@faable/faable 3.4.2 → 4.1.0

package/dist/api/FaableApi.js

@@ -33,6 +33,11 @@ const allPages = async (fetch_page) => {
     } while (next);
     return items;
 };
+// Only what's set: the list endpoints answer 400 to an unknown or empty param.
+const page_params = ({ pageSize, next }) => ({
+    ...(pageSize ? { pageSize } : {}),
+    ...(next ? { next } : {})
+});
 const data = async (res) => {
     const items = (await res).data;
     return items;
@@ -40,6 +45,10 @@ const data = async (res) => {
 class FaableApi {
     client;
     strategy;
+    // The active project (`--project`, FAABLE_PROJECT, `faable project use`),
+    // when there is one. Project-wide listings are scoped to it; calls about
+    // one app keep using that app's own project.
+    project;
     constructor(config) {
         const { authStrategy, auth } = config;
         this.client = create_base_client();
@@ -110,10 +119,35 @@ class FaableApi {
     async issueAuthAccountToken(account_id) {
         return data(this.client.post(`/auth-accounts/${account_id}/token`));
     }
+    // Every app the caller can see, across projects. Used to match the working
+    // directory's repository to its app: the link is global, so a repo whose
+    // app lives outside the active project must still resolve.
     async list() {
-        return allPages(next => data(this.client.get(`/app`, {
-            params: { pageSize: 200, ...(next ? { next } : {}) }
-        })));
+        return allPages(next => this.listApps({ pageSize: 200, next }, null));
+    }
+    // One page of apps, scoped to `project` (default: the active project).
+    // `null` = unscoped. The api filters by the header, so an admin session
+    // doesn't page through the whole platform.
+    async listApps(params, project = this.project ?? null) {
+        return data(this.client.get(`/app`, {
+            params: page_params(params),
+            ...(project ? { headers: projectHeader(project) } : {})
+        }));
+    }
+    // Projects the caller belongs to (an admin session sees all of them).
+    // `q` searches name/description/slug; `user_id` keeps the ones they own.
+    async listProjects(params) {
+        const { q, user_id, ...page } = params;
+        return data(this.client.get(`/project`, {
+            params: { ...page_params(page), ...(q ? { q } : {}), ...(user_id ? { user_id } : {}) }
+        }));
+    }
+    async getProject(project_id) {
+        return data(this.client.get(`/project/${project_id}`));
+    }
+    // The Faable Auth tenants of a project. Membership-checked by the api.
+    async listProjectAuthAccounts(project_id, params = {}) {
+        return data(this.client.get(`/project/${project_id}/auth-accounts`, { params: page_params(params) }));
     }
     async getBySlug(slug) {
         return data(this.client.get(`/app/slug/${slug}`));
@@ -209,10 +243,13 @@ class FaableApi {
     // Deployments of an app, newest first (the API's list index sorts
     // createdAt desc). Team pinned via header — same reason as domains.
     async listDeployments(app_id, team) {
-        return firstPage(data(this.client.get(`/deployment`, {
-            params: { app_id },
+        return firstPage(this.listDeploymentsPage(app_id, team));
+    }
+    async listDeploymentsPage(app_id, team, params = {}) {
+        return data(this.client.get(`/deployment`, {
+            params: { app_id, ...page_params(params) },
             headers: projectHeader(team)
-        })));
+        }));
     }
     // Build and deploy the current head of the deploy branch server-side —
     // the same path a push webhook takes, same-commit dedupe included.
@@ -236,10 +273,13 @@ class FaableApi {
     // so every call pins the app's project via `x-faable-project` (same pattern
     // as createSecretsBatch).
     async listDomains(app_id, team) {
-        return firstPage(data(this.client.get(`/domain`, {
-            params: { app_id },
+        return firstPage(this.listDomainsPage(app_id, team));
+    }
+    async listDomainsPage(app_id, team, params = {}) {
+        return data(this.client.get(`/domain`, {
+            params: { app_id, ...page_params(params) },
             headers: projectHeader(team)
-        })));
+        }));
     }
     async createDomain(team, params) {
         return data(this.client.post(`/domain`, params, {

