@cimplify/cli 0.14.0 → 0.15.1

package/README.md

@@ -34,7 +34,7 @@ cimplify lint --fix --format json               # safe fixes + stable machine-re
 ## Conventions
 
 - **Project link:** `cimplify link <project-id>` writes `.cimplify/project.json` in the working directory. Subsequent commands read it to know which project to act on — no `--project` flag needed for the common case.
-- **Auth:** credentials persist at `~/.config/cimplify/auth.json`. CI uses `--api-key dk_live_…` to skip the browser.
+- **Auth:** credentials persist at `~/.config/cimplify/auth.json`. Headless login accepts a user-bound Personal key via `--api-key cak_…`.
 - **JSON mode:** pass `--json` (or set `CIMPLIFY_JSON=1`) for `{ ok, data | error }` machine-readable output on stdout.
 - **Lint rules:** `cimplify lint` reads the current project's `@cimplify/sdk/lint-rules` JSON as bounded, validated data and falls back to the rule set bundled with the CLI when an older SDK has no rules asset. It never imports project code. Exit 0 means clean, 1 means diagnostics remain, and 2 means the lint run itself could not start.
 - **Yes/no prompts:** pass `--yes` (or `-y`) to auto-confirm.

package/dist/{add-PPUGTTDA.mjs → add-X3OUBJ7D.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { REGISTRY_INDEX, REGISTRY } from './chunk-JOF7ESSA.mjs';
-import { promptYesNo } from './chunk-5ZQURRIM.mjs';
+import { promptYesNo } from './chunk-TH4XENKH.mjs';
+import { REGISTRY_INDEX, REGISTRY } from './chunk-MTEMM6WI.mjs';
 import { parseArgs, flagString, flagBool } from './chunk-5KYR6WJB.mjs';
-import { CliError, CLI_ERROR_CODE, info, bold, dim, success, result, yellow } from './chunk-4O4G2CDE.mjs';
+import { CliError, CLI_ERROR_CODE, info, bold, dim, success, result, yellow } from './chunk-3QUK5BPY.mjs';
 import { mkdirSync, existsSync, writeFileSync } from 'fs';
 import { resolve, join, dirname } from 'path';
 

package/dist/{assets-OEY6FHHZ.mjs → assets-CWB72PZG.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { parseArgs, flagString, flagBool } from './chunk-5KYR6WJB.mjs';
-import { ApiClient } from './chunk-TOQGLBWF.mjs';
-import { readAuth } from './chunk-6CHBU7O4.mjs';
-import { CliError, CLI_ERROR_CODE, step, yellow, dim, success, info, result, bold, green } from './chunk-4O4G2CDE.mjs';
+import { ApiClient } from './chunk-NYXA6X56.mjs';
+import { readAuth } from './chunk-MLE4MVYC.mjs';
+import { CliError, CLI_ERROR_CODE, step, yellow, dim, success, info, result, bold, green } from './chunk-3QUK5BPY.mjs';
 import { createHash } from 'crypto';
 import { promises } from 'fs';
 import path from 'path';

package/dist/{auth-step-up-ALEUQUCE.mjs → auth-step-up-Z6KOTTV7.mjs}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
-import { startLoopbackServer, generateState, openBrowser } from './chunk-IK6NQHTG.mjs';
+import { startLoopbackServer, generateState, generatePkcePair, openBrowser } from './chunk-DMLQBAGC.mjs';
 import { parseArgs, flagString, flagBool } from './chunk-5KYR6WJB.mjs';
-import { resolveBaseUrl } from './chunk-TOQGLBWF.mjs';
-import { readAuth, writeStepUp } from './chunk-6CHBU7O4.mjs';
-import { isJsonMode, CliError, CLI_ERROR_CODE, step, info, dim, success, result } from './chunk-4O4G2CDE.mjs';
+import { resolveBaseUrl, ApiClient } from './chunk-NYXA6X56.mjs';
+import { readAuth, writeStepUp } from './chunk-MLE4MVYC.mjs';
+import { isJsonMode, CliError, CLI_ERROR_CODE, step, info, dim, success, result } from './chunk-3QUK5BPY.mjs';
 
