@cimplify/cli 0.3.1 → 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (47) hide show
  1. package/dist/{add-OUMIT4YX.mjs → add-MX4655EX.mjs} +3 -3
  2. package/dist/{assets-DMK2QOPD.mjs → assets-EBEMMENZ.mjs} +3 -3
  3. package/dist/auth-step-up-BIUYQJP6.mjs +82 -0
  4. package/dist/{chunk-I6P3I2YJ.mjs → chunk-AY23RQE6.mjs} +5 -5
  5. package/dist/{chunk-YI7UMMM7.mjs → chunk-DBZ3UOQ2.mjs} +1 -1
  6. package/dist/{chunk-IQJ45AK3.mjs → chunk-DCWHOH2S.mjs} +4 -1
  7. package/dist/{chunk-I3XQSSOT.mjs → chunk-E2T2SBP5.mjs} +6 -2
  8. package/dist/{login-7O7ZXKU3.mjs → chunk-GLXONXS3.mjs} +10 -126
  9. package/dist/{chunk-RZQTHTXX.mjs → chunk-ITAFAORS.mjs} +1 -1
  10. package/dist/{chunk-RRY3NEZZ.mjs → chunk-K5464A3L.mjs} +1 -1
  11. package/dist/{chunk-D7WMSGKK.mjs → chunk-MAOO6ZZ5.mjs} +22 -3
  12. package/dist/{chunk-QGBXGDA5.mjs → chunk-R3FDBXR6.mjs} +4 -4
  13. package/dist/{chunk-LS2VTSMQ.mjs → chunk-UBAI443T.mjs} +9 -2
  14. package/dist/{chunk-MOZQODQS.mjs → chunk-VTR5R5NQ.mjs} +1 -1
  15. package/dist/{chunk-42PFJBC6.mjs → chunk-Z5DEA7YM.mjs} +8 -8
  16. package/dist/{deploy-UKOOPJAE.mjs → deploy-3IFXUWPM.mjs} +7 -7
  17. package/dist/{dev-FD4PM3UD.mjs → dev-ONW2S77K.mjs} +4 -4
  18. package/dist/dispatcher.mjs +39 -26
  19. package/dist/{doctor-AY7VDIJZ.mjs → doctor-DGO3UAJB.mjs} +8 -8
  20. package/dist/{domains-JQMV6GAP.mjs → domains-AHH56CL7.mjs} +4 -4
  21. package/dist/{env-EVMYQUIK.mjs → env-7ISJ73YI.mjs} +5 -5
  22. package/dist/{explain-QZVAK5I3.mjs → explain-IJLIQUYJ.mjs} +2 -2
  23. package/dist/introspect-KID4YJYV.mjs +8 -0
  24. package/dist/{link-X3E4UZBF.mjs → link-DZSILT5N.mjs} +3 -3
  25. package/dist/{list-TEQ73IR7.mjs → list-5PMRTZV3.mjs} +2 -2
  26. package/dist/login-3OD4ND2H.mjs +153 -0
  27. package/dist/{logout-DJDINVDF.mjs → logout-3RLBZ33M.mjs} +2 -2
  28. package/dist/{logs-KUKGEXR2.mjs → logs-YNN2PQ24.mjs} +3 -3
  29. package/dist/{projects-364HGWHO.mjs → projects-JSEC2YCX.mjs} +3 -3
  30. package/dist/repo-WOBWKEAO.mjs +8 -0
  31. package/dist/{rollback-5YALPQXL.mjs → rollback-DD4RNRFM.mjs} +4 -4
  32. package/dist/{status-W4HW3CX3.mjs → status-JSYXM5RT.mjs} +3 -3
  33. package/dist/{unlink-HIIW57OO.mjs → unlink-RFK74SFP.mjs} +2 -2
  34. package/dist/{update-2DCENLHM.mjs → update-64K4Z3SF.mjs} +3 -3
  35. package/dist/{whoami-LACWBSNL.mjs → whoami-DNZ7RUTH.mjs} +3 -3
  36. package/package.json +4 -1
  37. package/templates/manifest.json +166 -0
  38. package/templates/storefront-auto/metadata.json +13 -0
  39. package/templates/storefront-bakery/metadata.json +13 -0
  40. package/templates/storefront-fashion/metadata.json +13 -0
  41. package/templates/storefront-grocery/metadata.json +13 -0
  42. package/templates/storefront-pharmacy/metadata.json +13 -0
  43. package/templates/storefront-restaurant/metadata.json +13 -0
  44. package/templates/storefront-retail/metadata.json +13 -0