package/dist/api/auth_admin.js

@@ -1,48 +1,157 @@
+import fs from 'fs-extra';
+import os from 'os';
+import path__default from 'path';
+import { ContextStore } from '../lib/ContextStore.js';
 import { CredentialsStore } from '../lib/CredentialsStore.js';
 import { log } from '../log.js';
 import { FaableApi } from './FaableApi.js';
-import { createBearerAuthApi, createAnonymousAuthApi } from './auth.js';
-import { loadLiveCredentials } from './session.js';
+import { AUTH_DOMAIN, createAnonymousAuthApi, createBearerAuthApi } from './auth.js';
+import { requireProject } from './project.js';
+import { loadLiveCredentials, isTokenLive } from './session.js';
 import { bearer_strategy } from './strategies/bearer.strategy.js';
 
-// Default tenant host. `faable auth` is customer-facing: a customer targets
-// their own tenant with --auth-url https://<account>.auth.faable.link (or
-// FAABLE_AUTH_URL); the default points at the Faable tenant.
-const DEFAULT_AUTH_URL = 'https://faable.auth.faable.link';
-// Build a management-API client for the Auth server reusing the CLI session
-// (FAABLE_TOKEN → `faable login` credentials, auto-refreshed). The bearer is
-// sent as-is and the SERVER decides whether it may manage the target tenant
-// (today MGMT_AUTH_ENFORCE is authz dry-run; when enforced, tokens without the
-// management audience/scopes for the tenant will get 403 — see
-// auth/docs/management-api-m2m-token.md for the M2M path).
-const requireAuthAdmin = async (opts = {}) => {
-    let token = process.env.FAABLE_TOKEN;
-    if (!token) {
-        const store = new CredentialsStore();
-        const config = await loadLiveCredentials(store);
-        if (config?.apikey && !config.token) {
-            // Deploy API keys are not Auth management credentials.
-            log.error("❌ You are logged in with an API key, but `faable auth` needs a browser session. Run 'faable login' (without --apikey) first.");
-            process.exit(1);
-        }
-        token = config?.token;
+// The session bearer: FAABLE_TOKEN, else `faable login` (auto-refreshed).
+const requireSessionToken = async () => {
+    if (process.env.FAABLE_TOKEN)
+        return process.env.FAABLE_TOKEN;
+    const config = await loadLiveCredentials(new CredentialsStore());
+    if (config?.apikey && !config.token) {
+        // Deploy API keys are not Auth management credentials.
+        log.error("❌ You are logged in with an API key, but `faable auth` needs a browser session. Run 'faable login' (without --apikey) first.");
+        process.exit(1);
     }
-    if (!token) {
+    if (!config?.token) {
         log.error("❌ Not logged in. Run 'faable login' first.");
         process.exit(1);
     }
-    const domain = opts.authUrl || process.env.FAABLE_AUTH_URL || DEFAULT_AUTH_URL;
-    const account = opts.account || process.env.FAABLE_AUTH_ACCOUNT;
-    const tenant = account ?? (await resolveAccountByHost(domain));
-    const tenantToken = tenant ? await issueTenantToken(token, tenant) : undefined;
-    // Prefer the per-tenant management token; the session's bearer is the
-    // fallback (the platform tenant, or an api that can't issue one), exactly
-    // what `faable auth` sent before phase 2. Either way, scoped to the tenant.
+    return config.token;
+};
+// Which Auth tenant `faable auth` manages, in precedence order:
+//
+//   1. --account / FAABLE_AUTH_ACCOUNT — an explicit tenant id;
+//   2. --auth-url / FAABLE_AUTH_URL    — a tenant host, looked up;
+//   3. the active project's tenant     — GET /project/:id/auth-accounts. One
+//      tenant: that one. Several: the one `faable auth use` stored for the
+//      project, or an error listing them.
+//
+// There is no default host any more: it used to be the Faable tenant, so a
+// customer who forgot --auth-url was listing (or suspending) OUR users.
+const resolveTenant = async (opts, api, store = new ContextStore(), env = process.env) => {
+    const account = opts.account || env.FAABLE_AUTH_ACCOUNT;
+    const authUrl = opts.authUrl || env.FAABLE_AUTH_URL;
+    if (account) {
+        return { account, domain: authUrl || AUTH_DOMAIN, source: 'account' };
+    }
+    if (authUrl) {
+        return {
+            account: await resolveAccountByHost(authUrl),
+            domain: authUrl,
+            source: 'auth-url'
+        };
+    }
+    const project = await requireProject(api, store, env);
+    const accounts = (await api.listProjectAuthAccounts(project.id, { pageSize: 200 }))
+        .results;
+    const chosen = await chooseAccount(project.id, accounts, store);
+    return {
+        account: chosen.id,
+        domain: `https://${chosen.domain}`,
+        source: 'project',
