@limecloud/cli 0.3.0 → 0.6.0

package/src/management.mjs

@@ -1,3 +1,4 @@
+import { message } from "./i18n.mjs";
 import { createHash } from "node:crypto";
 import { resolveSchema } from "./contract.mjs";
 import { jsonInput, readSource } from "./input.mjs";
@@ -10,7 +11,7 @@ const sensitive = new Set(["password", "secret", "client_secret", "signing_key",
 function noInlineSecrets(value) {
   if (!value || typeof value !== "object") return;
   for (const [key, item] of Object.entries(value)) {
-    if (sensitive.has(key) && item != null && item !== "") fail("Sensitive JSON fields require --data @file, stdin, or --param-env");
+    if (sensitive.has(key) && item != null && item !== "") fail(message("arguments.privateJSONRequired"));
     noInlineSecrets(item);
   }
 }
@@ -20,23 +21,23 @@ export function validateJSON(contract, input, value, label = "data", depth = 0)
   const schema = resolveSchema(contract, input);
   for (const kind of ["oneOf", "anyOf"]) if (schema[kind]) {
     const accepted = schema[kind].filter((variant) => { try { validateJSON(contract, variant, value, label, depth + 1); return true; } catch { return false; } });
-    if (!accepted.length || kind === "oneOf" && accepted.length !== 1) fail(`${label} does not match its public schema`);
+    if (!accepted.length || kind === "oneOf" && accepted.length !== 1) fail(message("arguments.schemaMismatch", { label }));
     return;
   }
   for (const variant of schema.allOf ?? []) validateJSON(contract, variant, value, label, depth + 1);
-  if (schema.const !== undefined && value !== schema.const || schema.enum && !schema.enum.includes(value)) fail(`${label} has an unsupported value`);
+  if (schema.const !== undefined && value !== schema.const || schema.enum && !schema.enum.includes(value)) fail(message("arguments.unsupportedValue", { label }));
   const types = Array.isArray(schema.type) ? schema.type : schema.type ? [schema.type] : [];
   if (types.length && !types.some((type) => type === "null" ? value === null : type === "array" ? Array.isArray(value) : type === "object" ? value && typeof value === "object" && !Array.isArray(value) :
-    type === "integer" ? Number.isInteger(value) : type === "number" ? typeof value === "number" && Number.isFinite(value) : typeof value === type)) fail(`${label} has the wrong type`);
-  if (typeof value === "string" && (schema.minLength !== undefined && value.length < schema.minLength || schema.maxLength !== undefined && value.length > schema.maxLength || schema.pattern && !new RegExp(schema.pattern).test(value))) fail(`${label} has an invalid string value`);
-  if (typeof value === "number" && (schema.minimum !== undefined && value < schema.minimum || schema.maximum !== undefined && value > schema.maximum)) fail(`${label} is outside the allowed range`);
+    type === "integer" ? Number.isInteger(value) : type === "number" ? typeof value === "number" && Number.isFinite(value) : typeof value === type)) fail(message("arguments.wrongType", { label }));
+  if (typeof value === "string" && (schema.minLength !== undefined && value.length < schema.minLength || schema.maxLength !== undefined && value.length > schema.maxLength || schema.pattern && !new RegExp(schema.pattern).test(value))) fail(message("arguments.invalidString", { label }));
+  if (typeof value === "number" && (schema.minimum !== undefined && value < schema.minimum || schema.maximum !== undefined && value > schema.maximum)) fail(message("arguments.outsideRange", { label }));
   if (Array.isArray(value)) {
-    if (schema.minItems !== undefined && value.length < schema.minItems || schema.maxItems !== undefined && value.length > schema.maxItems) fail(`${label} has an invalid number of items`);
+    if (schema.minItems !== undefined && value.length < schema.minItems || schema.maxItems !== undefined && value.length > schema.maxItems) fail(message("arguments.invalidItemCount", { label }));
