@commercelayer/agent-cli 1.0.0-dev.0 → 1.0.0-dev.10

package/dist/config.js

@@ -10,10 +10,16 @@
 // The organization: --org, then C11R_ORG, then .c11r.json, then the stored one when exactly one
 // is stored. With several stored and nothing naming one, the command stops and names them.
 // C11R_TOKEN, for CI, is used as is, whatever is stored.
+//
+// Every stored token records the host that issued it: an organization token and a cancel token
+// the API base (api_url), the login the auth endpoint (auth_url). An entry is used, listed and
+// forgotten only while that base is the one in effect, so a token never goes to a host it was not
+// issued by. An entry that records no host is not used, and goes at the next write.
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { fail, fixWith } from './errors.js';
+import { apiUrl } from './http.js';
 export const LINK_FILE = '.c11r.json';
 export function credentialsFile() {
     const base = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config');
@@ -32,6 +38,12 @@ function readCredentials() {
 }
 function writeCredentials(c) {
     const file = credentialsFile();
+    // An entry that records no issuing host is never used: it is not kept either.
+    c.orgs = Object.fromEntries(Object.entries(c.orgs).filter(([, o]) => o?.api_url));
+    if (c.login && !c.login.auth_url)
+        delete c.login;
+    if (c.bookings)
+        c.bookings = Object.fromEntries(Object.entries(c.bookings).filter(([, b]) => b?.api_url));
     fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
     // Written aside then renamed, so a crash never leaves half a file; 600 from the start.
     const tmp = `${file}.${process.pid}.tmp`;
@@ -39,19 +51,26 @@ function writeCredentials(c) {
     fs.chmodSync(tmp, 0o600);
     fs.renameSync(tmp, file);
 }
+export const DEFAULT_AUTH_URL = 'https://auth.commercelayer.io/oauth/token';
+export const authUrl = () => process.env.C11R_AUTH_URL || DEFAULT_AUTH_URL;
+const norm = (u) => u.replace(/\/+$/, '');
+/** True when an entry was issued by the API base in effect; one that records none never is. */
+const fromApi = (e) => !!e?.api_url && norm(e.api_url) === norm(apiUrl());
+const fromAuth = (e) => !!e?.auth_url && norm(e.auth_url) === norm(authUrl());
+/** The organization tokens issued by the API in effect. */
 export function storedOrgs() {
-    return readCredentials().orgs;
+    return Object.fromEntries(Object.entries(readCredentials().orgs).filter(([, o]) => fromApi(o)));
 }
 export function storeOrg(slug, org) {
     const c = readCredentials();
-    c.orgs[slug] = org;
+    c.orgs[slug] = { ...org, api_url: apiUrl() };
     writeCredentials(c);
 }
 /** After a reset: the same token, a new organization. */
 export function renameOrg(from, to, patch = {}) {
     const c = readCredentials();
     const entry = c.orgs[from];
-    if (!entry)
+    if (!fromApi(entry))
         return;
     delete c.orgs[from];
     c.orgs[to] = { ...entry, ...patch };
@@ -59,20 +78,25 @@ export function renameOrg(from, to, patch = {}) {
 }
 export function forgetOrg(slug) {
     const c = readCredentials();
-    if (!c.orgs[slug])
+    if (!fromApi(c.orgs[slug]))
         return;
     delete c.orgs[slug];
     writeCredentials(c);
 }
+/** The login minted by the auth endpoint in effect. */
 export function storedLogin() {
-    return readCredentials().login ?? null;
+    const l = readCredentials().login;
+    return l && fromAuth(l) ? l : null;
 }
+/** Stores the login for the auth endpoint in effect; null forgets it, only if it is that one's. */
 export function storeLogin(login) {
     const c = readCredentials();
     if (login)
-        c.login = login;
-    else
+        c.login = { ...login, auth_url: authUrl() };
+    else if (fromAuth(c.login))
         delete c.login;
+    else
+        return;
     writeCredentials(c);
 }
 export function defaultOrg() {
@@ -86,31 +110,51 @@ export function setDefaultOrg(org) {
         delete c.default_org;
     writeCredentials(c);
 }
-export function outWritten(org) {
-    return Boolean(readCredentials().out_written?.[org]);
+/** A record's secret went to an --out file: remembered so its delete can say that file stays. */
+export function markOutWritten(org, record) {
+    const keys = record.keys.filter(Boolean);
+    if (!keys.length)
+        return;
+    const c = readCredentials();
+    const all = { ...(c.out_written ?? {}) };
+    const list = (all[org] ?? []).filter((r) => !(r.noun === record.noun && r.keys.some((k) => keys.includes(k))));
+    all[org] = [...list, { noun: record.noun, keys }];
+    c.out_written = all;
+    writeCredentials(c);
 }
-export function markOutWritten(org, written) {
+/**
+ * After a delete: whether that record had a secret written with --out, which is then forgotten.
