@factorialco/fcode-cli 1.5.0 → 2.1.0

package/README.md

@@ -20,7 +20,7 @@ $ npm install -g @factorialco/fcode-cli
 $ fcode COMMAND
 running command...
 $ fcode (--version)
-@factorialco/fcode-cli/1.5.0 linux-x64 node-v22.22.3
+@factorialco/fcode-cli/2.1.0 linux-x64 node-v22.22.3
 $ fcode --help [COMMAND]
 USAGE
   $ fcode COMMAND
@@ -67,9 +67,15 @@ USAGE
 * [`fcode settings:set KEY VALUE`](#fcode-settingsset-key-value)
 * [`fcode setup-debug`](#fcode-setup-debug)
 * [`fcode status`](#fcode-status)
+* [`fcode team:aliases:delete NAME`](#fcode-teamaliasesdelete-name)
+* [`fcode team:aliases:list`](#fcode-teamaliaseslist)
+* [`fcode team:aliases:set NAME TAG`](#fcode-teamaliasesset-name-tag)
 * [`fcode team:pull`](#fcode-teampull)
 * [`fcode team:push`](#fcode-teampush)
 * [`fcode team:status`](#fcode-teamstatus)
+* [`fcode team:versions:create TAG`](#fcode-teamversionscreate-tag)
+* [`fcode team:versions:delete TAG`](#fcode-teamversionsdelete-tag)
+* [`fcode team:versions:list`](#fcode-teamversionslist)
 * [`fcode test [SLUG]`](#fcode-test-slug)
 * [`fcode test:scaffold SLUG`](#fcode-testscaffold-slug)
 * [`fcode variables:add [RESOURCESLUG]`](#fcode-variablesadd-resourceslug)
@@ -811,6 +817,59 @@ EXAMPLES
   $ fcode status
 ```
 
+## `fcode team:aliases:delete NAME`
+
+Delete a team version alias and the per-entity aliases carrying its name on every owned process and module
+
+```
+USAGE
+  $ fcode team:aliases:delete NAME
+
+ARGUMENTS
+  NAME  alias name to delete
+
+DESCRIPTION
+  Delete a team version alias and the per-entity aliases carrying its name on every owned process and module
+
+EXAMPLES
+  $ fcode team:aliases:delete production
+```
+
+## `fcode team:aliases:list`
+
+List the team version aliases of the active team workspace
+
+```
+USAGE
+  $ fcode team:aliases:list
+
+DESCRIPTION
+  List the team version aliases of the active team workspace
+
+EXAMPLES
+  $ fcode team:aliases:list
+```
+
+## `fcode team:aliases:set NAME TAG`
+
+Create or re-point a team version alias, upserting the per-entity alias on every owned process and module that has the target tag published
+
+```
+USAGE
+  $ fcode team:aliases:set NAME TAG
+
+ARGUMENTS
+  NAME  alias name (e.g. production)
+  TAG   team version tag the alias points at
+
+DESCRIPTION
+  Create or re-point a team version alias, upserting the per-entity alias on every owned process and module that has the
+  target tag published
+
+EXAMPLES
+  $ fcode team:aliases:set production v1.0.0
+```
+
 ## `fcode team:pull`
 
 Fetch team settings (timezone, error handler, inheritance) from cloud into team.json
@@ -828,7 +887,7 @@ EXAMPLES
 
 ## `fcode team:push`
 
-Update cloud team settings (timezone, error handler, inheritance) from team.json
+Update cloud team settings (timezone, error handler, inheritance, webhook auth) from team.json
 
 ```
 USAGE
@@ -838,7 +897,7 @@ FLAGS
   -f, --force  Force command
 
 DESCRIPTION
-  Update cloud team settings (timezone, error handler, inheritance) from team.json
+  Update cloud team settings (timezone, error handler, inheritance, webhook auth) from team.json
 
 EXAMPLES
   $ fcode team:push
@@ -859,6 +918,67 @@ EXAMPLES
   $ fcode team:status
 ```
 
+## `fcode team:versions:create TAG`
+
+Publish a team version: creates a version with the tag on every owned process and module (existing tags are skipped) and pins bare module imports in the published snapshots
+
+```
+USAGE
+  $ fcode team:versions:create TAG [-c <value>]
+
+ARGUMENTS
+  TAG  version tag to publish (e.g. v1.0.0)
+
+FLAGS
+  -c, --comment=<value>  comment describing the version
+
+DESCRIPTION
+  Publish a team version: creates a version with the tag on every owned process and module (existing tags are skipped)
+  and pins bare module imports in the published snapshots
