@go-labs-sg/gosh 0.4.2 → 0.6.1

package/README.md

@@ -72,6 +72,65 @@ Commands use `--input '<json>'` for the exact validated tRPC input object. This
 
 The command registry covers every callable GOSH tRPC procedure: organizer and global-admin operations, organization invitations and membership, player workflows, public results/login procedures, uploads, and realtime subscriptions. The compile-time registry test fails whenever a new API procedure is added without a CLI command.
 
+### Templates and organization scope
+
+Template commands use the selected organization as their scope. Provide its ID in
+the input when listing or retrieving a template:
+
+```bash
+gosh template list --input '{"organizationId":"acme"}'
+gosh template get --input '{"organizationId":"acme","templateId":"template-id"}'
+```
+
+Organization members can use only templates from that organization. Global admins
+can inspect templates from all organizations with `allOrganizations: true`, then
+use any returned template when creating an event for a chosen organization:
+
+```bash
+gosh template list --input '{"allOrganizations":true}'
+gosh event create-from-template \
+	--input '{"name":"Team challenge","organizationId":"acme","templateId":"template-id"}' \
+	--target template-id \
+	--allow-state-change
+```
+
+### Shared stations and team routes
+
+Create each station once for an event. In a team event, link the same station to
+each team's route with its own order. `team set-station-routes` replaces one
+team's complete route, so provide every station that team should see in order:
+
+```bash
+gosh team station-routes --input '{"eventId":"event-id"}'
+gosh team set-station-routes \
+  --input '{"eventId":"event-id","teamId":"team-red","stationIds":["station-2","station-1"]}' \
+  --target team-red \
+  --allow-state-change
+```
+
+To update an existing route's ordering without changing its station links, use
+`gosh station reorder` with the team as `scopeTeamId`.
+
+`gosh station clone` preserves the source station's team links when
+`targetTeamId` is omitted, appending the clone to each linked team's route.
+Provide a team ID to target only that team, or `null` to add the clone to the
+event catalog without explicit team links.
+
+When creating or replacing a template, each station can include `teamOrders` to
+preserve its route order for specific teams. `teamOrder` identifies the matching
+value in that template team's `order` field:
+
+```json
+{
+  "stations": [
+    {
+      "name": "Welcome station",
+      "teamOrders": [{ "teamOrder": 0, "order": 2 }]
+    }
+  ]
+}
+```
+
 ### Local file uploads
 
 Upload commands add the local file metadata to the supplied API input, request a permission-scoped signed URL, and upload the bytes directly to storage without sending the GOSH CLI access token to storage:
@@ -147,3 +206,17 @@ Without the allow flags, an interactive terminal prints a workflow preview and r
 ## Output
 
 One-shot commands write one JSON envelope to stdout. Watch commands write newline-delimited JSON envelopes. Failures and opt-in `--debug` diagnostics go to stderr, and known secrets, payloads, join codes, share tokens, and signed URLs are redacted. `--quiet` or `-q` suppresses diagnostics.
+
+## Release verification
+
+The `gosh-cli-v*` release workflow runs
+`bun run packages/scripts/monorepo/verify-cli-release-baseline.ts gosh` to check
+and typecheck the shared credential store, typecheck the retained test setup,
+and check, typecheck, and build the GOSH CLI. It then validates the packed
+artifact and runs both the installed entry point and `gosh version` before
+publishing.
+
+Behavior changes are verified with focused temporary tests before the PR,
+following the repository's temporary-test workflow in `AGENTS.md`. Those tests
+are removed before delivery, so the release workflow does not invoke the retired
+credential-store, architecture, or product regression suites.