+ * With no record named, the organization goes (sandbox destroy).
+ */
+export function forgetOutWritten(org, record) {
     const c = readCredentials();
+    const list = c.out_written?.[org] ?? [];
+    const hit = (r) => !record || (r.noun === record.noun && r.keys.some((k) => record.keys.includes(k)));
+    if (!list.some(hit))
+        return false;
+    const rest = list.filter((r) => !hit(r));
     const all = { ...(c.out_written ?? {}) };
-    if (written === Boolean(all[org]))
-        return;
-    if (written)
-        all[org] = true;
+    if (rest.length)
+        all[org] = rest;
     else
         delete all[org];
     c.out_written = all;
     writeCredentials(c);
+    return true;
 }
 export function storedBooking(id) {
-    return readCredentials().bookings?.[id] ?? null;
+    const b = readCredentials().bookings?.[id];
+    return b && fromApi(b) ? b : null;
 }
 export function storeBooking(id, booking) {
     const c = readCredentials();
     const all = { ...(c.bookings ?? {}) };
     if (booking)
-        all[id] = booking;
-    else
+        all[id] = { ...booking, api_url: apiUrl() };
+    else if (fromApi(all[id]))
         delete all[id];
+    else
+        return;
     c.bookings = all;
     writeCredentials(c);
 }

package/dist/engine.js

@@ -4,18 +4,45 @@
 // destructive verb, then the request. A plain noun needs no code here: its schema says
 // everything. Every answer is the API's envelope, { data, state, warnings, next }.
 import { parseCommand, parseFields, toFlag } from './argv.js';
-import { raiseProblem, resolveOrg } from './config.js';
-import { confirm } from './confirm.js';
+import { forgetOutWritten, raiseProblem, resolveOrg } from './config.js';
+import { confirm, terminal } from './confirm.js';
 import { CliError, closest, fail, fixWith } from './errors.js';
 import { indexHelp, nounHelp, verbHelp } from './help.js';
 import { envelope, request } from './http.js';
+import { readInputs } from './inputs.js';
 import { hasLogin, loginToken } from './login.js';
 import { resourceRequest } from './resources.js';
-import { describePlan, planSecret, writeSecret } from './secrets.js';
+import { markDrift } from './project.js';
+import { describePlan, OUT_NOT_TRACKED, planSecret, removeRecordFiles, writeSecret } from './secrets.js';
 import { verbOf } from './schema.js';
-import { apiNouns, apiSchema } from './schemas.js';
+import { apiNouns, apiSchema, refreshSchemas, refusedBySchema } from './schemas.js';
 import { VERSION } from './version.js';
+/**
+ * One command. When it was read against a cached schema the API has since changed (a deploy), and
+ * the refusal is one that explains (refusedBySchema), it runs once more on fresh schemas. The API
+ * refused, so nothing happened; the second run asks again what the fresh schema asks, and never
+ * adds confirm=true on its own.