+
+EXAMPLES
+  $ fcode team:versions:create v1.0.0
+
+  $ fcode team:versions:create v1.0.0 --comment "First stable release"
+```
+
+## `fcode team:versions:delete TAG`
+
+Delete a team version. CASCADES: every owned process/module version with the tag is deleted, together with the aliases, executions and schedules that reference them
+
+```
+USAGE
+  $ fcode team:versions:delete TAG [-f]
+
+ARGUMENTS
+  TAG  version tag to delete
+
+FLAGS
+  -f, --force  Force command
+
+DESCRIPTION
+  Delete a team version. CASCADES: every owned process/module version with the tag is deleted, together with the
+  aliases, executions and schedules that reference them
+
+EXAMPLES
+  $ fcode team:versions:delete v1.0.0
+```
+
+## `fcode team:versions:list`
+
+List the team versions published on the active team workspace
+
+```
+USAGE
+  $ fcode team:versions:list
+
+DESCRIPTION
+  List the team versions published on the active team workspace
+
+EXAMPLES
+  $ fcode team:versions:list
+```
+
 ## `fcode test [SLUG]`
 
 Run tests for Factorial Code processes

package/dist/commands/http.d.ts

@@ -11,12 +11,14 @@ export default class Http extends Command {
     };
     run(): Promise<void>;
     /**
-     * Enforces the process's configured webhook basic auth, simulating the cloud
-     * webhook endpoint. The username/password come from processes/<slug>/metadata.json;
-     * an env-var placeholder (e.g. $WEBHOOK_PASSWORD) is resolved against the workspace
-     * variables. Returns true when the request may proceed, false after writing a 401.
+     * Enforces the webhook's configured auth, simulating the cloud webhook endpoint: the effective
+     * configuration names a variable, whose value is looked up in the workspace variables and compared
+     * against the configured header. A missing or malformed header, an undefined variable, a mismatch,
+     * or a webhook inheriting a workspace configuration that team.json does not have, is rejected.
+     * Returns true when the request may proceed, false after writing a 403.
      */
     private _checkWebhookAuth;
+    private _forbid;
     private _handleProcessExecution;
     private _sendResponse;
 }

package/dist/commands/http.js

@@ -7,6 +7,9 @@ const process_runner_1 = require("../services/process-runner");
 const process_1 = require("../repositories/process");
 const variable_1 = require("../repositories/variable");
 const workspace_1 = require("../config/workspace");
+const team_1 = require("../repositories/team");
+const webhook_auth_1 = require("../services/webhook-auth");
+const types_1 = require("../core/types");
 class Http extends core_1.Command {
     async run() {
         const { flags: { port, logLevel, 'auth-user': authUser, 'auth-password': authPassword, jsonLogs }, } = await this.parse(Http);
@@ -16,11 +19,17 @@ class Http extends core_1.Command {
             : null;
         const { slug: teamSlug } = await new workspace_1.default().getTeamOrigin();
         const processRepository = new process_1.default();
+        const teamRepository = new team_1.default();
+        if (useBasicAuth) {
+            this.warn(`--auth-user/--auth-password protect the whole server through the ${types_1.DEFAULT_WEBHOOK_AUTH_HEADER} header, ` +
+                `so a webhook expecting its credential there cannot be exercised at the same time.`);
+        }
         const handler = async (req, res) => {
             // CORS headers
             res.setHeader('Access-Control-Allow-Origin', '*');
             res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
-            res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, Fcode-Async');
+            // Reflected rather than fixed, so a webhook using a custom auth header passes the preflight.
