@cerios/salesforce-sobjectly 1.0.0 → 1.2.0

package/dist/{codegen-CSx0WAtK.mjs → codegen-0L2ebG9j.mjs}

@@ -1,22 +1,50 @@
-import { Mt as init_api_version, Nt as isApiVersion, Pt as normalizeApiVersion, Rt as __esmMin, d as init_client, i as clientCredentials, n as sfCli, o as init_providers, r as accessToken, s as jwtBearer, t as init_sf_cli, u as SalesforceClient } from "./sf-cli-CtWtdkJ0.mjs";
+import { Mt as init_api_version, Nt as isApiVersion, Pt as normalizeApiVersion, Rt as __esmMin, d as init_client, i as clientCredentials, n as sfCli, o as init_providers, r as accessToken, s as jwtBearer, t as init_sf_cli, u as SalesforceClient } from "./sf-cli-D2PgjErx.mjs";
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { dirname, extname, isAbsolute, join, relative, resolve } from "node:path";
 import { createJiti } from "jiti";
 import { createInterface } from "node:readline";
+//#region src/codegen/emit.ts
+/** Fields sorted by name, `Id` first, so the output is deterministic. */
+function sortedFields(describe) {
+	return [...describe.fields].sort((a, b) => a.name === "Id" ? -1 : b.name === "Id" ? 1 : compare(a.name, b.name));
+}
+/** An object key: the bare name when it is an identifier, otherwise a quoted string. */
+function propertyKey(name) {
+	return IDENTIFIER$1.test(name) ? name : JSON.stringify(name);
+}
+function escapeComment(value) {
+	return String(value ?? "").replace(/\*\//g, "*\\/").replace(/\r?\n/g, " ");
+}
+function compare(a, b) {
+	return a < b ? -1 : a > b ? 1 : 0;
+}
+var IDENTIFIER$1;
+var init_emit = __esmMin((() => {
+	IDENTIFIER$1 = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+}));
+//#endregion
 //#region src/codegen/type-mapper.ts
-/** Returns the TypeScript type for a field, including `| null` for nillable fields. */
-function mapFieldType(field, picklists = "union") {
-	const base = picklistType(field, picklists) ?? FIELD_TYPE_MAP[field.type] ?? "unknown";
+/**
+* Returns the TypeScript type for a field, including `| null` for nillable fields. With picklist
+* mode `"const"` or `"enum"`, `typeName` is the field's named picklist type; it replaces the union.
+*/
+function mapFieldType(field, picklists = "union", typeName) {
+	const base = picklistType(field, picklists, typeName) ?? FIELD_TYPE_MAP[field.type] ?? "unknown";
 	return field.nillable && base !== "unknown" ? `${base} | null` : base;
 }
-function picklistType(field, picklists) {
-	if (picklists !== "union" || field.type !== "picklist" && field.type !== "combobox") return;
-	const values = [...new Set((field.picklistValues ?? []).filter((entry) => entry.active).map((entry) => entry.value))];
+function picklistType(field, picklists, typeName) {
+	if (picklists === "string" || field.type !== "picklist" && field.type !== "combobox") return;
+	const values = activePicklistValues(field);
 	if (values.length === 0) return;
-	const union = values.map((value) => JSON.stringify(value)).join(" | ");
-	return field.restrictedPicklist && field.type === "picklist" ? union : `${union} | (string & {})`;
+	const members = picklists !== "union" && typeName !== void 0 ? typeName : values.map((value) => JSON.stringify(value)).join(" | ");
+	return field.restrictedPicklist && field.type === "picklist" ? members : `${members} | (string & {})`;
+}
+/** The distinct active values of a picklist, multi-select picklist or combobox, in describe order. */
+function activePicklistValues(field) {
+	if (field.type !== "picklist" && field.type !== "multipicklist" && field.type !== "combobox") return [];
+	return [...new Set((field.picklistValues ?? []).filter((entry) => entry.active).map((entry) => entry.value))];
 }
 var ADDRESS_TYPE, GEOLOCATION_TYPE, FIELD_TYPE_MAP;
 var init_type_mapper = __esmMin((() => {
@@ -54,24 +82,151 @@ var init_type_mapper = __esmMin((() => {
 	};
 }));
 //#endregion
+//#region src/codegen/picklist-types.ts
+function isNamedPicklistMode(mode) {
+	return mode === "const" || mode === "enum";
+}
+/**
+* Names the type of every picklist with active values: sObject and field in PascalCase, e.g.
+* `Case.Status` -> `CaseStatus` and `Case.Status__c` -> `CaseStatusCustom`. A name that is in
+* `taken` (the sObjects and other names the file defines) or already used by another picklist gets
+* the suffix `Picklist`; when that is taken too, this throws.
