@go-labs-sg/rsvp 0.3.0 → 0.6.1

package/README.md

@@ -49,18 +49,53 @@ rsvp auth status
 rsvp auth whoami
 ```
 
-`rsvp auth login` opens RSVP in the system browser. Sign in through RSVP's normal Google-backed web flow if needed, verify that the displayed device and code match the terminal, then click **Authorize CLI**. Existing browser sessions skip another Google login but never skip explicit CLI approval.
+`rsvp auth login` opens RSVP in the system browser. Sign in through RSVP's normal email one-time-password flow if needed, verify that the displayed device code matches the terminal, then click **Authorize CLI**. Existing browser sessions skip another email-code prompt but never skip explicit CLI approval.
 
 RSVP CLI access is limited to global administrators. The server rechecks the account's current global role and ban state when issuing, refreshing, and authenticating CLI credentials, so removing the admin role immediately blocks further CLI access.
 
-The CLI polls automatically and stores only RSVP-issued credentials through `Bun.secrets`. It does not store Google credentials and has no API-key or environment-variable fallback. Use `rsvp auth logout` to revoke the remote session and remove its local credential. For SSH or containers, pass `--no-browser` and open the printed URL on another device.
+The CLI polls automatically and stores only RSVP-issued credentials through `Bun.secrets`. It does not store browser or email-OTP credentials and has no API-key or environment-variable fallback. Use `rsvp auth logout` to revoke the remote session and remove its local credential. For SSH or containers, pass `--no-browser` and open the printed URL on another device.
 
 The default API is `https://rsvp.getout.events`. Override it with `RSVP_API_URL` or `--api-url`; non-local overrides must use HTTPS.
 
+Global administrators can update another account's global role from the web user manager or with `rsvp user role update --allow-state-change --target <user-id> --payload '{"userId":"<user-id>","role":"admin"}'`. Administrators cannot remove their own global admin role.
+
 ## Command safety
 
+Argument-parsing errors use a safe command label and never echo option values,
+including roster JSON passed through `--payload`. Surrounding shell history and
+automation can still record arguments independently of the CLI's error output.
+
 Use `rsvp help` for the command catalogue. Every response is a JSON envelope on stdout; errors and diagnostics go to stderr. `rsvp manifest` emits the machine-readable command reference for tooling.
 
+For a read-only registration-journey diagnosis, inspect the event, draft,
+published versions, and event-owned resources together:
+
+```sh
+rsvp event get --organization-id org_123 --event-id evt_123
+rsvp event flow draft get --organization-id org_123 --event-id evt_123
+rsvp event flow versions list --organization-id org_123 --event-id evt_123
+rsvp event flow resources get --organization-id org_123 --event-id evt_123
+```
+
+Create an immutable menu version with an explicit mutation acknowledgement. The
+target is the event ID in the payload:
+
+```sh
+rsvp event flow menu version create \
+  --allow-state-change \
+  --target evt_123 \
+  --payload '{"organizationId":"org_123","eventId":"evt_123","menu":{"mode":"NEW","key":"dinner","name":"Dinner"},"choices":[{"key":"standard","label":"Standard meal","dietaryTags":[]}]}'
+```
+
+To version an existing menu, use `"menu":{"mode":"EXISTING","menuId":"..."}`
+in the payload and keep the event ID as `--target`.
+
+Reference the returned `version.id` from the draft's `MENU_SELECTION` blocks,
+then save with `event flow draft save`, `--allow-state-change`, and the event ID
+as `--target`. Include the latest draft revision as `expectedRevision`; nested
+resource IDs such as a seating block's `seatMapId` are not approval targets for
+this command. Saving the draft does not publish the registration flow.
+
 Commands returning invitee, registration, roster, report, audit, export, payment, or user data require `--ack-sensitive-data`. Mutations require their exact effect gates and a `--target` matching the affected resource in the payload. Depending on the operation, gates include:
 
 - `--allow-state-change`

package/dist/index.js

@@ -1,38 +1,6 @@
-#!/usr/bin/env bun
+#!/usr/bin/env -S bun --no-env-file
 // @bun
-var __create = Object.create;
-var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-function __accessProp(key) {
-  return this[key];
-}
-var __toESMCache_node;
-var __toESMCache_esm;
-var __toESM = (mod, isNodeMode, target) => {
-  var canCache = mod != null && typeof mod === "object";
-  if (canCache) {
-    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
-    var cached = cache.get(mod);
-    if (cached)
-      return cached;
-  }
-  target = mod != null ? __create(__getProtoOf(mod)) : {};
-  const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
-  if (mod && typeof mod === "object" || typeof mod === "function") {
-    for (let key of __getOwnPropNames(mod))
-      if (!__hasOwnProp.call(to, key))
-        __defProp(to, key, {
-          get: __accessProp.bind(mod, key),
-          enumerable: true
-        });
-  }
-  if (canCache)
-    cache.set(mod, to);
-  return to;
-};
-var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
 var __returnValue = (v) => v;
 function __exportSetter(name, newValue) {
   this[name] = __returnValue.bind(null, newValue);
@@ -46,334 +14,24 @@ var __export = (target, all) => {
       set: __exportSetter.bind(all, name)
     });
 };
-var __require = import.meta.require;
-
-// ../../../node_modules/.bun/dotenv@17.4.2/node_modules/dotenv/lib/main.js
