@cerios/salesforce-sobjectly 1.1.0 → 1.2.0

package/README.md

@@ -54,12 +54,19 @@ export default defineConfig({
 	apiVersion: "v66.0",
 	output: "src/generated/sobjects.ts",
 	sobjects: ["Account", "Contact", "Case", "User"],
-	// Reads SF_LOGIN_URL, SF_CLIENT_ID and SF_CLIENT_SECRET from the environment.
-	auth: { type: "clientCredentials" },
+	// Fill these in from process.env (any variable names), a secret store or elsewhere.
+	auth: {
+		type: "clientCredentials",
+		loginUrl: process.env.SF_LOGIN_URL,
+		clientId: process.env.SF_CLIENT_ID,
+		clientSecret: process.env.SF_CLIENT_SECRET,
+	},
 	picklists: "union",
 });
 ```
 
+The variable names are only suggestions; use whatever names your environment already has. A JSON config uses `"${NAME}"` placeholders instead. See [Auth](docs/codegen.md#auth) for every login method.
+
 ### 2. Generate types for your org
 
 ```bash
@@ -79,6 +86,7 @@ const sf = new SalesforceClient<SObjectRegistry>({
 		clientId: process.env.SF_CLIENT_ID!,
 		clientSecret: process.env.SF_CLIENT_SECRET!,
 	}),
+	// or reuse the config's auth: auth: await loadAuth() from "@cerios/salesforce-sobjectly/codegen"
 });
 
 // CRUD
@@ -107,16 +115,16 @@ for await (const contact of sf.iterate(sf.soql("Contact").select("Id", "Email"))
 
 ## 📖 Documentation
 
-| Guide                                                        | What's in it                                                                                            |
-| ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------- |
-| [Authentication](docs/authentication.md)                     | Salesforce CLI, access tokens, client credentials, JWT bearer, refresh tokens, custom providers         |
-| [Code generation](docs/codegen.md)                           | Config reference, type mapping, required fields, picklists, CI usage                                    |
-| [SOQL builder](docs/soql.md)                                 | Selecting, relationships, filters, aggregates, pagination, escaping                                     |
-| [Composite & collections](docs/composite-and-collections.md) | Composite with references, batch, tree, graph, sObject collections                                      |
-| [Approvals, files, reports & more](docs/platform.md)         | Record types, picklists, platform events, approvals, quick actions, UI API, files, reports, query plans |
-| [Bulk API 2.0](docs/bulk.md)                                 | Ingest jobs, query jobs, CSV handling                                                                   |
-| [Transports](docs/transports.md)                             | Custom HTTP clients (axios and Playwright examples), streaming, hooks, retries, timeouts                |
-| [Endpoint coverage](docs/endpoints.md)                       | Which Salesforce REST resources have typed helpers                                                      |
+| Guide                                                        | What's in it                                                                                                 |
+| ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------ |
+| [Authentication](docs/authentication.md)                     | Salesforce CLI, access tokens, client credentials, JWT bearer, refresh tokens, custom providers              |
+| [Code generation](docs/codegen.md)                           | Config reference, type mapping, required fields, picklists, CI usage                                         |