 // src/commands/auth-step-up.ts
 var FLAG_NO_BROWSER = "no-browser";
 var FLAG_BASE_URL = "base-url";
 var STEP_UP_PATH = "/cli/step-up";
-var STEP_UP_JWT_TTL_MS = 5 * 6e4;
+var STEP_UP_EXCHANGE_PATH = "/v1/auth/cli/step-up/exchange";
 var CALLBACK_TIMEOUT_MS = 10 * 6e4;
 async function run(argv) {
   if (isJsonMode()) {
@@ -26,8 +26,10 @@ async function run(argv) {
   const loopback = await startLoopbackServer(baseUrl);
   const state = generateState();
   const requestId = generateState();
+  const pkce = generatePkcePair();
   const url = new URL(`${dashboardUrl}${STEP_UP_PATH}`);
   url.searchParams.set("request_id", requestId);
+  url.searchParams.set("code_challenge", pkce.codeChallenge);
   url.searchParams.set("redirect_uri", loopback.redirectUri);
   url.searchParams.set("state", state);
   step("Opening browser for fresh-auth...");
@@ -51,20 +53,23 @@ async function run(argv) {
       "Step-up state mismatch. Possible CSRF attempt \u2014 try again."
     );
   }
-  if (!callback.step_up_token) {
-    throw new CliError(
-      CLI_ERROR_CODE.UNAUTHORIZED,
-      "Step-up callback missing step_up_token."
-    );
+  if (!callback.code) {
+    throw new CliError(CLI_ERROR_CODE.UNAUTHORIZED, "Step-up callback missing one-time code.");
   }
+  const exchange = await ApiClient.unauthenticated(baseUrl).post(STEP_UP_EXCHANGE_PATH, {
+    request_id: requestId,
+    code: callback.code,
+    code_verifier: pkce.codeVerifier
+  });
+  const ttlMs = exchange.expires_in_secs * 1e3;
   const token = {
-    token: callback.step_up_token,
-    expiresAt: Date.now() + STEP_UP_JWT_TTL_MS,
+    token: exchange.step_up_token,
+    expiresAt: Date.now() + ttlMs,
     savedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   await writeStepUp(token);
   success(
-    `Step-up complete. Re-run your destructive command within ${Math.round(STEP_UP_JWT_TTL_MS / 6e4)} minutes.`
+    `Step-up complete. Re-run your destructive command within ${Math.max(1, Math.floor(ttlMs / 6e4))} minutes.`
   );
   result({
     step_up_active: true,
@@ -73,10 +78,7 @@ async function run(argv) {
   });
 }
 function deriveDashboardUrl(apiBaseUrl) {
-  return apiBaseUrl.replace(
-    /^https?:\/\/api\./,
-    (m) => m.replace("api.", "app.")
-  );
+  return apiBaseUrl.replace(/^https?:\/\/api\./, (m) => m.replace("api.", "app."));
 }
 
 export { run as default };

package/dist/{cancel-FD66LTTS.mjs → cancel-ZHVVILOU.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { parseArgs } from './chunk-5KYR6WJB.mjs';
-import { ApiClient } from './chunk-TOQGLBWF.mjs';
-import { readAuth, readProjectLink } from './chunk-6CHBU7O4.mjs';
-import { CliError, CLI_ERROR_CODE, success, result } from './chunk-4O4G2CDE.mjs';
+import { ApiClient } from './chunk-NYXA6X56.mjs';
+import { readAuth, readProjectLink } from './chunk-MLE4MVYC.mjs';
+import { CliError, CLI_ERROR_CODE, success, result } from './chunk-3QUK5BPY.mjs';
 
 // src/commands/cancel.ts
 function cancelEndpoint(businessId, projectId, deploymentId) {