-var require_main = __commonJS(function(exports, module) {
-  var fs = __require("fs");
-  var path = __require("path");
-  var os = __require("os");
-  var crypto = __require("crypto");
-  var TIPS = [
-    "\u25C8 encrypted .env [www.dotenvx.com]",
-    "\u25C8 secrets for agents [www.dotenvx.com]",
-    "\u2301 auth for agents [www.vestauth.com]",
-    "\u2318 custom filepath { path: '/custom/path/.env' }",
-    "\u2318 enable debugging { debug: true }",
-    "\u2318 override existing { override: true }",
-    "\u2318 suppress logs { quiet: true }",
-    "\u2318 multiple files { path: ['.env.local', '.env'] }"
-  ];
-  function _getRandomTip() {
-    return TIPS[Math.floor(Math.random() * TIPS.length)];
-  }
-  function parseBoolean(value) {
-    if (typeof value === "string") {
-      return !["false", "0", "no", "off", ""].includes(value.toLowerCase());
-    }
-    return Boolean(value);
-  }
-  function supportsAnsi() {
-    return process.stdout.isTTY;
-  }
-  function dim(text) {
-    return supportsAnsi() ? `\x1B[2m${text}\x1B[0m` : text;
-  }
-  var LINE = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/mg;
-  function parse(src) {
-    const obj = {};
-    let lines = src.toString();
-    lines = lines.replace(/\r\n?/mg, `
-`);
-    let match;
-    while ((match = LINE.exec(lines)) != null) {
-      const key = match[1];
-      let value = match[2] || "";
-      value = value.trim();
-      const maybeQuote = value[0];
-      value = value.replace(/^(['"`])([\s\S]*)\1$/mg, "$2");
-      if (maybeQuote === '"') {
-        value = value.replace(/\\n/g, `
-`);
-        value = value.replace(/\\r/g, "\r");
-      }
-      obj[key] = value;
-    }
-    return obj;
-  }
-  function _parseVault(options) {
-    options = options || {};
-    const vaultPath = _vaultPath(options);
-    options.path = vaultPath;
-    const result = DotenvModule.configDotenv(options);
-    if (!result.parsed) {
-      const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`);
-      err.code = "MISSING_DATA";
-      throw err;
-    }
-    const keys = _dotenvKey(options).split(",");
-    const length = keys.length;
-    let decrypted;
-    for (let i = 0;i < length; i++) {
-      try {
-        const key = keys[i].trim();
-        const attrs = _instructions(result, key);
-        decrypted = DotenvModule.decrypt(attrs.ciphertext, attrs.key);
-        break;
-      } catch (error) {
-        if (i + 1 >= length) {
-          throw error;
-        }
-      }
-    }
-    return DotenvModule.parse(decrypted);
-  }
-  function _warn(message) {
-    console.error(`\u26A0 ${message}`);
-  }
-  function _debug(message) {
-    console.log(`\u2506 ${message}`);
-  }
-  function _log(message) {
-    console.log(`\u25C7 ${message}`);
-  }
-  function _dotenvKey(options) {
-    if (options && options.DOTENV_KEY && options.DOTENV_KEY.length > 0) {
-      return options.DOTENV_KEY;
-    }
-    if (process.env.DOTENV_KEY && process.env.DOTENV_KEY.length > 0) {
-      return process.env.DOTENV_KEY;
-    }
-    return "";
-  }
-  function _instructions(result, dotenvKey) {
-    let uri;
-    try {
-      uri = new URL(dotenvKey);
-    } catch (error) {
-      if (error.code === "ERR_INVALID_URL") {
-        const err = new Error("INVALID_DOTENV_KEY: Wrong format. Must be in valid uri format like dotenv://:key_1234@dotenvx.com/vault/.env.vault?environment=development");
-        err.code = "INVALID_DOTENV_KEY";
-        throw err;
-      }
-      throw error;
-    }
-    const key = uri.password;
-    if (!key) {
-      const err = new Error("INVALID_DOTENV_KEY: Missing key part");
-      err.code = "INVALID_DOTENV_KEY";
-      throw err;
-    }
-    const environment = uri.searchParams.get("environment");
-    if (!environment) {
-      const err = new Error("INVALID_DOTENV_KEY: Missing environment part");
-      err.code = "INVALID_DOTENV_KEY";
-      throw err;
-    }
-    const environmentKey = `DOTENV_VAULT_${environment.toUpperCase()}`;
-    const ciphertext = result.parsed[environmentKey];
-    if (!ciphertext) {
-      const err = new Error(`NOT_FOUND_DOTENV_ENVIRONMENT: Cannot locate environment ${environmentKey} in your .env.vault file.`);
-      err.code = "NOT_FOUND_DOTENV_ENVIRONMENT";
-      throw err;
-    }
-    return { ciphertext, key };
-  }
-  function _vaultPath(options) {
-    let possibleVaultPath = null;
-    if (options && options.path && options.path.length > 0) {
-      if (Array.isArray(options.path)) {
-        for (const filepath of options.path) {
-          if (fs.existsSync(filepath)) {
-            possibleVaultPath = filepath.endsWith(".vault") ? filepath : `${filepath}.vault`;
-          }
-        }
-      } else {
-        possibleVaultPath = options.path.endsWith(".vault") ? options.path : `${options.path}.vault`;
-      }
-    } else {
-      possibleVaultPath = path.resolve(process.cwd(), ".env.vault");
-    }
-    if (fs.existsSync(possibleVaultPath)) {
-      return possibleVaultPath;
-    }
-    return null;
-  }
-  function _resolveHome(envPath) {
-    return envPath[0] === "~" ? path.join(os.homedir(), envPath.slice(1)) : envPath;
-  }
-  function _configVault(options) {
-    const debug = parseBoolean(process.env.DOTENV_CONFIG_DEBUG || options && options.debug);
-    const quiet = parseBoolean(process.env.DOTENV_CONFIG_QUIET || options && options.quiet);
-    if (debug || !quiet) {
-      _log("loading env from encrypted .env.vault");
-    }
-    const parsed = DotenvModule._parseVault(options);
-    let processEnv = process.env;
-    if (options && options.processEnv != null) {
-      processEnv = options.processEnv;
-    }