+        project: project.id,
+        name: chosen.name
+    };
+};
+const chooseAccount = async (project, accounts, store = new ContextStore()) => {
+    if (accounts.length === 1)
+        return accounts[0];
+    if (accounts.length === 0) {
+        throw new Error(`Project ${project} has no Faable Auth tenant. Create one in the dashboard (https://dashboard.faable.com), or target one with --account <account_id>.`);
+    }
+    const stored = (await store.load()).auth_accounts?.[project];
+    const match = accounts.find(a => a.id === stored);
+    if (match)
+        return match;
+    const list = accounts.map(a => `${a.name} (${a.id})`).join(', ');
+    throw new Error(`Project ${project} has ${accounts.length} Auth tenants: ${list}. Pick one with: faable auth use <account_id>, or pass --account <account_id>.`);
+};
+// A management-API client for the tenant `resolveTenant` picks, with the
+// per-tenant token the deploy api issues (cached until it expires); the
+// session bearer is the fallback where no such token exists.
+const requireAuthAdmin = async (opts = {}) => {
+    const token = await requireSessionToken();
+    const deploy = FaableApi.create({
+        authStrategy: bearer_strategy,
+        auth: { token }
+    });
+    const tenant = await resolveTenant(opts, deploy);
+    const tenantToken = tenant.account
+        ? await cachedTenantToken(token, tenant.account, deploy)
+        : undefined;
     return createBearerAuthApi(tenantToken ?? token, {
-        domain,
-        account: tenant ?? account
+        domain: tenant.domain,
+        account: tenant.account
     });
 };
+// Every `faable auth` call used to mint a fresh tenant token — one extra
+// round trip per command, and a burst of them from a script or the MCP
+// server. It lives for minutes (`expires_in`), so it's kept next to the
+// credentials (0600) and reused while it's live, for the same session only.
+const cachedTenantToken = async (session_token, account_id, api, cache = new TenantTokenCache()) => {
+    const sub = subject(session_token);
+    const hit = await cache.get(account_id, sub);
+    if (hit)
+        return hit;
+    const issued = await issueTenantToken(session_token, account_id, api);
+    if (issued)
+        await cache.set(account_id, sub, issued);
+    return issued;
+};
+const subject = (token) => {
+    try {
+        const claims = JSON.parse(Buffer.from(token.split('.')[1], 'base64url').toString());
+        return typeof claims.sub === 'string' ? claims.sub : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+class TenantTokenCache {
+    file;
+    constructor(file = path__default.join(os.homedir(), '.faable', 'tenant-tokens.json')) {
+        this.file = file;
+    }
+    async read() {
+        try {
+            return (await fs.readJSON(this.file)) || {};
+        }
+        catch {
+            return {};
+        }
+    }
+    async get(account_id, sub) {
+        const entry = (await this.read())[account_id];
+        if (!entry || entry.sub !== sub || !isTokenLive(entry.token))
+            return;
+        return entry.token;
+    }
+    async set(account_id, sub, token) {
+        try {
+            const all = await this.read();
+            // Drop the dead ones while we're here.
+            for (const [id, entry] of Object.entries(all)) {
+                if (!isTokenLive(entry.token))
+                    delete all[id];
+            }
+            all[account_id] = { token, sub };
+            await fs.ensureDir(path__default.dirname(this.file));
+            await fs.writeJSON(this.file, all, { spaces: 2, mode: 0o600 });
+            await fs.chmod(this.file, 0o600);
+        }
+        catch {
+            // A cache that can't be written is a cache miss next time, not an error.
+        }
+    }
+}
 // The tenant behind an Auth host (`<slug>.auth.faable.link` or a custom
 // domain), through the anonymous public lookup. `undefined` when it can't be
 // resolved: the server then picks the tenant from the host, as before.
@@ -87,7 +196,7 @@ const hintAuthError = (e) => {
         throw new Error("Unauthorized (401) by the Auth management API. Your session may have expired — run 'faable login' and retry.");
     }
     if (status === 403) {
-        throw new Error('Forbidden (403): your session is not allowed to manage this tenant. Check --auth-url/--account, or use credentials with management access for it.');
+        throw new Error('Forbidden (403): your session is not allowed to manage this tenant. Check the tenant (`faable whoami`, --account, --project), or use credentials with management access for it.');
     }
     throw e;
 };
@@ -103,4 +212,4 @@ const withAuthHints = (handler) => {
     };
 };
 
