@inquir/compute-cli 0.2.2 → 0.4.0

package/dist/utils/assets.js

@@ -1,10 +1,35 @@
 import { CliError, ExitCode } from './errors.js';
+/**
+ * Opening words of the explanation findAssetOrExplain builds for an identifier
+ * that matches more than one asset, so assetNotFoundError can recognise its own
+ * message. The two have to agree through a plain string because the callers in
+ * between (deploy.ts, run.ts) forward only `{ error }`; keeping the prefix in one
+ * constant is what stops the producer and the detector drifting apart. It sits at
+ * position 0 and both other explanations start with `Asset `, so no asset name,
+ * path or export can spoof it.
+ */
+const AMBIGUOUS_PREFIX = 'Ambiguous asset ';
 /**
  * A friendly, actionable error for a local asset that could not be resolved.
  * Treated as a usage error (exit 2) — the user typed a name that doesn't match
- * (or that fails to compile) — with a hint to list what's available.
+ * (or that fails to compile, or that matches several assets) — with a hint to
+ * list what's available.
  */
 export function assetNotFoundError(identifier, explanation) {
+    if (explanation.startsWith(AMBIGUOUS_PREFIX)) {
+        // The way out is spelled out per collision in `explanation`, because that is
+        // the only free-text field `--json` renders (renderError drops fix/command).
+        return new CliError(`Asset "${identifier}" is ambiguous`, {
+            code: 'ASSET_AMBIGUOUS',
+            exitCode: ExitCode.USAGE,
+            explanation,
+            // Deliberately vaguer than "one of the values listed": when every colliding
+            // asset is reachable only through a value that is itself ambiguous, the
+            // explanation lists no value at all and asks for the rename instead.
+            fix: 'Use one of the values named in the explanation above, or rename the colliding asset.',
+            command: 'inquir list',
+        });
+    }
     const isImportFailure = explanation.includes('failed to import');
     return new CliError(isImportFailure ? `Asset "${identifier}" failed to load` : `Asset "${identifier}" not found`, {
         code: isImportFailure ? 'ASSET_IMPORT_FAILED' : 'ASSET_NOT_FOUND',
@@ -16,15 +41,168 @@ export function assetNotFoundError(identifier, explanation) {
         command: 'inquir list',
     });
 }
+/** The fields a caller may type to address a local asset, in resolution order. */
+const IDENTIFIER_FIELDS = ['name', 'localPath', 'exportName'];
+/** How each field is named to the user, so an offered value says what it is. */
+const FIELD_LABEL = {
+    name: 'asset name',
+    localPath: 'file path',
+    exportName: 'export name',
+};
+/**
+ * The only advice that always terminates: once the duplicates carry distinct
+ * names the `name` tier resolves each of them on its own. Phrased for any number
+ * of duplicates — renaming *one* of three same-named assets still leaves a tie —
+ * and it names both defining calls, because a name tie is compared across kinds,
+ * so the duplicate to rename can be a definePipeline.
+ */
+const RENAME_CURE = 'give the duplicates distinct defineFunction/definePipeline names';
+/**
+ * Match `identifier` against one field at a time — `name`, then `localPath`,
+ * then `exportName` — and report a tie instead of breaking it.
+ *
+ * Each field is searched on its own so that an export called `invoice` in one
+ * file can no longer outrank the asset actually *named* `invoice` in another —
+ * the old single `find()` merged all three namespaces and let discovery order
+ * decide. Within a field a tie is left unresolved: discoverAssets keeps every
+ * same-named asset and only *reports* the clash, as a DUPLICATE_NAME diagnostic
+ * that `inquir list` and `inquir codegen` print but the deploy/run lookup never
+ * reads. Refusing here is what stops `inquir deploy invoice` silently shipping
+ * whichever file sorted first.
+ *
+ * Names are compared across kinds on purpose, so a function and a pipeline that
+ * share a name are a tie as well and `inquir deploy <name>` / `inquir run <name>`
+ * now refuse where discoverAssets' leading `kind.localeCompare` sort used to hand
+ * the function over silently. That is the same clash discoverAssets already
+ * reports: it groups DUPLICATE_NAME by name alone, without looking at kind.
+ */
+export function resolveAsset(assets, identifier) {
+    for (const field of IDENTIFIER_FIELDS) {
+        const matches = assets.filter((asset) => asset[field] === identifier);
+        if (matches.length === 1)
+            return { kind: 'found', asset: matches[0] };
+        if (matches.length > 1)
+            return { kind: 'ambiguous', field, matches };
+    }
+    return { kind: 'none' };
+}
+/**
+ * The asset addressed by `identifier`, or undefined when nothing matches *or*
+ * when several assets do. Callers that want to tell those two apart (and to tell
+ * the user which assets collided) should use resolveAsset or findAssetOrExplain.
+ *
+ * What this does not fix: refusing the ambiguous *lookup* does not make two
+ * same-named assets deployable. deployAsset takes `name` and `linkedLocalName`
+ * from the asset itself, so addressing either one by its unique file path still
+ * deploys it onto the single remote function of that name, and the second deploy
+ * overwrites the first. Giving the duplicates distinct defineFunction names is
+ * the only cure, which is why the ambiguity explanation asks for it.
+ */
 export function findAsset(assets, identifier) {
-    return assets.find((asset) => asset.name === identifier
-        || asset.exportName === identifier
-        || asset.localPath === identifier);
+    const match = resolveAsset(assets, identifier);
+    return match.kind === 'found' ? match.asset : undefined;
+}
+/**
+ * A value that addresses exactly `asset` and nothing else, or undefined when
+ * neither of the two remaining fields does.
