@factorialco/fcode-cli 3.1.0 → 3.3.0

package/dist/core/commands/resource-command.d.ts

@@ -38,7 +38,10 @@ export default abstract class ResourceCommand<R extends Resource> extends ApiCli
      * whole set to place a change in context; `diffable` is only what a status says has changed.
      */
     protected diffSections(diffable: Array<ResourcePair<R>>, allPairs: Array<ResourcePair<R>>): Array<DiffSection>;
-    /** Names the resource a patch belongs to, flagging an inherited one as the parent's to fix. */
+    /**
+     * Names the resource a patch belongs to, flagging an inherited one as the parent's to fix and a
+     * deleted one as kept only for its versions.
+     */
     protected diffLabel(pair: ResourcePair<R>): string;
     /**
      * Prints a unified diff of everything that differs between the workspace and the cloud, and

package/dist/core/commands/resource-command.js

@@ -107,11 +107,18 @@ class ResourceCommand extends api_client_command_1.default {
             files: this._diffFilesFor(pair),
         }));
     }
-    /** Names the resource a patch belongs to, flagging an inherited one as the parent's to fix. */
+    /**
+     * Names the resource a patch belongs to, flagging an inherited one as the parent's to fix and a
+     * deleted one as kept only for its versions.
+     */
     diffLabel(pair) {
         const label = `${pair.status} ${this._resourceRepository._repositoryName}/${pair.slug}`;
         const inheritedTeam = (0, resource_differ_1.inheritedFrom)(pair);
-        return inheritedTeam ? `${label}  🔗 inherited from '${inheritedTeam}' (read-only — run pull to update)` : label;
+        if (inheritedTeam) {
+            return `${label}  🔗 inherited from '${inheritedTeam}' (read-only — run pull to update)`;
+        }
+        const deletion = (pair.remote ?? pair.local)?.deletion;
+        return deletion ? `${label}  🪦 deleted, kept by ${deletion.retainingVersionTags.join(', ')} (read-only — run pull to update)` : label;
     }
     /**
      * Prints a unified diff of everything that differs between the workspace and the cloud, and

package/dist/core/dependencies/javascript-env-dependencies.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const node_child_process_1 = require("node:child_process");
 const fs = require("node:fs");
 const path = require("node:path");
 const env_dependencies_command_1 = require("./env-dependencies-command");
+const child_process_1 = require("../../utils/child-process");
 class JavaScriptEnvDependencies extends env_dependencies_command_1.default {
     get programmingLanguage() {
         return 'JAVASCRIPT';
@@ -33,7 +33,7 @@ class JavaScriptEnvDependencies extends env_dependencies_command_1.default {
             // Backward compatibility
             const pnpmPath = await this.ensurePnpm();
             return new Promise((resolve, reject) => {
-                const proc = (0, node_child_process_1.spawn)(pnpmPath, ['install', '--no-dev'], {
+                const proc = (0, child_process_1.spawnCommand)(pnpmPath, ['install', '--no-dev'], {
                     cwd: installationPath,
                     stdio: 'inherit',
                 });
@@ -54,10 +54,10 @@ class JavaScriptEnvDependencies extends env_dependencies_command_1.default {
         }
     }
     async ensurePnpm() {
-        const pnpmPath = path.join(this.envPath, 'node_modules', '.bin', 'pnpm');
+        const pnpmPath = (0, child_process_1.binShimPath)(path.join(this.envPath, 'node_modules'), 'pnpm');
         if (!fs.existsSync(pnpmPath)) {
             return new Promise((resolve, reject) => {
-                const proc = (0, node_child_process_1.spawn)('npm', ['install', '--prefix', this.envPath, 'pnpm'], {
+                const proc = (0, child_process_1.spawnCommand)('npm', ['install', '--prefix', this.envPath, 'pnpm'], {
                     cwd: this.envPath,
                     stdio: 'inherit',
                 });

