@hs-x/cli 0.2.7 → 0.3.6

package/dist/commands/connect.js

@@ -1,14 +1,14 @@
-import { join } from 'node:path';
 import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
 import { HttpClientRequest, Schema, schemas } from '@hs-x/types';
-import { loadCreateControlPlane } from '../control-plane-loader.js';
 import { Effect } from 'effect';
-import { emitHelp } from '../help.js';
+import { isCustomControlPlane, resolveControlPlaneUrl } from '../config.js';
 import { controlPlaneAuthHeaders } from '../control-plane-fetch.js';
+import { loadCreateControlPlane } from '../control-plane-loader.js';
 import { executeCliHttp } from '../effect-http.js';
-import { isCustomControlPlane, resolveControlPlaneUrl } from '../config.js';
-import { createReporter } from '../reporter/index.js';
+import { emitHelp } from '../help.js';
 import { isInteractive, promptConfirm, promptSelect, promptText } from '../prompt.js';
+import { createReporter } from '../reporter/index.js';
 import { connectHelpText } from './help-command.js';
 async function hostedHttp(input) {
     const headers = { ...(input.headers ?? {}) };
@@ -107,26 +107,25 @@ async function connectWizard({ argv, cwd, json, }) {
 async function connectHubspotCommand({ argv, cwd, json, }) {
     const interactive = !json && isInteractive();
     const authMethod = resolveFlag(argv, '--auth-method') ?? 'pak';
-    // A HubSpot account binds 1:1 into ONE HS-X account, so the hosted connect
-    // requires a logged-in HS-X session. Gate the *interactive* flow up front —
-    // otherwise the user discovers accounts and pastes a PAK only to fail at the
-    // control-plane call with HSX_E_NOT_LOGGED_IN. Non-interactive/scripted
-    // callers (and `--no-control-plane` / `--local-control-plane`, which exercise
-    // the offline/local contract) are left to the server / fail fast at the call.
-    const usesHostedControlPlane = !argv.includes('--no-control-plane') && !argv.includes('--local-control-plane');
-    if (interactive && usesHostedControlPlane) {
-        const { isLinked, loadStore } = await import('../account-store.js');
-        if (!(await isLinked())) {
-            const reporter = createReporter({ command: 'connect hubspot', argv });
-            const code = 'HSX_E_NOT_LOGGED_IN';
-            reporter.error(code, 'Log in to an HS-X account before connecting HubSpot.', {
-                hint: 'Connecting a HubSpot account binds it 1:1 into one HS-X account. Run `hs-x login` first, then re-run `hs-x connect hubspot`.',
-                docs_url: `https://hs-x.dev/errors/${code}`,
-            });
-            reporter.done(undefined, 10);
-            return { exitCode: 10 };
-        }
-        // Surface which HS-X account this HubSpot account will bind into.
+    // ADR-025: the default `connect` is stored-direct (mode 2) — capture the
+    // credential, store it in local custody, and report success WITHOUT an HS-X
+    // account. The linked/hosted platform path (mode 3) is opt-in: taken only
+    // when the user is logged in (`isLinked()`), explicitly targets a custom
+    // control plane (`--control-plane-url` / `HSX_CONTROL_PLANE_URL`), or
+    // exercises the local contract handler (`--local-control-plane`).
+    // `--no-control-plane` always forces stored-direct. A HubSpot account still
+    // binds 1:1 into an HS-X account, but only on the opt-in linked path.
+    const localControlPlane = argv.includes('--local-control-plane');
+    const noControlPlane = argv.includes('--no-control-plane');
+    const { isLinked, loadStore } = await import('../account-store.js');
+    const linked = localControlPlane
+        ? true
+        : noControlPlane
+            ? false
+            : isCustomControlPlane(resolveControlPlaneUrl(argv)) || (await isLinked());
+    if (interactive && linked && !localControlPlane) {
+        // Opt-in linked path: surface which HS-X account this HubSpot account
+        // will bind into.
         const store = await loadStore();
         const active = store.defaultAccountId ? store.accounts[store.defaultAccountId] : undefined;
         if (active) {
@@ -317,11 +316,88 @@ async function connectHubspotCommand({ argv, cwd, json, }) {
         displayName: request.displayName,
         authMethod: request.authMethod,
     };
-    const noControlPlane = argv.includes('--no-control-plane');
-    const controlPlaneUrl = !noControlPlane && !argv.includes('--local-control-plane')
-        ? resolveControlPlaneUrl(argv)
-        : undefined;
-    if (controlPlaneUrl) {
+    // Stored-direct (ADR-025 mode 2) — the DEFAULT. No HS-X account, no control
+    // plane: capture the credential into local custody (HS-X store + HubSpot CLI
+    // config, where `hs-x deploy` reads it) and report success. Network-free: the
+    // PAK is validated at deploy time, not here, so a scripted `--pak` connect
+    // works offline.
