@devicecloud.dev/dcd 5.8.0 → 5.9.0

package/dist/commands/login.js

@@ -18,9 +18,12 @@
  *  5. Meanwhile, the CLI polls POST /cli-login/claim with {state, code_verifier}.
  *     Once the api has the row, it verifies sha256(verifier) === challenge,
  *     deletes the row, and returns the session.
- *  6. CLI fetches /me/orgs with the fresh Bearer token and prompts the user to
- *     pick an org. Org selection lives here, not in the web UI — that way the
- *     CLI login and `dcd switch-org` share one picker.
+ *  6. CLI fetches /me/orgs with the fresh Bearer token and picks the org:
+ *     `--org` if given, else the only one, else a picker that starts on the
+ *     last login's org. Without a TTY nobody can answer the picker, so the
+ *     last login's org is used, or the command fails pointing at `--org`.
+ *     Org selection lives here, not in the web UI — that way the CLI login
+ *     and `dcd switch-org` share one picker.
  *
  * Why PKCE + server rendezvous (instead of a localhost loopback): Safari
  * blocks HTTPS → HTTP fetches to 127.0.0.1 as mixed content, and a loopback
@@ -32,10 +35,13 @@ import * as p from '@clack/prompts';
 import { defineCommand } from 'citty';
 import { spawn } from 'node:child_process';
 import { createHash, randomBytes } from 'node:crypto';
-import { ENVIRONMENTS, inferEnvFromApiUrl, resolveFrontendUrl } from '../config/environments.js';
+import { ENVIRONMENTS, inferEnvFromApiUrl, resolveFrontendUrl, } from '../config/environments.js';
+import { getSupabaseKey } from '../config/supabase-key.js';
+import { jsonFlag } from '../config/flags/output.flags.js';
+import { canPrompt } from '../utils/ci.js';
 import { CliError, logger } from '../utils/cli.js';
 import { readConfig, writeConfig } from '../utils/config-store.js';
-import { fetchOrgs, pickOrg } from '../utils/orgs.js';
+import { fetchOrgs, selectOrg } from '../utils/orgs.js';
 import { colors } from '../utils/styling.js';
 import { ui } from '../utils/ui.js';
 const LOGIN_TIMEOUT_MS = 10 * 60 * 1000;
@@ -64,11 +70,35 @@ export const loginCommand = defineCommand({
             default: true,
             description: 'Open the login URL in a browser (pass --no-browser to just print it)',
         },
+        org: {
+            type: 'string',
+            description: 'Organization to use, by name or id (skips the picker)',
+        },
+        json: jsonFlag,
     },
     async run({ args }) {
         const apiUrl = args['api-url'].replace(/\/$/, '');
         const frontendOverride = args['frontend-url'];
         const noBrowser = args.browser === false;
+        const json = Boolean(args.json);
+        // citty gives '' for a bare `--org`. Refuse it, and an empty `--org "$ORG"`,
+        // rather than fall back to an org the caller didn't ask for.
+        const requestedOrg = args.org?.trim();
+        if (requestedOrg === '') {
+            throw new CliError('--org needs an organization name or id.');
+        }
+        // Login is interactive, so under --json the human rows and prompts move to
+        // stderr (the user still needs the URL) and stdout gets only the result.
+        const say = (m) => {
+            if (json)
+                process.stderr.write(`${m}\n`);
+            else
+                logger.log(m);
+        };
+        const promptOutput = json ? process.stderr : undefined;
+        // Without a TTY (a script, CI, a shell an agent runs) nobody can answer a
+        // prompt, so each one below falls back to the answer Enter would give.
+        const interactive = canPrompt(promptOutput);
         // If there's an existing stored session, make the user confirm before we
         // overwrite it. Silent clobber is fine for power users but surprising if
         // someone runs `dcd login` by mistake while already authenticated. An
@@ -79,7 +109,12 @@ export const loginCommand = defineCommand({
         if (existing?.session) {
             const now = Math.floor(Date.now() / 1000);
             if (existing.session.expires_at <= now) {
-                logger.log(ui.info(`Your session for ${existing.session.user_email} has expired — signing in again.`));
+                say(ui.info(`Your session for ${existing.session.user_email} has expired — signing in again.`));
+            }
+            else if (!interactive) {
+                // The confirm below defaults to yes. The old session stays until the
+                // new login succeeds, so this replaces nothing if it never completes.
+                say(ui.info(`Already logged in as ${existing.session.user_email} — signing in again.`));
             }
             else {
                 const currentOrg = existing.current_org_name ?? existing.current_org_id;
@@ -88,9 +123,15 @@ export const loginCommand = defineCommand({