package/dist/core/dependencies/python-env-dependencies.js

@@ -2,9 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const node_child_process_1 = require("node:child_process");
 const fs = require("node:fs");
-const path = require("node:path");
 const env_dependencies_command_1 = require("./env-dependencies-command");
 const cli_1 = require("../../utils/cli");
+const child_process_1 = require("../../utils/child-process");
 class PythonEnvDependencies extends env_dependencies_command_1.default {
     get programmingLanguage() {
         return 'PYTHON';
@@ -12,7 +12,8 @@ class PythonEnvDependencies extends env_dependencies_command_1.default {
     async createEnv() {
         try {
             await new Promise((resolve, reject) => {
-                (0, node_child_process_1.exec)(`python3 -m venv ${this.envPath}`, (error) => {
+                const python = process.platform === 'win32' ? 'python' : 'python3';
+                (0, node_child_process_1.exec)(`${python} -m venv ${JSON.stringify(this.envPath)}`, (error) => {
                     if (error) {
                         reject(error);
                     }
@@ -68,8 +69,8 @@ import json
 `;
     }
     async ensureUv() {
-        const uvPath = path.join(this.envPath, 'bin', 'uv');
-        const pipPath = path.join(this.envPath, 'bin', 'pip');
+        const uvPath = (0, child_process_1.venvExecutablePath)(this.envPath, 'uv');
+        const pipPath = (0, child_process_1.venvExecutablePath)(this.envPath, 'pip');
         if (!fs.existsSync(uvPath)) {
             return new Promise((resolve, reject) => {
                 const proc = (0, node_child_process_1.spawn)(pipPath, ['install', '--force-reinstall', 'uv'], {

package/dist/core/executors/execution-task.js

@@ -127,7 +127,7 @@ class ExecutionTask {
         const exportVars = {
             ...createFilesResult,
             FCODE_DEPENDENCIES_PATH: this._dependenciesPath,
-            FCODE_EXECUTION_PATH: [createFilesResult.FCODE_LIBRARY_PATH, this._dependenciesPath].filter((p) => p).join(':'),
+            FCODE_EXECUTION_PATH: [createFilesResult.FCODE_LIBRARY_PATH, this._dependenciesPath].filter((p) => p).join(path.delimiter),
         };
         fs.writeFileSync(path.join(this._tempDir, 'METADATA'), Object.entries(exportVars)
             .map(([key, value]) => `${key}=${value}`)

package/dist/core/executors/javascript-execution-task.js

@@ -6,6 +6,7 @@ const fs = require("node:fs");
 const path = require("node:path");
 const execution_task_1 = require("./execution-task");
 const source_code_sanitizer_1 = require("./source-code-sanitizer");
+const child_process_1 = require("../../utils/child-process");
 /**
  * Task which handles native executions using child_process.
  */
@@ -18,11 +19,11 @@ class JavaScriptExecutionTask extends execution_task_1.default {
         const fcodeLibPath = path.join(__dirname, '..', '..', 'runtime', 'libs', 'node');
         const nodeModulesPath = path.join(this._dependenciesPath, 'node_modules');
         const forked = (0, node_child_process_1.fork)(path.resolve(this._execFilePath), {
-            env: {
+            env: (0, child_process_1.childEnv)({
                 FORCE_COLOR: 'true',
-                NODE_PATH: [nodeModulesPath, nodePath, fcodeLibPath].filter((p) => p).join(':'),
+                NODE_PATH: [nodeModulesPath, nodePath, fcodeLibPath].filter((p) => p).join(path.delimiter),
                 PATH: process.env.PATH,
-            },
+            }),
             silent: false,
         });
         return new Promise((resolve, reject) => {
@@ -45,7 +46,7 @@ class JavaScriptExecutionTask extends execution_task_1.default {
         if (this._options.hookFilePath) {
             const fn = this._options.hookFunction ?? 'main';
             return `
-const _hooksModule = require('${this._options.hookFilePath}')
+const _hooksModule = require(${JSON.stringify(this._options.hookFilePath)})
 const main = typeof _hooksModule['${fn}'] === 'function'
   ? _hooksModule['${fn}']
   : async () => undefined`;
@@ -56,7 +57,7 @@ const main = typeof _hooksModule['${fn}'] === 'function'
         }
         processPath.push('index.js');
         const fullPath = path.join(...processPath);
-        return `const { main }= require('${fullPath}')`;
+        return `const { main }= require(${JSON.stringify(fullPath)})`;
     }
     async _createExecutionFiles(tempDir) {
         if (!this._options.silent) {
@@ -64,7 +65,7 @@ const main = typeof _hooksModule['${fn}'] === 'function'
                 ? process.stdout.write(JSON.stringify({ timestamp: new Date().toISOString(), level: 'DEBUG', message: `Creating execution files for '${this._process.slug}' in ${tempDir}` }) + '\n')
                 : console.debug(`Creating execution files for '${this._process.slug}' in ${tempDir}`);
         }
-        const execFilePath = `${tempDir}/${this._process.slug}.js`;
+        const execFilePath = path.join(tempDir, `${this._process.slug}.js`);
         const metadata = this.getMetadata();
         const execution = metadata.execution;
         execution.id = '00000000-0000-0000-0000-000000000000';
@@ -117,7 +118,7 @@ const main = typeof _hooksModule['${fn}'] === 'function'
           const version = typeof tagOrOptions === 'string'
             ? tagOrOptions
             : (tagOrOptions && typeof tagOrOptions === 'object' ? tagOrOptions.version : undefined);
-          let modulePath = require('path').join('${process.cwd()}', 'modules', moduleName);
+          let modulePath = require('path').join(${JSON.stringify(process.cwd())}, 'modules', moduleName);
           if(version) {
             modulePath = require('path').join(modulePath, 'versions', version)
           }
@@ -151,7 +152,7 @@ const main = typeof _hooksModule['${fn}'] === 'function'
         datastore: {
           async save(datastore) {
             return new Promise((resolve, reject) => {
-              require('fs').writeFile(require('path').join('${process.cwd()}', 'datastore.json'), JSON.stringify(datastore, null, 2), (err) => {
+              require('fs').writeFile(require('path').join(${JSON.stringify(process.cwd())}, 'datastore.json'), JSON.stringify(datastore, null, 2), (err) => {
                 if (err) {
                   reject(err)
                 }
@@ -161,7 +162,7 @@ const main = typeof _hooksModule['${fn}'] === 'function'
           },
           getAll() {
             try {
-              return require(require('path').join('${process.cwd()}', 'datastore.json'));
+              return require(require('path').join(${JSON.stringify(process.cwd())}, 'datastore.json'));
             } catch (e) {
               return {}
             }
@@ -172,7 +173,10 @@ const main = typeof _hooksModule['${fn}'] === 'function'
             }
             throw new Error('Invalid argument type')
           },
-          async set(key, value) {
+          async set(key, value, encrypted) {
+            if (encrypted !== undefined && typeof encrypted !== 'boolean') {
+              throw new Error('Invalid encrypted flag. Encrypted must be a boolean.')
+            }
             if ((typeof key === 'string' || typeof key === 'number') && (typeof value === 'string' || typeof value === 'number')) {
               const datastore = this.getAll()
               datastore[key] = value
@@ -235,7 +239,7 @@ const main = typeof _hooksModule['${fn}'] === 'function'
               }
 
