@framedash/cli 0.1.1 → 0.1.3

package/dist/lib/config.d.ts

@@ -1,16 +1,57 @@
+import { type StoredTokenEntry } from "./oauth/token-store.js";
 export type OutputFormat = "json" | "table" | "csv";
-export type CliConfig = {
+/** Where an API key came from (drives `framedash auth` source display). */
+export type ApiKeySource = "flag" | "file" | "env";
+/**
+ * The resolved credential for a run. Precedence: --api-key > --api-key-file >
+ * FRAMEDASH_API_KEY env > OAuth tokens stored by `framedash login` for the
+ * resolved base URL's origin. The OAuth variant carries the stored entry so
+ * the client starts from it without re-reading the store; the token values
+ * inside must never be logged.
+ */
+export type CliCredential = {
+    kind: "api-key";
     apiKey: string;
+    source: ApiKeySource;
+} | {
+    kind: "oauth";
+    origin: string;
+    entry: StoredTokenEntry;
+};
+export type CliConfig = {
+    credential: CliCredential;
     projectId: string;
     baseUrl: string;
     format: OutputFormat;
 };
+/** Resolve --base-url/--format (and env fallbacks) for commands that need no credential. */
+export declare function resolveBaseAndFormat(values: Record<string, unknown>): {
+    baseUrl: string;
+    format: OutputFormat;
+};
 /**
  * Resolve the API key, preferring sources that keep it out of the process
  * argument list: --api-key flag, then --api-key-file (a path, or "-" for stdin),
  * then the FRAMEDASH_API_KEY env var. Returns undefined if none is set.
  */
 export declare function resolveApiKey(values: Record<string, unknown>): string | undefined;
+/** As resolveApiKey, but also reports WHICH source supplied the key. */
+export declare function resolveApiKeyWithSource(values: Record<string, unknown>): {
+    apiKey: string;
+    source: ApiKeySource;
+} | undefined;
+/**
+ * Resolve the credential for the given base URL. API keys (flag > file > env)
+ * win over a stored OAuth login; the OAuth token store is consulted only for
+ * the resolved base URL's exact origin. Returns undefined when nothing is set.
+ *
+ * NOTE: throws a TypeError (from `new URL`) when `baseUrl` is not a valid
+ * URL and no API key short-circuits the lookup. Callers that accept raw user
+ * input for the base URL (map-capture) must validate or catch accordingly;
+ * resolveConfig* callers are safe because resolveBaseAndFormat has already
+ * vetted the URL.
+ */
+export declare function resolveCredential(values: Record<string, unknown>, baseUrl: string): CliCredential | undefined;
 /** Resolve global CLI config from parsed flags and environment variables. */
 export declare function resolveConfig(values: Record<string, unknown>): CliConfig;
 /** Resolve config for commands that don't require --project-id (e.g. auth). */

package/dist/lib/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;AAEpD,MAAM,MAAM,SAAS,GAAG;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,YAAY,CAAC;CACrB,CAAC;AA6BF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,SAAS,CA+BjF;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAgBxE;AAED,+EAA+E;AAC/E,wBAAgB,2BAA2B,CAC1C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAS9B;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOxE;AAED,6EAA6E;AAC7E,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOnE;AAED;;;GAGG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;CAO1B,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAGA,OAAO,EAAmB,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAEhF,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;AAEpD,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GACtB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAE9D,MAAM,MAAM,SAAS,GAAG;IACvB,UAAU,EAAE,aAAa,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,YAAY,CAAC;CACrB,CAAC;AAMF,4FAA4F;AAC5F,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,YAAY,CAAC;CACrB,CAsBA;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,SAAS,CAEjF;AAED,wEAAwE;AACxE,wBAAgB,uBAAuB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GAAG,SAAS,CAgCtD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,EAAE,MAAM,GACb,aAAa,GAAG,SAAS,CAS3B;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAgBxE;AAED,+EAA+E;AAC/E,wBAAgB,2BAA2B,CAC1C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAS9B;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOxE;AAED,6EAA6E;AAC7E,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOnE;AAED;;;GAGG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;CAO1B,CAAC"}

