@commercelayer/agent-cli 1.0.0-dev.14 → 1.0.0-dev.16

package/README.md

@@ -34,7 +34,7 @@ This is the 1.0.0 line, in development on the `clean-slate` branch. It replaces
 | `c11r loops run <name>` | One pass of a loop. The CLI is not a daemon: a scheduler repeats the pass. |
 | `c11r report sales [--from] [--to] [--by] [--interval] [--market] [--top]` | Sales in a window, from the Metrics API. A plain noun: its flags come from the API's schema. |
 | `c11r auth login [--client-id] [--secret-file] [--keep-file]` | The human's own Commerce Layer login, from their Provisioning API application. See below. |
-| `c11r auth logout`, `auth switch <slug> [--global]` | Forgetting the login; the organization commands act on. |
+| `c11r auth logout [--live --org <slug>]`, `auth switch <slug> [--global]` | Forgetting the login, or with `--live` revoking the API's live credential for an organization; the organization commands act on. |
 | `c11r shop profile\|search\|get\|ask <store>` | Reading a store that speaks UCP, as a shopping agent: what it offers, its catalog, a variant, a question. No organization. See below. |
 | `c11r skills sync` | Local copies of the Commerce Layer skills in `.claude/skills`, from the index at commercelayer.ai, listed in `AGENTS.md`. No organization. See below. |
 | `c11r shop checkout <store> [<checkout>]`, `shop order <store> <checkout>` | Buying there for the human: their details after their yes on what is shared, then the payment after their yes on the total, with the sandbox test handler only. |
@@ -65,11 +65,25 @@ Never from a flag or the environment. c11r exchanges the pair for a two hour tok
 | `--dry-run` | On a write, the CLI sends it with `?dry_run=true`: the API checks it all (state, plan, limits, Commerce Layer's current status) and answers what it would do, `would: [...]`, and nothing is written. No confirmation is needed. Reads ignore it. |
 | `--yes` | Confirms a destructive verb in advance. |
 | `--org <slug>` | The organization to act on, by its stored token. |
-| `--live` | Live data, on a claimed organization: `?mode=live` on every request. Without it, test mode. |
+| `--live` | Live data, on a claimed organization named with `--org` (or `C11R_ORG`), with the human's login: `?mode=live&org=` on every request. Without it, test mode. See below. |
 | `--help` | Describes the noun or verb it follows, from its schema. |
 
 Destructive verbs (deletes, `orders cancel`, `payments void` and `refund`, `sandbox reset` and `destroy`), and any verb the schema marks `confirm`, ask for confirmation in a terminal, then send `confirm=true`. With no terminal, as when an agent or a schedule runs the CLI, they never wait: without `--yes` they stop at once with `confirmation_required` and exit code 3. Its `next_step.command` is the same command without `--yes`: the agent asks the human first, and only on their yes runs it again with `--yes`. The API's own `confirmation_required` works the same way.
 
+## Live mode
+
+`--live` acts on a claimed organization's live data. It always sends the human's login, never an organization token, and names the organization with `?org=`: from `--org`, or `C11R_ORG`, never from the folder's link or the default, which are a sandbox's. Without one it is `missing_value` before any call, with the command and `--org ORG_SLUG --live`.
+
+- Without a login, nothing is checked on this machine: the request goes without a token, and the API's answer (`login_required`, or `state_required` for an organization not claimed) comes through as it is. So do `live_unavailable` (a plan without live), `forbidden` (the login is not an active admin of it) and `not_supported` for a verb that comes with a later step of go-live.
+- A verb that never runs live (sandbox, plans, sales calls, `auth login`, `auth switch`, `shop`) stops on this machine with `state_required`.
+- `c11r status --live --org <slug>` is the organization's live status, with `live_credential` and the warning `live_credential_held` while the API holds one.
+- `c11r auth logout --live --org <slug>` revokes that credential in Commerce Layer (`DELETE /v1/auth/live`): `{ org, revoked, credential }`. The login stays on this machine. `--dry-run` says what it would revoke.
+- A verb that needs a yes is confirmed by the API in live, with a sentence naming the action, the amount and the mode (`Refunds EUR 1.00 on order N, in LIVE mode, real money.`): the CLI sends it without `confirm=true` and shows that `confirmation_required` as it is, with the API's next command, or asks it with those words in a terminal. `--yes` sends `confirm=true` on every live write, `payments capture` included.
+- A verb that answers a secret (`credentials create`) writes it in live only to the file the human chose with `--out`: without it, `missing_value` with the command and `--out FILE`. Never to c11r's secrets folder, never printed. A live delete leaves the test mode's secret files of the same organization alone.
+- `store.yml`, `.c11r/export.json` and the drift notes are of an organization in a mode: a live write marks a live `store.yml` behind, never a test one, and the other way round.
+- `c11r organizations disconnect <slug>` (confirmed) has the API revoke its credentials and the organization tokens; this machine then forgets the token, its secret files and a `.c11r.json` naming it, as `sandbox destroy` does, and answers `forgotten`.
+- A secret read from a file (`--credentials-file`) is never printed: an answer or an error that holds it, a dry run's included, shows `[secret]` in its place. No live key is stored on this machine.
+
 ## Which organization
 