  45. package/templates/storefront-services/metadata.json +13 -0
  46. package/dist/introspect-MNTC26UY.mjs +0 -8
  47. package/dist/repo-26N2CHF6.mjs +0 -8
@@ -1,8 +1,8 @@
1
1
  #!/usr/bin/env node
2
- import { REGISTRY_INDEX, REGISTRY } from './chunk-42PFJBC6.mjs';
3
- import { promptYesNo } from './chunk-RZQTHTXX.mjs';
2
+ import { REGISTRY_INDEX, REGISTRY } from './chunk-Z5DEA7YM.mjs';
3
+ import { promptYesNo } from './chunk-ITAFAORS.mjs';
4
4
  import { parseArgs, flagString, flagBool } from './chunk-C4M3DXKC.mjs';
5
- import { CliError, CLI_ERROR_CODE, info, bold, dim, success, result, yellow } from './chunk-I3XQSSOT.mjs';
5
+ import { CliError, CLI_ERROR_CODE, info, bold, dim, success, result, yellow } from './chunk-E2T2SBP5.mjs';
6
6
  import { mkdirSync, existsSync, writeFileSync } from 'fs';
7
7
  import { resolve, join, dirname } from 'path';
8
8
 
@@ -1,8 +1,8 @@
1
1
  #!/usr/bin/env node
2
2
  import { parseArgs, flagString, flagBool } from './chunk-C4M3DXKC.mjs';
3
- import { ApiClient } from './chunk-D7WMSGKK.mjs';
4
- import { readAuth } from './chunk-LS2VTSMQ.mjs';
5
- import { CliError, CLI_ERROR_CODE, step, yellow, dim, success, info, result, bold, green } from './chunk-I3XQSSOT.mjs';
3
+ import { ApiClient } from './chunk-MAOO6ZZ5.mjs';
4
+ import { readAuth } from './chunk-UBAI443T.mjs';
5
+ import { CliError, CLI_ERROR_CODE, step, yellow, dim, success, info, result, bold, green } from './chunk-E2T2SBP5.mjs';
6
6
  import { createHash } from 'crypto';
7
7
  import { promises } from 'fs';
8
8
  import path from 'path';
@@ -0,0 +1,82 @@
1
+ #!/usr/bin/env node
2
+ import { startLoopbackServer, generateState, openBrowser } from './chunk-GLXONXS3.mjs';
3
+ import { parseArgs, flagString, flagBool } from './chunk-C4M3DXKC.mjs';
4
+ import { resolveBaseUrl } from './chunk-MAOO6ZZ5.mjs';
5
+ import { readAuth, writeStepUp } from './chunk-UBAI443T.mjs';
6
+ import { isJsonMode, CliError, CLI_ERROR_CODE, step, info, dim, success, result } from './chunk-E2T2SBP5.mjs';
7
+
8
+ // src/commands/auth-step-up.ts
9
+ var FLAG_NO_BROWSER = "no-browser";
10
+ var FLAG_BASE_URL = "base-url";
11
+ var STEP_UP_PATH = "/cli/step-up";
12
+ var STEP_UP_JWT_TTL_MS = 5 * 6e4;
13
+ var CALLBACK_TIMEOUT_MS = 10 * 6e4;
14
+ async function run(argv) {
15
+ if (isJsonMode()) {
16
+ throw new CliError(
17
+ CLI_ERROR_CODE.INTERACTIVE_REQUIRED,
18
+ "step-up needs an interactive browser; --json mode is unsupported.",
19
+ { remediation: "Run from a terminal with a browser available." }
20
+ );
21
+ }
22
+ const args = parseArgs(argv);
23
+ const baseUrl = resolveBaseUrl(flagString(args, FLAG_BASE_URL));
24
+ const auth = await readAuth();
25
+ const dashboardUrl = deriveDashboardUrl(baseUrl);
26
+ const loopback = await startLoopbackServer(baseUrl);
27
+ const state = generateState();
28
+ const requestId = generateState();
29
+ const url = new URL(`${dashboardUrl}${STEP_UP_PATH}`);
