@grantjs/cli 1.12.0 → 1.13.0

package/dist/index.mjs

@@ -2,7 +2,7 @@
 import { EventEmitter } from "node:events";
 import childProcess, { spawn } from "node:child_process";
 import path, { join, resolve } from "node:path";
-import fs, { existsSync } from "node:fs";
+import fs, { existsSync, readFileSync } from "node:fs";
 import process$1 from "node:process";
 import { stripVTControlCharacters } from "node:util";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
@@ -2964,7 +2964,302 @@ function useColor() {
 }
 new Command();
 //#endregion
+//#region src/config/storage.ts
+var CONFIG_DIR_NAME = "grant";
+var CONFIG_FILE_NAME = "config.json";
+var DEFAULT_PROFILE_NAME = "default";
+/**
+* Returns the platform-specific config directory for Grant CLI.
+* - Windows: %APPDATA%\grant
+* - Linux/macOS: $XDG_CONFIG_HOME/grant or ~/.config/grant
+*/
+function getConfigDir() {
+	if (platform() === "win32") {
+		const appData = process.env.APPDATA;
+		if (!appData) return join(homedir(), "AppData", "Roaming", CONFIG_DIR_NAME);
+		return join(appData, CONFIG_DIR_NAME);
+	}
+	const xdg = process.env.XDG_CONFIG_HOME;
+	if (xdg) return join(xdg, CONFIG_DIR_NAME);
+	return join(homedir(), ".config", CONFIG_DIR_NAME);
+}
+/**
+* Returns the path to the config file (config dir + config.json).
+*/
+function getConfigPath() {
+	return join(getConfigDir(), CONFIG_FILE_NAME);
+}
+/** Detect legacy single-profile config (apiUrl at top level, no profiles). */
+function isLegacyConfig(data) {
+	if (!data || typeof data !== "object") return false;
+	const o = data;
+	return typeof o.apiUrl === "string" && !("profiles" in o);
+}
+/**
+* Load config file from disk. Migrates legacy single-config to profiles shape.
+* Returns null if file does not exist or is invalid.
+*/
+async function loadConfigFile() {
+	const path = getConfigPath();
+	try {
+		const raw = await readFile(path, "utf-8");
+		const data = JSON.parse(raw);
+		if (!data || typeof data !== "object") return null;
+		if (isLegacyConfig(data)) {
+			const file = {
+				defaultProfile: DEFAULT_PROFILE_NAME,
+				profiles: { [DEFAULT_PROFILE_NAME]: data }
+			};
+			await saveConfigFile(file);
+			return file;
+		}
+		const file = data;
+		if (typeof file.defaultProfile !== "string" || !file.profiles || typeof file.profiles !== "object") return null;
+		return file;
+	} catch {
+		return null;
+	}
+}
+/**
+* Save config file to disk. Creates config dir if needed. Sets file mode to 0o600 (owner read/write only).
+*/
+async function saveConfigFile(file) {
+	const dir = getConfigDir();
+	const path = getConfigPath();
+	await mkdir(dir, {
+		recursive: true,
+		mode: 448
+	});
+	await writeFile(path, JSON.stringify(file, null, 2), {
+		encoding: "utf-8",
+		mode: 384,
+		flag: "w"
+	});
+}
+/**
+* Resolve which profile name to use: explicit name, or file's default, or "default".
+*/
+function resolveProfileName(file, profileFlag) {
+	if (profileFlag?.trim()) return profileFlag.trim();
+	const fromEnv = process.env.GRANT_PROFILE?.trim();
+	if (fromEnv) return fromEnv;
+	return file.defaultProfile || "default";
+}
+/**
+* Get config for a profile. Returns null if profile does not exist.
+*/
+function getProfileConfig(file, profileName) {
+	return file.profiles[profileName] ?? null;
+}
+/**
+* List profile names. Returns empty array if no file.
+*/
+function listProfileNames(file) {
+	if (!file?.profiles) return [];
+	return Object.keys(file.profiles);
+}
+/**
+* Load config file and return the resolved profile's config plus file and name.
+* Use when you need to read and then update (save) the file. Returns null if no file or profile does not exist.
+*/
+async function loadProfile(profileFlag) {
+	const file = await loadConfigFile();
+	if (!file) return null;
+	const profileName = resolveProfileName(file, profileFlag);
+	const config = getProfileConfig(file, profileName);
+	if (!config) return null;
+	return {
+		file,
+		config,
+		profileName
+	};
+}
+//#endregion
+//#region src/config/credentials.ts
+var ENV = {
+	profile: "GRANT_PROFILE",
+	apiUrl: "GRANT_API_URL",
+	clientId: "GRANT_CLIENT_ID",
+	clientSecret: "GRANT_CLIENT_SECRET",
+	scopeTenant: "GRANT_SCOPE_TENANT",
+	scopeId: "GRANT_SCOPE_ID",
+	originVerify: "GRANT_ORIGIN_VERIFY",
+	accessToken: "GRANT_ACCESS_TOKEN"
+};
+function env(name) {
+	return process.env[name]?.trim() || void 0;
+}
+function mergeScope(config, flags) {
+	const id = flags.scopeId?.trim() || env(ENV.scopeId) || config.selectedScope?.id;
+	const tenant = flags.tenant?.trim() || env(ENV.scopeTenant) || config.selectedScope?.tenant;
+	if (id && tenant) return {
+		id,
+		tenant
+	};
+	return config.selectedScope;
+}
+function envApiKeyConfig(apiUrl) {
+	const clientId = env(ENV.clientId);
+	const clientSecret = env(ENV.clientSecret);
+	const tenant = env(ENV.scopeTenant);
+	const id = env(ENV.scopeId);
+	if (!clientId || !clientSecret || !tenant || !id) return null;
+	const scope = {
+		tenant,
+		id
+	};
+	return {
+		apiUrl,
+		authMethod: "api-key",
+		apiKey: {
+			clientId,
+			clientSecret,
+			scope
+		},
+		selectedScope: scope,
+		originVerifySecret: env(ENV.originVerify)
+	};
+}
+function envTokenConfig(apiUrl) {
+	const token = env(ENV.accessToken);
+	if (!token) return null;
+	const tenant = env(ENV.scopeTenant);
+	const id = env(ENV.scopeId);
+	return {
+		apiUrl,
+		authMethod: "session",
+		session: { token },
+		selectedScope: tenant && id ? {
+			tenant,
+			id
+		} : void 0,
+		originVerifySecret: env(ENV.originVerify)
+	};
+}
+/**
+* Resolve API URL, credentials, and scope.
+* Order: flags → GRANT_* env → named profile file.