                         (currentOrg ? ` (org ${currentOrg})` : '') +
                         `. Sign out and log in again?`,
                     initialValue: true,
+                    output: promptOutput,
                 });
                 if (p.isCancel(ok) || !ok) {
-                    logger.log(ui.info('Keeping existing session.'));
+                    if (json) {
+                        logger.json({ status: 'UNCHANGED', user: existing.session.user_email });
+                    }
+                    else {
+                        logger.log(ui.info('Keeping existing session.'));
+                    }
                     return;
                 }
             }
@@ -102,7 +143,7 @@ export const loginCommand = defineCommand({
         const codeVerifier = base64url(randomBytes(32));
         const codeChallenge = base64url(createHash('sha256').update(codeVerifier, 'ascii').digest());
         const loginUrl = `${frontendUrl}/cli-login?state=${state}&code_challenge=${codeChallenge}`;
-        logger.log(ui.section('Signing in to devicecloud.dev'));
+        say(ui.section('Signing in to devicecloud.dev'));
         const rows = [];
         if (noBrowser) {
             rows.push(ui.note('Open this URL in a browser to finish login:'), colors.highlight(loginUrl));
@@ -117,7 +158,7 @@ export const loginCommand = defineCommand({
             }
         }
         rows.push(ui.note('Waiting for login to complete…'));
-        logger.log(ui.branch(rows));
+        say(ui.branch(rows));
         try {
             const payload = await pollForClaim(apiUrl, state, codeVerifier);
             if (!payload.access_token || typeof payload.access_token !== 'string') {
@@ -139,14 +180,24 @@ export const loginCommand = defineCommand({
                 // rejects it, the token itself is bad; if Supabase accepts, the
                 // api's JwtService is misconfigured.
                 const iss = decodeJwtIssuer(payload.access_token);
-                const supabaseUser = await probeSupabaseUser(iss, ENVIRONMENTS[env].supabase.anonKey, payload.access_token);
+                const supabaseUser = await probeSupabaseUser(iss, env, payload.access_token);
                 const parts = [
                     iss ? `token iss: ${iss}` : null,
                     `supabase /auth/v1/user: ${supabaseUser}`,
                 ].filter(Boolean);
                 throw new CliError(`${err.message} [${parts.join(' | ')}]`);
             }
-            const chosen = await pickOrg(orgs);
+            const { org: chosen, fromLastLogin } = await selectOrg(orgs, {
+                requested: requestedOrg,
+                // Org ids are per environment (dev org 1 isn't prod org 1), so the
+                // last login's org only counts if that login was to this same API.
+                lastOrgId: existing?.api_url === apiUrl ? existing.current_org_id : undefined,
+                interactive,
+                output: promptOutput,
+            });
+            if (fromLastLogin) {
+                say(ui.info(`No terminal to pick an organization in, so using ${chosen.name} from your last login.`));
+            }
             writeConfig({
                 version: 1,
                 env,
@@ -162,6 +213,15 @@ export const loginCommand = defineCommand({
                 current_org_id: chosen.id,
                 current_org_name: chosen.name,
             });
+            if (json) {
+                logger.json({
+                    status: 'SUCCESS',
+                    user: payload.user_email,
+                    org: { id: chosen.id, name: chosen.name },
+                    env,
+                });
+                return;
+            }
             logger.log(ui.success(`Logged in as ${colors.highlight(payload.user_email)}`));
             logger.log(ui.branch([
                 ...ui.fields([['organization', colors.highlight(chosen.name)]]),
@@ -171,7 +231,7 @@ export const loginCommand = defineCommand({
             ]));
         }
         catch (error) {
-            logger.error(error, { exit: 1 });
+            logger.error(error, { exit: 1, json });
         }
     },
 });
@@ -228,14 +288,14 @@ async function pollForClaim(apiUrl, state, codeVerifier) {
 function base64url(buf) {
     return buf.toString('base64').replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
 }
-async function probeSupabaseUser(iss, anonKey, token) {
+async function probeSupabaseUser(iss, env, token) {
     if (!iss)
         return 'skipped (no iss)';
     try {
         const res = await fetch(`${iss}/user`, {
             headers: {
                 authorization: `Bearer ${token}`,
-                apikey: anonKey,
+                apikey: await getSupabaseKey(env),
             },
         });
         const bodyText = await res.text().catch(() => '');