+*/
+function picklistTypeNames(describes, taken) {
+	const used = new Map([...taken].map((name) => [name, void 0]));
+	const result = /* @__PURE__ */ new Map();
+	for (const describe of [...describes].sort((a, b) => compare(a.name, b.name))) {
+		const names = /* @__PURE__ */ new Map();
+		for (const field of sortedFields(describe).filter((item) => activePicklistValues(item).length > 0)) {
+			const base = `${pascalApiName(describe.name, "sobject")}${pascalApiName(field.name, "field")}`;
+			if (IDENTIFIER$1.test(base)) {
+				const picklist = `${describe.name}.${field.name}`;
+				const name = resolveName(base, picklist, used);
+				used.set(name, picklist);
+				names.set(field.name, name);
+			}
+		}
+		if (names.size > 0) result.set(describe.name, names);
+	}
+	return result;
+}
+function resolveName(base, picklist, used) {
+	const name = used.has(base) ? `${base}${CLASH_SUFFIX}` : base;
+	if (used.has(name)) {
+		const owner = used.get(name);
+		const other = owner === void 0 ? "a type the generated file defines" : `the picklist type for ${owner}`;
+		throw new Error(`The picklist type "${name}" for ${picklist} clashes with ${other}; exclude one of the sObjects or use picklists: "union".`);
+	}
+	return name;
+}
+/**
+* An API name in PascalCase without underscores. A field's `__c` becomes `Custom`
+* (`Lead_Source__c` -> `LeadSourceCustom`) and an sObject's is dropped (`My_Object__c` ->
+* `MyObject`). Other suffixes are kept: `Foo__pc` -> `FooPc`, `Config__mdt` -> `ConfigMdt`.
+*/
+function pascalApiName(name, kind) {
+	const match = /^(.+?)__([a-z]+)$/.exec(name);
+	const body = match ? match[1] : name;
+	const suffix = match ? match[2] : "";
+	const suffixPart = suffix === "c" ? kind === "field" ? "Custom" : "" : capitalize(suffix);
+	return `${body.split("_").filter((part) => part.length > 0).map(capitalize).join("")}${suffixPart}`;
+}
+function capitalize(value) {
+	return value.charAt(0).toUpperCase() + value.slice(1);
+}
+/**
+* The member names for a picklist's values, in the same order. A value that is an identifier is
+* its own name; other values are sanitized (`"Closed Won"` -> `Closed_Won`, `"3rd Party"` ->
+* `_3rd_Party`). When the sanitized name is empty or taken, the value itself is the (quoted) name.
+*/
+function picklistMemberKeys(values, mode) {
+	const used = /* @__PURE__ */ new Set();
+	const claim = (key) => {
+		used.add(key);
+		return key;
+	};
+	const usable = (key) => key.length > 0 && key !== "__proto__" && !used.has(key) && (mode === "const" || !isNumericName(key));
+	const own = values.map((value) => IDENTIFIER$1.test(value) && usable(value) ? claim(value) : void 0);
+	return values.map((value, index) => {
+		const ownKey = own[index];
+		if (ownKey !== void 0) return ownKey;
+		const sanitized = sanitizeKey(value);
+		if (usable(sanitized)) return claim(sanitized);
+		if (usable(value)) return claim(value);
+		let counter = 2;
+		while (!usable(`${sanitized || "_"}_${counter}`)) counter++;
+		return claim(`${sanitized || "_"}_${counter}`);
+	});
+}
+function sanitizeKey(value) {
+	const key = value.normalize("NFKD").replace(/\p{M}/gu, "").replace(/[^A-Za-z0-9_]+/g, "_").replace(/^_+|_+$/g, "");
+	return /^[0-9]/.test(key) ? `_${key}` : key;
+}
+/** Names TypeScript rejects as enum members because they are numeric, e.g. `"1"` or `"-1"`. */
+function isNumericName(key) {
+	const number = Number(key);
+	return Number.isFinite(number) && String(number) === key;
+}
+/** The named type declarations for one sObject's picklists, in field order; `""` when there are none. */
+function picklistDeclarations(describe, names, mode) {
+	if (!names) return "";
+	return sortedFields(describe).flatMap((field) => {
+		const name = names.get(field.name);
+		return name === void 0 ? [] : [declaration(describe.name, field, name, mode)];
+	}).join("\n\n");
+}
+function declaration(sobject, field, name, mode) {
+	const values = activePicklistValues(field);
+	const keys = picklistMemberKeys(values, mode);
+	const doc = `/** Active values of ${escapeComment(`${sobject}.${field.name}`)} (${escapeComment(field.type)}). */`;
+	if (mode === "enum") {
+		const members = values.map((value, index) => `\t${propertyKey(keys[index])} = ${JSON.stringify(value)},`);
+		return [
+			doc,
+			`export enum ${name} {`,
+			...members,
+			"}"
+		].join("\n");
+	}
+	const members = values.map((value, index) => `\t${propertyKey(keys[index])}: ${JSON.stringify(value)},`);
+	return [
+		doc,
+		`export const ${name} = {`,
+		...members,
+		"} as const;",
+		`export type ${name} = (typeof ${name})[keyof typeof ${name}];`
+	].join("\n");
+}
+var CLASH_SUFFIX;
+var init_picklist_types = __esmMin((() => {
+	init_emit();
+	init_type_mapper();
+	CLASH_SUFFIX = "Picklist";
+}));
+//#endregion
 //#region src/codegen/generator.ts
 /**
 * Generates the TypeScript source for a set of sObject describes: a read interface, create
-* and update input types per sObject, and the `SObjectRegistry` that ties them together.
+* and update input types per sObject, and the `SObjectRegistry` that ties them together. With
+* picklist mode `"const"` or `"enum"`, each picklist also gets a named type before its sObject.