+ *
+ * The candidate is checked with resolveAsset over the *whole* discovered set and
+ * has to land back on this very asset. Uniqueness inside the colliding subset is
+ * not enough: with two assets named `invoice`, one of them in a file that also
+ * exports `refund`, that file path is unique among the two `invoice` rows yet
+ * ambiguous overall, so offering it would bounce the caller into a second
+ * refusal that points back at the name they started from.
+ *
+ * Candidates are tried in IDENTIFIER_FIELDS order, so a file path is preferred
+ * over an export name when both address the asset. That order is a preference and
+ * nothing more: a candidate is stolen by an *earlier* tier, never a later one — an
+ * export name `v2` loses to an asset actually named `v2` — and it is the
+ * round-trip above, not the order, that rules such a value out.
+ */
+function addressableValue(assets, asset, collided) {
+    for (const field of IDENTIFIER_FIELDS) {
+        if (field === collided)
+            continue;
+        const candidate = asset[field];
+        const match = resolveAsset(assets, candidate);
+        if (match.kind === 'found' && match.asset === asset)
+            return { value: candidate, field };
+    }
+    return undefined;
+}
+/**
+ * Name the way out in terms of the field the caller actually typed.
+ *
+ * Every value printed as an alternative has been verified with addressableValue
+ * against the full asset list, so typing it ends the search instead of raising
+ * the next ambiguity. A colliding asset that no single value reaches is reported
+ * rather than offered.
+ *
+ * Where RENAME_CURE appears is not uniform, because the rename is not always the
+ * cure. The name branch always ends in it: a path addresses one of the duplicates
+ * for this lookup but leaves the names tied, and when two of the tied assets are
+ * functions they also share one remote function on deploy. The path and export
+ * branches print it only when some match is unreachable, which happens only
+ * because that match's asset name is shared with a further asset — a file that
+ * merely exports two well-named assets needs no rename, and its advice already
+ * terminates.
+ */
+function describeAmbiguity(assets, identifier, field, matches) {
+    const offers = matches
+        .map((asset) => addressableValue(assets, asset, field))
+        .filter((offer) => offer !== undefined);
+    const advice = offers.length > 0
+        ? `Pass one of these values in place of the ${FIELD_LABEL[field]} to address a single asset: `
+            + `${offers.map((offer) => `"${offer.value}" (${FIELD_LABEL[offer.field]})`).join(', ')}.`
+        : 'No single value addresses any one of them.';
+    const unreachable = matches.length - offers.length;
+    // Counting the unreachable matches is only worth a sentence when some other
+    // match *was* offered; with no offer at all `advice` has already said it, and
+    // repeating the same fact as a count reads like a second, different problem.
+    const partial = offers.length > 0 && unreachable > 0;
+    if (field === 'name') {
+        const owners = matches.map((asset) => `${asset.localPath} (export ${asset.exportName})`);
+        const shortfall = partial
+            ? ` ${unreachable} of the ${matches.length} cannot be addressed by any single value.`
+            : '';
+        // A name tie is compared across kinds, but deployAsset refuses every kind
+        // except `function`, so only two or more *functions* can overwrite each other
+        // on the remote side. With a pipeline in the tie the rename is still the cure
+        // for the lookup, and claiming an overwrite that deploy would refuse outright
+        // would be inventing a consequence.
+        const cure = matches.filter((asset) => asset.kind === 'function').length > 1
+            ? `Deploy takes the remote function name from the asset either way, so each of them deploys onto the one remote function "${identifier}" — ${RENAME_CURE}.`
+            : `The only lasting fix is to ${RENAME_CURE}.`;
+        return `${AMBIGUOUS_PREFIX}"${identifier}": ${matches.length} local assets are named "${identifier}": ${owners.join(', ')}. `
+            + `${advice}${shortfall} ${cure}`;
+    }
+    // Only the two fields other than the collided one are ever offered, so an
+    // unreachable match is exactly one whose *both* remaining fields are shared;
+    // each branch spells out which two, and the rename un-shares the asset name.
+    const shortfall = (reason) => {
+        if (unreachable === 0)
+            return '';
+        const lead = partial
+            ? `${unreachable} of the ${matches.length} cannot be addressed by any single value, because`
+            : 'That is because';
+        return ` ${lead} ${reason} — ${RENAME_CURE}.`;
+    };
+    if (field === 'localPath') {
+        const owners = matches.map((asset) => `${asset.name} (export ${asset.exportName})`);
+        return `${AMBIGUOUS_PREFIX}"${identifier}": that file exports ${matches.length} assets: ${owners.join(', ')}. `