+ */
 export async function execute(argv, opts = {}) {
+    try {
+        return await executeOnce(argv, opts);
+    }
+    catch (e) {
+        if (!(e instanceof CliError) || !refusedBySchema(e.code) || !refusedBeforeEffect(e))
+            throw e;
+        refreshSchemas();
+        process.stderr.write(JSON.stringify({ retrying: { code: e.code, why: 'the schema changed on the API: read again' } }) + '\n');
+        return executeOnce(argv, opts);
+    }
+}
+/** A refusal the API answered (4xx), or a flag or verb the cached schema did not know: nothing was done. */
+function refusedBeforeEffect(e) {
+    const status = e.body.details?.status;
+    if (typeof status === 'number')
+        return status >= 400 && status < 500;
+    return e.code === 'unknown_field' || e.code === 'unknown_verb';
+}
+async function executeOnce(argv, opts) {
     const cmd = parseCommand(argv);
     const builtins = opts.builtins ?? {};
     if (cmd.globals.version && !cmd.noun)
@@ -27,7 +54,10 @@ export async function execute(argv, opts = {}) {
     const schema = builtins[cmd.noun]?.schema ?? (await apiSchema(cmd.noun, Object.keys(builtins)));
     if (cmd.globals.help && !cmd.verb && !builtins[cmd.noun]?.defaultVerb)
         return envelope(nounHelp(schema));
-    const verb = verbOf(schema, cmd.verb ?? builtins[cmd.noun]?.defaultVerb);
+    const ext = opts.extensions?.[schema.noun];
+    const found = verbOf(schema, cmd.verb ?? builtins[cmd.noun]?.defaultVerb);
+    const local = ext?.flags?.[found.name];
+    const verb = local ? { ...found, flags: { ...found.flags, ...local } } : found;
     if (cmd.globals.help)
         return envelope(verbHelp(schema, verb));
     // A verb the schema lists as refused: no request, no confirmation for something that cannot happen.
@@ -35,12 +65,15 @@ export async function execute(argv, opts = {}) {
         const by = verb.refused.by === 'commercelayer' ? 'Commerce Layer' : verb.refused.by;
         fail('not_supported', `c11r ${schema.noun} ${verb.name} is refused by ${by}: ${verb.description || 'it cannot be done through the API.'}`, { details: { refused_by: verb.refused.by }, next_step: { action: 'none' } });
     }
-    const ext = opts.extensions?.[schema.noun];
     const positional = ext?.positional?.[verb.name];
     const rest = positional && !verb.id && cmd.rest[0] !== undefined && !cmd.rest[0].startsWith('-') ? [`--${positional}`, ...cmd.rest] : cmd.rest;
     const parsed = parseFields(schema.noun, verb, rest);
     ext?.prepare?.(verb, parsed);
+    // Files first, so a required document given with --file counts; a secret is typed only once
+    // the command is otherwise complete.
+    await readInputs(schema.noun, verb, parsed, null);
     check(schema, verb, parsed);
+    await readInputs(schema.noun, verb, parsed, opts.prompter ?? terminal);
     const line = ['c11r', ...argv.filter((a) => a !== '--yes' && a !== '-y')].map(quote).join(' ');
     const org = resolveOrg(cmd.globals.org);
     const login = hasLogin();
@@ -68,13 +101,13 @@ export async function execute(argv, opts = {}) {
     }
     let confirmed = false;
     const confirmFlags = verb.confirmIf.filter((k) => parsed.values[k] !== undefined && parsed.values[k] !== false);
-    if ((verb.destructive || confirmFlags.length) && !cmd.globals.dryRun) {
+    if ((verb.destructive || verb.confirm || confirmFlags.length) && !cmd.globals.dryRun) {
         const what = `${verb.name} ${schema.noun}${parsed.id ? ` ${parsed.id}` : ''}${confirmFlags.length ? ` with ${confirmFlags.map(toFlag).join(' ')}` : ''}`;
         await confirm(what.charAt(0).toUpperCase() + what.slice(1), line, { yes: cmd.globals.yes, prompter: opts.prompter });
         confirmed = true;
     }
     // Where a secret goes, checked before the request makes one.