+| [SOQL builder](docs/soql.md)                                 | Selecting, relationships, filters, aggregates, pagination, escaping                                          |
+| [Composite & collections](docs/composite-and-collections.md) | Composite with references, batch, tree, graph, sObject collections                                           |
+| [Approvals, files, reports & more](docs/platform.md)         | Record types, picklists, platform events, approvals, quick actions, UI API, files, reports, query plans      |
+| [Bulk API 2.0](docs/bulk.md)                                 | Ingest jobs, query jobs, CSV handling                                                                        |
+| [Transports](docs/transports.md)                             | Custom HTTP clients (axios and Playwright examples), streaming, hooks and request logging, retries, timeouts |
+| [Endpoint coverage](docs/endpoints.md)                       | Which Salesforce REST resources have typed helpers                                                           |
 
 ## 🧭 API Overview
 

package/dist/cli.cjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-const require_sf_cli = require("./sf-cli-R6LHwqoo.cjs");
-const require_codegen = require("./codegen-Bylrt2Ju.cjs");
+const require_sf_cli = require("./sf-cli-S2BrCbik.cjs");
+const require_codegen = require("./codegen-Daud-Grz.cjs");
 let node_fs = require("node:fs");
 let node_path = require("node:path");
 let node_util = require("node:util");

package/dist/cli.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { Lt as __commonJSMin, Mt as init_api_version, Pt as normalizeApiVersion } from "./sf-cli-_Ua-M_Zi.mjs";
-import { C as init_validate_config, S as PICKLIST_MODES, a as init_prompter, c as init_init, d as runInit, g as loadConfig, l as parseSObjects, m as findConfigFiles, n as generate, o as readlinePrompter, r as init_codegen, t as checkGenerated } from "./codegen-C6MEYiWo.mjs";
+import { Lt as __commonJSMin, Mt as init_api_version, Pt as normalizeApiVersion } from "./sf-cli-D2PgjErx.mjs";
+import { T as init_validate_config, _ as findConfigFiles, f as runInit, l as init_init, n as generate, o as init_prompter, r as init_codegen, s as readlinePrompter, t as checkGenerated, u as parseSObjects, w as PICKLIST_MODES, y as loadConfig } from "./codegen-0L2ebG9j.mjs";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 import { parseArgs } from "node:util";

package/dist/{codegen-C6MEYiWo.mjs → codegen-0L2ebG9j.mjs}

@@ -1,4 +1,4 @@
-import { Mt as init_api_version, Nt as isApiVersion, Pt as normalizeApiVersion, Rt as __esmMin, d as init_client, i as clientCredentials, n as sfCli, o as init_providers, r as accessToken, s as jwtBearer, t as init_sf_cli, u as SalesforceClient } from "./sf-cli-_Ua-M_Zi.mjs";
+import { Mt as init_api_version, Nt as isApiVersion, Pt as normalizeApiVersion, Rt as __esmMin, d as init_client, i as clientCredentials, n as sfCli, o as init_providers, r as accessToken, s as jwtBearer, t as init_sf_cli, u as SalesforceClient } from "./sf-cli-D2PgjErx.mjs";
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
@@ -506,8 +506,17 @@ function validateAuth(value, { json, problem }) {
 		problem(`auth.type: must be one of ${Object.keys(AUTH_OPTIONS).join(", ")}, got ${show(type)}.`);
 		return;
 	}