+    if (!linked) {
+        await persistConnectedAccount({
+            id: accountId,
+            displayName: request.displayName,
+            hubspotPortalId: Number(developerAccountId),
+        });
+        const hscliResult = personalAccessKey && Number.isFinite(Number(developerAccountId))
+            ? await persistPakToHubSpotCli({
+                portalId: Number(developerAccountId),
+                pak: personalAccessKey,
+                ...(discoveredDefault?.persistInfo?.hubName
+                    ? { hubName: discoveredDefault.persistInfo.hubName }
+                    : {}),
+            })
+            : undefined;
+        const result = {
+            ok: true,
+            command: 'connect hubspot',
+            mode: 'stored-direct',
+            accountId,
+            request: safeRequest,
+        };
+        if (json) {
+            write(`${JSON.stringify(result, null, 2)}\n`);
+        }
+        else {
+            const reporter = createReporter({ command: 'connect hubspot', argv });
+            reporter.header(accountId);
+            reporter.step('Stored HubSpot developer credential').ok(request.displayName);
+            renderCredentialDestinations(reporter, {
+                hsxStore: defaultStorePathForLog(),
+                ...(hscliResult?.written ? { hscli: hscliResult.path } : {}),
+            });
+            reporter.info('');
+            reporter.info('Stored locally — no HS-X account needed. Run `hs-x deploy` to ship. To link this into an HS-X account (dashboard, teams, hosted billing), run `hs-x login`, then re-run `hs-x connect hubspot`.');
+            reporter.done('Connected');
+        }
+        return { exitCode: 0 };
+    }
+    // Linked local contract handler (`--local-control-plane`).
+    if (localControlPlane) {
+        const connection = await requestLocalControlPlaneHubSpotConnect({ accountId, request });
+        const result = {
+            ok: true,
+            command: 'connect hubspot',
+            mode: 'local-control-plane-connect',
+            accountId,
+            request: safeRequest,
+            connection,
+        };
+        await persistConnectedAccount({
+            id: accountId,
+            displayName: connection.displayName,
+            hubspotPortalId: Number(developerAccountId),
+        });
+        const hscliResult = await maybePersistToHubSpotCli(discoveredDefault, personalAccessKey);
+        if (json) {
+            write(`${JSON.stringify(result, null, 2)}\n`);
+        }
+        else {
+            const reporter = createReporter({ command: 'connect hubspot', argv });
+            reporter.header(connection.accountId);
+            reporter
+                .step('Connected HubSpot developer account (local control plane)')
+                .ok(connection.displayName);
+            renderCredentialDestinations(reporter, {
+                hsxStore: defaultStorePathForLog(),
+                hscli: hscliResult?.written ? hscliResult.path : null,
+                controlPlane: 'local (in-memory)',
+            });
+            reporter.done();
+        }
+        return { exitCode: 0 };
+    }
+    // Linked hosted platform path (logged in, or explicit `--control-plane-url`).