 `--org`, then `C11R_ORG`, then `.c11r.json` in the project folder (found by walking up, like `.git`), then the default set by `auth switch --global`, then the stored organization when exactly one is stored (never for a login noun's `?org=`). With several stored and nothing naming one, the command stops with `org_required` and lists them.
@@ -80,7 +94,7 @@ Destructive verbs (deletes, `orders cancel`, `payments void` and `refund`, `sand
 
 ## The store's setup in files
 
-`c11r config export` writes the organization's setup into the project folder: `store.yml` (the Configure nouns, refs by key, no ids, no secrets; its first key, `meta`, names the organization and the time) and `price_lists/<code>.csv` (in a row, an empty `compare_at_amount` means equal to `amount`, and one below `amount` is refused). It records what it wrote in `.c11r/export.json`, and never overwrites a file changed since the last export (or one no export wrote) without `--yes`: the answer lists them. A price list file the organization no longer has, unchanged since, goes. `c11r config plan` sends the files and answers what `config apply` would change; `apply` makes the organization match them, and with `--prune` (confirmed) also deletes what the files lack. While imports run, `apply` answers `status: running` with each noun's state, `retry_after` and the run's token, `run`; `--wait` applies again with that token and the same files until done or failed, and the done answer counts everything the run wrote. The `next` an unfinished apply suggests carries `--run <token> --wait`. `plan` lists in `needs` the new records the files can't make alone (a webhook without its `callback_url`); `apply` skips them and warns `needs_input` with the command that creates each.
+`c11r config export` writes the organization's setup into the project folder: `store.yml` (the Configure nouns, refs by key, no ids, no secrets; its first key, `meta`, names the organization, the mode (`test`, or `live` with `--live`) and the time) and `price_lists/<code>.csv` (in a row, an empty `compare_at_amount` means equal to `amount`, and one below `amount` is refused). It records what it wrote in `.c11r/export.json`, and never overwrites a file another organization or mode exported, nor a file changed since the last export (or one no export wrote) without `--yes`: the answer lists them. A price list file the organization no longer has, unchanged since, goes. `c11r config plan` sends the files and answers what `config apply` would change; `apply` makes the organization match them, and with `--prune` (confirmed) also deletes what the files lack. While imports run, `apply` answers `status: running` with each noun's state, `retry_after` and the run's token, `run`; `--wait` applies again with that token and the same files until done or failed, and the done answer counts everything the run wrote. The `next` an unfinished apply suggests carries `--run <token> --wait`. `plan` lists in `needs` the new records the files can't make alone (a webhook without its `callback_url`); `apply` skips them and warns `needs_input` with the command that creates each.
 