package/dist/lib/config.js

@@ -1,7 +1,11 @@
 import { readFileSync } from "node:fs";
 import { assertSafeBaseUrl } from "@framedash/api-client";
 import { error } from "./logger.js";
-function resolveBaseAndFormat(values) {
+import { readStoredEntry } from "./oauth/token-store.js";
+const NO_CREDENTIAL_MESSAGE = "No credentials found: pass --api-key/--api-key-file, set FRAMEDASH_API_KEY, " +
+    "or run 'framedash login' (interactive). CI/non-interactive use should set FRAMEDASH_API_KEY.";
+/** Resolve --base-url/--format (and env fallbacks) for commands that need no credential. */
+export function resolveBaseAndFormat(values) {
     const baseUrl = values["base-url"] ??
         process.env.FRAMEDASH_BASE_URL ??
         "https://app.framedash.dev";
@@ -27,9 +31,13 @@ function resolveBaseAndFormat(values) {
  * then the FRAMEDASH_API_KEY env var. Returns undefined if none is set.
  */
 export function resolveApiKey(values) {
+    return resolveApiKeyWithSource(values)?.apiKey;
+}
+/** As resolveApiKey, but also reports WHICH source supplied the key. */
+export function resolveApiKeyWithSource(values) {
     const flag = values["api-key"];
     if (flag)
-        return flag;
+        return { apiKey: flag, source: "flag" };
     const file = values["api-key-file"];
     if (file) {
         const label = file === "-" ? "stdin" : file;
@@ -52,15 +60,38 @@ export function resolveApiKey(values) {
             error(`--api-key-file (${label}) is empty`);
             process.exit(1);
         }
-        return key;
+        return { apiKey: key, source: "file" };
     }
-    return process.env.FRAMEDASH_API_KEY;
+    const envKey = process.env.FRAMEDASH_API_KEY;
+    return envKey ? { apiKey: envKey, source: "env" } : undefined;
+}
+/**
+ * Resolve the credential for the given base URL. API keys (flag > file > env)
+ * win over a stored OAuth login; the OAuth token store is consulted only for
+ * the resolved base URL's exact origin. Returns undefined when nothing is set.
+ *
+ * NOTE: throws a TypeError (from `new URL`) when `baseUrl` is not a valid
+ * URL and no API key short-circuits the lookup. Callers that accept raw user
+ * input for the base URL (map-capture) must validate or catch accordingly;
+ * resolveConfig* callers are safe because resolveBaseAndFormat has already
+ * vetted the URL.
+ */
+export function resolveCredential(values, baseUrl) {
+    const key = resolveApiKeyWithSource(values);
+    if (key)
+        return { kind: "api-key", ...key };
+    const origin = new URL(baseUrl).origin;
+    const entry = readStoredEntry(origin);
+    if (entry)
+        return { kind: "oauth", origin, entry };
+    return undefined;
 }
 /** Resolve global CLI config from parsed flags and environment variables. */
 export function resolveConfig(values) {
-    const apiKey = resolveApiKey(values);
-    if (!apiKey) {
-        error("--api-key, --api-key-file, or FRAMEDASH_API_KEY env is required");
+    const { baseUrl, format } = resolveBaseAndFormat(values);
+    const credential = resolveCredential(values, baseUrl);
+    if (!credential) {
+        error(NO_CREDENTIAL_MESSAGE);
         process.exit(1);
     }
     const projectId = values["project-id"] ?? process.env.FRAMEDASH_PROJECT_ID;
@@ -68,18 +99,17 @@ export function resolveConfig(values) {
         error("--project-id or FRAMEDASH_PROJECT_ID env is required");
         process.exit(1);
     }
-    const { baseUrl, format } = resolveBaseAndFormat(values);
-    return { apiKey, projectId, baseUrl, format };
+    return { credential, projectId, baseUrl, format };
 }
 /** Resolve config for commands that don't require --project-id (e.g. auth). */
 export function resolveConfigWithoutProject(values) {
-    const apiKey = resolveApiKey(values);
-    if (!apiKey) {
-        error("--api-key, --api-key-file, or FRAMEDASH_API_KEY env is required");
+    const { baseUrl, format } = resolveBaseAndFormat(values);
+    const credential = resolveCredential(values, baseUrl);
+    if (!credential) {
+        error(NO_CREDENTIAL_MESSAGE);
         process.exit(1);
     }
-    const { baseUrl, format } = resolveBaseAndFormat(values);
-    return { apiKey, baseUrl, format };
+    return { credential, baseUrl, format };
 }
 /** Parse a string flag as a positive integer with a descriptive error. */
 export function parsePositiveInt(value, flagName) {