30
+ url.searchParams.set("request_id", requestId);
31
+ url.searchParams.set("redirect_uri", loopback.redirectUri);
32
+ url.searchParams.set("state", state);
33
+ step("Opening browser for fresh-auth...");
34
+ info(dim(url.toString()));
35
+ if (!flagBool(args, FLAG_NO_BROWSER)) {
36
+ openBrowser(url.toString());
37
+ } else {
38
+ info("");
39
+ info(dim("Open the URL above in any browser to continue."));
40
+ }
41
+ let callback;
42
+ try {
43
+ callback = await loopback.awaitCallback(CALLBACK_TIMEOUT_MS);
44
+ } catch (err) {
45
+ loopback.close();
46
+ throw err;
47
+ }
48
+ if (callback.state !== state) {
49
+ throw new CliError(
50
+ CLI_ERROR_CODE.UNAUTHORIZED,
51
+ "Step-up state mismatch. Possible CSRF attempt \u2014 try again."
52
+ );
53
+ }
54
+ if (!callback.step_up_token) {
55
+ throw new CliError(
56
+ CLI_ERROR_CODE.UNAUTHORIZED,
57
+ "Step-up callback missing step_up_token."
58
+ );
59
+ }
60
+ const token = {
61
+ token: callback.step_up_token,
62
+ expiresAt: Date.now() + STEP_UP_JWT_TTL_MS,
63
+ savedAt: (/* @__PURE__ */ new Date()).toISOString()
64
+ };
65
+ await writeStepUp(token);
66
+ success(
67
+ `Step-up complete. Re-run your destructive command within ${Math.round(STEP_UP_JWT_TTL_MS / 6e4)} minutes.`
68
+ );
69
+ result({
70
+ step_up_active: true,
71
+ expires_at: new Date(token.expiresAt).toISOString(),
72
+ account: { id: auth.accountId }
73
+ });
74
+ }
75
+ function deriveDashboardUrl(apiBaseUrl) {
76
+ return apiBaseUrl.replace(
77
+ /^https?:\/\/api\./,
78
+ (m) => m.replace("api.", "app.")
79
+ );
80
+ }
81
+
82
+ export { run as default };
@@ -1,10 +1,10 @@
1
1
  #!/usr/bin/env node
2
- import { gitDetectRoot, gitCurrentBranch, gitCurrentSha, gitStatusPorcelain } from './chunk-RRY3NEZZ.mjs';
3
- import { parseEnvFile } from './chunk-YI7UMMM7.mjs';
4
- import { package_default } from './chunk-IQJ45AK3.mjs';
2
+ import { gitDetectRoot, gitCurrentBranch, gitCurrentSha, gitStatusPorcelain } from './chunk-K5464A3L.mjs';
3
+ import { parseEnvFile } from './chunk-DBZ3UOQ2.mjs';
4
+ import { package_default } from './chunk-DCWHOH2S.mjs';
5
5
  import { parseArgs } from './chunk-C4M3DXKC.mjs';
6
- import { readAuthOrNull, readProjectLinkOrNull, readProjectState } from './chunk-LS2VTSMQ.mjs';
7
- import { bold, dim, yellow, green, info, result, red } from './chunk-I3XQSSOT.mjs';
6
+ import { readAuthOrNull, readProjectLinkOrNull, readProjectState } from './chunk-UBAI443T.mjs';
7
+ import { bold, dim, yellow, green, info, result, red } from './chunk-E2T2SBP5.mjs';
8
8
  import { promises } from 'fs';
9
9
  import path from 'path';
10
10
 
@@ -1,5 +1,5 @@
1
1
  #!/usr/bin/env node
2
- import { CliError, CLI_ERROR_CODE } from './chunk-I3XQSSOT.mjs';
2
+ import { CliError, CLI_ERROR_CODE } from './chunk-E2T2SBP5.mjs';
3
3
 
4
4
  // src/envfile.ts
5
5
  var COMMENT_CHAR = "#";
@@ -2,7 +2,7 @@
2
2
