@configdirector/cli 0.9.0-beta.1 → 0.10.0-beta.1

package/dist/configdirector.mjs

@@ -2,8 +2,8 @@
 import { homedir } from "node:os";
 import { Command, CommanderError, Option } from "commander";
 import * as v from "valibot";
-import { access, mkdir, open, readFile, readdir, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { mkdir, open, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { createInterface } from "node:readline";
 import ignore from "ignore";
 import picomatch from "picomatch";
@@ -12,7 +12,7 @@ import { promisify } from "node:util";
 import { randomUUID } from "node:crypto";
 import { text } from "node:stream/consumers";
 //#region package.json
-var version = "0.9.0-beta.1";
+var version = "0.10.0-beta.1";
 //#endregion
 //#region src/CliError.ts
 var CliError = class extends Error {
@@ -100,10 +100,15 @@ var UnexpectedApiResponseError = class extends CliError {
 	}
 };
 //#endregion
-//#region src/aligned-columns.ts
-const COLUMN_GAP = "   ";
-const widestCellOf = (rows, column) => Math.max(0, ...rows.map((row) => row[column]?.length ?? 0));
-const alignedColumns = (rows) => rows.map((row) => row.map((cell, column) => column === row.length - 1 ? cell : cell.padEnd(widestCellOf(rows, column))).join(COLUMN_GAP));
+//#region src/admin-api/config-creation.ts
+const CreatedConfigSchema = v.object({
+	key: v.string(),
+	type: v.string(),
+	role: v.string(),
+	lifetime: v.string(),
+	client: v.boolean(),
+	server: v.boolean()
+});
 //#endregion
 //#region src/admin-api/targeting-rules.ts
 const RuleValueSchema = v.union([
@@ -220,95 +225,349 @@ const ConfigWithTargetingRulesSchema = v.intersect([v.object({
 	targets: v.array(TargetingRulesInEnvironmentSchema)
 }), ConfigTypeSchema]);
 //#endregion
-//#region src/old-key-lines.ts
-const oldKeyLines = (requestedKey, currentKey) => requestedKey === currentKey ? [] : [`${requestedKey} is an old key of ${currentKey}.`];
-//#endregion
-//#region src/rule-sentences.ts
-const TRAIT_POINTER_PREFIX = "/";
-const ATTRIBUTE_LABELS = {
-	identifier: "context identifier",
-	kind: "context kind",
-	name: "context name",
-	appName: "app name",
-	appVersion: "app version"
-};
-const formatPercentage = (value) => Number(value.toFixed(3)).toString();
-const subjectOf = (condition) => {
-	if (condition.attribute === "traits" && condition.trait != null) return condition.trait.startsWith(TRAIT_POINTER_PREFIX) ? condition.trait.slice(1) : condition.trait;
-	return ATTRIBUTE_LABELS[condition.attribute] ?? condition.attribute;
-};
-const segmentNameOf = (segmentId, segments) => segments[segmentId]?.name ?? segmentId;
-const describeAttributeCondition = (condition) => `${subjectOf(condition)} ${condition.operator} ${condition.targetValues.map(String).join(", ")}`;
-const describeConditionGroup = (group) => group.map(describeAttributeCondition).join(" and ");
-const describeCondition = (condition, segments) => {
-	switch (condition.kind) {
-		case "attribute": return describeAttributeCondition(condition);
-		case "segment": return `${condition.operator} segment ${segmentNameOf(condition.segmentId, segments)}`;
-	}
-};
-const describePercentages = (percentages) => percentages.map((percentage) => `${formatPercentage(percentage.percentage)}% get ${String(percentage.value)}`).join(", ");
-const describeRule = (rule, segments) => {
-	if (rule.type === "percentage") return describePercentages(rule.percentages);
-	return `${rule.conditions.map((condition) => describeCondition(condition, segments)).join(" and ")}: ${rule.target === "value" ? String(rule.value) : describePercentages(rule.percentages)}`;
+//#region src/admin-api/scanned-repositories.ts
+const scannedRepositoryFields = {
+	name: v.string(),
+	commit: v.pipe(v.string(), v.transform((commit) => commit === "" ? null : commit)),
+	referenceCount: v.number(),
+	dynamicReferenceCount: v.number()
 };
+const ScannedRepositorySchema = v.object(scannedRepositoryFields);
+const ListedScannedRepositorySchema = v.object({
+	...scannedRepositoryFields,
+	scannedAt: v.pipe(v.string(), v.isoTimestamp())
+});
 //#endregion
-//#region src/configs/config-text.ts
-const boundsDescriptions = (bounds) => {
-	const limits = [bounds?.min, bounds?.max].flatMap((bound) => bound === void 0 ? [] : [`${bound.relation} ${bound.value}`]);
-	return limits.length === 0 ? [] : [limits.join(" and ")];
+//#region src/admin-api/segments.ts
+const SegmentSchema = v.object({
+	id: v.string(),
+	key: v.string(),
+	name: v.string(),
+	usages: v.array(v.unknown())
+});
+const SegmentDefinitionSchema = v.object({
+	key: v.string(),
+	name: v.string(),
+	groups: v.array(ConditionGroupSchema),
+	overrides: v.record(v.string(), v.array(ConditionGroupSchema))
+});
+//#endregion
+//#region src/admin-api/targeting-rules-reference.ts
+const TargetingRulesReferenceSchema = v.object({
+	notes: v.array(v.string()),
+	conditionKinds: v.array(v.string()),
+	conditionAttributes: v.array(v.string()),
+	contextKindOperators: v.array(v.string()),
+	segmentOperators: v.array(v.string()),
+	operatorsByTargetType: v.record(v.string(), v.array(v.string()))
+});
+//#endregion
+//#region src/admin-api/config-evaluation.ts
+const CheckedOutcomeSchema = v.picklist(["matched", "not-matched"]);
+const AttributeConditionExplanationSchema = v.object({
+	conditionId: v.string(),
+	kind: v.literal("attribute"),
+	outcome: CheckedOutcomeSchema,
+	resolvedValue: v.optional(v.unknown()),
+	resolvedType: v.picklist([
+		"absent",
+		"scalar",
+		"array",
+		"object",
+		"unknown-attribute"
+	])
+});
+const SegmentConditionExplanationSchema = v.object({
+	conditionId: v.string(),
+	kind: v.literal("segment"),
+	outcome: CheckedOutcomeSchema,
+	segmentId: v.string(),
+	segmentFound: v.boolean(),
+	matchedGroupIndex: v.optional(v.number())
+});
+const ConditionExplanationSchema = v.union([
+	v.object({
+		conditionId: v.string(),
+		outcome: v.literal("not-evaluated")
+	}),
+	AttributeConditionExplanationSchema,
+	SegmentConditionExplanationSchema
+]);
+const BucketSchema = v.object({
+	defaultedToPredefinedBucket: v.boolean(),
+	assignedPercentage: v.number(),
+	shares: v.array(v.object({
+		percentageId: v.string(),
+		from: v.number(),
+		to: v.number()
+	})),
+	selectedPercentageId: v.optional(v.string())
+});
+const RuleExplanationSchema = v.object({
+	ruleId: v.string(),
+	outcome: v.picklist([
+		"matched",
+		"not-matched",
+		"not-evaluated",
+		"errored"
+	]),
+	conditions: v.array(ConditionExplanationSchema),
+	bucket: v.optional(BucketSchema)
+});
+const ConfigEvaluationSchema = v.object({
+	key: v.string(),
+	environment: v.object({ name: v.string() }),
+	context: v.nullable(v.object({
+		kind: v.string(),
+		identifier: v.nullable(v.string())
+	})),
+	value: v.optional(v.string()),
+	servedBy: v.variant("kind", [v.object({
+		kind: v.literal("rule"),
+		ruleId: v.string()
+	}), v.object({ kind: v.literal("default") })]),
+	rules: v.array(RuleExplanationSchema),
+	targetingRules: v.object({
+		rules: v.array(RuleSchema),
+		defaultValue: v.string()
+	}),
+	segments: v.record(v.string(), v.object({ name: v.string() }))
+});
+//#endregion
+//#region src/admin-api/AdminApiClient.ts
+const ProjectSchema = v.object({
+	id: v.string(),
+	name: v.string(),
+	slug: v.string(),
+	organizationId: v.string(),
+	storeCodeSnippets: v.optional(v.boolean(), true)
+});
+const DescribedApiTokenSchema = v.object({
+	name: v.string(),
+	organization: v.object({
+		id: v.string(),
+		name: v.string()
+	}),
+	permissions: v.array(v.string()),
+	expiresAt: v.nullable(v.string())
+});
+const configFields = {
+	key: v.string(),
+	deprecatedKeys: v.array(v.object({ key: v.string() })),
+	role: v.string(),
+	lifetime: v.string(),
+	state: v.string(),
+	client: v.boolean(),
+	server: v.boolean()
 };
-const enumValuesDescription = ({ valueType, values }) => valueType === "number" ? `one of the numbers ${values.join(", ")}` : `one of ${values.join(", ")}`;
-const timespanRangeDescriptions = (range) => [`${range.min} to ${range.max} ${range.unit}`, ...range.allowFractions ? ["fractions allowed"] : []];
-const typeConstraintDescriptions = (config) => {
-	if (!hasTypeConstraints(config)) return [];
-	switch (config.type) {
-		case "integer":
-		case "float": return boundsDescriptions(config.typeOptions);
-		case "enum": return [enumValuesDescription(config.typeOptions)];
-		case "timespan": return timespanRangeDescriptions(config.typeOptions);
-		case "url": return config.typeOptions?.secureOnly ? ["HTTPS only"] : [];
-		case "json": return config.typeOptions?.useSchema ? ["checked against a JSON schema"] : [];
+const EnumConfigSchema = v.object({
+	...configFields,
+	type: v.literal("enum"),
+	typeOptions: v.object({
+		valueType: v.string(),
+		values: v.array(v.string())
+	})
+});
+const ConfigSchema = v.variant("type", [EnumConfigSchema, v.object({
+	...configFields,
+	type: v.pipe(v.string(), v.notValue("enum"))
+})]);
+const isEnumConfig = (config) => config.type === "enum";
+const EnvironmentSchema = v.object({
+	id: v.string(),
+	slug: v.string(),
+	name: v.string(),
+	live: v.boolean()
+});
+const ConfigActivitySchema = v.object({ latestEvaluations: v.array(v.object({
+	environment: v.object({ slug: v.string() }),
+	source: v.string(),
+	sdkName: v.nullable(v.string()),
+	sdkVersion: v.nullable(v.string()),
+	time: v.pipe(v.string(), v.isoTimestamp())
+})) });
+const TagSchema = v.object({ id: v.string() });
+const tagFilterQuery = (tagFilter) => {
+	switch (tagFilter.form) {
+		case "every-config": return "";
+		case "tagged": return `?${new URLSearchParams(tagFilter.tagIds.map((tagId) => ["tagIds", tagId]))}`;
+		case "untagged": return "?untagged=true";
 	}
 };
-const availabilityDescription = (config) => {
-	if (config.client && config.server) return "client and server SDKs";
-	if (config.client) return "client-only";
-	if (config.server) return "server-only";
-	return "served to no SDK";
-};
-const settingLines = (config) => [
-	...config.description ? [`Description: ${config.description}`] : [],
-	`Type: ${[config.type, ...typeConstraintDescriptions(config)].join(", ")}`,
-	`Role: ${config.role}`,
-	`Lifetime: ${config.lifetime}`,
-	`Availability: ${availabilityDescription(config)}`,
-	`Lifecycle state: ${config.state}`,
-	...config.tags.length === 0 ? [] : [`Tags: ${config.tags.map((tag) => tag.name).join(", ")}`]