-export { hintAuthError, issueTenantToken, requireAuthAdmin, resolveAccountByHost, withAuthHints };
+export { TenantTokenCache, cachedTenantToken, chooseAccount, hintAuthError, issueTenantToken, requireAuthAdmin, requireSessionToken, resolveAccountByHost, resolveTenant, subject, withAuthHints };

package/dist/api/context.js

@@ -6,6 +6,7 @@ import { bearer_strategy } from './strategies/bearer.strategy.js';
 import { CredentialsStore } from '../lib/CredentialsStore.js';
 import { loadLiveCredentials } from './session.js';
 import { log } from '../log.js';
+import { configuredProject, resolveProjectRef } from './project.js';
 
 const context = async (targetAppId) => {
     let api;
@@ -49,6 +50,14 @@ const context = async (targetAppId) => {
             }
         }
     }
+    // The active project scopes project-wide listings (`deploy list`). Only
+    // when one is configured: picking a default here would cost a request on
+    // every command, including a deploy.
+    if (api) {
+        const configured = await configuredProject();
+        if (configured)
+            api.project = await resolveProjectRef(api, configured.ref);
+    }
     const appId = await api?.strategy?.app_id?.();
     return {
         api,

package/dist/api/project.js

@@ -0,0 +1,62 @@
+import { ContextStore } from '../lib/ContextStore.js';
+
+let flag_value;
+// Set by the global middleware in src/index.ts.
+const setProjectFlag = (value) => {
+    flag_value = value || undefined;
+};
+const configuredProject = async (store = new ContextStore(), env = process.env) => {
+    if (flag_value)
+        return { ref: flag_value, source: 'flag' };
+    if (env.FAABLE_PROJECT)
+        return { ref: env.FAABLE_PROJECT, source: 'env' };
+    const { project } = await store.load();
+    if (project)
+        return { ref: project, source: 'config' };
+    return undefined;
+};
+const ID_RE = /^(project|team)_[a-f0-9]{24}$/;
+// project_<hex>: the api's form. A team_<hex> (the app rows' form) is the
+// same project.
+const toProjectId = (id) => id.replace(/^team_/, 'project_');
+// An id is taken as-is (the api checks membership on use); a name or slug is
+// looked up — exactly one project must match.
+const resolveProjectRef = async (api, ref) => {
+    if (ID_RE.test(ref))
+        return toProjectId(ref);
+    const page = await api.listProjects({ q: ref, pageSize: 50 });
+    const wanted = ref.toLowerCase();
+    const matches = page.results.filter(p => p.name.toLowerCase() === wanted || p.slug?.toLowerCase() === wanted);
+    if (matches.length === 1)
+        return matches[0].id;
+    if (matches.length === 0) {
+        throw new Error(`No project named "${ref}". See them with: faable project list`);
+    }
+    throw new Error(`Several projects are named "${ref}": ${describe(matches)}. Use its id.`);
+};
+const describe = (projects) => projects.map(p => `${p.name} (${p.id})`).join(', ');
+// The project a project-wide command needs. With none configured, a caller
+// who belongs to exactly one project gets that one; otherwise it's an error
+// that says how to choose.
+const requireProject = async (api, store = new ContextStore(), env = process.env) => {
+    const configured = await configuredProject(store, env);
+    if (configured) {
+        return {
+            id: await resolveProjectRef(api, configured.ref),
+            source: configured.source
+        };
+    }
+    const page = await api.listProjects({ pageSize: 2 });
+    if (page.results.length === 1 && !page.next) {
+        return { id: page.results[0].id, source: 'only' };
+    }
+    throw new Error('No project selected. Pick one with: faable project use <id|name> (list them with: faable project list), or pass --project <id|name>.');
+};
+const SOURCE_LABEL = {