               try {
-                const storageDir = path.join('${process.cwd()}', 'storage')
+                const storageDir = path.join(${JSON.stringify(process.cwd())}, 'storage')
                 if (!fs.existsSync(storageDir)) {
                   fs.mkdirSync(storageDir)
                 }
@@ -338,7 +342,7 @@ const main = typeof _hooksModule['${fn}'] === 'function'
               throw new Error('Storage list failed: prefix must be a string')
             }
 
-            const storageDir = path.join('${process.cwd()}', 'storage')
+            const storageDir = path.join(${JSON.stringify(process.cwd())}, 'storage')
 
             if (!fs.existsSync(storageDir)) {
               return []
@@ -410,7 +414,7 @@ const main = typeof _hooksModule['${fn}'] === 'function'
                 return reject(new Error('Storage download failed: filename cannot be empty'))
               }
 
-              const filePath = path.join('${process.cwd()}', 'storage', filename)
+              const filePath = path.join(${JSON.stringify(process.cwd())}, 'storage', filename)
 
               if (!fs.existsSync(filePath)) {
                 return reject(new Error(\`Storage download failed: file not found - \${filename}\`))
@@ -448,7 +452,7 @@ const main = typeof _hooksModule['${fn}'] === 'function'
                 return reject(new Error('Storage delete failed: filename cannot be empty'))
               }
 
-              const filePath = path.join('${process.cwd()}', 'storage', filename)
+              const filePath = path.join(${JSON.stringify(process.cwd())}, 'storage', filename)
 
               if (!fs.existsSync(filePath)) {
                 return reject(new Error(\`Storage delete failed: file not found - \${filename}\`))
@@ -463,7 +467,7 @@ const main = typeof _hooksModule['${fn}'] === 'function'
                 fs.unlinkSync(filePath)
 
                 let dir = path.dirname(filePath)
-                const storageDir = path.join('${process.cwd()}', 'storage')
+                const storageDir = path.join(${JSON.stringify(process.cwd())}, 'storage')
 
                 while (dir !== storageDir && dir !== path.dirname(dir)) {
                   try {
@@ -501,7 +505,7 @@ const main = typeof _hooksModule['${fn}'] === 'function'
               throw new Error('Storage createSignedUrl failed: expiresInSeconds must be an integer between 1 and 604800')
             }
 