 Records that share a key (two shipping methods with the same name in one market, say) can't be matched to the files. `export` and `plan` list them in `ambiguous` (an empty list when there are none), each with the command that makes its key differ, and `export` puts the first one at the top of `next`. `apply` refuses with `conflict` and the same list in `error.details.ambiguous`, before it writes anything.
 

package/dist/builtins/auth.js

@@ -30,6 +30,7 @@ export const auth = {
                 path: '/v1/auth/login',
                 state: 'none',
                 credential: 'none',
+                live: false,
                 body: [
                     { name: 'client_id', type: 'string', description: 'The client id of the Provisioning API application. Not a secret. Also read from the secret file.' },
                     { name: 'secret_file', type: 'string', description: `A file with the client secret, alone or as client_secret=..., readable only by its owner (mode 600). By default ${'~/.config/c11r/provisioning.secret'} when there is no terminal.` },
@@ -37,13 +38,21 @@ export const auth = {
                 ],
                 effect: 'Logs in with the human\'s Provisioning API application: mints a token at Commerce Layer, checks it with the API, keeps the client id and secret in credentials.json (mode 600). The API receives only the token.',
             },
-            { verb: 'logout', method: 'POST', path: '/v1/auth/logout', state: 'none', credential: 'none', effect: 'Forgets the stored login on this machine. Its last token ends by itself within two hours. Organization tokens stay.' },
+            {
+                verb: 'logout',
+                method: 'POST',
+                path: '/v1/auth/logout',
+                state: 'none',
+                credential: 'none',
+                effect: 'Forgets the stored login on this machine. Its last token ends by itself within two hours. Organization tokens stay. With --live --org, instead revokes the API\'s own live credential for that organization in Commerce Layer, with the login: the login stays on this machine.',
+            },
             {
                 verb: 'switch',
                 method: 'POST',
                 path: '/v1/auth/switch/{slug}',
                 state: 'none',
                 credential: 'none',
+                live: false,
                 body: [{ name: 'global', type: 'boolean', description: 'Sets the default for this machine, used when no --org, C11R_ORG or .c11r.json names one; without it, links this project folder.' }],
                 effect: 'Picks the organization commands act on: links this project folder to it (.c11r.json), or with --global sets the default for this machine.',
             },
@@ -54,7 +63,7 @@ export const auth = {
             case 'login':
                 return login(run);
             case 'logout':
-                return logout();
+                return run.globals.live ? logoutLive(run) : logout();
             case 'switch':
                 return switchOrg(run);
         }
@@ -132,6 +141,12 @@ async function login(run) {
         next: who.next?.length ? who.next : [{ command: 'c11r organizations list', why: 'The organizations this login reaches.' }],
     };
 }
+/** The API's live credential for the organization, revoked in Commerce Layer: DELETE /v1/auth/live?org=. */
+async function logoutLive(run) {
+    // The path names live already: the request carries ?org= and not ?mode=live.
+    run.ctx.live = false;
+    return run.send({ method: 'DELETE', path: '/auth/live' });
+}
 function logout() {
     const l = storedLogin();
     if (!l)