+    flag: '--project',
+    env: 'FAABLE_PROJECT',
+    config: 'faable project use',
+    only: 'your only project'
+};
+
+export { SOURCE_LABEL, configuredProject, requireProject, resolveProjectRef, setProjectFlag, toProjectId };

package/dist/commands/auth/accounts/index.js

@@ -0,0 +1,76 @@
+import { requireSessionToken } from '../../../api/auth_admin.js';
+import { FaableApi } from '../../../api/FaableApi.js';
+import { requireProject } from '../../../api/project.js';
+import { bearer_strategy } from '../../../api/strategies/bearer.strategy.js';
+import { ContextStore } from '../../../lib/ContextStore.js';
+import { fetch_page, print_json, table_lines, print, more_hint, list_options } from '../../../lib/listing.js';
+import { log } from '../../../log.js';
+
+const deploy_api = async () => FaableApi.create({
+    authStrategy: bearer_strategy,
+    auth: { token: await requireSessionToken() }
+});
+// `faable auth accounts list` — the Auth tenants of the active project, the
+// ones `faable auth` can manage without --account.
+const accounts_list = {
+    command: 'list',
+    describe: "List the active project's Auth tenants",
+    builder: yargs => list_options(yargs).showHelpOnFail(false),
+    handler: async (args) => {
+        const api = await deploy_api();
+        const project = await requireProject(api);
+        const page = await fetch_page(p => api.listProjectAuthAccounts(project.id, p), args);
+        if (args.json)
+            return print_json(page);
+        if (page.data.length === 0) {
+            log.info(`📭 Project ${project.id} has no Auth tenants.`);
+            return;
+        }
+        const stored = (await new ContextStore().load()).auth_accounts?.[project.id];
+        const active = page.data.length === 1 ? page.data[0].id : stored;
+        log.info(`🔐 ${page.data.length} Auth tenant(s) in ${project.id}:`);
+        for (const line of table_lines(['', 'ID', 'NAME', 'DOMAIN'], page.data.map(a => [a.id === active ? '*' : '', a.id, a.name, a.domain]))) {
+            print(line);
+        }
+        const hint = more_hint(page);
+        if (hint)
+            log.info(hint);
+    }
+};
+const accounts = {
+    command: 'accounts',
+    describe: "The active project's Auth tenants",
+    builder: yargs => yargs.command(accounts_list).demandCommand(1).showHelpOnFail(false),
+    handler: () => { }
+};
+// `faable auth use <account_id>` — which tenant `faable auth` manages in the
+// active project, for a project with more than one.
+const auth_use = {
+    command: 'use <account>',
+    describe: 'Set the Auth tenant to manage in the active project',
+    builder: yargs => yargs
+        .positional('account', { type: 'string', demandOption: true })
+        .showHelpOnFail(false),
+    handler: async (args) => {
+        const api = await deploy_api();
+        const project = await requireProject(api);
+        const { results } = await api.listProjectAuthAccounts(project.id, {
+            pageSize: 200
+        });
+        const wanted = args.account.toLowerCase();
+        const account = results.find(a => a.id === args.account ||
+            a.slug?.toLowerCase() === wanted ||
+            a.domain.toLowerCase() === wanted);
+        if (!account) {
+            const list = results.map(a => `${a.name} (${a.id})`).join(', ') || 'none';
+            throw new Error(`${args.account} is not an Auth tenant of ${project.id}. Its tenants: ${list}.`);
+        }
+        await new ContextStore().update(ctx => ({
+            ...ctx,
+            auth_accounts: { ...ctx.auth_accounts, [project.id]: account.id }
+        }));
+        log.info(`✅ faable auth now manages ${account.name} (${account.domain}) in ${project.id}.`);
+    }
+};
+
+export { accounts, auth_use };