package/command-manifest.json

@@ -750,7 +750,7 @@
 		"path": ["station", "reorder"],
 		"procedure": "event.reorderStations",
 		"requiresAuth": true,
-		"summary": "Reorder an event's stations.",
+		"summary": "Reorder shared stations, or a selected team's station route when scopeTeamId is supplied.",
 		"targetKeys": [
 			"id",
 			"memberId",
@@ -912,6 +912,15 @@
 		"requiresAuth": true,
 		"summary": "List teams and their current members."
 	},
+	{
+		"effects": [],
+		"input": "json",
+		"operation": "query",
+		"path": ["team", "station-routes"],
+		"procedure": "team.getStationRoutes",
+		"requiresAuth": true,
+		"summary": "List each team's linked stations and team-specific route order."
+	},
 	{
 		"effects": ["state-change"],
 		"input": "json",
@@ -1104,6 +1113,38 @@
 			"name"
 		]
 	},
+	{
+		"effects": ["state-change"],
+		"input": "json",
+		"operation": "mutation",
+		"path": ["team", "set-station-routes"],
+		"procedure": "team.setStationRoutes",
+		"requiresAuth": true,
+		"summary": "Replace a team's linked station route and set its order.",
+		"targetKeys": [
+			"id",
+			"memberId",
+			"invitationId",
+			"broadcastId",
+			"rewardId",
+			"submissionId",
+			"participantId",
+			"participantIds",
+			"missionId",
+			"stationId",
+			"teamId",
+			"templateId",
+			"eventId",
+			"organizationId",
+			"userId",
+			"key",
+			"uploadId",
+			"email",
+			"joinCode",
+			"slug",
+			"name"
+		]
+	},
 	{
 		"effects": [],
 		"input": "json",
@@ -1111,7 +1152,7 @@
 		"path": ["template", "list"],
 		"procedure": "template.list",
 		"requiresAuth": true,
-		"summary": "List system and organization templates."
+		"summary": "List templates visible in an organization; global admins can include every organization."
 	},
 	{
 		"effects": [],
@@ -1120,7 +1161,7 @@
 		"path": ["template", "get"],
 		"procedure": "template.getById",
 		"requiresAuth": true,
-		"summary": "Get a template by ID."
+		"summary": "Get a template visible in the requested organization; global admins can get any template."
 	},
 	{
 		"effects": ["state-change"],
@@ -1129,7 +1170,7 @@
 		"path": ["template", "create"],
 		"procedure": "template.create",
 		"requiresAuth": true,
-		"summary": "Create an organization template.",
+		"summary": "Create an organization template, including shared stations with optional per-team route order.",
 		"targetKeys": ["organizationId", "name"]
 	},
 	{
@@ -1139,7 +1180,7 @@
 		"path": ["template", "update"],
 		"procedure": "template.update",
 		"requiresAuth": true,
-		"summary": "Replace a template's setup.",
+		"summary": "Replace a template's setup, including shared stations with optional per-team route order.",
 		"targetKeys": [
 			"id",
 			"memberId",

package/command-reference.md

@@ -316,7 +316,7 @@ Archive a station.
 
 ## `gosh station reorder`
 
-Reorder an event's stations.
+Reorder shared stations, or a selected team's station route when scopeTeamId is supplied.
 
 - Authentication: browser-authenticated CLI session required
 - Input: `--input '<json>'` required
@@ -362,6 +362,14 @@ List teams and their current members.
 - Input: `--input '<json>'` required
 - Effects: read-only
 
+## `gosh team station-routes`
+
+List each team's linked stations and team-specific route order.
+
+- Authentication: browser-authenticated CLI session required
+- Input: `--input '<json>'` required
+- Effects: read-only
+
 ## `gosh team create`
 
 Create a team.
@@ -410,9 +418,17 @@ Change who can submit missions in team play.
 - Input: `--input '<json>'` required
 - Effects: state-change
 
+## `gosh team set-station-routes`
+
+Replace a team's linked station route and set its order.
+
+- Authentication: browser-authenticated CLI session required
+- Input: `--input '<json>'` required
+- Effects: state-change
+
 ## `gosh template list`
 
-List system and organization templates.
+List templates visible in an organization; global admins can include every organization.
 
 - Authentication: browser-authenticated CLI session required
 - Input: `--input '<json>'` required
@@ -420,7 +436,7 @@ List system and organization templates.
 
 ## `gosh template get`
 
-Get a template by ID.
+Get a template visible in the requested organization; global admins can get any template.
 
 - Authentication: browser-authenticated CLI session required
 - Input: `--input '<json>'` required
@@ -428,7 +444,7 @@ Get a template by ID.
 
 ## `gosh template create`
 
-Create an organization template.
+Create an organization template, including shared stations with optional per-team route order.
 
 - Authentication: browser-authenticated CLI session required
 - Input: `--input '<json>'` required
@@ -436,7 +452,7 @@ Create an organization template.
 
 ## `gosh template update`
 
-Replace a template's setup.
+Replace a template's setup, including shared stations with optional per-team route order.
 
