```
 
-Complete browser sign-in when prompted. The CLI stores the native OAuth access
-token in the operating-system credential store. `aventure auth status` reports
-credential metadata without displaying the token.
+Complete browser sign-in when prompted. The CLI stores the OAuth credential in
+the operating-system credential store, or in `~/.config/aventure/credentials.json`
+(mode `0600`) where the keyring cannot be used without a GUI session. An expired
+access token is renewed with its refresh token automatically. `aventure auth
+status` reports credential metadata, the store in use, and the sign-in providers
+without displaying any secret. `aventure auth logout` revokes the personal key,
+revokes the OAuth refresh token, and removes both local records.
 
 ### Personal API key
 
 Create a key at [aventure.vc](https://aventure.vc) under **Settings → API keys →
 Add new key**, then provide it through `AUTH_TOKEN` using your environment or
 secret manager. To create and store a personal key through browser approval, run
-`aventure auth personal-login` in an interactive terminal. `aventure auth status`
+`aventure auth login --key` in an interactive terminal. `aventure auth status`
 reports metadata without displaying the key. Help and the command catalog work
 without signing in.
 
 ## Headless authentication
 
-CI, containers, and SSH sessions without writable OS credential storage must
-provide an existing personal API key through `AUTH_TOKEN`. Native OAuth
-(`aventure auth login`) and personal-key approval (`aventure auth personal-login`)
-require an interactive terminal and usable OS credential storage.
+`aventure auth login` uses the OAuth device authorization grant: it prints a one-time
+code and a sign-in URL, opens the browser when one is available (`--no-browser` only
+skips that), you approve on any device, and the CLI polls until the sign-in completes.
+The same command works on a laptop, over SSH, and in a container. The verification
+page uses the account already signed in at `accounts.aventure.vc`; to choose another
+account, open the URL in a private window or sign out there first. `aventure auth
+login --key --no-browser` is the equivalent path for a personal API key, and an
+existing key can always be provided through `AUTH_TOKEN`.
 
 The command catalog is generated from the public aVenture OpenAPI spec and must not be hand-edited.
 

package/dist/aventure-cli/index.js

@@ -1,2 +1,2 @@
 #!/usr/bin/env node
-import{D as e,V as t,j as n,z as r}from"../chunks/auth-DVA6KxqF.js";import{C as i,g as a,i as o,s,t as c}from"../chunks/openapi-commands-CM6Yhmi3.js";o(process.argv.slice(2))&&t(!1);try{if(s(process.argv.slice(2),c)===`optional`){await n();try{await i(),await a()}catch(e){r({component:`aventure-cli`,event:`optional_auth_materialization_failed`,message:`saved credential unavailable; continuing with credential-optional command`,error:e})}}await import(`../chunks/aventure-cli-CeQTzpF6.js`)}catch(t){if(!(t instanceof e))throw t;process.stderr.write(`${t.message}\n`),process.exitCode=t.exitCode}export{};
+import{D as e,V as t,j as n,z as r}from"../chunks/auth-Bb-9biQe.js";import{C as i,g as a,i as o,s,t as c}from"../chunks/openapi-commands-DoiIrMC_.js";o(process.argv.slice(2))&&t(!1);try{if(s(process.argv.slice(2),c)===`optional`){await n();try{await i(),await a()}catch(e){r({component:`aventure-cli`,event:`optional_auth_materialization_failed`,message:`saved credential unavailable; continuing with credential-optional command`,error:e})}}await import(`../chunks/aventure-cli-D8DWnUUN.js`)}catch(t){if(!(t instanceof e))throw t;process.stderr.write(`${t.message}\n`),process.exitCode=t.exitCode}export{};

package/dist/aventure-cli/unified-operations.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "generatedFrom": "MCP_GENERATION_CONTRACT",
-  "generatedAt": "2026-09-15T22:57:34.452Z",
+  "generatedAt": "2026-09-16T01:44:05.499Z",
   "totalOperations": 162,
   "note": "Projection of MCP_GENERATION_CONTRACT - see mcp/scripts/build-unified-operations.ts header for SSOT rules.",
   "operations": [