-];
-const environmentHeading = (targetingRules) => targetingRules.environment.live ? `${targetingRules.environment.slug} (live)` : targetingRules.environment.slug;
-const targetingRuleLines = (targetingRules, segments) => [
-	environmentHeading(targetingRules),
-	...targetingRules.rules.map((rule, index) => `  ${index + 1}. ${describeRule(rule, segments)}`),
-	`  Default targeting rule: ${targetingRules.defaultValue}`
-];
-const configText = (config, requestedKey, segments) => [
-	...oldKeyLines(requestedKey, config.key),
-	config.key,
-	...settingLines(config).map((line) => `  ${line}`),
-	...config.targets.flatMap((targetingRules) => ["", ...targetingRuleLines(targetingRules, segments)]),
-	""
-].join("\n");
-//#endregion
-//#region src/file-contents.ts
-const readFileIfPresent = async (file) => {
+const MissingResourceBodySchema = v.strictObject({});
+const readJsonBody = async (response) => {
 	try {
-		return await readFile(file, "utf8");
-	} catch (error) {
-		if (error.code === "ENOENT") return;
-		throw error;
+		return await response.json();
+	} catch {
+		return;
 	}
 };
-const readOptionFile = async (argumentLabel, path, workingDirectory) => {
+const describeStatus = (response) => `HTTP ${response.status}`;
+const failureFor = (url, response, body) => {
+	switch (response.status) {
+		case 400: {
+			if (v.is(RepositoryLimitReachedBodySchema, body)) return new RepositoryLimitReachedError();
+			const validationError = v.safeParse(ApiValidationErrorBodySchema, body);
+			return validationError.success ? new ApiValidationError(validationError.output.errors) : new UnexpectedApiResponseError(url, describeStatus(response));
+		}
+		case 403: {
+			const authorizationError = v.safeParse(ApiAuthorizationErrorBodySchema, body);
+			return authorizationError.success ? new ApiAuthorizationError(authorizationError.output.code, authorizationError.output.error) : new UnexpectedApiResponseError(url, describeStatus(response));
+		}
+		case 404: {
+			const notFoundError = v.safeParse(EvaluationNotFoundBodySchema, body);
+			return notFoundError.success ? new EvaluationNotFoundError(notFoundError.output.code, notFoundError.output.error) : new UnexpectedApiResponseError(url, describeStatus(response));
+		}
+		case 429: {
+			const retryAfterSeconds = response.headers.get("retry-after");
+			return v.is(ServiceSuspendedBodySchema, body) && retryAfterSeconds !== null ? new ServiceSuspendedError(retryAfterSeconds) : new UnexpectedApiResponseError(url, describeStatus(response));
+		}
+		default: return new UnexpectedApiResponseError(url, describeStatus(response));
+	}
+};
+const isMissingResource = (received) => received.response.status === 404 && v.is(MissingResourceBodySchema, received.body);
+const parsedResponseOf = ({ url, response, body }, schema) => {
+	if (!response.ok) throw failureFor(url, response, body);
+	const parsedBody = v.safeParse(schema, body);
+	if (!parsedBody.success) throw new UnexpectedApiResponseError(url, `an ${describeStatus(response)} response the CLI cannot read`);
+	return {
+		responseBody: body,
+		parsedBody: parsedBody.output
+	};
+};
+var AdminApiClient = class {
+	constructor(connection) {
+		this.connection = connection;
+	}
+	describeApiToken() {
+		return this.get("/v1/api-token", DescribedApiTokenSchema);
+	}
+	listProjects() {
+		return this.get("/v1/projects", v.array(ProjectSchema));
+	}
+	async listConfigs(projectId, tagFilter) {
+		const { parsedBody: configs, responseBody } = await this.get(`/v1/projects/${encodeURIComponent(projectId)}/configs${tagFilterQuery(tagFilter)}`, v.array(ConfigSchema));
+		const receivedConfigs = v.parse(v.array(v.unknown()), responseBody);
+		return configs.map((config, index) => ({
+			config,
+			receivedConfig: receivedConfigs[index]
+		}));
+	}
+	listEnvironments(projectId) {
+		return this.get(`/v1/projects/${encodeURIComponent(projectId)}/environments`, v.array(EnvironmentSchema));
+	}
+	getConfig(projectId, configKey) {
+		return this.getIfFound(`/v1/projects/${encodeURIComponent(projectId)}/configs/${encodeURIComponent(configKey)}`, ConfigWithTargetingRulesSchema);
+	}
+	getConfigActivity(projectId, configKey) {
+		return this.getIfFound(`/v1/projects/${encodeURIComponent(projectId)}/configs/${encodeURIComponent(configKey)}/activity`, ConfigActivitySchema);
+	}
+	listSegments(projectId) {
+		return this.get(`/v1/projects/${encodeURIComponent(projectId)}/segments`, v.array(SegmentSchema));
+	}
+	getSegment(projectId, segmentKey) {
+		return this.getIfFound(`/v1/projects/${encodeURIComponent(projectId)}/segments/${encodeURIComponent(segmentKey)}`, SegmentDefinitionSchema);
+	}
+	async findTagByName(projectId, name) {
+		return (await this.getIfFound(`/v1/projects/${encodeURIComponent(projectId)}/tags/by-name?${new URLSearchParams({ name })}`, TagSchema))?.parsedBody;
+	}
+	createConfig(projectId, request) {
+		return this.requestJson(`/v1/projects/${encodeURIComponent(projectId)}/configs`, CreatedConfigSchema, {
+			method: "POST",
+			body: request
+		});
+	}
+	async evaluateConfig(projectId, configKey, request) {
+		const { responseBody, parsedBody } = await this.requestJson(`/v1/projects/${encodeURIComponent(projectId)}/configs/${encodeURIComponent(configKey)}/evaluate`, ConfigEvaluationSchema, {
+			method: "POST",
+			body: request
+		});
+		return {
+			evaluation: parsedBody,
+			responseBody
+		};
+	}
+	getTargetingRulesReference() {
+		return this.get("/v1/targeting-rules-reference", TargetingRulesReferenceSchema);
+	}
+	async replaceTargetingRules(projectId, configKey, request) {
+		return await this.requestIfFound(`/v1/projects/${encodeURIComponent(projectId)}/configs/${encodeURIComponent(configKey)}/targets`, v.unknown(), {
+			method: "PUT",
+			body: request
+		}) === void 0 ? "not-found" : "replaced";
+	}
+	uploadRepositoryScan(projectId, repositoryName, upload) {
+		return this.requestJson(`/v1/projects/${encodeURIComponent(projectId)}/repositories/${encodeURIComponent(repositoryName)}`, ScannedRepositorySchema, {
+			method: "PUT",
+			body: upload
+		});
+	}
+	listScannedRepositories(projectId) {
+		return this.get(`/v1/projects/${encodeURIComponent(projectId)}/repositories`, v.array(ListedScannedRepositorySchema));
+	}
+	async removeScannedRepository(projectId, repositoryName) {
+		return await this.requestIfFound(`/v1/projects/${encodeURIComponent(projectId)}/repositories/${encodeURIComponent(repositoryName)}`, v.unknown(), { method: "DELETE" }) === void 0 ? "not-found" : "removed";
+	}
+	async archiveConfig(projectId, configKey) {
+		return await this.requestIfFound(`/v1/projects/${encodeURIComponent(projectId)}/configs/${encodeURIComponent(configKey)}`, v.unknown(), { method: "DELETE" }) === void 0 ? "not-found" : "archived";
+	}
+	get(path, schema) {
+		return this.requestJson(path, schema, { method: "GET" });
+	}
+	getIfFound(path, schema) {
+		return this.requestIfFound(path, schema, { method: "GET" });
+	}
+	async requestIfFound(path, schema, request) {
+		const received = await this.send(path, request);
+		return isMissingResource(received) ? void 0 : parsedResponseOf(received, schema);
+	}
+	async requestJson(path, schema, request) {
+		return parsedResponseOf(await this.send(path, request), schema);
+	}
+	async send(path, request) {
+		const url = `${this.connection.baseUrl}${path}`;
+		const response = await this.fetchResponse(url, request);
+		return {
+			url,
+			response,
+			body: await readJsonBody(response)
+		};
+	}
+	async fetchResponse(url, request) {
+		const headers = {
+			Accept: "application/json",
+			Authorization: `Bearer ${this.connection.token}`,
+			"User-Agent": `configdirector-cli/${version}`,
+			"X-SourceClient": "cli"
+		};
+		try {
+			return await fetch(url, "body" in request ? {
+				method: request.method,
+				headers: {
+					...headers,
+					"Content-Type": "application/json"
+				},
+				body: JSON.stringify(request.body)
+			} : {
+				method: request.method,
+				headers
+			});
+		} catch (error) {
+			throw new ApiUnreachableError(this.connection.baseUrl, error);
+		}
+	}
+};
+//#endregion
+//#region src/file-contents.ts
+const readFileIfPresent = async (file) => {
+	try {
+		return await readFile(file, "utf8");
+	} catch (error) {
+		if (error.code === "ENOENT") return;
+		throw error;
+	}
+};
+const readOptionFile = async (argumentLabel, path, workingDirectory) => {
 	const file = resolve(workingDirectory, path);
 	const contents = await readFileIfPresent(file);
 	if (contents === void 0) throw new CliError(`${argumentLabel} names ${file}, which does not exist.`);
@@ -333,618 +592,580 @@ const parseJson = (contents) => {
 const pathExists = (path) => stat(path).then(() => true, () => false);
 const fileExists = (path) => stat(path).then((stats) => stats.isFile(), () => false);
 //#endregion
-//#region src/configs/new-config.ts
-const CONFIG_TYPES = [
-	"boolean",
-	"string",
-	"integer",
-	"float",
-	"timespan",
-	"enum",
-	"url",
-	"json"
-];
-const CONFIG_ROLES = [
-	"config",
-	"flag",
-	"kill-switch",
-	"experiment"
-];
-const CONFIG_LIFETIMES = ["permanent", "temporary"];
-const TIMESPAN_UNITS = [
-	"milliseconds",
-	"seconds",
-	"minutes"
-];
-const ENUM_VALUE_TYPES = ["string", "number"];
-const DEFAULT_ENUM_VALUE_TYPE = "string";
-const TYPE_CONSTRAINT_OPTION_NAMES = {
-	min: "--min",
-	max: "--max",
-	exclusiveMin: "--exclusive-min",
-	exclusiveMax: "--exclusive-max",
-	unit: "--unit",
-	allowFractions: "--allow-fractions",
-	allowedValue: "--allowed-value",
-	enumValueType: "--enum-value-type",
-	httpsOnly: "--https-only",
-	jsonSchema: "--json-schema"
+//#region src/project-settings.ts
+const ProjectSettingsSchema = v.looseObject({
+	project: v.optional(v.string()),
+	organization: v.optional(v.string()),
+	include: v.optional(v.array(v.string())),
+	exclude: v.optional(v.array(v.string())),
+	ignoreKeys: v.optional(v.array(v.string()))
+});
+const projectSettingsFile = (workingDirectory) => join(workingDirectory, "configdirector.json");
+const describeIssue = (issue) => {
+	const path = v.getDotPath(issue);
+	return path === null ? issue.message : `${path}: ${issue.message}`;
 };
-const availabilityOf = (options) => {
-	if (options.clientOnly) return {
-		client: true,
-		server: false
+const projectSettingsOf = (file, contents) => {