 - Authentication: browser-authenticated CLI session required
 - Input: `--input '<json>'` required

package/dist/index.js

@@ -375,6 +375,20 @@ import_dotenv.config({ path: path.resolve(process.cwd(), ".env"), quiet: true })
 // src/cli.ts
 import { readFileSync } from "fs";
 
+// ../../cli-auth/src/client/credential-store.ts
+import { createHash as createHash2, randomUUID } from "crypto";
+import {
+  chmod,
+  lstat,
+  mkdir,
+  open as open2,
+  readFile,
+  stat,
+  unlink
+} from "fs/promises";
+import { userInfo } from "os";
+import { join } from "path";
+
 // ../../cli-auth/src/protocol/constants.ts
 var CLI_ACCESS_TOKEN_TTL_MS = 15 * 60 * 1000;
 var CLI_DEVICE_AUTHORIZATION_TTL_MS = 10 * 60 * 1000;
@@ -19028,13 +19042,15 @@ var deviceTokenErrorSchema = exports_external.object({
     "authorization_pending",
     "slow_down",
     "access_denied",
-    "expired_token"
+    "expired_token",
+    "invalid_grant"
   ])
 }).strict();
 var refreshRequestSchema = exports_external.object({ refreshToken: exports_external.string().min(40) }).strict();
 var storedCliCredentialsSchema = exports_external.object({
   accessToken: exports_external.string().min(1),
   accessTokenExpiresAt: dateTimeString,
+  issuer: exports_external.string().url().optional(),
   refreshToken: exports_external.string().min(1),
   refreshTokenExpiresAt: dateTimeString,
   session: cliSessionIdentitySchema
@@ -19086,6 +19102,77 @@ var defaultSecrets = () => {
   assertBunRuntime();
   return Bun.secrets;
 };
+var refreshLockTimeoutMs = 5 * 60 * 1000;
+var refreshLockRetryMs = 50;
+var getCredentialLockDirectoryPath = () => {
+  return join(userInfo().homedir, ".cache", "go-labs-cli", "locks");
+};
+var ensurePrivateCredentialLockDirectory = async () => {
+  const directory = getCredentialLockDirectoryPath();
+  await mkdir(directory, { mode: 448, recursive: true });
+  const inspectDirectory = async () => {
+    const directoryStat2 = await lstat(directory);
+    if (directoryStat2.isSymbolicLink() || !directoryStat2.isDirectory()) {
+      throw new Error("The CLI credential lock path is not a private directory.");
+    }
+    const uid = process.getuid?.();
+    if (uid !== undefined && directoryStat2.uid !== uid) {
+      throw new Error("The CLI credential lock directory belongs to another user.");
+    }
+    return directoryStat2;
+  };
+  const directoryStat = await inspectDirectory();
+  if ((directoryStat.mode & 63) !== 0) {
+    await chmod(directory, 448);
+    const securedDirectoryStat = await inspectDirectory();
+    if ((securedDirectoryStat.mode & 63) !== 0) {
+      throw new Error("Unable to secure the CLI credential lock directory.");
+    }
+  }
+  return directory;
+};
+var getCredentialLockPath = async (product, account) => {
+  const key = createHash2("sha256").update(`${product}:${account}`).digest("hex");
+  return join(await ensurePrivateCredentialLockDirectory(), `${key}.lock`);
+};
+var acquireRefreshLock = async (path2) => {
+  const deadline = Date.now() + refreshLockTimeoutMs;
+  while (Date.now() < deadline) {
+    try {
+      const handle = await open2(path2, "wx");
+      const owner = randomUUID();
+      try {
+        await handle.writeFile(owner);
+      } catch (cause) {
+        await handle.close().catch(() => {
+          return;
+        });
+        await unlink(path2).catch(() => {
+          return;
+        });
+        throw cause;
+      }
+      return { handle, owner };
+    } catch (cause) {
+      if (!(cause instanceof Error) || !("code" in cause) || cause.code !== "EEXIST") {
+        throw cause;
+      }
+      try {
+        const lock = await stat(path2);
+        if (Date.now() - lock.mtimeMs > refreshLockTimeoutMs) {
+          throw new Error(`The CLI credential lock appears stale at ${path2}. Ensure no CLI authentication command is running, remove that lock file, and retry.`);
+        }
+      } catch (statCause) {
+        if (statCause instanceof Error && "code" in statCause && statCause.code === "ENOENT") {
+          continue;
+        }
+        throw statCause;
+      }