package/dist/lib/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAWpC,SAAS,oBAAoB,CAAC,MAA+B;IAI5D,MAAM,OAAO,GACX,MAAM,CAAC,UAAU,CAAwB;QAC1C,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,2BAA2B,CAAC;IAE7B,4EAA4E;IAC5E,mFAAmF;IACnF,IAAI,CAAC;QACJ,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,SAAS,GAAI,MAAM,CAAC,MAA6B,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,MAAM,CAAC;IAClG,IAAI,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QAC1E,KAAK,CAAC,mBAAmB,SAAS,4BAA4B,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,MAA+B;IAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAuB,CAAC;IACrD,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAEtB,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAuB,CAAC;IAC1D,IAAI,IAAI,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5C,6EAA6E;QAC7E,IAAI,IAAI,KAAK,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACzC,KAAK,CAAC,0EAA0E,CAAC,CAAC;YAClF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QACD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACJ,kFAAkF;YAClF,GAAG,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,KAAK,CACJ,kCAAkC,KAAK,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC/F,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,KAAK,CAAC,mBAAmB,KAAK,YAAY,CAAC,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QACD,OAAO,GAAG,CAAC;IACZ,CAAC;IAED,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;AACtC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,MAA+B;IAC5D,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,SAAS,GACb,MAAM,CAAC,YAAY,CAAwB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAClF,IAAI,CAAC,SAAS,EAAE,CAAC;QAChB,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACzD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC/C,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,2BAA2B,CAC1C,MAA+B;IAE/B,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACzD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACpC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,QAAgB;IAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACxC,KAAK,CAAC,KAAK,QAAQ,qCAAqC,KAAK,EAAE,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,QAAgB;IAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,KAAK,QAAQ,2BAA2B,KAAK,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC7B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;IACtC,cAAc,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;IAC3C,YAAY,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;IACzC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;IACvC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;IACnC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAkB,EAAE,KAAK,EAAE,GAAY,EAAE;CACvD,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,eAAe,EAAyB,MAAM,wBAAwB,CAAC;AAyBhF,MAAM,qBAAqB,GAC1B,8EAA8E;IAC9E,8FAA8F,CAAC;AAEhG,4FAA4F;AAC5F,MAAM,UAAU,oBAAoB,CAAC,MAA+B;IAInE,MAAM,OAAO,GACX,MAAM,CAAC,UAAU,CAAwB;QAC1C,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,2BAA2B,CAAC;IAE7B,4EAA4E;IAC5E,mFAAmF;IACnF,IAAI,CAAC;QACJ,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,SAAS,GAAI,MAAM,CAAC,MAA6B,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,MAAM,CAAC;IAClG,IAAI,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QAC1E,KAAK,CAAC,mBAAmB,SAAS,4BAA4B,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,MAA+B;IAC5D,OAAO,uBAAuB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;AAChD,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,uBAAuB,CACtC,MAA+B;IAE/B,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAuB,CAAC;IACrD,IAAI,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAElD,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAuB,CAAC;IAC1D,IAAI,IAAI,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5C,6EAA6E;QAC7E,IAAI,IAAI,KAAK,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACzC,KAAK,CAAC,0EAA0E,CAAC,CAAC;YAClF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QACD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACJ,kFAAkF;YAClF,GAAG,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,KAAK,CACJ,kCAAkC,KAAK,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC/F,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,KAAK,CAAC,mBAAmB,KAAK,YAAY,CAAC,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC7C,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAChC,MAA+B,EAC/B,OAAe;IAEf,MAAM,GAAG,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,GAAG,EAAE,CAAC;IAE5C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IACvC,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAEnD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,MAA+B;IAC5D,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,SAAS,GACb,MAAM,CAAC,YAAY,CAAwB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAClF,IAAI,CAAC,SAAS,EAAE,CAAC;QAChB,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACnD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,2BAA2B,CAC1C,MAA+B;IAE/B,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,QAAgB;IAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACxC,KAAK,CAAC,KAAK,QAAQ,qCAAqC,KAAK,EAAE,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,QAAgB;IAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,KAAK,QAAQ,2BAA2B,KAAK,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC7B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;IACtC,cAAc,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;IAC3C,YAAY,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;IACzC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;IACvC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE;IACnC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAkB,EAAE,KAAK,EAAE,GAAY,EAAE;CACvD,CAAC"}

package/dist/lib/create-client.d.ts

@@ -1,3 +1,29 @@
 import { ApiClient } from "@framedash/api-client";
-export declare function createClient(baseUrl: string, apiKey: string, projectId: string): ApiClient;
+import type { CliCredential } from "./config.js";
+import { OAuthTokenManager } from "./oauth/manager.js";
+export type CreateClientOptions = {
+    throwOnError?: boolean;
+};
+/** Test-only: drop cached managers so each test starts from its own entry. */
+export declare function resetOAuthManagerCacheForTests(): void;
+/**
+ * Process-shared token manager for an origin. Also used by non-ApiClient
+ * consumers (the map-capture uploader) so EVERY Bearer credential in the
+ * process rides on the same rotation state.
+ */
+export declare function getSharedOAuthManager(baseUrl: string, credential: Extract<CliCredential, {
+    kind: "oauth";
+}>): OAuthTokenManager;
+/**
+ * Create the CLI's API client from the resolved credential. By default a
+ * request error prints a message and exits the process (the right behavior
+ * for one-shot commands). Pass `throwOnError` for a client used inside a
+ * retry loop (e.g. the run-profile-test ingest poll), where a transient
+ * 429/5xx must be thrown and retried, not exit.
+ *
+ * API keys go on X-API-Key as before. A stored OAuth login gets a wrapper
+ * that refreshes near expiry, retries exactly once after a 401, and persists
+ * rotated refresh tokens.
+ */
+export declare function createClient(baseUrl: string, credential: CliCredential, projectId: string, options?: CreateClientOptions): ApiClient;
 //# sourceMappingURL=create-client.d.ts.map