package/dist/{chunk-4O4G2CDE.mjs → chunk-3QUK5BPY.mjs}

@@ -18,7 +18,9 @@ var CLI_ERROR_CODE = {
   /** Generic resource-not-found (e.g. unknown registry component, missing local fixture). */
   NOT_FOUND: "NOT_FOUND",
   /** Destructive op needs a fresh user re-auth — run `cimplify auth step-up`. */
-  STEP_UP_REQUIRED: "STEP_UP_REQUIRED"
+  STEP_UP_REQUIRED: "STEP_UP_REQUIRED",
+  /** The project's local build failed, so the deploy was not started. */
+  BUILD_FAILED: "BUILD_FAILED"
 };
 var EXIT_CODE = {
   OK: 0,
@@ -38,7 +40,8 @@ var EXIT_CODE = {
   AUTH_FAILED: 21,
   UNAUTHORIZED: 22,
   STEP_UP_REQUIRED: 23,
-  INVALID_INPUT: 30
+  INVALID_INPUT: 30,
+  BUILD_FAILED: 31
 };
 var EXIT_CODE_FOR = {
   NOT_LOGGED_IN: EXIT_CODE.NOT_LOGGED_IN,
@@ -55,7 +58,8 @@ var EXIT_CODE_FOR = {
   TIMEOUT: EXIT_CODE.TIMEOUT,
   INTERACTIVE_REQUIRED: EXIT_CODE.INTERACTIVE_REQUIRED,
   NOT_FOUND: EXIT_CODE.NOT_FOUND,
-  STEP_UP_REQUIRED: EXIT_CODE.STEP_UP_REQUIRED
+  STEP_UP_REQUIRED: EXIT_CODE.STEP_UP_REQUIRED,
+  BUILD_FAILED: EXIT_CODE.BUILD_FAILED
 };
 var CliError = class extends Error {
   code;

package/dist/{chunk-7CI5RWNE.mjs → chunk-A6WHBSXZ.mjs}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-import { promptYesNo } from './chunk-5ZQURRIM.mjs';
+import { promptYesNo } from './chunk-TH4XENKH.mjs';
 import { TOKEN_PURPOSE, REPO_PROVIDER, REPO_PROVIDER_VALUES } from './chunk-MXYUAJEW.mjs';
-import { gitRemoteHead } from './chunk-YIBOOKQQ.mjs';
+import { gitRemoteHead } from './chunk-KN2YSKXZ.mjs';
 import { parseArgs, flagString, flagBool } from './chunk-5KYR6WJB.mjs';
-import { ApiClient } from './chunk-TOQGLBWF.mjs';
-import { readAuth, readProjectLink } from './chunk-6CHBU7O4.mjs';
-import { CliError, CLI_ERROR_CODE, isJsonMode, result, dim, success, info, bold } from './chunk-4O4G2CDE.mjs';
+import { ApiClient } from './chunk-NYXA6X56.mjs';
+import { readAuth, readProjectLink } from './chunk-MLE4MVYC.mjs';
+import { CliError, CLI_ERROR_CODE, isJsonMode, result, dim, success, info, bold } from './chunk-3QUK5BPY.mjs';
 
 // src/commands/repo.ts
 var SUB_PROVISION = "provision";

package/dist/{chunk-IK6NQHTG.mjs → chunk-DMLQBAGC.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { CliError, CLI_ERROR_CODE } from './chunk-4O4G2CDE.mjs';
+import { CliError, CLI_ERROR_CODE } from './chunk-3QUK5BPY.mjs';
 import { randomBytes, createHash } from 'crypto';
 import { createServer } from 'http';
 import { spawn } from 'child_process';
@@ -11,9 +11,7 @@ var CALLBACK_PATH = "/callback";
 var CALLBACK_TIMEOUT_MS = 10 * 60 * 1e3;
 function generatePkcePair() {
   const codeVerifier = base64UrlEncode(randomBytes(CODE_VERIFIER_BYTES));
-  const codeChallenge = base64UrlEncode(
-    createHash("sha256").update(codeVerifier).digest()
-  );
+  const codeChallenge = base64UrlEncode(createHash("sha256").update(codeVerifier).digest());
   return { codeVerifier, codeChallenge, codeChallengeMethod: "S256" };
 }
 function generateState() {
@@ -69,7 +67,6 @@ async function startLoopbackServer(apiBaseUrl) {
       return;
     }
     const code = parsed.searchParams.get("code");
-    const stepUpToken = parsed.searchParams.get("step_up_token");
     const state = parsed.searchParams.get("state");
     const error = parsed.searchParams.get("error");
     if (error) {
@@ -77,7 +74,7 @@ async function startLoopbackServer(apiBaseUrl) {
       rejectCb?.(new CliError(CLI_ERROR_CODE.UNAUTHORIZED, `OAuth error: ${error}`));
       return;
     }
-    if (!state || !code && !stepUpToken) {
+    if (!state || !code) {
       res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" }).end(HTML_ERROR("Missing code or token in callback"));
       rejectCb?.(new CliError(CLI_ERROR_CODE.UNAUTHORIZED, "Malformed callback"));
       return;
@@ -85,7 +82,6 @@ async function startLoopbackServer(apiBaseUrl) {
     res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" }).end(HTML_SUCCESS(apiBaseUrl));
     resolveCb?.({
       code: code ?? void 0,
-      step_up_token: stepUpToken ?? void 0,
       state
     });
   });
@@ -96,10 +92,7 @@ async function startLoopbackServer(apiBaseUrl) {
   const address = server.address();
   if (!address || typeof address === "string") {
     server.close();
-    throw new CliError(
-      CLI_ERROR_CODE.UNAUTHORIZED,
-      "Could not bind loopback server"
-    );
+    throw new CliError(CLI_ERROR_CODE.UNAUTHORIZED, "Could not bind loopback server");
   }
   const redirectUri = `http://${LOOPBACK_HOST}:${address.port}${CALLBACK_PATH}`;
   return {