+            + `${advice}${shortfall('their asset name and their export name are each shared with a further asset')}`;
+    }
+    const owners = matches.map((asset) => `${asset.name} in ${asset.localPath}`);
+    return `${AMBIGUOUS_PREFIX}"${identifier}": ${matches.length} assets use "${identifier}" as their export name: ${owners.join(', ')}. `
+        + `${advice}${shortfall('their asset name is shared with a further asset and their file exports more than one')}`;
 }
 export function findAssetOrExplain(registry, identifier) {
-    const asset = findAsset(registry.assets, identifier);
-    if (asset)
-        return { asset };
+    const match = resolveAsset(registry.assets, identifier);
+    if (match.kind === 'found')
+        return { asset: match.asset };
+    if (match.kind === 'ambiguous') {
+        return { error: describeAmbiguity(registry.assets, identifier, match.field, match.matches) };
+    }
     // Check if any IMPORT_FAILED diagnostic mentions a path containing the identifier
     const relatedDiag = registry.diagnostics.find((d) => d.code === 'IMPORT_FAILED' && d.filePath && d.filePath.includes(identifier));
     if (relatedDiag) {

package/dist/utils/assets.js.map

@@ -1 +1 @@
-{"version":3,"file":"assets.js","sourceRoot":"","sources":["../../src/utils/assets.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEjD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,WAAmB;IACxE,MAAM,eAAe,GAAG,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACjE,OAAO,IAAI,QAAQ,CACjB,eAAe,CAAC,CAAC,CAAC,UAAU,UAAU,kBAAkB,CAAC,CAAC,CAAC,UAAU,UAAU,aAAa,EAC5F;QACE,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,iBAAiB;QACjE,QAAQ,EAAE,QAAQ,CAAC,KAAK;QACxB,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QACtD,GAAG,EAAE,eAAe;YAClB,CAAC,CAAC,iDAAiD;YACnD,CAAC,CAAC,uCAAuC;QAC3C,OAAO,EAAE,aAAa;KACvB,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAoB,EAAE,UAAkB;IAChE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC3B,KAAK,CAAC,IAAI,KAAK,UAAU;WACtB,KAAK,CAAC,UAAU,KAAK,UAAU;WAC/B,KAAK,CAAC,SAAS,KAAK,UAAU,CAClC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,QAAuB,EACvB,UAAkB;IAElB,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACrD,IAAI,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE5B,kFAAkF;IAClF,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAC3C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CACnF,CAAC;IAEF,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO;YACL,KAAK,EAAE,UAAU,UAAU,uBAAuB,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;SACnI,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,oBAAoB,UAAU,EAAE,EAAE,CAAC;AACrD,CAAC"}
+{"version":3,"file":"assets.js","sourceRoot":"","sources":["../../src/utils/assets.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEjD;;;;;;;;GAQG;AACH,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,WAAmB;IACxE,IAAI,WAAW,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC7C,6EAA6E;QAC7E,6EAA6E;QAC7E,OAAO,IAAI,QAAQ,CAAC,UAAU,UAAU,gBAAgB,EAAE;YACxD,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,QAAQ,CAAC,KAAK;YACxB,WAAW;YACX,4EAA4E;YAC5E,wEAAwE;YACxE,qEAAqE;YACrE,GAAG,EAAE,sFAAsF;YAC3F,OAAO,EAAE,aAAa;SACvB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,eAAe,GAAG,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACjE,OAAO,IAAI,QAAQ,CACjB,eAAe,CAAC,CAAC,CAAC,UAAU,UAAU,kBAAkB,CAAC,CAAC,CAAC,UAAU,UAAU,aAAa,EAC5F;QACE,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,iBAAiB;QACjE,QAAQ,EAAE,QAAQ,CAAC,KAAK;QACxB,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QACtD,GAAG,EAAE,eAAe;YAClB,CAAC,CAAC,iDAAiD;YACnD,CAAC,CAAC,uCAAuC;QAC3C,OAAO,EAAE,aAAa;KACvB,CACF,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,CAAU,CAAC;AAGvE,gFAAgF;AAChF,MAAM,WAAW,GAAoC;IACnD,IAAI,EAAE,YAAY;IAClB,SAAS,EAAE,WAAW;IACtB,UAAU,EAAE,aAAa;CAC1B,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,GAAG,kEAAkE,CAAC;AAOvF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,YAAY,CAAC,MAAoB,EAAE,UAAkB;IACnE,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC,CAAC;QACtE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACvE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,MAAoB,EAAE,UAAkB;IAChE,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AAID;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,gBAAgB,CACvB,MAAoB,EACpB,KAAiB,EACjB,QAAyB;IAEzB,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACtC,IAAI,KAAK,KAAK,QAAQ;YAAE,SAAS;QACjC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC9C,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC1F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,iBAAiB,CACxB,MAAoB,EACpB,UAAkB,EAClB,KAAsB,EACtB,OAAqB;IAErB,MAAM,MAAM,GAAG,OAAO;SACnB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;SACtD,MAAM,CAAC,CAAC,KAAK,EAAkB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC;QAC9B,CAAC,CAAC,4CAA4C,WAAW,CAAC,KAAK,CAAC,8BAA8B;cAC1F,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,KAAK,MAAM,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAC5F,CAAC,CAAC,4CAA4C,CAAC;IACjD,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