@factorialco/fcode-cli 2.1.0 → 2.3.0

package/dist/services/auth-service.d.ts

@@ -8,6 +8,7 @@ declare const AuthService: {
     isAuthenticated(url: string): Promise<boolean>;
     isTokenExpiring(token: Token): boolean;
     refreshToken(authUrl: string, refreshToken: string): Promise<Token>;
+    refreshSession(url: string): Promise<boolean>;
     tryRefresh(url: string, { authUrl, token, userInfo }: AuthInfo): Promise<boolean>;
     login({ url, authUrl, email, password, clientId, clientSecret, accessToken }: Credentials): Promise<AuthInfo>;
     logout(url: string): Promise<void>;

package/dist/services/auth-service.js

@@ -117,6 +117,18 @@ const AuthService = {
         }
         throw token.error_description;
     },
+    // Force a re-mint of the access token regardless of expiry. Team groups are
+    // snapshotted into the token at issuance, so a token created before a team
+    // existed (or before the user joined it) 403s on it until re-minted (FCT-61231).
+    async refreshSession(url) {
+        try {
+            const authInfo = await this.globalConfig.getAuthInfo(url);
+            return await this.tryRefresh(url, authInfo);
+        }
+        catch {
+            return false;
+        }
+    },
     async tryRefresh(url, { authUrl, token, userInfo }) {
         if (!token.refresh_token) {
             return false;

package/dist/services/fcode-graphql-client.d.ts

@@ -1,5 +1,5 @@
 import { GraphQLClient } from 'graphql-request';
-import { Process, ProgrammingLanguage, ProgrammingLanguageManifest, RawTeamSettings, ScriptLibrary, TeamUpdateInput, TeamVersion, TeamVersionAlias, Variable, VersionedProcess, VersionedScriptLibrary, ServiceAccount } from '../core/types';
+import { Locale, Process, ProgrammingLanguage, ProgrammingLanguageManifest, RawTeamSettings, ScriptLibrary, TeamUpdateInput, TeamVersion, TeamVersionAlias, Variable, VersionedProcess, VersionedScriptLibrary, ServiceAccount } from '../core/types';
 export type FcodeGraphQLClientOptions = {
     url: string;
     accessToken: string;
@@ -10,6 +10,7 @@ declare class FcodeGraphQLClient {
     private teamSlug;
     private url;
     constructor(options: FcodeGraphQLClientOptions);
+    setAccessToken(accessToken: string): void;
     isDuplicatedError(error: any): boolean;
     isEmptyValueError(error: any): boolean;
     cleanError(error: any): any;
@@ -22,6 +23,16 @@ declare class FcodeGraphQLClient {
     allVersionedScriptLibraries(scriptLibraryId: string): Promise<Array<VersionedScriptLibrary>>;
     createVersionedScriptLibrary(versionedScriptLibrary: VersionedScriptLibrary): Promise<void>;
     allVariables(): Promise<Array<Variable>>;
+    /**
+     * Every locale the workspace resolves: its own files, plus one merged file per identifier it
+     * inherits. A locale the workspace and a parent both define is listed twice by the platform and
+     * kept twice here — an override is layered over the parent's file key by key, so the parent's
+     * keys are still what the ones it does not mention resolve to.
+     */
+    allLocales(): Promise<Array<Locale>>;
+    pushLocale(locale: Locale): Promise<Locale>;
+    updateLocale(locale: Locale): Promise<Locale>;
+    removeLocale(locale: string | undefined): Promise<void>;
     private toProcessInput;
     pushProcess(process: Process): Promise<Process>;
     removeProcess(id: String | undefined): Promise<Process>;
@@ -53,6 +64,7 @@ declare class FcodeGraphQLClient {
     /** The API upserts: an existing alias with the same name is re-pointed to the tag. */
     createTeamVersionAlias(name: string, tag: string): Promise<TeamVersionAlias>;
     deleteTeamVersionAlias(id: string): Promise<TeamVersionAlias>;
+    verifyTeamAccess(): Promise<void>;
     team(): Promise<RawTeamSettings>;
     pushTeam(update: TeamUpdateInput): Promise<RawTeamSettings>;
     mapProgrammingLanguageManifest(programmingLanguageManifest: any): ProgrammingLanguageManifest;