 * The output is deterministic: sObjects are sorted by name and fields by name (`Id` first).
 */
 function generateSource(describes, options = {}) {
 	const sorted = [...describes].sort((a, b) => compare(a.name, b.name));
-	assertGeneratableNames(sorted);
+	const definedNames = assertGeneratableNames(sorted);
 	const names = new Set(sorted.map((describe) => describe.name));
+	const picklists = options.picklists ?? "union";
+	const picklistTypes = isNamedPicklistMode(picklists) ? picklistTypeNames(sorted, definedNames) : void 0;
 	const sections = [imports(sorted, options.importSource ?? "@cerios/salesforce-sobjectly")];
 	const objectHashes = [];
 	for (const describe of sorted) {
+		const typeNames = picklistTypes?.get(describe.name);
 		const objectSections = [
-			readInterface(describe, options.picklists ?? "union"),
+			isNamedPicklistMode(picklists) ? picklistDeclarations(describe, typeNames, picklists) : "",
+			readInterface(describe, picklists, typeNames),
 			inputType(describe, "CreateInput", "createable", lookup(options.excludeCreateFields, describe.name)),
 			inputType(describe, "UpdateInput", "updateable", lookup(options.excludeUpdateFields, describe.name))
-		];
+		].filter((section) => section.length > 0);
 		sections.push(...objectSections);
 		const fingerprint = [
 			...objectSections,
@@ -86,7 +241,10 @@ function generateSource(describes, options = {}) {
 	const body = sections.filter((section) => section.length > 0).join("\n\n");
 	return `${header(sha256(body), objectHashes)}\n\n${body}\n`;
 }
-/** Fails with a clear message for sObject names the generated TypeScript can't represent. */
+/**
+* Fails with a clear message for sObject names the generated TypeScript can't represent. Returns
+* every name the file defines apart from picklist types, so those can avoid them.
+*/
 function assertGeneratableNames(describes) {
 	const seen = /* @__PURE__ */ new Map();
 	const generated = new Set(describes.flatMap((describe) => [`${describe.name}CreateInput`, `${describe.name}UpdateInput`]));
@@ -97,6 +255,11 @@ function assertGeneratableNames(describes) {
 		if (previous !== void 0) throw new Error(`sObjects "${previous}" and "${name}" differ only in case; list each sObject once.`);
 		seen.set(name.toLowerCase(), name);
 	}
+	return /* @__PURE__ */ new Set([
+		...RESERVED_TYPE_NAMES,
+		...generated,
+		...describes.map((describe) => describe.name)
+	]);
 }
 /** Looks up a per-sObject option case-insensitively (sObject names are case-insensitive in Salesforce). */
 function lookup(map, name) {
@@ -141,12 +304,11 @@ function imports(describes, importSource) {
 	if (fields.some((field) => field.type === "location")) used.push(GEOLOCATION_TYPE);
 	return used.length > 0 ? `import type { ${used.join(", ")} } from ${JSON.stringify(importSource)};` : "";
 }
-function sortedFields(describe) {
-	return [...describe.fields].sort((a, b) => a.name === "Id" ? -1 : b.name === "Id" ? 1 : compare(a.name, b.name));
-}
-function readInterface(describe, picklists) {
+function readInterface(describe, picklists, typeNames) {
 	const lines = sortedFields(describe).map((field) => {
-		return `${`\t/** ${escapeComment(field.label)} (${escapeComment(field.type)}) */`}\n\t${propertyKey(field.name)}: ${mapFieldType(field, picklists)};`;
+		const comment = `\t/** ${escapeComment(field.label)} (${escapeComment(field.type)}) */`;
+		const type = mapFieldType(field, picklists, typeNames?.get(field.name));
+		return `${comment}\n\t${propertyKey(field.name)}: ${type};`;
 	});
 	return `${describe.label ? `/** ${escapeComment(describe.label)} */\n` : ""}export interface ${describe.name} {\n${lines.join("\n")}\n}`;
 }
@@ -233,10 +395,6 @@ function recordTypeConstants(describes) {
 	const entries = describes.map((describe) => [describe.name, recordTypeNames(describe)]).filter(([, names]) => names.length > 0).map(([name, names]) => `\t${name}: [${names.map((value) => JSON.stringify(value)).join(", ")}],`);
 	return ["/** Record type DeveloperNames per sObject. Resolve ids with `sf.sobject(name).recordTypeId(developerName)`. */", `export const RECORD_TYPES = {${entries.length > 0 ? `\n${entries.join("\n")}\n` : ""}} as const;`].join("\n");
 }
-function activePicklistValues(field) {
-	if (field.type !== "picklist" && field.type !== "multipicklist" && field.type !== "combobox") return [];
-	return [...new Set((field.picklistValues ?? []).filter((entry) => entry.active).map((entry) => entry.value))];