package/dist/lib/create-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-client.d.ts","sourceRoot":"","sources":["../../src/lib/create-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAiB,MAAM,uBAAuB,CAAC;AAGjE,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,CAyB1F"}
+{"version":3,"file":"create-client.d.ts","sourceRoot":"","sources":["../../src/lib/create-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAY,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,EAA2B,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEhF,MAAM,MAAM,mBAAmB,GAAG;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAY7D,8EAA8E;AAC9E,wBAAgB,8BAA8B,IAAI,IAAI,CAErD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACpC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,OAAO,CAAC,aAAa,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,GACnD,iBAAiB,CAOnB;AAuBD;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAC3B,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,aAAa,EACzB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,mBAAmB,GAC3B,SAAS,CAiBX"}

package/dist/lib/create-client.js

@@ -1,30 +1,173 @@
-import { ApiClient } from "@framedash/api-client";
+import { ApiClient, ApiError } from "@framedash/api-client";
 import { error } from "./logger.js";
-export function createClient(baseUrl, apiKey, projectId) {
-    return new ApiClient({
-        baseUrl,
-        apiKey,
-        projectId,
-        onError(err) {
-            if (err.status === 429) {
-                const retryAfter = err.retryAfter;
-                if (retryAfter !== undefined) {
-                    error(`Rate limit exceeded (429). Retry after ${retryAfter}s.`);
+import { OAuthLoginRequiredError, OAuthTokenManager } from "./oauth/manager.js";
+/**
+ * ONE token manager per origin per process. Refresh tokens are single-use
+ * (rotation), so two independent managers over the same stored login would
+ * race: the second to refresh presents an already-consumed token, which the
+ * server treats as theft and answers by revoking the whole grant. Commands
+ * that build several clients (e.g. run-profile-test's exit-on-error client
+ * plus its throwing poll client) must therefore share rotation state.
+ */
+const managerCache = new Map();
+/** Test-only: drop cached managers so each test starts from its own entry. */
+export function resetOAuthManagerCacheForTests() {
+    managerCache.clear();
+}
+/**
+ * Process-shared token manager for an origin. Also used by non-ApiClient
+ * consumers (the map-capture uploader) so EVERY Bearer credential in the
+ * process rides on the same rotation state.
+ */
+export function getSharedOAuthManager(baseUrl, credential) {
+    let manager = managerCache.get(credential.origin);
+    if (!manager) {
+        manager = new OAuthTokenManager(baseUrl, credential.origin, credential.entry);
+        managerCache.set(credential.origin, manager);
+    }
+    return manager;
+}
+/** Print an ApiError (with 429 rate-limit detail) and exit -- the default for one-shot commands. */
+function printAndExit(err) {
+    if (err.status === 429) {
+        const retryAfter = err.retryAfter;
+        if (retryAfter !== undefined) {
+            error(`Rate limit exceeded (429). Retry after ${retryAfter}s.`);
+        }
+        else {
+            const reset = err.headers.get("X-RateLimit-Reset");
+            const resetNum = reset ? Number(reset) : Number.NaN;
+            const resetStr = !Number.isNaN(resetNum) && resetNum > 0
+                ? new Date(resetNum * 1000).toLocaleTimeString()
+                : "unknown";
+            error(`Rate limit exceeded (429). Resets at ${resetStr}.`);
+        }
+    }
+    else {
+        error(err.message);
+    }
+    process.exit(1);
+}
+/**
+ * Create the CLI's API client from the resolved credential. By default a
+ * request error prints a message and exits the process (the right behavior
+ * for one-shot commands). Pass `throwOnError` for a client used inside a
+ * retry loop (e.g. the run-profile-test ingest poll), where a transient
+ * 429/5xx must be thrown and retried, not exit.
+ *
+ * API keys go on X-API-Key as before. A stored OAuth login gets a wrapper
+ * that refreshes near expiry, retries exactly once after a 401, and persists
+ * rotated refresh tokens.
+ */
+export function createClient(baseUrl, credential, projectId, options) {
+    const onError = options?.throwOnError
+        ? (err) => {
+            throw err;
+        }
+        : printAndExit;
+    if (credential.kind === "api-key") {
+        return new ApiClient({ baseUrl, apiKey: credential.apiKey, projectId, onError });
+    }
+    return new OAuthApiClient(baseUrl, projectId, getSharedOAuthManager(baseUrl, credential), options);
+}
+/**
+ * ApiClient facade for the OAuth path. Extends ApiClient so the rest of the
+ * CLI (typed against ApiClient) needs no changes, but every verb delegates
+ * to a short-lived inner client carrying the CURRENT access token from the
+ * token manager; the superclass instance itself never sends a request.
+ *
+ * 401 handling: refresh once, retry once. A second failure surfaces like any
+ * other API error. A dead grant (refresh -> invalid_grant) always prints the
+ * re-login instruction and exits, even in throwOnError mode -- retry loops
+ * (which swallow thrown errors) must not spin on an unrecoverable credential.
+ */
+class OAuthApiClient extends ApiClient {
+    oauthBaseUrl;
+    oauthProjectId;
+    manager;
+    options;
+    constructor(oauthBaseUrl, oauthProjectId, manager, options) {
+        super({
+            baseUrl: oauthBaseUrl,
+            projectId: oauthProjectId,
+            // Never sent: all verbs are overridden to use the inner client.
+            accessToken: "oauth-managed-placeholder",
+            onError: (err) => {
+                throw err;
+            },
+        });
+        this.oauthBaseUrl = oauthBaseUrl;
+        this.oauthProjectId = oauthProjectId;
+        this.manager = manager;
+        this.options = options;
+    }
+    async get(path) {
+        return this.execute((client) => client.get(path));
+    }
+    async post(path, body) {
+        return this.execute((client) => client.post(path, body));
+    }
+    async patch(path, body) {
+        return this.execute((client) => client.patch(path, body));
+    }
+    async delete(path) {
+        return this.execute((client) => client.delete(path));
+    }
+    withProject(projectId) {
+        return new OAuthApiClient(this.oauthBaseUrl, projectId, this.manager, this.options);
+    }
+    buildInner(accessToken) {
+        return new ApiClient({
+            baseUrl: this.oauthBaseUrl,
+            projectId: this.oauthProjectId,
+            accessToken,
+            onError: (err) => {
+                throw err;
+            },
+        });
+    }
+    async token(forceRefresh) {
+        try {
+            return forceRefresh ? await this.manager.forceRefresh() : await this.manager.getAccessToken();
+        }
+        catch (err) {
+            if (err instanceof OAuthLoginRequiredError) {
+                error(err.message);
+                process.exit(1);
+            }
+            throw err;
+        }
+    }
+    async execute(fn) {
+        const accessToken = await this.token(false);
+        try {
+            return await fn(this.buildInner(accessToken));
+        }
+        catch (err) {
+            if (isApiError(err) && err.status === 401) {
+                // The server rejected a token we believed valid (revoked access
+                // token, clock skew): refresh and retry exactly once.
+                const freshToken = await this.token(true);
+                try {
+                    return await fn(this.buildInner(freshToken));
                 }
-                else {
-                    const reset = err.headers.get("X-RateLimit-Reset");
-                    const resetNum = reset ? Number(reset) : Number.NaN;
-                    const resetStr = !Number.isNaN(resetNum) && resetNum > 0
-                        ? new Date(resetNum * 1000).toLocaleTimeString()
-                        : "unknown";
-                    error(`Rate limit exceeded (429). Resets at ${resetStr}.`);
+                catch (retryErr) {
+                    return this.reportError(retryErr);
                 }
             }
-            else {
-                error(err.message);
-            }
-            process.exit(1);
-        },
-    });
+            return this.reportError(err);
+        }
+    }
+    reportError(err) {
+        if (isApiError(err) && !this.options?.throwOnError) {
+            printAndExit(err);
+        }
+        // throwOnError mode, or a non-API failure (network error): propagate,
+        // matching the api-key client (index.ts prints and exits).
+        throw err;
+    }
+}
+function isApiError(err) {
+    return err instanceof ApiError;
 }
 //# sourceMappingURL=create-client.js.map