+	const settings = v.safeParse(ProjectSettingsSchema, parseJson(contents));
+	if (!settings.success) throw new CliError(`${file} is not valid (${settings.issues.map(describeIssue).join("; ")}).`);
+	return settings.output;
+};
+const readProjectSettings = async (workingDirectory) => {
+	const file = projectSettingsFile(workingDirectory);
+	const contents = await readFileIfPresent(file);
+	return contents === void 0 ? void 0 : projectSettingsOf(file, contents);
+};
+//#endregion
+//#region src/sign-ins/chosen-sign-in.ts
+const organizationReferenceOf = (context, settings) => {
+	if (context.organizationOption !== void 0) return {
+		from: "option",
+		reference: context.organizationOption
 	};
-	if (options.serverOnly) return {
-		client: false,
-		server: true
+	if (settings?.organization !== void 0) return {
+		from: "settings-file",
+		reference: settings.organization
 	};
+	return { from: "nowhere" };
+};
+const describeSignIn = (signIn) => `${signIn.organization.name} (${signIn.organization.id})`;
+const describeSignIns = (signIns) => signIns.map(describeSignIn).join(", ");
+const sameName = (name, otherName) => name.localeCompare(otherName, void 0, { sensitivity: "accent" }) === 0;
+const signInWithId = (signIns, organizationId) => signIns.find((signIn) => signIn.organization.id === organizationId);
+const signInNamedByOption = (signIns, reference) => {
+	const signInWithReferenceAsId = signInWithId(signIns, reference);
+	if (signInWithReferenceAsId !== void 0) return signInWithReferenceAsId;
+	const signInsWithName = signIns.filter((signIn) => sameName(signIn.organization.name, reference));
+	const [onlySignInWithName] = signInsWithName;
+	if (signInsWithName.length > 1) throw new CliError(`${signInsWithName.length} CLI sign-ins are named "${reference}": ${describeSignIns(signInsWithName)}. Name the organization by its id.`);
+	if (onlySignInWithName === void 0) throw new CliError(`No CLI sign-in is for the organization "${reference}". The CLI sign-ins are for ${describeSignIns(signIns)}.`);
+	return onlySignInWithName;
+};
+const signInNamedBySettingsFile = (signIns, organizationId) => {
+	const signIn = signInWithId(signIns, organizationId);
+	if (signIn === void 0) throw new CliError(`No CLI sign-in is for the organization ${organizationId}, which configdirector.json names. The CLI sign-ins are for ${describeSignIns(signIns)}. Run \`configdirector login\` with a token of that organization.`);
+	return signIn;
+};
+const onlySignIn = (signIns) => {
+	const [firstSignIn] = signIns;
+	if (firstSignIn === void 0) return { outcome: "no-sign-in" };
+	if (signIns.length > 1) throw new CliError(`There are CLI sign-ins for ${describeSignIns(signIns)}. Name the organization with --organization, CONFIGDIRECTOR_ORGANIZATION or \`organization\` in configdirector.json, which \`configdirector init\` writes.`);
 	return {
-		client: true,
-		server: true
+		outcome: "chosen",
+		signIn: firstSignIn
 	};
 };
-const BOOLEAN_VALUES = new Map([["true", true], ["false", false]]);
-const numberOf = (text) => {
-	const value = parseJson(text);
-	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-};
-const constraintNumberOf = (options, option) => {
-	const text = options[option];
-	if (text === void 0) return;
-	const value = numberOf(text);
-	if (value === void 0) throw new CliError(`${TYPE_CONSTRAINT_OPTION_NAMES[option]} takes a number, not ${text}.`);
-	return value;
+const chosenSignIn = (signIns, organizationReference) => {
+	if (signIns.length === 0) return { outcome: "no-sign-in" };
+	switch (organizationReference.from) {
+		case "option": return {
+			outcome: "chosen",
+			signIn: signInNamedByOption(signIns, organizationReference.reference)
+		};
+		case "settings-file": return {
+			outcome: "chosen",
+			signIn: signInNamedBySettingsFile(signIns, organizationReference.reference)
+		};
+		case "nowhere": return onlySignIn(signIns);
+	}
 };
-const boundOf = (options, option, relation) => {
-	const value = constraintNumberOf(options, option);
-	return value === void 0 ? void 0 : {
-		relation,
-		value
-	};
+//#endregion
+//#region src/user-config-directory.ts
+const platformConfigDirectory = (invocation) => {
+	switch (invocation.platform) {
+		case "darwin": return join(invocation.homeDirectory, "Library", "Application Support");
+		case "win32": return nonEmptyVariable(invocation, "APPDATA") ?? join(invocation.homeDirectory, "AppData", "Roaming");
+		default: return join(invocation.homeDirectory, ".config");
+	}
 };
-const numericBoundsOf = (options) => ({
-	min: boundOf(options, "min", ">=") ?? boundOf(options, "exclusiveMin", ">"),
-	max: boundOf(options, "max", "<=") ?? boundOf(options, "exclusiveMax", "<")
-});
-const jsonTextOf = async ({ argumentLabel, text, workingDirectory }) => {
-	const jsonText = (await atFileArgumentText(argumentLabel, text, workingDirectory)).trim();
-	return parseJson(jsonText) === void 0 ? void 0 : jsonText;
-};
-const jsonSchemaOptionsOf = async (options, workingDirectory) => {
-	if (options.jsonSchema === void 0) return;
-	const { file, contents } = await readOptionFile(TYPE_CONSTRAINT_OPTION_NAMES.jsonSchema, options.jsonSchema, workingDirectory);
-	const schema = parseJson(contents);
-	if (schema === void 0) throw new CliError(`${TYPE_CONSTRAINT_OPTION_NAMES.jsonSchema} names ${file}, which is not JSON.`);
+const userConfigDirectory = (invocation) => join(nonEmptyVariable(invocation, "XDG_CONFIG_HOME") ?? platformConfigDirectory(invocation), "configdirector");
+//#endregion
+//#region src/sign-ins/config-json-token.ts
+const ConfigJsonSchema = v.object({ token: v.string() });
+const configJsonFile = (invocation) => join(userConfigDirectory(invocation), "config.json");
+const readConfigJsonToken = async (invocation) => {
+	const file = configJsonFile(invocation);
+	const contents = await readFileIfPresent(file);
+	if (contents === void 0) return;
+	const configJson = v.safeParse(ConfigJsonSchema, parseJson(contents));
+	if (!configJson.success) throw new CliError(`${file} does not hold a saved API token. Delete it and run \`configdirector login\`.`);
 	return {
-		useSchema: true,
-		schema
+		file,
+		token: configJson.output.token
 	};
 };
-const timespanRangeOf = async (options) => {
-	if (options.unit === void 0 || options.min === void 0 || options.max === void 0) throw new CliError("--type timespan needs --unit, --min and --max.");
-	return {
-		unit: options.unit,
-		min: constraintNumberOf(options, "min"),
-		max: constraintNumberOf(options, "max"),
-		allowFractions: options.allowFractions
-	};
+const deleteConfigJson = (configJsonToken) => rm(configJsonToken.file, { force: true });
+//#endregion
+//#region src/sign-ins/sign-ins-file.ts
+const OrganizationSchema = v.object({
+	id: v.string(),
+	name: v.string()
+});
+const SignInSchema = v.object({
+	organization: OrganizationSchema,
+	token: v.string()
+});
+const SignInsFileSchema = v.object({ signIns: v.array(SignInSchema) });
+const signInsFile = (invocation) => join(userConfigDirectory(invocation), "sign-ins.json");
+const readSignInsFile = async (invocation) => {
+	const file = signInsFile(invocation);
+	const contents = await readFileIfPresent(file);
+	if (contents === void 0) return [];
+	const parsedFile = v.safeParse(SignInsFileSchema, parseJson(contents));
+	if (!parsedFile.success) throw new CliError(`${file} does not hold CLI sign-ins. Delete it and run \`configdirector login\` again.`);
+	return parsedFile.output.signIns;
 };
-const NUMERIC_BOUND_OPTIONS = [
-	"min",
-	"max",
-	"exclusiveMin",
-	"exclusiveMax"
-];
-const CONFIG_TYPE_RULES = {
-	boolean: {
-		constraintOptions: [],
-		valueDescription: "true or false",
-		valueOf: async ({ text }) => BOOLEAN_VALUES.get(text),
-		typeOptionsOf: async () => void 0
-	},
-	string: {
-		constraintOptions: [],
-		valueDescription: "text",
-		valueOf: async ({ text }) => text,
-		typeOptionsOf: async () => void 0
-	},
-	integer: {
-		constraintOptions: NUMERIC_BOUND_OPTIONS,
-		valueDescription: "a number",
-		valueOf: async ({ text }) => numberOf(text),
-		typeOptionsOf: async (options) => ({
-			isInteger: true,
-			...numericBoundsOf(options)
-		})
-	},
-	float: {
-		constraintOptions: NUMERIC_BOUND_OPTIONS,
-		valueDescription: "a number",
-		valueOf: async ({ text }) => numberOf(text),
-		typeOptionsOf: async (options) => ({
-			isInteger: false,
-			...numericBoundsOf(options)
-		})
-	},
-	timespan: {
-		constraintOptions: [
-			"min",
-			"max",
-			"unit",
-			"allowFractions"
-		],
-		valueDescription: "a number",
-		valueOf: async ({ text }) => numberOf(text),
-		typeOptionsOf: timespanRangeOf
-	},
-	enum: {
-		constraintOptions: ["allowedValue", "enumValueType"],
-		valueDescription: "text",
-		valueOf: async ({ text }) => text,
-		typeOptionsOf: async (options) => ({
-			values: options.allowedValue ?? [],
-			valueType: options.enumValueType ?? DEFAULT_ENUM_VALUE_TYPE
-		})
-	},
-	url: {
-		constraintOptions: ["httpsOnly"],
-		valueDescription: "text",
-		valueOf: async ({ text }) => text,
-		typeOptionsOf: async (options) => ({ secureOnly: options.httpsOnly === true })
-	},
-	json: {
-		constraintOptions: ["jsonSchema"],
-		valueDescription: "JSON or @<file>",
-		valueOf: jsonTextOf,
-		typeOptionsOf: jsonSchemaOptionsOf
+const writeSignInsFile = async (invocation, signIns) => {
+	const file = signInsFile(invocation);
+	await mkdir(dirname(file), {
+		recursive: true,
+		mode: 448
+	});
+	const handle = await open(file, "w", 384);
+	try {
+		await handle.chmod(384);
+		await handle.writeFile(`${JSON.stringify({ signIns }, null, 2)}\n`);
+	} finally {
+		await handle.close();
 	}
+	return file;
 };
-const typeAlternatives = (types) => types.length === 1 ? `${types[0]}` : `${types.slice(0, -1).join(", ")} or ${types.at(-1)}`;
-const typesTaking = (option) => CONFIG_TYPES.filter((type) => CONFIG_TYPE_RULES[type].constraintOptions.includes(option));
-const typeConstraintHelpGroup = (option) => `Options for --type ${typeAlternatives(typesTaking(option))}:`;
-const TYPE_CONSTRAINT_OPTIONS = Object.keys(TYPE_CONSTRAINT_OPTION_NAMES);
-const rejectOptionsOfOtherTypes = (options) => {
-	const { constraintOptions } = CONFIG_TYPE_RULES[options.type];
-	const otherTypeOption = TYPE_CONSTRAINT_OPTIONS.find((option) => options[option] !== void 0 && !constraintOptions.includes(option));