-}
 function unionOrNever(values) {
 	return values.length > 0 ? values.map((value) => JSON.stringify(value)).join(" | ") : "never";
 }
@@ -259,17 +417,10 @@ function relationshipMap(entries) {
 function keyUnion(names) {
 	return names.map((name) => JSON.stringify(name)).join(" | ");
 }
-function propertyKey(name) {
-	return IDENTIFIER$1.test(name) ? name : JSON.stringify(name);
-}
-function escapeComment(value) {
-	return String(value ?? "").replace(/\*\//g, "*\\/").replace(/\r?\n/g, " ");
-}
-function compare(a, b) {
-	return a < b ? -1 : a > b ? 1 : 0;
-}
-var FIELD_KINDS, IDENTIFIER$1, RESERVED_TYPE_NAMES, CONTENT_HASH_PREFIX, OBJECT_HASHES_PREFIX, OBJECT_HASH_LENGTH;
+var FIELD_KINDS, RESERVED_TYPE_NAMES, CONTENT_HASH_PREFIX, OBJECT_HASHES_PREFIX, OBJECT_HASH_LENGTH;
 var init_generator = __esmMin((() => {
+	init_emit();
+	init_picklist_types();
 	init_type_mapper();
 	FIELD_KINDS = /* @__PURE__ */ new Set([
 		"date",
@@ -277,7 +428,6 @@ var init_generator = __esmMin((() => {
 		"time",
 		"multipicklist"
 	]);
-	IDENTIFIER$1 = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
 	RESERVED_TYPE_NAMES = /* @__PURE__ */ new Set([
 		"Record",
 		"Pick",
@@ -356,8 +506,17 @@ function validateAuth(value, { json, problem }) {
 		problem(`auth.type: must be one of ${Object.keys(AUTH_OPTIONS).join(", ")}, got ${show(type)}.`);
 		return;
 	}
-	for (const [key, option] of Object.entries(rest)) if (!allowed.includes(key)) problem(`auth.${key}: not an option of "${String(type)}". Valid options: ${allowed.join(", ")}.`);
-	else if (typeof option !== "string" || option.length === 0) problem(`auth.${key}: must be a non-empty string, got ${show(option)}.`);
+	for (const [key, option] of Object.entries(rest)) if (!allowed.includes(key)) {
+		const valid = allowed.filter((name) => !(name in DEPRECATED_AUTH_OPTIONS));
+		problem(`auth.${key}: not an option of "${String(type)}". Valid options: ${valid.join(", ")}.`);
+	} else validateAuthOption(key, option, rest, problem);
+}
+function validateAuthOption(key, option, setting, problem) {
+	const replacement = DEPRECATED_AUTH_OPTIONS[key];
+	if (replacement !== void 0 && replacement in setting) problem(`auth.${key}: use either ${replacement} or ${key}, not both.`);
+	else if (replacement !== void 0) {
+		if (typeof option !== "string" || option.length === 0) problem(`auth.${key}: must be a non-empty string, got ${show(option)}.`);
+	} else if (option !== void 0 && typeof option !== "string") problem(`auth.${key}: must be a string, got ${show(option)}.`);
 }
 function show(value) {
 	if (value === void 0) return "undefined";
@@ -368,7 +527,7 @@ function show(value) {
 		return typeof value;
 	}
 }
-var CodegenConfigError, AUTH_OPTIONS, PICKLIST_MODES, IDENTIFIER, VALIDATORS, CONFIG_OPTIONS;
+var CodegenConfigError, AUTH_OPTIONS, DEPRECATED_AUTH_OPTIONS, PICKLIST_MODES, IDENTIFIER, VALIDATORS, CONFIG_OPTIONS;
 var init_validate_config = __esmMin((() => {
 	init_api_version();
 	CodegenConfigError = class extends Error {
@@ -383,12 +542,25 @@ var init_validate_config = __esmMin((() => {
 	};
 	AUTH_OPTIONS = {
 		clientCredentials: [
+			"loginUrl",
+			"clientId",
+			"clientSecret",
 			"loginUrlEnv",
 			"clientIdEnv",
 			"clientSecretEnv"
 		],
-		accessToken: ["accessTokenEnv", "instanceUrlEnv"],
+		accessToken: [
+			"accessToken",
+			"instanceUrl",
+			"accessTokenEnv",
+			"instanceUrlEnv"
+		],
 		jwtBearer: [
+			"loginUrl",
+			"clientId",
+			"username",
+			"privateKey",
+			"privateKeyPath",
 			"loginUrlEnv",
 			"clientIdEnv",
 			"usernameEnv",
@@ -397,7 +569,22 @@ var init_validate_config = __esmMin((() => {
 		],
 		sfCli: ["targetOrg"]
 	};
-	PICKLIST_MODES = ["union", "string"];
+	DEPRECATED_AUTH_OPTIONS = {
+		loginUrlEnv: "loginUrl",
+		clientIdEnv: "clientId",
+		clientSecretEnv: "clientSecret",
+		accessTokenEnv: "accessToken",
+		instanceUrlEnv: "instanceUrl",
+		usernameEnv: "username",
+		privateKeyEnv: "privateKey",
+		privateKeyPathEnv: "privateKeyPath"
+	};
+	PICKLIST_MODES = [
+		"union",
+		"string",
+		"const",
+		"enum"
+	];
 	IDENTIFIER = /^[A-Za-z][A-Za-z0-9_]*$/;
 	VALIDATORS = {
 		$schema: (value, { problem }) => {
@@ -417,7 +604,7 @@ var init_validate_config = __esmMin((() => {
 		excludeCreateFields: (value, context) => validateFieldMap("excludeCreateFields", value, context),
 		excludeUpdateFields: (value, context) => validateFieldMap("excludeUpdateFields", value, context),