     value.forEach((item, index) => validateJSON(contract, schema.items, item, `${label}[${index}]`, depth + 1));
   } else if (value && typeof value === "object") {
-    for (const required of schema.required ?? []) if (!Object.hasOwn(value, required)) fail(`${label}.${required} is required`);
+    for (const required of schema.required ?? []) if (!Object.hasOwn(value, required)) fail(message("arguments.requiredField", { label, name: required }));
     for (const [name, item] of Object.entries(value)) {
-      if (schema.additionalProperties === false && !Object.hasOwn(schema.properties ?? {}, name)) fail(`${label}.${name} is not a declared field`);
+      if (schema.additionalProperties === false && !Object.hasOwn(schema.properties ?? {}, name)) fail(message("arguments.undeclaredField", { label, name }));
       validateJSON(contract, schema.properties?.[name], item, `${label}.${name}`, depth + 1);
     }
   }
@@ -64,15 +65,15 @@ export function matchHTTP(catalogue, method, path) {
 
 function cast(raw, schema) {
   if (schema?.type === "integer" || schema?.type === "number") {
-    if (String(raw).trim() === "" || !Number.isFinite(Number(raw))) fail("Expected a numeric parameter");
+    if (String(raw).trim() === "" || !Number.isFinite(Number(raw))) fail(message("arguments.numericRequired"));
     return Number(raw);
   }
   if (schema?.type === "boolean") {
-    if (raw !== "true" && raw !== "false" && typeof raw !== "boolean") fail("Expected true or false");
+    if (raw !== "true" && raw !== "false" && typeof raw !== "boolean") fail(message("arguments.booleanRequired"));
     return raw === true || raw === "true";
   }
   if (["object", "array"].includes(schema?.type) && typeof raw === "string") {
-    try { return JSON.parse(raw); } catch { fail("Structured typed fields require a JSON value"); }
+    try { return JSON.parse(raw); } catch { fail(message("arguments.structuredJSONRequired")); }
   }
   return raw;
 }
@@ -85,11 +86,11 @@ export async function prepareManagement(contract, operation, parsed, env, readIn
   const binaryType = Object.keys(operation.requestBody?.content ?? {}).find((type) => type === "image/png");
   let binaryBody;
   if (parsed.get("file")) {
-    if (!binaryType) fail("This public method does not accept --file");
-    if (parsed.get("data")) fail("Use --file alone for a binary request body");
+    if (!binaryType) fail(message("arguments.fileUnsupported"));
+    if (parsed.get("data")) fail(message("arguments.binaryBodyConflict"));
     binaryBody = Buffer.from(await readBinary(parsed.get("file") === "-" ? 0 : parsed.get("file"), 320 << 10));
     if (binaryBody.length > 320 << 10 || binaryBody.length < 33 || !binaryBody.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10])) ||
-        binaryBody.toString("ascii", 12, 16) !== "IHDR" || binaryBody.readUInt32BE(16) !== 256 || binaryBody.readUInt32BE(20) !== 256) fail("Choose a cropped 256 by 256 PNG no larger than 320 KiB");
+        binaryBody.toString("ascii", 12, 16) !== "IHDR" || binaryBody.readUInt32BE(16) !== 256 || binaryBody.readUInt32BE(20) !== 256) fail(message("arguments.invalidPNG"));
     bodyProvided = true;
   }
   if (parsed.get("params")) {
@@ -98,27 +99,27 @@ export async function prepareManagement(contract, operation, parsed, env, readIn
     Object.assign(values, value);
   }
   if (parsed.get("data")) {
-    if (!inputSchema) fail("This public method does not accept --data");
+    if (!inputSchema) fail(message("arguments.dataUnsupported"));
     const input = await jsonInput(parsed.get("data"), readInput);
     if (!input.indirect) noInlineSecrets(input.value);
     Object.assign(body, input.value); bodyProvided = true;
   }
   const declaration = (name) => declarations.find((item) => item.name === name || item.in === "header" && item.name.toLowerCase() === name.toLowerCase());