-	for (const [key, option] of Object.entries(rest)) if (!allowed.includes(key)) problem(`auth.${key}: not an option of "${String(type)}". Valid options: ${allowed.join(", ")}.`);
-	else if (typeof option !== "string" || option.length === 0) problem(`auth.${key}: must be a non-empty string, got ${show(option)}.`);
+	for (const [key, option] of Object.entries(rest)) if (!allowed.includes(key)) {
+		const valid = allowed.filter((name) => !(name in DEPRECATED_AUTH_OPTIONS));
+		problem(`auth.${key}: not an option of "${String(type)}". Valid options: ${valid.join(", ")}.`);
+	} else validateAuthOption(key, option, rest, problem);
+}
+function validateAuthOption(key, option, setting, problem) {
+	const replacement = DEPRECATED_AUTH_OPTIONS[key];
+	if (replacement !== void 0 && replacement in setting) problem(`auth.${key}: use either ${replacement} or ${key}, not both.`);
+	else if (replacement !== void 0) {
+		if (typeof option !== "string" || option.length === 0) problem(`auth.${key}: must be a non-empty string, got ${show(option)}.`);
+	} else if (option !== void 0 && typeof option !== "string") problem(`auth.${key}: must be a string, got ${show(option)}.`);
 }
 function show(value) {
 	if (value === void 0) return "undefined";
@@ -518,7 +527,7 @@ function show(value) {
 		return typeof value;
 	}
 }
-var CodegenConfigError, AUTH_OPTIONS, PICKLIST_MODES, IDENTIFIER, VALIDATORS, CONFIG_OPTIONS;
+var CodegenConfigError, AUTH_OPTIONS, DEPRECATED_AUTH_OPTIONS, PICKLIST_MODES, IDENTIFIER, VALIDATORS, CONFIG_OPTIONS;
 var init_validate_config = __esmMin((() => {
 	init_api_version();
 	CodegenConfigError = class extends Error {
@@ -533,12 +542,25 @@ var init_validate_config = __esmMin((() => {
 	};
 	AUTH_OPTIONS = {
 		clientCredentials: [
+			"loginUrl",
+			"clientId",
+			"clientSecret",
 			"loginUrlEnv",
 			"clientIdEnv",
 			"clientSecretEnv"
 		],
-		accessToken: ["accessTokenEnv", "instanceUrlEnv"],
+		accessToken: [
+			"accessToken",
+			"instanceUrl",
+			"accessTokenEnv",
+			"instanceUrlEnv"
+		],
 		jwtBearer: [
+			"loginUrl",
+			"clientId",
+			"username",
+			"privateKey",
+			"privateKeyPath",
 			"loginUrlEnv",
 			"clientIdEnv",
 			"usernameEnv",
@@ -547,6 +569,16 @@ var init_validate_config = __esmMin((() => {
 		],
 		sfCli: ["targetOrg"]
 	};
+	DEPRECATED_AUTH_OPTIONS = {
+		loginUrlEnv: "loginUrl",
+		clientIdEnv: "clientId",
+		clientSecretEnv: "clientSecret",
+		accessTokenEnv: "accessToken",
+		instanceUrlEnv: "instanceUrl",
+		usernameEnv: "username",
+		privateKeyEnv: "privateKey",
+		privateKeyPathEnv: "privateKeyPath"
+	};
 	PICKLIST_MODES = [
 		"union",
 		"string",
@@ -598,25 +630,6 @@ var init_validate_config = __esmMin((() => {
 	CONFIG_OPTIONS = Object.keys(VALIDATORS).filter((key) => key !== "$schema");
 }));
 //#endregion
-//#region src/codegen/config.ts
-/**
-* Type-checks a `sobjectly.config.ts`. The listed `sobjects` become a literal union, so a typo in
-* a per-sObject option is a compile error:
-*
-* ```ts
-* export default defineConfig({
-* 	apiVersion: "v66.0",
-* 	output: "src/generated/sobjects.ts",
-* 	sobjects: ["Account", "Contact"],
-* 	excludeCreateFields: { Acount: ["Name"] }, // ❌ "Acount" is not in sobjects
-* });
-* ```
-*/
-function defineConfig(config) {
-	return config;
-}
-var init_config = __esmMin((() => {}));
-//#endregion
 //#region src/codegen/load-config.ts
 /** Looks for a `sobjectly.config.{ts,mts,cts,json}` file in `cwd`; the first match in lookup order wins. */
 function findConfigFile(cwd = process.cwd()) {