+      await Bun.sleep(refreshLockRetryMs);
+    }
+  }
+  throw new Error("Timed out waiting for another CLI process to refresh credentials. Retry the command.");
+};
 var createBunCredentialStore = ({
   account = "default",
   product,
@@ -19113,16 +19200,46 @@ var createBunCredentialStore = ({
         service,
         value: JSON.stringify(parsed)
       }));
+    },
+    withCredentialLock: async (operation) => {
+      const refreshLockPath = await getCredentialLockPath(product, account);
+      const lock = await acquireRefreshLock(refreshLockPath);
+      try {
+        return await operation();
+      } finally {
+        await lock.handle.close();
+        const owner = await readFile(refreshLockPath, "utf8").catch(() => null);
+        if (owner === lock.owner) {
+          await unlink(refreshLockPath).catch(() => {
+            return;
+          });
+        }
+      }
     }
   };
 };
 // ../../cli-auth/src/client/login.ts
 import { hostname as hostname3 } from "os";
-var normalizeBaseUrl = (value) => value.replace(/\/+$/, "");
-var postJson = async (fetchImplementation, url2, body) => fetchImplementation(url2, {
+var normalizeCliAuthIssuer = (value) => {
+  const url2 = new URL(value);
+  url2.hash = "";
+  url2.search = "";
+  url2.pathname = url2.pathname.replace(/\/+$/, "");
+  return url2.toString().replace(/\/+$/, "");
+};
+var isCliCredentialForIssuer = (credentials, apiBaseUrl) => credentials.issuer === normalizeCliAuthIssuer(apiBaseUrl);
+var credentialIssuerError = (issuer) => issuer ? new Error("These CLI credentials belong to a different API URL. Run auth login for this API URL before retrying.") : new Error("These CLI credentials were created by an older CLI and are not bound to an API URL. Run auth login again.");
+var assertCredentialIssuer = (credentials, apiBaseUrl) => {
+  const expectedIssuer = normalizeCliAuthIssuer(apiBaseUrl);
+  if (!credentials.issuer || credentials.issuer !== expectedIssuer) {
+    throw credentialIssuerError(credentials.issuer);
+  }
+};
+var postJson = async (fetchImplementation, url2, body, options = {}) => fetchImplementation(url2, {
   body: JSON.stringify(body),
   headers: { "content-type": "application/json" },
-  method: "POST"
+  method: "POST",
+  ...options
 });
 var readJson = async (response) => {
   try {
@@ -19131,9 +19248,29 @@ var readJson = async (response) => {
     throw new Error(`CLI authentication returned HTTP ${response.status} without valid JSON.`);
   }
 };
-var toStoredCredentials = (response, now) => ({
+var localCredentialLocks = new WeakMap;
+var withCredentialLock = (store, operation) => {
+  if (store.withCredentialLock) {
+    return store.withCredentialLock(operation);
+  }
+  const previous = localCredentialLocks.get(store) ?? Promise.resolve();
+  const pending = previous.then(operation, operation);
+  const tail = pending.then(() => {
+    return;
+  }, () => {
+    return;
+  });
+  localCredentialLocks.set(store, tail);
+  return pending.finally(() => {
+    if (localCredentialLocks.get(store) === tail) {
+      localCredentialLocks.delete(store);
+    }
+  });
+};
+var toStoredCredentials = (response, issuer, now) => ({
   accessToken: response.accessToken,
   accessTokenExpiresAt: new Date(now.getTime() + response.expiresIn * 1000).toISOString(),
+  issuer,
   refreshToken: response.refreshToken,
   refreshTokenExpiresAt: new Date(now.getTime() + response.refreshExpiresIn * 1000).toISOString(),
   session: response.session
@@ -19167,7 +19304,7 @@ var loginWithBrowser = async ({
   sleep = (milliseconds) => Bun.sleep(milliseconds),
   store
 }) => {
-  const baseUrl = normalizeBaseUrl(apiBaseUrl);
+  const baseUrl = normalizeCliAuthIssuer(apiBaseUrl);
   const pkce = createPkcePair();
   const beginResponse = await postJson(fetchImplementation, `${baseUrl}/api/cli-auth/device`, {
     clientName,
@@ -19194,8 +19331,8 @@ var loginWithBrowser = async ({
     const payload = await readJson(response);
     if (response.ok) {
       const issued = tokenResponseSchema.parse(payload);
-      const credentials = toStoredCredentials(issued, now());