-    const secretPlan = verb.secret ? planSecret({ org: org.org, verb: verb.name, id: parsed.id, values: parsed.values, yes: cmd.globals.yes }) : null;
+    const secretPlan = verb.secret ? planSecret({ org: org.org, noun: schema.noun, verb: verb.name, id: parsed.id, values: parsed.values, yes: cmd.globals.yes }) : null;
     const ctx = { live: cmd.globals.live, token: bearer === 'login' ? await loginToken() : org.token };
     const orgQuery = bearer === 'login' && loginOrg && schema.noun !== 'organizations' && schema.noun !== 'auth' ? { org: loginOrg } : {};
     const sendOnce = (req) => request({ ...req, query: { ...(req.query ?? {}), ...orgQuery }, dryRun: req.dryRun ?? cmd.globals.dryRun, confirm: confirmed || req.confirm }, ctx);
@@ -110,7 +143,37 @@ export async function execute(argv, opts = {}) {
     };
     const own = (await builtins[schema.noun]?.run?.(run)) ?? (await ext?.run?.(run));
     const r = own ?? (await run.send(resourceRequest(schema.noun, verb, parsed.id, parsed.values)));
-    return secretOf(r, run, secretPlan);
+    return drifted(filesGone(secretOf(r, run, secretPlan), run), run);
+}
+/**
+ * A Configure write that went through, in a folder whose store.yml names this organization: the
+ * file is now behind it. Noted in .c11r/drift, with the warning config_drift.
+ */
+function drifted(r, run) {
+    if (run.globals.dryRun || !run.org.org || run.verb.method === 'GET')
+        return r;
+    if (run.schema.doc?.group !== 'configure')
+        return r;
+    const data = (r.data && typeof r.data === 'object' ? r.data : {});
+    const id = [run.parsed.id, data.code, data.name, data.id].find((k) => typeof k === 'string' && k !== '');
+    const warning = markDrift(run.org.org, { noun: run.schema.noun, verb: run.verb.name, id: id ?? null });
+    return warning ? { ...r, warnings: [...r.warnings, warning] } : r;
+}
+/**
+ * A delete on a noun that answers secrets: the files c11r wrote for that record in the secrets
+ * folder go with it, listed in removed_files. out_files_not_tracked only when that record's secret
+ * was written with --out on this machine: that file stays where it was written.
+ */
+function filesGone(r, run) {
+    if (run.verb.name !== 'delete' || run.globals.dryRun || !run.org.org)
+        return r;
+    if (!Object.values(run.schema.verbs).some((v) => v.secret))
+        return r;
+    const data = (r.data && typeof r.data === 'object' ? r.data : {});
+    const keys = [run.parsed.id, data.id, data.name, data.code].filter((k) => typeof k === 'string' && k !== '');
+    const removed = removeRecordFiles(run.org.org, run.schema.noun, keys);
+    const warn = forgetOutWritten(run.org.org, { noun: run.schema.noun, keys });
+    return { ...r, data: { ...data, removed_files: removed }, warnings: [...r.warnings, ...(warn ? [OUT_NOT_TRACKED] : [])] };
 }
 /** A secret in the answer goes to its file; a dry run says where it would go. */
 function secretOf(r, run, plan) {
@@ -118,8 +181,8 @@ function secretOf(r, run, plan) {
     const secret = data && typeof data === 'object' ? data.secret : undefined;
     if (secret && typeof secret === 'object' && 'value' in secret) {
         // A verb the schema did not mark: still never printed.
-        const p = plan ?? planSecret({ org: run.org.org, verb: run.verb.name, id: run.parsed.id, values: run.parsed.values, yes: true });
-        return writeSecret(r, p, { org: run.org.org, verb: run.verb.name, id: run.parsed.id });
+        const p = plan ?? planSecret({ org: run.org.org, noun: run.schema.noun, verb: run.verb.name, id: run.parsed.id, values: run.parsed.values, yes: true });
+        return writeSecret(r, p, { org: run.org.org, noun: run.schema.noun, verb: run.verb.name, id: run.parsed.id });
     }
     if (plan && run.globals.dryRun)
         return { ...r, data: { ...(data && typeof data === 'object' ? data : { result: data }), secret_file: describePlan(plan) } };
@@ -128,13 +191,25 @@ function secretOf(r, run, plan) {
 /** What the command needs before anything is sent: the id, the required flags, known --data keys. */
 function check(schema, verb, parsed) {
     const cmd = `c11r ${schema.noun} ${verb.name}`;
-    if (verb.id && parsed.id === undefined) {
+    const alt = verb.idAlternative;