package/dist/commands/auth/actions/create.js

@@ -1,8 +1,8 @@
 import fs from 'fs-extra';
 import { withAuthHints, requireAuthAdmin } from '../../../api/auth_admin.js';
 import { log } from '../../../log.js';
-import { json_option, tenant_options } from '../options.js';
-import { print_json } from '../render.js';
+import { tenant_options } from '../options.js';
+import { json_option, print_json } from '../../../lib/listing.js';
 import { formatTriggers } from './triggers.js';
 
 const actions_create = {

package/dist/commands/auth/actions/get.js

@@ -1,8 +1,9 @@
 import { withAuthHints, requireAuthAdmin } from '../../../api/auth_admin.js';
 import { log } from '../../../log.js';
-import { json_option, tenant_options } from '../options.js';
-import { print_json, yes_no } from '../render.js';
+import { tenant_options } from '../options.js';
+import { yes_no } from '../render.js';
 import { formatTriggers } from './triggers.js';
+import { json_option, print_json } from '../../../lib/listing.js';
 
 const actions_get = {
     command: 'get <action_id>',

package/dist/commands/auth/actions/list.js

@@ -1,14 +1,14 @@
 import { withAuthHints, requireAuthAdmin } from '../../../api/auth_admin.js';
 import { log } from '../../../log.js';
-import { json_option, list_options, tenant_options } from '../options.js';
-import { fetch_items } from '../paging.js';
-import { print_json, yes_no, when, table_lines } from '../render.js';
+import { list_options, fetch_page, from_paginator, print_json, table_lines, print, more_hint } from '../../../lib/listing.js';
+import { tenant_options } from '../options.js';
+import { yes_no, when } from '../render.js';
 import { formatTriggers } from './triggers.js';
 
 const actions_list = {
     command: 'list',
     describe: 'List actions',
-    builder: yargs => json_option(list_options(tenant_options(yargs)))
+    builder: yargs => list_options(tenant_options(yargs))
         .option('query', {
         type: 'string',
         description: 'FaableQL filter, e.g. "enabled:true"'
@@ -16,15 +16,15 @@ const actions_list = {
         .showHelpOnFail(false),
     handler: withAuthHints(async (args) => {
         const api = await requireAuthAdmin(args);
-        const { items, more } = await fetch_items(api.actionList({ query: args.query, pageSize: args.limit }), args.all);
+        const page = await fetch_page(from_paginator(api.actionList({ query: args.query })), args);
         if (args.json)
-            return print_json(items);
-        if (items.length === 0) {
+            return print_json(page);
+        if (page.data.length === 0) {
             log.info('📭 No actions.');
             return;
         }
-        log.info(`⚙️ ${items.length} action(s):`);
-        const rows = items.map(a => [
+        log.info(`⚙️ ${page.data.length} action(s):`);
+        const rows = page.data.map(a => [
             a.id ?? '-',
             a.name ?? '-',
             formatTriggers(a),
@@ -33,11 +33,11 @@ const actions_list = {
             when(a.createdAt)
         ]);
         for (const line of table_lines(['ID', 'NAME', 'TRIGGER', 'ENABLED', 'ORDER', 'CREATED'], rows)) {
-            log.info(`  ${line}`);
-        }
-        if (more) {
-            log.info('… more results available: raise --limit or use --all.');
+            print(line);
         }
+        const hint = more_hint(page);
+        if (hint)
+            log.info(hint);
     })
 };
 