package/dist/{dev-L3W6UXYN.mjs → chunk-F2UI225N.mjs}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { parseEnvFile, formatEnvFile } from './chunk-RU53TQLZ.mjs';
+import { parseEnvFile, formatEnvFile } from './chunk-I2UP7YTG.mjs';
 import { ENV_SCOPE, PUBLIC_ENV_PREFIX } from './chunk-MXYUAJEW.mjs';
 import { parseArgs, flagBool } from './chunk-5KYR6WJB.mjs';
-import { ApiClient } from './chunk-TOQGLBWF.mjs';
-import { readAuth, readProjectLink } from './chunk-6CHBU7O4.mjs';
-import { info, CliError, CLI_ERROR_CODE, dim } from './chunk-4O4G2CDE.mjs';
+import { ApiClient } from './chunk-NYXA6X56.mjs';
+import { readAuth, readProjectLink } from './chunk-MLE4MVYC.mjs';
+import { info, CliError, CLI_ERROR_CODE, dim } from './chunk-3QUK5BPY.mjs';
 import { spawn } from 'child_process';
 import { promises } from 'fs';
 import path from 'path';
@@ -159,4 +159,4 @@ async function run(argv) {
   });
 }
 
-export { run as default, detectPackageManager, mergeEnvEntries };
+export { detectPackageManager, mergeEnvEntries, run };

package/dist/{chunk-RU53TQLZ.mjs → chunk-I2UP7YTG.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { CliError, CLI_ERROR_CODE } from './chunk-4O4G2CDE.mjs';
+import { CliError, CLI_ERROR_CODE } from './chunk-3QUK5BPY.mjs';
 
 // src/envfile.ts
 var COMMENT_CHAR = "#";

package/dist/{chunk-YIBOOKQQ.mjs → chunk-KN2YSKXZ.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { CliError, CLI_ERROR_CODE } from './chunk-4O4G2CDE.mjs';
+import { CliError, CLI_ERROR_CODE } from './chunk-3QUK5BPY.mjs';
 import { spawn } from 'child_process';
 
 var GIT_BINARY = "git";

package/dist/{chunk-KAZMZD4X.mjs → chunk-MGQD5MEC.mjs}

@@ -2,7 +2,7 @@
 // package.json
 var package_default = {
   name: "@cimplify/cli",
-  version: "0.14.0",
+  version: "0.15.1",
   description: "Cimplify CLI \u2014 deploy, manage env vars, link projects, and scaffold storefronts",
   keywords: [
     "cimplify",
@@ -43,7 +43,7 @@ var package_default = {
     "@babel/parser": "^8.0.4",
     "@babel/traverse": "^8.0.4",
     "@babel/types": "^8.0.4",
-    "@cimplify/sdk": "^0.101.1",
+    "@cimplify/sdk": "^0.104.1",
     re2js: "^1.4.0"
   },
   devDependencies: {
@@ -54,7 +54,7 @@ var package_default = {
     "@typescript/native-preview": "^7.0.0-dev.20260616.1",
     tsup: "^8.5.1",
     typescript: "6.0.3",
-    vitest: "^4.1.9"
+    vitest: "^4.1.10"
   }
 };
 

package/dist/{chunk-6CHBU7O4.mjs → chunk-MLE4MVYC.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { CliError, CLI_ERROR_CODE } from './chunk-4O4G2CDE.mjs';
+import { CliError, CLI_ERROR_CODE } from './chunk-3QUK5BPY.mjs';
 import { promises } from 'fs';
 import os from 'os';
 import path from 'path';