+    const altGiven = alt.filter((k) => parsed.values[k] !== undefined);
+    if (alt.length && parsed.id !== undefined && altGiven.length) {
+        fail('invalid_value', `${cmd} takes the id or ${alt.map(toFlag).join(' with ')}, not both.`, { path: altGiven[0], next_step: fixWith(`${cmd} --help`) });
+    }
+    if (verb.id && parsed.id === undefined && altGiven.length < Math.max(alt.length, 1)) {
         const accepts = schema.id?.accepts.length ? ` (or its ${schema.id.accepts.filter((a) => a !== 'id').join(' or ')})` : '';
-        fail('missing_id', `${cmd} needs the id${accepts} of one of the ${schema.noun}.`, { path: 'id', next_step: fixWith(`c11r ${schema.noun} list`) });
+        const instead = alt.length ? `, or ${alt.map(toFlag).join(' with ')}` : '';
+        const missing = alt.filter((k) => parsed.values[k] === undefined);
+        fail('missing_id', `${cmd} needs the id${accepts} of one of the ${schema.noun}${instead}.`, {
+            path: altGiven.length ? missing[0] : 'id',
+            ...(alt.length ? { details: { id_alternative: alt.map(toFlag) } } : {}),
+            next_step: fixWith(`c11r ${schema.noun} list`),
+        });
     }
     const keys = Object.keys(verb.flags);
+    const fromFiles = new Set(Object.values(verb.flags).flatMap((f) => (f.input ? [f.input.target] : [])));
     for (const key of Object.keys(parsed.values)) {
-        if (!verb.flags[key])
+        if (!verb.flags[key] && !fromFiles.has(key))
             fail('unknown_field', `${cmd} has no field ${key}.`, { path: key, did_you_mean: closest(key, keys), details: { flags: keys.map(toFlag) } });
     }
     const missing = Object.entries(verb.flags)

package/dist/help.js

@@ -3,6 +3,7 @@
 // reads it and offers to do the work.
 import { toFlag } from './argv.js';
 import { EXIT } from './errors.js';
+import { clearable } from './schema.js';
 export const USAGE = 'c11r <noun> <verb> [id] [--field value ...]';
 export const GLOBAL_FLAG_HELP = {
     '--json': 'Output as JSON. The default, and the only format: one object on stdout, { data, state, warnings, next } or { error, state }.',
@@ -21,7 +22,7 @@ export const EXIT_CODE_HELP = {
     [EXIT.not_found]: 'no such resource',
     [EXIT.rejected]: 'the API or Commerce Layer refused the request as it is',
     [EXIT.unavailable]: 'the API did not answer, is busy, or answered with an error of its own',
-    [EXIT.auth]: 'a wrong or revoked token, or no token stored for the organization named',
+    [EXIT.auth]: 'a wrong or revoked token, no token stored for the organization named, or no login (login_required)',
 };
 export function indexHelp(builtins, api) {
     return {
@@ -29,7 +30,7 @@ export function indexHelp(builtins, api) {
         description: 'c11r is the Commerce Layer CLI for coding agents. Every answer, errors included, is one JSON object on stdout.',
         nouns: [...builtins, ...(api ?? [])].sort((a, b) => (a.noun < b.noun ? -1 : 1)),
         standard_verbs: 'list, get, create, update, delete. Nouns with a state machine add their own verbs.',
-        flags: 'Fields in kebab or snake case (--price-list, --price_list). On list, --<field> <value> filters by equality and --<field>.<op> <value> by another operator (--created-at.gte 2026-11-01; in takes values separated by commas). A dotted flag sets part of an object (--customer.email). An array takes a JSON array, values separated by commas, or the flag repeated; an array of objects takes key=value pairs (--items sku=COFFEE,quantity=2). --data takes the fields as one JSON object, or @ and a file name.',
+        flags: 'Fields in kebab or snake case (--price-list, --price_list). On list, --<field> <value> filters by equality and --<field>.<op> <value> by another operator (--created-at.gte 2026-11-01). in takes several values as the flag repeated or a JSON array; on enums, numbers and dates also separated by commas, while a name or text is one value even with a comma in it, and a list that has one is sent as a JSON array. A ref flag, or a flag the schema marks nullable, given null or an empty value sends null and takes it off (--customer-group null, --coupon-code null). A dotted flag sets part of an object (--customer.email). Any other array takes a JSON array, values separated by commas, or the flag repeated; an array of objects takes key=value pairs (--items sku=COFFEE,quantity=2). --data takes the fields as one JSON object, or @ and a file name.',