+    {
+        const controlPlaneUrl = resolveControlPlaneUrl(argv);
         // Validate the PAK with a cheap exchange BEFORE storing it, so a typo'd or
         // revoked key is rejected here with a pointed error instead of persisting
         // garbage that fails on every later deploy. The browser flow has already
@@ -394,60 +470,6 @@ async function connectHubspotCommand({ argv, cwd, json, }) {
         }
         return { exitCode: 0 };
     }
-    if (!argv.includes('--local-control-plane')) {
-        const result = {
-            ok: true,
-            command: 'connect hubspot',
-            mode: 'request',
-            accountId,
-            request: safeRequest,
-            nextStep: 'Pass --control-plane-url to connect through the control plane or --local-control-plane to exercise the local contract handler.',
-        };
-        if (json) {
-            write(`${JSON.stringify(result, null, 2)}\n`);
-        }
-        else {
-            const reporter = createReporter({ command: 'connect hubspot', argv });
-            reporter.header(accountId);
-            reporter.info(`Prepared HubSpot connect request for ${request.displayName}.`);
-            reporter.warn('HSX_W_CONNECT_NO_TRANSPORT', 'Hosted transport is not wired yet.');
-            reporter.info('Pass --control-plane-url or --local-control-plane to complete the connect.');
-            reporter.done('Prepared');
-        }
-        return { exitCode: 0 };
-    }
-    const connection = await requestLocalControlPlaneHubSpotConnect({ accountId, request });
-    const result = {
-        ok: true,
-        command: 'connect hubspot',
-        mode: 'local-control-plane-connect',
-        accountId,
-        request: safeRequest,
-        connection,
-    };
-    await persistConnectedAccount({
-        id: accountId,
-        displayName: connection.displayName,
-        hubspotPortalId: Number(developerAccountId),
-    });
-    const hscliResult = await maybePersistToHubSpotCli(discoveredDefault, personalAccessKey);
-    if (json) {
-        write(`${JSON.stringify(result, null, 2)}\n`);
-    }
-    else {
-        const reporter = createReporter({ command: 'connect hubspot', argv });
-        reporter.header(connection.accountId);
-        reporter
-            .step('Connected HubSpot developer account (local control plane)')
-            .ok(connection.displayName);
-        renderCredentialDestinations(reporter, {
-            hsxStore: defaultStorePathForLog(),
-            hscli: hscliResult?.written ? hscliResult.path : null,
-            controlPlane: 'local (in-memory)',
-        });
-        reporter.done();
-    }
-    return { exitCode: 0 };
 }
 function renderCredentialDestinations(reporter, destinations) {
     reporter.info('');
@@ -489,6 +511,25 @@ async function maybePersistToHubSpotCli(discoveredDefault, pak) {
         return undefined;
     }
 }
+/**
+ * Stored-direct persistence: write a raw PAK to the HubSpot CLI config (where
+ * `hs-x deploy` discovers it) without an OAuth exchange. Best-effort — a write
+ * failure never fails the connect; deploy also accepts `--pak` / `HSX_HUBSPOT_PAK`.
+ */
+async function persistPakToHubSpotCli(input) {
+    try {
+        const { persistToHubSpotCliConfig } = await import('../hubspot-auth.js');
+        const result = await persistToHubSpotCliConfig({
+            portalId: input.portalId,
+            pak: input.pak,
+            ...(input.hubName ? { hubName: input.hubName } : {}),
+        });
+        return result.written ? result : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 async function resolveAccountIdOrPrompt(input) {
     const fromFlag = resolveFlag(input.argv, '--account-id') ?? process.env.HSX_ACCOUNT_ID;
     if (fromFlag && fromFlag.length > 0)
@@ -624,7 +665,7 @@ async function runCloudflareOAuthFlow(input) {
     return Effect.runPromise(Effect.promise(() => runCloudflareOAuthFlowBody(input)).pipe(Effect.withSpan('cli.cloudflare_oauth.flow', {
         attributes: {
             account_id: input.hsxAccountId,
-            brokered: Boolean(resolveControlPlaneUrl(input.argv)),
+            brokered: input.brokered,
         },
     })));
 }
@@ -677,7 +718,7 @@ async function runCloudflareOAuthFlowBody(input) {
         // browser on this machine completes the redirect.
         reporter.info('No TTY detected — not launching a browser.');
         reporter.info(`Authorize HS-X by opening: ${authorizeUrl}`);
-        reporter.info(`Waiting up to ${Math.round(timeoutMs / 1000)}s for the OAuth callback. For headless runs use --auth-method api-token with HSX_CLOUDFLARE_API_TOKEN instead.`);
+        reporter.info(`Waiting up to ${Math.round(timeoutMs / 1000)}s for the OAuth callback. For headless runs use --auth-method api-token with CLOUDFLARE_API_TOKEN (alias: HSX_CLOUDFLARE_API_TOKEN) instead.`);
     }
     let code;
     try {
@@ -703,12 +744,15 @@ async function runCloudflareOAuthFlowBody(input) {
         throw error;
     }
     await listener.close();
-    // Brokered path: control plane has a client id AND we didn't take the env
-    // override. The control plane will exchange the code, store the refresh
-    // token, and return the CloudflareConnection in one round trip.