+*/
+async function resolveRuntimeContext(flags = {}) {
+	const loaded = await loadProfile(flags.profile?.trim() || env(ENV.profile));
+	const apiUrl = env(ENV.apiUrl) || loaded?.config.apiUrl;
+	if (!apiUrl) throw new Error("No Grant API URL. Set GRANT_API_URL, pass a profile with apiUrl, or run \"grant start\".");
+	const envToken = envTokenConfig(apiUrl);
+	const envKey = envApiKeyConfig(apiUrl);
+	const base = envToken ?? envKey ?? loaded?.config;
+	if (!base) throw new Error("No credentials. Set GRANT_ACCESS_TOKEN or GRANT_CLIENT_ID/GRANT_CLIENT_SECRET, or run \"grant start\".");
+	const config = {
+		...base,
+		apiUrl,
+		originVerifySecret: env(ENV.originVerify) || base.originVerifySecret,
+		selectedScope: mergeScope(base, flags)
+	};
+	const accessToken = env(ENV.accessToken);
+	if (accessToken && !config.session?.token) {
+		config.authMethod = "session";
+		config.session = { token: accessToken };
+	}
+	return {
+		apiUrl,
+		authMethod: env(ENV.accessToken) ? "token" : config.authMethod,
+		config,
+		profileName: loaded?.profileName ?? null,
+		scope: config.selectedScope,
+		originVerifySecret: config.originVerifySecret
+	};
+}
+var CliError = class extends Error {
+	exitCode;
+	constructor(message, exitCode = 1) {
+		super(message);
+		this.name = "CliError";
+		this.exitCode = exitCode;
+	}
+};
+function isAuthFailure(status, message) {
+	if (status === 401 || status === 403) return true;
+	return /unauthorized|forbidden|invalid or expired|no credentials/i.test(message);
+}
+function handleCliError(err) {
+	if (err instanceof CliError) {
+		console.error(err.message);
+		process.exit(err.exitCode);
+	}
+	const message = err instanceof Error ? err.message : String(err);
+	console.error(message);
+	process.exit(isAuthFailure(0, message) ? 2 : 1);
+}
+//#endregion
+//#region src/api/transport.ts
+var DEBUG = process.env.GRANT_CLI_DEBUG === "1" || process.env.GRANT_CLI_DEBUG === "true";
+function joinUrl(apiUrl, path) {
+	const base = apiUrl.replace(/\/+$/, "");
+	const suffix = path.startsWith("/") ? path : `/${path}`;
+	return new URL(base + suffix);
+}
+function parseErrorMessage(status, text) {
+	let message = `Request failed (${status})`;
+	try {
+		const data = JSON.parse(text);
+		if (data?.error?.message) message = data.error.message;
+		else if (data?.message) message = data.message;
+		if (data?.reason) message += ` — ${data.reason}`;
+	} catch {
+		if (text) message = text.slice(0, 200);
+	}
+	return message;
+}
+async function apiRequest(req) {
+	const url = joinUrl(req.apiUrl, req.path);
+	if (req.query) for (const [key, value] of Object.entries(req.query)) {
+		if (value === void 0 || value === "") continue;
+		url.searchParams.set(key, String(value));
+	}
+	const headers = {
+		Accept: "application/json",
+		...req.extraHeaders
+	};
+	if (req.token) headers.Authorization = `Bearer ${req.token}`;
+	if (req.originVerifySecret) headers["x-origin-verify"] = req.originVerifySecret;
+	const init = {
+		method: req.method.toUpperCase(),
+		headers
+	};
+	if (req.body !== void 0) {
+		headers["Content-Type"] = "application/json";
+		init.body = JSON.stringify(req.body);
+	}
+	if (DEBUG) console.error(`[Grant CLI] ${init.method} ${url.href}`);
+	let res;
+	try {
+		res = await fetch(url.href, init);
+	} catch (err) {
+		throw new CliError(`Request failed: ${err instanceof Error ? err.message : String(err)}. URL: ${url.href}`, 1);
+	}
+	const text = await res.text();
+	let parsed = void 0;
+	if (text) try {
+		parsed = JSON.parse(text);
+	} catch {
+		parsed = text;
+	}
+	if (!res.ok) {
+		const message = parseErrorMessage(res.status, text);
+		throw new CliError(message, isAuthFailure(res.status, message) ? 2 : 1);
+	}
+	const envelope = parsed;
+	const data = envelope && typeof envelope === "object" && envelope !== null && "data" in envelope ? envelope.data ?? envelope : envelope;
+	return {
+		status: res.status,
+		data
+	};
+}
+//#endregion
 //#region src/api/client.ts
+/**
+* Minimal REST client for Grant API.
+* Used by start (token exchange) and generate-types (resources/permissions).
+*/
 process.env.GRANT_CLI_DEBUG === "1" || process.env.GRANT_CLI_DEBUG;
 /** Log request URL, status, and response body when an API call fails (always on failure). */
 function logFailedRequest(label, url, status, bodyText, extra) {
@@ -3021,6 +3316,23 @@ async function exchangeApiKey(baseUrl, body) {
 	return data.data;
 }
 /**
+* Refresh a session. Cookie is preferred by browsers; CLI sends the stored refresh token in the body.
+*/
+async function refreshSession(baseUrl, refreshToken, originVerifySecret) {
+	const { data } = await apiRequest({
+		apiUrl: baseUrl,
+		method: "POST",
+		path: "/api/auth/refresh",
+		originVerifySecret,
+		body: { refreshToken }
+	});
+	if (!data?.accessToken) throw new Error("Invalid refresh response: missing accessToken");
+	return {
+		accessToken: data.accessToken,
+		refreshToken: data.refreshToken
+	};
+}
+/**
 * Login with email and password. POST {baseUrl}/api/auth/login
 * Returns access token, refresh token, and primary account (personal).
 */
@@ -3102,7 +3414,7 @@ async function exchangeCliCallback(baseUrl, code) {
 * Fetch organizations (paginated). Requires Bearer token. GET /api/organizations?scopeId=&tenant=
 * Scope is the account context (user's personal account id, tenant 'account').
 */
-async function fetchOrganizations(baseUrl, accessToken, scope) {
+async function fetchOrganizations(baseUrl, accessToken, scope, originVerifySecret) {
 	const items = [];
 	let page = 1;
 	let hasNextPage = true;
@@ -3112,7 +3424,9 @@ async function fetchOrganizations(baseUrl, accessToken, scope) {
 		url.searchParams.set("tenant", scope.tenant);
 		url.searchParams.set("page", String(page));
 		url.searchParams.set("limit", String(DEFAULT_PAGE_SIZE));
-		const res = await fetch(url.href, { headers: { Authorization: `Bearer ${accessToken}` } });
+		const headers = { Authorization: `Bearer ${accessToken}` };
+		if (originVerifySecret) headers["x-origin-verify"] = originVerifySecret;
+		const res = await fetch(url.href, { headers });
 		if (!res.ok) {
 			const text = await res.text();
 			logFailedRequest("Organizations request", url.href, res.status, text, {
@@ -3142,7 +3456,7 @@ async function fetchOrganizations(baseUrl, accessToken, scope) {
 * Fetch projects for a scope (account or organization). Paginated. Requires Bearer token.
 * GET /api/projects?scopeId=&tenant=
 */
-async function fetchProjects(baseUrl, accessToken, scope) {
+async function fetchProjects(baseUrl, accessToken, scope, originVerifySecret) {
 	const items = [];
 	let page = 1;
 	let hasNextPage = true;
@@ -3152,7 +3466,9 @@ async function fetchProjects(baseUrl, accessToken, scope) {
 		url.searchParams.set("tenant", scope.tenant);
 		url.searchParams.set("page", String(page));
 		url.searchParams.set("limit", String(DEFAULT_PAGE_SIZE));
-		const res = await fetch(url.href, { headers: { Authorization: `Bearer ${accessToken}` } });
+		const headers = { Authorization: `Bearer ${accessToken}` };
+		if (originVerifySecret) headers["x-origin-verify"] = originVerifySecret;
+		const res = await fetch(url.href, { headers });
 		if (!res.ok) {
 			const text = await res.text();
 			logFailedRequest("Projects request", url.href, res.status, text, {
@@ -3182,7 +3498,7 @@ var DEFAULT_PAGE_SIZE = 50;
 /**
 * Fetch all resources for a scope (paginated). Requires Bearer token.
 */
-async function fetchResources(baseUrl, accessToken, scope) {
+async function fetchResources(baseUrl, accessToken, scope, originVerifySecret) {
 	const items = [];
 	let page = 1;
 	let hasNextPage = true;
@@ -3192,7 +3508,9 @@ async function fetchResources(baseUrl, accessToken, scope) {
 		url.searchParams.set("tenant", scope.tenant);
 		url.searchParams.set("page", String(page));
 		url.searchParams.set("limit", String(DEFAULT_PAGE_SIZE));
-		const res = await fetch(url.href, { headers: { Authorization: `Bearer ${accessToken}` } });
+		const headers = { Authorization: `Bearer ${accessToken}` };
+		if (originVerifySecret) headers["x-origin-verify"] = originVerifySecret;
+		const res = await fetch(url.href, { headers });
 		if (!res.ok) {
 			const text = await res.text();
 			let msg = `Resources request failed (${res.status})`;
@@ -3216,7 +3534,7 @@ async function fetchResources(baseUrl, accessToken, scope) {
 /**
 * Fetch all permissions for a scope (paginated). Requires Bearer token.
 */
-async function fetchPermissions(baseUrl, accessToken, scope) {
+async function fetchPermissions(baseUrl, accessToken, scope, originVerifySecret) {
 	const items = [];
 	let page = 1;
 	let hasNextPage = true;
@@ -3226,7 +3544,9 @@ async function fetchPermissions(baseUrl, accessToken, scope) {
 		url.searchParams.set("tenant", scope.tenant);
 		url.searchParams.set("page", String(page));
 		url.searchParams.set("limit", String(DEFAULT_PAGE_SIZE));
-		const res = await fetch(url.href, { headers: { Authorization: `Bearer ${accessToken}` } });
+		const headers = { Authorization: `Bearer ${accessToken}` };
+		if (originVerifySecret) headers["x-origin-verify"] = originVerifySecret;
+		const res = await fetch(url.href, { headers });
 		if (!res.ok) {
 			const text = await res.text();
 			let msg = `Permissions request failed (${res.status})`;
@@ -3250,13 +3570,13 @@ async function fetchPermissions(baseUrl, accessToken, scope) {
 //#endregion
 //#region src/config/resolve-token.ts
 /**
-* Resolve a valid access token from stored config.
-* Only tokens are stored (no credentials). Session auth does not auto-refresh; user must re-auth when the access token expires.
-*
-* - API key: exchanges clientId + clientSecret for a fresh token (no credentials stored after exchange).