-    DotenvModule.populate(processEnv, parsed, options);
-    return { parsed };
-  }
-  function configDotenv(options) {
-    const dotenvPath = path.resolve(process.cwd(), ".env");
-    let encoding = "utf8";
-    let processEnv = process.env;
-    if (options && options.processEnv != null) {
-      processEnv = options.processEnv;
-    }
-    let debug = parseBoolean(processEnv.DOTENV_CONFIG_DEBUG || options && options.debug);
-    let quiet = parseBoolean(processEnv.DOTENV_CONFIG_QUIET || options && options.quiet);
-    if (options && options.encoding) {
-      encoding = options.encoding;
-    } else {
-      if (debug) {
-        _debug("no encoding is specified (UTF-8 is used by default)");
-      }
-    }
-    let optionPaths = [dotenvPath];
-    if (options && options.path) {
-      if (!Array.isArray(options.path)) {
-        optionPaths = [_resolveHome(options.path)];
-      } else {
-        optionPaths = [];
-        for (const filepath of options.path) {
-          optionPaths.push(_resolveHome(filepath));
-        }
-      }
-    }
-    let lastError;
-    const parsedAll = {};
-    for (const path2 of optionPaths) {
-      try {
-        const parsed = DotenvModule.parse(fs.readFileSync(path2, { encoding }));
-        DotenvModule.populate(parsedAll, parsed, options);
-      } catch (e) {
-        if (debug) {
-          _debug(`failed to load ${path2} ${e.message}`);
-        }
-        lastError = e;
-      }
-    }
-    const populated = DotenvModule.populate(processEnv, parsedAll, options);
-    debug = parseBoolean(processEnv.DOTENV_CONFIG_DEBUG || debug);
-    quiet = parseBoolean(processEnv.DOTENV_CONFIG_QUIET || quiet);
-    if (debug || !quiet) {
-      const keysCount = Object.keys(populated).length;
-      const shortPaths = [];
-      for (const filePath of optionPaths) {
-        try {
-          const relative = path.relative(process.cwd(), filePath);
-          shortPaths.push(relative);
-        } catch (e) {
-          if (debug) {
-            _debug(`failed to load ${filePath} ${e.message}`);
-          }
-          lastError = e;
-        }
-      }
-      _log(`injected env (${keysCount}) from ${shortPaths.join(",")} ${dim(`// tip: ${_getRandomTip()}`)}`);
-    }
-    if (lastError) {
-      return { parsed: parsedAll, error: lastError };
-    } else {
-      return { parsed: parsedAll };
-    }
-  }
-  function config(options) {
-    if (_dotenvKey(options).length === 0) {
-      return DotenvModule.configDotenv(options);
-    }
-    const vaultPath = _vaultPath(options);
-    if (!vaultPath) {
-      _warn(`you set DOTENV_KEY but you are missing a .env.vault file at ${vaultPath}`);
-      return DotenvModule.configDotenv(options);
-    }
-    return DotenvModule._configVault(options);
-  }
-  function decrypt(encrypted, keyStr) {
-    const key = Buffer.from(keyStr.slice(-64), "hex");
-    let ciphertext = Buffer.from(encrypted, "base64");
-    const nonce = ciphertext.subarray(0, 12);
-    const authTag = ciphertext.subarray(-16);
-    ciphertext = ciphertext.subarray(12, -16);
-    try {
-      const aesgcm = crypto.createDecipheriv("aes-256-gcm", key, nonce);
-      aesgcm.setAuthTag(authTag);
-      return `${aesgcm.update(ciphertext)}${aesgcm.final()}`;
-    } catch (error) {
-      const isRange = error instanceof RangeError;
-      const invalidKeyLength = error.message === "Invalid key length";
-      const decryptionFailed = error.message === "Unsupported state or unable to authenticate data";
-      if (isRange || invalidKeyLength) {
-        const err = new Error("INVALID_DOTENV_KEY: It must be 64 characters long (or more)");
-        err.code = "INVALID_DOTENV_KEY";
-        throw err;
-      } else if (decryptionFailed) {
-        const err = new Error("DECRYPTION_FAILED: Please check your DOTENV_KEY");
-        err.code = "DECRYPTION_FAILED";
-        throw err;
-      } else {
-        throw error;
-      }
-    }
-  }
-  function populate(processEnv, parsed, options = {}) {
-    const debug = Boolean(options && options.debug);
-    const override = Boolean(options && options.override);
-    const populated = {};
-    if (typeof parsed !== "object") {
-      const err = new Error("OBJECT_REQUIRED: Please check the processEnv argument being passed to populate");
-      err.code = "OBJECT_REQUIRED";
-      throw err;
-    }
-    for (const key of Object.keys(parsed)) {
-      if (Object.prototype.hasOwnProperty.call(processEnv, key)) {
-        if (override === true) {
-          processEnv[key] = parsed[key];
-          populated[key] = parsed[key];
-        }
-        if (debug) {
-          if (override === true) {
-            _debug(`"${key}" is already defined and WAS overwritten`);
-          } else {
-            _debug(`"${key}" is already defined and was NOT overwritten`);
-          }
-        }
-      } else {
-        processEnv[key] = parsed[key];
-        populated[key] = parsed[key];
-      }
-    }
-    return populated;
-  }
-  var DotenvModule = {
-    configDotenv,
-    _configVault,
-    _parseVault,
-    config,
-    decrypt,
-    parse,
-    populate
-  };
-  module.exports.configDotenv = DotenvModule.configDotenv;
-  module.exports._configVault = DotenvModule._configVault;
-  module.exports._parseVault = DotenvModule._parseVault;
-  module.exports.config = DotenvModule.config;
-  module.exports.decrypt = DotenvModule.decrypt;
-  module.exports.parse = DotenvModule.parse;
-  module.exports.populate = DotenvModule.populate;
-  module.exports = DotenvModule;
-});
-
-// src/load-env.ts
-var import_dotenv = __toESM(require_main(), 1);
-import_dotenv.config({ quiet: true });
 
 // src/cli.ts