 		picklists: (value, { problem }) => {
-			if (!PICKLIST_MODES.includes(value)) problem(`picklists: must be "union" or "string", got ${show(value)}.`);
+			if (!PICKLIST_MODES.includes(value)) problem(`picklists: must be one of ${PICKLIST_MODES.join(", ")}, got ${show(value)}.`);
 		},
 		constants: (value, { problem }) => {
 			if (typeof value !== "boolean") problem(`constants: must be true or false, got ${show(value)}.`);
@@ -443,25 +630,6 @@ var init_validate_config = __esmMin((() => {
 	CONFIG_OPTIONS = Object.keys(VALIDATORS).filter((key) => key !== "$schema");
 }));
 //#endregion
-//#region src/codegen/config.ts
-/**
-* Type-checks a `sobjectly.config.ts`. The listed `sobjects` become a literal union, so a typo in
-* a per-sObject option is a compile error:
-*
-* ```ts
-* export default defineConfig({
-* 	apiVersion: "v66.0",
-* 	output: "src/generated/sobjects.ts",
-* 	sobjects: ["Account", "Contact"],
-* 	excludeCreateFields: { Acount: ["Name"] }, // ❌ "Acount" is not in sobjects
-* });
-* ```
-*/
-function defineConfig(config) {
-	return config;
-}
-var init_config = __esmMin((() => {}));
-//#endregion
 //#region src/codegen/load-config.ts
 /** Looks for a `sobjectly.config.{ts,mts,cts,json}` file in `cwd`; the first match in lookup order wins. */
 function findConfigFile(cwd = process.cwd()) {
@@ -516,6 +684,25 @@ var init_load_config = __esmMin((() => {
 	]);
 }));
 //#endregion
+//#region src/codegen/config.ts
+/**
+* Type-checks a `sobjectly.config.ts`. The listed `sobjects` become a literal union, so a typo in
+* a per-sObject option is a compile error:
+*
+* ```ts
+* export default defineConfig({
+* 	apiVersion: "v66.0",
+* 	output: "src/generated/sobjects.ts",
+* 	sobjects: ["Account", "Contact"],
+* 	excludeCreateFields: { Acount: ["Name"] }, // ❌ "Acount" is not in sobjects
+* });
+* ```
+*/
+function defineConfig(config) {
+	return config;
+}
+var init_config = __esmMin((() => {}));
+//#endregion
 //#region src/codegen/init.ts
 /**
 * Creates a `sobjectly.config` file by asking for the API version, output path, sObjects, auth
@@ -630,7 +817,6 @@ function renderJsonConfig(answers) {
 	return `${JSON.stringify(config, null, "	")}\n`;
 }
 function renderTypeScriptConfig(answers) {
-	const envVars = AUTH_ENV_VARS[answers.auth];
 	const sobjects = answers.sobjects.map((name) => JSON.stringify(name)).join(", ");
 	return [
 		"import { defineConfig } from \"@cerios/salesforce-sobjectly/codegen\";",
@@ -642,26 +828,38 @@ function renderTypeScriptConfig(answers) {
 		`\toutput: ${JSON.stringify(answers.output)},`,
 		"	// The sObjects to generate types for.",
 		`\tsobjects: [${sobjects}],`,
-		`\t// ${authComment(answers.auth, envVars)}`,
+		`\t// ${authComment(answers.auth)}`,
 		`\tauth: ${renderAuth(answers)},`,
 		`\tpicklists: ${JSON.stringify(answers.picklists)},`,
 		"});",
 		""
 	].join("\n");
 }
+/** The JSON auth setting: credentials are `"${NAME}"` placeholders, read from the environment. */
 function authSetting(answers) {
-	return answers.auth === "sfCli" && answers.targetOrg ? {
+	if (answers.auth === "sfCli") return answers.targetOrg ? {
 		type: "sfCli",
 		targetOrg: answers.targetOrg
-	} : { type: answers.auth };
+	} : { type: "sfCli" };
+	const fields = AUTH_FIELDS[answers.auth].map(([key, envName]) => [key, `\${${envName}}`]);
+	return {
+		type: answers.auth,
+		...Object.fromEntries(fields)
+	};
 }
+/** The TypeScript auth setting: credentials are read with `process.env`. */
 function renderAuth(answers) {
-	const setting = authSetting(answers);
-	const targetOrg = setting.targetOrg ? `, targetOrg: ${JSON.stringify(setting.targetOrg)}` : "";
-	return `{ type: ${JSON.stringify(setting.type)}${targetOrg} }`;
+	if (answers.auth === "sfCli") return `{ type: "sfCli"${answers.targetOrg ? `, targetOrg: ${JSON.stringify(answers.targetOrg)}` : ""} }`;
+	const fields = AUTH_FIELDS[answers.auth].map(([key, envName]) => `\t\t${key}: process.env.${envName},`);
+	return [
+		"{",
+		`\t\ttype: ${JSON.stringify(answers.auth)},`,
+		...fields,
+		"	}"
+	].join("\n");
 }
-function authComment(auth, envVars) {
-	return auth === "sfCli" ? "Uses an org you are logged into with the Salesforce CLI (sf org login web)." : `Reads ${formatList(envVars)} from the environment.`;
+function authComment(auth) {
+	return auth === "sfCli" ? "Uses an org you are logged into with the Salesforce CLI (sf org login web)." : "Fill these in from process.env (any variable names), a secret store or elsewhere. Keep secrets out of this file.";