-* - Session: returns the stored access token. When it expires, the user must run "grant start" again to re-authenticate.
+* Resolve a valid access token from env or stored config.
+* API key: exchanges clientId + clientSecret for a fresh token.
+* Session: returns the stored access token. GRANT_ACCESS_TOKEN wins when set.
 */
 async function resolveAccessToken(config) {
+	const envToken = process.env[ENV.accessToken]?.trim();
+	if (envToken) return envToken;
 	if (config.authMethod === "api-key" && config.apiKey) {
 		const { accessToken } = await exchangeApiKey(config.apiUrl, {
 			clientId: config.apiKey.clientId,
@@ -3268,114 +3588,127 @@ async function resolveAccessToken(config) {
 	if (config.authMethod === "session" && config.session?.token) return config.session.token;
 	throw new Error("No credentials in config. Run \"grant start\" to set up authentication.");
 }
-//#endregion
-//#region src/config/storage.ts
-var CONFIG_DIR_NAME = "grant";
-var CONFIG_FILE_NAME = "config.json";
-var DEFAULT_PROFILE_NAME = "default";
-/**
-* Returns the platform-specific config directory for Grant CLI.
-* - Windows: %APPDATA%\grant
-* - Linux/macOS: $XDG_CONFIG_HOME/grant or ~/.config/grant
-*/
-function getConfigDir() {
-	if (platform() === "win32") {
-		const appData = process.env.APPDATA;
-		if (!appData) return join(homedir(), "AppData", "Roaming", CONFIG_DIR_NAME);
-		return join(appData, CONFIG_DIR_NAME);
+async function refreshAndPersistSession(config, profileName) {
+	const refreshToken = config.session?.refreshToken;
+	if (!refreshToken) throw new Error("Session expired. Run \"grant start\" again or use an api-key profile.");
+	const rotated = await refreshSession(config.apiUrl, refreshToken, config.originVerifySecret);
+	config.session = {
+		token: rotated.accessToken,
+		refreshToken: rotated.refreshToken ?? refreshToken
+	};
+	if (profileName) {
+		const loaded = await loadProfile(profileName);
+		if (loaded) {
+			loaded.config.session = config.session;
+			loaded.file.profiles[loaded.profileName] = loaded.config;
+			await saveConfigFile(loaded.file);
+		}
 	}
-	const xdg = process.env.XDG_CONFIG_HOME;
-	if (xdg) return join(xdg, CONFIG_DIR_NAME);
-	return join(homedir(), ".config", CONFIG_DIR_NAME);
-}
-/**
-* Returns the path to the config file (config dir + config.json).
-*/
-function getConfigPath() {
-	return join(getConfigDir(), CONFIG_FILE_NAME);
-}
-/** Detect legacy single-profile config (apiUrl at top level, no profiles). */
-function isLegacyConfig(data) {
-	if (!data || typeof data !== "object") return false;
-	const o = data;
-	return typeof o.apiUrl === "string" && !("profiles" in o);
+	return rotated.accessToken;
 }
-/**
-* Load config file from disk. Migrates legacy single-config to profiles shape.
-* Returns null if file does not exist or is invalid.
-*/
-async function loadConfigFile() {
-	const path = getConfigPath();
+//#endregion
+//#region src/api/authenticated.ts
+var REAUTH_HINT = "Session expired or unauthorized. Run \"grant start\" again, or use an api-key profile / GRANT_ACCESS_TOKEN.";
+async function authenticatedRequest(req) {
+	const ctx = await resolveRuntimeContext(req.flags);
+	const query = { ...req.query };
+	if (req.injectScope !== false && ctx.scope) {
+		query.scopeId ??= ctx.scope.id;
+		query.tenant ??= ctx.scope.tenant;
+	}
+	const send = (token) => apiRequest({
+		apiUrl: ctx.apiUrl,
+		method: req.method,
+		path: req.path,
+		token,
+		originVerifySecret: ctx.originVerifySecret,
+		query,
+		body: req.body
+	});
+	let token = await resolveAccessToken(ctx.config);
 	try {
-		const raw = await readFile(path, "utf-8");
-		const data = JSON.parse(raw);
-		if (!data || typeof data !== "object") return null;
-		if (isLegacyConfig(data)) {
-			const file = {
-				defaultProfile: DEFAULT_PROFILE_NAME,
-				profiles: { [DEFAULT_PROFILE_NAME]: data }
-			};
-			await saveConfigFile(file);
-			return file;
+		return await send(token);
+	} catch (err) {
+		if (!(err instanceof CliError && err.exitCode === 2 && ctx.config.authMethod === "session" && Boolean(ctx.config.session?.refreshToken))) {
+			if (err instanceof CliError && err.exitCode === 2) throw new CliError(REAUTH_HINT, 2);
+			throw err;
+		}
+		try {
+			token = await refreshAndPersistSession(ctx.config, ctx.profileName);
+			return await send(token);
+		} catch (refreshErr) {
+			if (refreshErr instanceof CliError && refreshErr.exitCode === 2) throw new CliError(REAUTH_HINT, 2);
+			throw refreshErr;
 		}
-		const file = data;
-		if (typeof file.defaultProfile !== "string" || !file.profiles || typeof file.profiles !== "object") return null;
-		return file;
-	} catch {
-		return null;
 	}
 }
-/**
-* Save config file to disk. Creates config dir if needed. Sets file mode to 0o600 (owner read/write only).
-*/
-async function saveConfigFile(file) {
-	const dir = getConfigDir();
-	const path = getConfigPath();
-	await mkdir(dir, {
-		recursive: true,
-		mode: 448
-	});
-	await writeFile(path, JSON.stringify(file, null, 2), {
-		encoding: "utf-8",
-		mode: 384,
-		flag: "w"
-	});
+//#endregion
+//#region src/config/output.ts
+function defaultOutputFormat() {
+	return process.stdout.isTTY ? "text" : "json";
 }
-/**
-* Resolve which profile name to use: explicit name, or file's default, or "default".
-*/
-function resolveProfileName(file, profileFlag) {
-	if (profileFlag?.trim()) return profileFlag.trim();
-	return file.defaultProfile || "default";
+function parseOutputFormat(value) {
+	if (!value) return defaultOutputFormat();
+	const normalized = value.trim().toLowerCase();
+	if (normalized === "json" || normalized === "text") return normalized;
+	if (normalized === "table") return "text";
+	throw new Error(`Unknown --output format "${value}". Use json or text.`);
 }
-/**
-* Get config for a profile. Returns null if profile does not exist.
-*/
-function getProfileConfig(file, profileName) {
-	return file.profiles[profileName] ?? null;
+function printOutput(data, format) {
+	if (format === "json") {
+		console.log(JSON.stringify(data, null, 2));
+		return;
+	}
+	if (typeof data === "string") {
+		console.log(data);
+		return;
+	}
+	console.log(JSON.stringify(data, null, 2));
 }
-/**
-* List profile names. Returns empty array if no file.
-*/
-function listProfileNames(file) {
-	if (!file?.profiles) return [];
-	return Object.keys(file.profiles);
+//#endregion
+//#region src/commands/api.ts
+function parseQuery$1(pairs) {
+	const query = {};
+	for (const pair of pairs ?? []) {
+		const eq = pair.indexOf("=");
+		if (eq <= 0) throw new Error(`Invalid --query "${pair}". Use key=value.`);
+		query[pair.slice(0, eq)] = pair.slice(eq + 1);
+	}
+	return query;
 }
-/**
-* Load config file and return the resolved profile's config plus file and name.
-* Use when you need to read and then update (save) the file. Returns null if no file or profile does not exist.