-            const filePath = path.join('${process.cwd()}', 'storage', filename)
+            const filePath = path.join(${JSON.stringify(process.cwd())}, 'storage', filename)
 
             if (!fs.existsSync(filePath)) {
               throw new Error(\`Storage createSignedUrl failed: file not found - \${filename}\`)
@@ -532,7 +536,7 @@ const main = typeof _hooksModule['${fn}'] === 'function'
         },
         variables: (() => {
           const fs = require('fs');
-          const localEnvPath = require('path').join('${process.cwd()}', 'variables.local.env');
+          const localEnvPath = require('path').join(${JSON.stringify(process.cwd())}, 'variables.local.env');
           const baseVars = ${JSON.stringify(metadata.variables, null, 2)};
           const readLocal = () => { try { return fs.readFileSync(localEnvPath, 'utf8') } catch { return '' } };
           const parseEnv = (text) => {

package/dist/core/executors/python-execution-task.js

@@ -7,15 +7,16 @@ const errors_1 = require("../errors");
 const execution_task_1 = require("./execution-task");
 const workspace_1 = require("../../config/workspace");
 const source_code_sanitizer_1 = require("./source-code-sanitizer");
+const child_process_1 = require("../../utils/child-process");
 class PythonExecutionTask extends execution_task_1.default {
     async run() {
         if (!this._execFilePath) {
             this.prepare();
         }
         const venvPath = (0, workspace_1.baseDependenciesPath)(this._programmingLanguage);
-        const forked = (0, node_child_process_1.spawn)(`${venvPath}/bin/python3`, ['-u', path.resolve(this._execFilePath)], {
+        const forked = (0, node_child_process_1.spawn)((0, child_process_1.venvPythonPath)(venvPath), ['-u', path.resolve(this._execFilePath)], {
             stdio: 'inherit',
-            env: {},
+            env: (0, child_process_1.childEnv)({}),
         });
         return new Promise((resolve, reject) => {
             forked.on('exit', (code) => {
@@ -76,7 +77,7 @@ _builtins.print = _json_print
             return `import fcode as _imported_fcode_module
 ${jsonLogsSetup}
 import importlib.util as _importlib_util
-_spec = _importlib_util.spec_from_file_location("hooks", "${this._options.hookFilePath}")
+_spec = _importlib_util.spec_from_file_location("hooks", ${JSON.stringify(this._options.hookFilePath)})
 _hooks_module = _importlib_util.module_from_spec(_spec)
 _spec.loader.exec_module(_hooks_module)
 _hook_fn = getattr(_hooks_module, '${fn}', None)
@@ -143,8 +144,8 @@ if (hasattr(process, 'main')):
                 ? process.stdout.write(JSON.stringify({ timestamp: new Date().toISOString(), level: 'DEBUG', message: `Creating execution files for '${this._process.slug}' in ${tempDir}` }) + '\n')
                 : console.debug(`Creating execution files for '${this._process.slug}' in ${tempDir}`);
         }
-        const execFilePath = `${tempDir}/${this._process.slug}.py`;
-        const libraryFilePath = `${tempDir}/initialize_params.py`;
+        const execFilePath = path.join(tempDir, `${this._process.slug}.py`);
+        const libraryFilePath = path.join(tempDir, 'initialize_params.py');
         fs.writeFileSync(libraryFilePath, JSON.stringify(this.getMetadata()));
         fs.writeFileSync(execFilePath, `
 import sys
@@ -152,13 +153,13 @@ import os
 import json
 import traceback
 
-sys.path.append('${path.join(this._dependenciesPath)}')
-sys.path.append('${path.join(__dirname, '..', '..', 'runtime', 'libs', 'python')}')
+sys.path.append(${JSON.stringify(this._dependenciesPath)})
+sys.path.append(${JSON.stringify(path.join(__dirname, '..', '..', 'runtime', 'libs', 'python'))})
 
 os.environ['FCODE_LOG_LEVEL'] = '${this._options.logLevel}'
-os.environ['FCODE_RUNTIME_METADATA_PATH'] = '${libraryFilePath}'
-os.environ['FCODE_RETURN_FILE'] = '${this.returnValueFilePath}'
-os.environ['FCODE_ERROR_FILE'] = '${this.errorValueFilePath}'
+os.environ['FCODE_RUNTIME_METADATA_PATH'] = ${JSON.stringify(libraryFilePath)}
+os.environ['FCODE_RETURN_FILE'] = ${JSON.stringify(this.returnValueFilePath)}
+os.environ['FCODE_ERROR_FILE'] = ${JSON.stringify(this.errorValueFilePath)}
 ${this._options.jsonLogs ? `os.environ['FCODE_JSON_LOGS'] = 'true'` : ''}
 ${Object.entries(this.getVariablesObject()).map(([key, value]) => `if '${key}' not in os.environ: os.environ['${key}'] = ${JSON.stringify(value)}`).join('\n')}
 