-	if (otherTypeOption !== void 0) throw new CliError(`${TYPE_CONSTRAINT_OPTION_NAMES[otherTypeOption]} cannot be used with --type ${options.type}. It applies to --type ${typeAlternatives(typesTaking(otherTypeOption))}.`);
+//#endregion
+//#region src/sign-ins/sign-ins.ts
+const isFor = (signIn, organization) => signIn.organization.id === organization.id;
+const withSignIn = (signIns, signIn) => signIns.some((savedSignIn) => isFor(savedSignIn, signIn.organization)) ? signIns.map((savedSignIn) => isFor(savedSignIn, signIn.organization) ? signIn : savedSignIn) : [...signIns, signIn];
+const withoutSignIn = (signIns, organization) => signIns.filter((savedSignIn) => !isFor(savedSignIn, organization));
+const configJsonTokenMoveOf = async (context, configJsonToken) => {
+	const client = new AdminApiClient({
+		baseUrl: context.baseUrl,
+		token: configJsonToken.token
+	});
+	try {
+		const { parsedBody: apiToken } = await client.describeApiToken();
+		return {
+			outcome: "moved",
+			signIn: {
+				organization: apiToken.organization,
+				token: configJsonToken.token
+			}
+		};
+	} catch (error) {
+		if (error instanceof ApiAuthorizationError) return {
+			outcome: "rejected",
+			code: error.code
+		};
+		throw error;
+	}
 };
-const typedValueOf = async (type, argument) => {
-	const rules = CONFIG_TYPE_RULES[type];
-	const value = await rules.valueOf(argument);
-	if (value === void 0) throw new CliError(`${argument.argumentLabel} takes ${rules.valueDescription} with --type ${type}, not ${argument.text}.`);
-	return value;
+const withConfigJsonTokenMoved = async (context, signIns) => {
+	const configJsonToken = await readConfigJsonToken(context.invocation);
+	if (configJsonToken === void 0) return signIns;
+	const move = await configJsonTokenMoveOf(context, configJsonToken);
+	switch (move.outcome) {
+		case "moved": {
+			const movedSignIns = withSignIn(signIns, move.signIn);
+			await writeSignInsFile(context.invocation, movedSignIns);
+			await deleteConfigJson(configJsonToken);
+			return movedSignIns;
+		}
+		case "rejected":
+			await deleteConfigJson(configJsonToken);
+			context.invocation.stderr.write(`The API token saved by an earlier version in ${configJsonToken.file} was rejected (${move.code}), so the file was deleted. Run \`configdirector login\` to sign in again.
+`);
+			return signIns;
+	}
 };
-const VARIATION_SEPARATOR = "=";
-const variationOf = async (type, variation, workingDirectory) => {
-	const separatorIndex = variation.indexOf(VARIATION_SEPARATOR);
-	const name = variation.slice(0, separatorIndex);
-	if (separatorIndex === -1 || name === "") throw new CliError(`--variation takes name=value, not ${variation}.`);
-	const text = variation.slice(separatorIndex + 1);
-	return {
-		name,
-		value: await typedValueOf(type, {
-			argumentLabel: `--variation ${name}`,
-			text,
-			workingDirectory
-		})
-	};
+const savedSignIns = async (context) => withConfigJsonTokenMoved(context, await readSignInsFile(context.invocation));
+const saveSignIn = async (context, signIn) => writeSignInsFile(context.invocation, withSignIn(await savedSignIns(context), signIn));
+const removeSignIn = async (context, signIns, organization) => writeSignInsFile(context.invocation, withoutSignIn(signIns, organization));
+//#endregion
+//#region src/configured-api-token.ts
+const describeApiTokenSource = (source) => {
+	switch (source.from) {
+		case "token-option": return "--token";
+		case "token-variable": return "CONFIGDIRECTOR_TOKEN";
+		case "sign-in": return `the CLI sign-in for ${source.signIn.organization.name}`;
+	}
 };
-const variationsOf = async (options, workingDirectory) => {
-	const variations = [];
-	for (const variation of options.variation ?? []) variations.push(await variationOf(options.type, variation, workingDirectory));
-	return variations;
+const refuseOrganizationWithExplicitToken = (context) => {
+	if (context.organizationOption !== void 0) throw new CliError("--organization and CONFIGDIRECTOR_ORGANIZATION pick a CLI sign-in, so neither can be used together with --token or CONFIGDIRECTOR_TOKEN.");
 };
-const newConfigOf = async (options, workingDirectory) => {
-	rejectOptionsOfOtherTypes(options);
-	return {
-		key: options.key,
-		description: options.description,
-		role: options.role,
-		lifetime: options.lifetime,
-		type: options.type,
-		typeOptions: await CONFIG_TYPE_RULES[options.type].typeOptionsOf(options, workingDirectory),
-		...availabilityOf(options),
-		variations: await variationsOf(options, workingDirectory),
-		defaultValue: await typedValueOf(options.type, {
-			argumentLabel: "--default-value",
-			text: options.defaultValue,
-			workingDirectory
-		})
-	};
+const explicitApiToken = (context) => {
+	if (context.tokenOption !== void 0) {
+		refuseOrganizationWithExplicitToken(context);
+		return {
+			token: context.tokenOption,
+			source: { from: "token-option" }
+		};
+	}
+	const tokenVariable = nonEmptyVariable(context.invocation, "CONFIGDIRECTOR_TOKEN");
+	if (tokenVariable !== void 0) {
+		refuseOrganizationWithExplicitToken(context);
+		return {
+			token: tokenVariable,
+			source: { from: "token-variable" }
+		};
+	}
 };
-//#endregion
-//#region src/admin-api/config-creation.ts
-const CreatedConfigSchema = v.object({
-	key: v.string(),
-	type: v.string(),
-	role: v.string(),
-	lifetime: v.string(),
-	client: v.boolean(),
-	server: v.boolean()
+const signInApiToken = (signIn) => ({
+	token: signIn.token,
+	source: {
+		from: "sign-in",
+		signIn
+	}
 });
+const chosenSignInApiToken = (signIns, organizationReference) => {
+	const choice = chosenSignIn(signIns, organizationReference);
+	switch (choice.outcome) {
+		case "chosen": return signInApiToken(choice.signIn);
+		case "no-sign-in": throw new CliError("No API token found. Set CONFIGDIRECTOR_TOKEN, pass --token, or run `configdirector login`.");
+	}
+};
+const apiTokensToSearch = async (context) => {
+	const explicitToken = explicitApiToken(context);
+	if (explicitToken !== void 0) return [explicitToken];
+	const signIns = await savedSignIns(context);
+	const organizationReference = organizationReferenceOf(context, void 0);
+	if (organizationReference.from === "nowhere" && signIns.length > 0) return signIns.map(signInApiToken);
+	return [chosenSignInApiToken(signIns, organizationReference)];
+};
+const configuredApiToken = async (context) => {
+	const explicitToken = explicitApiToken(context);
+	if (explicitToken !== void 0) return explicitToken;
+	const settings = await readProjectSettings(context.invocation.workingDirectory);
+	return chosenSignInApiToken(await savedSignIns(context), organizationReferenceOf(context, settings));
+};
 //#endregion
-//#region src/admin-api/scanned-repositories.ts
-const scannedRepositoryFields = {
-	name: v.string(),
-	commit: v.pipe(v.string(), v.transform((commit) => commit === "" ? null : commit)),
-	referenceCount: v.number(),
-	dynamicReferenceCount: v.number()
+//#region src/utc-minute.ts
+const utcMinute = (time) => {
+	const isoTime = new Date(time).toISOString();
+	return `${isoTime.slice(0, 10)} ${isoTime.slice(11, 16)} UTC`;
 };
-const ScannedRepositorySchema = v.object(scannedRepositoryFields);
-const ListedScannedRepositorySchema = v.object({
-	...scannedRepositoryFields,
-	scannedAt: v.pipe(v.string(), v.isoTimestamp())
-});
 //#endregion
-//#region src/admin-api/segments.ts
-const SegmentSchema = v.object({
-	id: v.string(),
-	key: v.string(),
-	name: v.string(),
-	usages: v.array(v.unknown())
-});
-const SegmentDefinitionSchema = v.object({
-	key: v.string(),
-	name: v.string(),
-	groups: v.array(ConditionGroupSchema),
-	overrides: v.record(v.string(), v.array(ConditionGroupSchema))
-});
+//#region src/commands/api-token.ts
+const apiTokenLines = (apiToken, source) => [
+	`Organization: ${apiToken.organization.name} (${apiToken.organization.id})`,
+	`Name: ${apiToken.name}`,
+	`Permissions: ${apiToken.permissions.length === 0 ? "none" : apiToken.permissions.join(", ")}`,
+	`Expires: ${apiToken.expiresAt === null ? "never" : utcMinute(apiToken.expiresAt)}`,
+	`Source: ${describeApiTokenSource(source)}`
+];
+const getApiToken = async (context) => {
+	const { token, source } = await configuredApiToken(context);
+	const { parsedBody: apiToken, responseBody } = await new AdminApiClient({
+		baseUrl: context.baseUrl,
+		token
+	}).describeApiToken();
+	return {
+		json: responseBody,
+		text: [...apiTokenLines(apiToken, source), ""].join("\n"),
+		exitCode: ExitCode.success
+	};
+};
 //#endregion
-//#region src/admin-api/targeting-rules-reference.ts
-const TargetingRulesReferenceSchema = v.object({
-	notes: v.array(v.string()),
-	conditionKinds: v.array(v.string()),
-	conditionAttributes: v.array(v.string()),
-	contextKindOperators: v.array(v.string()),
-	segmentOperators: v.array(v.string()),
-	operatorsByTargetType: v.record(v.string(), v.array(v.string()))
-});
+//#region src/aligned-columns.ts
+const COLUMN_GAP = "   ";
+const widestCellOf = (rows, column) => Math.max(0, ...rows.map((row) => row[column]?.length ?? 0));
+const alignedColumns = (rows) => rows.map((row) => row.map((cell, column) => column === row.length - 1 ? cell : cell.padEnd(widestCellOf(rows, column))).join(COLUMN_GAP));
 //#endregion
-//#region src/admin-api/config-evaluation.ts
-const CheckedOutcomeSchema = v.picklist(["matched", "not-matched"]);
-const AttributeConditionExplanationSchema = v.object({
-	conditionId: v.string(),
-	kind: v.literal("attribute"),
-	outcome: CheckedOutcomeSchema,
-	resolvedValue: v.optional(v.unknown()),
-	resolvedType: v.picklist([
-		"absent",
-		"scalar",
-		"array",
-		"object",
-		"unknown-attribute"
-	])
-});
-const SegmentConditionExplanationSchema = v.object({
-	conditionId: v.string(),
-	kind: v.literal("segment"),
-	outcome: CheckedOutcomeSchema,
-	segmentId: v.string(),
-	segmentFound: v.boolean(),
-	matchedGroupIndex: v.optional(v.number())
-});
-const ConditionExplanationSchema = v.union([
-	v.object({
-		conditionId: v.string(),
-		outcome: v.literal("not-evaluated")
-	}),
-	AttributeConditionExplanationSchema,
-	SegmentConditionExplanationSchema
-]);
-const BucketSchema = v.object({
-	defaultedToPredefinedBucket: v.boolean(),
-	assignedPercentage: v.number(),
-	shares: v.array(v.object({