-*/
-async function loadProfile(profileFlag) {
-	const file = await loadConfigFile();
-	if (!file) return null;
-	const profileName = resolveProfileName(file, profileFlag);
-	const config = getProfileConfig(file, profileName);
-	if (!config) return null;
-	return {
-		file,
-		config,
-		profileName
-	};
+function parseBody(options) {
+	const raw = options.bodyFile ? readFileSync(options.bodyFile, "utf-8") : options.body;
+	if (raw === void 0) return void 0;
+	const trimmed = raw.trim();
+	if (!trimmed) return void 0;
+	if (trimmed === "-") {
+		const stdin = readFileSync(0, "utf-8");
+		return stdin.trim() ? JSON.parse(stdin) : void 0;
+	}
+	return JSON.parse(trimmed);
+}
+function createApiCommand(program) {
+	program.command("api").description("Call any Grant REST path with the resolved profile (method + path)").argument("<method>", "HTTP method (GET, POST, PATCH, PUT, DELETE)").argument("<path>", "Path beginning with /api/…").option("-p, --profile <name>", "Profile to use (or GRANT_PROFILE)").option("--output <format>", "json or text").option("--scope-id <id>", "Override selected scope id").option("--tenant <tenant>", "Override selected scope tenant").option("-q, --query <pair...>", "Query pairs (key=value). Repeatable").option("--body <json>", "JSON body (use - to read stdin)").option("--body-file <path>", "Read JSON body from a file").option("--no-scope", "Do not inject profile scopeId/tenant query params").action(async (method, path, options) => {
+		try {
+			if (!path.startsWith("/")) path = `/${path}`;
+			const format = parseOutputFormat(options.output);
+			const { data } = await authenticatedRequest({
+				flags: {
+					profile: options.profile,
+					scopeId: options.scopeId,
+					tenant: options.tenant
+				},
+				method,
+				path,
+				query: parseQuery$1(options.query),
+				body: parseBody(options),
+				injectScope: options.scope !== false
+			});
+			printOutput(data, format);
+		} catch (err) {
+			handleCliError(err);
+		}
+	});
 }
 //#endregion
 //#region src/commands/config-cmd.ts
@@ -3443,8 +3776,9 @@ function createConfigCommand(program) {
 		console.log("Auth method:", config.authMethod);
 		if (config.selectedScope) console.log("Selected scope:", `${config.selectedScope.tenant}:${config.selectedScope.id}`);
 		if (config.generateTypesOutputPath) console.log("Generate-types output:", config.generateTypesOutputPath);
+		if (config.originVerifySecret) console.log("Origin-verify: set");
 	});
-	const setCmd = configCmd.command("set").description("Set a config value for a profile (use a subcommand: api-url, auth-method, credentials, scope, generate-types-output, default-profile)").option("-p, --profile <name>", "Profile to update (default: default profile)");
+	const setCmd = configCmd.command("set").description("Set a config value for a profile (use a subcommand: api-url, auth-method, credentials, scope, generate-types-output, origin-verify, default-profile)").option("-p, --profile <name>", "Profile to update (default: default profile)");
 	setCmd.command("api-url <url>").description("Set the Grant API base URL (e.g. http://localhost:4000)").action(async (url, cmd) => {
 		const profileFlag = cmd.parent?.opts?.()?.profile;
 		const { file, config, profileName } = await requireProfile(profileFlag);
@@ -3565,6 +3899,22 @@ function createConfigCommand(program) {
 		await saveConfigFile(file);
 		console.log("generate-types-output set to", config.generateTypesOutputPath, "(profile:", profileName + ")");
 	});
+	setCmd.command("origin-verify [secret]").description("Set x-origin-verify secret (only when apiUrl is the raw API origin). Empty clears it.").action(async (secret, cmd) => {
+		const profileFlag = cmd.parent?.opts?.()?.profile;
+		const { file, config, profileName } = await requireProfile(profileFlag);
+		const trimmed = secret?.trim() ?? "";
+		if (!trimmed) {
+			delete config.originVerifySecret;
+			file.profiles[profileName] = config;
+			await saveConfigFile(file);
+			console.log("origin-verify cleared (profile:", profileName + ")");
+			return;
+		}
+		config.originVerifySecret = trimmed;
+		file.profiles[profileName] = config;
+		await saveConfigFile(file);
+		console.log("origin-verify set (profile:", profileName + ")");
+	});
 	setCmd.command("default-profile <name>").description("Set the default profile (used when --profile is not passed)").action(async (name) => {
 		const file = await loadConfigFile();
 		if (!file) {
@@ -3582,6 +3932,1231 @@ function createConfigCommand(program) {
 	});
 }
 //#endregion
+//#region src/spec/map-commands.ts
+function kebab(value) {
+	return value.trim().replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/[\s_]+/g, "-").replace(/[^a-zA-Z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").toLowerCase();
+}
+function groupFromTag(tag, path) {
+	if (tag) return kebab(tag);
+	const first = path.replace(/^\/api\/?/, "").split("/").find(Boolean);
+	return first ? kebab(first) : "api";
+}
+var SINGLETONS = /* @__PURE__ */ new Set([
+	"me",
+	"config",
+	"jwks"
+]);
+function deriveVerb(method, path) {
+	const parts = path.replace(/^\/api\/?/, "").split("/").filter(Boolean);
+	const staticRest = parts.slice(1).filter((part) => !part.startsWith("{"));
+	const lastIsParam = (parts.at(-1) ?? "").startsWith("{");
+	const verbLike = staticRest.at(-1);
+	if (verbLike && /^(revoke|rotate|confirm|read|read-all)$/i.test(verbLike)) return kebab(verbLike);
+	if (staticRest.length === 0) {
+		if (method === "get") {
+			if (lastIsParam) return "get";
+			return SINGLETONS.has(parts[0] ?? "") ? "get" : "list";
+		}
+		if (method === "post") return "create";
+		if (method === "put" || method === "patch") return "update";
+		if (method === "delete") return "delete";
+		return method;
+	}
+	const action = staticRest.map(kebab).join("-");
+	if (method === "get") return lastIsParam ? `get-${action}` : `list-${action}`;
+	if (method === "post") return `create-${action}`;
+	if (method === "put" || method === "patch") return `update-${action}`;
+	if (method === "delete") return `delete-${action}`;
+	return `${method}-${action}`;
+}
+function mapOperation(operation) {
+	return {
+		group: groupFromTag(operation.tags[0], operation.path),
+		verb: deriveVerb(operation.method.toLowerCase(), operation.path),
+		operation
+	};
+}
+function mapOperations(operations) {
+	const used = /* @__PURE__ */ new Map();
+	return operations.map((operation) => {
+		const mapped = mapOperation(operation);
+		const key = `${mapped.group} ${mapped.verb}`;
+		const count = used.get(key) ?? 0;
+		used.set(key, count + 1);
+		if (count > 0) mapped.verb = `${mapped.verb}-${operation.operationId}`;
+		return mapped;
+	});
+}
+function applyPathParams(path, values) {
+	return path.replace(/\{([^}]+)\}/g, (_all, name) => {
+		const value = values[name];
+		if (!value) throw new Error(`Missing path parameter --${kebab(name)}`);
+		return encodeURIComponent(value);
+	});
+}
+function flagName(param) {
+	return kebab(param);
+}
+//#endregion
+//#region src/spec/operations.ts
+/** Generated by scripts/vendor-cli-openapi.mjs — do not edit by hand. */
+var vendoredOperations = [
+	{
+		operationId: "deleteApiApiKeysById",
+		method: "delete",
+		path: "/api/api-keys/{id}",
+		tags: ["API Keys"],
+		summary: "Delete an API key",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "deleteApiGroupsById",
+		method: "delete",
+		path: "/api/groups/{id}",
+		tags: ["Groups"],
+		summary: "Delete a group",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "deleteApiMeAccounts",
+		method: "delete",
+		path: "/api/me/accounts",
+		tags: ["Me"],
+		summary: "Delete all current user accounts and user",
+		pathParams: []
+	},
+	{
+		operationId: "deleteApiMeSessionsBySessionId",
+		method: "delete",
+		path: "/api/me/sessions/{sessionId}",
+		tags: ["Me"],
+		summary: "Revoke a specific session for the current user",
+		pathParams: ["sessionId"]
+	},
+	{
+		operationId: "deleteApiOrganizationInvitationsById",
+		method: "delete",
+		path: "/api/organization-invitations/{id}",
+		tags: ["Organization Invitations"],
+		summary: "Revoke invitation",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "deleteApiOrganizationMembersByUserId",
+		method: "delete",
+		path: "/api/organization-members/{userId}",
+		tags: ["Organization Members"],
+		summary: "Remove organization member",