+            res.setHeader('Access-Control-Allow-Headers', req.headers['access-control-request-headers'] ?? 'Content-Type, Authorization, Fcode-Async');
             if (req.method === 'OPTIONS') {
                 res.writeHead(204);
                 res.end();
@@ -77,7 +86,7 @@ class Http extends core_1.Command {
                     res.end(JSON.stringify({ success: false, error: `Process slug required in path (e.g. /api/${teamSlug}/webhooks/my-process)` }));
                     return;
                 }
-                if (!(await this._checkWebhookAuth(req, res, processRepository, slug))) {
+                if (!(await this._checkWebhookAuth(req, res, processRepository, teamRepository, slug))) {
                     return;
                 }
                 await this._handleProcessExecution(req, res, slug, urlObj, logLevel, jsonLogs);
@@ -110,12 +119,13 @@ class Http extends core_1.Command {
         await new Promise(() => { });
     }
     /**
-     * Enforces the process's configured webhook basic auth, simulating the cloud
-     * webhook endpoint. The username/password come from processes/<slug>/metadata.json;
-     * an env-var placeholder (e.g. $WEBHOOK_PASSWORD) is resolved against the workspace
-     * variables. Returns true when the request may proceed, false after writing a 401.
+     * Enforces the webhook's configured auth, simulating the cloud webhook endpoint: the effective
+     * configuration names a variable, whose value is looked up in the workspace variables and compared
+     * against the configured header. A missing or malformed header, an undefined variable, a mismatch,
+     * or a webhook inheriting a workspace configuration that team.json does not have, is rejected.
+     * Returns true when the request may proceed, false after writing a 403.
      */
-    async _checkWebhookAuth(req, res, processRepository, slug) {
+    async _checkWebhookAuth(req, res, processRepository, teamRepository, slug) {
         let webhook;
         try {
             webhook = (await processRepository.find(slug)).webhook;
@@ -124,28 +134,34 @@ class Http extends core_1.Command {
             // Unknown process: let the execution path report the 404.
             return true;
         }
-        if (!webhook || (!webhook.username && !webhook.password)) {
-            return true;
+        // Read per request, like the process metadata above, so editing team.json while the server
+        // runs takes effect without a restart.
+        const teamWebhookAuth = (await teamRepository.find()).webhookAuth;
+        let effectiveAuth;
+        try {
+            effectiveAuth = (0, webhook_auth_1.resolveEffectiveAuth)(webhook, teamWebhookAuth);
         }
-        const variables = await new variable_1.default().findAllForExecution();
-        const values = new Map(variables.map((variable) => [variable.key, variable.value]));
-        const resolvePlaceholder = (value) => {
-            if (!value)
-                return '';
-            const match = value.match(/^\$\{?([A-Za-z_]\w*)\}?$/);
-            return match ? values.get(match[1]) ?? value : value;
-        };
-        const expected = Buffer.from(`${resolvePlaceholder(webhook.username)}:${resolvePlaceholder(webhook.password)}`).toString('base64');
-        const authHeader = req.headers['authorization'] ?? '';
-        const match = authHeader.match(/^Basic (.+)$/);
-        if (!match || match[1] !== expected) {
-            res.setHeader('WWW-Authenticate', 'Basic realm="Factorial Code Webhook"');
-            res.writeHead(401, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ success: false, error: 'Unauthorized' }));
+        catch (error) {
+            // Fails closed, and says why: otherwise this reads as a wrong token rather than a local
+            // configuration the developer still has to complete.