  // package.json
3
3
  var package_default = {
4
4
  name: "@cimplify/cli",
5
- version: "0.3.1",
5
+ version: "0.5.0",
6
6
  description: "Cimplify CLI \u2014 deploy, manage env vars, link projects, and scaffold storefronts",
7
7
  keywords: [
8
8
  "cimplify",
@@ -25,6 +25,8 @@ var package_default = {
25
25
  "build:binary": "bun run bundle-assets && bun scripts/build-binaries.ts",
26
26
  "build:binary:local": "bun run bundle-assets && bun scripts/build-binaries.ts --local",
27
27
  "sync:template-pins": "bun scripts/sync-template-pins.ts",
28
+ "publish:templates": "bun scripts/publish-templates.ts",
29
+ "publish:templates:dry": "bun scripts/publish-templates.ts --dry-run",
28
30
  version: "bun scripts/sync-template-pins.ts && git add templates/*/package.json",
29
31
  prepublishOnly: "bun scripts/sync-template-pins.ts && bun run build",
30
32
  dev: "bun run bundle-assets && tsup --watch",
@@ -37,6 +39,7 @@ var package_default = {
37
39
  "test:run": "vitest run"
38
40
  },
39
41
  devDependencies: {
42
+ "@aws-sdk/client-s3": "^3.700.0",
40
43
  "@types/node": "^25.6.0",
41
44
  "@typescript/native-preview": "^7.0.0-dev.20260503.1",
42
45
  tsup: "^8.5.1",
@@ -16,7 +16,9 @@ var CLI_ERROR_CODE = {
16
16
  /** Operation needs interactive confirmation and the shell is non-interactive. */
17
17
  INTERACTIVE_REQUIRED: "INTERACTIVE_REQUIRED",
18
18
  /** Generic resource-not-found (e.g. unknown registry component, missing local fixture). */
19
- NOT_FOUND: "NOT_FOUND"
19
+ NOT_FOUND: "NOT_FOUND",
20
+ /** Destructive op needs a fresh user re-auth — run `cimplify auth step-up`. */
21
+ STEP_UP_REQUIRED: "STEP_UP_REQUIRED"
20
22
  };
21
23
  var EXIT_CODE = {
22
24
  OK: 0,
@@ -35,6 +37,7 @@ var EXIT_CODE = {
35
37
  NOT_LOGGED_IN: 20,
36
38
  AUTH_FAILED: 21,
37
39
  UNAUTHORIZED: 22,
40
+ STEP_UP_REQUIRED: 23,
38
41
  INVALID_INPUT: 30
39
42
  };
40
43
  var EXIT_CODE_FOR = {
@@ -51,7 +54,8 @@ var EXIT_CODE_FOR = {
51
54
  UNAUTHORIZED: EXIT_CODE.UNAUTHORIZED,
52
55
  TIMEOUT: EXIT_CODE.TIMEOUT,
53
56
  INTERACTIVE_REQUIRED: EXIT_CODE.INTERACTIVE_REQUIRED,
54
- NOT_FOUND: EXIT_CODE.NOT_FOUND
57
+ NOT_FOUND: EXIT_CODE.NOT_FOUND,
58
+ STEP_UP_REQUIRED: EXIT_CODE.STEP_UP_REQUIRED
55
59
  };
56
60
  var CliError = class extends Error {
57
61
  code;
@@ -1,9 +1,5 @@
1
1
  #!/usr/bin/env node
2
- import { parseArgs, flagString, flagBool } from './chunk-C4M3DXKC.mjs';
3
- import { resolveBaseUrl, ApiClient } from './chunk-D7WMSGKK.mjs';
4
- import { writeAuth } from './chunk-LS2VTSMQ.mjs';
5
- import { CliError, CLI_ERROR_CODE, success, result, isJsonMode, step, info, dim } from './chunk-I3XQSSOT.mjs';
6
- import os from 'os';
2
+ import { CliError, CLI_ERROR_CODE } from './chunk-E2T2SBP5.mjs';
7
3
  import { randomBytes, createHash } from 'crypto';
8
4
  import { createServer } from 'http';
9
5
  import { spawn } from 'child_process';