package/dist/builtins/extensions.js

@@ -11,15 +11,18 @@ import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import zlib from 'node:zlib';
-import { credentialsFile, hintOf, projectDir, readLink, storeBooking, storedBooking, storeOrg, writeLink } from '../config.js';
+import { credentialsFile, forgetOrg, forgetOutWritten, hintOf, projectDir, readLink, removeLink, storeBooking, storedBooking, storedOrgs, storeOrg, writeLink } from '../config.js';
+import { OUT_NOT_TRACKED, removeOrgSecrets } from '../secrets.js';
 import { confirm, terminal } from '../confirm.js';
 import { fail } from '../errors.js';
 import { apiUrl } from '../http.js';
-import { clearDrift, driftWarning, readDrift, readStoreFiles, storeFileOrg, writeStoreFiles } from '../project.js';
+import { clearDrift, driftWarning, readDrift, readStoreFiles, storeFileIs, writeStoreFiles } from '../project.js';
 import { resourceRequest } from '../resources.js';
 const NAME_MAX = 25;
 export const organizations = {
     async run(run) {
+        if (run.verb.name === 'disconnect')
+            return disconnect(run);
         if (run.verb.name !== 'create' && run.verb.name !== 'connect')
             return undefined;
         const name = run.parsed.values.name;
@@ -73,6 +76,23 @@ export const organizations = {
         return { ...r, data: { ...data, org, token_hint: hint, credentials: credentialsFile(), linked }, warnings };
     },
 };
+/**
+ * organizations disconnect: the API revokes its own credentials and the organization tokens, so
+ * this machine forgets them too, as sandbox destroy does: the token, its secret files, a link
+ * naming it.
+ */
+async function disconnect(run) {
+    const r = await run.send(resourceRequest('organizations', run.verb, run.parsed.id, run.parsed.values));
+    if (run.globals.dryRun || r.data?.disconnected !== true)
+        return r;
+    const org = r.data.org ?? run.parsed.id;
+    const out = forgetOutWritten(org);
+    const credentials = Boolean(storedOrgs()[org]);
+    forgetOrg(org);
+    const link = removeLink(org);
+    const secrets = removeOrgSecrets(org);
+    return { ...r, data: { ...r.data, forgotten: { credentials, link, secrets } }, warnings: [...r.warnings, ...(out ? [OUT_NOT_TRACKED] : [])] };
+}
 export const salesCalls = {
     positional: { book: 'slot' },
     prepare(verb, parsed) {
@@ -146,7 +166,7 @@ export const config = {
             const data = r.data ?? {};
             if (!data.store || typeof data.store !== 'object')
                 fail('invalid_response', 'config export answered without store.', { next_step: { action: 'none' } });
-            const out = writeStoreFiles({ store: data.store, price_lists: data.price_lists ?? {}, meta: { org: data.meta?.org ?? run.org.org ?? undefined, exported_at: data.meta?.exported_at } }, { overwrite: run.globals.yes });
+            const out = writeStoreFiles({ store: data.store, price_lists: data.price_lists ?? {}, meta: { org: data.meta?.org ?? run.org.org ?? undefined, exported_at: data.meta?.exported_at } }, { overwrite: run.globals.yes, mode: run.globals.live ? 'live' : 'test' });
             const ambiguous = Array.isArray(data.ambiguous) ? data.ambiguous : [];
             const counts = Object.fromEntries(Object.entries(data.store).map(([k, v]) => [k, Array.isArray(v) ? v.length : 0]));
             return {
@@ -183,12 +203,12 @@ export const config = {
                 r = await run.send(resourceRequest('config', run.verb, undefined, values));
             }
             const warnings = [...r.warnings];
-            const here = storeFileOrg();
+            const here = storeFileIs(run.org.org, run.globals.live ? 'live' : 'test');
             const drift = readDrift();
-            if (name === 'plan' && drift.length && here === run.org.org)
+            if (name === 'plan' && drift.length && here)
                 warnings.push(driftWarning(drift));
             // The organization now matches the files: the folder is no longer behind.
-            if (name === 'apply' && !run.globals.dryRun && r.data?.status === 'done' && here === run.org.org)
+            if (name === 'apply' && !run.globals.dryRun && r.data?.status === 'done' && here)
                 clearDrift();
             const data = r.data ?? {};
             const running = name === 'apply' && data.status === 'running';