+    // Brokered path (opt-in linked, mode 3): the control plane exchanges the
+    // code, stores the refresh token server-side against the HS-X account, and
+    // returns the CloudflareConnection in one round trip. Taken only when the
+    // caller opted into the linked path AND we didn't take the dev env override.
+    // The stored-direct default (`brokered` false) falls through to the local
+    // exchange below, which keeps the refresh token in local custody.
     const envHasOverride = typeof process.env.HSX_CLOUDFLARE_OAUTH_CLIENT_ID === 'string' &&
         process.env.HSX_CLOUDFLARE_OAUTH_CLIENT_ID.length > 0;
-    if (controlPlaneUrl && !envHasOverride) {
+    if (input.brokered && controlPlaneUrl && !envHasOverride) {
         try {
             const connection = await postCloudflareOAuthComplete({
                 controlPlaneUrl,
@@ -768,17 +812,27 @@ async function runCloudflareOAuthFlowBody(input) {
     }
     let discoveredAccountId;
     try {
-        const { verifyCloudflareToken } = await import('../cloudflare-auth.js');
-        const info = await verifyCloudflareToken(tokens.accessToken);
-        discoveredAccountId = info.accountId;
+        // Resolve the account id via /accounts, NOT verifyCloudflareToken: OAuth
+        // access tokens 400 on the API-token verify endpoint, which left the id
+        // undefined and silently skipped persistence below (the credential is keyed
+        // by account id). /accounts works with the granted account-read scope.
+        const { resolveCloudflareAccountId } = await import('../cloudflare-auth.js');
+        discoveredAccountId = await resolveCloudflareAccountId(tokens.accessToken);
     }
     catch {
-        // verification is optional here
+        // account discovery is best-effort
     }
-    if (tokens.refreshToken && discoveredAccountId) {
+    // Persist the credential so a later `hs-x deploy` can reuse this connection
+    // without re-authorizing. Cloudflare OAuth returns no refresh token, so the
+    // access token IS what we store (with its expiry); deploy uses it directly
+    // while valid and prompts a reconnect once it lapses.
+    if (discoveredAccountId && (tokens.refreshToken || tokens.accessToken)) {
         try {
             await saveCloudflareOAuthCredential(discoveredAccountId, {
-                refreshToken: tokens.refreshToken,
+                ...(tokens.refreshToken ? { refreshToken: tokens.refreshToken } : {}),
+                ...(tokens.accessToken
+                    ? { accessToken: tokens.accessToken, accessTokenExpiresAt: tokens.expiresAt }
+                    : {}),
                 ...(tokens.scope ? { scope: tokens.scope } : {}),
             });
         }
@@ -894,19 +948,21 @@ function defaultStorePathForLog() {
     return join(process.env.HOME ?? '~', '.hsx', 'config.json');
 }
 async function connectCloudflareCommand({ argv, json, }) {
+    // ADR-025: the default is stored-direct (mode 2) — connect Cloudflare and
+    // keep the refresh token in local custody, with NO HS-X account. The linked
+    // path (mode 3) is opt-in: taken only when logged in, when a custom control
+    // plane is targeted, or when exercising the local contract. When there's no
+    // HS-X account we still proceed under a local placeholder id (the local
+    // OAuth store keys the credential by Cloudflare account id, not this id).
+    const localControlPlane = argv.includes('--local-control-plane');
+    const { isLinked } = await import('../account-store.js');
+    const linked = localControlPlane
+        ? true
+        : isCustomControlPlane(resolveControlPlaneUrl(argv)) || (await isLinked());
     const accountId = resolveFlag(argv, '--account-id') ??
         process.env.HSX_ACCOUNT_ID ??
-        (await defaultHsxAccountId());
-    if (!accountId) {
-        const reporter = createReporter({ command: 'connect cloudflare', argv });
-        const code = 'HSX_E_INPUT_NO_HSX_ACCOUNT';
-        reporter.error(code, 'No HS-X account to bind Cloudflare to.', {
-            hint: 'Run `hs-x connect` first to create an HS-X account.',
-            docs_url: `https://hs-x.dev/errors/${code}`,
-        });
-        reporter.done(undefined, 10);
-        return { exitCode: 10 };
-    }
+        (await defaultHsxAccountId()) ??