@@ -73,6 +69,7 @@ async function startLoopbackServer(apiBaseUrl) {
73
69
  return;
74
70
  }
75
71
  const code = parsed.searchParams.get("code");
72
+ const stepUpToken = parsed.searchParams.get("step_up_token");
76
73
  const state = parsed.searchParams.get("state");
77
74
  const error = parsed.searchParams.get("error");
78
75
  if (error) {
@@ -80,13 +77,17 @@ async function startLoopbackServer(apiBaseUrl) {
80
77
  rejectCb?.(new CliError(CLI_ERROR_CODE.UNAUTHORIZED, `OAuth error: ${error}`));
81
78
  return;
82
79
  }
83
- if (!code || !state) {
84
- res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" }).end(HTML_ERROR("Missing code or state in callback"));
80
+ if (!state || !code && !stepUpToken) {
81
+ res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" }).end(HTML_ERROR("Missing code or token in callback"));
85
82
  rejectCb?.(new CliError(CLI_ERROR_CODE.UNAUTHORIZED, "Malformed callback"));
86
83
  return;
87
84
  }
88
85
  res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" }).end(HTML_SUCCESS(apiBaseUrl));
89
- resolveCb?.({ code, state });
86
+ resolveCb?.({
87
+ code: code ?? void 0,
88
+ step_up_token: stepUpToken ?? void 0,
89
+ state
90
+ });
90
91
  });
91
92
  await new Promise((resolve, reject) => {
92
93
  server.once("error", reject);
@@ -150,121 +151,4 @@ function openBrowser(url) {
150
151
  }
151
152
  }
152
153
 
153
- // src/commands/login.ts
154
- var FLAG_API_KEY = "api-key";
155
- var FLAG_BASE_URL = "base-url";
156
- var FLAG_NO_BROWSER = "no-browser";
157
- var ENDPOINT_AUTH_ME = "/v1/auth/me";
158
- var ENDPOINT_CLI_START = "/v1/auth/cli/start";
159
- var ENDPOINT_CLI_TOKEN = "/v1/auth/cli/token";
160
- var KEY_PREFIX_DK = "dk_";
161
- var KEY_PREFIX_SK = "sk_";
162
- var PRODUCT_NAME = "cimplify-cli";
163
- async function run(argv) {
164
- const args = parseArgs(argv);
165
- const baseUrl = resolveBaseUrl(flagString(args, FLAG_BASE_URL));
166
- const explicitKey = flagString(args, FLAG_API_KEY);
167
- if (explicitKey) {
168
- await loginWithKey(baseUrl, explicitKey);
169
- return;
170
- }
171
- await loginWithBrowser(baseUrl, flagBool(args, FLAG_NO_BROWSER));
172
- }
173
- async function loginWithKey(baseUrl, apiKey) {
174
- if (!apiKey.startsWith(KEY_PREFIX_DK) && !apiKey.startsWith(KEY_PREFIX_SK)) {
175
- throw new CliError(
176
- CLI_ERROR_CODE.INVALID_INPUT,
177
- `API key must start with "${KEY_PREFIX_DK}" or "${KEY_PREFIX_SK}".`
178
- );
179
- }
180
- const client = ApiClient.withKey(apiKey, baseUrl);
181
- const me = await client.get(ENDPOINT_AUTH_ME);
182
- await writeAuth({
183
- apiKey,
184
- apiBaseUrl: baseUrl,
185
- accountId: me.id,
186
- businessId: me.business_id,
187
- email: me.email,
188
- name: me.name,
189
- savedAt: (/* @__PURE__ */ new Date()).toISOString()
190
- });
191
- success(`Logged in as ${me.email ?? me.name ?? me.id} (business ${me.business_id})`);
192
- result({