package/dist/engine.js

@@ -81,13 +81,29 @@ async function executeOnce(argv, opts) {
     const line = ['c11r', ...argv.filter((a) => a !== '--yes' && a !== '-y')].map(quote).join(' ');
     const org = resolveOrg(cmd.globals.org);
     const login = hasLogin();
+    const live = cmd.globals.live;
+    // The command as typed: c11r status, not c11r status get, when the verb was left out.
+    const named = `c11r ${schema.noun}${cmd.verb ? ` ${verb.name}` : ''}`;
+    if (live && !verb.live) {
+        fail('state_required', `${named} does not run in live mode.`, { required_state: 'claimed', path: 'live', next_step: fixWith(line.replace(/\s--live\b/, '')) });
+    }
+    // Live mode acts on an organization named on the command, never the folder's link or the
+    // default, which are a sandbox's: --org, or C11R_ORG.
+    const liveOrg = live ? (cmd.globals.org ?? (process.env.C11R_ORG || null)) : null;
+    if (live && !liveOrg) {
+        fail('missing_value', `${named} --live acts on a claimed organization, named with --org.`, { path: 'org', next_step: fixWith(`${line.replace(/\s--live\b/, '')} --org ORG_SLUG --live`) });
+    }
     // The bearer, from the schema (contract section 23). An organization token for the organization
     // nouns, the login for the Provisioning ones; credentials take the login when there is one and
     // the organization token is not a sandbox's.
-    let bearer = verb.credential === 'login' ? 'login' : verb.credential === 'organization|login' ? (login && !org.token?.startsWith('sbx_') ? 'login' : 'organization') : verb.credential === 'none' ? 'none' : 'organization';
+    // In live mode, always the login, never an organization token: the API answers login_required
+    // to anything else, and to no token at all.
+    let bearer = live
+        ? 'login'
+        : verb.credential === 'login' ? 'login' : verb.credential === 'organization|login' ? (login && !org.token?.startsWith('sbx_') ? 'login' : 'organization') : verb.credential === 'none' ? 'none' : 'organization';
     // members and roles with an organization token and no login: the API says what is needed (a
     // claim for a sandbox, a login for a claimed organization). organizations and auth stop here.
-    if (bearer === 'login' && !login && org.token && schema.noun !== 'organizations' && schema.noun !== 'auth')
+    if (!live && bearer === 'login' && !login && org.token && schema.noun !== 'organizations' && schema.noun !== 'auth')
         bearer = 'organization';
     // A verb that needs an organization token: say which is missing before the API does.
     if (bearer === 'organization' && verb.state !== 'none' && !org.token) {
@@ -100,20 +116,29 @@ async function executeOnce(argv, opts) {
     // The login names its organization with ?org=, from --org, C11R_ORG, .c11r.json or the default:
     // never a guess from the only token stored, which may be a sandbox the login does not reach.
     const loginOrg = org.source && org.source !== 'only_stored' ? org.org : null;
-    if (cmd.globals.live && !verb.live) {
-        fail('state_required', `c11r ${schema.noun} ${verb.name} does not run in live mode.`, { required_state: 'claimed', path: 'live', next_step: fixWith(line.replace(/\s--live\b/, '')) });
-    }
     let confirmed = false;
     const confirmFlags = verb.confirmIf.filter((k) => parsed.values[k] !== undefined && parsed.values[k] !== false);
-    if ((verb.destructive || verb.confirm || confirmFlags.length) && !cmd.globals.dryRun) {
+    // In live mode the API asks for the verbs it confirms, with a sentence naming the action, the
+    // amount and the mode ("Refunds EUR 1.00 on order N, in LIVE mode, real money."): the CLI sends
+    // without confirm=true and shows that 428 as it is, or asks it in a terminal. --yes sends
+    // confirm=true on every live write, payments capture included.
+    const apiAsks = live && (verb.confirm || confirmFlags.length > 0);
+    if (live && cmd.globals.yes && verb.method !== 'GET')
+        confirmed = true;
+    if ((verb.destructive || verb.confirm || confirmFlags.length) && !cmd.globals.dryRun && !apiAsks) {
         const what = `${verb.name} ${schema.noun}${parsed.id ? ` ${parsed.id}` : ''}${confirmFlags.length ? ` with ${confirmFlags.map(toFlag).join(' ')}` : ''}`;
-        await confirm(what.charAt(0).toUpperCase() + what.slice(1), line, { yes: cmd.globals.yes, prompter: opts.prompter });
+        const sentence = what.charAt(0).toUpperCase() + what.slice(1);
+        await confirm(sentence, line, { yes: cmd.globals.yes, prompter: opts.prompter });
         confirmed = true;
     }
+    // A live secret goes only to a file the human chose: never the default folder, never printed.
+    if (live && verb.secret && parsed.values.out === undefined) {
+        fail('missing_value', `${named} --live answers a live secret: it is written only to a file the human chooses, with --out.`, { path: 'out', next_step: fixWith(`${line} --out FILE`) });
+    }
     // Where a secret goes, checked before the request makes one.
     const secretPlan = verb.secret ? planSecret({ org: org.org, noun: schema.noun, verb: verb.name, id: parsed.id, values: parsed.values, yes: cmd.globals.yes }) : null;
-    const ctx = { live: cmd.globals.live, token: bearer === 'login' ? await loginToken() : org.token };
-    const orgQuery = bearer === 'login' && loginOrg && schema.noun !== 'organizations' && schema.noun !== 'auth' ? { org: loginOrg } : {};