 }
 async function maybeUpdateEnvExample(options, auth) {
 	const path = join(options.cwd, ".env.example");
@@ -711,36 +909,43 @@ function printNextSteps(log, answers, scriptAdded, cwd) {
 		"Next steps:",
 		cli ? `  1. Log in with the Salesforce CLI: sf org login web${answers.targetOrg ? ` --alias ${answers.targetOrg}` : " --set-default"}` : `  1. Put ${formatList(AUTH_ENV_VARS[answers.auth])} in a .env file${envIgnored ? "" : " (and add .env to .gitignore)"}.`,
 		`  2. Generate the types: ${command}`,
-		"  3. Use them:",
+		"  3. Use them, logging in with the config's auth:",
+		"       import { loadAuth } from \"@cerios/salesforce-sobjectly/codegen\";",
 		`       import { API_VERSION, type SObjectRegistry } from "./${answers.output.replace(/\.(ts|mts|cts)$/, "")}";`,
-		"       const sf = new SalesforceClient<SObjectRegistry>({ apiVersion: API_VERSION, auth });"
+		"       const sf = new SalesforceClient<SObjectRegistry>({ apiVersion: API_VERSION, auth: await loadAuth() });"
 	].join("\n"));
 }
 function formatList(items) {
 	if (items.length <= 1) return items.join("");
 	return `${items.slice(0, -1).join(", ")} and ${items.at(-1)}`;
 }
-var SOBJECT_NAME, NPM_SCRIPT, AUTH_ENV_VARS, AUTH_CHOICES, PICKLIST_CHOICES, FORMAT_CHOICES, JSON_SCHEMA_REFERENCE;
+var SOBJECT_NAME, NPM_SCRIPT, AUTH_FIELDS, AUTH_ENV_VARS, AUTH_CHOICES, PICKLIST_CHOICES, FORMAT_CHOICES, JSON_SCHEMA_REFERENCE;
 var init_init = __esmMin((() => {
 	init_api_version();
 	init_load_config();
 	SOBJECT_NAME = /^[A-Za-z][A-Za-z0-9_]*$/;
 	NPM_SCRIPT = "sobjects:generate";
-	AUTH_ENV_VARS = {
+	AUTH_FIELDS = {
 		clientCredentials: [
-			"SF_LOGIN_URL",
-			"SF_CLIENT_ID",
-			"SF_CLIENT_SECRET"
+			["loginUrl", "SF_LOGIN_URL"],
+			["clientId", "SF_CLIENT_ID"],
+			["clientSecret", "SF_CLIENT_SECRET"]
 		],
-		accessToken: ["SF_ACCESS_TOKEN", "SF_INSTANCE_URL"],
+		accessToken: [["accessToken", "SF_ACCESS_TOKEN"], ["instanceUrl", "SF_INSTANCE_URL"]],
 		jwtBearer: [
-			"SF_LOGIN_URL",
-			"SF_CLIENT_ID",
-			"SF_USERNAME",
-			"SF_PRIVATE_KEY_PATH"
+			["loginUrl", "SF_LOGIN_URL"],
+			["clientId", "SF_CLIENT_ID"],
+			["username", "SF_USERNAME"],
+			["privateKeyPath", "SF_PRIVATE_KEY_PATH"]
 		],
 		sfCli: []
 	};
+	AUTH_ENV_VARS = {
+		clientCredentials: AUTH_FIELDS.clientCredentials.map(([, envName]) => envName),
+		accessToken: AUTH_FIELDS.accessToken.map(([, envName]) => envName),
+		jwtBearer: AUTH_FIELDS.jwtBearer.map(([, envName]) => envName),
+		sfCli: []
+	};
 	AUTH_CHOICES = [
 		{
 			value: "clientCredentials",
@@ -759,13 +964,24 @@ var init_init = __esmMin((() => {
 			label: "JWT bearer (certificate-based, runs as a user)"
 		}
 	];
-	PICKLIST_CHOICES = [{
-		value: "union",
-		label: "Union of values, e.g. \"New\" | \"Closed\" (type-safe)"
-	}, {
-		value: "string",
-		label: "Plain string"
-	}];
+	PICKLIST_CHOICES = [
+		{
+			value: "union",
+			label: "Union of values, e.g. \"New\" | \"Closed\" (type-safe)"
+		},
+		{
+			value: "string",
+			label: "Plain string"
+		},
+		{
+			value: "const",
+			label: "Union plus a named constant per picklist, e.g. CaseStatus.Closed"
+		},
+		{
+			value: "enum",
+			label: "TypeScript enum per picklist (restricted picklists only accept enum members)"
+		}
+	];
 	FORMAT_CHOICES = [{
 		value: "ts",
 		label: "TypeScript (sobjectly.config.ts, type-checked with defineConfig)"
@@ -932,7 +1148,7 @@ async function buildSource(input, options) {
 	const env = options.env ?? process.env;
 	const outputPath = isAbsolute(config.output) ? config.output : resolve(options.cwd ?? process.cwd(), config.output);
 	const client = new SalesforceClient({
-		auth: resolveAuth(config.auth, env),
+		auth: resolveAuth(config.auth, env, { warn: (message) => logger.warn(message) }),
 		apiVersion,
 		transport: config.transport,
 		retry: true
@@ -985,39 +1201,114 @@ function normalizeSource(source) {
 	}
 	return result;
 }
-/** Turns the config's auth setting into an auth provider, reading env-based credentials. */
-function resolveAuth(auth, env) {
+/**
+* Turns the config's auth setting into an auth provider. Each credential comes from its key in
+* the setting (a `"${NAME}"` placeholder is read from `env`), else from the variable a deprecated
+* `*Env` key names, else from its default `SF_*` variable. Throws one error listing every
+* missing credential.