193
- logged_in: true,
194
- account: { id: me.id, email: me.email ?? null, name: me.name ?? null },
195
- business: { id: me.business_id },
196
- method: "api_key"
197
- });
198
- }
199
- async function loginWithBrowser(baseUrl, noBrowser) {
200
- if (isJsonMode()) {
201
- throw new CliError(
202
- CLI_ERROR_CODE.INTERACTIVE_REQUIRED,
203
- "browser login is not supported in --json mode",
204
- { remediation: "pass --api-key dk_\u2026 (create one in the dashboard or via `cimplify auth keys create`)" }
205
- );
206
- }
207
- const pkce = generatePkcePair();
208
- const state = generateState();
209
- const loopback = await startLoopbackServer(baseUrl);
210
- const startBody = {
211
- code_challenge: pkce.codeChallenge,
212
- code_challenge_method: pkce.codeChallengeMethod,
213
- redirect_uri: loopback.redirectUri,
214
- state,
215
- client_meta: {
216
- hostname: os.hostname(),
217
- platform: process.platform,
218
- arch: process.arch,
219
- node_version: process.version,
220
- product: PRODUCT_NAME
221
- }
222
- };
223
- const unauthClient = ApiClient.unauthenticated(baseUrl);
224
- const startResponse = await unauthClient.post(
225
- ENDPOINT_CLI_START,
226
- startBody
227
- );
228
- step("Opening browser to authorize this CLI...");
229
- info(dim(startResponse.approval_url));
230
- if (!noBrowser) {
231
- openBrowser(startResponse.approval_url);
232
- } else {
233
- info("");
234
- info(dim("Open the URL above in any browser to continue."));
235
- }
236
- let callback;
237
- try {
238
- callback = await loopback.awaitCallback(startResponse.expires_in_secs * 1e3);
239
- } catch (err) {
240
- loopback.close();
241
- throw err;
242
- }
243
- if (callback.state !== state) {
244
- throw new CliError(
245
- CLI_ERROR_CODE.UNAUTHORIZED,
246
- "OAuth state mismatch. Possible CSRF attempt \u2014 try again."
247
- );
248
- }
249
- const token = await unauthClient.post(ENDPOINT_CLI_TOKEN, {
250
- auth_code: callback.code,
251
- code_verifier: pkce.codeVerifier,
252
- redirect_uri: loopback.redirectUri
253
- });
254
- await writeAuth({
255
- apiKey: token.access_token,
256
- apiBaseUrl: baseUrl,
257
- accountId: token.account_id,
258
- businessId: token.business_id,
259
- savedAt: (/* @__PURE__ */ new Date()).toISOString()
260
- });
261
- success(`Logged in (business ${token.business_id})`);
262
- result({
263
- logged_in: true,
264
- account: { id: token.account_id, email: null, name: null },
265
- business: { id: token.business_id },
266
- method: "oauth_pkce"
267
- });
268
- }
269
-
270
- export { run as default };
154
+ export { generatePkcePair, generateState, openBrowser, startLoopbackServer };
@@ -1,5 +1,5 @@
1
1
  #!/usr/bin/env node
2
- import { isAutoYes, isInteractive, CliError, CLI_ERROR_CODE } from './chunk-I3XQSSOT.mjs';
2
+ import { isAutoYes, isInteractive, CliError, CLI_ERROR_CODE } from './chunk-E2T2SBP5.mjs';
3
3
  import readline from 'readline';