         global_flags: GLOBAL_FLAG_HELP,
         exit_codes: EXIT_CODE_HELP,
         more: 'c11r <noun> --help describes a noun and its verbs; c11r <noun> <verb> --help a verb and its flags; c11r schema <noun> returns the full schema.',
@@ -53,7 +54,8 @@ export function verbHelp(s, v) {
         state: v.state,
         ...(v.plan ? { plan: v.plan } : {}),
         ...(v.refused ? { served: false, refused_by: v.refused.by } : {}),
-        ...(v.destructive ? { destructive: true, confirmation: 'Asks for confirmation unless --yes; with no terminal and no --yes it stops with confirmation_required.' } : {}),
+        ...(v.destructive ? { destructive: true } : {}),
+        ...(v.confirm ? { confirmation: 'Asks for confirmation unless --yes; with no terminal and no --yes it stops with confirmation_required.' } : {}),
         ...(v.loopable ? { loopable: 'A loop policy may allow this verb.' } : {}),
         ...(v.live ? {} : { live: 'Not in live mode.' }),
         flags: Object.entries(v.flags).map(([key, f]) => flagHelp(key, f)),
@@ -63,16 +65,20 @@ function flagHelp(key, f) {
     return {
         flag: toFlag(key),
         type: f.type === 'array' ? `array of ${f.items ?? 'string'}` : f.type === 'ref' ? `${f.noun ?? 'resource'} id` : f.type === 'money' ? 'amount in major units' : f.type,
-        ...(f.required ? { required: true } : {}),
+        ...(f.required || (f.input?.kind === 'secret' && f.input.required) ? { required: true } : {}),
+        ...(f.input ? { reads: f.input.kind === 'secret' ? `${f.input.target}, a secret: never a flag value, never printed` : `${f.input.target}, a JSON document` } : {}),
         ...(f.values ? { values: f.values } : {}),
+        ...(clearable(f) ? { clear: 'null, or an empty value, takes it off' } : {}),
         ...(f.filter ? { filter: f.filter.op } : {}),
         ...(f.description ? { description: f.description } : {}),
     };
 }
 export function usageOf(noun, v) {
+    const needed = (f) => f.required || (f.input?.kind === 'secret' && f.input.required);
     const required = Object.entries(v.flags)
-        .filter(([, f]) => f.required)
-        .map(([k, f]) => `${toFlag(k)} <${f.type === 'enum' ? f.values?.join('|') : f.type}>`);
-    const optional = Object.values(v.flags).some((f) => !f.required);
-    return [`c11r ${noun} ${v.name}`, v.id ? '<id>' : '', ...required, optional ? '[--field value ...]' : ''].filter(Boolean).join(' ');
+        .filter(([, f]) => needed(f))
+        .map(([k, f]) => `${toFlag(k)} <${f.input ? 'file' : f.type === 'enum' && f.values?.length ? f.values.join('|') : f.type}>`);
+    const optional = Object.entries(v.flags).some(([k, f]) => !needed(f) && !v.idAlternative.includes(k));
+    const id = v.id ? (v.idAlternative.length ? `<id | ${v.idAlternative.map((k) => `${toFlag(k)} <${v.flags[k].type}>`).join(' ')}>` : '<id>') : '';
+    return [`c11r ${noun} ${v.name}`, id, ...required, optional ? '[--field value ...]' : ''].filter(Boolean).join(' ');
 }

package/dist/http.js

@@ -33,6 +33,13 @@ export function urlOf(req, ctx) {
     const qs = q.toString();
     return `${apiUrl()}${req.path}${qs ? `?${qs}` : ''}`;
 }
+/** The header with the hash of the schemas the API serves: it changes with a deploy that changes them. */
+export const SCHEMA_HEADER = 'c11r-schema';
+let schemaWatcher = null;
+/** Called with the header's value on every answer that has it (the schema cache listens). */
+export function watchSchemaHeader(fn) {
+    schemaWatcher = fn;
+}
 /** Sends the request: the envelope, or the API's error as a CliError. */
 export async function request(req, ctx) {
     for (let attempt = 1;; attempt++) {
@@ -76,6 +83,9 @@ async function once(req, ctx) {
             next_step: req.method === 'GET' ? { action: 'retry_later' } : { action: 'none' },
         });
     }
+    const version = res.headers.get(SCHEMA_HEADER);
+    if (version && schemaWatcher)
+        schemaWatcher(version);
     const text = await res.text();
     let data;
     try {

package/dist/inputs.js

@@ -0,0 +1,112 @@
+// Values read from files before anything is sent (contract section 28.6 and 39).