+*/
+function resolveAuth(auth, env, options = {}) {
 	const setting = auth ?? { type: "clientCredentials" };
 	if ("getToken" in setting) return setting;
-	const read = (name) => {
-		const value = env[name];
-		if (!value) throw new Error(`Environment variable ${name} is not set.`);
+	const problems = [];
+	const lookup = (key, defaultEnv) => readCredential(setting, key, defaultEnv, env, options.warn);
+	const read = (key, defaultEnv) => {
+		const { value, problem } = lookup(key, defaultEnv);
+		if (problem) problems.push(problem);
 		return value;
 	};
 	switch (setting.type) {
-		case "accessToken": return accessToken({
-			accessToken: read(setting.accessTokenEnv ?? "SF_ACCESS_TOKEN"),
-			instanceUrl: read(setting.instanceUrlEnv ?? "SF_INSTANCE_URL")
-		});
-		case "jwtBearer": return jwtBearerFromEnv(setting, env, read);
-		case "sfCli": return sfCli({ targetOrg: setting.targetOrg });
-		case "clientCredentials": return clientCredentials({
-			loginUrl: read(setting.loginUrlEnv ?? "SF_LOGIN_URL"),
-			clientId: read(setting.clientIdEnv ?? "SF_CLIENT_ID"),
-			clientSecret: read(setting.clientSecretEnv ?? "SF_CLIENT_SECRET")
-		});
+		case "accessToken": {
+			const token = {
+				accessToken: read("accessToken", "SF_ACCESS_TOKEN"),
+				instanceUrl: read("instanceUrl", "SF_INSTANCE_URL")
+			};
+			throwIfMissing(setting.type, problems);
+			return accessToken(token);
+		}
+		case "jwtBearer": {
+			const loginUrl = read("loginUrl", "SF_LOGIN_URL");
+			const clientId = read("clientId", "SF_CLIENT_ID");
+			const username = read("username", "SF_USERNAME");
+			const configured = PRIVATE_KEY_SOURCES.filter(([key]) => key in setting);
+			const found = (configured.length > 0 ? configured : PRIVATE_KEY_SOURCES).map(([key, defaultEnv]) => ({
+				key,
+				...lookup(key, defaultEnv)
+			}));
+			const source = found.find((item) => item.value);
+			if (source === void 0) problems.push(`no private key: ${found.map((item) => item.problem).join(", and ")}`);
+			throwIfMissing(setting.type, problems);
+			const privateKey = source?.key === "privateKeyPath" ? readFileSync(source.value, "utf8") : source?.value ?? "";
+			return jwtBearer({
+				loginUrl,
+				clientId,
+				username,
+				privateKey
+			});
+		}
+		case "sfCli": {
+			const targetOrg = "targetOrg" in setting ? read("targetOrg", "") : void 0;
+			throwIfMissing(setting.type, problems);
+			return sfCli({ targetOrg });
+		}
+		case "clientCredentials": {
+			const credentials = {
+				loginUrl: read("loginUrl", "SF_LOGIN_URL"),
+				clientId: read("clientId", "SF_CLIENT_ID"),
+				clientSecret: read("clientSecret", "SF_CLIENT_SECRET")
+			};
+			throwIfMissing(setting.type, problems);
+			return clientCredentials(credentials);
+		}
 		default: throw new Error(`Unknown codegen auth type "${setting.type}".`);
 	}
 }
-function jwtBearerFromEnv(setting, env, read) {
-	const keyEnv = setting.privateKeyEnv ?? "SF_PRIVATE_KEY";
-	const privateKey = env[keyEnv] ? read(keyEnv) : readFileSync(read(setting.privateKeyPathEnv ?? "SF_PRIVATE_KEY_PATH"), "utf8");
-	return jwtBearer({
-		loginUrl: read(setting.loginUrlEnv ?? "SF_LOGIN_URL"),
-		clientId: read(setting.clientIdEnv ?? "SF_CLIENT_ID"),
-		username: read(setting.usernameEnv ?? "SF_USERNAME"),
-		privateKey
-	});
+/**
+* Loads the sobjectly config and returns an auth provider for its `auth` setting, so the client
+* logs in the same way as `sobjectly generate`:
+* `new SalesforceClient({ apiVersion: API_VERSION, auth: await loadAuth() })`.
+* Throws when no config file is found, or one error listing every missing credential.