package/dist/core/resource-pusher.js

@@ -15,14 +15,16 @@ class ResourcePusher {
     }
     async push(remoteResources, localResources, force) {
         cli_1.default.log(`\n🌩️  Pushing ${this._repository._repositoryName}...`);
-        for (const resource of localResources.filter((resource) => resource.resolvingTeamSlug)) {
+        // Neither an inherited resource nor a deleted one the cloud keeps for its versions is pushed:
+        // the first is the parent's, the second only exists through what was already published.
+        for (const resource of localResources.filter((resource) => (0, types_1.isReadOnly)(resource))) {
             if (await resource_checker_1.default.localResourceHasBeenModified(undefined, resource)) {
-                cli_1.default.log(color_1.default.red(`🚨 '${resource.slug}' is inherited from team '${resource.resolvingTeamSlug}' and is read-only. ` +
+                cli_1.default.log(color_1.default.red(`🚨 '${resource.slug}' is ${(0, types_1.readOnlyReason)(resource)} and is read-only. ` +
                     `Run 'fcode ${this._repository._repositoryName}:pull' to restore it before pushing.`));
             }
         }
-        localResources = localResources.filter((resource) => !resource.resolvingTeamSlug);
-        remoteResources = remoteResources.filter((resource) => !resource.resolvingTeamSlug);
+        localResources = localResources.filter((resource) => !(0, types_1.isReadOnly)(resource));
+        remoteResources = remoteResources.filter((resource) => !(0, types_1.isReadOnly)(resource));
         if (this._repository._repositoryName === 'variables') {
             const localVariables = localResources;
             const remoteVariables = remoteResources;
@@ -115,11 +117,12 @@ class ResourcePusher {
     }
     async removeResource(resource) {
         try {
+            let removed;
             if (this._repository._repositoryName === 'processes') {
-                await this._fcodeGraphQLClient.removeProcess(resource.id);
+                removed = await this._fcodeGraphQLClient.removeProcess(resource.id);
             }
             if (this._repository._repositoryName === 'modules') {
-                await this._fcodeGraphQLClient.removeScriptLibrary(resource.id);
+                removed = await this._fcodeGraphQLClient.removeScriptLibrary(resource.id);
             }
             if (this._repository._repositoryName === 'variables') {
                 await this._fcodeGraphQLClient.removeVariable(resource.id);
@@ -127,7 +130,10 @@ class ResourcePusher {
             if (this._repository._repositoryName === 'i18n') {
                 // By identifier, not slug: an inherited locale is tracked under a qualified slug, and only
                 // this workspace's own locales — where the two coincide — ever reach a remote delete.
-                await this._fcodeGraphQLClient.removeLocale(resource.locale);
+                removed = await this._fcodeGraphQLClient.removeLocale(resource.locale);
+            }
+            if (removed?.deletedAt) {
+                cli_1.default.log(color_1.default.yellow(`📌 '${resource.slug}' is kept as deleted: workspace version(s) ${removed.retainingVersionTags.join(', ')} still contain it.`));
             }
             this._repository.removeMetadata(resource.slug);
         }