+//
+// A secret field (secret_input: provider credentials) is taken only from --<name>-file, as JSON or
+// KEY=value lines, from a plain file only its owner can read; or, in a terminal, typed without
+// echo. Never from a flag value or --data, never printed: an error names the file, not the value.
+// A document field (file_input: price rules, rule filters) is also read from a JSON file, --file.
+import fs from 'node:fs';
+import { toFlag } from './argv.js';
+import { fail } from './errors.js';
+import { readPrivateFile } from './login.js';
+/** The flag a secret field is read from, if the key is one. */
+export function secretFileFlag(verb, key) {
+    const k = `${key}_file`;
+    return verb.flags[k]?.input?.kind === 'secret' ? k : null;
+}
+/** Reads the files given; with a prompter, also asks for a required secret not given (null: files only). */
+export async function readInputs(noun, verb, parsed, prompter) {
+    const cmd = `c11r ${noun} ${verb.name}`;
+    for (const [key, spec] of Object.entries(verb.flags)) {
+        const input = spec.input;
+        if (!input)
+            continue;
+        const file = parsed.values[key];
+        // The second pass only asks for a secret: the files were read in the first.
+        if (prompter !== null && (input.kind === 'document' || parsed.values[input.target] !== undefined))
+            continue;
+        if (input.kind === 'document') {
+            if (file === undefined)
+                continue;
+            if (parsed.values[input.target] !== undefined)
+                fail('invalid_value', `${cmd} takes ${input.target} from ${toFlag(input.target)} or from ${toFlag(key)}, not both.`, { path: key });
+            parsed.values[input.target] = documentOf(file, key, spec);
+            continue;
+        }
+        if (file !== undefined) {
+            parsed.values[input.target] = secretOf(readPrivateFile(file, key), file, key, input.target_type);
+            continue;
+        }
+        if (!input.required || prompter === null)
+            continue;
+        if (prompter.interactive && prompter.askSecret) {
+            const typed = (await prompter.askSecret(`${input.target} as JSON, or KEY=value pairs separated by spaces (not shown): `)).trim();
+            if (!typed)
+                fail('secret_required', `Nothing was typed: ${cmd} needs ${input.target}.`, { path: key });
+            parsed.values[input.target] = secretOf(typed.startsWith('{') ? typed : typed.split(/\s+/).join('\n'), null, key, input.target_type);
+            continue;
+        }
+        fail('secret_required', `${cmd} needs ${input.target}, and there is no terminal to type it in. Ask the human to save it in a file only they can read (mode 600), as JSON or KEY=value lines, then run the command with ${toFlag(key)} <file>. Do not open or print that file.`, {
+            path: key,
+            next_step: { action: 'human_step', command: null, url: null },
+        });
+    }
+}
+function documentOf(file, key, spec) {
+    let text;
+    try {
+        text = fs.readFileSync(file, 'utf8');
+    }
+    catch (e) {
+        fail('invalid_value', `${toFlag(key)} ${file}: ${e.code === 'ENOENT' ? 'no such file' : e.message}.`, { path: key });
+    }
+    let v;
+    try {
+        v = JSON.parse(text);
+    }
+    catch (e) {
+        fail('invalid_value', `${file} is not valid JSON: ${e.message}.`, { path: key });
+    }
+    const want = spec.input.target_type;
+    if (want === 'object' && (!v || typeof v !== 'object' || Array.isArray(v)))
+        fail('invalid_value', `${file} is not a JSON object.`, { path: key });
+    if (want === 'array' && !Array.isArray(v))
+        fail('invalid_value', `${file} is not a JSON list.`, { path: key });
+    return v;
+}
+/** JSON, or KEY=value lines (keys lowercased: API_KEY is api_key). The value never goes in a message. */
+function secretOf(text, file, key, type) {
+    const where = file ?? 'What was typed';
+    const trimmed = text.trim();