@@ -671,6 +684,25 @@ var init_load_config = __esmMin((() => {
 	]);
 }));
 //#endregion
+//#region src/codegen/config.ts
+/**
+* Type-checks a `sobjectly.config.ts`. The listed `sobjects` become a literal union, so a typo in
+* a per-sObject option is a compile error:
+*
+* ```ts
+* export default defineConfig({
+* 	apiVersion: "v66.0",
+* 	output: "src/generated/sobjects.ts",
+* 	sobjects: ["Account", "Contact"],
+* 	excludeCreateFields: { Acount: ["Name"] }, // ❌ "Acount" is not in sobjects
+* });
+* ```
+*/
+function defineConfig(config) {
+	return config;
+}
+var init_config = __esmMin((() => {}));
+//#endregion
 //#region src/codegen/init.ts
 /**
 * Creates a `sobjectly.config` file by asking for the API version, output path, sObjects, auth
@@ -785,7 +817,6 @@ function renderJsonConfig(answers) {
 	return `${JSON.stringify(config, null, "	")}\n`;
 }
 function renderTypeScriptConfig(answers) {
-	const envVars = AUTH_ENV_VARS[answers.auth];
 	const sobjects = answers.sobjects.map((name) => JSON.stringify(name)).join(", ");
 	return [
 		"import { defineConfig } from \"@cerios/salesforce-sobjectly/codegen\";",
@@ -797,26 +828,38 @@ function renderTypeScriptConfig(answers) {
 		`\toutput: ${JSON.stringify(answers.output)},`,
 		"	// The sObjects to generate types for.",
 		`\tsobjects: [${sobjects}],`,
-		`\t// ${authComment(answers.auth, envVars)}`,
+		`\t// ${authComment(answers.auth)}`,
 		`\tauth: ${renderAuth(answers)},`,
 		`\tpicklists: ${JSON.stringify(answers.picklists)},`,
 		"});",
 		""
 	].join("\n");
 }
+/** The JSON auth setting: credentials are `"${NAME}"` placeholders, read from the environment. */
 function authSetting(answers) {
-	return answers.auth === "sfCli" && answers.targetOrg ? {
+	if (answers.auth === "sfCli") return answers.targetOrg ? {
 		type: "sfCli",
 		targetOrg: answers.targetOrg
-	} : { type: answers.auth };
+	} : { type: "sfCli" };
+	const fields = AUTH_FIELDS[answers.auth].map(([key, envName]) => [key, `\${${envName}}`]);
+	return {
+		type: answers.auth,
+		...Object.fromEntries(fields)
+	};
 }
+/** The TypeScript auth setting: credentials are read with `process.env`. */
 function renderAuth(answers) {
-	const setting = authSetting(answers);
-	const targetOrg = setting.targetOrg ? `, targetOrg: ${JSON.stringify(setting.targetOrg)}` : "";
-	return `{ type: ${JSON.stringify(setting.type)}${targetOrg} }`;
+	if (answers.auth === "sfCli") return `{ type: "sfCli"${answers.targetOrg ? `, targetOrg: ${JSON.stringify(answers.targetOrg)}` : ""} }`;
+	const fields = AUTH_FIELDS[answers.auth].map(([key, envName]) => `\t\t${key}: process.env.${envName},`);
+	return [
+		"{",
+		`\t\ttype: ${JSON.stringify(answers.auth)},`,
+		...fields,
+		"	}"
+	].join("\n");
 }
-function authComment(auth, envVars) {
-	return auth === "sfCli" ? "Uses an org you are logged into with the Salesforce CLI (sf org login web)." : `Reads ${formatList(envVars)} from the environment.`;
+function authComment(auth) {
+	return auth === "sfCli" ? "Uses an org you are logged into with the Salesforce CLI (sf org login web)." : "Fill these in from process.env (any variable names), a secret store or elsewhere. Keep secrets out of this file.";
 }
 async function maybeUpdateEnvExample(options, auth) {
 	const path = join(options.cwd, ".env.example");
@@ -866,36 +909,43 @@ function printNextSteps(log, answers, scriptAdded, cwd) {
 		"Next steps:",