4
4
 
5
5
  async function promptLine(question) {
@@ -1,5 +1,5 @@
1
1
  #!/usr/bin/env node
2
- import { CliError, CLI_ERROR_CODE } from './chunk-I3XQSSOT.mjs';
2
+ import { CliError, CLI_ERROR_CODE } from './chunk-E2T2SBP5.mjs';
3
3
  import { spawn } from 'child_process';
4
4
 
5
5
  var GIT_BINARY = "git";
@@ -1,11 +1,12 @@
1
1
  #!/usr/bin/env node
2
- import { CliError, CLI_ERROR_CODE } from './chunk-I3XQSSOT.mjs';
2
+ import { CliError, CLI_ERROR_CODE } from './chunk-E2T2SBP5.mjs';
3
3
 
4
4
  // src/api-client.ts
5
5
  var DEFAULT_API_BASE_URL = "https://api.cimplify.io";
6
6
  var ENV_API_BASE_URL = "CIMPLIFY_API_URL";
7
7
  var DEFAULT_TIMEOUT_MS = 3e4;
8
8
  var HEADER_AUTHORIZATION = "Authorization";
9
+ var HEADER_STEP_UP = "X-Step-Up-Authorization";
9
10
  var HEADER_CONTENT_TYPE = "Content-Type";
10
11
  var HEADER_ACCEPT = "Accept";
11
12
  var HEADER_USER_AGENT = "User-Agent";
@@ -25,12 +26,20 @@ var STATUS_SERVER_ERROR_MIN = 500;
25
26
  var ApiClient = class _ApiClient {
26
27
  baseUrl;
27
28
  apiKey;
29
+ stepUpToken = null;
28
30
  constructor(baseUrl, apiKey) {
29
31
  this.baseUrl = baseUrl.replace(/\/+$/, "");
30
32
  this.apiKey = apiKey;
31
33
  }
32
- static fromAuth(auth) {
33
- return new _ApiClient(auth.apiBaseUrl, auth.apiKey);
34
+ /** Attach a step-up JWT to subsequent requests via X-Step-Up-Authorization. */
35
+ withStepUp(token) {
36
+ this.stepUpToken = token;
37
+ return this;
38
+ }
39
+ static fromAuth(auth, stepUpToken = null) {
40
+ const client = new _ApiClient(auth.apiBaseUrl, auth.apiKey);
41
+ if (stepUpToken) client.withStepUp(stepUpToken);
42
+ return client;
34
43
  }
35
44
  static unauthenticated(baseUrl = resolveBaseUrl()) {
36
45
  return new _ApiClient(baseUrl, "");
@@ -59,6 +68,9 @@ var ApiClient = class _ApiClient {
59
68
  if (this.apiKey) {
60
69
  headers[HEADER_AUTHORIZATION] = `${BEARER_PREFIX}${this.apiKey}`;
61
70
  }
71
+ if (this.stepUpToken) {
72
+ headers[HEADER_STEP_UP] = `${BEARER_PREFIX}${this.stepUpToken}`;
73
+ }
62
74
  let payload;
63
75
  if (body !== void 0) {
64
76
  headers[HEADER_CONTENT_TYPE] = CONTENT_TYPE_JSON;
@@ -120,6 +132,13 @@ async function parseResponse(response) {
120
132
  }
121
133
  const code = mapStatusToCode(response.status);
122
134
  const message = extractErrorMessage(body, response.status);
135
+ if (response.status === STATUS_UNAUTHORIZED && /step_up_required/i.test(message)) {
136
+ throw new CliError(
137
+ CLI_ERROR_CODE.STEP_UP_REQUIRED,
138
+ "This action requires fresh re-authentication. Run `cimplify auth step-up`, then retry.",
139
+ { remediation: "cimplify auth step-up" }
140
+ );
141
+ }
123
142
  throw new CliError(code, message);
124
143
  }
125
144
  function mapStatusToCode(status) {
@@ -1,10 +1,10 @@
1
1
  #!/usr/bin/env node
2
- import { promptYesNo } from './chunk-RZQTHTXX.mjs';
2