IACnD,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,GAAG,CAAC,CAAC;IAErD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,SAAS,YAAY,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC;QACzF,MAAM,SAAS,GAAG,OAAO;YACvB,CAAC,CAAC,IAAI,WAAW,WAAW,OAAO,CAAC,MAAM,2CAA2C;YACrF,CAAC,CAAC,EAAE,CAAC;QACP,0EAA0E;QAC1E,8EAA8E;QAC9E,8EAA8E;QAC9E,8EAA8E;QAC9E,oCAAoC;QACpC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC;YAC1E,CAAC,CAAC,0HAA0H,UAAU,OAAO,WAAW,GAAG;YAC3J,CAAC,CAAC,8BAA8B,WAAW,GAAG,CAAC;QACjD,OAAO,GAAG,gBAAgB,IAAI,UAAU,MAAM,OAAO,CAAC,MAAM,4BAA4B,UAAU,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;cACzH,GAAG,MAAM,GAAG,SAAS,IAAI,IAAI,EAAE,CAAC;IACtC,CAAC;IAED,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,SAAS,GAAG,CAAC,MAAc,EAAU,EAAE;QAC3C,IAAI,WAAW,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,OAAO;YAClB,CAAC,CAAC,GAAG,WAAW,WAAW,OAAO,CAAC,MAAM,mDAAmD;YAC5F,CAAC,CAAC,iBAAiB,CAAC;QACtB,OAAO,IAAI,IAAI,IAAI,MAAM,MAAM,WAAW,GAAG,CAAC;IAChD,CAAC,CAAC;IAEF,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,YAAY,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC;QACpF,OAAO,GAAG,gBAAgB,IAAI,UAAU,wBAAwB,OAAO,CAAC,MAAM,YAAY,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;cAC3G,GAAG,MAAM,GAAG,SAAS,CAAC,6EAA6E,CAAC,EAAE,CAAC;IAC7G,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7E,OAAO,GAAG,gBAAgB,IAAI,UAAU,MAAM,OAAO,CAAC,MAAM,gBAAgB,UAAU,2BAA2B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;UAClI,GAAG,MAAM,GAAG,SAAS,CAAC,sFAAsF,CAAC,EAAE,CAAC;AACtH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,QAAuB,EACvB,UAAkB;IAElB,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAC1D,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/F,CAAC;IAED,kFAAkF;IAClF,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAC3C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CACnF,CAAC;IAEF,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO;YACL,KAAK,EAAE,UAAU,UAAU,uBAAuB,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;SACnI,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,oBAAoB,UAAU,EAAE,EAAE,CAAC;AACrD,CAAC"}

package/dist/utils/auth.d.ts

@@ -8,6 +8,10 @@ export interface EnvironmentConfig {
     apiKey?: string;
     /** Personal Access Token from `inquir login` (user-scoped credential). */
     token?: string;
+    /** Only browser-issued sessions belong to the CLI; imported PATs do not. */
+    tokenSession?: StoredCliSession;
+    /** Explicit logout prevents a partial profile from inheriting credentials. */
+    loggedOut?: boolean;
     /** Active workspace selector (tenant id or slug) for user-scoped credentials. */
     workspaceId?: string;
     /** Cached identity for `inquir whoami` after login. */
@@ -27,6 +31,23 @@ export interface ResolvedAuthConfig {
 }
 /** Default when no config, env, or flags set — first-party prod API (see proxy/Caddyfile). */
 export declare const DEFAULT_API_URL = "https://api.inquir.org";
+/** API base identity: URL canonicalization includes the scheme and base path. */
+export declare function sameApiEndpoint(left: string, right: string): boolean;
+export interface StoredCliSession {
+    source: 'cli-browser';
+    apiUrl: string;
+    tokenHash: string;
+    tokenId?: string;
+    expiresAt?: string;
+}
+export declare function cliSession(apiUrl: string, token: string, details?: {
+    tokenId?: string;
+    expiresAt?: string;
+}): StoredCliSession;
+/** Stale metadata must never turn a subsequently imported PAT into an owned session. */
+export declare function ownedCliSession(slice: EnvironmentConfig): StoredCliSession | undefined;
+/** Compare raw credentials too: another profile may use this token as an API key. */
+export declare function configReferencesToken(config: AuthConfig, token: string, except?: EnvironmentConfig): boolean;
 /** Absolute path to the active CLI config file (for `config path` / `doctor`). */
 export declare function getConfigFilePath(): string;
 export declare function loadAuthConfig(): Promise<AuthConfig>;
@@ -34,13 +55,19 @@ export declare function saveAuthConfig(nextConfig: AuthConfig): Promise<void>;
 export declare function clearAuthConfig(): Promise<void>;
 /** Resolve the active environment name from overrides or environment variables. */
 export declare function resolveEnvironmentName(override?: string): string | undefined;
+export declare function updateAuthConfig<T>(mutate: (config: AuthConfig) => T | Promise<T>): Promise<T>;
 export declare function resolveAuthConfig(overrides?: Partial<AuthConfig> & {
     environment?: string;
     projectWorkspaceId?: string;
+}, 
+/** Only login may resolve defaults while creating a new named environment. */
+behavior?: {
+    allowMissingEnvironment?: boolean;
 }): Promise<ResolvedAuthConfig>;
 /**
  * Mutate the config slice for the active environment (top-level when no `--env`)
- * and persist. Used by login/logout/use to update credentials in place.
+ * and persist. The same loaded config is available for coordinated profile
+ * updates, such as retaining API bindings when login changes the default.