package/dist/core/types.d.ts

@@ -72,14 +72,27 @@ export interface WorkspaceConfig {
 export type ResourceRepositoryOptions = {
     name: string;
 };
+/**
+ * Why a deleted resource is still in the cloud: a workspace version contains one of its published
+ * snapshots. The row is read-only there and goes for good once the last of those versions does.
+ */
+export type Deletion = {
+    deletedAt: string;
+    retainingVersionTags: string[];
+};
 export declare abstract class Resource {
     abstract readonly contentHash: string;
     id: string | undefined;
     slug: string;
     errorPushing: boolean | undefined;
     resolvingTeamSlug?: string;
+    deletion?: Deletion;
     sameAs(other: Resource): boolean;
 }
+/** Whether the workspace may edit the resource: neither a parent's nor a deleted one is its to change. */
+export declare const isReadOnly: (resource: Resource) => boolean;
+/** The sentence `push` and `diff` use to say why a resource is not the workspace's to change. */
+export declare const readOnlyReason: (resource: Resource) => string | undefined;
 export declare enum OnConflictResolution {
     KEEP_LOCAL = 0,
     KEEP_REMOTE = 1
@@ -185,7 +198,7 @@ export declare class Process extends Resource {
         dependencies: {
             scopedToProcess: boolean;
         };
-    }, metadata: ProcessMetadataFields, resolvingTeamSlug?: string);
+    }, metadata: ProcessMetadataFields, resolvingTeamSlug?: string, deletion?: Deletion);
     get contentHash(): string;
 }
 export declare class VersionedProcess extends Resource {
@@ -207,7 +220,7 @@ export declare class ScriptLibrary extends Resource {
     name: string;
     programmingLanguage: ProgrammingLanguage;
     sourceCode: string;
-    constructor(id: string, name: string, sourceCode: string, programmingLanguage: ProgrammingLanguage, resolvingTeamSlug?: string);
+    constructor(id: string, name: string, sourceCode: string, programmingLanguage: ProgrammingLanguage, resolvingTeamSlug?: string, deletion?: Deletion);
     get contentHash(): string;
 }
 export declare class Locale extends Resource {
@@ -217,7 +230,7 @@ export declare class Locale extends Resource {
     slug: string;
     locale: string;
     content: string;
-    constructor(id: string | undefined, locale: string, content: string, resolvingTeamSlug?: string);
+    constructor(id: string | undefined, locale: string, content: string, resolvingTeamSlug?: string, deletion?: Deletion);
     /**
      * The name a locale is tracked and stored under. Unlike every other resource, the identifier is
      * not unique: a workspace sees its own `en` and each parent workspace's `en`, and all of them are