 import { readFileSync } from "fs";
 
+// ../../cli-auth/src/client/credential-store.ts
+import { createHash as createHash2, randomUUID } from "crypto";
+import {
+  chmod,
+  lstat,
+  mkdir,
+  open as open2,
+  readFile,
+  stat,
+  unlink
+} from "fs/promises";
+import { userInfo } from "os";
+import { join } from "path";
+
 // ../../cli-auth/src/protocol/constants.ts
 var CLI_ACCESS_TOKEN_TTL_MS = 15 * 60 * 1000;
 var CLI_DEVICE_AUTHORIZATION_TTL_MS = 10 * 60 * 1000;
@@ -502,7 +160,7 @@ __export(exports_external, {
   codec: () => codec,
   coerce: () => exports_coerce,
   compile: () => compile,
-  config: () => config2,
+  config: () => config,
   core: () => exports_core2,
   creditCard: () => creditCard2,
   cuid: () => cuid3,
@@ -905,7 +563,7 @@ __export(exports_core2, {
   clone: () => clone,
   compile: () => compile,
   compileFn: () => compileFn,
-  config: () => config2,
+  config: () => config,
   createStandardJSONSchemaMethod: () => createStandardJSONSchemaMethod,
   createToJSONSchemaMethod: () => createToJSONSchemaMethod,
   decode: () => decode,
@@ -1569,7 +1227,7 @@ function attachSchema(issues, start, inst) {
     (_a = issues[i]).schema ?? (_a.schema = inst);
   }
 }
-function finalizeIssue(iss, ctx, config2) {
+function finalizeIssue(iss, ctx, config) {
   var _a;
   const traits = iss.inst?._zod?.traits;
   if (traits?.has("$ZodType")) {
@@ -1579,7 +1237,7 @@ function finalizeIssue(iss, ctx, config2) {
       iss.schema = iss.inst;
   }
   const schemaError = iss.schema !== iss.inst ? iss.schema?._zod.def?.error : undefined;
-  const message = iss.message ? iss.message : unwrapMessage(iss.inst?._zod.def?.error?.(iss)) ?? unwrapMessage(schemaError?.(iss)) ?? unwrapMessage(ctx?.error?.(iss)) ?? unwrapMessage(config2.customError?.(iss)) ?? unwrapMessage(config2.localeError?.(iss)) ?? "Invalid input";
+  const message = iss.message ? iss.message : unwrapMessage(iss.inst?._zod.def?.error?.(iss)) ?? unwrapMessage(schemaError?.(iss)) ?? unwrapMessage(ctx?.error?.(iss)) ?? unwrapMessage(config.customError?.(iss)) ?? unwrapMessage(config.localeError?.(iss)) ?? "Invalid input";
   const { inst: _inst, schema: _schema, continue: _continue, input: _input, ...rest } = iss;
   rest.path ?? (rest.path = []);
   rest.message = message;
@@ -1913,7 +1571,7 @@ class $ZodEncodeError extends Error {
 }
 (_a = globalThis).__zod_globalConfig ?? (_a.__zod_globalConfig = {});
 var globalConfig = globalThis.__zod_globalConfig;
-function config2(newConfig) {
+function config(newConfig) {
   if (newConfig)
     Object.assign(globalConfig, newConfig);
   return globalConfig;
@@ -2127,7 +1785,7 @@ var _parse = (_Err) => {
       throw new $ZodAsyncError;
     }
     if (result.issues.length) {
-      const e = new (_params?.Err ?? _Err)(result.issues.map((iss) => finalizeIssue(iss, ctx, config2())));
+      const e = new (_params?.Err ?? _Err)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())));
       captureStackTrace(e, _params?.callee ?? fn);
       throw e;
     }
@@ -2143,7 +1801,7 @@ var _parseAsync = (_Err) => {
     if (result instanceof Promise)
       result = await result;
     if (result.issues.length) {
-      const e = new (params?.Err ?? _Err)(result.issues.map((iss) => finalizeIssue(iss, ctx, config2())));
+      const e = new (params?.Err ?? _Err)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())));
       captureStackTrace(e, params?.callee ?? fn);
       throw e;
     }
@@ -2160,7 +1818,7 @@ var _safeParse = (_Err) => (schema, value, _ctx) => {
   }
   return result.issues.length ? {
     success: false,
-    error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config2())))
+    error: new (_Err ?? $ZodError)(result.issues.map((iss) => finalizeIssue(iss, ctx, config())))
   } : { success: true, data: result.value };
 };
 var safeParse = /* @__PURE__ */ _safeParse($ZodRealError);
@@ -2171,7 +1829,7 @@ var _safeParseAsync = (_Err) => async (schema, value, _ctx) => {
     result = await result;
   return result.issues.length ? {
     success: false,
-    error: new _Err(result.issues.map((iss) => finalizeIssue(iss, ctx, config2())))
+    error: new _Err(result.issues.map((iss) => finalizeIssue(iss, ctx, config())))
   } : { success: true, data: result.value };
 };
 var safeParseAsync = /* @__PURE__ */ _safeParseAsync($ZodRealError);
@@ -4047,7 +3705,7 @@ function handleUnionResults(results, final, inst, ctx) {
     code: "invalid_union",
     input: final.value,
     inst,
-    errors: results.map((result) => result.issues.map((iss) => finalizeIssue(iss, ctx, config2())))
+    errors: results.map((result) => result.issues.map((iss) => finalizeIssue(iss, ctx, config())))
   });
   return final;
 }
@@ -4111,7 +3769,7 @@ function handleExclusiveUnionResults(results, final, inst, ctx) {
       code: "invalid_union",
       input: final.value,
       inst,
-      errors: results.map((result) => result.issues.map((iss) => finalizeIssue(iss, ctx, config2())))
+      errors: results.map((result) => result.issues.map((iss) => finalizeIssue(iss, ctx, config())))
     });
   } else {
     final.issues.push({
@@ -4503,7 +4161,7 @@ var $ZodRecord = /* @__PURE__ */ $constructor("$ZodRecord", (inst, def) => {
             payload.issues.push({
               code: "invalid_key",
               origin: "record",
-              issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config2())),
+              issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config())),
               input: key,
               path: [key],
               inst
@@ -4583,7 +4241,7 @@ var $ZodRecord = /* @__PURE__ */ $constructor("$ZodRecord", (inst, def) => {