package/dist/commands/logout.d.ts

@@ -1,2 +1,7 @@
-export declare const logoutCommand: import("citty").CommandDef<import("citty").ArgsDef>;
+export declare const logoutCommand: import("citty").CommandDef<{
+    readonly json: {
+        readonly type: "boolean";
+        readonly description: "Output the result as a single JSON object on stdout";
+    };
+}>;
 export default logoutCommand;

package/dist/commands/logout.js

@@ -3,7 +3,7 @@
  * it on Supabase. Leaves DEVICE_CLOUD_API_KEY (env/flag) untouched.
  */
 import { defineCommand } from 'citty';
-import { ENVIRONMENTS } from '../config/environments.js';
+import { jsonFlag } from '../config/flags/output.flags.js';
 import { CliAuthGateway } from '../gateways/cli-auth-gateway.js';
 import { logger } from '../utils/cli.js';
 import { clearConfig, getConfigPath, readConfig } from '../utils/config-store.js';
@@ -14,16 +14,28 @@ export const logoutCommand = defineCommand({
         name: 'logout',
         description: 'Clear the stored devicecloud.dev session',
     },
-    async run() {
+    args: {
+        json: jsonFlag,
+    },
+    async run({ args }) {
+        const json = Boolean(args.json);
         const config = readConfig();
         if (!config?.session) {
-            logger.log(ui.info(`No active session found (${colors.dim(getConfigPath())}).`));
             clearConfig();
+            if (json) {
+                logger.json({ status: 'SUCCESS', loggedOut: false });
+            }
+            else {
+                logger.log(ui.info(`No active session found (${colors.dim(getConfigPath())}).`));
+            }
             return;
         }
-        const { anonKey } = ENVIRONMENTS[config.env].supabase;
-        await CliAuthGateway.signOut(config.supabase_url, anonKey, config.session);
+        await CliAuthGateway.signOut(config.supabase_url, config.env, config.session);
         clearConfig();
+        if (json) {
+            logger.json({ status: 'SUCCESS', loggedOut: true, user: config.session.user_email });
+            return;
+        }
         logger.log(ui.success(`Logged out ${colors.dim(`(${config.session.user_email})`)}`));
     },
 });

package/dist/commands/status.js

@@ -105,13 +105,12 @@ async function statusMain({ apiKeyFlag, apiUrl, json, name, uploadId, }) {
         if (isClientApiError(lastError)) {
             const errorMessage = lastError?.message || 'Unknown error';
             if (json) {
-                // eslint-disable-next-line no-console
-                console.log(JSON.stringify({
+                logger.json({
                     status: 'FAILED',
                     error: errorMessage,
                     attempts: attemptsMade,
                     tests: [],
-                }, null, 2));
+                });
                 return;
             }
             throw new CliError(errorMessage);
@@ -128,8 +127,7 @@ async function statusMain({ apiKeyFlag, apiUrl, json, name, uploadId, }) {
             errorMessage = `Failed to get status after ${attemptsMade} attempt${attemptsMade > 1 ? 's' : ''}.\n\nInternet connectivity check failed - all test endpoints unreachable:\n${endpointDetails}\n\nPlease verify your network connection and DNS resolution.\nLast API error: ${lastError?.message || 'Unknown error'}`;
         }
         if (json) {
-            // eslint-disable-next-line no-console
-            console.log(JSON.stringify({
+            logger.json({
                 status: 'FAILED',
                 error: errorMessage,
                 attempts: attemptsMade,
@@ -139,7 +137,7 @@ async function statusMain({ apiKeyFlag, apiUrl, json, name, uploadId, }) {
                     message: connectivityCheck.message,
                 },
                 tests: [],
-            }, null, 2));
+            });
             return;
         }
         throw new CliError(errorMessage);
@@ -147,8 +145,7 @@ async function statusMain({ apiKeyFlag, apiUrl, json, name, uploadId, }) {
     try {
         if (json) {
             const { tests, ...rest } = status;
-            // eslint-disable-next-line no-console
-            console.log(JSON.stringify({ ...rest, tests }, null, 2));
+            logger.json({ ...rest, tests });
             return;
         }
         const fields = [];