package/dist/commands/auth/actions/update.js

@@ -1,8 +1,8 @@
 import fs from 'fs-extra';
 import { withAuthHints, requireAuthAdmin } from '../../../api/auth_admin.js';
 import { log } from '../../../log.js';
-import { json_option, tenant_options } from '../options.js';
-import { print_json } from '../render.js';
+import { tenant_options } from '../options.js';
+import { json_option, print_json } from '../../../lib/listing.js';
 import { formatTriggers } from './triggers.js';
 
 const actions_update = {

package/dist/commands/auth/clients/create.js

@@ -1,7 +1,7 @@
 import { withAuthHints, requireAuthAdmin } from '../../../api/auth_admin.js';
 import { log } from '../../../log.js';
-import { json_option, tenant_options } from '../options.js';
-import { print_json } from '../render.js';
+import { tenant_options } from '../options.js';
+import { json_option, print_json } from '../../../lib/listing.js';
 
 const clients_create = {
     command: 'create',

package/dist/commands/auth/clients/get.js

@@ -1,7 +1,7 @@
 import { withAuthHints, requireAuthAdmin } from '../../../api/auth_admin.js';
 import { log } from '../../../log.js';
-import { json_option, tenant_options } from '../options.js';
-import { print_json } from '../render.js';
+import { tenant_options } from '../options.js';
+import { json_option, print_json } from '../../../lib/listing.js';
 import { resolve_client } from './resolve.js';
 
 const clients_get = {

package/dist/commands/auth/clients/list.js

@@ -1,13 +1,13 @@
 import { withAuthHints, requireAuthAdmin } from '../../../api/auth_admin.js';
 import { log } from '../../../log.js';
-import { json_option, list_options, tenant_options } from '../options.js';
-import { fetch_items } from '../paging.js';
-import { print_json, truncate, when, table_lines } from '../render.js';
+import { list_options, fetch_page, from_paginator, print_json, table_lines, print, more_hint } from '../../../lib/listing.js';
+import { tenant_options } from '../options.js';
+import { truncate, when } from '../render.js';
 
 const clients_list = {
     command: 'list',
     describe: 'List OAuth clients',
-    builder: yargs => json_option(list_options(tenant_options(yargs)))
+    builder: yargs => list_options(tenant_options(yargs))
         .option('q', {
         type: 'string',
         description: 'Full-text search over name/description/client_id'
@@ -15,26 +15,26 @@ const clients_list = {
         .showHelpOnFail(false),
     handler: withAuthHints(async (args) => {
         const api = await requireAuthAdmin(args);
-        const { items, more } = await fetch_items(api.clientList({ q: args.q, pageSize: args.limit }), args.all);
+        const page = await fetch_page(from_paginator(api.clientList({ q: args.q })), args);
         if (args.json)
-            return print_json(items);
-        if (items.length === 0) {
+            return print_json(page);
+        if (page.data.length === 0) {
             log.info('📭 No clients.');
             return;
         }
-        log.info(`🔑 ${items.length} client(s):`);
-        const rows = items.map(c => [
+        log.info(`🔑 ${page.data.length} client(s):`);
+        const rows = page.data.map(c => [
             c.client_id ?? '-',
             truncate(c.name, 28),
             String(c.callbacks?.length ?? 0),
             when(c.createdAt)
         ]);
         for (const line of table_lines(['CLIENT_ID', 'NAME', 'CALLBACKS', 'CREATED'], rows)) {
-            log.info(`  ${line}`);
-        }
-        if (more) {
-            log.info('… more results available: raise --limit or use --all.');
+            print(line);
         }
+        const hint = more_hint(page);
+        if (hint)
+            log.info(hint);
     })
 };