-      await store.set(credentials);
+      const credentials = toStoredCredentials(issued, baseUrl, now());
+      await withCredentialLock(store, () => store.set(credentials));
       return credentials;
     }
     const error61 = deviceTokenErrorSchema.safeParse(payload);
@@ -19216,6 +19353,26 @@ var loginWithBrowser = async ({
   throw new Error("CLI authentication expired. Run auth login again.");
 };
 var refreshes = new WeakMap;
+var refreshRequestTimeoutMs = 30000;
+var isInvalidGrantResponse = (payload) => {
+  const parsed = deviceTokenErrorSchema.safeParse(payload);
+  return parsed.success && parsed.data.error === "invalid_grant";
+};
+var readJsonOrNull = async (response) => {
+  try {
+    return await response.json();
+  } catch {
+    return null;
+  }
+};
+var deleteInvalidCredentials = async (store, credentials) => {
+  const current = await store.get();
+  if (!current)
+    return;
+  if (current.issuer === credentials.issuer && current.refreshToken === credentials.refreshToken) {
+    await store.delete();
+  }
+};
 var refreshAccessToken = async ({
   apiBaseUrl,
   credentials,
@@ -19223,16 +19380,56 @@ var refreshAccessToken = async ({
   now,
   store
 }) => {
-  const response = await postJson(fetchImplementation, `${normalizeBaseUrl(apiBaseUrl)}/api/cli-auth/refresh`, { refreshToken: credentials.refreshToken });
+  assertCredentialIssuer(credentials, apiBaseUrl);
+  let response;
+  try {
+    response = await postJson(fetchImplementation, `${normalizeCliAuthIssuer(apiBaseUrl)}/api/cli-auth/refresh`, { refreshToken: credentials.refreshToken }, { signal: AbortSignal.timeout(refreshRequestTimeoutMs) });
+  } catch {
+    throw new Error("Unable to refresh the CLI session because the API could not be reached. Credentials were kept; retry the command.");
+  }
   if (!response.ok) {
-    await store.delete();
-    throw new Error("The CLI session expired or was revoked. Run auth login again.");
+    const payload2 = await readJsonOrNull(response);
+    if (isInvalidGrantResponse(payload2)) {
+      await deleteInvalidCredentials(store, credentials);
+      throw new Error("The CLI session expired or was revoked. Run auth login again.");
+    }
+    throw new Error(`Unable to refresh the CLI session (HTTP ${response.status}). Credentials were kept; retry the command.`);
   }
-  const issued = tokenResponseSchema.parse(await readJson(response));
-  const stored = toStoredCredentials(issued, now());
+  const payload = await readJsonOrNull(response);
+  if (payload === null) {
+    throw new Error("Unable to refresh the CLI session because the API returned malformed JSON. Credentials were kept; retry the command.");
+  }
+  let issued;
+  try {
+    issued = tokenResponseSchema.parse(payload);
+  } catch {
+    throw new Error("Unable to refresh the CLI session because the API returned invalid credentials. Credentials were kept; retry the command.");
+  }
+  const stored = toStoredCredentials(issued, normalizeCliAuthIssuer(apiBaseUrl), now());
   await store.set(stored);
   return stored.accessToken;
 };
+var refreshWithCurrentCredentials = async ({
+  apiBaseUrl,
+  fetch: fetchImplementation,
+  now,
+  store
+}) => {
+  const credentials = await store.get();
+  if (!credentials)
+    throw new Error("Not authenticated. Run auth login first.");
+  assertCredentialIssuer(credentials, apiBaseUrl);
+  if (Date.parse(credentials.accessTokenExpiresAt) - now().getTime() > 60000) {
+    return credentials.accessToken;
+  }
+  return refreshAccessToken({
+    apiBaseUrl,
+    credentials,
+    fetch: fetchImplementation,
+    now,
+    store
+  });
+};
 var getAuthenticatedAccessToken = async ({
   apiBaseUrl,
   fetch: fetchImplementation = globalThis.fetch,
@@ -19242,19 +19439,20 @@ var getAuthenticatedAccessToken = async ({
   const credentials = await store.get();
   if (!credentials)
     throw new Error("Not authenticated. Run auth login first.");
+  assertCredentialIssuer(credentials, apiBaseUrl);
   if (Date.parse(credentials.accessTokenExpiresAt) - now().getTime() > 60000) {
     return credentials.accessToken;