package/dist/commands/switch-org.d.ts

@@ -8,5 +8,9 @@ export declare const switchOrgCommand: import("citty").CommandDef<{
         readonly required: false;
         readonly description: "Org name to switch to (omit for an interactive picker)";
     };
+    readonly json: {
+        readonly type: "boolean";
+        readonly description: "Output the result as a single JSON object on stdout";
+    };
 }>;
 export default switchOrgCommand;

package/dist/commands/switch-org.js

@@ -3,13 +3,16 @@
  *
  * With an argument (`dcd switch-org <name>`): update config immediately after
  * confirming the user is a member via GET /me/orgs.
- * Without an argument: fetch orgs and prompt the user to pick one.
+ * Without an argument: fetch orgs and prompt the user to pick one (an error
+ * instead when there's no TTY to answer the prompt).
  */
 import { defineCommand } from 'citty';
+import { jsonFlag } from '../config/flags/output.flags.js';
 import { apiKeyOverride, resolveAuth } from '../utils/auth.js';
+import { canPrompt } from '../utils/ci.js';
 import { CliError, logger } from '../utils/cli.js';
 import { readConfig, resolveApiUrl, writeConfig } from '../utils/config-store.js';
-import { fetchOrgs, pickOrg } from '../utils/orgs.js';
+import { fetchOrgs, matchOrg, pickOrg } from '../utils/orgs.js';
 import { colors } from '../utils/styling.js';
 import { ui } from '../utils/ui.js';
 export const switchOrgCommand = defineCommand({
@@ -27,6 +30,7 @@ export const switchOrgCommand = defineCommand({
             required: false,
             description: 'Org name to switch to (omit for an interactive picker)',
         },
+        json: jsonFlag,
     },
     async run({ args }) {
         const config = readConfig();
@@ -37,44 +41,43 @@ export const switchOrgCommand = defineCommand({
         // a dev Bearer token to the prod API.
         const apiUrl = resolveApiUrl(args['api-url']);
         const target = args.org;
+        const json = Boolean(args.json);
         // sessionOnly: an exported DEVICE_CLOUD_API_KEY must not shadow the
         // browser session this command requires.
         const auth = await resolveAuth({ apiKeyFlag: undefined, sessionOnly: true });
         const orgs = await fetchOrgs(apiUrl, auth.headers);
         let chosen;
         if (target) {
-            chosen = matchOrg(orgs, target);
+            chosen = matchOrg(orgs, target, '`dcd switch-org` without arguments');
         }
         else {
-            chosen = await pickOrg(orgs);
+            // Under --json the picker draws on stderr so stdout stays pure JSON.
+            const output = json ? process.stderr : undefined;
+            // Without a TTY the picker would wait forever for a keypress.
+            if (orgs.length > 1 && !canPrompt(output)) {
+                throw new CliError(`There's no terminal to pick an organization in. Run \`dcd switch-org <name>\` with one of: ${orgs.map((o) => o.name).join(', ')}`);
+            }
+            chosen = await pickOrg(orgs, { output });
         }
         writeConfig({
             ...config,
             current_org_id: chosen.id,
             current_org_name: chosen.name,
         });
-        logger.log(ui.success(`Switched to ${colors.highlight(chosen.name)}`));
         // The switch only changes the stored session; an exported key still wins.
-        if (apiKeyOverride() === 'DEVICE_CLOUD_API_KEY') {
+        const keyOverride = apiKeyOverride() === 'DEVICE_CLOUD_API_KEY';
+        if (json) {
+            logger.json({
+                status: 'SUCCESS',
+                org: { id: chosen.id, name: chosen.name, slug: chosen.slug ?? null },
+                apiKeyOverride: keyOverride,
+            });
+            return;
+        }
+        logger.log(ui.success(`Switched to ${colors.highlight(chosen.name)}`));
+        if (keyOverride) {
             logger.log(ui.warn(`${colors.highlight('DEVICE_CLOUD_API_KEY')} is set, so other dcd commands still authenticate with that API key and its org, not ${chosen.name}. Unset it to use the session.`));
         }
     },
 });
-/**
- * Match a user-supplied string to an org. Prefers case-insensitive name match.
- * Falls back to slug / id so existing scripts keep working, but error output
- * only surfaces names.
- */
-function matchOrg(orgs, target) {
-    const needle = target.toLowerCase();
-    const nameMatches = orgs.filter((o) => o.name.toLowerCase() === needle);
-    if (nameMatches.length > 1) {
-        throw new CliError(`Multiple orgs named "${target}". Run \`dcd switch-org\` without arguments to pick interactively.`);
-    }
-    const chosen = nameMatches[0] ?? orgs.find((o) => o.slug === target || o.id === target);
-    if (!chosen) {
-        throw new CliError(`No org named "${target}". Available: ${orgs.map((o) => o.name).join(', ')}`);
-    }
-    return chosen;
-}
 export default switchOrgCommand;