+            this.warn(`Rejecting the ${slug} webhook: ${error.message}`);
+            this._forbid(res);
+            return false;
+        }
+        const variables = effectiveAuth === null ? [] : await new variable_1.default().findAllForExecution();
+        const variableValue = variables.find((variable) => variable.key === effectiveAuth?.variableKey)?.value;
+        const result = (0, webhook_auth_1.checkWebhookAuth)(effectiveAuth, req.headers, variableValue);
+        if (!result.authorized) {
+            this.warn(`Rejecting the ${slug} webhook: ${result.reason}`);
+            this._forbid(res);
             return false;
         }
         return true;
     }
+    _forbid(res) {
+        res.writeHead(403, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ success: false, error: 'Forbidden' }));
+    }
     async _handleProcessExecution(req, res, slug, urlObj, logLevel, jsonLogs) {
         if (req.method !== 'GET' && req.method !== 'POST') {
             res.writeHead(405, { 'Content-Type': 'application/json' });

package/dist/commands/setup-debug.js

@@ -70,11 +70,11 @@ class SetupDebug extends core_1.Command {
                 });
             }
         }
-        if (process.env.YC_COMMAND) {
+        if (process.env.FC_COMMAND) {
             configurations.forEach((configuration) => {
                 configuration.env = {
                     ...configuration.env,
-                    YC_COMMAND: process.env.YC_COMMAND
+                    FC_COMMAND: process.env.FC_COMMAND
                 };
             });
         }

package/dist/commands/team/aliases/delete.d.ts

@@ -0,0 +1,9 @@
+import ApiClientCommand from '../../../core/commands/api-client-command';
+export default class TeamAliasesDeleteCommand extends ApiClientCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/team/aliases/delete.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const color_1 = require("@oclif/color");
+const api_client_command_1 = require("../../../core/commands/api-client-command");
+const pull_1 = require("../pull");
+const cli_1 = require("../../../utils/cli");
+class TeamAliasesDeleteCommand extends api_client_command_1.default {
+    async run() {
+        const { args: { name }, } = await this.parse(TeamAliasesDeleteCommand);
+        const aliases = await this._fcodeGraphQLClient.allTeamVersionAliases();
+        const alias = aliases.find((candidate) => candidate.name === name);
+        if (!alias) {
+            cli_1.default.error(`Alias ${name} does not exist`);
+            return;
+        }
+        cli_1.default.log(color_1.default.cyan(`\n🗑️  deleting alias ${name}...`));
+        await this._fcodeGraphQLClient.deleteTeamVersionAlias(alias.id);
+        cli_1.default.log(color_1.default.green(`✅ alias ${name} deleted`));
+        await pull_1.default.run([]);
+    }
+}
+TeamAliasesDeleteCommand.description = 'Delete a team version alias and the per-entity aliases carrying its name on every owned process and module';
+TeamAliasesDeleteCommand.examples = ['$ fcode team:aliases:delete production'];
+TeamAliasesDeleteCommand.args = {
+    name: core_1.Args.string({ description: 'alias name to delete', required: true }),
+};
+exports.default = TeamAliasesDeleteCommand;

package/dist/commands/team/aliases/list.d.ts

@@ -0,0 +1,6 @@
+import ApiClientCommand from '../../../core/commands/api-client-command';
+export default class TeamAliasesListCommand extends ApiClientCommand {
+    static description: string;
+    static examples: string[];
+    run(): Promise<void>;
+}

package/dist/commands/team/aliases/list.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const color_1 = require("@oclif/color");
+const api_client_command_1 = require("../../../core/commands/api-client-command");
+const cli_1 = require("../../../utils/cli");
+class TeamAliasesListCommand extends api_client_command_1.default {
+    async run() {
+        await this.parse(TeamAliasesListCommand);
+        const aliases = await this._fcodeGraphQLClient.allTeamVersionAliases();
+        if (aliases.length === 0) {
+            cli_1.default.log('📋 No team version aliases yet.');
+            cli_1.default.log(`Create one with ${color_1.default.cyan('fcode team:aliases:set [name] [tag]')}`);
+            return;
+        }
+        cli_1.default.log('🔗 Team version aliases:\n');
+        for (const alias of aliases) {
+            cli_1.default.log(`  ${color_1.default.cyan(alias.name)} → ${alias.tag}`);
+        }
+    }
+}
+TeamAliasesListCommand.description = 'List the team version aliases of the active team workspace';
+TeamAliasesListCommand.examples = ['$ fcode team:aliases:list'];
+exports.default = TeamAliasesListCommand;

package/dist/commands/team/aliases/set.d.ts

@@ -0,0 +1,10 @@
+import ApiClientCommand from '../../../core/commands/api-client-command';
+export default class TeamAliasesSetCommand extends ApiClientCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        tag: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/team/aliases/set.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const color_1 = require("@oclif/color");
+const api_client_command_1 = require("../../../core/commands/api-client-command");
+const pull_1 = require("../pull");
+const cli_1 = require("../../../utils/cli");
+class TeamAliasesSetCommand extends api_client_command_1.default {
+    async run() {
+        const { args: { name, tag }, } = await this.parse(TeamAliasesSetCommand);
+        cli_1.default.log(color_1.default.cyan(`\n🔗 pointing alias ${name} at ${tag}...`));
+        await this._fcodeGraphQLClient.createTeamVersionAlias(name, tag);
+        cli_1.default.log(color_1.default.green(`✅ alias ${name} → ${tag}`));
+        // Aliases have no folder representation; refreshing team.json is enough.