  */
-export declare function updateEnvironmentConfig(environment: string | undefined, mutate: (slice: EnvironmentConfig) => void): Promise<void>;
+export declare function updateEnvironmentConfig<T>(environment: string | undefined, mutate: (slice: EnvironmentConfig, config: AuthConfig) => T | Promise<T>, afterSave?: (result: T, config: AuthConfig) => Promise<void>): Promise<T>;
 //# sourceMappingURL=auth.d.ts.map

package/dist/utils/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/utils/auth.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,UAAW,SAAQ,iBAAiB;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACjD,yFAAyF;IACzF,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,8FAA8F;AAC9F,eAAO,MAAM,eAAe,2BAA2B,CAAC;AAcxD,kFAAkF;AAClF,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,UAAU,CAAC,CA2B1D;AAED,wBAAsB,cAAc,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAS1E;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAMrD;AAWD,mFAAmF;AACnF,wBAAgB,sBAAsB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE5E;AAED,wBAAsB,iBAAiB,CACrC,SAAS,GAAE,OAAO,CAAC,UAAU,CAAC,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1F,OAAO,CAAC,kBAAkB,CAAC,CAwC7B;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,MAAM,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,GACzC,OAAO,CAAC,IAAI,CAAC,CAYf"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/utils/auth.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,8EAA8E;IAC9E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,UAAW,SAAQ,iBAAiB;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACjD,yFAAyF;IACzF,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,8FAA8F;AAC9F,eAAO,MAAM,eAAe,2BAA2B,CAAC;AAExD,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAMpE;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,gBAAgB,CAElI;AAED,wFAAwF;AACxF,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,gBAAgB,GAAG,SAAS,CAKtF;AAED,qFAAqF;AACrF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAI5G;AAcD,kFAAkF;AAClF,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,UAAU,CAAC,CA2B1D;AAED,wBAAsB,cAAc,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAyB1E;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAMrD;AAWD,mFAAmF;AACnF,wBAAgB,sBAAsB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK5E;AAkCD,wBAAsB,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CASpG;AAYD,wBAAsB,iBAAiB,CACrC,SAAS,GAAE,OAAO,CAAC,UAAU,CAAC,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAO;AAC3F,8EAA8E;AAC9E,QAAQ,GAAE;IAAE,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAAO,GACnD,OAAO,CAAC,kBAAkB,CAAC,CAmE7B;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,CAAC,EAC7C,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,MAAM,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,UAAU,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EACxE,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,GAC3D,OAAO,CAAC,CAAC,CAAC,CAsBZ"}

package/dist/utils/auth.js

@@ -1,8 +1,34 @@
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+import { CliError, ExitCode, usageError } from './errors.js';
 /** Default when no config, env, or flags set — first-party prod API (see proxy/Caddyfile). */
 export const DEFAULT_API_URL = 'https://api.inquir.org';
+/** API base identity: URL canonicalization includes the scheme and base path. */
+export function sameApiEndpoint(left, right) {
+    try {
+        return new URL(left).href.replace(/\/+$/, '') === new URL(right).href.replace(/\/+$/, '');
+    }
+    catch {
+        return left === right;
+    }
+}
+export function cliSession(apiUrl, token, details = {}) {
+    return { source: 'cli-browser', apiUrl, tokenHash: createHash('sha256').update(token).digest('hex'), ...details };
+}
+/** Stale metadata must never turn a subsequently imported PAT into an owned session. */
+export function ownedCliSession(slice) {
+    const session = slice.tokenSession;
+    return slice.token && session?.source === 'cli-browser' &&
+        session.tokenHash === createHash('sha256').update(slice.token).digest('hex')
+        ? session : undefined;
+}
+/** Compare raw credentials too: another profile may use this token as an API key. */
+export function configReferencesToken(config, token, except) {
+    return [process.env.INQUIR_TOKEN, process.env.INQUIR_API_KEY, process.env.LAMBDA_API_KEY].includes(token) ||
+        [config, ...Object.values(config.environments ?? {})].some((slice) => slice && slice !== except && !slice.loggedOut && (slice.token === token || slice.apiKey === token));
+}
 // Paths are resolved lazily (not module-level constants) so `os.homedir()` can
 // be overridden in tests and respects HOME changes at runtime.
 function configDir() {
@@ -52,8 +78,27 @@ export async function loadAuthConfig() {
 }
 export async function saveAuthConfig(nextConfig) {
     await fs.mkdir(configDir(), { recursive: true, mode: 0o700 });
-    // Credentials live here — write with owner-only permissions.
-    await fs.writeFile(configFile(), `${JSON.stringify(nextConfig, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    // Readers (including an older CLI) see a complete old or new file, never a
+    // truncated credential store. Keep the temporary file on the same volume.
+    const target = configFile();
+    const temporary = `${target}.${randomUUID()}.tmp`;
+    try {
+        const file = await fs.open(temporary, 'wx', 0o600);
+        try {
+            await file.writeFile(`${JSON.stringify(nextConfig, null, 2)}\n`, 'utf8');
+            await file.sync();
+        }
+        finally {
+            await file.close();
+        }
+        await fs.rename(temporary, target);
+    }
+    finally {
+        await fs.unlink(temporary).catch((error) => {
+            if (error.code !== 'ENOENT')
+                throw error;
+        });
+    }
     try {
         await fs.chmod(configFile(), 0o600);
     }
@@ -79,14 +124,93 @@ function envValue(value) {
 }
 /** Resolve the active environment name from overrides or environment variables. */
 export function resolveEnvironmentName(override) {
+    if (override !== undefined && !override.trim()) {
+        throw usageError('Missing credential environment name', 'inquir config show --env <name>');
+    }
     return override ?? envValue(process.env.INQUIR_ENV) ?? envValue(process.env.LAMBDA_ENV) ?? undefined;
 }
-export async function resolveAuthConfig(overrides = {}) {
+/** Serialize credential mutations across CLI processes, including self-revocation. */
+async function withAuthConfigLock(operation) {
+    await fs.mkdir(configDir(), { recursive: true, mode: 0o700 });
+    const lockPath = `${configFile()}.lock`;
+    const deadline = Date.now() + 10_000;
+    let lock;
+    for (;;) {
+        try {
+            lock = await fs.open(lockPath, 'wx', 0o600);
+            break;
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            if (Date.now() >= deadline) {
+                // Never steal a lock on a timeout: its owner may be between a remote
+                // revocation and a local write. A crash needs explicit local recovery.
+                throw new CliError('CLI configuration is locked by another command.', {
+                    code: 'AUTH_CONFIG_LOCKED',
+                    fix: `Wait for the other CLI command. If it crashed, close all CLI commands before removing ${lockPath}.`,
+                });
+            }
+            await new Promise((resolve) => setTimeout(resolve, 25));
+        }
+    }
+    try {
+        await lock.writeFile(JSON.stringify({ pid: process.pid, createdAt: new Date().toISOString() }), 'utf8');
+        return await operation();
+    }
+    finally {
+        await lock.close();
+        await fs.unlink(lockPath);
+    }
+}
+export async function updateAuthConfig(mutate) {
+    return withAuthConfigLock(async () => {
+        const config = await loadAuthConfig();
+        const before = JSON.stringify(config);
+        const result = await mutate(config);
+        await assertConfigUnchanged(before);
+        await saveAuthConfig(config);
+        return result;
+    });
+}
+async function assertConfigUnchanged(before) {
+    // An older CLI or an editor may ignore the lock. Do not overwrite a change
+    // observed while awaiting remote revocation or other asynchronous work.