   }
   const existing = refreshes.get(store);
   if (existing)
     return existing;
-  const refresh = refreshAccessToken({
+  const refreshOperation = () => withCredentialLock(store, () => refreshWithCurrentCredentials({
     apiBaseUrl,
-    credentials,
     fetch: fetchImplementation,
     now,
     store
-  }).finally(() => refreshes.delete(store));
+  }));
+  const refresh = refreshOperation().finally(() => refreshes.delete(store));
   refreshes.set(store, refresh);
   return refresh;
 };
@@ -19263,18 +19461,22 @@ var logoutCliSession = async ({
   fetch: fetchImplementation = globalThis.fetch,
   store
 }) => {
-  const credentials = await store.get();
-  let remoteRevoked = credentials === null;
-  if (credentials) {
-    try {
-      const response = await postJson(fetchImplementation, `${normalizeBaseUrl(apiBaseUrl)}/api/cli-auth/revoke`, { refreshToken: credentials.refreshToken });
-      remoteRevoked = response.ok;
-    } catch {
-      remoteRevoked = false;
+  const issuer = normalizeCliAuthIssuer(apiBaseUrl);
+  return withCredentialLock(store, async () => {
+    const credentials = await store.get();
+    let remoteRevoked = credentials === null;
+    if (credentials) {
+      try {
+        assertCredentialIssuer(credentials, apiBaseUrl);
+        const response = await postJson(fetchImplementation, `${issuer}/api/cli-auth/revoke`, { refreshToken: credentials.refreshToken }, { signal: AbortSignal.timeout(refreshRequestTimeoutMs) });
+        remoteRevoked = response.ok;
+      } catch {
+        remoteRevoked = false;
+      }
     }
-  }
-  await store.delete();
-  return { remoteRevoked };
+    await store.delete();
+    return { remoteRevoked };
+  });
 };
 // src/api-client.ts
 import {
@@ -19866,6 +20068,10 @@ var typedOperations = {
     kind: "query",
     invoke: (client, input2) => client.team.list.query(input2)
   },
+  "team.getStationRoutes": {
+    kind: "query",
+    invoke: (client, input2) => client.team.getStationRoutes.query(input2)
+  },
   "team.create": {
     kind: "mutation",
     invoke: (client, input2) => client.team.create.mutate(input2)
@@ -19890,6 +20096,10 @@ var typedOperations = {
     kind: "mutation",
     invoke: (client, input2) => client.team.setSubmissionAccess.mutate(input2)
   },
+  "team.setStationRoutes": {
+    kind: "mutation",
+    invoke: (client, input2) => client.team.setStationRoutes.mutate(input2)
+  },
   "template.list": {
     kind: "query",
     invoke: (client, input2) => client.template.list.query(input2)
@@ -20363,7 +20573,7 @@ var commands = [
   ]),
   mutation(["station", "clone"], "event.cloneStation", "Clone a station and its missions.", ["state-change"]),
   mutation(["station", "archive"], "event.archiveStation", "Archive a station.", ["state-change", "delete"]),
-  mutation(["station", "reorder"], "event.reorderStations", "Reorder an event's stations.", ["state-change"]),
+  mutation(["station", "reorder"], "event.reorderStations", "Reorder shared stations, or a selected team's station route when scopeTeamId is supplied.", ["state-change"]),
   mutation(["mission", "create"], "event.createMission", "Create a mission in a station.", ["state-change"]),
   mutation(["mission", "update"], "event.updateMission", "Update a mission.", [
     "state-change"
@@ -20371,6 +20581,7 @@ var commands = [
   mutation(["mission", "archive"], "event.archiveMission", "Archive a mission.", ["state-change", "delete"]),
   mutation(["mission", "reorder"], "event.reorderMissions", "Reorder missions within a station.", ["state-change"]),
   query(["team", "list"], "team.list", "List teams and their current members."),
+  query(["team", "station-routes"], "team.getStationRoutes", "List each team's linked stations and team-specific route order."),
   mutation(["team", "create"], "team.create", "Create a team.", [
     "state-change"
   ]),
@@ -20381,10 +20592,11 @@ var commands = [
   mutation(["team", "remove-member"], "team.removeMember", "Remove a member from a team.", ["state-change", "delete"]),