+        await pull_1.default.run([]);
+    }
+}
+TeamAliasesSetCommand.description = 'Create or re-point a team version alias, upserting the per-entity alias on every owned ' +
+    'process and module that has the target tag published';
+TeamAliasesSetCommand.examples = ['$ fcode team:aliases:set production v1.0.0'];
+TeamAliasesSetCommand.args = {
+    name: core_1.Args.string({ description: 'alias name (e.g. production)', required: true }),
+    tag: core_1.Args.string({ description: 'team version tag the alias points at', required: true }),
+};
+exports.default = TeamAliasesSetCommand;

package/dist/commands/team/pull.js

@@ -12,9 +12,16 @@ class TeamPullCommand extends api_client_command_1.default {
     async run() {
         await this.parse(TeamPullCommand);
         cli_1.default.log(color_1.default.cyan('\n🗄️  pulling team settings...'));
-        const raw = await this._fcodeGraphQLClient.team();
+        const [raw, versions, aliases] = await Promise.all([
+            this._fcodeGraphQLClient.team(),
+            this._fcodeGraphQLClient.allTeamVersions(),
+            this._fcodeGraphQLClient.allTeamVersionAliases(),
+        ]);
         const team = await this._teamRepository.fromRaw(raw);
+        this._teamRepository.applyCloudVersioning(team, versions, aliases);
         this._teamRepository.save(team);
+        // The stored hash intentionally excludes versions/aliases (see Team.contentHash), so
+        // pull-only fields never surface as a phantom MODIFIED state.
         await this.workspaceConfig.setTeamStoredHash(team.contentHash);
     }
 }

package/dist/commands/team/push.js

@@ -22,6 +22,9 @@ class TeamPushCommand extends api_client_command_1.default {
             cli_1.default.log('Team settings already up to date');
             return;
         }
+        // team.json's `versions`/`aliases` fields are pull-only and intentionally left out of the
+        // update payload: team versions and aliases are only written through the explicit
+        // team:versions/team:aliases commands.
         const update = { parentTeamSlugs: team.parentTeamSlugs };
         if (team.zoneId !== undefined) {
             update.zoneId = team.zoneId;
@@ -30,12 +33,17 @@ class TeamPushCommand extends api_client_command_1.default {
             const processId = await this._teamRepository.resolveSlugToId(team.errorHandlerConfig.processSlug);
             update.executionErrorHandlerConfig = { processId, tag: team.errorHandlerConfig.tag ?? null };
         }
+        // Sent unconditionally, null arm included: team.json is the source of truth, so removing
+        // webhookAuth from it must clear the cloud configuration rather than leave it dangling.