package/dist/services/fcode-graphql-client.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const graphql_request_1 = require("graphql-request");
 const types_1 = require("../core/types");
+const locale_merger_1 = require("./locale-merger");
 const _ = require("lodash");
 // Shared team version selections so every query/mutation returns the same shape.
 const TEAM_VERSION_FIELDS = `
@@ -89,6 +90,11 @@ class FcodeGraphQLClient {
             },
         });
     }
+    // Swap the bearer token on the live client (after a session refresh) so every
+    // holder of this instance — repositories, pushers, queries — uses the new one.
+    setAccessToken(accessToken) {
+        this.client.setHeader('authorization', `Bearer ${accessToken}`);
+    }
     isDuplicatedError(error) {
         return (error &&
             error.response &&
@@ -302,6 +308,114 @@ class FcodeGraphQLClient {
         }
         return variables;
     }
+    /**
+     * Every locale the workspace resolves: its own files, plus one merged file per identifier it
+     * inherits. A locale the workspace and a parent both define is listed twice by the platform and
+     * kept twice here — an override is layered over the parent's file key by key, so the parent's
+     * keys are still what the ones it does not mention resolve to.
+     */
+    async allLocales() {
+        const pageSize = 200;
+        const locales = [];
+        let after = null;
+        try {
+            do {
+                const { locales: { edges, pageInfo }, } = await this.client.request((0, graphql_request_1.gql) `
+            query locales($first: Int!, $after: String) {
+              locales(first: $first, after: $after) {
+                edges {
+                  node {
+                    id
+                    locale
+                    content
+                    resolvingTeamSlug
+                  }
+                }
+                pageInfo {
+                  hasNextPage
+                  endCursor
+                }
+              }
+            }
+          `, {
+                    after,
+                    first: pageSize,
+                });
+                for (const { node: { id, locale, content, resolvingTeamSlug }, } of edges) {
+                    locales.push(new types_1.Locale(id, locale, content, this.inheritedTeam(resolvingTeamSlug)));
+                }
+                after = pageInfo?.hasNextPage ? pageInfo.endCursor : null;
+            } while (after);
+        }
+        catch (error) {
+            return Promise.reject(this.cleanError(error));
+        }
+        // The cloud team's parent order is the inheritance precedence the merge must replicate; the
+        // local team.json may lag behind it, so the cloud is asked, not the file.
+        const { parentTeamSlugs } = await this.team();
+        const merged = (0, locale_merger_1.mergeInheritedLocales)(locales, parentTeamSlugs ?? []);
+        (0, locale_merger_1.assertLocaleFilesCanCoexist)(merged);
+        return merged;
+    }
+    pushLocale(locale) {
+        return this.client
+            .request((0, graphql_request_1.gql) `
+          mutation createLocale($locale: String!, $content: String!) {
+            createLocale(locale: $locale, content: $content) {
+              id
+              locale
+              content
+            }
+          }
+        `, {
+            locale: locale.locale,
+            content: locale.content,
+        })
+            .then(({ createLocale: created }) => new types_1.Locale(created.id, created.locale, created.content))
+            .catch((error) => {
+            return Promise.reject(this.cleanError(error));
+        });
+    }
+    updateLocale(locale) {
+        return this.client
+            .request((0, graphql_request_1.gql) `
+          mutation updateLocale($locale: String!, $content: String!) {
+            updateLocale(locale: $locale, content: $content) {
+              id
+              locale
+              content
+            }
+          }
+        `, {
+            locale: locale.locale,
+            content: locale.content,
+        })
+            .then(({ updateLocale: updated }) => new types_1.Locale(updated.id, updated.locale, updated.content))
+            .catch((error) => {
+            return Promise.reject(this.cleanError(error));
+        });
+    }
+    // Addressed by identifier rather than id: a locale is its file, and the delete path is reached
+    // from a file that is gone, whose recorded id may predate an override.
+    removeLocale(locale) {
+        if (!locale) {
+            return Promise.reject(new Error('locale is required during remove'));
+        }
+        return this.client
+            .request((0, graphql_request_1.gql) `
+          mutation deleteLocale($locale: String!) {
+            deleteLocale(locale: $locale) {
+              id
+            }
+          }
+        `, {
+            locale,
+        })
+            .then(() => undefined)
+            .catch((error) => {
+            return Promise.reject(this.cleanError(error));
+        });
+    }
     toProcessInput(process, includeCreateOnly) {
         const settings = {
             dependencies: { scopedToProcess: process.settings.dependencies.scopedToProcess },
@@ -639,6 +753,9 @@ class FcodeGraphQLClient {
                 settings.webhookAuth.headerName = webhookAuth.headerName;
             }
         }
+        if (team.settings?.primaryLocale) {
+            settings.primaryLocale = team.settings.primaryLocale;
+        }
         return settings;
     }
     mapTeamVersion(teamVersion) {
@@ -751,6 +868,23 @@ class FcodeGraphQLClient {
             return Promise.reject(this.cleanError(error));
         });
     }
+    // Cheapest team-scoped query, used as a pre-flight access check so commands can
+    // fail once with a clear error before touching local state, instead of erroring
+    // on every resource pull.
+    verifyTeamAccess() {
+        return this.client
+            .request((0, graphql_request_1.gql) `
+          query team($slug: ID!) {
+            team(slug: $slug) {
+              slug
+            }
+          }
+        `, { slug: this.teamSlug })
+            .then(() => undefined)
+            .catch((error) => {
+            return Promise.reject(this.cleanError(error));
+        });
+    }
     team() {
         return this.client
             .request((0, graphql_request_1.gql) `
@@ -768,6 +902,7 @@ class FcodeGraphQLClient {
                   headerName
                   variableKey
                 }
+                primaryLocale
               }
             }
           }
@@ -794,6 +929,7 @@ class FcodeGraphQLClient {
                   headerName
                   variableKey
                 }
+                primaryLocale
               }
             }
           }