+		pathParams: ["userId"]
+	},
+	{
+		operationId: "deleteApiOrganizationsById",
+		method: "delete",
+		path: "/api/organizations/{id}",
+		tags: ["Organizations"],
+		summary: "Delete organization",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "deleteApiPermissionsById",
+		method: "delete",
+		path: "/api/permissions/{id}",
+		tags: ["Permissions"],
+		summary: "Delete a permission",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "deleteApiProjectAppsById",
+		method: "delete",
+		path: "/api/project-apps/{id}",
+		tags: ["Project Apps"],
+		summary: "Delete a project app",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "deleteApiProjectAppsByIdPicture",
+		method: "delete",
+		path: "/api/project-apps/{id}/picture",
+		tags: ["Project Apps"],
+		summary: "Clear a project-app picture",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "deleteApiProjectOauthConnections",
+		method: "delete",
+		path: "/api/project-oauth-connections",
+		tags: ["Project OAuth Connections"],
+		summary: "Clear a project OAuth connection",
+		pathParams: []
+	},
+	{
+		operationId: "deleteApiProjectsById",
+		method: "delete",
+		path: "/api/projects/{id}",
+		tags: ["Projects"],
+		summary: "Delete a project",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "deleteApiProjectsByIdPicture",
+		method: "delete",
+		path: "/api/projects/{id}/picture",
+		tags: ["Projects"],
+		summary: "Clear a project picture",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "deleteApiProjectsByIdSyncJobsByJobId",
+		method: "delete",
+		path: "/api/projects/{id}/sync/jobs/{jobId}",
+		tags: ["Projects"],
+		summary: "Cancel a project sync job",
+		pathParams: ["id", "jobId"]
+	},
+	{
+		operationId: "deleteApiResourcesById",
+		method: "delete",
+		path: "/api/resources/{id}",
+		tags: ["Resources"],
+		summary: "Delete a resource",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "deleteApiRolesById",
+		method: "delete",
+		path: "/api/roles/{id}",
+		tags: ["Roles"],
+		summary: "Delete a role",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "deleteApiTagsById",
+		method: "delete",
+		path: "/api/tags/{id}",
+		tags: ["Tags"],
+		summary: "Delete a tag",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "deleteApiUsersById",
+		method: "delete",
+		path: "/api/users/{id}",
+		tags: ["Users"],
+		summary: "Delete a user",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "deleteApiWebhookSubscriptionsById",
+		method: "delete",
+		path: "/api/webhook-subscriptions/{id}",
+		tags: [],
+		summary: "Delete a webhook subscription",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "get.wellKnownJwks.json",
+		method: "get",
+		path: "/.well-known/jwks.json",
+		tags: ["JWKS"],
+		summary: "Get system JWKS",
+		pathParams: []
+	},
+	{
+		operationId: "getAccByAccIdPrjByProjectId.wellKnownJwks.json",
+		method: "get",
+		path: "/acc/{accId}/prj/{projectId}/.well-known/jwks.json",
+		tags: ["JWKS"],
+		summary: "Get account project JWKS",
+		pathParams: ["accId", "projectId"]
+	},
+	{
+		operationId: "getApiApiKeys",
+		method: "get",
+		path: "/api/api-keys",
+		tags: ["API Keys"],
+		summary: "List API keys",
+		pathParams: []
+	},
+	{
+		operationId: "getApiAuthGithub",
+		method: "get",
+		path: "/api/auth/github",
+		tags: ["Authentication"],
+		summary: "Initiate GitHub OAuth",
+		pathParams: []
+	},
+	{
+		operationId: "getApiAuthGithubCallback",
+		method: "get",
+		path: "/api/auth/github/callback",
+		tags: ["Authentication"],
+		summary: "GitHub OAuth callback",
+		pathParams: []
+	},
+	{
+		operationId: "getApiAuthGoogle",
+		method: "get",
+		path: "/api/auth/google",
+		tags: ["Authentication"],
+		summary: "Initiate Google OAuth",
+		pathParams: []
+	},
+	{
+		operationId: "getApiAuthGoogleCallback",
+		method: "get",
+		path: "/api/auth/google/callback",
+		tags: ["Authentication"],
+		summary: "Google OAuth callback",
+		pathParams: []
+	},
+	{
+		operationId: "getApiAuthProjectAppInfo",
+		method: "get",
+		path: "/api/auth/project/app-info",
+		tags: ["Authentication"],
+		summary: "Project app public info",
+		pathParams: []
+	},
+	{
+		operationId: "getApiAuthProjectAuthorize",
+		method: "get",
+		path: "/api/auth/project/authorize",
+		tags: ["Authentication"],
+		summary: "Initiate project OAuth",
+		pathParams: []
+	},
+	{
+		operationId: "getApiAuthProjectCallback",
+		method: "get",
+		path: "/api/auth/project/callback",
+		tags: ["Authentication"],
+		summary: "Project OAuth callback",
+		pathParams: []
+	},
+	{
+		operationId: "getApiAuthProjectConsentInfo",
+		method: "get",
+		path: "/api/auth/project/consent-info",
+		tags: ["Authentication"],
+		summary: "Consent info",
+		pathParams: []
+	},
+	{
+		operationId: "getApiAuthProviders",
+		method: "get",
+		path: "/api/auth/providers",
+		tags: ["Authentication"],
+		summary: "List OAuth providers",
+		pathParams: []
+	},
+	{
+		operationId: "getApiConfig",
+		method: "get",
+		path: "/api/config",
+		tags: ["Config"],
+		summary: "Get runtime config",
+		pathParams: []
+	},
+	{
+		operationId: "getApiGroups",
+		method: "get",
+		path: "/api/groups",
+		tags: ["Groups"],
+		summary: "List groups",
+		pathParams: []
+	},
+	{
+		operationId: "getApiMe",
+		method: "get",
+		path: "/api/me",
+		tags: ["Me"],
+		summary: "Get current user information",
+		pathParams: []
+	},
+	{
+		operationId: "getApiMeAuthenticationMethods",
+		method: "get",
+		path: "/api/me/authentication-methods",
+		tags: ["Me"],
+		summary: "Get current user authentication methods",
+		pathParams: []
+	},
+	{
+		operationId: "getApiMeExport",
+		method: "get",
+		path: "/api/me/export",
+		tags: ["Me"],
+		summary: "Export current user data",
+		pathParams: []
+	},
+	{
+		operationId: "getApiMeMfaRecoveryCodesStatus",
+		method: "get",
+		path: "/api/me/mfa/recovery-codes/status",
+		tags: ["Me"],
+		summary: "MFA recovery code status (metadata only)",
+		pathParams: []
+	},
+	{
+		operationId: "getApiMeNotificationPreferences",
+		method: "get",
+		path: "/api/me/notification-preferences",
+		tags: ["Me"],
+		summary: "List my notification preferences for a tenant",
+		pathParams: []
+	},
+	{
+		operationId: "getApiMeNotifications",
+		method: "get",
+		path: "/api/me/notifications",
+		tags: ["Me"],
+		summary: "List my in-app notifications",
+		pathParams: []
+	},
+	{
+		operationId: "getApiMeNotificationsUnreadCount",
+		method: "get",
+		path: "/api/me/notifications/unread-count",
+		tags: ["Me"],
+		summary: "Get my unread notification count",
+		pathParams: []
+	},
+	{
+		operationId: "getApiMeProjectMemberships",
+		method: "get",
+		path: "/api/me/project-memberships",
+		tags: ["Me"],
+		summary: "List my project memberships",
+		pathParams: []
+	},
+	{
+		operationId: "getApiMeProjectMembershipsByProjectId",
+		method: "get",
+		path: "/api/me/project-memberships/{projectId}",
+		tags: ["Me"],
+		summary: "Get one of my project memberships",
+		pathParams: ["projectId"]
+	},
+	{
+		operationId: "getApiMeSessions",
+		method: "get",
+		path: "/api/me/sessions",
+		tags: ["Me"],
+		summary: "Get current user sessions",
+		pathParams: []
+	},
+	{
+		operationId: "getApiOrganizationInvitations",
+		method: "get",
+		path: "/api/organization-invitations",
+		tags: ["Organization Invitations"],
+		summary: "List organization invitations",
+		pathParams: []
+	},
+	{
+		operationId: "getApiOrganizationInvitationsByToken",
+		method: "get",
+		path: "/api/organization-invitations/{token}",
+		tags: ["Organization Invitations"],
+		summary: "Get invitation by token",
+		pathParams: ["token"]
+	},
+	{
+		operationId: "getApiOrganizationMembers",
+		method: "get",
+		path: "/api/organization-members",
+		tags: ["Organization Members"],
+		summary: "List organization members",
+		pathParams: []
+	},
+	{
+		operationId: "getApiOrganizations",
+		method: "get",
+		path: "/api/organizations",
+		tags: ["Organizations"],
+		summary: "List organizations",
+		pathParams: []
+	},
+	{
+		operationId: "getApiOrganizationsById",
+		method: "get",
+		path: "/api/organizations/{id}",
+		tags: ["Organizations"],
+		summary: "Get organization by ID",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "getApiPermissions",
+		method: "get",
+		path: "/api/permissions",
+		tags: ["Permissions"],
+		summary: "List permissions",