package/dist/lib/create-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-client.js","sourceRoot":"","sources":["../../src/lib/create-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAiB,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,MAAc,EAAE,SAAiB;IAC9E,OAAO,IAAI,SAAS,CAAC;QACpB,OAAO;QACP,MAAM;QACN,SAAS;QACT,OAAO,CAAC,GAAa;YACpB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxB,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;gBAClC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC9B,KAAK,CAAC,0CAA0C,UAAU,IAAI,CAAC,CAAC;gBACjE,CAAC;qBAAM,CAAC;oBACP,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;oBACnD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;oBACpD,MAAM,QAAQ,GACb,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;wBACtC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,kBAAkB,EAAE;wBAChD,CAAC,CAAC,SAAS,CAAC;oBACd,KAAK,CAAC,wCAAwC,QAAQ,GAAG,CAAC,CAAC;gBAC5D,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACpB,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;KACD,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"create-client.js","sourceRoot":"","sources":["../../src/lib/create-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAIhF;;;;;;;GAOG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,EAA6B,CAAC;AAE1D,8EAA8E;AAC9E,MAAM,UAAU,8BAA8B;IAC7C,YAAY,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACpC,OAAe,EACf,UAAqD;IAErD,IAAI,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO,GAAG,IAAI,iBAAiB,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;QAC9E,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,oGAAoG;AACpG,SAAS,YAAY,CAAC,GAAa;IAClC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;QAClC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC9B,KAAK,CAAC,0CAA0C,UAAU,IAAI,CAAC,CAAC;QACjE,CAAC;aAAM,CAAC;YACP,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACpD,MAAM,QAAQ,GACb,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;gBACtC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,kBAAkB,EAAE;gBAChD,CAAC,CAAC,SAAS,CAAC;YACd,KAAK,CAAC,wCAAwC,QAAQ,GAAG,CAAC,CAAC;QAC5D,CAAC;IACF,CAAC;SAAM,CAAC;QACP,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAC3B,OAAe,EACf,UAAyB,EACzB,SAAiB,EACjB,OAA6B;IAE7B,MAAM,OAAO,GAA6B,OAAO,EAAE,YAAY;QAC9D,CAAC,CAAC,CAAC,GAAG,EAAS,EAAE;YACf,MAAM,GAAG,CAAC;QACX,CAAC;QACF,CAAC,CAAC,YAAY,CAAC;IAEhB,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,IAAI,cAAc,CACxB,OAAO,EACP,SAAS,EACT,qBAAqB,CAAC,OAAO,EAAE,UAAU,CAAC,EAC1C,OAAO,CACP,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,cAAe,SAAQ,SAAS;IAEnB;IACA;IACA;IACA;IAJlB,YACkB,YAAoB,EACpB,cAAsB,EACtB,OAA0B,EAC1B,OAA6B;QAE9C,KAAK,CAAC;YACL,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE,cAAc;YACzB,gEAAgE;YAChE,WAAW,EAAE,2BAA2B;YACxC,OAAO,EAAE,CAAC,GAAG,EAAS,EAAE;gBACvB,MAAM,GAAG,CAAC;YACX,CAAC;SACD,CAAC,CAAC;QAbc,iBAAY,GAAZ,YAAY,CAAQ;QACpB,mBAAc,GAAd,cAAc,CAAQ;QACtB,YAAO,GAAP,OAAO,CAAmB;QAC1B,YAAO,GAAP,OAAO,CAAsB;IAW/C,CAAC;IAEQ,KAAK,CAAC,GAAG,CAAc,IAAY;QAC3C,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAI,IAAI,CAAC,CAAC,CAAC;IACtD,CAAC;IAEQ,KAAK,CAAC,IAAI,CAAc,IAAY,EAAE,IAAc;QAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC;IAEQ,KAAK,CAAC,KAAK,CAAc,IAAY,EAAE,IAAa;QAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9D,CAAC;IAEQ,KAAK,CAAC,MAAM,CAAc,IAAY;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAI,IAAI,CAAC,CAAC,CAAC;IACzD,CAAC;IAEQ,WAAW,CAAC,SAAiB;QACrC,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACrF,CAAC;IAEO,UAAU,CAAC,WAAmB;QACrC,OAAO,IAAI,SAAS,CAAC;YACpB,OAAO,EAAE,IAAI,CAAC,YAAY;YAC1B,SAAS,EAAE,IAAI,CAAC,cAAc;YAC9B,WAAW;YACX,OAAO,EAAE,CAAC,GAAG,EAAS,EAAE;gBACvB,MAAM,GAAG,CAAC;YACX,CAAC;SACD,CAAC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,YAAqB;QACxC,IAAI,CAAC;YACJ,OAAO,YAAY,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC/F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;gBAC5C,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,CAAC;YACD,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,EAAqC;QAC7D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC;YACJ,OAAO,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC3C,gEAAgE;gBAChE,sDAAsD;gBACtD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,CAAC;oBACJ,OAAO,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC9C,CAAC;gBAAC,OAAO,QAAQ,EAAE,CAAC;oBACnB,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;gBACnC,CAAC;YACF,CAAC;YACD,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACF,CAAC;IAEO,WAAW,CAAC,GAAY;QAC/B,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC;YACpD,YAAY,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,GAAG,CAAC;IACX,CAAC;CACD;AAED,SAAS,UAAU,CAAC,GAAY;IAC/B,OAAO,GAAG,YAAY,QAAQ,CAAC;AAChC,CAAC"}