             payload.issues.push({
               code: "invalid_key",
               origin: "record",
-              issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config2())),
+              issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config())),
               input: key,
               path: [key],
               inst
@@ -4668,7 +4326,7 @@ function handleMapResult(keyResult, valueResult, final, key, input, inst, ctx) {
         origin: "map",
         input,
         inst,
-        issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config2()))
+        issues: keyResult.issues.map((iss) => finalizeIssue(iss, ctx, config()))
       });
     }
   }
@@ -4682,7 +4340,7 @@ function handleMapResult(keyResult, valueResult, final, key, input, inst, ctx) {
         input,
         inst,
         key,
-        issues: valueResult.issues.map((iss) => finalizeIssue(iss, ctx, config2()))
+        issues: valueResult.issues.map((iss) => finalizeIssue(iss, ctx, config()))
       });
     }
   }
@@ -4946,7 +4604,7 @@ function handleCatchResult(payload, result, def, ctx) {
     ...result,
     value: payload.value,
     error: {
-      issues: result.issues.map((iss) => finalizeIssue(iss, ctx, config2()))
+      issues: result.issues.map((iss) => finalizeIssue(iss, ctx, config()))
     },
     input: payload.value
   });
@@ -16797,11 +16455,11 @@ var safeDecodeAsync2 = /* @__PURE__ */ _safeDecodeAsync(ZodRealError);
 // ../../../node_modules/.bun/zod@4.5.4/node_modules/zod/v4/classic/schemas.js
 function _ensureDefaultLocale() {
   if (!globalConfig.localeError)
-    config2(en_default());
+    config(en_default());
 }
 function _ensureDefaultMemoizer() {
   if (!globalConfig.memoizer)
-    config2({ memoizer: memoizer() });
+    config({ memoizer: memoizer() });
 }
 var ZodType = /* @__PURE__ */ $constructor("ZodType", (inst, def) => {
   _ensureDefaultLocale();
@@ -18213,12 +17871,12 @@ var ZodIssueCode = {
   custom: "custom"
 };
 function setErrorMap(map2) {
-  config2({
+  config({
     customError: map2
   });
 }
 function getErrorMap() {
-  return config2().customError;
+  return config().customError;
 }
 var ZodFirstPartyTypeKind;
 (function(ZodFirstPartyTypeKind2) {})(ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {}));
@@ -19027,13 +18685,15 @@ var deviceTokenErrorSchema = exports_external.object({
     "authorization_pending",
     "slow_down",
     "access_denied",
-    "expired_token"
+    "expired_token",
+    "invalid_grant"
   ])
 }).strict();
 var refreshRequestSchema = exports_external.object({ refreshToken: exports_external.string().min(40) }).strict();
 var storedCliCredentialsSchema = exports_external.object({
   accessToken: exports_external.string().min(1),
   accessTokenExpiresAt: dateTimeString,
+  issuer: exports_external.string().url().optional(),
   refreshToken: exports_external.string().min(1),
   refreshTokenExpiresAt: dateTimeString,
   session: cliSessionIdentitySchema
@@ -19085,6 +18745,77 @@ var defaultSecrets = () => {
   assertBunRuntime();
   return Bun.secrets;
 };
+var refreshLockTimeoutMs = 5 * 60 * 1000;
+var refreshLockRetryMs = 50;
+var getCredentialLockDirectoryPath = () => {
+  return join(userInfo().homedir, ".cache", "go-labs-cli", "locks");
+};
+var ensurePrivateCredentialLockDirectory = async () => {
+  const directory = getCredentialLockDirectoryPath();
+  await mkdir(directory, { mode: 448, recursive: true });
+  const inspectDirectory = async () => {
+    const directoryStat2 = await lstat(directory);
+    if (directoryStat2.isSymbolicLink() || !directoryStat2.isDirectory()) {
+      throw new Error("The CLI credential lock path is not a private directory.");
+    }
+    const uid = process.getuid?.();
+    if (uid !== undefined && directoryStat2.uid !== uid) {
+      throw new Error("The CLI credential lock directory belongs to another user.");
+    }
+    return directoryStat2;
+  };
+  const directoryStat = await inspectDirectory();
+  if ((directoryStat.mode & 63) !== 0) {
+    await chmod(directory, 448);
+    const securedDirectoryStat = await inspectDirectory();
+    if ((securedDirectoryStat.mode & 63) !== 0) {
+      throw new Error("Unable to secure the CLI credential lock directory.");
+    }
+  }
+  return directory;
+};
+var getCredentialLockPath = async (product, account) => {
+  const key = createHash2("sha256").update(`${product}:${account}`).digest("hex");
+  return join(await ensurePrivateCredentialLockDirectory(), `${key}.lock`);
+};
+var acquireRefreshLock = async (path) => {
+  const deadline = Date.now() + refreshLockTimeoutMs;
+  while (Date.now() < deadline) {
+    try {
+      const handle = await open2(path, "wx");
+      const owner = randomUUID();
+      try {
+        await handle.writeFile(owner);
+      } catch (cause) {
+        await handle.close().catch(() => {
+          return;
+        });
+        await unlink(path).catch(() => {
+          return;
+        });
+        throw cause;
+      }
+      return { handle, owner };
+    } catch (cause) {
+      if (!(cause instanceof Error) || !("code" in cause) || cause.code !== "EEXIST") {
+        throw cause;
+      }
+      try {
+        const lock = await stat(path);
+        if (Date.now() - lock.mtimeMs > refreshLockTimeoutMs) {
+          throw new Error(`The CLI credential lock appears stale at ${path}. Ensure no CLI authentication command is running, remove that lock file, and retry.`);
+        }
+      } catch (statCause) {
+        if (statCause instanceof Error && "code" in statCause && statCause.code === "ENOENT") {
+          continue;
+        }
+        throw statCause;
+      }
+      await Bun.sleep(refreshLockRetryMs);