+		pathParams: []
+	},
+	{
+		operationId: "getApiProjectApps",
+		method: "get",
+		path: "/api/project-apps",
+		tags: ["Project Apps"],
+		summary: "List project apps",
+		pathParams: []
+	},
+	{
+		operationId: "getApiProjectOauthConnections",
+		method: "get",
+		path: "/api/project-oauth-connections",
+		tags: ["Project OAuth Connections"],
+		summary: "List project OAuth connections",
+		pathParams: []
+	},
+	{
+		operationId: "getApiProjects",
+		method: "get",
+		path: "/api/projects",
+		tags: ["Projects"],
+		summary: "List projects",
+		pathParams: []
+	},
+	{
+		operationId: "getApiProjectsByIdSyncJobs",
+		method: "get",
+		path: "/api/projects/{id}/sync/jobs",
+		tags: ["Projects"],
+		summary: "List project sync jobs",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "getApiProjectsByIdSyncJobsByJobId",
+		method: "get",
+		path: "/api/projects/{id}/sync/jobs/{jobId}",
+		tags: ["Projects"],
+		summary: "Get the status of a project sync job",
+		pathParams: ["id", "jobId"]
+	},
+	{
+		operationId: "getApiProjectsByIdSyncJobsByJobIdPayload",
+		method: "get",
+		path: "/api/projects/{id}/sync/jobs/{jobId}/payload",
+		tags: ["Projects"],
+		summary: "Download the original CDM JSON payload for a sync job",
+		pathParams: ["id", "jobId"]
+	},
+	{
+		operationId: "getApiProjectsByIdSyncJobsByJobIdSnapshot",
+		method: "get",
+		path: "/api/projects/{id}/sync/jobs/{jobId}/snapshot",
+		tags: ["Projects"],
+		summary: "Download the CDM JSON snapshot attached to a sync job",
+		pathParams: ["id", "jobId"]
+	},
+	{
+		operationId: "getApiResources",
+		method: "get",
+		path: "/api/resources",
+		tags: ["Resources"],
+		summary: "List resources",
+		pathParams: []
+	},
+	{
+		operationId: "getApiRoles",
+		method: "get",
+		path: "/api/roles",
+		tags: ["Roles"],
+		summary: "List roles",
+		pathParams: []
+	},
+	{
+		operationId: "getApiSigningKeys",
+		method: "get",
+		path: "/api/signing-keys",
+		tags: ["Signing Keys"],
+		summary: "List signing keys",
+		pathParams: []
+	},
+	{
+		operationId: "getApiTags",
+		method: "get",
+		path: "/api/tags",
+		tags: ["Tags"],
+		summary: "List tags",
+		pathParams: []
+	},
+	{
+		operationId: "getApiUsers",
+		method: "get",
+		path: "/api/users",
+		tags: ["Users"],
+		summary: "List users",
+		pathParams: []
+	},
+	{
+		operationId: "getApiWebhookSubscriptions",
+		method: "get",
+		path: "/api/webhook-subscriptions",
+		tags: [],
+		summary: "List webhook subscriptions",
+		pathParams: []
+	},
+	{
+		operationId: "getApiWebhookSubscriptionsById",
+		method: "get",
+		path: "/api/webhook-subscriptions/{id}",
+		tags: [],
+		summary: "Get a webhook subscription",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "getApiWebhookSubscriptionsDeliveries",
+		method: "get",
+		path: "/api/webhook-subscriptions/deliveries",
+		tags: [],
+		summary: "List webhook delivery attempts",
+		pathParams: []
+	},
+	{
+		operationId: "getOrgByOrgIdPrjByProjectId.wellKnownJwks.json",
+		method: "get",
+		path: "/org/{orgId}/prj/{projectId}/.well-known/jwks.json",
+		tags: ["JWKS"],
+		summary: "Get organization project JWKS",
+		pathParams: ["orgId", "projectId"]
+	},
+	{
+		operationId: "patchApiGroupsById",
+		method: "patch",
+		path: "/api/groups/{id}",
+		tags: ["Groups"],
+		summary: "Update a group",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "patchApiMeProjectMembershipsByProjectId",
+		method: "patch",
+		path: "/api/me/project-memberships/{projectId}",
+		tags: ["Me"],
+		summary: "Update my project membership profile",
+		pathParams: ["projectId"]
+	},
+	{
+		operationId: "patchApiOrganizationMembersByUserId",
+		method: "patch",
+		path: "/api/organization-members/{userId}",
+		tags: ["Organization Members"],
+		summary: "Update organization member role",
+		pathParams: ["userId"]
+	},
+	{
+		operationId: "patchApiOrganizationsById",
+		method: "patch",
+		path: "/api/organizations/{id}",
+		tags: ["Organizations"],
+		summary: "Update organization",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "patchApiPermissionsById",
+		method: "patch",
+		path: "/api/permissions/{id}",
+		tags: ["Permissions"],
+		summary: "Update a permission",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "patchApiProjectAppsById",
+		method: "patch",
+		path: "/api/project-apps/{id}",
+		tags: ["Project Apps"],
+		summary: "Update a project app",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "patchApiProjectsById",
+		method: "patch",
+		path: "/api/projects/{id}",
+		tags: ["Projects"],
+		summary: "Update a project",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "patchApiResourcesById",
+		method: "patch",
+		path: "/api/resources/{id}",
+		tags: ["Resources"],
+		summary: "Update a resource",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "patchApiRolesById",
+		method: "patch",
+		path: "/api/roles/{id}",
+		tags: ["Roles"],
+		summary: "Update a role",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "patchApiTagsById",
+		method: "patch",
+		path: "/api/tags/{id}",
+		tags: ["Tags"],
+		summary: "Update a tag",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "patchApiUsersById",
+		method: "patch",
+		path: "/api/users/{id}",
+		tags: ["Users"],
+		summary: "Update a user",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "patchApiWebhookSubscriptionsById",
+		method: "patch",
+		path: "/api/webhook-subscriptions/{id}",
+		tags: [],
+		summary: "Update a webhook subscription",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "postApiApiKeys",
+		method: "post",
+		path: "/api/api-keys",
+		tags: ["API Keys"],
+		summary: "Create a new API key",
+		pathParams: []
+	},
+	{
+		operationId: "postApiApiKeysByIdRevoke",
+		method: "post",
+		path: "/api/api-keys/{id}/revoke",
+		tags: ["API Keys"],
+		summary: "Revoke an API key",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "postApiApiKeysByIdRotate",
+		method: "post",
+		path: "/api/api-keys/{id}/rotate",
+		tags: ["API Keys"],
+		summary: "Rotate an API key secret",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "postApiAuthCliCallback",
+		method: "post",
+		path: "/api/auth/cli-callback",
+		tags: ["Authentication"],
+		summary: "Exchange CLI one-time code for session tokens",
+		pathParams: []
+	},
+	{
+		operationId: "postApiAuthIsAuthorized",
+		method: "post",
+		path: "/api/auth/is-authorized",
+		tags: ["Authentication"],
+		summary: "Check if user is authorized",
+		pathParams: []
+	},
+	{
+		operationId: "postApiAuthLogin",
+		method: "post",
+		path: "/api/auth/login",
+		tags: ["Authentication"],
+		summary: "Login user",
+		pathParams: []
+	},
+	{
+		operationId: "postApiAuthLogout",
+		method: "post",
+		path: "/api/auth/logout",
+		tags: ["Authentication"],
+		summary: "Logout user",
+		pathParams: []
+	},
+	{
+		operationId: "postApiAuthMfaRecoveryVerify",
+		method: "post",
+		path: "/api/auth/mfa/recovery/verify",
+		tags: ["Authentication"],
+		summary: "Complete MFA challenge with recovery code",
+		pathParams: []
+	},
+	{
+		operationId: "postApiAuthMfaSetup",
+		method: "post",
+		path: "/api/auth/mfa/setup",
+		tags: ["Authentication"],
+		summary: "Initialize TOTP MFA enrollment",
+		pathParams: []
+	},
+	{
+		operationId: "postApiAuthMfaVerify",
+		method: "post",
+		path: "/api/auth/mfa/verify",
+		tags: ["Authentication"],
+		summary: "Complete MFA challenge with TOTP",
+		pathParams: []
+	},
+	{
+		operationId: "postApiAuthProjectConsentApprove",
+		method: "post",
+		path: "/api/auth/project/consent/approve",
+		tags: ["Authentication"],
+		summary: "Approve consent",
+		pathParams: []
+	},
+	{
+		operationId: "postApiAuthProjectConsentDeny",
+		method: "post",
+		path: "/api/auth/project/consent/deny",
+		tags: ["Authentication"],
+		summary: "Deny consent",
+		pathParams: []
+	},
+	{
+		operationId: "postApiAuthProjectEmailRequest",
+		method: "post",
+		path: "/api/auth/project/email/request",
+		tags: ["Authentication"],
+		summary: "Request project OAuth magic link",
+		pathParams: []
+	},
+	{
+		operationId: "postApiAuthRefresh",
+		method: "post",
+		path: "/api/auth/refresh",
+		tags: ["Authentication"],
+		summary: "Refresh session",
+		pathParams: []
+	},
+	{
+		operationId: "postApiAuthRegister",
+		method: "post",
+		path: "/api/auth/register",
+		tags: ["Authentication"],