   mutation(["team", "set-play-mode"], "team.setPlayMode", "Change an event between individual and team play.", ["state-change"]),
   mutation(["team", "set-submission-access"], "team.setSubmissionAccess", "Change who can submit missions in team play.", ["state-change"]),
-  query(["template", "list"], "template.list", "List system and organization templates."),
-  query(["template", "get"], "template.getById", "Get a template by ID."),
-  mutation(["template", "create"], "template.create", "Create an organization template.", ["state-change"]),
-  mutation(["template", "update"], "template.update", "Replace a template's setup.", ["state-change"]),
+  mutation(["team", "set-station-routes"], "team.setStationRoutes", "Replace a team's linked station route and set its order.", ["state-change"]),
+  query(["template", "list"], "template.list", "List templates visible in an organization; global admins can include every organization."),
+  query(["template", "get"], "template.getById", "Get a template visible in the requested organization; global admins can get any template."),
+  mutation(["template", "create"], "template.create", "Create an organization template, including shared stations with optional per-team route order.", ["state-change"]),
+  mutation(["template", "update"], "template.update", "Replace a template's setup, including shared stations with optional per-team route order.", ["state-change"]),
   mutation(["template", "update-metadata"], "template.updateMetadata", "Update template metadata.", ["state-change"]),
   mutation(["template", "delete"], "template.delete", "Delete a template.", [
     "state-change",
@@ -20491,7 +20703,7 @@ var findCommand = (positional) => {
   return;
 };
 // src/features/upload.ts
-import { open as open2, readFile, stat } from "fs/promises";
+import { open as open3, readFile as readFile2, stat as stat2 } from "fs/promises";
 import { basename, extname } from "path";
 var contentTypes = {
   ".gif": "image/gif",
@@ -20561,7 +20773,7 @@ var uploadMultipartMissionMedia = async ({
   input: input2,
   metadata
 }) => {
-  const file2 = await open2(filePath, "r");
+  const file2 = await open3(filePath, "r");
   const completedParts = [];
   try {
     for (const part of metadata.parts) {
@@ -20607,7 +20819,7 @@ var uploadFileForCommand = async ({
   if (!isRecord2(input2)) {
     throw new CliError("VALIDATION", "Upload command input must be an object.");
   }
-  const file2 = await stat(filePath).catch(() => null);
+  const file2 = await stat2(filePath).catch(() => null);
   if (!file2?.isFile()) {
     throw new CliError("VALIDATION", `File not found: ${filePath}`);
   }
@@ -20634,7 +20846,7 @@ var uploadFileForCommand = async ({
     return { completed, key: multipart.key, strategy: multipart.strategy };
   }
   const single = asSingleResult(requested);
-  const singleFile = await readFile(filePath);
+  const singleFile = await readFile2(filePath);
   await putPart(single.uploadUrl, singleFile.buffer.slice(singleFile.byteOffset, singleFile.byteOffset + singleFile.byteLength), contentType);
   return {
     ...single.imageUrl ? { imageUrl: single.imageUrl } : {},
@@ -20842,7 +21054,7 @@ Waiting for approval\u2026
     }
     if (first === "auth" && rest[0] === "status" && rest.length === 1) {
       const credentials = await credentialStore.get();
-      return emitSuccess(dependencies.runtime, { apiBaseUrl, cliVersion: GOSH_CLI_VERSION, command: "auth status" }, credentials ? {
+      return emitSuccess(dependencies.runtime, { apiBaseUrl, cliVersion: GOSH_CLI_VERSION, command: "auth status" }, credentials && isCliCredentialForIssuer(credentials, apiBaseUrl) ? {
         authenticated: true,
         accessTokenExpiresAt: credentials.accessTokenExpiresAt,
         refreshTokenExpiresAt: credentials.refreshTokenExpiresAt,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@go-labs-sg/gosh",
-  "version": "0.4.2",
+  "version": "0.6.1",
   "description": "GOSH CLI for organizers and AI agents — manage organizations, events, teams, stations, missions, templates, and live operations through the GOSH API.",
   "type": "module",
   "main": "./dist/index.js",