+    const ctx = { live, token: live ? (login ? await loginToken() : null) : bearer === 'login' ? await loginToken() : org.token };
+    const orgQuery = liveOrg ? { org: liveOrg } : bearer === 'login' && loginOrg && schema.noun !== 'organizations' && schema.noun !== 'auth' ? { org: loginOrg } : {};
     const sendOnce = (req) => request({ ...req, query: { ...(req.query ?? {}), ...orgQuery }, dryRun: req.dryRun ?? cmd.globals.dryRun, confirm: confirmed || req.confirm }, ctx);
     const run = {
         globals: cmd.globals,
@@ -130,6 +155,15 @@ async function executeOnce(argv, opts) {
                 return await sendOnce(req);
             }
             catch (e) {
+                // The API's own confirmation, in live: as it is with no terminal; asked with its words in one.
+                if (live && !confirmed && e instanceof CliError && e.code === 'confirmation_required') {
+                    const p = opts.prompter ?? terminal;
+                    if (!p.interactive)
+                        throw e;
+                    await confirm(e.body.message, line, { yes: false, prompter: p, sentence: e.body.message });
+                    confirmed = true;
+                    return sendOnce(req);
+                }
                 // A login token Commerce Layer no longer takes: mint a new one, once.
                 if (!(e instanceof CliError && e.code === 'login_required') || !login)
                     throw e;
@@ -139,16 +173,51 @@ async function executeOnce(argv, opts) {
                     throw e;
                 ctx.token = await loginToken({ fresh: bearer === 'login' });
                 run.bearer = 'login';
-                if (loginOrg && schema.noun !== 'organizations')
+                if (!live && loginOrg && schema.noun !== 'organizations')
                     Object.assign(orgQuery, { org: loginOrg });
                 return sendOnce(req);
             }
         },
     };
-    const own = (await builtins[schema.noun]?.run?.(run)) ?? (await ext?.run?.(run));
-    const r = own ?? (await run.send(resourceRequest(schema.noun, verb, parsed.id, parsed.values)));
-    const out = drifted(filesGone(secretOf(r, run, secretPlan), run), run);
-    return unknown.length ? { ...out, warnings: [...unknown, ...out.warnings] } : out;
+    // A secret read from a file (provider or payment keys) is never printed, whatever the answer
+    // holds: a dry run or an error that echoes it shows [secret] in its place.
+    const secrets = secretValues(verb, parsed.values);
+    try {
+        const own = (await builtins[schema.noun]?.run?.(run)) ?? (await ext?.run?.(run));
+        const r = own ?? (await run.send(resourceRequest(schema.noun, verb, parsed.id, parsed.values)));
+        const out = drifted(filesGone(secretOf(r, run, secretPlan), run), run);
+        return scrub(unknown.length ? { ...out, warnings: [...unknown, ...out.warnings] } : out, secrets);
+    }
+    catch (e) {
+        if (e instanceof CliError && secrets.length)
+            throw new CliError(scrub(e.body, secrets), e.kind, scrub(e.state, secrets));
+        throw e;
+    }
+}
+/** The string values of the secret fields given, longest first. */
+function secretValues(verb, values) {
+    const out = [];
+    const walk = (v) => {
+        if (typeof v === 'string' && v.length >= 4)
+            out.push(v);
+        else if (v && typeof v === 'object')
+            for (const x of Object.values(v))
+                walk(x);
+    };
+    for (const spec of Object.values(verb.flags))
+        if (spec.input?.kind === 'secret')
+            walk(values[spec.input.target]);
+    return [...new Set(out)].sort((a, b) => b.length - a.length);
+}
+function scrub(v, secrets) {
+    if (!secrets.length || v === undefined)
+        return v;
+    let text = JSON.stringify(v);
+    if (text === undefined)
+        return v;
+    for (const s of secrets)
+        text = text.split(JSON.stringify(s).slice(1, -1)).join('[secret]');
+    return JSON.parse(text);
 }
 /**
  * A value outside a flag's documented values (known: webhook topics): not enforced, so it is sent,
@@ -185,7 +254,7 @@ function drifted(r, run) {
         return r;
     const data = (r.data && typeof r.data === 'object' ? r.data : {});
     const id = [run.parsed.id, data.code, data.name, data.id].find((k) => typeof k === 'string' && k !== '');
-    const warning = markDrift(run.org.org, { noun: run.schema.noun, verb: run.verb.name, id: id ?? null });
+    const warning = markDrift(run.org.org, run.globals.live ? 'live' : 'test', { noun: run.schema.noun, verb: run.verb.name, id: id ?? null });
     return warning ? { ...r, warnings: [...r.warnings, warning] } : r;
 }
 /**
@@ -198,6 +267,10 @@ function filesGone(r, run) {
         return r;
     if (!Object.values(run.schema.verbs).some((v) => v.secret))
         return r;
+    // In live mode the secret went to a file the human chose, which is theirs to delete; the
+    // secrets folder holds the test mode's files of the same organization, which stay.
+    if (run.globals.live)
+        return { ...r, warnings: [...r.warnings, OUT_NOT_TRACKED] };
     const data = (r.data && typeof r.data === 'object' ? r.data : {});
     const keys = [run.parsed.id, data.id, data.name, data.code].filter((k) => typeof k === 'string' && k !== '');
     const removed = removeRecordFiles(run.org.org, run.schema.noun, keys);