+        update.webhookAuth = team.webhookAuth
+            ? { headerName: team.webhookAuth.headerName ?? null, variableKey: team.webhookAuth.variableKey }
+            : { variableKey: null };
         await this._fcodeGraphQLClient.pushTeam(update);
         await this.workspaceConfig.setTeamStoredHash(team.contentHash);
         cli_1.default.log(color_1.default.green('✅ team settings pushed'));
     }
 }
-TeamPushCommand.description = 'Update cloud team settings (timezone, error handler, inheritance) from team.json';
+TeamPushCommand.description = 'Update cloud team settings (timezone, error handler, inheritance, webhook auth) from team.json';
 TeamPushCommand.examples = ['$ fcode team:push'];
 TeamPushCommand.flags = types_1.ForceFlag;
 exports.default = TeamPushCommand;

package/dist/commands/team/versions/create.d.ts

@@ -0,0 +1,13 @@
+import ApiClientCommand from '../../../core/commands/api-client-command';
+export default class TeamVersionsCreateCommand extends ApiClientCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        tag: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        comment: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+    private logManifest;
+}

package/dist/commands/team/versions/create.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const color_1 = require("@oclif/color");
+const api_client_command_1 = require("../../../core/commands/api-client-command");
+const pull_1 = require("../../pull");
+const cli_1 = require("../../../utils/cli");
+class TeamVersionsCreateCommand extends api_client_command_1.default {
+    async run() {
+        const { args: { tag }, flags: { comment }, } = await this.parse(TeamVersionsCreateCommand);
+        cli_1.default.log(color_1.default.cyan(`\n🏷️  publishing team version ${tag}...`));
+        const teamVersion = await this._fcodeGraphQLClient.createTeamVersion(tag, comment);
+        const failedCount = this.logManifest(teamVersion);
+        // Refresh the local workspace: per-entity versions/<tag>/ folders and team.json.
+        await pull_1.default.run([]);
+        // Release pipelines must be able to detect an incomplete version. Re-running the
+        // command converges: it publishes only what is still missing.
+        if (failedCount > 0) {
+            this.error(`team version ${tag} published with ${failedCount} failed entities`, { exit: 1 });
+        }
+    }
+    logManifest(teamVersion) {
+        const created = teamVersion.manifest.filter(({ outcome }) => outcome === 'CREATED');
+        const skipped = teamVersion.manifest.filter(({ outcome }) => outcome === 'SKIPPED_EXISTS');
+        const failed = teamVersion.manifest.filter(({ outcome }) => outcome === 'FAILED');
+        cli_1.default.log(color_1.default.green(`✅ ${created.length} created`) + `, ${skipped.length} skipped (tag already exists)` + (failed.length > 0 ? `, ${color_1.default.red(`${failed.length} failed`)}` : ''));
+        for (const entry of failed) {
+            cli_1.default.error(`${entry.resourceType.toLowerCase()} ${entry.slug} — ${entry.error ?? 'unknown error'}`);
+        }
+        return failed.length;
+    }
+}
+TeamVersionsCreateCommand.description = 'Publish a team version: creates a version with the tag on every owned process and module ' +
+    '(existing tags are skipped) and pins bare module imports in the published snapshots';
+TeamVersionsCreateCommand.examples = ['$ fcode team:versions:create v1.0.0', '$ fcode team:versions:create v1.0.0 --comment "First stable release"'];
+TeamVersionsCreateCommand.args = {
+    tag: core_1.Args.string({ description: 'version tag to publish (e.g. v1.0.0)', required: true }),
+};
+TeamVersionsCreateCommand.flags = {
+    comment: core_1.Flags.string({ char: 'c', description: 'comment describing the version' }),
+};
+exports.default = TeamVersionsCreateCommand;

package/dist/commands/team/versions/delete.d.ts

@@ -0,0 +1,12 @@
+import ApiClientCommand from '../../../core/commands/api-client-command';
+export default class TeamVersionsDeleteCommand extends ApiClientCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        tag: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        force: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/team/versions/delete.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const color_1 = require("@oclif/color");
+const api_client_command_1 = require("../../../core/commands/api-client-command");
+const pull_1 = require("../../pull");
+const types_1 = require("../../../core/types");
+const cli_1 = require("../../../utils/cli");
+class TeamVersionsDeleteCommand extends api_client_command_1.default {
+    async run() {
+        const { args: { tag }, flags: { force }, } = await this.parse(TeamVersionsDeleteCommand);
+        if (!force) {
+            const confirmed = await cli_1.default.confirm(`Deleting team version ${tag} also deletes every process/module version with that tag, plus the aliases, executions and schedules referencing them. Continue?`);
+            if (!confirmed) {
+                return;
+            }
+        }
+        cli_1.default.log(color_1.default.cyan(`\n🗑️  deleting team version ${tag}...`));
+        await this._fcodeGraphQLClient.deleteTeamVersion(tag);
+        cli_1.default.log(color_1.default.green(`✅ team version ${tag} deleted`));
+        // Refresh the local workspace so removed versions/<tag>/ folders disappear.