+*/
+async function loadAuth(options = {}) {
+	const cwd = options.cwd ?? process.cwd();
+	let configPath = options.configPath === void 0 ? void 0 : resolve(cwd, options.configPath);
+	if (configPath === void 0) {
+		const found = findConfigFiles(cwd);
+		if (found.length > 1) options.warn?.(`found ${found.join(" and ")}; using ${found[0]}. Remove the other one.`);
+		configPath = found[0];
+	}
+	if (configPath === void 0) throw new Error(`No sobjectly config file found in ${cwd} (looked for ${CONFIG_FILE_NAMES.join(", ")}).\nPass { configPath } to loadAuth(), run "npx sobjectly init" to create a config, or pass an auth provider such as clientCredentials() to SalesforceClient directly.`);
+	const { config } = await loadConfig(configPath);
+	return resolveAuth(config.auth, options.env ?? process.env, { warn: options.warn });
+}
+function readCredential(setting, key, defaultEnv, env, warn) {
+	const values = setting;
+	if (key in values) {
+		const configured = values[key];
+		const name = typeof configured === "string" ? ENV_PLACEHOLDER.exec(configured)?.[1] : void 0;
+		if (name !== void 0) return fromEnv(env, name, ` (from auth.${key} "${String(configured)}")`);
+		return typeof configured === "string" && configured.length > 0 ? { value: configured } : {
+			value: "",
+			problem: `auth.${key} is empty or undefined (if it reads process.env, that variable is not set)`
+		};
+	}
+	const envKey = `${key}Env`;
+	const legacy = values[envKey];
+	if (typeof legacy === "string") {
+		warn?.(`auth.${envKey} is deprecated and will be removed in 2.0. Use ${key}: process.env.${legacy} in a TypeScript config, or "${key}": "\${${legacy}}" in JSON.`);
+		return fromEnv(env, legacy, "");
+	}
+	return fromEnv(env, defaultEnv, "");
+}
+function fromEnv(env, name, origin) {
+	const value = env[name];
+	return value ? { value } : {
+		value: "",
+		problem: `environment variable ${name}${origin} is not set`
+	};
+}
+function throwIfMissing(type, problems) {
+	if (problems.length > 0) throw new Error(`Missing Salesforce credentials for auth "${type}":\n${problems.map((problem) => `  - ${problem}`).join("\n")}\nFill them in under auth in the config, or set the environment variables (e.g. with --env-file .env).`);
 }
 async function resolveSObjectNames(client, config, logger) {
 	const exclude = new Set((config.exclude ?? []).map((name) => name.toLowerCase()));
@@ -1087,24 +1378,26 @@ async function renameWithRetry(from, to) {
 		await new Promise((resolve) => setTimeout(resolve, 50 * attempt));
 	}
 }
-var silentLogger;
+var silentLogger, PRIVATE_KEY_SOURCES, ENV_PLACEHOLDER;
 var init_codegen = __esmMin((() => {
 	init_providers();
 	init_sf_cli();
 	init_client();
 	init_generator();
+	init_load_config();
 	init_validate_config();
 	init_config();
 	init_type_mapper();
-	init_load_config();
 	init_init();
 	init_prompter();
 	silentLogger = {
 		info: () => void 0,
 		warn: () => void 0
 	};
+	PRIVATE_KEY_SOURCES = [["privateKey", "SF_PRIVATE_KEY"], ["privateKeyPath", "SF_PRIVATE_KEY_PATH"]];
+	ENV_PLACEHOLDER = /^\$\{([A-Za-z_][A-Za-z0-9_]*)\}$/;
 }));
 //#endregion
-export { validateConfig as C, FIELD_TYPE_MAP as D, readGeneratedHashes as E, init_type_mapper as O, init_validate_config as S, init_generator as T, defineConfig as _, init_prompter as a, CONFIG_OPTIONS as b, init_init as c, runInit as d, CONFIG_FILE_NAMES as f, loadConfig as g, init_load_config as h, resolveAuth as i, mapFieldType as k, parseSObjects as l, findConfigFiles as m, generate as n, readlinePrompter as o, findConfigFile as p, init_codegen as r, AUTH_ENV_VARS as s, checkGenerated as t, renderConfig as u, init_config as v, generateSource as w, CodegenConfigError as x, AUTH_OPTIONS as y };
+export { FIELD_TYPE_MAP as A, DEPRECATED_AUTH_OPTIONS as C, generateSource as D, validateConfig as E, mapFieldType as M, init_generator as O, CodegenConfigError as S, init_validate_config as T, findConfigFiles as _, resolveAuth as a, AUTH_OPTIONS as b, AUTH_ENV_VARS as c, renderConfig as d, runInit as f, findConfigFile as g, CONFIG_FILE_NAMES as h, loadAuth as i, init_type_mapper as j, readGeneratedHashes as k, init_init as l, init_config as m, generate as n, init_prompter as o, defineConfig as p, init_codegen as r, readlinePrompter as s, checkGenerated as t, parseSObjects as u, init_load_config as v, PICKLIST_MODES as w, CONFIG_OPTIONS as x, loadConfig as y };
 
-//# sourceMappingURL=codegen-CSx0WAtK.mjs.map
+//# sourceMappingURL=codegen-0L2ebG9j.mjs.map