+		summary: "Register new user",
+		pathParams: []
+	},
+	{
+		operationId: "postApiAuthRequestPasswordReset",
+		method: "post",
+		path: "/api/auth/request-password-reset",
+		tags: ["Authentication"],
+		summary: "Request password reset",
+		pathParams: []
+	},
+	{
+		operationId: "postApiAuthResendVerification",
+		method: "post",
+		path: "/api/auth/resend-verification",
+		tags: ["Authentication"],
+		summary: "Resend verification email",
+		pathParams: []
+	},
+	{
+		operationId: "postApiAuthResetPassword",
+		method: "post",
+		path: "/api/auth/reset-password",
+		tags: ["Authentication"],
+		summary: "Reset password",
+		pathParams: []
+	},
+	{
+		operationId: "postApiAuthToken",
+		method: "post",
+		path: "/api/auth/token",
+		tags: ["API Keys", "Authentication"],
+		summary: "Exchange API key for access token",
+		pathParams: []
+	},
+	{
+		operationId: "postApiAuthVerifyEmail",
+		method: "post",
+		path: "/api/auth/verify-email",
+		tags: ["Authentication"],
+		summary: "Verify email address",
+		pathParams: []
+	},
+	{
+		operationId: "postApiGroups",
+		method: "post",
+		path: "/api/groups",
+		tags: ["Groups"],
+		summary: "Create a new group",
+		pathParams: []
+	},
+	{
+		operationId: "postApiMeAccounts",
+		method: "post",
+		path: "/api/me/accounts",
+		tags: ["Me"],
+		summary: "Create a secondary account for the current user",
+		pathParams: []
+	},
+	{
+		operationId: "postApiMeAuthenticationMethods",
+		method: "post",
+		path: "/api/me/authentication-methods",
+		tags: ["Me"],
+		summary: "Create a new authentication method for the current user",
+		pathParams: []
+	},
+	{
+		operationId: "postApiMeChangePassword",
+		method: "post",
+		path: "/api/me/change-password",
+		tags: ["Me"],
+		summary: "Change current user password",
+		pathParams: []
+	},
+	{
+		operationId: "postApiMeLogout",
+		method: "post",
+		path: "/api/me/logout",
+		tags: ["Me"],
+		summary: "Logout current user and revoke session",
+		pathParams: []
+	},
+	{
+		operationId: "postApiMeNotificationsByIdRead",
+		method: "post",
+		path: "/api/me/notifications/{id}/read",
+		tags: ["Me"],
+		summary: "Mark a notification as read",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "postApiMeNotificationsReadAll",
+		method: "post",
+		path: "/api/me/notifications/read-all",
+		tags: ["Me"],
+		summary: "Mark all my notifications as read",
+		pathParams: []
+	},
+	{
+		operationId: "postApiMePicture",
+		method: "post",
+		path: "/api/me/picture",
+		tags: ["Me"],
+		summary: "Upload current user profile picture",
+		pathParams: []
+	},
+	{
+		operationId: "postApiMePictureConfirm",
+		method: "post",
+		path: "/api/me/picture/confirm",
+		tags: ["Me"],
+		summary: "Record a completed direct upload of the current user picture",
+		pathParams: []
+	},
+	{
+		operationId: "postApiMePictureUploadUrl",
+		method: "post",
+		path: "/api/me/picture/upload-url",
+		tags: ["Me"],
+		summary: "Request a direct-upload URL for the current user picture",
+		pathParams: []
+	},
+	{
+		operationId: "postApiOrganizationInvitationsAccept",
+		method: "post",
+		path: "/api/organization-invitations/accept",
+		tags: ["Organization Invitations"],
+		summary: "Accept organization invitation",
+		pathParams: []
+	},
+	{
+		operationId: "postApiOrganizationInvitationsByIdRenew",
+		method: "post",
+		path: "/api/organization-invitations/{id}/renew",
+		tags: ["Organization Invitations"],
+		summary: "Renew expired invitation",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "postApiOrganizationInvitationsByIdResendEmail",
+		method: "post",
+		path: "/api/organization-invitations/{id}/resend-email",
+		tags: ["Organization Invitations"],
+		summary: "Resend invitation email",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "postApiOrganizationInvitationsInvite",
+		method: "post",
+		path: "/api/organization-invitations/invite",
+		tags: ["Organization Invitations"],
+		summary: "Invite member to organization",
+		pathParams: []
+	},
+	{
+		operationId: "postApiOrganizations",
+		method: "post",
+		path: "/api/organizations",
+		tags: ["Organizations"],
+		summary: "Create organization",
+		pathParams: []
+	},
+	{
+		operationId: "postApiOrganizationsByIdPicture",
+		method: "post",
+		path: "/api/organizations/{id}/picture",
+		tags: ["Organizations"],
+		summary: "Upload organization logo",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "postApiOrganizationsByIdPictureConfirm",
+		method: "post",
+		path: "/api/organizations/{id}/picture/confirm",
+		tags: ["Organizations"],
+		summary: "Record a completed direct upload of an organization logo",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "postApiOrganizationsByIdPictureUploadUrl",
+		method: "post",
+		path: "/api/organizations/{id}/picture/upload-url",
+		tags: ["Organizations"],
+		summary: "Request a direct-upload URL for an organization logo",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "postApiPermissions",
+		method: "post",
+		path: "/api/permissions",
+		tags: ["Permissions"],
+		summary: "Create a new permission",
+		pathParams: []
+	},
+	{
+		operationId: "postApiProjectApps",
+		method: "post",
+		path: "/api/project-apps",
+		tags: ["Project Apps"],
+		summary: "Create a project app",
+		pathParams: []
+	},
+	{
+		operationId: "postApiProjectAppsByIdPicture",
+		method: "post",
+		path: "/api/project-apps/{id}/picture",
+		tags: ["Project Apps"],
+		summary: "Upload a project-app picture",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "postApiProjectAppsByIdPictureConfirm",
+		method: "post",
+		path: "/api/project-apps/{id}/picture/confirm",
+		tags: ["Project Apps"],
+		summary: "Record a completed direct upload of a project-app picture",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "postApiProjectAppsByIdPictureUploadUrl",
+		method: "post",
+		path: "/api/project-apps/{id}/picture/upload-url",
+		tags: ["Project Apps"],
+		summary: "Request a direct-upload URL for a project-app picture",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "postApiProjects",
+		method: "post",
+		path: "/api/projects",
+		tags: ["Projects"],
+		summary: "Create a new project",
+		pathParams: []
+	},
+	{
+		operationId: "postApiProjectsByIdPicture",
+		method: "post",
+		path: "/api/projects/{id}/picture",
+		tags: ["Projects"],
+		summary: "Upload a project picture",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "postApiProjectsByIdPictureConfirm",
+		method: "post",
+		path: "/api/projects/{id}/picture/confirm",
+		tags: ["Projects"],
+		summary: "Record a completed direct upload of a project picture",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "postApiProjectsByIdPictureUploadUrl",
+		method: "post",
+		path: "/api/projects/{id}/picture/upload-url",
+		tags: ["Projects"],
+		summary: "Request a direct-upload URL for a project picture",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "postApiProjectsByIdSyncJobs",
+		method: "post",
+		path: "/api/projects/{id}/sync/jobs",
+		tags: ["Projects"],
+		summary: "Start an asynchronous CDM import job",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "postApiProjectsByIdSyncJobsExport",
+		method: "post",
+		path: "/api/projects/{id}/sync/jobs/export",
+		tags: ["Projects"],
+		summary: "Enqueue an asynchronous CDM export job",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "postApiResources",
+		method: "post",
+		path: "/api/resources",
+		tags: ["Resources"],
+		summary: "Create a new resource",
+		pathParams: []
+	},
+	{
+		operationId: "postApiRoles",
+		method: "post",
+		path: "/api/roles",
+		tags: ["Roles"],
+		summary: "Create a new role",
+		pathParams: []
+	},
+	{
+		operationId: "postApiSigningKeysRotate",
+		method: "post",
+		path: "/api/signing-keys/rotate",
+		tags: ["Signing Keys"],
+		summary: "Rotate signing key",
+		pathParams: []
+	},
+	{
+		operationId: "postApiTags",
+		method: "post",
+		path: "/api/tags",
+		tags: ["Tags"],
+		summary: "Create a new tag",
+		pathParams: []
+	},
+	{
+		operationId: "postApiUsers",
+		method: "post",
+		path: "/api/users",
+		tags: ["Users"],
+		summary: "Create a new user",
+		pathParams: []
+	},
+	{
+		operationId: "postApiWebhookSubscriptions",
+		method: "post",
+		path: "/api/webhook-subscriptions",
+		tags: [],
+		summary: "Create webhook subscription",
+		pathParams: []
+	},
+	{