-		percentageId: v.string(),
-		from: v.number(),
-		to: v.number()
-	})),
-	selectedPercentageId: v.optional(v.string())
-});
-const RuleExplanationSchema = v.object({
-	ruleId: v.string(),
-	outcome: v.picklist([
-		"matched",
-		"not-matched",
-		"not-evaluated",
-		"errored"
-	]),
-	conditions: v.array(ConditionExplanationSchema),
-	bucket: v.optional(BucketSchema)
-});
-const ConfigEvaluationSchema = v.object({
-	key: v.string(),
-	environment: v.object({ name: v.string() }),
-	context: v.nullable(v.object({
-		kind: v.string(),
-		identifier: v.nullable(v.string())
-	})),
-	value: v.optional(v.string()),
-	servedBy: v.variant("kind", [v.object({
-		kind: v.literal("rule"),
-		ruleId: v.string()
-	}), v.object({ kind: v.literal("default") })]),
-	rules: v.array(RuleExplanationSchema),
-	targetingRules: v.object({
-		rules: v.array(RuleSchema),
-		defaultValue: v.string()
-	}),
-	segments: v.record(v.string(), v.object({ name: v.string() }))
-});
+//#region src/old-key-lines.ts
+const oldKeyLines = (requestedKey, currentKey) => requestedKey === currentKey ? [] : [`${requestedKey} is an old key of ${currentKey}.`];
 //#endregion
-//#region src/admin-api/AdminApiClient.ts
-const ProjectSchema = v.object({
-	id: v.string(),
-	name: v.string(),
-	slug: v.string(),
-	storeCodeSnippets: v.optional(v.boolean(), true)
-});
-const configFields = {
-	key: v.string(),
-	deprecatedKeys: v.array(v.object({ key: v.string() })),
-	role: v.string(),
-	lifetime: v.string(),
-	state: v.string(),
-	client: v.boolean(),
-	server: v.boolean()
+//#region src/rule-sentences.ts
+const TRAIT_POINTER_PREFIX = "/";
+const ATTRIBUTE_LABELS = {
+	identifier: "context identifier",
+	kind: "context kind",
+	name: "context name",
+	appName: "app name",
+	appVersion: "app version"
 };
-const EnumConfigSchema = v.object({
-	...configFields,
-	type: v.literal("enum"),
-	typeOptions: v.object({
-		valueType: v.string(),
-		values: v.array(v.string())
-	})
-});
-const ConfigSchema = v.variant("type", [EnumConfigSchema, v.object({
-	...configFields,
-	type: v.pipe(v.string(), v.notValue("enum"))
-})]);
-const isEnumConfig = (config) => config.type === "enum";
-const EnvironmentSchema = v.object({
-	id: v.string(),
-	slug: v.string(),
-	name: v.string(),
-	live: v.boolean()
-});
-const ConfigActivitySchema = v.object({ latestEvaluations: v.array(v.object({
-	environment: v.object({ slug: v.string() }),
-	source: v.string(),
-	sdkName: v.nullable(v.string()),
-	sdkVersion: v.nullable(v.string()),
-	time: v.pipe(v.string(), v.isoTimestamp())
-})) });
-const TagSchema = v.object({ id: v.string() });
-const tagFilterQuery = (tagFilter) => {
-	switch (tagFilter.form) {
-		case "every-config": return "";
-		case "tagged": return `?${new URLSearchParams(tagFilter.tagIds.map((tagId) => ["tagIds", tagId]))}`;
-		case "untagged": return "?untagged=true";
-	}
+const formatPercentage = (value) => Number(value.toFixed(3)).toString();
+const subjectOf = (condition) => {
+	if (condition.attribute === "traits" && condition.trait != null) return condition.trait.startsWith(TRAIT_POINTER_PREFIX) ? condition.trait.slice(1) : condition.trait;
+	return ATTRIBUTE_LABELS[condition.attribute] ?? condition.attribute;
 };
-const MissingResourceBodySchema = v.strictObject({});
-const readJsonBody = async (response) => {
-	try {
-		return await response.json();
-	} catch {
-		return;
+const segmentNameOf = (segmentId, segments) => segments[segmentId]?.name ?? segmentId;
+const describeAttributeCondition = (condition) => `${subjectOf(condition)} ${condition.operator} ${condition.targetValues.map(String).join(", ")}`;
+const describeConditionGroup = (group) => group.map(describeAttributeCondition).join(" and ");
+const describeCondition = (condition, segments) => {
+	switch (condition.kind) {
+		case "attribute": return describeAttributeCondition(condition);
+		case "segment": return `${condition.operator} segment ${segmentNameOf(condition.segmentId, segments)}`;
 	}
 };
-const describeStatus = (response) => `HTTP ${response.status}`;
-const failureFor = (url, response, body) => {
-	switch (response.status) {
-		case 400: {
-			if (v.is(RepositoryLimitReachedBodySchema, body)) return new RepositoryLimitReachedError();
-			const validationError = v.safeParse(ApiValidationErrorBodySchema, body);
-			return validationError.success ? new ApiValidationError(validationError.output.errors) : new UnexpectedApiResponseError(url, describeStatus(response));
-		}
-		case 403: {
-			const authorizationError = v.safeParse(ApiAuthorizationErrorBodySchema, body);
-			return authorizationError.success ? new ApiAuthorizationError(authorizationError.output.code, authorizationError.output.error) : new UnexpectedApiResponseError(url, describeStatus(response));
-		}
-		case 404: {
-			const notFoundError = v.safeParse(EvaluationNotFoundBodySchema, body);
-			return notFoundError.success ? new EvaluationNotFoundError(notFoundError.output.code, notFoundError.output.error) : new UnexpectedApiResponseError(url, describeStatus(response));
-		}
-		case 429: {
-			const retryAfterSeconds = response.headers.get("retry-after");
-			return v.is(ServiceSuspendedBodySchema, body) && retryAfterSeconds !== null ? new ServiceSuspendedError(retryAfterSeconds) : new UnexpectedApiResponseError(url, describeStatus(response));
-		}
-		default: return new UnexpectedApiResponseError(url, describeStatus(response));
-	}
+const describePercentages = (percentages) => percentages.map((percentage) => `${formatPercentage(percentage.percentage)}% get ${String(percentage.value)}`).join(", ");
+const describeRule = (rule, segments) => {
+	if (rule.type === "percentage") return describePercentages(rule.percentages);
+	return `${rule.conditions.map((condition) => describeCondition(condition, segments)).join(" and ")}: ${rule.target === "value" ? String(rule.value) : describePercentages(rule.percentages)}`;
 };
-const isMissingResource = (received) => received.response.status === 404 && v.is(MissingResourceBodySchema, received.body);
-const parsedResponseOf = ({ url, response, body }, schema) => {
-	if (!response.ok) throw failureFor(url, response, body);
-	const parsedBody = v.safeParse(schema, body);
-	if (!parsedBody.success) throw new UnexpectedApiResponseError(url, `an ${describeStatus(response)} response the CLI cannot read`);
-	return {
-		responseBody: body,
-		parsedBody: parsedBody.output
-	};
+//#endregion
+//#region src/configs/config-text.ts
+const boundsDescriptions = (bounds) => {
+	const limits = [bounds?.min, bounds?.max].flatMap((bound) => bound === void 0 ? [] : [`${bound.relation} ${bound.value}`]);
+	return limits.length === 0 ? [] : [limits.join(" and ")];
 };
-var AdminApiClient = class {
-	constructor(connection) {
-		this.connection = connection;
-	}
-	listProjects() {
-		return this.get("/v1/projects", v.array(ProjectSchema));
-	}
-	async listConfigs(projectId, tagFilter) {
-		const { parsedBody: configs, responseBody } = await this.get(`/v1/projects/${encodeURIComponent(projectId)}/configs${tagFilterQuery(tagFilter)}`, v.array(ConfigSchema));
-		const receivedConfigs = v.parse(v.array(v.unknown()), responseBody);
-		return configs.map((config, index) => ({
-			config,
-			receivedConfig: receivedConfigs[index]
-		}));
-	}
-	listEnvironments(projectId) {
-		return this.get(`/v1/projects/${encodeURIComponent(projectId)}/environments`, v.array(EnvironmentSchema));
-	}
-	getConfig(projectId, configKey) {
-		return this.getIfFound(`/v1/projects/${encodeURIComponent(projectId)}/configs/${encodeURIComponent(configKey)}`, ConfigWithTargetingRulesSchema);
-	}
-	getConfigActivity(projectId, configKey) {
-		return this.getIfFound(`/v1/projects/${encodeURIComponent(projectId)}/configs/${encodeURIComponent(configKey)}/activity`, ConfigActivitySchema);
-	}
-	listSegments(projectId) {
-		return this.get(`/v1/projects/${encodeURIComponent(projectId)}/segments`, v.array(SegmentSchema));
-	}
-	getSegment(projectId, segmentKey) {
-		return this.getIfFound(`/v1/projects/${encodeURIComponent(projectId)}/segments/${encodeURIComponent(segmentKey)}`, SegmentDefinitionSchema);
-	}
-	async findTagByName(projectId, name) {
-		return (await this.getIfFound(`/v1/projects/${encodeURIComponent(projectId)}/tags/by-name?${new URLSearchParams({ name })}`, TagSchema))?.parsedBody;
-	}
-	createConfig(projectId, request) {
-		return this.requestJson(`/v1/projects/${encodeURIComponent(projectId)}/configs`, CreatedConfigSchema, {
-			method: "POST",
-			body: request
-		});
-	}
-	async evaluateConfig(projectId, configKey, request) {
-		const { responseBody, parsedBody } = await this.requestJson(`/v1/projects/${encodeURIComponent(projectId)}/configs/${encodeURIComponent(configKey)}/evaluate`, ConfigEvaluationSchema, {
-			method: "POST",
-			body: request
-		});
-		return {
-			evaluation: parsedBody,
-			responseBody
-		};
-	}
-	getTargetingRulesReference() {
-		return this.get("/v1/targeting-rules-reference", TargetingRulesReferenceSchema);
-	}
-	async replaceTargetingRules(projectId, configKey, request) {
-		return await this.requestIfFound(`/v1/projects/${encodeURIComponent(projectId)}/configs/${encodeURIComponent(configKey)}/targets`, v.unknown(), {
-			method: "PUT",
-			body: request
-		}) === void 0 ? "not-found" : "replaced";
-	}
-	uploadRepositoryScan(projectId, repositoryName, upload) {
-		return this.requestJson(`/v1/projects/${encodeURIComponent(projectId)}/repositories/${encodeURIComponent(repositoryName)}`, ScannedRepositorySchema, {
-			method: "PUT",
-			body: upload
-		});
-	}
-	listScannedRepositories(projectId) {
-		return this.get(`/v1/projects/${encodeURIComponent(projectId)}/repositories`, v.array(ListedScannedRepositorySchema));
-	}
-	async removeScannedRepository(projectId, repositoryName) {
-		return await this.requestIfFound(`/v1/projects/${encodeURIComponent(projectId)}/repositories/${encodeURIComponent(repositoryName)}`, v.unknown(), { method: "DELETE" }) === void 0 ? "not-found" : "removed";
-	}
-	async archiveConfig(projectId, configKey) {
-		return await this.requestIfFound(`/v1/projects/${encodeURIComponent(projectId)}/configs/${encodeURIComponent(configKey)}`, v.unknown(), { method: "DELETE" }) === void 0 ? "not-found" : "archived";
-	}
-	get(path, schema) {
-		return this.requestJson(path, schema, { method: "GET" });