+    }
+  }
+  throw new Error("Timed out waiting for another CLI process to refresh credentials. Retry the command.");
+};
 var createBunCredentialStore = ({
   account = "default",
   product,
@@ -19112,16 +18843,46 @@ var createBunCredentialStore = ({
         service,
         value: JSON.stringify(parsed)
       }));
+    },
+    withCredentialLock: async (operation) => {
+      const refreshLockPath = await getCredentialLockPath(product, account);
+      const lock = await acquireRefreshLock(refreshLockPath);
+      try {
+        return await operation();
+      } finally {
+        await lock.handle.close();
+        const owner = await readFile(refreshLockPath, "utf8").catch(() => null);
+        if (owner === lock.owner) {
+          await unlink(refreshLockPath).catch(() => {
+            return;
+          });
+        }
+      }
     }
   };
 };
 // ../../cli-auth/src/client/login.ts
 import { hostname as hostname3 } from "os";
-var normalizeBaseUrl = (value) => value.replace(/\/+$/, "");
-var postJson = async (fetchImplementation, url2, body) => fetchImplementation(url2, {
+var normalizeCliAuthIssuer = (value) => {
+  const url2 = new URL(value);
+  url2.hash = "";
+  url2.search = "";
+  url2.pathname = url2.pathname.replace(/\/+$/, "");
+  return url2.toString().replace(/\/+$/, "");
+};
+var isCliCredentialForIssuer = (credentials, apiBaseUrl) => credentials.issuer === normalizeCliAuthIssuer(apiBaseUrl);
+var credentialIssuerError = (issuer) => issuer ? new Error("These CLI credentials belong to a different API URL. Run auth login for this API URL before retrying.") : new Error("These CLI credentials were created by an older CLI and are not bound to an API URL. Run auth login again.");
+var assertCredentialIssuer = (credentials, apiBaseUrl) => {
+  const expectedIssuer = normalizeCliAuthIssuer(apiBaseUrl);
+  if (!credentials.issuer || credentials.issuer !== expectedIssuer) {
+    throw credentialIssuerError(credentials.issuer);
+  }
+};
+var postJson = async (fetchImplementation, url2, body, options = {}) => fetchImplementation(url2, {
   body: JSON.stringify(body),
   headers: { "content-type": "application/json" },
-  method: "POST"
+  method: "POST",
+  ...options
 });
 var readJson = async (response) => {
   try {
@@ -19130,9 +18891,29 @@ var readJson = async (response) => {
     throw new Error(`CLI authentication returned HTTP ${response.status} without valid JSON.`);
   }
 };
-var toStoredCredentials = (response, now) => ({
+var localCredentialLocks = new WeakMap;
+var withCredentialLock = (store, operation) => {
+  if (store.withCredentialLock) {
+    return store.withCredentialLock(operation);
+  }
+  const previous = localCredentialLocks.get(store) ?? Promise.resolve();
+  const pending = previous.then(operation, operation);
+  const tail = pending.then(() => {
+    return;
+  }, () => {
+    return;
+  });
+  localCredentialLocks.set(store, tail);
+  return pending.finally(() => {
+    if (localCredentialLocks.get(store) === tail) {
+      localCredentialLocks.delete(store);
+    }
+  });
+};
+var toStoredCredentials = (response, issuer, now) => ({
   accessToken: response.accessToken,
   accessTokenExpiresAt: new Date(now.getTime() + response.expiresIn * 1000).toISOString(),
+  issuer,
   refreshToken: response.refreshToken,
   refreshTokenExpiresAt: new Date(now.getTime() + response.refreshExpiresIn * 1000).toISOString(),
   session: response.session
@@ -19166,7 +18947,7 @@ var loginWithBrowser = async ({
   sleep = (milliseconds) => Bun.sleep(milliseconds),
   store
 }) => {
-  const baseUrl = normalizeBaseUrl(apiBaseUrl);
+  const baseUrl = normalizeCliAuthIssuer(apiBaseUrl);
   const pkce = createPkcePair();
   const beginResponse = await postJson(fetchImplementation, `${baseUrl}/api/cli-auth/device`, {
     clientName,
@@ -19193,8 +18974,8 @@ var loginWithBrowser = async ({
     const payload = await readJson(response);
     if (response.ok) {
       const issued = tokenResponseSchema.parse(payload);
-      const credentials = toStoredCredentials(issued, now());
-      await store.set(credentials);
+      const credentials = toStoredCredentials(issued, baseUrl, now());
+      await withCredentialLock(store, () => store.set(credentials));
       return credentials;
     }
     const error61 = deviceTokenErrorSchema.safeParse(payload);
@@ -19215,6 +18996,26 @@ var loginWithBrowser = async ({
   throw new Error("CLI authentication expired. Run auth login again.");
 };
 var refreshes = new WeakMap;
+var refreshRequestTimeoutMs = 30000;
+var isInvalidGrantResponse = (payload) => {
+  const parsed = deviceTokenErrorSchema.safeParse(payload);
+  return parsed.success && parsed.data.error === "invalid_grant";
+};
+var readJsonOrNull = async (response) => {
+  try {
+    return await response.json();
+  } catch {
+    return null;
+  }
+};
+var deleteInvalidCredentials = async (store, credentials) => {
+  const current = await store.get();
+  if (!current)
+    return;
+  if (current.issuer === credentials.issuer && current.refreshToken === credentials.refreshToken) {
+    await store.delete();
+  }
+};
 var refreshAccessToken = async ({
   apiBaseUrl,
   credentials,
@@ -19222,16 +19023,56 @@ var refreshAccessToken = async ({
   now,
   store
 }) => {
-  const response = await postJson(fetchImplementation, `${normalizeBaseUrl(apiBaseUrl)}/api/cli-auth/refresh`, { refreshToken: credentials.refreshToken });
+  assertCredentialIssuer(credentials, apiBaseUrl);
+  let response;
+  try {
+    response = await postJson(fetchImplementation, `${normalizeCliAuthIssuer(apiBaseUrl)}/api/cli-auth/refresh`, { refreshToken: credentials.refreshToken }, { signal: AbortSignal.timeout(refreshRequestTimeoutMs) });