+        'acct_local';
     const interactive = !json && isInteractive();
     let cloudflareAccountId = resolveFlag(argv, '--cloudflare-account-id');
     let displayName = resolveFlag(argv, '--display-name');
@@ -925,6 +981,13 @@ async function connectCloudflareCommand({ argv, json, }) {
         reporter.done(undefined, 10);
         return { exitCode: 10 };
     }
+    // One visual timeline: identity header first, then the OAuth steps, then
+    // the railed result — with elapsed measured from here, not from a reporter
+    // constructed at summary time (which always read "0ms").
+    const connectStartedAt = Date.now();
+    if (!json) {
+        createReporter({ command: 'connect cloudflare', argv }).header(accountId);
+    }
     // No TTY pre-gate: runCloudflareOAuthFlow degrades on its own — without a
     // TTY it prints the authorize URL + instructions instead of spawning a
     // browser, so headless terminals can still complete consent.
@@ -932,6 +995,7 @@ async function connectCloudflareCommand({ argv, json, }) {
         argv,
         json,
         hsxAccountId: accountId,
+        brokered: linked,
         ...(displayName ? { displayName } : {}),
     });
     if (oauthOutcome.kind === 'cancelled') {
@@ -955,20 +1019,56 @@ async function connectCloudflareCommand({ argv, json, }) {
             write(`${JSON.stringify(result, null, 2)}\n`);
         }
         else {
-            const reporter = createReporter({ command: 'connect cloudflare', argv });
-            reporter.header(accountId);
-            reporter.block(renderCloudflareConnect(oauthOutcome.connection));
+            const reporter = createReporter({
+                command: 'connect cloudflare',
+                argv,
+                startedAt: connectStartedAt,
+            });
+            reporter.rows(cloudflareConnectRows(oauthOutcome.connection));
+            const siblings = oauthOutcome.connection.visibleSiblingAccountIds;
+            if (siblings && siblings.length > 0) {
+                reporter.info(`Also connected to HS-X account(s) ${siblings.join(', ')} — resources are namespaced per HS-X account; Cloudflare quota is shared.`);
+            }
             reporter.done('Connected');
         }
         return { exitCode: 0 };
     }
-    // success-local: sandbox-client dev path (HSX_CLOUDFLARE_OAUTH_CLIENT_ID) —
-    // the CLI holds the OAuth access token and registers it via the connect
-    // call below, still authMethod oauth.
+    // success-local: the CLI exchanged the code itself and saved the refresh
+    // token in local custody (cloudflare-oauth-store). Used for the stored-direct
+    // default and the sandbox-client dev path (HSX_CLOUDFLARE_OAUTH_CLIENT_ID).
     const apiToken = oauthOutcome.accessToken;
     if (!cloudflareAccountId && oauthOutcome.cloudflareAccountId) {
         cloudflareAccountId = oauthOutcome.cloudflareAccountId;
     }
+    // Stored-direct (ADR-025 mode 2): the credential is already persisted
+    // locally; there's no HS-X account to register it against, so report success
+    // and stop. The opt-in linked path continues to the CP connect call below.
+    if (!linked) {
+        const result = {
+            ok: true,
+            command: 'connect cloudflare',
+            mode: 'stored-direct',
+            accountId,
+            ...(cloudflareAccountId ? { cloudflareAccountId } : {}),
+        };
+        if (json) {
+            write(`${JSON.stringify(result, null, 2)}\n`);
+        }
+        else {
+            const reporter = createReporter({
+                command: 'connect cloudflare',
+                argv,
+                startedAt: connectStartedAt,
+            });
+            reporter
+                .step('Stored Cloudflare credential')
+                .ok(cloudflareAccountId ? `account ${cloudflareAccountId}` : 'token stored');
+            reporter.info('');
+            reporter.info('Stored locally — no HS-X account needed. Run `hs-x deploy` to ship. To link this into an HS-X account, run `hs-x login`, then re-run `hs-x connect cloudflare`.');
+            reporter.done('Connected');
+        }
+        return { exitCode: 0 };
+    }
     if (interactive && !cloudflareAccountId) {
         const answer = await promptText({
             message: 'Cloudflare account id',
@@ -1038,9 +1138,16 @@ async function connectCloudflareCommand({ argv, json, }) {