-	}
-	getIfFound(path, schema) {
-		return this.requestIfFound(path, schema, { method: "GET" });
-	}
-	async requestIfFound(path, schema, request) {
-		const received = await this.send(path, request);
-		return isMissingResource(received) ? void 0 : parsedResponseOf(received, schema);
-	}
-	async requestJson(path, schema, request) {
-		return parsedResponseOf(await this.send(path, request), schema);
-	}
-	async send(path, request) {
-		const url = `${this.connection.baseUrl}${path}`;
-		const response = await this.fetchResponse(url, request);
-		return {
-			url,
-			response,
-			body: await readJsonBody(response)
-		};
-	}
-	async fetchResponse(url, request) {
-		const headers = {
-			Accept: "application/json",
-			Authorization: `Bearer ${this.connection.token}`,
-			"User-Agent": `configdirector-cli/${version}`,
-			"X-SourceClient": "cli"
-		};
-		try {
-			return await fetch(url, "body" in request ? {
-				method: request.method,
-				headers: {
-					...headers,
-					"Content-Type": "application/json"
-				},
-				body: JSON.stringify(request.body)
-			} : {
-				method: request.method,
-				headers
-			});
-		} catch (error) {
-			throw new ApiUnreachableError(this.connection.baseUrl, error);
-		}
+const enumValuesDescription = ({ valueType, values }) => valueType === "number" ? `one of the numbers ${values.join(", ")}` : `one of ${values.join(", ")}`;
+const timespanRangeDescriptions = (range) => [`${range.min} to ${range.max} ${range.unit}`, ...range.allowFractions ? ["fractions allowed"] : []];
+const typeConstraintDescriptions = (config) => {
+	if (!hasTypeConstraints(config)) return [];
+	switch (config.type) {
+		case "integer":
+		case "float": return boundsDescriptions(config.typeOptions);
+		case "enum": return [enumValuesDescription(config.typeOptions)];
+		case "timespan": return timespanRangeDescriptions(config.typeOptions);
+		case "url": return config.typeOptions?.secureOnly ? ["HTTPS only"] : [];
+		case "json": return config.typeOptions?.useSchema ? ["checked against a JSON schema"] : [];
 	}
 };
-//#endregion
-//#region src/saved-api-token.ts
-const SavedApiTokenSchema = v.object({ token: v.string() });
-const platformConfigDirectory = (invocation) => {
-	switch (invocation.platform) {
-		case "darwin": return join(invocation.homeDirectory, "Library", "Application Support");
-		case "win32": return nonEmptyVariable(invocation, "APPDATA") ?? join(invocation.homeDirectory, "AppData", "Roaming");
-		default: return join(invocation.homeDirectory, ".config");
-	}
+const availabilityDescription = (config) => {
+	if (config.client && config.server) return "client and server SDKs";
+	if (config.client) return "client-only";
+	if (config.server) return "server-only";
+	return "served to no SDK";
+};
+const settingLines = (config) => [
+	...config.description ? [`Description: ${config.description}`] : [],
+	`Type: ${[config.type, ...typeConstraintDescriptions(config)].join(", ")}`,
+	`Role: ${config.role}`,
+	`Lifetime: ${config.lifetime}`,
+	`Availability: ${availabilityDescription(config)}`,
+	`Lifecycle state: ${config.state}`,
+	...config.tags.length === 0 ? [] : [`Tags: ${config.tags.map((tag) => tag.name).join(", ")}`]
+];
+const environmentHeading = (targetingRules) => targetingRules.environment.live ? `${targetingRules.environment.slug} (live)` : targetingRules.environment.slug;
+const targetingRuleLines = (targetingRules, segments) => [
+	environmentHeading(targetingRules),
+	...targetingRules.rules.map((rule, index) => `  ${index + 1}. ${describeRule(rule, segments)}`),
+	`  Default targeting rule: ${targetingRules.defaultValue}`
+];
+const configText = (config, requestedKey, segments) => [
+	...oldKeyLines(requestedKey, config.key),
+	config.key,
+	...settingLines(config).map((line) => `  ${line}`),
+	...config.targets.flatMap((targetingRules) => ["", ...targetingRuleLines(targetingRules, segments)]),
+	""
+].join("\n");
+//#endregion
+//#region src/configs/new-config.ts
+const CONFIG_TYPES = [
+	"boolean",
+	"string",
+	"integer",
+	"float",
+	"timespan",
+	"enum",
+	"url",
+	"json"
+];
+const CONFIG_ROLES = [
+	"config",
+	"flag",
+	"kill-switch",
+	"experiment"
+];
+const CONFIG_LIFETIMES = ["permanent", "temporary"];
+const TIMESPAN_UNITS = [
+	"milliseconds",
+	"seconds",
+	"minutes"
+];
+const ENUM_VALUE_TYPES = ["string", "number"];
+const DEFAULT_ENUM_VALUE_TYPE = "string";
+const TYPE_CONSTRAINT_OPTION_NAMES = {
+	min: "--min",
+	max: "--max",
+	exclusiveMin: "--exclusive-min",
+	exclusiveMax: "--exclusive-max",
+	unit: "--unit",
+	allowFractions: "--allow-fractions",
+	allowedValue: "--allowed-value",
+	enumValueType: "--enum-value-type",
+	httpsOnly: "--https-only",
+	jsonSchema: "--json-schema"
+};
+const availabilityOf = (options) => {
+	if (options.clientOnly) return {
+		client: true,
+		server: false
+	};
+	if (options.serverOnly) return {
+		client: false,
+		server: true
+	};
+	return {
+		client: true,
+		server: true
+	};
+};
+const BOOLEAN_VALUES = new Map([["true", true], ["false", false]]);
+const numberOf = (text) => {
+	const value = parseJson(text);
+	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 };
-const userConfigDirectory = (invocation) => nonEmptyVariable(invocation, "XDG_CONFIG_HOME") ?? platformConfigDirectory(invocation);
-const savedApiTokenFile = (invocation) => join(userConfigDirectory(invocation), "configdirector", "config.json");
-const readSavedApiToken = async (invocation) => {
-	const file = savedApiTokenFile(invocation);
-	const contents = await readFileIfPresent(file);
-	if (contents === void 0) return;
-	const savedToken = v.safeParse(SavedApiTokenSchema, parseJson(contents));
-	if (!savedToken.success) throw new CliError(`${file} does not hold a saved API token. Run \`configdirector login\` again.`);
-	return savedToken.output.token;
+const constraintNumberOf = (options, option) => {
+	const text = options[option];
+	if (text === void 0) return;
+	const value = numberOf(text);
+	if (value === void 0) throw new CliError(`${TYPE_CONSTRAINT_OPTION_NAMES[option]} takes a number, not ${text}.`);
+	return value;
 };
-const saveApiToken = async (invocation, token) => {
-	const file = savedApiTokenFile(invocation);
-	await mkdir(dirname(file), {
-		recursive: true,
-		mode: 448
-	});
-	const handle = await open(file, "w", 384);
-	try {
-		await handle.chmod(384);
-		await handle.writeFile(`${JSON.stringify({ token }, null, 2)}\n`);
-	} finally {
-		await handle.close();
+const boundOf = (options, option, relation) => {
+	const value = constraintNumberOf(options, option);
+	return value === void 0 ? void 0 : {
+		relation,
+		value
+	};
+};
+const numericBoundsOf = (options) => ({
+	min: boundOf(options, "min", ">=") ?? boundOf(options, "exclusiveMin", ">"),
+	max: boundOf(options, "max", "<=") ?? boundOf(options, "exclusiveMax", "<")
+});
+const jsonTextOf = async ({ argumentLabel, text, workingDirectory }) => {
+	const jsonText = (await atFileArgumentText(argumentLabel, text, workingDirectory)).trim();
+	return parseJson(jsonText) === void 0 ? void 0 : jsonText;
+};
+const jsonSchemaOptionsOf = async (options, workingDirectory) => {
+	if (options.jsonSchema === void 0) return;
+	const { file, contents } = await readOptionFile(TYPE_CONSTRAINT_OPTION_NAMES.jsonSchema, options.jsonSchema, workingDirectory);
+	const schema = parseJson(contents);
+	if (schema === void 0) throw new CliError(`${TYPE_CONSTRAINT_OPTION_NAMES.jsonSchema} names ${file}, which is not JSON.`);
+	return {
+		useSchema: true,
+		schema
+	};
+};
+const timespanRangeOf = async (options) => {
+	if (options.unit === void 0 || options.min === void 0 || options.max === void 0) throw new CliError("--type timespan needs --unit, --min and --max.");
+	return {
+		unit: options.unit,
+		min: constraintNumberOf(options, "min"),
+		max: constraintNumberOf(options, "max"),
+		allowFractions: options.allowFractions
+	};
+};
+const NUMERIC_BOUND_OPTIONS = [
+	"min",
+	"max",
+	"exclusiveMin",
+	"exclusiveMax"
+];
+const CONFIG_TYPE_RULES = {
+	boolean: {
+		constraintOptions: [],
+		valueDescription: "true or false",
+		valueOf: async ({ text }) => BOOLEAN_VALUES.get(text),
+		typeOptionsOf: async () => void 0
+	},
+	string: {
+		constraintOptions: [],
+		valueDescription: "text",
+		valueOf: async ({ text }) => text,
+		typeOptionsOf: async () => void 0
+	},
+	integer: {
+		constraintOptions: NUMERIC_BOUND_OPTIONS,
+		valueDescription: "a number",
+		valueOf: async ({ text }) => numberOf(text),
+		typeOptionsOf: async (options) => ({
+			isInteger: true,
+			...numericBoundsOf(options)
+		})
+	},
+	float: {
+		constraintOptions: NUMERIC_BOUND_OPTIONS,
+		valueDescription: "a number",
+		valueOf: async ({ text }) => numberOf(text),
+		typeOptionsOf: async (options) => ({
+			isInteger: false,
+			...numericBoundsOf(options)
+		})
+	},
+	timespan: {
+		constraintOptions: [
+			"min",
+			"max",
+			"unit",
+			"allowFractions"
+		],
+		valueDescription: "a number",
+		valueOf: async ({ text }) => numberOf(text),
+		typeOptionsOf: timespanRangeOf
+	},
+	enum: {
+		constraintOptions: ["allowedValue", "enumValueType"],
+		valueDescription: "text",
+		valueOf: async ({ text }) => text,
+		typeOptionsOf: async (options) => ({
+			values: options.allowedValue ?? [],
+			valueType: options.enumValueType ?? DEFAULT_ENUM_VALUE_TYPE
+		})
+	},
+	url: {
+		constraintOptions: ["httpsOnly"],
+		valueDescription: "text",
+		valueOf: async ({ text }) => text,
+		typeOptionsOf: async (options) => ({ secureOnly: options.httpsOnly === true })
+	},
+	json: {
+		constraintOptions: ["jsonSchema"],
+		valueDescription: "JSON or @<file>",
+		valueOf: jsonTextOf,
+		typeOptionsOf: jsonSchemaOptionsOf
 	}
-	return file;
 };
-//#endregion
-//#region src/configured-api-token.ts
-const configuredApiToken = async (context) => {
-	const token = context.tokenOption ?? nonEmptyVariable(context.invocation, "CONFIGDIRECTOR_TOKEN") ?? await readSavedApiToken(context.invocation);
-	if (!token) throw new CliError("No API token found. Set CONFIGDIRECTOR_TOKEN, pass --token, or run `configdirector login`.");
-	return token;
+const typeAlternatives = (types) => types.length === 1 ? `${types[0]}` : `${types.slice(0, -1).join(", ")} or ${types.at(-1)}`;