package/dist/services/locale-merger.d.ts

@@ -0,0 +1,23 @@
+import { Locale } from '../core/types';
+/**
+ * Collapses the locale files a workspace inherits into one file per identifier.
+ *
+ * The cloud lists a locale once per workspace that defines it, and every one of them is live: an
+ * override is layered over its parent key by key, so a locale several workspaces define is several
+ * files. A workspace directory keeps one inherited file per identifier instead — one file cannot
+ * hold two names — so the parents' files are merged here, in the order the cloud resolves them.
+ *
+ * A single parent's file is kept verbatim, comments and nesting included. Only a locale that
+ * several parents define is rewritten, as a flat mapping of dotted keys, which is the shape the
+ * lookup uses anyway and the one shape where a nested and a dotted key cannot disagree.
+ */
+export declare function mergeInheritedLocales(locales: Array<Locale>, parentTeamSlugs: Array<string>): Array<Locale>;
+/**
+ * Locale identifiers are case-sensitive on the platform (pt-BR and pt-br are different locales),
+ * but the filesystems macOS and Windows usually run on are not — both identifiers would collapse
+ * into one file, so a pull would write one locale over the other, `status` would report a phantom
+ * change forever, and the next push would silently overwrite one locale's cloud content with the
+ * other's. Refused outright before anything is written; on a case-sensitive filesystem the files
+ * live side by side and nothing is refused.
+ */
+export declare function assertLocaleFilesCanCoexist(locales: Array<Locale>, filesystemKeepsCase?: boolean): void;