+    if (trimmed.startsWith('{')) {
+        let v;
+        try {
+            v = JSON.parse(trimmed);
+        }
+        catch {
+            fail('invalid_value', `${where} is not valid JSON.`, { path: key });
+        }
+        if (!v || typeof v !== 'object' || Array.isArray(v))
+            fail('invalid_value', `${where} is not a JSON object.`, { path: key });
+        return v;
+    }
+    const out = {};
+    for (const line of trimmed.split(/\r?\n/).map((l) => l.trim())) {
+        if (!line || line.startsWith('#'))
+            continue;
+        const eq = line.indexOf('=');
+        if (eq < 1)
+            fail('invalid_value', `${where} has a line that is not KEY=value.`, { path: key });
+        const value = line.slice(eq + 1).trim().replace(/^(['"])(.*)\1$/, '$2');
+        if (value)
+            out[line.slice(0, eq).trim().toLowerCase()] = value;
+    }
+    if (!Object.keys(out).length)
+        fail('secret_required', `${where} has no values.`, { path: key });
+    if (type !== 'object') {
+        const values = Object.values(out);
+        if (values.length !== 1)
+            fail('invalid_value', `${where} has to hold one value.`, { path: key });
+        return values[0];
+    }
+    return out;
+}

package/dist/login.js

@@ -9,13 +9,12 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { storedLogin, storeLogin } from './config.js';
+import { authUrl, storedLogin, storeLogin } from './config.js';
 import { CliError, errorBody, fail } from './errors.js';
 import { USER_AGENT } from './version.js';
 export const PROVISIONING_URL = 'https://dashboard.commercelayer.io/user/provisioning_api';
-const AUTH_URL = 'https://auth.commercelayer.io/oauth/token';
 const MARGIN_MS = 60_000;
-export const authUrl = () => process.env.C11R_AUTH_URL || AUTH_URL;
+export { authUrl };
 /** Where the human saves the client id and secret when there is no terminal to type them in. */
 export function secretFileDefault() {
     const base = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config');
@@ -78,25 +77,29 @@ export async function loginToken(opts = {}) {
     return minted.token;
 }
 export const hasLogin = () => Boolean(process.env.C11R_PROVISIONING_TOKEN) || storedLogin() !== null;
-/** The client id and secret, from a file the human saved: key=value lines, JSON, or the secret alone. */
-export function readSecretFile(file) {
+/** A secret file's text: a plain file only its owner can read, else insecure_file. */
+export function readPrivateFile(file, flagPath) {
     let st;
     try {
         st = fs.lstatSync(file);
     }
     catch {
-        fail('invalid_value', `${file} does not exist.`, { path: 'secret_file' });
+        fail('invalid_value', `${file} does not exist.`, { path: flagPath });
     }
     if (st.isSymbolicLink() || !st.isFile())
-        fail('insecure_file', `${file} is not a plain file. c11r reads a secret only from a plain file.`, { path: 'secret_file' });
+        fail('insecure_file', `${file} is not a plain file. c11r reads a secret only from a plain file.`, { path: flagPath });
     if (st.mode & 0o077) {
         fail('insecure_file', `${file} can be read by other users (mode ${(st.mode & 0o777).toString(8)}). c11r reads a secret only from a file that only its owner can read, mode 600.`, {
-            path: 'secret_file',
+            path: flagPath,
             next_step: { action: 'human_step', command: null, url: null },
             details: { file, mode: (st.mode & 0o777).toString(8) },
         });
     }
-    const text = fs.readFileSync(file, 'utf8');
+    return fs.readFileSync(file, 'utf8');
+}
+/** The client id and secret, from a file the human saved: key=value lines, JSON, or the secret alone. */
+export function readSecretFile(file) {
+    const text = readPrivateFile(file, 'secret_file');
     const lines = text.split(/\r?\n/).map((l) => l.trim()).filter((l) => l && !l.startsWith('#'));
     try {
         const json = JSON.parse(text);