+const typesTaking = (option) => CONFIG_TYPES.filter((type) => CONFIG_TYPE_RULES[type].constraintOptions.includes(option));
+const typeConstraintHelpGroup = (option) => `Options for --type ${typeAlternatives(typesTaking(option))}:`;
+const TYPE_CONSTRAINT_OPTIONS = Object.keys(TYPE_CONSTRAINT_OPTION_NAMES);
+const rejectOptionsOfOtherTypes = (options) => {
+	const { constraintOptions } = CONFIG_TYPE_RULES[options.type];
+	const otherTypeOption = TYPE_CONSTRAINT_OPTIONS.find((option) => options[option] !== void 0 && !constraintOptions.includes(option));
+	if (otherTypeOption !== void 0) throw new CliError(`${TYPE_CONSTRAINT_OPTION_NAMES[otherTypeOption]} cannot be used with --type ${options.type}. It applies to --type ${typeAlternatives(typesTaking(otherTypeOption))}.`);
 };
-//#endregion
-//#region src/project-settings.ts
-const ProjectSettingsSchema = v.object({
-	project: v.optional(v.string()),
-	include: v.optional(v.array(v.string())),
-	exclude: v.optional(v.array(v.string())),
-	ignoreKeys: v.optional(v.array(v.string()))
-});
-const projectSettingsFile = (workingDirectory) => join(workingDirectory, "configdirector.json");
-const describeIssue = (issue) => {
-	const path = v.getDotPath(issue);
-	return path === null ? issue.message : `${path}: ${issue.message}`;
+const typedValueOf = async (type, argument) => {
+	const rules = CONFIG_TYPE_RULES[type];
+	const value = await rules.valueOf(argument);
+	if (value === void 0) throw new CliError(`${argument.argumentLabel} takes ${rules.valueDescription} with --type ${type}, not ${argument.text}.`);
+	return value;
 };
-const readProjectSettings = async (workingDirectory) => {
-	const file = projectSettingsFile(workingDirectory);
-	const contents = await readFileIfPresent(file);
-	if (contents === void 0) return;
-	const settings = v.safeParse(ProjectSettingsSchema, parseJson(contents));
-	if (!settings.success) throw new CliError(`${file} is not valid (${settings.issues.map(describeIssue).join("; ")}).`);
-	return settings.output;
+const VARIATION_SEPARATOR = "=";
+const variationOf = async (type, variation, workingDirectory) => {
+	const separatorIndex = variation.indexOf(VARIATION_SEPARATOR);
+	const name = variation.slice(0, separatorIndex);
+	if (separatorIndex === -1 || name === "") throw new CliError(`--variation takes name=value, not ${variation}.`);
+	const text = variation.slice(separatorIndex + 1);
+	return {
+		name,
+		value: await typedValueOf(type, {
+			argumentLabel: `--variation ${name}`,
+			text,
+			workingDirectory
+		})
+	};
+};
+const variationsOf = async (options, workingDirectory) => {
+	const variations = [];
+	for (const variation of options.variation ?? []) variations.push(await variationOf(options.type, variation, workingDirectory));
+	return variations;
+};
+const newConfigOf = async (options, workingDirectory) => {
+	rejectOptionsOfOtherTypes(options);
+	return {
+		key: options.key,
+		description: options.description,
+		role: options.role,
+		lifetime: options.lifetime,
+		type: options.type,
+		typeOptions: await CONFIG_TYPE_RULES[options.type].typeOptionsOf(options, workingDirectory),
+		...availabilityOf(options),
+		variations: await variationsOf(options, workingDirectory),
+		defaultValue: await typedValueOf(options.type, {
+			argumentLabel: "--default-value",
+			text: options.defaultValue,
+			workingDirectory
+		})
+	};
 };
 //#endregion
 //#region src/project-selection.ts
@@ -963,24 +1184,38 @@ const findProjectBySlug = async (client, slug) => {
 	if (project === void 0) throw new CliError(`No project in the API token's organization has the slug "${slug}".`);
 	return project;
 };
+const projectOrganizationCheck = (project, settings) => {
+	if (settings?.organization === void 0) return { verdict: "not-checked" };
+	return project.organizationId === settings.organization ? { verdict: "same" } : {
+		verdict: "another-organization",
+		linkedOrganizationId: settings.organization
+	};
+};
+const refuseProjectOfAnotherOrganization = (project, settings, apiToken) => {
+	const check = projectOrganizationCheck(project, settings);
+	switch (check.verdict) {
+		case "not-checked":
+		case "same": return;
+		case "another-organization": throw new CliError(`The token from ${describeApiTokenSource(apiToken.source)} belongs to the organization ${project.organizationId}, whose project "${project.slug}" is not the one this directory links to: configdirector.json names the organization ${check.linkedOrganizationId}. Use a token of that organization, or run the command somewhere else.`);
+	}
+};
 const connectToLinkedProject = async (context) => {
-	const projectSlug = requireLinkedProjectSlug(context, await readProjectSettings(context.invocation.workingDirectory));
+	const settings = await readProjectSettings(context.invocation.workingDirectory);
+	const projectSlug = requireLinkedProjectSlug(context, settings);
+	const apiToken = await configuredApiToken(context);
 	const client = new AdminApiClient({
 		baseUrl: context.baseUrl,
-		token: await configuredApiToken(context)
+		token: apiToken.token
 	});
+	const project = await findProjectBySlug(client, projectSlug);
+	refuseProjectOfAnotherOrganization(project, settings, apiToken);
 	return {
 		client,
-		project: await findProjectBySlug(client, projectSlug)
+		project,
+		settings
 	};
 };
 //#endregion
-//#region src/utc-minute.ts
-const utcMinute = (time) => {
-	const isoTime = new Date(time).toISOString();
-	return `${isoTime.slice(0, 10)} ${isoTime.slice(11, 16)} UTC`;
-};
-//#endregion
 //#region src/commands/configs.ts
 const LIFECYCLE_STATES = [
 	"new",
@@ -1348,24 +1583,75 @@ const evaluate = async (context, [configKey], options) => {
 };
 //#endregion
 //#region src/commands/init.ts
-const refuseExistingFile = async (file) => {
-	if (await access(file).then(() => true, () => false)) throw new CliError(`${file} already exists. init never overwrites it; edit the file instead.`);
+const existingFileWithoutOrganization = (context, file, contents) => {
+	const settings = projectSettingsOf(file, contents);
+	if (settings.organization !== void 0) throw new CliError(`${file} already exists. init never overwrites it; edit the file instead.`);
+	const projectSlug = settings.project ?? requireProjectSlug(context);
+	if (context.projectSlug !== void 0 && context.projectSlug !== projectSlug) throw new CliError(`${file} links the project ${projectSlug}, but --project or CONFIGDIRECTOR_PROJECT names ${context.projectSlug}. init only adds the organization to an existing file; edit the file to link another project.`);
+	const otherFields = Object.fromEntries(Object.entries(settings).filter(([name]) => name !== "project"));
+	return {
+		projectSlug,
+		fieldsOf: (organizationId) => ({
+			project: projectSlug,
+			organization: organizationId,
+			...otherFields
+		})
+	};
 };
-const init = async (context) => {
-	const settingsFile = projectSettingsFile(context.invocation.workingDirectory);
-	await refuseExistingFile(settingsFile);
+const newSettingsFile = (context) => {
 	const projectSlug = requireProjectSlug(context);
-	const project = await findProjectBySlug(new AdminApiClient({
+	return {
+		projectSlug,
+		fieldsOf: (organizationId) => ({
+			project: projectSlug,
+			organization: organizationId,
+			include: ["**"],
+			exclude: [],
+			ignoreKeys: []
+		})
+	};
+};
+const settingsFileToWrite = async (context, file) => {
+	const contents = await readFileIfPresent(file);
+	return contents === void 0 ? newSettingsFile(context) : existingFileWithoutOrganization(context, file, contents);
+};
+const projectFoundWith = async (context, apiToken, slug) => {
+	const { parsedBody: projects } = await new AdminApiClient({
 		baseUrl: context.baseUrl,
-		token: await configuredApiToken(context)
-	}), projectSlug);
-	const settings = {
-		project: project.slug,
-		include: ["**"],
-		exclude: [],
-		ignoreKeys: []
+		token: apiToken.token
+	}).listProjects();
+	const project = projects.find((listedProject) => listedProject.slug === slug);
+	return project === void 0 ? void 0 : {
+		apiToken,
+		project
 	};
-	await writeFile(settingsFile, `${JSON.stringify(settings, null, 2)}\n`, { flag: "wx" });
+};
+const describeOrganizationOf = ({ apiToken, project }) => apiToken.source.from === "sign-in" ? apiToken.source.signIn.organization.name : project.organizationId;
+const signInsSearched = (apiTokens) => apiTokens.flatMap((apiToken) => apiToken.source.from === "sign-in" ? [apiToken.source.signIn] : []);
+const onlyProjectFound = (slug, apiTokens, projectsFound) => {
+	const [firstProjectFound] = projectsFound;
+	if (projectsFound.length > 1) throw new CliError(`The organizations ${projectsFound.map(describeOrganizationOf).join(" and ")} both have a project with the slug "${slug}". Name one with --organization.`);
+	if (firstProjectFound === void 0) {
+		const signIns = signInsSearched(apiTokens);
+		throw new CliError(signIns.length === 0 ? `No project in the API token's organization has the slug "${slug}".` : `No project has the slug "${slug}" in the organizations signed in to: ${describeSignIns(signIns)}.`);
+	}
+	return firstProjectFound;
+};
+const findProjectAcrossOrganizations = async (context, slug) => {
+	const apiTokens = await apiTokensToSearch(context);
+	const projectsFound = [];
+	for (const apiToken of apiTokens) {
+		const projectFound = await projectFoundWith(context, apiToken, slug);
+		if (projectFound !== void 0) projectsFound.push(projectFound);
+	}
+	return onlyProjectFound(slug, apiTokens, projectsFound);
+};
+const init = async (context) => {
+	const settingsFile = projectSettingsFile(context.invocation.workingDirectory);
+	const fileToWrite = await settingsFileToWrite(context, settingsFile);
+	const projectFound = await findProjectAcrossOrganizations(context, fileToWrite.projectSlug);
+	const { project } = projectFound;
+	await writeFile(settingsFile, `${JSON.stringify(fileToWrite.fieldsOf(project.organizationId), null, 2)}\n`);
 	return {
 		json: {
 			settingsFile,
@@ -1373,9 +1659,10 @@ const init = async (context) => {
 				id: project.id,
 				slug: project.slug,
 				name: project.name
-			}
+			},
+			organizationId: project.organizationId
 		},
-		text: `Linked this directory to the project ${project.name} (${project.slug}) in ${settingsFile}\n`,