package/dist/services/locale-merger.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mergeInheritedLocales = mergeInheritedLocales;
+exports.assertLocaleFilesCanCoexist = assertLocaleFilesCanCoexist;
+const fs = require("fs-extra");
+const os = require("node:os");
+const path = require("node:path");
+const yaml_1 = require("yaml");
+const color_1 = require("@oclif/color");
+const cli_1 = require("../utils/cli");
+const types_1 = require("../core/types");
+const locale_resolver_1 = require("./locale-resolver");
+/**
+ * Collapses the locale files a workspace inherits into one file per identifier.
+ *
+ * The cloud lists a locale once per workspace that defines it, and every one of them is live: an
+ * override is layered over its parent key by key, so a locale several workspaces define is several
+ * files. A workspace directory keeps one inherited file per identifier instead — one file cannot
+ * hold two names — so the parents' files are merged here, in the order the cloud resolves them.
+ *
+ * A single parent's file is kept verbatim, comments and nesting included. Only a locale that
+ * several parents define is rewritten, as a flat mapping of dotted keys, which is the shape the
+ * lookup uses anyway and the one shape where a nested and a dotted key cannot disagree.
+ */
+function mergeInheritedLocales(locales, parentTeamSlugs) {
+    const inheritedByIdentifier = new Map();
+    for (const locale of locales.filter((locale) => locale.resolvingTeamSlug)) {
+        inheritedByIdentifier.set(locale.locale, [...(inheritedByIdentifier.get(locale.locale) ?? []), locale]);
+    }
+    return [
+        ...locales.filter((locale) => !locale.resolvingTeamSlug),
+        ...[...inheritedByIdentifier.values()].map((files) => files.length === 1 ? files[0] : mergeLocaleFiles(files, parentTeamSlugs)),
+    ];
+}
+/**
+ * The platform walks parents in the team's configured order — `Team.parentTeamIdsInResolutionOrder`
+ * — and the first defining a key wins. Deriving that order here from the cloud team's
+ * `parentTeamSlugs`, rather than trusting the order the API happened to list the rows in (which
+ * follows the listing's `orderBy`, `updatedAt` by default), is what keeps a local run and the
+ * cloud resolving the same text.
+ */
+function inResolutionOrder(files, parentTeamSlugs) {
+    const precedence = (file) => {
+        const index = parentTeamSlugs.indexOf(file.resolvingTeamSlug ?? '');
+        return index === -1 ? parentTeamSlugs.length : index;
+    };
+    return [...files].sort((a, b) => precedence(a) - precedence(b));
+}
+/**
+ * @param files the same locale as every parent workspace defines it, in any order
+ * @param parentTeamSlugs the workspace's parents in inheritance-precedence order
+ * @returns one locale carrying their merged translations, attributed to the winning parent
+ */
+function mergeLocaleFiles(files, parentTeamSlugs) {
+    const ordered = inResolutionOrder(files, parentTeamSlugs);
+    const [winner] = ordered;
+    const translations = {};
+    // Lowest precedence first, so the first parent in resolution order is the text that survives —
+    // the same layering the platform applies.
+    for (const file of [...ordered].reverse()) {
+        Object.assign(translations, translationsOf(file));
+    }
+    return new types_1.Locale(winner.id, winner.locale, `${mergeHeader(ordered)}${(0, yaml_1.stringify)(translations)}`, winner.resolvingTeamSlug);
+}
+function translationsOf(file) {
+    try {
+        return (0, locale_resolver_1.flattenTranslations)((0, yaml_1.parse)(file.content));
+    }
+    catch (error) {
+        // Skipped rather than fatal: a workspace cannot fix a parent's file, and the cloud ignores an
+        // unparseable one too.
+        cli_1.default.log(color_1.default.yellow(`\n⚠️  locale '${file.locale}' from workspace '${file.resolvingTeamSlug}' could not be parsed and will be ignored: ${error.message}`));
+        return {};
+    }
+}
+/**
+ * Locale identifiers are case-sensitive on the platform (pt-BR and pt-br are different locales),
+ * but the filesystems macOS and Windows usually run on are not — both identifiers would collapse
+ * into one file, so a pull would write one locale over the other, `status` would report a phantom
+ * change forever, and the next push would silently overwrite one locale's cloud content with the
+ * other's. Refused outright before anything is written; on a case-sensitive filesystem the files
+ * live side by side and nothing is refused.
+ */
+function assertLocaleFilesCanCoexist(locales, filesystemKeepsCase = filesystemKeepsCaseApart()) {
+    const slugsByFoldedSlug = new Map();
+    for (const locale of locales) {
+        const slug = locale.slug ?? locale.locale;
+        const folded = slug.toLowerCase();
+        slugsByFoldedSlug.set(folded, [...(slugsByFoldedSlug.get(folded) ?? []), slug]);
+    }
+    const collisions = [...slugsByFoldedSlug.values()].filter((slugs) => slugs.length > 1);
+    if (collisions.length === 0 || filesystemKeepsCase) {
+        return;
+    }
+    const described = collisions.map((slugs) => `'${slugs.join("' / '")}'`).join(', ');
+    throw new Error(`locales differing only in case cannot both be stored on this filesystem: ${described}. ` +
+        'Rename or remove one of them in the cloud and pull again.');
+}
+function filesystemKeepsCaseApart() {
+    const probe = fs.mkdtempSync(path.join(os.tmpdir(), 'fcode-case-'));
+    try {
+        fs.outputFileSync(path.join(probe, 'a'), '');
+        return !fs.existsSync(path.join(probe, 'A'));
+    }
+    finally {
+        fs.removeSync(probe);
+    }
+}
+function mergeHeader(files) {
+    const workspaces = files.map((file) => file.resolvingTeamSlug).join(', ');
+    return (`# Generated by fcode: the '${files[0].locale}' translations inherited from ${workspaces},\n` +
+        `# merged in the platform's resolution order (the first wins where they disagree).\n` +
+        `# Edit i18n/${files[0].locale}.yaml to override any of these keys.\n`);
+}