         write(`${JSON.stringify(result, null, 2)}\n`);
     }
     else {
-        const reporter = createReporter({ command: 'connect cloudflare', argv });
-        reporter.header(accountId);
-        reporter.block(renderCloudflareConnect(connection));
+        const reporter = createReporter({
+            command: 'connect cloudflare',
+            argv,
+            startedAt: connectStartedAt,
+        });
+        reporter.rows(cloudflareConnectRows(connection));
+        const siblings = connection.visibleSiblingAccountIds;
+        if (siblings && siblings.length > 0) {
+            reporter.info(`Also connected to HS-X account(s) ${siblings.join(', ')} — resources are namespaced per HS-X account; Cloudflare quota is shared.`);
+        }
         reporter.done('Connected');
     }
     return { exitCode: 0 };
@@ -1133,11 +1240,18 @@ async function requestHostedControlPlaneCloudflareConnect({ accountId, request,
     }
     return Schema.decodeUnknownSync(schemas.CloudflareConnection)(body);
 }
-function renderCloudflareConnect(connection) {
-    const siblingLine = connection.visibleSiblingAccountIds && connection.visibleSiblingAccountIds.length > 0
-        ? `\nThis Cloudflare account is also connected to HS-X account(s) ${connection.visibleSiblingAccountIds.join(', ')}. Resources will be namespaced by HS-X account id; Cloudflare quota is shared.\n`
-        : '\n';
-    return `Connected Cloudflare account ${connection.displayName} for ${connection.accountId}${siblingLine}`;
+function cloudflareConnectRows(connection) {
+    return [
+        {
+            status: 'ok',
+            key: 'cloudflare',
+            value: connection.displayName,
+            ...(connection.cloudflareAccountId
+                ? { detail: `account ${connection.cloudflareAccountId}` }
+                : {}),
+        },
+        { key: 'hs-x account', value: connection.accountId },
+    ];
 }
 function writeDiagnostics(diagnostics) {
     for (const diagnostic of diagnostics) {
@@ -1230,7 +1344,7 @@ const connectCloudflareCmd = CommandNative.make('cloudflare', {
         argv.push('--local-control-plane');
     const defaultCwd = yield* Cwd;
     const cwd = Option.getOrElse(opts.cwd, () => defaultCwd);
-    yield* runQuarantined(opts.json, () => connectCommand({ argv, cwd, json: opts.json }));
+    yield* runQuarantined('connect', opts.json, () => connectCommand({ argv, cwd, json: opts.json }));
 })));
 // connect hubspot
 const connectDeveloperAccountIdOption = OptionsNative.text('developer-account-id').pipe(OptionsNative.optional);
@@ -1285,7 +1399,7 @@ const connectHubspotCmd = CommandNative.make('hubspot', {
         argv.push('--yes');
     const defaultCwd = yield* Cwd;
     const cwd = Option.getOrElse(opts.cwd, () => defaultCwd);
-    yield* runQuarantined(opts.json, () => connectCommand({ argv, cwd, json: opts.json }));
+    yield* runQuarantined('connect', opts.json, () => connectCommand({ argv, cwd, json: opts.json }));
 })));
 // Bare `hs-x connect` runs the interactive wizard (HubSpot, then optionally
 // Cloudflare); non-TTY/--json invocations fall back to the curated help text
@@ -1350,7 +1464,7 @@ export const connectCmd = CommandNative.make('connect', {
         argv.push('--yes');
     const defaultCwd = yield* Cwd;
     const cwd = Option.getOrElse(opts.cwd, () => defaultCwd);
-    yield* runQuarantined(opts.json, () => connectCommand({ argv, cwd, json: opts.json }));
+    yield* runQuarantined('connect', opts.json, () => connectCommand({ argv, cwd, json: opts.json }));
 }))).pipe(CommandNative.withSubcommands([connectCloudflareCmd, connectHubspotCmd]));
 // Appended imports (ES module imports are hoisted; placement at file end keeps
 // this additive change off the existing import block to avoid merge conflicts).
@@ -1358,6 +1472,6 @@ import * as CommandNative from '@effect/cli/Command';
 import * as OptionsNative from '@effect/cli/Options';
 import { Option } from 'effect';
 import { exitWith } from '../cli-error.js';
-import { jsonOption, cwdOption, accountIdOption, controlPlaneUrlOption, userIdOption, runHandler, runQuarantined, } from '../cli/kit.js';
+import { accountIdOption, controlPlaneUrlOption, cwdOption, jsonOption, runHandler, runQuarantined, userIdOption, } from '../cli/kit.js';
 import { Cwd } from '../services/cwd.js';
 //# sourceMappingURL=connect.js.map