package/dist/help.js

@@ -10,7 +10,7 @@ export const GLOBAL_FLAG_HELP = {
     '--dry-run': 'On a write, the API checks everything and says what would change, and changes nothing. Reads ignore it.',
     '--yes': 'Confirms a destructive verb in advance. Without it a destructive verb asks in the terminal, or, with no terminal, stops with confirmation_required.',
     '--org <slug>': 'The organization to act on, by its stored token. Without it: C11R_ORG, then the folder\'s .c11r.json, then the only stored organization.',
-    '--live': 'Acts on live data, on a claimed organization. Without it every command works in test mode.',
+    '--live': 'Acts on live data, on a claimed organization named with --org, with the human\'s login. Without it every command works in test mode.',
     '--help': 'Describes the noun or verb it follows, from its schema.',
 };
 export const EXIT_CODE_HELP = {

package/dist/project.js

@@ -7,7 +7,10 @@
 //   .c11r/drift        the Configure writes made since, in a folder whose store.yml names the
 //                      same organization: config plan mentions them, config export clears them.
 //
-// store.yml carries the export's meta ({ org, exported_at }) as its first key; the CLI takes it
+// Live is a mode of the same organization, with the same slug: store.yml, the export record and
+// the drift notes say which mode they are of, so test and live notes never mix.
+//
+// store.yml carries the export's meta ({ org, mode, exported_at }) as its first key; the CLI takes it
 // off before it sends the file, so the API sees { <noun>: [records] } only.
 import crypto from 'node:crypto';
 import fs from 'node:fs';
@@ -15,6 +18,7 @@ import path from 'node:path';
 import YAML from 'yaml';
 import { projectDir } from './config.js';
 import { fail } from './errors.js';
+const sameSource = (a, b) => a.org !== null && a.org === b.org && a.mode === b.mode;
 export const STORE_FILE = 'store.yml';
 export const PRICE_LISTS_DIR = 'price_lists';
 const NOTES_DIR = '.c11r';
@@ -57,16 +61,18 @@ export function readStoreFiles(dir = projectDir()) {
             price_lists[n.slice(0, -4)] = fs.readFileSync(path.join(csvDir, n), 'utf8');
     return { store, price_lists, org };
 }
-/** The organization the folder's store.yml names, or null without one. */
-export function storeFileOrg(dir = projectDir()) {
+/** The organization and mode the folder's store.yml names; org null without one. */
+export function storeFileSource(dir = projectDir()) {
     try {
         const doc = YAML.parse(fs.readFileSync(path.join(dir, STORE_FILE), 'utf8'));
-        return typeof doc?.meta?.org === 'string' ? doc.meta.org : null;
+        return { org: typeof doc?.meta?.org === 'string' ? doc.meta.org : null, mode: doc?.meta?.mode === 'live' ? 'live' : 'test' };
     }
     catch {
-        return null;
+        return { org: null, mode: 'test' };
     }
 }
+/** Whether the folder's store.yml is of this organization in this mode. */
+export const storeFileIs = (org, mode, dir = projectDir()) => sameSource(storeFileSource(dir), { org, mode });
 /**
  * Writes an export: store.yml (meta first) and price_lists/<code>.csv. A file there that differs
  * from what the last export wrote (or that no export wrote) is the user's: without overwrite,
@@ -76,15 +82,19 @@ export function storeFileOrg(dir = projectDir()) {