package/dist/commands/upgrade.d.ts

@@ -1,2 +1,7 @@
-export declare const upgradeCommand: import("citty").CommandDef<import("citty").ArgsDef>;
+export declare const upgradeCommand: import("citty").CommandDef<{
+    readonly json: {
+        readonly type: "boolean";
+        readonly description: "Output the result as a single JSON object on stdout";
+    };
+}>;
 export default upgradeCommand;

package/dist/commands/upgrade.js

@@ -12,6 +12,7 @@ import { chmodSync, createReadStream, createWriteStream, renameSync, unlinkSync,
 import { Readable } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
 import { defineCommand } from 'citty';
+import { jsonFlag } from '../config/flags/output.flags.js';
 import { VersionService } from '../services/version.service.js';
 import { CliError, getCliVersion, getInstallMethod, logger, } from '../utils/cli.js';
 import { colors } from '../utils/styling.js';
@@ -31,7 +32,15 @@ export const upgradeCommand = defineCommand({
         name: 'upgrade',
         description: 'Upgrade dcd in place to the latest released version',
     },
-    async run() {
+    args: {
+        json: jsonFlag,
+    },
+    async run({ args }) {
+        const json = Boolean(args.json);
+        const out = (m) => {
+            if (!json)
+                logger.log(m);
+        };
         if (getInstallMethod() !== 'binary') {
             throw new CliError('`dcd upgrade` only applies to the standalone binary install. ' +
                 'Run: npm install -g @devicecloud.dev/dcd@latest');
@@ -45,11 +54,19 @@ export const upgradeCommand = defineCommand({
         // Reachable, but nothing published on this channel yet (e.g. a stable
         // install while only betas exist). Not an error — just nothing to do.
         if (result.version === null) {
+            if (json) {
+                logger.json({ status: 'NO_RELEASE', current, channel: result.channel });
+                return;
+            }
             logger.log(ui.info(`No newer release available on the ${result.channel} channel.`));
             return;
         }
         const latest = result.version;
         if (!versionService.isOutdated(current, latest)) {
+            if (json) {
+                logger.json({ status: 'UP_TO_DATE', current, latest, channel: result.channel });
+                return;
+            }
             logger.log(ui.success(`Already on the latest version (${colors.highlight(current)})`));
             return;
         }
@@ -69,8 +86,8 @@ export const upgradeCommand = defineCommand({
         const base = process.env.DCD_DOWNLOAD_BASE ?? DEFAULT_DOWNLOAD_BASE;
         const binaryUrl = `${base}/download/${latest}/${asset}`;
         const sumsUrl = `${base}/download/${latest}/SHA256SUMS`;
-        logger.log(ui.info(`Upgrading ${colors.highlight(current)} → ${colors.highlight(latest)}`));
-        logger.log(ui.note(`  ${binaryUrl}`));
+        out(ui.info(`Upgrading ${colors.highlight(current)} → ${colors.highlight(latest)}`));
+        out(ui.note(`  ${binaryUrl}`));
         const execPath = process.execPath;
         const tmpPath = `${execPath}.new`;
         try {
@@ -89,6 +106,10 @@ export const upgradeCommand = defineCommand({
             safeUnlink(tmpPath);
             throw new CliError(`Upgrade failed: ${e.message}. The existing binary at ${execPath} was not modified.`);
         }
+        if (json) {
+            logger.json({ status: 'UPGRADED', current, latest, channel: result.channel });
+            return;
+        }
         logger.log(ui.success(`Upgraded to ${colors.highlight(latest)}`));
     },
 });