 		cli ? `  1. Log in with the Salesforce CLI: sf org login web${answers.targetOrg ? ` --alias ${answers.targetOrg}` : " --set-default"}` : `  1. Put ${formatList(AUTH_ENV_VARS[answers.auth])} in a .env file${envIgnored ? "" : " (and add .env to .gitignore)"}.`,
 		`  2. Generate the types: ${command}`,
-		"  3. Use them:",
+		"  3. Use them, logging in with the config's auth:",
+		"       import { loadAuth } from \"@cerios/salesforce-sobjectly/codegen\";",
 		`       import { API_VERSION, type SObjectRegistry } from "./${answers.output.replace(/\.(ts|mts|cts)$/, "")}";`,
-		"       const sf = new SalesforceClient<SObjectRegistry>({ apiVersion: API_VERSION, auth });"
+		"       const sf = new SalesforceClient<SObjectRegistry>({ apiVersion: API_VERSION, auth: await loadAuth() });"
 	].join("\n"));
 }
 function formatList(items) {
 	if (items.length <= 1) return items.join("");
 	return `${items.slice(0, -1).join(", ")} and ${items.at(-1)}`;
 }
-var SOBJECT_NAME, NPM_SCRIPT, AUTH_ENV_VARS, AUTH_CHOICES, PICKLIST_CHOICES, FORMAT_CHOICES, JSON_SCHEMA_REFERENCE;
+var SOBJECT_NAME, NPM_SCRIPT, AUTH_FIELDS, AUTH_ENV_VARS, AUTH_CHOICES, PICKLIST_CHOICES, FORMAT_CHOICES, JSON_SCHEMA_REFERENCE;
 var init_init = __esmMin((() => {
 	init_api_version();
 	init_load_config();
 	SOBJECT_NAME = /^[A-Za-z][A-Za-z0-9_]*$/;
 	NPM_SCRIPT = "sobjects:generate";
-	AUTH_ENV_VARS = {
+	AUTH_FIELDS = {
 		clientCredentials: [
-			"SF_LOGIN_URL",
-			"SF_CLIENT_ID",
-			"SF_CLIENT_SECRET"
+			["loginUrl", "SF_LOGIN_URL"],
+			["clientId", "SF_CLIENT_ID"],
+			["clientSecret", "SF_CLIENT_SECRET"]
 		],
-		accessToken: ["SF_ACCESS_TOKEN", "SF_INSTANCE_URL"],
+		accessToken: [["accessToken", "SF_ACCESS_TOKEN"], ["instanceUrl", "SF_INSTANCE_URL"]],
 		jwtBearer: [
-			"SF_LOGIN_URL",
-			"SF_CLIENT_ID",
-			"SF_USERNAME",
-			"SF_PRIVATE_KEY_PATH"
+			["loginUrl", "SF_LOGIN_URL"],
+			["clientId", "SF_CLIENT_ID"],
+			["username", "SF_USERNAME"],
+			["privateKeyPath", "SF_PRIVATE_KEY_PATH"]
 		],
 		sfCli: []
 	};
+	AUTH_ENV_VARS = {
+		clientCredentials: AUTH_FIELDS.clientCredentials.map(([, envName]) => envName),
+		accessToken: AUTH_FIELDS.accessToken.map(([, envName]) => envName),
+		jwtBearer: AUTH_FIELDS.jwtBearer.map(([, envName]) => envName),
+		sfCli: []
+	};
 	AUTH_CHOICES = [
 		{
 			value: "clientCredentials",
@@ -1098,7 +1148,7 @@ async function buildSource(input, options) {
 	const env = options.env ?? process.env;
 	const outputPath = isAbsolute(config.output) ? config.output : resolve(options.cwd ?? process.cwd(), config.output);
 	const client = new SalesforceClient({
-		auth: resolveAuth(config.auth, env),
+		auth: resolveAuth(config.auth, env, { warn: (message) => logger.warn(message) }),
 		apiVersion,
 		transport: config.transport,
 		retry: true
@@ -1151,39 +1201,114 @@ function normalizeSource(source) {
 	}
 	return result;
 }
-/** Turns the config's auth setting into an auth provider, reading env-based credentials. */
-function resolveAuth(auth, env) {
+/**
+* Turns the config's auth setting into an auth provider. Each credential comes from its key in
+* the setting (a `"${NAME}"` placeholder is read from `env`), else from the variable a deprecated
+* `*Env` key names, else from its default `SF_*` variable. Throws one error listing every
+* missing credential.
+*/
+function resolveAuth(auth, env, options = {}) {
 	const setting = auth ?? { type: "clientCredentials" };
 	if ("getToken" in setting) return setting;