+		operationId: "postApiWebhookSubscriptionsByIdRotateSecret",
+		method: "post",
+		path: "/api/webhook-subscriptions/{id}/rotate-secret",
+		tags: [],
+		summary: "Rotate a webhook subscription secret",
+		pathParams: ["id"]
+	},
+	{
+		operationId: "postApiWebhookSubscriptionsDeliveriesByDeliveryIdReplay",
+		method: "post",
+		path: "/api/webhook-subscriptions/deliveries/{deliveryId}/replay",
+		tags: [],
+		summary: "Replay a webhook delivery",
+		pathParams: ["deliveryId"]
+	},
+	{
+		operationId: "putApiMeNotificationPreferences",
+		method: "put",
+		path: "/api/me/notification-preferences",
+		tags: ["Me"],
+		summary: "Set one of my notification preferences",
+		pathParams: []
+	},
+	{
+		operationId: "putApiProjectOauthConnections",
+		method: "put",
+		path: "/api/project-oauth-connections",
+		tags: ["Project OAuth Connections"],
+		summary: "Upsert a project OAuth connection",
+		pathParams: []
+	}
+];
+//#endregion
+//#region src/commands/from-spec.ts
+var SKIP_PATHS = /* @__PURE__ */ new Set([
+	"/api/auth/login",
+	"/api/auth/register",
+	"/api/auth/cli-callback",
+	"/api/auth/github"
+]);
+function parseQuery(pairs) {
+	const query = {};
+	for (const pair of pairs ?? []) {
+		const eq = pair.indexOf("=");
+		if (eq <= 0) continue;
+		query[pair.slice(0, eq)] = pair.slice(eq + 1);
+	}
+	return query;
+}
+function addOperationCommand(group, operation, verb) {
+	const cmd = group.command(verb).description(operation.summary || `${operation.method.toUpperCase()} ${operation.path}`).option("-p, --profile <name>", "Profile to use (or GRANT_PROFILE)").option("--output <format>", "json or text").option("--scope-id <id>", "Override selected scope id").option("--tenant <tenant>", "Override selected scope tenant").option("-q, --query <pair...>", "Extra query pairs (key=value)").option("--body <json>", "JSON body");
+	for (const param of operation.pathParams) cmd.requiredOption(`--${flagName(param)} <value>`, `Path parameter ${param}`);
+	cmd.action(async (options) => {
+		try {
+			const params = {};
+			for (const param of operation.pathParams) {
+				const value = options[param] ?? options[flagName(param)];
+				if (typeof value === "string") params[param] = value;
+			}
+			const path = applyPathParams(operation.path, params);
+			const format = parseOutputFormat(options.output);
+			const body = options.body ? JSON.parse(options.body) : void 0;
+			const { data } = await authenticatedRequest({
+				flags: {
+					profile: options.profile,
+					scopeId: options.scopeId,
+					tenant: options.tenant
+				},
+				method: operation.method,
+				path,
+				query: parseQuery(options.query),
+				body
+			});
+			printOutput(data, format);
+		} catch (err) {
+			handleCliError(err);
+		}
+	});
+}
+function createSpecCommands(program) {
+	const mapped = mapOperations(vendoredOperations.filter((operation) => !SKIP_PATHS.has(operation.path)));
+	const groups = /* @__PURE__ */ new Map();
+	for (const item of mapped) {
+		const list = groups.get(item.group) ?? [];
+		list.push(item);
+		groups.set(item.group, list);
+	}
+	for (const [name, items] of [...groups.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+		if (program.commands.some((existing) => existing.name() === name)) continue;
+		const group = program.command(name).description(`REST ${name} operations`);
+		const verbs = /* @__PURE__ */ new Set();
+		for (const item of items) {
+			if (verbs.has(item.verb) || group.commands.some((existing) => existing.name() === item.verb)) continue;
+			verbs.add(item.verb);
+			addOperationCommand(group, item.operation, item.verb);
+		}
+	}
+}
+//#endregion
 //#region src/commands/generate-types-impl.ts
 /**
 * Generate TypeScript content for ResourceSlug and ResourceAction from project data.
@@ -3630,19 +5205,25 @@ function generateTypesContent(slugs, actions) {
 var DEFAULT_OUTPUT = "./grant-types.ts";
 function createGenerateTypesCommand(program) {
 	program.command("generate-types").description("Query the selected project's resources and permissions, then generate ResourceSlug and ResourceAction TypeScript constants").option("-p, --profile <name>", "Profile to use (default: default profile)").option("-o, --output <path>", "Output file path (default: from grant start, or ./grant-types.ts)").option("--dry-run", "Print what would be generated without writing").addHelpText("after", "\nExample:\n  grant generate-types --profile staging -o ./src/grant-types.ts\n").action(async (options) => {
-		const result = await loadProfile(options.profile);
-		if (!result?.config?.selectedScope) {
-			console.error("No project selected for this profile. Run \"grant start\" first or use --profile <name>.");
+		let config;
+		let scope;
+		try {
+			const ctx = await resolveRuntimeContext({ profile: options.profile });
+			config = ctx.config;
+			scope = ctx.scope;
+		} catch (err) {
+			handleCliError(err);
+		}
+		if (!config || !scope) {
+			console.error("No project selected for this profile. Run \"grant start\" first or set GRANT_SCOPE_ID and GRANT_SCOPE_TENANT.");
 			process.exitCode = 1;
 			return;
 		}
-		const config = result.config;
-		const scope = result.config.selectedScope;
 		const outputPath = resolve(process.cwd(), options.output ?? config.generateTypesOutputPath ?? DEFAULT_OUTPUT);
 		const dryRun = options.dryRun === true;
 		try {
 			const accessToken = await resolveAccessToken(config);
-			const [resources, permissions] = await Promise.all([fetchResources(config.apiUrl, accessToken, scope), fetchPermissions(config.apiUrl, accessToken, scope)]);
+			const [resources, permissions] = await Promise.all([fetchResources(config.apiUrl, accessToken, scope, config.originVerifySecret), fetchPermissions(config.apiUrl, accessToken, scope, config.originVerifySecret)]);
 			const slugs = resources.map((r) => r.slug).filter(Boolean);
 			const actions = permissions.map((p) => p.action).filter(Boolean);
 			const content = generateTypesContent(slugs, actions);
@@ -4116,7 +5697,7 @@ function createStartCommand(program) {
 //#endregion
 //#region src/utils/package.ts
 function getPackageVersion() {
-	return "1.12.0";
+	return "1.13.0";
 }
 //#endregion
 //#region src/commands/version.ts
@@ -4128,6 +5709,35 @@ function createVersionCommand(program) {
 	});
 }
 //#endregion
+//#region src/commands/whoami.ts
+function createWhoamiCommand(program) {
+	program.command("whoami").description("Show the authenticated caller (GET /api/me)").option("-p, --profile <name>", "Profile to use (or GRANT_PROFILE)").option("--output <format>", "json or text").option("--scope-id <id>", "Override selected scope id").option("--tenant <tenant>", "Override selected scope tenant").action(async (options) => {
+		try {
+			const format = parseOutputFormat(options.output);
+			const ctx = await resolveRuntimeContext({
+				profile: options.profile,
+				scopeId: options.scopeId,
+				tenant: options.tenant
+			});
+			const { data } = await authenticatedRequest({
+				flags: options,
+				method: "GET",
+				path: "/api/me",
+				injectScope: false
+			});
+			printOutput({
+				profile: ctx.profileName,
+				apiUrl: ctx.apiUrl,
+				authMethod: ctx.authMethod,
+				scope: ctx.scope ?? null,
+				me: data
+			}, format);
+		} catch (err) {
+			handleCliError(err);
+		}
+	});
+}
+//#endregion
 //#region src/index.ts
 var program = new Command();
 program.name("grant").description("Grant CLI - Setup, authentication, and typings generation for @grantjs/server").enablePositionalOptions().addHelpText("after", `
@@ -4137,6 +5747,9 @@ Examples:
   grant config list                   List profiles and default
   grant config show --profile staging Show config for a profile
   grant config set api-url http://localhost:4000 --profile default
+  grant whoami --profile ci --output json
+  grant api get /api/users --profile ci
+  grant users list --output json
   grant generate-types --profile staging   Generate types for a profile
   grant --help                        Show this help
   grant config set --help             Show help for config set subcommands
@@ -4145,6 +5758,9 @@ createVersionCommand(program);
 createConfigCommand(program);
 createStartCommand(program);
 createGenerateTypesCommand(program);
+createWhoamiCommand(program);
+createApiCommand(program);
+createSpecCommands(program);
 program.parse();
 //#endregion