package/dist/core/types.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ServiceAccount = exports.Dependency = exports.DependenciesFlags = exports.TeamNameArg = exports.ShowInheritedFlag = exports.ResourceSlugArg = exports.ForceFlag = exports.ScriptLibraryNotFound = exports.ProcessNotFound = exports.WorkspaceSettings = exports.ProgrammingLanguageManifest = exports.Variable = exports.VersionedProgrammingLanguageManifest = exports.VersionedScriptLibrary = exports.Locale = exports.ScriptLibrary = exports.VersionedProcess = exports.Process = exports.DEFAULT_WEBHOOK_AUTH_HEADER = exports.programmingLanguageDisplayName = exports.PROGRAMMING_LANGUAGES = exports.ResourceStatus = exports.OnConflictResolution = exports.Resource = void 0;
+exports.ServiceAccount = exports.Dependency = exports.DependenciesFlags = exports.TeamNameArg = exports.ShowInheritedFlag = exports.ResourceSlugArg = exports.ForceFlag = exports.ScriptLibraryNotFound = exports.ProcessNotFound = exports.WorkspaceSettings = exports.ProgrammingLanguageManifest = exports.Variable = exports.VersionedProgrammingLanguageManifest = exports.VersionedScriptLibrary = exports.Locale = exports.ScriptLibrary = exports.VersionedProcess = exports.Process = exports.DEFAULT_WEBHOOK_AUTH_HEADER = exports.programmingLanguageDisplayName = exports.PROGRAMMING_LANGUAGES = exports.ResourceStatus = exports.OnConflictResolution = exports.readOnlyReason = exports.isReadOnly = exports.Resource = void 0;
 const core_1 = require("@oclif/core");
 const crypto = require("node:crypto");
 const canonical_hash_1 = require("../utils/canonical-hash");
@@ -10,6 +10,27 @@ class Resource {
     }
 }
 exports.Resource = Resource;
+/** Whether the workspace may edit the resource: neither a parent's nor a deleted one is its to change. */
+const isReadOnly = (resource) => Boolean(resource.resolvingTeamSlug || resource.deletion);
+exports.isReadOnly = isReadOnly;
+/** The sentence `push` and `diff` use to say why a resource is not the workspace's to change. */
+const readOnlyReason = (resource) => {
+    if (resource.resolvingTeamSlug) {
+        return `inherited from team '${resource.resolvingTeamSlug}'`;
+    }
+    if (resource.deletion) {
+        return `deleted in the cloud and kept by workspace version(s) ${resource.deletion.retainingVersionTags.join(', ')}`;
+    }
+    return undefined;
+};
+exports.readOnlyReason = readOnlyReason;
+/**
+ * The deletion as it enters a content hash. A deleted resource must read as changed the moment the
+ * cloud deletes it — or brings it back — so a pull marks its files read-only (or writable again)
+ * even though their content did not move; a live resource contributes nothing, so no stored hash
+ * changes for it.
+ */
+const deletionHashPart = (deletion) => deletion ? JSON.stringify({ deletedAt: deletion.deletedAt, retainingVersionTags: [...deletion.retainingVersionTags].sort() }) : '';
 var OnConflictResolution;
 (function (OnConflictResolution) {
     OnConflictResolution[OnConflictResolution["KEEP_LOCAL"] = 0] = "KEEP_LOCAL";
@@ -41,10 +62,11 @@ exports.programmingLanguageDisplayName = programmingLanguageDisplayName;
 // The header assumed when none is configured; its value carries a Bearer scheme.
 exports.DEFAULT_WEBHOOK_AUTH_HEADER = 'Authorization';
 class Process extends Resource {
-    constructor(id, slug, script, readme, manifest, settings, metadata, resolvingTeamSlug) {
+    constructor(id, slug, script, readme, manifest, settings, metadata, resolvingTeamSlug, deletion) {
         super();
         this.id = id;
         this.slug = slug;
+        this.deletion = deletion;
         this.name = metadata.name;
         this.description = metadata.description;
         this.tags = metadata.tags;
@@ -72,6 +94,7 @@ class Process extends Resource {
             ...(this.uiTrigger && { uiTrigger: this.uiTrigger }),
             manifestDependencies: this.manifest.dependencies,
             dependenciesScopedToProcess: this.settings.dependencies.scopedToProcess,
+            ...(this.deletion && { deletion: deletionHashPart(this.deletion) }),
         });
     }
 }
@@ -94,7 +117,7 @@ class VersionedProcess extends Resource {
 }
 exports.VersionedProcess = VersionedProcess;
 class ScriptLibrary extends Resource {
-    constructor(id, name, sourceCode, programmingLanguage, resolvingTeamSlug) {
+    constructor(id, name, sourceCode, programmingLanguage, resolvingTeamSlug, deletion) {
         super();
         this.id = id;
         this.slug = name;
@@ -102,20 +125,22 @@ class ScriptLibrary extends Resource {
         this.sourceCode = sourceCode;
         this.programmingLanguage = programmingLanguage;
         this.resolvingTeamSlug = resolvingTeamSlug;
+        this.deletion = deletion;
     }
     get contentHash() {
-        return crypto.createHash('md5').update(this.sourceCode).digest('hex');
+        return crypto.createHash('md5').update(this.sourceCode).update(deletionHashPart(this.deletion)).digest('hex');
     }
 }
 exports.ScriptLibrary = ScriptLibrary;
 class Locale extends Resource {
-    constructor(id, locale, content, resolvingTeamSlug) {
+    constructor(id, locale, content, resolvingTeamSlug, deletion) {
         super();
         this.id = id;
         this.slug = Locale.slugFor(locale, resolvingTeamSlug);
         this.locale = locale;
         this.content = content;
         this.resolvingTeamSlug = resolvingTeamSlug;
+        this.deletion = deletion;
     }
     /**
      * The name a locale is tracked and stored under. Unlike every other resource, the identifier is
@@ -133,7 +158,7 @@ class Locale extends Resource {
     // Hashed over the raw YAML: the file is the source of truth and round-trips comments and
     // ordering, so any edit — even one that parses to the same translations — is a change to push.
     get contentHash() {
-        return crypto.createHash('md5').update(this.content).digest('hex');
+        return crypto.createHash('md5').update(this.content).update(deletionHashPart(this.deletion)).digest('hex');
     }
 }
 exports.Locale = Locale;

package/dist/hooks/init/auth.d.ts

@@ -1,3 +1,22 @@
 import { Hook } from '@oclif/core';
+import GlobalConfig from '../../config/global';
+export type LoginMethod = 'accessToken' | 'credentials' | 'browser';
+export interface LoginOptions {
+    email?: string;
+    password?: string;
+    clientId?: string;
+    clientSecret?: string;
+    accessToken?: string;
+    prompt?: boolean;
+    browserLoginDisabled?: boolean;
+}
+/**
+ * Picks how to log in from what the user passed. The browser OAuth flow is the default, but it is
+ * skipped when the user asked to be prompted (`--prompt`), when it is disabled through the
+ * `disableBrowserLogin` setting or the `FCODE_DISABLE_BROWSER_LOGIN` env var (headless machines,
+ * CI, remote shells), or when credentials that identify another method were given.
+ */
+export declare function resolveLoginMethod(options: LoginOptions): LoginMethod;
+export declare function isBrowserLoginDisabled(globalConfig?: GlobalConfig): Promise<boolean>;
 declare const auth: Hook<'init'>;
 export default auth;