+    if (JSON.stringify(await loadAuthConfig()) !== before) {
+        throw new CliError('CLI configuration changed during this command.', {
+            code: 'AUTH_CONFIG_CHANGED', fix: 'Retry after the other CLI command has finished.',
+        });
+    }
+}
+export async function resolveAuthConfig(overrides = {}, 
+/** Only login may resolve defaults while creating a new named environment. */
+behavior = {}) {
     const fileConfig = await loadAuthConfig();
     const selectedEnvironment = resolveEnvironmentName(overrides.environment);
-    const environmentConfig = selectedEnvironment
-        ? fileConfig.environments?.[selectedEnvironment] ?? {}
-        : {};
+    const hasEnvironment = selectedEnvironment !== undefined &&
+        Object.prototype.hasOwnProperty.call(fileConfig.environments ?? {}, selectedEnvironment);
+    if (selectedEnvironment !== undefined && !hasEnvironment && !behavior.allowMissingEnvironment) {
+        throw new CliError(`Unknown credential environment: ${selectedEnvironment}`, {
+            code: 'UNKNOWN_ENVIRONMENT',
+            exitCode: ExitCode.USAGE,
+            explanation: `Credential environment "${selectedEnvironment}" is not configured. Choose an existing name, or create it with \`inquir login --env <name>\` or \`inquir config set apiUrl <url> --env <name>\`.`,
+        });
+    }
+    const environmentConfig = hasEnvironment ? fileConfig.environments[selectedEnvironment] : {};
+    if (!environmentConfig || typeof environmentConfig !== 'object' || Array.isArray(environmentConfig)) {
+        throw new CliError(`Invalid credential environment: ${selectedEnvironment}`, {
+            code: 'INVALID_ENVIRONMENT',
+            exitCode: ExitCode.USAGE,
+            explanation: `Credential environment "${selectedEnvironment}" must be a configuration object. Correct it in ~/.inquir/config.json before retrying.`,
+        });
+    }
+    // Partial named profiles may share the default credential only while they
+    // target the same API. A profile pointing elsewhere must never resurrect a
+    // default token/key or workspace after its own login is cleared.
+    const inheritedConfig = environmentConfig.loggedOut || fileConfig.loggedOut || (environmentConfig.apiUrl &&
+        !sameApiEndpoint(environmentConfig.apiUrl, fileConfig.apiUrl ?? DEFAULT_API_URL)) ? {}
+        : fileConfig;
+    const storedEnvironment = environmentConfig.loggedOut ? {} : environmentConfig;
     const apiUrl = overrides.apiUrl
         ?? envValue(process.env.INQUIR_API_URL)
         ?? envValue(process.env.LAMBDA_API_URL)
@@ -96,39 +220,52 @@ export async function resolveAuthConfig(overrides = {}) {
     const apiKey = overrides.apiKey
         ?? envValue(process.env.INQUIR_API_KEY)
         ?? envValue(process.env.LAMBDA_API_KEY)
-        ?? environmentConfig.apiKey
-        ?? fileConfig.apiKey
+        ?? storedEnvironment.apiKey
+        ?? inheritedConfig.apiKey
         ?? undefined;
     const token = overrides.token
         ?? envValue(process.env.INQUIR_TOKEN)
-        ?? environmentConfig.token
-        ?? fileConfig.token
+        ?? storedEnvironment.token
+        ?? inheritedConfig.token
         ?? undefined;
     const workspaceId = overrides.workspaceId // explicit --workspace
         ?? envValue(process.env.INQUIR_WORKSPACE) // env var
-        ?? environmentConfig.workspaceId // named credential environment
+        ?? storedEnvironment.workspaceId // named credential environment
         ?? overrides.projectWorkspaceId // project link (inquir.config.json)
-        ?? fileConfig.workspaceId // stored global default
+        ?? inheritedConfig.workspaceId // stored default for the same API
         ?? undefined;
-    const user = environmentConfig.user ?? fileConfig.user;
+    // A cached identity from another token is not this profile's identity.
+    const user = storedEnvironment.user ?? (storedEnvironment.token && storedEnvironment.token !== inheritedConfig.token
+        ? undefined
+        : inheritedConfig.user);
     return { apiUrl, apiKey, token, workspaceId, user };
 }
 /**
  * Mutate the config slice for the active environment (top-level when no `--env`)
- * and persist. Used by login/logout/use to update credentials in place.
+ * and persist. The same loaded config is available for coordinated profile
+ * updates, such as retaining API bindings when login changes the default.