package/dist/services/locale-resolver.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Builds the translations a local run resolves `fcode.i18n` against, so `fcode run` behaves like
+ * the cloud does.
+ *
+ * The cloud does this work in the engine: it merges the workspace's locale over its parents', then
+ * layers the chosen locale over the primary one and ships a single flat map. Locally there is no
+ * engine, so the same layering happens here over the files in `i18n/` — including the inherited
+ * ones, which `pull` writes into the same directory as `<locale>.inherited.yaml`.
+ */
+export declare function flattenTranslations(document: unknown, prefix?: string, target?: Record<string, string>): Record<string, string>;
+/**
+ * @param requestedLocale the locale to run with, or undefined to use the workspace's primary
+ * @returns the locale actually used and its flat translations, with the primary locale underneath
+ */
+export declare function resolveLocalTranslations(requestedLocale?: string, workspaceDir?: string): {
+    locale?: string;
+    translations: Record<string, string>;
+};

package/dist/services/locale-resolver.js

@@ -0,0 +1,120 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.flattenTranslations = flattenTranslations;
+exports.resolveLocalTranslations = resolveLocalTranslations;
+const fs = require("fs-extra");
+const path = require("node:path");
+const yaml_1 = require("yaml");
+const cli_1 = require("../utils/cli");
+const color_1 = require("@oclif/color");
+const types_1 = require("../core/types");
+const I18N_DIRECTORY = 'i18n';
+const YAML_EXTENSION = '.yaml';
+const KEY_SEPARATOR = '.';
+/**
+ * Builds the translations a local run resolves `fcode.i18n` against, so `fcode run` behaves like
+ * the cloud does.
+ *
+ * The cloud does this work in the engine: it merges the workspace's locale over its parents', then
+ * layers the chosen locale over the primary one and ships a single flat map. Locally there is no
+ * engine, so the same layering happens here over the files in `i18n/` — including the inherited
+ * ones, which `pull` writes into the same directory as `<locale>.inherited.yaml`.
+ */
+function flattenTranslations(document, prefix = '', target = {}) {
+    if (document === null || document === undefined || typeof document !== 'object' || Array.isArray(document)) {
+        return target;
+    }
+    for (const [key, value] of Object.entries(document)) {
+        const keyPath = prefix ? `${prefix}${KEY_SEPARATOR}${key}` : key;
+        if (value === null || value === undefined) {
+            // A key written without a value is a placeholder: it counts as not translated, so lookups
+            // fall through to the fallback locale instead of resolving to an empty string.
+            continue;
+        }
+        if (typeof value === 'object' && !Array.isArray(value)) {
+            flattenTranslations(value, keyPath, target);
+        }
+        else if (!Array.isArray(value)) {
+            target[keyPath] = String(value);
+        }
+    }
+    return target;
+}
+function readLocaleFile(workspaceDir, slug) {
+    const filePath = path.join(workspaceDir, I18N_DIRECTORY, `${slug}${YAML_EXTENSION}`);
+    if (!fs.pathExistsSync(filePath)) {
+        return {};
+    }
+    try {
+        return flattenTranslations((0, yaml_1.parse)(fs.readFileSync(filePath).toString()));
+    }
+    catch (error) {
+        // A broken translation file must never stop a run, exactly as in the cloud.
+        cli_1.default.log(color_1.default.yellow(`\n⚠️  locale '${slug}' could not be parsed and will be ignored: ${error.message}`));
+        return {};
+    }
+}
+/** The identifier a locale file contributes keys to, whether the workspace owns the file or not. */
+function identifierOf(slug) {
+    return slug.endsWith(types_1.Locale.INHERITED_SUFFIX) ? slug.slice(0, -types_1.Locale.INHERITED_SUFFIX.length) : slug;
+}
+/**
+ * One locale as this workspace resolves it: what it inherits, with its own file layered on top key
+ * by key, so a key it does not translate itself still resolves to the parent's text. `pull` has