-	const read = (name) => {
-		const value = env[name];
-		if (!value) throw new Error(`Environment variable ${name} is not set.`);
+	const problems = [];
+	const lookup = (key, defaultEnv) => readCredential(setting, key, defaultEnv, env, options.warn);
+	const read = (key, defaultEnv) => {
+		const { value, problem } = lookup(key, defaultEnv);
+		if (problem) problems.push(problem);
 		return value;
 	};
 	switch (setting.type) {
-		case "accessToken": return accessToken({
-			accessToken: read(setting.accessTokenEnv ?? "SF_ACCESS_TOKEN"),
-			instanceUrl: read(setting.instanceUrlEnv ?? "SF_INSTANCE_URL")
-		});
-		case "jwtBearer": return jwtBearerFromEnv(setting, env, read);
-		case "sfCli": return sfCli({ targetOrg: setting.targetOrg });
-		case "clientCredentials": return clientCredentials({
-			loginUrl: read(setting.loginUrlEnv ?? "SF_LOGIN_URL"),
-			clientId: read(setting.clientIdEnv ?? "SF_CLIENT_ID"),
-			clientSecret: read(setting.clientSecretEnv ?? "SF_CLIENT_SECRET")
-		});
+		case "accessToken": {
+			const token = {
+				accessToken: read("accessToken", "SF_ACCESS_TOKEN"),
+				instanceUrl: read("instanceUrl", "SF_INSTANCE_URL")
+			};
+			throwIfMissing(setting.type, problems);
+			return accessToken(token);
+		}
+		case "jwtBearer": {
+			const loginUrl = read("loginUrl", "SF_LOGIN_URL");
+			const clientId = read("clientId", "SF_CLIENT_ID");
+			const username = read("username", "SF_USERNAME");
+			const configured = PRIVATE_KEY_SOURCES.filter(([key]) => key in setting);
+			const found = (configured.length > 0 ? configured : PRIVATE_KEY_SOURCES).map(([key, defaultEnv]) => ({
+				key,
+				...lookup(key, defaultEnv)
+			}));
+			const source = found.find((item) => item.value);
+			if (source === void 0) problems.push(`no private key: ${found.map((item) => item.problem).join(", and ")}`);
+			throwIfMissing(setting.type, problems);
+			const privateKey = source?.key === "privateKeyPath" ? readFileSync(source.value, "utf8") : source?.value ?? "";
+			return jwtBearer({
+				loginUrl,
+				clientId,
+				username,
+				privateKey
+			});
+		}
+		case "sfCli": {
+			const targetOrg = "targetOrg" in setting ? read("targetOrg", "") : void 0;
+			throwIfMissing(setting.type, problems);
+			return sfCli({ targetOrg });
+		}
+		case "clientCredentials": {
+			const credentials = {
+				loginUrl: read("loginUrl", "SF_LOGIN_URL"),
+				clientId: read("clientId", "SF_CLIENT_ID"),
+				clientSecret: read("clientSecret", "SF_CLIENT_SECRET")
+			};
+			throwIfMissing(setting.type, problems);
+			return clientCredentials(credentials);
+		}
 		default: throw new Error(`Unknown codegen auth type "${setting.type}".`);
 	}
 }
-function jwtBearerFromEnv(setting, env, read) {
-	const keyEnv = setting.privateKeyEnv ?? "SF_PRIVATE_KEY";
-	const privateKey = env[keyEnv] ? read(keyEnv) : readFileSync(read(setting.privateKeyPathEnv ?? "SF_PRIVATE_KEY_PATH"), "utf8");
-	return jwtBearer({
-		loginUrl: read(setting.loginUrlEnv ?? "SF_LOGIN_URL"),
-		clientId: read(setting.clientIdEnv ?? "SF_CLIENT_ID"),
-		username: read(setting.usernameEnv ?? "SF_USERNAME"),
-		privateKey
-	});
+/**
+* Loads the sobjectly config and returns an auth provider for its `auth` setting, so the client
+* logs in the same way as `sobjectly generate`:
+* `new SalesforceClient({ apiVersion: API_VERSION, auth: await loadAuth() })`.
+* Throws when no config file is found, or one error listing every missing credential.