+		text: `Linked this directory to the project ${project.name} (${project.slug}) of the organization ${describeOrganizationOf(projectFound)} in ${settingsFile}\n`,
 		exitCode: ExitCode.success
 	};
 };
@@ -1436,16 +1723,42 @@ const readPastedApiToken = async (invocation) => {
 };
 //#endregion
 //#region src/commands/login.ts
+const PERMISSION_TO_FIND_PROJECTS = "projects:read";
 const login = async (context) => {
+	if (context.organizationOption !== void 0) throw new CliError("login saves the sign-in for the token's own organization, so it takes no --organization or CONFIGDIRECTOR_ORGANIZATION.");
 	const token = context.tokenOption ?? await readPastedApiToken(context.invocation);
-	await new AdminApiClient({
+	const { parsedBody: apiToken } = await new AdminApiClient({
 		baseUrl: context.baseUrl,
 		token
-	}).listProjects();
-	const file = await saveApiToken(context.invocation, token);
+	}).describeApiToken();
+	if (!apiToken.permissions.includes(PERMISSION_TO_FIND_PROJECTS)) throw new CliError(`The API token lacks the ${PERMISSION_TO_FIND_PROJECTS} permission, which the CLI needs to find a project. Create a token with it on the dashboard's API tokens page.`);
+	const file = await saveSignIn(context, {
+		organization: apiToken.organization,
+		token
+	});
+	return {
+		json: {
+			signInsFile: file,
+			organization: apiToken.organization
+		},
+		text: `Signed in to ${apiToken.organization.name}. The CLI sign-in is saved in ${file}\n`,
+		exitCode: ExitCode.success
+	};
+};
+//#endregion
+//#region src/commands/logout.ts
+const logout = async (context) => {
+	if (context.tokenOption !== void 0) throw new CliError("logout removes a CLI sign-in and sends no token, so it takes no --token.");
+	const settings = await readProjectSettings(context.invocation.workingDirectory);
+	const signIns = await savedSignIns(context);
+	const choice = chosenSignIn(signIns, organizationReferenceOf(context, settings));
+	if (choice.outcome === "no-sign-in") throw new CliError("There is no CLI sign-in on this machine to remove; `configdirector login` adds one.");
+	const { signIn } = choice;
+	await removeSignIn(context, signIns, signIn.organization);
 	return {
-		json: { tokenFile: file },
-		text: `Logged in. The API token is saved in ${file}\n`,
+		json: { removedSignIn: { organization: signIn.organization } },
+		text: `Signed out of ${signIn.organization.name}. The API token keeps working until it is revoked on the dashboard's API tokens page.
+`,
 		exitCode: ExitCode.success
 	};
 };
@@ -1455,7 +1768,7 @@ const projectLines = (projects) => projects.length === 0 ? ["No projects found."
 const listProjects = async (context) => {
 	const { parsedBody: projects, responseBody } = await new AdminApiClient({
 		baseUrl: context.baseUrl,
-		token: await configuredApiToken(context)
+		token: (await configuredApiToken(context)).token
 	}).listProjects();
 	return {
 		json: responseBody,
@@ -3879,13 +4192,7 @@ const scanCodeReferences = async (scope, projectKeys, snippetCut) => {
 //#region src/project-scan.ts
 const connectToScannableProject = async (context) => {
 	const { workingDirectory } = context.invocation;
-	const settings = await readProjectSettings(workingDirectory);
-	const projectSlug = requireLinkedProjectSlug(context, settings);
-	const client = new AdminApiClient({
-		baseUrl: context.baseUrl,
-		token: await configuredApiToken(context)
-	});
-	const project = await findProjectBySlug(client, projectSlug);
+	const { client, project, settings } = await connectToLinkedProject(context);
 	const configs = (await client.listConfigs(project.id, { form: "every-config" })).map((listedConfig) => listedConfig.config);
 	const projectKeys = new Set(configs.flatMap((config) => [config.key, ...config.deprecatedKeys.map((deprecatedKey) => deprecatedKey.key)]));
 	return {
@@ -4258,7 +4565,7 @@ const setTargetingRules = async (context, [configKey], options) => {
 const showTargetingRulesReference = async (context) => {
 	const { parsedBody: reference, responseBody } = await new AdminApiClient({
 		baseUrl: context.baseUrl,
-		token: await configuredApiToken(context)
+		token: (await configuredApiToken(context)).token
 	}).getTargetingRulesReference();
 	return {
 		json: responseBody,
@@ -4490,7 +4797,8 @@ const runCommand = async (invocation, command, actionArguments) => {
 		invocation,
 		baseUrl: withoutTrailingSlashes(options.baseUrl ?? nonEmptyVariable(invocation, "CONFIGDIRECTOR_BASE_URL") ?? DEFAULT_BASE_URL),
 		tokenOption: options.token,
-		projectSlug: options.project ?? nonEmptyVariable(invocation, "CONFIGDIRECTOR_PROJECT")
+		projectSlug: options.project ?? nonEmptyVariable(invocation, "CONFIGDIRECTOR_PROJECT"),
+		organizationOption: options.organization ?? nonEmptyVariable(invocation, "CONFIGDIRECTOR_ORGANIZATION")
 	}, parsedCommand.processedArgs, parsedCommand.opts());
 	invocation.stdout.write(options.json ? `${JSON.stringify(output.json, null, 2)}\n` : output.text);
 	return output.exitCode;
@@ -4509,15 +4817,17 @@ const run = async (invocation) => {
 	const commandAction = (command) => async (...actionArguments) => {
 		exitCode = await runCommand(invocation, command, actionArguments);
 	};
-	const program = new Command("configdirector").description("Work with ConfigDirector configs from the terminal and CI.").addHelpText("afterAll", "\nBeta: commands and output may change before 1.0.").configureHelp({ showGlobalOptions: true }).version(version).option("--token <token>", "API token, used instead of CONFIGDIRECTOR_TOKEN and the token saved by login").option("--base-url <url>", `Admin API host, used instead of CONFIGDIRECTOR_BASE_URL (default ${DEFAULT_BASE_URL})`).option("--project <slug>", "project slug, used instead of CONFIGDIRECTOR_PROJECT").option("--json", "print JSON on stdout").exitOverride().configureOutput({
+	const program = new Command("configdirector").description("Work with ConfigDirector configs from the terminal and CI.").addHelpText("afterAll", "\nBeta: commands and output may change before 1.0.").configureHelp({ showGlobalOptions: true }).version(version).option("--token <token>", "API token, used instead of CONFIGDIRECTOR_TOKEN and the CLI sign-ins saved by login").option("--base-url <url>", `Admin API host, used instead of CONFIGDIRECTOR_BASE_URL (default ${DEFAULT_BASE_URL})`).option("--project <slug>", "project slug, used instead of CONFIGDIRECTOR_PROJECT").option("--organization <name or id>", "organization whose CLI sign-in to use, by its saved name or its id, used instead of CONFIGDIRECTOR_ORGANIZATION and `organization` in configdirector.json").option("--json", "print JSON on stdout").exitOverride().configureOutput({
 		writeOut: (text) => invocation.stdout.write(text),
 		writeErr: (text) => invocation.stderr.write(text)
 	});
-	program.command("login").description("save an API token for later runs, after checking it can list projects").action(commandAction(login));
+	program.command("login").description("save an API token as the CLI sign-in for its organization, after checking it can find projects").action(commandAction(login));
+	program.command("logout").description("remove the CLI sign-in this directory's commands would use; the token itself keeps working").action(commandAction(logout));
 	program.command("init").description("write configdirector.json for a project in the current directory").action(commandAction(init));
 	program.command("scan").argument("[path]", "directory or file to scan (default: the current directory)").description("list where the code reads config keys through a ConfigDirector SDK").option("--upload", "send the code references to the project, replacing those it holds for this repository").option("--repository <name>", "the repository name to upload under (default: the path of the git remote origin, such as ConfigDirector/cli)").addOption(new Option("--context-lines <number>", `how many lines of code to include before and after each reference, from 0 to 5 (default: 2)`).conflicts("snippets")).option("--no-snippets", "leave out the lines of code around each reference").action(commandAction(scan));
 	program.command("validate").argument("[path]", "directory or file to check (default: the current directory)").description("check every config key the code reads against the project's configs, exiting 1 when one is wrong").action(commandAction(validate));
 	program.command("evaluate").argument("<key>", "the config's key").description("show the value a context gets for a config in an environment, and why").requiredOption("--environment <slug>", "slug of the environment whose targeting rules to evaluate (required)").option("--context-kind <kind>", "context kind of the context to evaluate for (default: user)").option("--context-id <identifier>", "identifier of the context").option("--context-name <name>", "name of the context").option("--context-trait <name=value>", "a trait of the context, as a string, or name:=<json> for a number, boolean, array or object; repeatable", repeatedOption).option("--context-json <json>", "the whole context as a JSON object, or @<file> to read it from a file").option("--saved-context <kind:identifier>", "a context ConfigDirector saved from SDK evaluations in the environment, such as user:123").addHelpText("after", "\nGive the context with the --context-* options, with --context-json, or with --saved-context. Without any of them, the config is evaluated for an empty context, as an SDK given none would.").action(commandAction(evaluate));
+	program.command("api-token").description("describe the API token a command here would use").command("get").description("show the token's organization, name, permissions and expiration, and where it came from; never the token itself").action(commandAction(getApiToken));
 	program.command("projects").description("list the projects of the API token's organization").command("list").description("list the organization's projects, whatever project is selected").action(commandAction(listProjects));
 	program.command("environments").description("list the project's environments").command("list").description("list the project's environments with their slugs, marking the live ones").action(commandAction(listEnvironments));
 	const configsCommand = program.command("configs").description("list, show, create and archive a project's configs");