+        await pull_1.default.run([]);
+    }
+}
+TeamVersionsDeleteCommand.description = 'Delete a team version. CASCADES: every owned process/module version with the tag is deleted, ' +
+    'together with the aliases, executions and schedules that reference them';
+TeamVersionsDeleteCommand.examples = ['$ fcode team:versions:delete v1.0.0'];
+TeamVersionsDeleteCommand.args = {
+    tag: core_1.Args.string({ description: 'version tag to delete', required: true }),
+};
+TeamVersionsDeleteCommand.flags = types_1.ForceFlag;
+exports.default = TeamVersionsDeleteCommand;

package/dist/commands/team/versions/list.d.ts

@@ -0,0 +1,6 @@
+import ApiClientCommand from '../../../core/commands/api-client-command';
+export default class TeamVersionsListCommand extends ApiClientCommand {
+    static description: string;
+    static examples: string[];
+    run(): Promise<void>;
+}

package/dist/commands/team/versions/list.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const color_1 = require("@oclif/color");
+const api_client_command_1 = require("../../../core/commands/api-client-command");
+const cli_1 = require("../../../utils/cli");
+class TeamVersionsListCommand extends api_client_command_1.default {
+    async run() {
+        await this.parse(TeamVersionsListCommand);
+        const versions = await this._fcodeGraphQLClient.allTeamVersions();
+        if (versions.length === 0) {
+            cli_1.default.log('📋 No team versions published yet.');
+            cli_1.default.log(`Publish one with ${color_1.default.cyan('fcode team:versions:create [tag]')}`);
+            return;
+        }
+        cli_1.default.log('🏷️  Team versions:\n');
+        for (const version of versions) {
+            const comment = version.comment ? ` — ${version.comment}` : '';
+            const author = version.createdBy?.name ? ` by ${version.createdBy.name}` : '';
+            cli_1.default.log(`  ${color_1.default.cyan(version.tag)}${comment} (${version.createdAt}${author})`);
+        }
+    }
+}
+TeamVersionsListCommand.description = 'List the team versions published on the active team workspace';
+TeamVersionsListCommand.examples = ['$ fcode team:versions:list'];
+exports.default = TeamVersionsListCommand;

package/dist/commands/variables/status.js

@@ -11,6 +11,7 @@ class VariablesStatus extends variables_command_1.default {
     async resourcesTableLog(resources) {
         const globalConfig = new global_1.default();
         const localVariablesFileName = await globalConfig.getSetting(settings_1.SettingKeys.LOCAL_VARIABLES_FILE_NAME);
+        const hasInherited = resources.some((resource) => resource.resolvingTeamSlug);
         cli_1.cli.table(resources, {
             key: {
                 get({ key, status }) {
@@ -18,6 +19,16 @@ class VariablesStatus extends variables_command_1.default {
                 },
                 header: 'key',
             },
+            ...(hasInherited
+                ? {
+                    inherited: {
+                        get(resource) {
+                            return (0, colorize_resource_1.colorizeByStatus)(resource.resolvingTeamSlug ? `🔗 ${resource.resolvingTeamSlug}` : '', resource.status);
+                        },
+                        header: 'inherited',
+                    },
+                }
+                : {}),
             status: {
                 get({ status }) {
                     return (0, colorize_resource_1.colorizeByStatus)(status, status);

package/dist/config/settings.d.ts

@@ -8,6 +8,7 @@ export declare enum SettingKeys {
     IGNORE_PROCESS_VERSIONS = "ignoreProcessVersions",
     IGNORE_WORKSPACE_NOT_EMPTY = "ignoreWorkspaceNotEmpty",
     IGNORE_FCODE_RUN_PROCESSES = "ignoreFcodeRunProcesses",
+    INHERITED_VARIABLES_FILE_NAME = "inheritedVariablesFileName",
     LOCAL_VARIABLES_FILE_NAME = "localVariablesFileName",
     SKIP_SKILLS_SETUP = "skipSkillsSetup",
     VARIABLES_FILE_NAME = "variablesFileName"