+*/
+async function loadAuth(options = {}) {
+	const cwd = options.cwd ?? process.cwd();
+	let configPath = options.configPath === void 0 ? void 0 : resolve(cwd, options.configPath);
+	if (configPath === void 0) {
+		const found = findConfigFiles(cwd);
+		if (found.length > 1) options.warn?.(`found ${found.join(" and ")}; using ${found[0]}. Remove the other one.`);
+		configPath = found[0];
+	}
+	if (configPath === void 0) throw new Error(`No sobjectly config file found in ${cwd} (looked for ${CONFIG_FILE_NAMES.join(", ")}).\nPass { configPath } to loadAuth(), run "npx sobjectly init" to create a config, or pass an auth provider such as clientCredentials() to SalesforceClient directly.`);
+	const { config } = await loadConfig(configPath);
+	return resolveAuth(config.auth, options.env ?? process.env, { warn: options.warn });
+}
+function readCredential(setting, key, defaultEnv, env, warn) {
+	const values = setting;
+	if (key in values) {
+		const configured = values[key];
+		const name = typeof configured === "string" ? ENV_PLACEHOLDER.exec(configured)?.[1] : void 0;
+		if (name !== void 0) return fromEnv(env, name, ` (from auth.${key} "${String(configured)}")`);
+		return typeof configured === "string" && configured.length > 0 ? { value: configured } : {
+			value: "",
+			problem: `auth.${key} is empty or undefined (if it reads process.env, that variable is not set)`
+		};
+	}
+	const envKey = `${key}Env`;
+	const legacy = values[envKey];
+	if (typeof legacy === "string") {
+		warn?.(`auth.${envKey} is deprecated and will be removed in 2.0. Use ${key}: process.env.${legacy} in a TypeScript config, or "${key}": "\${${legacy}}" in JSON.`);
+		return fromEnv(env, legacy, "");
+	}
+	return fromEnv(env, defaultEnv, "");
+}
+function fromEnv(env, name, origin) {
+	const value = env[name];
+	return value ? { value } : {
+		value: "",
+		problem: `environment variable ${name}${origin} is not set`
+	};
+}
+function throwIfMissing(type, problems) {
+	if (problems.length > 0) throw new Error(`Missing Salesforce credentials for auth "${type}":\n${problems.map((problem) => `  - ${problem}`).join("\n")}\nFill them in under auth in the config, or set the environment variables (e.g. with --env-file .env).`);
 }
 async function resolveSObjectNames(client, config, logger) {
 	const exclude = new Set((config.exclude ?? []).map((name) => name.toLowerCase()));
@@ -1253,24 +1378,26 @@ async function renameWithRetry(from, to) {
 		await new Promise((resolve) => setTimeout(resolve, 50 * attempt));
 	}
 }
-var silentLogger;
+var silentLogger, PRIVATE_KEY_SOURCES, ENV_PLACEHOLDER;
 var init_codegen = __esmMin((() => {
 	init_providers();
 	init_sf_cli();
 	init_client();
 	init_generator();
+	init_load_config();
 	init_validate_config();
 	init_config();
 	init_type_mapper();
-	init_load_config();
 	init_init();
 	init_prompter();
 	silentLogger = {
 		info: () => void 0,
 		warn: () => void 0
 	};
+	PRIVATE_KEY_SOURCES = [["privateKey", "SF_PRIVATE_KEY"], ["privateKeyPath", "SF_PRIVATE_KEY_PATH"]];
+	ENV_PLACEHOLDER = /^\$\{([A-Za-z_][A-Za-z0-9_]*)\}$/;
 }));
 //#endregion
-export { mapFieldType as A, init_validate_config as C, readGeneratedHashes as D, init_generator as E, FIELD_TYPE_MAP as O, PICKLIST_MODES as S, generateSource as T, defineConfig as _, init_prompter as a, CONFIG_OPTIONS as b, init_init as c, runInit as d, CONFIG_FILE_NAMES as f, loadConfig as g, init_load_config as h, resolveAuth as i, init_type_mapper as k, parseSObjects as l, findConfigFiles as m, generate as n, readlinePrompter as o, findConfigFile as p, init_codegen as r, AUTH_ENV_VARS as s, checkGenerated as t, renderConfig as u, init_config as v, validateConfig as w, CodegenConfigError as x, AUTH_OPTIONS as y };
+export { FIELD_TYPE_MAP as A, DEPRECATED_AUTH_OPTIONS as C, generateSource as D, validateConfig as E, mapFieldType as M, init_generator as O, CodegenConfigError as S, init_validate_config as T, findConfigFiles as _, resolveAuth as a, AUTH_OPTIONS as b, AUTH_ENV_VARS as c, renderConfig as d, runInit as f, findConfigFile as g, CONFIG_FILE_NAMES as h, loadAuth as i, init_type_mapper as j, readGeneratedHashes as k, init_init as l, init_config as m, generate as n, init_prompter as o, defineConfig as p, init_codegen as r, readlinePrompter as s, checkGenerated as t, parseSObjects as u, init_load_config as v, PICKLIST_MODES as w, CONFIG_OPTIONS as x, loadConfig as y };
 
-//# sourceMappingURL=codegen-C6MEYiWo.mjs.map
+//# sourceMappingURL=codegen-0L2ebG9j.mjs.map