+ * already merged the parents' files into the inherited one.
+ */
+function readLocale(workspaceDir, locale) {
+    return {
+        ...readLocaleFile(workspaceDir, `${locale}${types_1.Locale.INHERITED_SUFFIX}`),
+        ...readLocaleFile(workspaceDir, locale),
+    };
+}
+function chosenPrimaryLocaleOf(workspaceDir) {
+    try {
+        const team = fs.readJsonSync(path.join(workspaceDir, 'team.json'));
+        return typeof team?.primaryLocale === 'string' && team.primaryLocale.length > 0 ? team.primaryLocale : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Every locale file in the workspace, own and inherited: `pull` writes them all to `i18n/`. */
+function localeFileSlugs(workspaceDir) {
+    const directory = path.join(workspaceDir, I18N_DIRECTORY);
+    if (!fs.pathExistsSync(directory)) {
+        return [];
+    }
+    return fs
+        .readdirSync(directory)
+        .filter((fileName) => fileName.endsWith(YAML_EXTENSION))
+        .map((fileName) => path.basename(fileName, YAML_EXTENSION))
+        .sort();
+}
+/** Every locale the workspace resolves, counting a locale defined in several workspaces once. */
+function availableLocales(workspaceDir) {
+    return [...new Set(localeFileSlugs(workspaceDir).map((slug) => identifierOf(slug)))].sort();
+}
+/**
+ * The workspace's primary locale: the one chosen in `team.json`, or its first locale when none is
+ * chosen — or when the chosen one has no file anymore, which would otherwise resolve zero keys.
+ * Mirrors the platform's `PrimaryLocale.resolve`, so a local run and the cloud agree on which
+ * locale a process without an explicit one resolves against.
+ */
+function primaryLocaleOf(workspaceDir) {
+    const available = availableLocales(workspaceDir);
+    const chosen = chosenPrimaryLocaleOf(workspaceDir);
+    return chosen && available.includes(chosen) ? chosen : available[0];
+}
+/**
+ * @param requestedLocale the locale to run with, or undefined to use the workspace's primary
+ * @returns the locale actually used and its flat translations, with the primary locale underneath
+ */
+function resolveLocalTranslations(requestedLocale, workspaceDir = process.cwd()) {
+    const primary = primaryLocaleOf(workspaceDir);
+    const locale = requestedLocale || primary;
+    if (!locale) {
+        return { locale: undefined, translations: {} };
+    }
+    const fallback = primary && primary !== locale ? readLocale(workspaceDir, primary) : {};
+    return { locale, translations: { ...fallback, ...readLocale(workspaceDir, locale) } };
+}

package/dist/services/process-runner.d.ts

@@ -10,6 +10,7 @@ export type RunProcessOptions = {
     variablesOverride?: Variable[];
     extraVariablesFile?: string;
     suppressElapsedLog?: boolean;
+    locale?: string;
 };
 export type RunHookOptions = {
     logLevel?: string;

package/dist/services/process-runner.js

@@ -34,7 +34,7 @@ function mergeVariables(base, ...overrides) {
     return [...map.values()];
 }
 async function runProcess(options) {
-    const { slug, version, logLevel = 'DEBUG', request, jsonLogs = false, suppressElapsedLog = false } = options;
+    const { slug, version, logLevel = 'DEBUG', request, jsonLogs = false, suppressElapsedLog = false, locale } = options;
     const processRepository = new process_1.default();
     const variableRepository = new variable_1.default();
     const fcodeProcess = await processRepository.find(slug, version);
@@ -50,7 +50,7 @@ async function runProcess(options) {
         }
     }
     const ExecutionTask = fcodeProcess.script.programmingLanguage === 'PYTHON' ? python_execution_task_1.default : javascript_execution_task_1.default;
-    const executor = new ExecutionTask(fcodeProcess.script.programmingLanguage, fcodeProcess, { version, parameters, variables, logLevel, request, jsonLogs });
+    const executor = new ExecutionTask(fcodeProcess.script.programmingLanguage, fcodeProcess, { version, parameters, variables, logLevel, request, jsonLogs, locale });
     const start = Date.now();
     try {
         await executor.prepare();