+  } catch {
+    throw new Error("Unable to refresh the CLI session because the API could not be reached. Credentials were kept; retry the command.");
+  }
   if (!response.ok) {
-    await store.delete();
-    throw new Error("The CLI session expired or was revoked. Run auth login again.");
+    const payload2 = await readJsonOrNull(response);
+    if (isInvalidGrantResponse(payload2)) {
+      await deleteInvalidCredentials(store, credentials);
+      throw new Error("The CLI session expired or was revoked. Run auth login again.");
+    }
+    throw new Error(`Unable to refresh the CLI session (HTTP ${response.status}). Credentials were kept; retry the command.`);
+  }
+  const payload = await readJsonOrNull(response);
+  if (payload === null) {
+    throw new Error("Unable to refresh the CLI session because the API returned malformed JSON. Credentials were kept; retry the command.");
   }
-  const issued = tokenResponseSchema.parse(await readJson(response));
-  const stored = toStoredCredentials(issued, now());
+  let issued;
+  try {
+    issued = tokenResponseSchema.parse(payload);
+  } catch {
+    throw new Error("Unable to refresh the CLI session because the API returned invalid credentials. Credentials were kept; retry the command.");
+  }
+  const stored = toStoredCredentials(issued, normalizeCliAuthIssuer(apiBaseUrl), now());
   await store.set(stored);
   return stored.accessToken;
 };
+var refreshWithCurrentCredentials = async ({
+  apiBaseUrl,
+  fetch: fetchImplementation,
+  now,
+  store
+}) => {
+  const credentials = await store.get();
+  if (!credentials)
+    throw new Error("Not authenticated. Run auth login first.");
+  assertCredentialIssuer(credentials, apiBaseUrl);
+  if (Date.parse(credentials.accessTokenExpiresAt) - now().getTime() > 60000) {
+    return credentials.accessToken;
+  }
+  return refreshAccessToken({
+    apiBaseUrl,
+    credentials,
+    fetch: fetchImplementation,
+    now,
+    store
+  });
+};
 var getAuthenticatedAccessToken = async ({
   apiBaseUrl,
   fetch: fetchImplementation = globalThis.fetch,
@@ -19241,19 +19082,20 @@ var getAuthenticatedAccessToken = async ({
   const credentials = await store.get();
   if (!credentials)
     throw new Error("Not authenticated. Run auth login first.");
+  assertCredentialIssuer(credentials, apiBaseUrl);
   if (Date.parse(credentials.accessTokenExpiresAt) - now().getTime() > 60000) {
     return credentials.accessToken;
   }
   const existing = refreshes.get(store);
   if (existing)
     return existing;
-  const refresh = refreshAccessToken({
+  const refreshOperation = () => withCredentialLock(store, () => refreshWithCurrentCredentials({
     apiBaseUrl,
-    credentials,
     fetch: fetchImplementation,
     now,
     store
-  }).finally(() => refreshes.delete(store));
+  }));
+  const refresh = refreshOperation().finally(() => refreshes.delete(store));
   refreshes.set(store, refresh);
   return refresh;
 };
@@ -19262,18 +19104,22 @@ var logoutCliSession = async ({
   fetch: fetchImplementation = globalThis.fetch,
   store
 }) => {
-  const credentials = await store.get();
-  let remoteRevoked = credentials === null;
-  if (credentials) {
-    try {
-      const response = await postJson(fetchImplementation, `${normalizeBaseUrl(apiBaseUrl)}/api/cli-auth/revoke`, { refreshToken: credentials.refreshToken });
-      remoteRevoked = response.ok;
-    } catch {
-      remoteRevoked = false;
+  const issuer = normalizeCliAuthIssuer(apiBaseUrl);
+  return withCredentialLock(store, async () => {
+    const credentials = await store.get();
+    let remoteRevoked = credentials === null;
+    if (credentials) {
+      try {
+        assertCredentialIssuer(credentials, apiBaseUrl);
+        const response = await postJson(fetchImplementation, `${issuer}/api/cli-auth/revoke`, { refreshToken: credentials.refreshToken }, { signal: AbortSignal.timeout(refreshRequestTimeoutMs) });
+        remoteRevoked = response.ok;
+      } catch {
+        remoteRevoked = false;
+      }
     }
-  }
-  await store.delete();
-  return { remoteRevoked };
+    await store.delete();
+    return { remoteRevoked };
+  });
 };
 // src/api-client.ts
 import {
@@ -19364,10 +19210,24 @@ var commands = {
     scope: "event",
     summary: "Get the editable registration flow draft."
   },
+  "event flow resources get": {
+    effects: [],
+    operation: (api2, input2) => api2.eventFlow.getResourceCatalog.query(input2),
+    scope: "event",
+    summary: "List the menus, consent documents, images, and seat maps available to the registration flow."
+  },
+  "event flow menu version create": {
+    effects: ["state-change"],
+    operation: (api2, input2) => api2.eventFlow.createMenuVersion.mutate(input2),
+    payloadOnly: true,
+    targetKey: "eventId",
+    summary: "Create an immutable event menu version (--payload JSON)."
+  },
   "event flow draft save": {
     effects: ["state-change"],
     operation: (api2, input2) => api2.eventFlow.saveDraft.mutate(input2),
     payloadOnly: true,
+    targetKey: "eventId",
     summary: "Save a revision-checked registration flow draft (--payload JSON)."
   },
   "event flow published get": {
@@ -19587,6 +19447,12 @@ var commands = {
     operation: (api2, input2) => api2.user.unban.mutate(input2),
     payloadOnly: true,
     summary: "Unban a user (--payload JSON)."
+  },
+  "user role update": {
+    effects: ["state-change"],
+    operation: (api2, input2) => api2.user.updateGlobalRole.mutate(input2),
+    payloadOnly: true,
+    summary: "Update a user's global role (--payload JSON)."