  */
-export async function updateEnvironmentConfig(environment, mutate) {
-    const config = await loadAuthConfig();
-    const envName = resolveEnvironmentName(environment);
-    if (envName) {
-        config.environments = config.environments ?? {};
-        const slice = config.environments[envName] ?? {};
-        mutate(slice);
-        config.environments[envName] = slice;
-    }
-    else {
-        mutate(config);
-    }
-    await saveAuthConfig(config);
+export async function updateEnvironmentConfig(environment, mutate, afterSave) {
+    return withAuthConfigLock(async () => {
+        const config = await loadAuthConfig();
+        const before = JSON.stringify(config);
+        const envName = resolveEnvironmentName(environment);
+        let slice = config;
+        if (envName) {
+            config.environments = config.environments ?? {};
+            const existing = Object.prototype.hasOwnProperty.call(config.environments, envName)
+                ? config.environments[envName] : undefined;
+            if (existing !== undefined && (!existing || typeof existing !== 'object' || Array.isArray(existing))) {
+                throw new CliError(`Invalid credential environment: ${envName}`, { code: 'INVALID_ENVIRONMENT', exitCode: ExitCode.USAGE });
+            }
+            slice = existing ?? {};
+            Object.defineProperty(config.environments, envName, { value: slice, writable: true, enumerable: true, configurable: true });
+        }
+        const result = await mutate(slice, config);
+        await assertConfigUnchanged(before);
+        await saveAuthConfig(config);
+        await afterSave?.(result, config);
+        return result;
+    });
 }
 //# sourceMappingURL=auth.js.map

package/dist/utils/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/utils/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAiC7B,8FAA8F;AAC9F,MAAM,CAAC,MAAM,eAAe,GAAG,wBAAwB,CAAC;AAExD,+EAA+E;AAC/E,+DAA+D;AAC/D,SAAS,SAAS;IAChB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AACD,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,CAAC,CAAC;AAC/C,CAAC;AACD,SAAS,gBAAgB;IACvB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;AAC/D,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,iBAAiB;IAC/B,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2EAA2E;QAC3E,2EAA2E;QAC3E,4EAA4E;QAC5E,oDAAoD;QACpD,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,MAAM,CAAC,CAAC;YAChE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAe,CAAC;YACnD,0EAA0E;YAC1E,2EAA2E;YAC3E,6EAA6E;YAC7E,MAAM,QAAQ,GAAe,EAAE,CAAC;YAChC,IAAI,MAAM,CAAC,KAAK;gBAAE,QAAQ,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAChD,IAAI,MAAM,CAAC,MAAM;gBAAE,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YACnD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAsB;IACzD,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,6DAA6D;IAC7D,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChH,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,KAAyB;IACzC,OAAO,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,sBAAsB,CAAC,QAAiB;IACtD,OAAO,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;AACvG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,YAAyF,EAAE;IAE3F,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAC;IAC1C,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC1E,MAAM,iBAAiB,GAAG,mBAAmB;QAC3C,CAAC,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE;QACtD,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,MAAM,GACV,SAAS,CAAC,MAAM;WACb,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;WACpC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;WACpC,iBAAiB,CAAC,MAAM;WACxB,UAAU,CAAC,MAAM;WACjB,eAAe,CAAC;IAErB,MAAM,MAAM,GACV,SAAS,CAAC,MAAM;WACb,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;WACpC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;WACpC,iBAAiB,CAAC,MAAM;WACxB,UAAU,CAAC,MAAM;WACjB,SAAS,CAAC;IAEf,MAAM,KAAK,GACT,SAAS,CAAC,KAAK;WACZ,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;WAClC,iBAAiB,CAAC,KAAK;WACvB,UAAU,CAAC,KAAK;WAChB,SAAS,CAAC;IAEf,MAAM,WAAW,GACf,SAAS,CAAC,WAAW,CAAe,uBAAuB;WACxD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,UAAU;WACjD,iBAAiB,CAAC,WAAW,CAAK,+BAA+B;WACjE,SAAS,CAAC,kBAAkB,CAAM,oCAAoC;WACtE,UAAU,CAAC,WAAW,CAAY,wBAAwB;WAC1D,SAAS,CAAC;IAEf,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC;IAEvD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAA+B,EAC/B,MAA0C;IAE1C,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACpD,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,CAAC;QACd,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;IACvC,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,MAAM,CAAC,CAAC;IACjB,CAAC;IACD,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/utils/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAqC7D,8FAA8F;AAC9F,MAAM,CAAC,MAAM,eAAe,GAAG,wBAAwB,CAAC;AAExD,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa;IACzD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,KAAK,KAAK,CAAC;IACxB,CAAC;AACH,CAAC;AAUD,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,KAAa,EAAE,UAAoD,EAAE;IAC9G,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC;AACpH,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,eAAe,CAAC,KAAwB;IACtD,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC;IACnC,OAAO,KAAK,CAAC,KAAK,IAAI,OAAO,EAAE,MAAM,KAAK,aAAa;QACrD,OAAO,CAAC,SAAS,KAAK,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC5E,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1B,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,qBAAqB,CAAC,MAAkB,EAAE,KAAa,EAAE,MAA0B;IACjG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACvG,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACrE,KAAK,IAAI,KAAK,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC;AACxG,CAAC;AAED,+EAA+E;AAC/E,+DAA+D;AAC/D,SAAS,SAAS;IAChB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AACD,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,CAAC,CAAC;AAC/C,CAAC;AACD,SAAS,gBAAgB;IACvB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;AAC/D,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,iBAAiB;IAC/B,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2EAA2E;QAC3E,2EAA2E;QAC3E,4EAA4E;QAC5E,oDAAoD;QACpD,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,MAAM,CAAC,CAAC;YAChE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAe,CAAC;YACnD,0EAA0E;YAC1E,2EAA2E;YAC3E,6EAA6E;YAC7E,MAAM,QAAQ,GAAe,EAAE,CAAC;YAChC,IAAI,MAAM,CAAC,KAAK;gBAAE,QAAQ,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAChD,IAAI,MAAM,CAAC,MAAM;gBAAE,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YACnD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAsB;IACzD,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,GAAG,MAAM,IAAI,UAAU,EAAE,MAAM,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACzE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QACD,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,KAA4B,EAAE,EAAE;YAChE,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QAC3C,CAAC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,KAAyB;IACzC,OAAO,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,sBAAsB,CAAC,QAAiB;IACtD,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,UAAU,CAAC,qCAAqC,EAAE,iCAAiC,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;AACvG,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,kBAAkB,CAAI,SAA2B;IAC9D,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,GAAG,UAAU,EAAE,OAAO,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,IAAI,IAAyC,CAAC;IAC9C,SAAS,CAAC;QACR,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC5C,MAAM;QACR,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACpE,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC3B,qEAAqE;gBACrE,uEAAuE;gBACvE,MAAM,IAAI,QAAQ,CAAC,iDAAiD,EAAE;oBACpE,IAAI,EAAE,oBAAoB;oBAC1B,GAAG,EAAE,yFAAyF,QAAQ,GAAG;iBAC1G,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QACxG,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAI,MAA8C;IACtF,OAAO,kBAAkB,CAAC,KAAK,IAAI,EAAE;QACnC,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,MAAc;IACjD,2EAA2E;IAC3E,wEAAwE;IACxE,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,cAAc,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC;QACtD,MAAM,IAAI,QAAQ,CAAC,gDAAgD,EAAE;YACnE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,iDAAiD;SACpF,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,YAAyF,EAAE;AAC3F,8EAA8E;AAC9E,WAAkD,EAAE;IAEpD,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAC;IAC1C,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC1E,MAAM,cAAc,GAAG,mBAAmB,KAAK,SAAS;QACtD,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,EAAE,EAAE,mBAAmB,CAAC,CAAC;IAC3F,IAAI,mBAAmB,KAAK,SAAS,IAAI,CAAC,cAAc,IAAI,CAAC,QAAQ,CAAC,uBAAuB,EAAE,CAAC;QAC9F,MAAM,IAAI,QAAQ,CAAC,mCAAmC,mBAAmB,EAAE,EAAE;YAC3E,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,QAAQ,CAAC,KAAK;YACxB,WAAW,EAAE,2BAA2B,mBAAmB,mJAAmJ;SAC/M,CAAC,CAAC;IACL,CAAC;IACD,MAAM,iBAAiB,GAAG,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,YAAa,CAAC,mBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,IAAI,CAAC,iBAAiB,IAAI,OAAO,iBAAiB,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACpG,MAAM,IAAI,QAAQ,CAAC,mCAAmC,mBAAmB,EAAE,EAAE;YAC3E,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,QAAQ,CAAC,KAAK;YACxB,WAAW,EAAE,2BAA2B,mBAAmB,wFAAwF;SACpJ,CAAC,CAAC;IACL,CAAC;IACD,0EAA0E;IAC1E,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,eAAe,GAAsB,iBAAiB,CAAC,SAAS,IAAI,UAAU,CAAC,SAAS,IAAI,CAAC,iBAAiB,CAAC,MAAM;QACzH,CAAC,eAAe,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,eAAe,CAAC,CAC/E,CAAC,CAAC,CAAC,EAAE;QACN,CAAC,CAAC,UAAU,CAAC;IACf,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAC/E,MAAM,MAAM,GACV,SAAS,CAAC,MAAM;WACb,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;WACpC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;WACpC,iBAAiB,CAAC,MAAM;WACxB,UAAU,CAAC,MAAM;WACjB,eAAe,CAAC;IAErB,MAAM,MAAM,GACV,SAAS,CAAC,MAAM;WACb,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;WACpC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;WACpC,iBAAiB,CAAC,MAAM;WACxB,eAAe,CAAC,MAAM;WACtB,SAAS,CAAC;IAEf,MAAM,KAAK,GACT,SAAS,CAAC,KAAK;WACZ,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;WAClC,iBAAiB,CAAC,KAAK;WACvB,eAAe,CAAC,KAAK;WACrB,SAAS,CAAC;IAEf,MAAM,WAAW,GACf,SAAS,CAAC,WAAW,CAAe,uBAAuB;WACxD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,UAAU;WACjD,iBAAiB,CAAC,WAAW,CAAK,+BAA+B;WACjE,SAAS,CAAC,kBAAkB,CAAM,oCAAoC;WACtE,eAAe,CAAC,WAAW,CAAO,kCAAkC;WACpE,SAAS,CAAC;IAEf,uEAAuE;IACvE,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,IAAI,CACrC,iBAAiB,CAAC,KAAK,IAAI,iBAAiB,CAAC,KAAK,KAAK,eAAe,CAAC,KAAK;QAC1E,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,eAAe,CAAC,IAAI,CACzB,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAA+B,EAC/B,MAAwE,EACxE,SAA4D;IAE5D,OAAO,kBAAkB,CAAC,KAAK,IAAI,EAAE;QACnC,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,KAAK,GAAsB,MAAM,CAAC;QACtC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;YAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC;gBACjF,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7C,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACrG,MAAM,IAAI,QAAQ,CAAC,mCAAmC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;YAC9H,CAAC;YACD,KAAK,GAAG,QAAQ,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9H,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/utils/browser.d.ts

@@ -1,3 +1,15 @@
+/**
+ * Only absolute http(s) URLs are ever handed to a launcher. The URL can come
+ * from the server (device-login verification URL), so anything else — other
+ * schemes, option-looking strings, or text with shell metacharacters that
+ * would not survive URL parsing — is refused.
+ */
+export declare function browserLaunchUrl(url: string): string | null;
+/** Launcher command for the platform. No shell is involved on any platform. */
+export declare function browserLaunchCommand(href: string, platform?: NodeJS.Platform): {
+    command: string;
+    args: string[];
+};
 /**
  * Best-effort open of a URL in the user's default browser. Resolves to `true`
  * if a launcher process was spawned, `false` otherwise (caller should then print

package/dist/utils/browser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/utils/browser.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAyBhD"}
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/utils/browser.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW3D;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAWrC;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAchD"}