package/dist/hooks/init/auth.js

@@ -1,27 +1,61 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveLoginMethod = resolveLoginMethod;
+exports.isBrowserLoginDisabled = isBrowserLoginDisabled;
 const dotenv_1 = require("dotenv");
 const auth_service_1 = require("../../services/auth-service");
 const credential_prompter_1 = require("../../services/credential-prompter");
 const oauth_browser_service_1 = require("../../services/oauth-browser-service");
 const global_1 = require("../../config/global");
+const settings_1 = require("../../config/settings");
 const url_utils_1 = require("../../utils/url-utils");
+/**
+ * Picks how to log in from what the user passed. The browser OAuth flow is the default, but it is
+ * skipped when the user asked to be prompted (`--prompt`), when it is disabled through the
+ * `disableBrowserLogin` setting or the `FCODE_DISABLE_BROWSER_LOGIN` env var (headless machines,
+ * CI, remote shells), or when credentials that identify another method were given.
+ */
+function resolveLoginMethod(options) {
+    if (options.accessToken) {
+        return 'accessToken';
+    }
+    if (options.prompt ||
+        options.browserLoginDisabled ||
+        options.email ||
+        options.password ||
+        (options.clientId && options.clientSecret)) {
+        return 'credentials';
+    }
+    return 'browser';
+}
+async function isBrowserLoginDisabled(globalConfig = new global_1.default()) {
+    return (process.env.FCODE_DISABLE_BROWSER_LOGIN === 'true' ||
+        (await globalConfig.getSetting(settings_1.SettingKeys.DISABLE_BROWSER_LOGIN)) === 'true');
+}
 const auth = async function ({ argv }) {
     const url = argv[0] || global_1.FCODE_CLOUD_URL;
     const authUrl = argv[1] || (0, url_utils_1.buildAuthUrl)(url);
     const isAuthenticated = await auth_service_1.default.isAuthenticated(url);
     if (!isAuthenticated) {
         (0, dotenv_1.config)();
-        const accessToken = argv[6];
-        const prompt = argv[7];
-        if (accessToken) {
+        const [, , email, password, clientId, clientSecret, accessToken, prompt] = argv;
+        const method = resolveLoginMethod({
+            email,
+            password,
+            clientId,
+            clientSecret,
+            accessToken,
+            prompt: Boolean(prompt),
+            browserLoginDisabled: await isBrowserLoginDisabled(),
+        });
+        if (method === 'accessToken') {
             await auth_service_1.default.login({ url, authUrl, accessToken });
         }
-        else if (prompt || argv[2] || argv[3] || (argv[4] && argv[5])) {
-            await credential_prompter_1.default.prompt({ url, authUrl, email: argv[2], password: argv[3], clientId: argv[4], clientSecret: argv[5] });
+        else if (method === 'credentials') {
+            await credential_prompter_1.default.prompt({ url, authUrl, email, password, clientId, clientSecret });
         }
         else {
-            await (0, oauth_browser_service_1.loginViaBrowser)(url, authUrl, argv[4]);
+            await (0, oauth_browser_service_1.loginViaBrowser)(url, authUrl, clientId);
         }
     }
 };

package/dist/repositories/locale.js

@@ -32,7 +32,7 @@ class LocaleRepository extends resource_1.default {
         }
         try {
             const content = fs.readFileSync(this.getResourcePath(localeMetadata)).toString();
-            return new types_1.Locale(localeMetadata.id, localeMetadata.locale ?? slug, content, localeMetadata.resolvingTeamSlug);
+            return new types_1.Locale(localeMetadata.id, localeMetadata.locale ?? slug, content, localeMetadata.resolvingTeamSlug, localeMetadata.deletion);
         }
         catch (error) {
             throw new errors_1.LocalLocaleNotFound(error, slug);
@@ -78,12 +78,14 @@ class LocaleRepository extends resource_1.default {
             locale: locale.locale,
             slug: locale.slug,
             ...(locale.resolvingTeamSlug && { resolvingTeamSlug: locale.resolvingTeamSlug }),
+            ...(locale.deletion && { deletion: locale.deletion }),
         };
     }
     async saveFiles(locale) {
         // Inherited locales are written read-only, like inherited modules: they belong to a parent
-        // workspace, and editing one here would push an override rather than change the parent.
-        (0, file_utils_1.outputFileSyncIfChanged)(this.getResourcePath(locale), locale.content || '', { readOnly: Boolean(locale.resolvingTeamSlug) });
+        // workspace, and editing one here would push an override rather than change the parent. A
+        // deleted locale is read-only too: only its versions are still resolved.
+        (0, file_utils_1.outputFileSyncIfChanged)(this.getResourcePath(locale), locale.content || '', { readOnly: (0, types_1.isReadOnly)(locale) });
     }
     async metadataFromFiles(slug) {
         return {