   }
 };
 var payloadCommand = (operation, summary, effects = []) => ({ effects, operation, payloadOnly: true, summary });
@@ -19901,15 +19767,27 @@ var collectValuesForKey = (value, targetKey) => {
     return collectValuesForKey(nested, targetKey);
   });
 };
-var collectTargets = (input2) => {
-  for (const targetKey of targetKeys) {
-    const values = collectValuesForKey(input2, targetKey);
+var collectDirectTargetValues = (input2, targetKey) => {
+  if (!input2)
+    return [];
+  const value = input2[targetKey];
+  if (Array.isArray(value))
+    return value.map(String);
+  if (["string", "number"].includes(typeof value))
+    return [String(value)];
+  return [];
+};
+var collectTargets = (input2, targetKey) => {
+  if (targetKey)
+    return collectDirectTargetValues(input2, targetKey);
+  for (const targetKey2 of targetKeys) {
+    const values = collectValuesForKey(input2, targetKey2);
     if (values.length > 0)
       return values;
   }
   return [];
 };
-var requireEffects = async (effects, flags, confirm, input2) => {
+var requireEffects = async (effects, flags, confirm, input2, targetKey) => {
   if (effects.length === 0)
     return;
   const missing = effects.filter((effect) => {
@@ -19918,7 +19796,7 @@ var requireEffects = async (effects, flags, confirm, input2) => {
   });
   const targetRequired = effects.some((effect) => effect !== "sensitive-data");
   const target = getStringFlag(flags, "--target");
-  const candidates = targetRequired ? collectTargets(input2) : [];
+  const candidates = targetRequired ? collectTargets(input2, targetKey) : [];
   const targetMatches = !targetRequired || target !== undefined && candidates.includes(target);
   if (missing.length === 0 && targetMatches)
     return;
@@ -19933,13 +19811,26 @@ var requireEffects = async (effects, flags, confirm, input2) => {
   ];
   throw new CliUsageError(`Command requires ${requirements.join(" and ")} in non-interactive use.${candidates.length > 0 ? ` Expected target: ${candidates.join(" or ")}.` : ""}`);
 };
+var knownCommandNames = new Set([
+  "help",
+  "manifest",
+  "version",
+  "health",
+  "auth login",
+  "auth status",
+  "auth logout",
+  "auth whoami",
+  ...Object.keys(commands)
+]);
 var runRsvpCli = async (argv, dependencies) => {
-  let command = argv.filter((argument) => !argument.startsWith("--")).join(" ");
-  if (!command)
-    command = "help";
+  let command = "unknown";
   try {
     const parsed = parseArgs(argv);
-    command = parsed.positionals.join(" ") || "help";
+    const requestedCommand = parsed.positionals.join(" ") || "help";
+    if (!knownCommandNames.has(requestedCommand)) {
+      throw new CliUsageError("Unknown command. Run 'rsvp help' to list commands.");
+    }
+    command = requestedCommand;
     if (command === "help") {
       output2(dependencies.io, command, getCommandManifest());
       return 0;
@@ -19986,15 +19877,53 @@ Waiting for approval\u2026
       return 0;
     }
     if (command === "auth status") {
-      const credentials = await getCredentialStore().get();
-      output2(dependencies.io, command, credentials ? {
-        authenticated: true,
-        accessTokenExpiresAt: credentials.accessTokenExpiresAt,
-        refreshTokenExpiresAt: credentials.refreshTokenExpiresAt,
-        session: credentials.session,
-        storage: "Bun.secrets"
-      } : { authenticated: false, storage: "Bun.secrets" });
-      return 0;
+      const store = getCredentialStore();
+      const credentials = await store.get();
+      if (!credentials) {
+        output2(dependencies.io, command, {
+          authenticated: false,
+          storage: "Bun.secrets"
+        });
+        return 0;
+      }
+      if (!credentials.issuer) {
+        output2(dependencies.io, command, {
+          authenticated: false,
+          reason: "These CLI credentials were created by an older CLI and are not bound to an API URL. Run auth login again.",
+          storage: "Bun.secrets"
+        });
+        return 0;
+      }
+      try {
+        const accessToken2 = await getAuthenticatedAccessToken({
+          apiBaseUrl,
+          store
+        });
+        const api3 = dependencies.apiClient ?? createClient(apiBaseUrl, accessToken2);
+        await api3.user.getCurrent.query();
+        const currentCredentials = await store.get();
+        if (!currentCredentials || !isCliCredentialForIssuer(currentCredentials, apiBaseUrl) || currentCredentials.accessToken !== accessToken2) {
+          throw new Error("CLI credentials changed while validating the session. Retry the command.");
+        }
+        output2(dependencies.io, command, {
+          authenticated: true,
+          accessTokenExpiresAt: currentCredentials.accessTokenExpiresAt,
+          refreshTokenExpiresAt: currentCredentials.refreshTokenExpiresAt,
+          session: currentCredentials.session,
+          storage: "Bun.secrets",
+          validated: true
+        });
+        return 0;
+      } catch (cause) {
+        output2(dependencies.io, command, {
+          authenticated: false,
+          accessTokenExpiresAt: credentials.accessTokenExpiresAt,
+          refreshTokenExpiresAt: credentials.refreshTokenExpiresAt,
+          reason: cause instanceof Error ? cause.message : "Unable to validate the CLI session. Retry the command.",
+          storage: "Bun.secrets"
+        });
+        return 0;
+      }
     }
     if (command === "auth logout") {
       output2(dependencies.io, command, {
@@ -20019,7 +19948,7 @@ Waiting for approval\u2026
     if (!definition)
       throw new CliUsageError("Unknown command. Run 'rsvp help' to list commands.");
     const input2 = getInput(parsed.flags, definition.payloadOnly, definition.scope);
-    await requireEffects(definition.effects, parsed.flags, dependencies.confirm, input2);
+    await requireEffects(definition.effects, parsed.flags, dependencies.confirm, input2, definition.targetKey);
     const accessToken = !dependencies.apiClient && !definition.public ? await getAuthenticatedAccessToken({
       apiBaseUrl,
       store: getCredentialStore()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@go-labs-sg/rsvp",
-  "version": "0.3.0",
+  "version": "0.6.1",
   "description": "RSVP CLI for authorized event operations.",
   "type": "module",
   "exports": {},
@@ -14,7 +14,6 @@
   ],
   "dependencies": {
     "@trpc/client": "^11.18.0",
-    "dotenv": "^17.4.2",
     "superjson": "^2.2.6"
   },
   "engines": {