package/dist/lib/formatters.js

@@ -10,13 +10,105 @@ export function formatOutput(data, format) {
     }
 }
 function formatTable(data) {
+    // A single object whose values contain nested arrays/objects (e.g. the
+    // dashboard's { kpis, dailyActiveUsers, topEvents }) renders one titled
+    // section per key rather than a single blob-cell row. Flat arrays-of-objects
+    // (maps list, alerts list, builds) fall through to the plain table renderer
+    // unchanged.
+    if (isSectionedPayload(data)) {
+        return formatSections(data);
+    }
     const rows = toRows(data);
     if (rows.length === 0)
         return "(no data)";
     const firstRow = rows[0];
     if (!firstRow)
         return "(no data)";
-    const keys = Object.keys(firstRow);
+    return renderRows(rows, Object.keys(firstRow));
+}
+/**
+ * True for an envelope-style object whose every field is a nested array/object
+ * (e.g. the dashboard's { kpis, dailyActiveUsers, topEvents } or status's
+ * { project, kpis }). Records that mix scalar fields with a nested one -- such as
+ * an alert row's scalars plus channelIds: [] -- stay on the plain one-row table
+ * path, so `alerts create/update --format table` output does not regress.
+ */
+function isSectionedPayload(data) {
+    if (Array.isArray(data))
+        return false;
+    if (typeof data !== "object" || data === null)
+        return false;
+    const values = Object.values(data);
+    if (values.length === 0)
+        return false;
+    return values.every((v) => v !== null && typeof v === "object");
+}
+/** Render each top-level key of a sectioned payload as a titled sub-table. */
+function formatSections(obj) {
+    const sections = Object.entries(obj).map(([key, value]) => {
+        let table;
+        if (Array.isArray(value)) {
+            table = formatArraySection(value);
+        }
+        else if (value !== null && typeof value === "object") {
+            table = formatObjectSection(value);
+        }
+        else {
+            table = cellString(value);
+        }
+        return `## ${key}\n${table}`;
+    });
+    return sections.join("\n\n");
+}
+/** An array-of-objects section: normal table, nested objects flattened to dot-paths. */
+function formatArraySection(arr) {
+    if (arr.length === 0)
+        return "(no data)";
+    const rows = arr.map((item) => typeof item === "object" && item !== null && !Array.isArray(item)
+        ? flattenOneLevel(item)
+        : { value: item });
+    return renderRows(rows, unionKeys(rows));
+}
+/** An object section: two-column key/value rows. */
+function formatObjectSection(obj) {
+    const rows = Object.entries(obj).map(([key, value]) => ({ key, value }));
+    if (rows.length === 0)
+        return "(no data)";
+    return renderRows(rows, ["key", "value"]);
+}
+/** Flatten one level of nested objects into dot-path keys; deeper nesting stays JSON. */
+function flattenOneLevel(row) {
+    const out = {};
+    for (const [key, value] of Object.entries(row)) {
+        if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+            for (const [subKey, subValue] of Object.entries(value)) {
+                out[`${key}.${subKey}`] = subValue;
+            }
+        }
+        else {
+            out[key] = value;
+        }
+    }
+    return out;
+}
+/** Union of row keys in first-seen order. */
+function unionKeys(rows) {
+    const seen = new Set();
+    const keys = [];
+    for (const row of rows) {
+        for (const key of Object.keys(row)) {
+            if (!seen.has(key)) {
+                seen.add(key);
+                keys.push(key);
+            }
+        }
+    }
+    return keys;
+}
+/** Render aligned columns for the given rows/keys using cellString for each cell. */
+function renderRows(rows, keys) {
+    if (rows.length === 0 || keys.length === 0)
+        return "(no data)";
     const widths = keys.map((k) => Math.max(k.length, ...rows.map((r) => cellString(r[k]).length)));
     const header = keys.map((k, i) => k.padEnd(widths[i] ?? k.length)).join("  ");
     const separator = widths.map((w) => "-".repeat(w)).join("  ");

package/dist/lib/formatters.js.map

@@ -1 +1 @@
-{"version":3,"file":"formatters.js","sourceRoot":"","sources":["../../src/lib/formatters.ts"],"names":[],"mappings":"AAEA,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,IAAa,EAAE,MAAoB;IAC/D,QAAQ,MAAM,EAAE,CAAC;QAChB,KAAK,MAAM;YACV,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACtC,KAAK,OAAO;YACX,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QAC1B,KAAK,KAAK;YACT,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;AACF,CAAC;AAED,SAAS,WAAW,CAAC,IAAa;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAE1C,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,QAAQ;QAAE,OAAO,WAAW,CAAC;IAElC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAEhG,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAI;SACf,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAC7F,