package/dist/commands/upload.js

@@ -116,8 +116,7 @@ export const uploadCommand = defineCommand({
             });
             telemetry.recordEncryption({ binary: encryption.enabled });
             if (json) {
-                // eslint-disable-next-line no-console
-                console.log(JSON.stringify({ appBinaryId }, null, 2));
+                logger.json({ appBinaryId });
                 return;
             }
             logger.log(`\n${ui.success('Upload complete')}`);

package/dist/commands/whoami.d.ts

@@ -4,5 +4,9 @@ export declare const whoamiCommand: import("citty").CommandDef<{
         readonly type: "string";
         readonly alias: ["apiKey"];
     };
+    readonly json: {
+        readonly type: "boolean";
+        readonly description: "Output the result as a single JSON object on stdout";
+    };
 }>;
 export default whoamiCommand;

package/dist/commands/whoami.js

@@ -7,6 +7,7 @@
  */
 import { defineCommand } from 'citty';
 import { apiFlags } from '../config/flags/api.flags.js';
+import { jsonFlag } from '../config/flags/output.flags.js';
 import { apiKeyOverride } from '../utils/auth.js';
 import { logger } from '../utils/cli.js';
 import { readConfig } from '../utils/config-store.js';
@@ -22,10 +23,26 @@ export const whoamiCommand = defineCommand({
             ...apiFlags['api-key'],
             description: 'An API key as you would pass it to other commands; whoami says that it takes precedence over the stored session',
         },
+        json: jsonFlag,
     },
     run({ args }) {
         const config = readConfig();
         const keySource = apiKeyOverride(args['api-key']);
+        if (args.json) {
+            logger.json({
+                status: 'SUCCESS',
+                loggedIn: Boolean(config?.session),
+                ...(config?.session && {
+                    user: config.session.user_email,
+                    org: config.current_org_id
+                        ? { id: config.current_org_id, name: config.current_org_name ?? null }
+                        : null,
+                    env: config.env,
+                }),
+                apiKeySource: keySource ?? null,
+            });
+            return;
+        }
         const keyName = colors.highlight(keySource ?? '');
         if (!config?.session) {
             logger.log(ui.info(keySource === 'DEVICE_CLOUD_API_KEY'

package/dist/config/environments.d.ts

@@ -1,12 +1,10 @@
 /**
  * Per-env devicecloud.dev coordinates — single source of truth for the URLs
- * and Supabase credentials the CLI uses.
+ * the CLI uses.
  *
- * **These `anonKey` values are public.** Supabase anon keys are JWTs designed
- * to be embedded in client code (web apps, mobile apps, CLIs). They only
- * grant whatever the project's RLS policies expose. Don't worry about seeing
- * them here — every Supabase-based product ships its anon key the same way.
- * https://supabase.com/docs/guides/api/api-keys
+ * There is deliberately no Supabase key here. A compiled-in key can never be
+ * rotated without breaking every pinned CLI version, so it is fetched from the
+ * API at runtime instead: see `getSupabaseKey` in ./supabase-key.ts (dcd#1112).
  */
 export type DcdEnvName = 'dev' | 'prod';
 export interface DcdEnvironment {
@@ -15,13 +13,12 @@ export interface DcdEnvironment {
     supabase: {
         url: string;
         projectRef: string;
-        anonKey: string;
     };
     /**
      * Pinned KEK public key for client-side binary envelope encryption (dcd#1138).
      * `key` is base64 of the raw 32-byte X25519 public key; `version` selects which
-     * KEK the platform API unwraps with. **Public — safe to embed** (like the anon
-     * key above): it can only *encrypt*; the private half lives solely on the API.
+     * KEK the platform API unwraps with. **Public — safe to embed**: it can only
+     * *encrypt*; the private half lives solely on the API.
      *
      * Left `null` until the KEK is generated and provisioned. Generate a keypair
      * with, e.g.:

package/dist/config/environments.js

@@ -1,12 +1,10 @@
 /**
  * Per-env devicecloud.dev coordinates — single source of truth for the URLs
- * and Supabase credentials the CLI uses.
+ * the CLI uses.
  *
- * **These `anonKey` values are public.** Supabase anon keys are JWTs designed
- * to be embedded in client code (web apps, mobile apps, CLIs). They only
- * grant whatever the project's RLS policies expose. Don't worry about seeing
- * them here — every Supabase-based product ships its anon key the same way.
- * https://supabase.com/docs/guides/api/api-keys
+ * There is deliberately no Supabase key here. A compiled-in key can never be
+ * rotated without breaking every pinned CLI version, so it is fetched from the
+ * API at runtime instead: see `getSupabaseKey` in ./supabase-key.ts (dcd#1112).
  */
 export const ENVIRONMENTS = {
     prod: {
@@ -15,7 +13,6 @@ export const ENVIRONMENTS = {
         supabase: {
             url: 'https://cloud.devicecloud.dev',
             projectRef: 'pgydnphbimetinsgfkbo',
-            anonKey: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InBneWRucGhiaW1ldGluc2dma2JvIiwicm9sZSI6ImFub24iLCJpYXQiOjE3MDc1OTQzNDYsImV4cCI6MjAyMzE3MDM0Nn0.hAYOMFxxwX1exkQkY9xyQJGC_GhGnyogkj2N-kBkMI8',
         },
         kekPublicKey: { version: 1, key: 'wtfyWEwK7nJzwI4PD+9RAW8jxIR1u8kMQq2IhsrVnH4=' },
     },
@@ -25,7 +22,6 @@ export const ENVIRONMENTS = {
         supabase: {
             url: 'https://lbmsowehtjwnqlurpemb.supabase.co',
             projectRef: 'lbmsowehtjwnqlurpemb',
-            anonKey: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImxibXNvd2VodGp3bnFsdXJwZW1iIiwicm9sZSI6ImFub24iLCJpYXQiOjE3MDkyMTg0ODcsImV4cCI6MjAyNDc5NDQ4N30.zeLTMAuZ_WwYvGdeP0kdvL_Zrs-RQee5APPyxmWq7qQ',
         },
         kekPublicKey: { version: 1, key: 'RgcToF/OJpcQI9koYvSvtj/WLaebfcN4v5GJoqtr/00=' },
     },

package/dist/config/flags/output.flags.d.ts

@@ -1,3 +1,11 @@
+/**
+ * Generic `--json` flag for commands outside `cloud`. With it, stdout carries
+ * exactly one JSON object; failures print `{ status: 'FAILED', error }`.
+ */
+export declare const jsonFlag: {
+    readonly type: "boolean";
+    readonly description: "Output the result as a single JSON object on stdout";
+};
 /**
  * Output format and artifact download flags
  */

package/dist/config/flags/output.flags.js

@@ -1,3 +1,11 @@
+/**
+ * Generic `--json` flag for commands outside `cloud`. With it, stdout carries
+ * exactly one JSON object; failures print `{ status: 'FAILED', error }`.
+ */
+export const jsonFlag = {
+    type: 'boolean',
+    description: 'Output the result as a single JSON object on stdout',
+};
 /**
  * Output format and artifact download flags
  */

package/dist/config/supabase-key.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The Supabase publishable key, fetched from the dcd API at runtime (dcd#1112).
+ *
+ * Releases up to this one compiled the anon key in, so the key could never be
+ * rotated without breaking every CLI version pinned in customer CI. The API now
+ * serves it from the public `GET /cli-config`, and rotating it is an env change
+ * on the API.
+ *
+ * Fetched once per process and kept in memory only. It is deliberately not
+ * cached on disk: a stale key makes GoTrue answer a refresh with a 4xx, which
+ * `resolveAuth` treats as a dead session and deletes the user's login.
+ *
+ * Only the key comes from the API. The Supabase URLs stay pinned in
+ * `ENVIRONMENTS`: prod goes through the `cloud.devicecloud.dev` custom domain,
+ * which customer firewalls may allow-list, not the API's raw `supabase.co` URL.
+ */
+import { type DcdEnvName } from './environments.js';
+/** The publishable key for `env`. A failed fetch is not cached, so the next call retries. */
+export declare function getSupabaseKey(env: DcdEnvName): Promise<string>;
+/**
+ * Headers that authenticate a raw Storage/Auth request with `key` alone. A
+ * legacy anon key is a JWT and also goes in `Authorization`; an
+ * `sb_publishable_` key is not a JWT and must only be sent as `apikey`.
+ */
+export declare function supabaseKeyHeaders(key: string): Record<string, string>;
+/** Test seam: forget fetched keys. */
+export declare function resetSupabaseKeyCache(): void;