 export function writeStoreFiles(data, opts) {
     const dir = opts.dir ?? projectDir();
     const last = readRecord(dir);
-    const meta = { org: data.meta?.org ?? null, exported_at: data.meta?.exported_at ?? new Date().toISOString() };
+    const meta = { org: data.meta?.org ?? null, mode: opts.mode, exported_at: data.meta?.exported_at ?? new Date().toISOString() };
     const yaml = `# The organization's setup, written by c11r config export. Edit it, then c11r config plan and c11r config apply.\n${YAML.stringify({ meta, ...data.store }, { lineWidth: 0 })}`;
     const files = { [STORE_FILE]: yaml };
     for (const [code, csv] of Object.entries(data.price_lists ?? {}))
         files[path.join(PRICE_LISTS_DIR, `${safeName(code)}.csv`)] = csv;
+    // Files of another organization or mode are not the last export's to replace: --yes first.
+    const other = last.org !== null && !sameSource(last, meta);
     const changed = (rel) => {
         const abs = path.join(dir, rel);
         if (!fs.existsSync(abs))
             return false;
+        if (other)
+            return true;
         const now = hashOf(fs.readFileSync(abs, 'utf8'));
         return last.files[rel] !== now;
     };
@@ -110,7 +120,7 @@ export function writeStoreFiles(data, opts) {
         fs.rmSync(path.join(dir, rel), { force: true });
         removed.push(path.join(dir, rel));
     }
-    writeRecord(dir, { org: meta.org, exported_at: meta.exported_at, files: Object.fromEntries(Object.entries(files).map(([rel, text]) => [rel, hashOf(text)])) });
+    writeRecord(dir, { org: meta.org, mode: meta.mode, exported_at: meta.exported_at, files: Object.fromEntries(Object.entries(files).map(([rel, text]) => [rel, hashOf(text)])) });
     clearDrift(dir);
     return { written, removed, dir };
 }
@@ -118,8 +128,8 @@ export function writeStoreFiles(data, opts) {
  * After a Configure write: in a folder whose store.yml names this organization, notes it in
  * .c11r/drift and answers the warning. Elsewhere, nothing.
  */
-export function markDrift(org, entry, dir = projectDir()) {
-    if (storeFileOrg(dir) !== org)
+export function markDrift(org, mode, entry, dir = projectDir()) {
+    if (!storeFileIs(org, mode, dir))
         return null;
     const list = readDrift(dir);
     list.push({ ...entry, at: new Date().toISOString() });
@@ -153,10 +163,10 @@ export function driftWarning(list) {
 function readRecord(dir) {
     try {
         const v = JSON.parse(fs.readFileSync(path.join(notes(dir), EXPORT_FILE), 'utf8'));
-        return { org: v.org ?? null, exported_at: v.exported_at ?? null, files: v.files && typeof v.files === 'object' ? v.files : {} };
+        return { org: v.org ?? null, mode: v.mode === 'live' ? 'live' : 'test', exported_at: v.exported_at ?? null, files: v.files && typeof v.files === 'object' ? v.files : {} };
     }
     catch {
-        return { org: null, exported_at: null, files: {} };
+        return { org: null, mode: 'test', exported_at: null, files: {} };
     }
 }
 function writeRecord(dir, r) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commercelayer/agent-cli",
-  "version": "1.0.0-dev.14",
+  "version": "1.0.0-dev.16",
   "description": "c11r: the Commerce Layer CLI for coding agents. One grammar, c11r <noun> <verb>, from a sandbox to a running organization.",
   "homepage": "https://commercelayer.ai",
   "keywords": [