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO,GAAG,MAAM,KAAK,SAAS,KAAK,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,SAAS,CAAC,IAAa;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEjC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IAEzB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI;SACf,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SACtE,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO,GAAG,MAAM,KAAK,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED,gGAAgG;AAChG,SAAS,UAAU,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC/B,kFAAkF;IAClF,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;IAClC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,KAAK,GAAG,IAAI,KAAK,EAAE,CAAC;IACrB,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChG,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,IAAa;IAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACxB,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YACxC,CAAC,CAAE,IAAgC;YACnC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAClB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,CAAC,IAA+B,CAAC,CAAC;IACxF,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"formatters.js","sourceRoot":"","sources":["../../src/lib/formatters.ts"],"names":[],"mappings":"AAEA,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,IAAa,EAAE,MAAoB;IAC/D,QAAQ,MAAM,EAAE,CAAC;QAChB,KAAK,MAAM;YACV,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACtC,KAAK,OAAO;YACX,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QAC1B,KAAK,KAAK;YACT,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;AACF,CAAC;AAED,SAAS,WAAW,CAAC,IAAa;IACjC,uEAAuE;IACvE,wEAAwE;IACxE,6EAA6E;IAC7E,4EAA4E;IAC5E,aAAa;IACb,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,IAA+B,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAE1C,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,QAAQ;QAAE,OAAO,WAAW,CAAC;IAElC,OAAO,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,IAAa;IACxC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AACjE,CAAC;AAED,8EAA8E;AAC9E,SAAS,cAAc,CAAC,GAA4B;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QACzD,IAAI,KAAa,CAAC;QAClB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;aAAM,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxD,KAAK,GAAG,mBAAmB,CAAC,KAAgC,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACP,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,MAAM,GAAG,KAAK,KAAK,EAAE,CAAC;IAC9B,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAED,wFAAwF;AACxF,SAAS,kBAAkB,CAAC,GAAc;IACzC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IACzC,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAC7B,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAChE,CAAC,CAAC,eAAe,CAAC,IAA+B,CAAC;QAClD,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAClB,CAAC;IACF,OAAO,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,oDAAoD;AACpD,SAAS,mBAAmB,CAAC,GAA4B;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACzE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAC1C,OAAO,UAAU,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,yFAAyF;AACzF,SAAS,eAAe,CAAC,GAA4B;IACpD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1E,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;gBACnF,GAAG,CAAC,GAAG,GAAG,IAAI,MAAM,EAAE,CAAC,GAAG,QAAQ,CAAC;YACpC,CAAC;QACF,CAAC;aAAM,CAAC;YACP,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAClB,CAAC;IACF,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,6CAA6C;AAC7C,SAAS,SAAS,CAAC,IAA+B;IACjD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,qFAAqF;AACrF,SAAS,UAAU,CAAC,IAA+B,EAAE,IAAc;IAClE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAEhG,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAI;SACf,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAC7F,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO,GAAG,MAAM,KAAK,SAAS,KAAK,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,SAAS,CAAC,IAAa;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEjC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IAEzB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI;SACf,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SACtE,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO,GAAG,MAAM,KAAK,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED,gGAAgG;AAChG,SAAS,UAAU,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC/B,kFAAkF;IAClF,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;IAClC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,KAAK,GAAG,IAAI,KAAK,EAAE,CAAC;IACrB,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChG,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,IAAa;IAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACxB,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YACxC,CAAC,CAAE,IAAgC;YACnC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAClB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,CAAC,IAA+B,CAAC,CAAC;IACxF,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC1B,CAAC"}