package/dist/services/team-access.d.ts

@@ -0,0 +1,13 @@
+import FcodeGraphQLClient from './fcode-graphql-client';
+import GlobalConfig from '../config/global';
+declare const TeamAccessService: {
+    globalConfig: GlobalConfig;
+    clientFactory: (options: {
+        url: string;
+        accessToken: string;
+        teamSlug: string;
+    }) => FcodeGraphQLClient;
+    ensureTeamAccess(url: string, slug: string): Promise<void>;
+    checkAccess(url: string, slug: string): Promise<void>;
+};
+export default TeamAccessService;

package/dist/services/team-access.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const auth_service_1 = require("./auth-service");
+const fcode_graphql_client_1 = require("./fcode-graphql-client");
+const global_1 = require("../config/global");
+const errors_1 = require("../core/errors");
+function is403(error) {
+    return error?.response?.status === 403;
+}
+const TeamAccessService = {
+    globalConfig: new global_1.default(),
+    clientFactory: (options) => new fcode_graphql_client_1.default(options),
+    // Pre-flight check that the current session can access the team, run before any
+    // local state is touched so a denied session fails once with a clear error
+    // instead of erroring on every resource pull. A 403 may just mean the token
+    // predates the team: groups are snapshotted into the token at issuance
+    // (FCT-61231), so re-mint it through the refresh grant and retry once.
+    async ensureTeamAccess(url, slug) {
+        try {
+            await this.checkAccess(url, slug);
+        }
+        catch (error) {
+            if (!is403(error)) {
+                throw error;
+            }
+            if (!(await auth_service_1.default.refreshSession(url))) {
+                throw new errors_1.TeamAccessDenied(slug);
+            }
+            try {
+                await this.checkAccess(url, slug);
+            }
+            catch (retryError) {
+                if (is403(retryError)) {
+                    throw new errors_1.TeamAccessDenied(slug);
+                }
+                throw retryError;
+            }
+        }
+    },
+    async checkAccess(url, slug) {
+        const { token } = await this.globalConfig.getAuthInfo(url);
+        await this.clientFactory({ url, accessToken: token.access_token, teamSlug: slug }).verifyTeamAccess();
+    },
+};
+exports.default = TeamAccessService;

package/dist/utils/gitignore.d.ts

@@ -14,6 +14,6 @@ export declare function renderGitignoreWithInherited(existing: string, inherited
  * parent team and pulled read-only) are not tracked by git. Regenerated from the
  * current workspace metadata, so resources that stop being inherited drop out.
  * Inherited variable values live in one file, which is ignored as soon as the
- * workspace inherits any variable.
+ * workspace inherits any variable; inherited locales are one file each, like modules.
  */
 export declare function syncInheritedGitignore(workspaceDir?: string): Promise<void>;

package/dist/utils/gitignore.js

@@ -46,7 +46,7 @@ function stripManagedBlock(content) {
  * parent team and pulled read-only) are not tracked by git. Regenerated from the
  * current workspace metadata, so resources that stop being inherited drop out.
  * Inherited variable values live in one file, which is ignored as soon as the
- * workspace inherits any variable.
+ * workspace inherits any variable; inherited locales are one file each, like modules.
  */
 async function syncInheritedGitignore(workspaceDir = process.cwd()) {
     const team = await new workspace_1.default(workspaceDir).getActiveTeam();
@@ -59,6 +59,9 @@ async function syncInheritedGitignore(workspaceDir = process.cwd()) {
             .filter((module) => module.resolvingTeamSlug)
             .map((module) => `modules/${(0, filenamify_1.default)(module.name)}/`),
         ...(Object.values(team.variables ?? {}).some((variable) => variable.resolvingTeamSlug) ? [inheritedVariablesFileName] : []),
+        ...Object.values(team.i18n ?? {})
+            .filter((locale) => locale.resolvingTeamSlug)
+            .map((locale) => `i18n/${(0, filenamify_1.default)(locale.slug)}.yaml`),
     ];
     const gitignorePath = path.join(workspaceDir, '.gitignore');
     const existing = fs.existsSync(gitignorePath) ? fs.readFileSync(gitignorePath, 'utf8') : '';