+ import { promptYesNo } from './chunk-ITAFAORS.mjs';
3
3
  import { TOKEN_PURPOSE, REPO_PROVIDER, REPO_PROVIDER_VALUES } from './chunk-MXYUAJEW.mjs';
4
4
  import { parseArgs, flagString, flagBool } from './chunk-C4M3DXKC.mjs';
5
- import { ApiClient } from './chunk-D7WMSGKK.mjs';
6
- import { readAuth, readProjectLink } from './chunk-LS2VTSMQ.mjs';
7
- import { CliError, CLI_ERROR_CODE, isJsonMode, result, dim, success, info, bold } from './chunk-I3XQSSOT.mjs';
5
+ import { ApiClient } from './chunk-MAOO6ZZ5.mjs';
6
+ import { readAuth, readProjectLink } from './chunk-UBAI443T.mjs';
7
+ import { CliError, CLI_ERROR_CODE, isJsonMode, result, dim, success, info, bold } from './chunk-E2T2SBP5.mjs';
8
8
 
9
9
  // src/commands/repo.ts
10
10
  var SUB_PROVISION = "provision";
@@ -1,10 +1,11 @@
1
1
  #!/usr/bin/env node
2
- import { CliError, CLI_ERROR_CODE } from './chunk-I3XQSSOT.mjs';
2
+ import { CliError, CLI_ERROR_CODE } from './chunk-E2T2SBP5.mjs';
3
3
  import { promises } from 'fs';
4
4
  import os from 'os';
5
5
  import path from 'path';
6
6
 
7
7
  var AUTH_FILE_NAME = "auth.json";
8
+ var STEP_UP_FILE_NAME = "step-up.json";
8
9
  var PROJECT_FILE_NAME = "project.json";
9
10
  var STATE_FILE_NAME = "state.json";
10
11
  var PROJECT_DIR_NAME = ".cimplify";
@@ -24,6 +25,9 @@ function authConfigDir() {
24
25
  function authConfigPath() {
25
26
  return path.join(authConfigDir(), AUTH_FILE_NAME);
26
27
  }
28
+ function stepUpConfigPath() {
29
+ return path.join(authConfigDir(), STEP_UP_FILE_NAME);
30
+ }
27
31
  function projectConfigDir(cwd = process.cwd()) {
28
32
  return path.join(cwd, PROJECT_DIR_NAME);
29
33
  }
@@ -76,6 +80,9 @@ async function clearAuth() {
76
80
  throw err;
77
81
  }
78
82
  }
83
+ async function writeStepUp(token) {
84
+ await writeJsonFile(stepUpConfigPath(), token, FILE_MODE_PRIVATE);
85
+ }
79
86
  async function readProjectLink(cwd = process.cwd()) {
80
87
  const data = await readJsonFile(projectConfigPath(cwd));
81
88
  if (!data) {
@@ -130,4 +137,4 @@ ${STATE_GITIGNORE_LINE}
130
137
  await promises.writeFile(gitignore, next, ENCODING_UTF8);
131
138
  }
132
139
 
133
- export { clearAuth, clearProjectLink, readAuth, readAuthOrNull, readProjectLink, readProjectLinkOrNull, readProjectState, writeAuth, writeProjectLink, writeProjectState };
140
+ export { clearAuth, clearProjectLink, readAuth, readAuthOrNull, readProjectLink, readProjectLinkOrNull, readProjectState, writeAuth, writeProjectLink, writeProjectState, writeStepUp };
@@ -1,6 +1,6 @@
1
1
  #!/usr/bin/env node
2
2
  import { TERMINAL_DEPLOYMENT_STATUSES, DEPLOYMENT_STATUS } from './chunk-MXYUAJEW.mjs';
3
- import { dim, CliError, CLI_ERROR_CODE, failure, success, isJsonMode } from './chunk-I3XQSSOT.mjs';
3
+ import { dim, CliError, CLI_ERROR_CODE, failure, success, isJsonMode } from './chunk-E2T2SBP5.mjs';
4
4
 
5
5
  // src/progress.ts
6
6
  var POLL_INTERVAL_MS = 1e3;