package/dist/lib/logger.d.ts

@@ -5,5 +5,7 @@
  */
 export declare function log(message: string): void;
 export declare function success(message: string): void;
+/** Non-fatal warning (the run still exits 0). */
+export declare function warn(message: string): void;
 export declare function error(message: string): void;
 //# sourceMappingURL=logger.d.ts.map

package/dist/lib/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/lib/logger.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,wBAAgB,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEzC;AAED,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE7C;AAED,wBAAgB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE3C"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/lib/logger.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,wBAAgB,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEzC;AAED,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE7C;AAED,iDAAiD;AACjD,wBAAgB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE1C;AAED,wBAAgB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE3C"}

package/dist/lib/logger.js

@@ -9,6 +9,10 @@ export function log(message) {
 export function success(message) {
     process.stderr.write(`  \u2713 ${message}\n`);
 }
+/** Non-fatal warning (the run still exits 0). */
+export function warn(message) {
+    process.stderr.write(`  ! ${message}\n`);
+}
 export function error(message) {
     process.stderr.write(`  \u2717 ${message}\n`);
 }

package/dist/lib/logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/lib/logger.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,UAAU,GAAG,CAAC,OAAe;IAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,OAAe;IACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,OAAO,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,OAAe;IACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,OAAO,IAAI,CAAC,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/lib/logger.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,UAAU,GAAG,CAAC,OAAe;IAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,OAAe;IACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,OAAO,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,IAAI,CAAC,OAAe;IACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,OAAO,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,OAAe;IACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,OAAO,IAAI,CAAC,CAAC;AAC/C,CAAC"}

package/dist/lib/oauth/loopback-server.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The authorization server bounced back an OAuth error (e.g. the user hit
+ * Deny -> access_denied). Distinguished from local failures so the CLI can
+ * present it as a normal outcome rather than a bug.
+ */
+export declare class OAuthCallbackError extends Error {
+    readonly code: string;
+    constructor(code: string, description: string | null);
+}
+export type LoopbackServer = {
+    /** The ephemeral port actually bound on 127.0.0.1. */
+    port: number;
+    /** The exact redirect URI to register in the authorize request. */
+    redirectUri: string;
+    /** Resolve with the authorization code, or reject on error/timeout. */
+    waitForCallback: (timeoutMs: number) => Promise<{
+        code: string;
+    }>;
+    close: () => Promise<void>;
+};
+/**
+ * Start the loopback callback receiver. `expectedState` is the CSRF state
+ * minted for this login attempt; only a /callback request carrying exactly
+ * that state can complete the flow.
+ */
+export declare function startLoopbackServer(expectedState: string): Promise<LoopbackServer>;
+//# sourceMappingURL=loopback-server.d.ts.map

package/dist/lib/oauth/loopback-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback-server.d.ts","sourceRoot":"","sources":["../../../src/lib/oauth/loopback-server.ts"],"names":[],"mappings":"AAiCA;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;aAE3B,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EAC5B,WAAW,EAAE,MAAM,GAAG,IAAI;CAK3B;AAWD,MAAM,MAAM,cAAc,GAAG;IAC5B,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CA+HlF"}