   function apply(name, raw, privateInput) {
-    if (!privateInput && sensitive.has(name)) fail("Sensitive fields require --param-env or private JSON input");
+    if (!privateInput && sensitive.has(name)) fail(message("arguments.privateFieldRequired"));
     const parameter = declaration(name);
     const property = inputSchema?.properties?.[name];
-    if (!parameter && !property) fail(`Unknown parameter ${name}`);
+    if (!parameter && !property) fail(message("arguments.unknownParameter", { name }));
     if (parameter) values[parameter.name] = cast(raw, parameter.schema);
     else { body[name] = cast(raw, resolveSchema(contract, property)); bodyProvided = true; }
   }
   for (const kind of ["param", "param-env", "header"]) for (const pair of parsed.flags.get(kind) ?? []) {
     const index = pair.indexOf("=");
-    if (index < 1) fail(`--${kind} requires name=value`);
+    if (index < 1) fail(message("arguments.nameValueRequired", { flag: kind }));
     const name = pair.slice(0, index), raw = pair.slice(index + 1);
-    if (kind === "header" && !declarations.some((item) => item.in === "header" && item.name.toLowerCase() === name.toLowerCase())) fail("Only contract-declared HTTP headers can be set");
+    if (kind === "header" && !declarations.some((item) => item.in === "header" && item.name.toLowerCase() === name.toLowerCase())) fail(message("arguments.headerUndeclared"));
     if (kind === "param-env") {
-      if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(raw) || !env[raw]) fail(`--param-env ${name} needs a populated environment variable`);
+      if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(raw) || !env[raw]) fail(message("arguments.environmentValueRequired", { name }));
       apply(name, env[raw], true);
     } else apply(name, raw, false);
   }
@@ -129,30 +130,30 @@ export async function prepareManagement(contract, operation, parsed, env, readIn
       apply(name, field?.type === "array" && items.length > 1 ? items : items[0], false);
     }
   }
-  for (const key of Object.keys(values)) if (!declaration(key)) fail(`Unknown path/query/header parameter ${key}`);
+  for (const key of Object.keys(values)) if (!declaration(key)) fail(message("arguments.unknownRequestParameter", { name: key }));
   const query = new URLSearchParams(), headers = {}, bindings = { ...rawBindings };
   for (const parameter of declarations) {
     let value = values[parameter.name];
     if (parameter.in === "path" && rawBindings[parameter.name] !== undefined) {
-      if (value !== undefined && String(value) !== rawBindings[parameter.name]) fail(`Path parameter ${parameter.name} conflicts with the raw HTTP path`);
+      if (value !== undefined && String(value) !== rawBindings[parameter.name]) fail(message("arguments.pathConflict", { name: parameter.name }));
       value = rawBindings[parameter.name];
     }
-    if (value === undefined) { if (parameter.required) fail(`Required ${parameter.in} parameter: ${parameter.name}`); continue; }
+    if (value === undefined) { if (parameter.required) fail(message("arguments.requiredRequestParameter", { location: parameter.in, name: parameter.name })); continue; }
     value = cast(value, parameter.schema);
     validateJSON(contract, parameter.schema, value, parameter.name);
     if (parameter.in === "path") {
-      if (typeof value !== "string" || !value || value === "." || value === ".." || /[/\\?#\x00-\x1f]/.test(value)) fail(`Invalid path parameter ${parameter.name}`);
+      if (typeof value !== "string" || !value || value === "." || value === ".." || /[/\\?#\x00-\x1f]/.test(value)) fail(message("arguments.invalidPathParameter", { name: parameter.name }));
       bindings[parameter.name] = value;
     } else if (parameter.in === "header") {
-      if (["authorization", "cookie", "host", "content-type"].includes(parameter.name.toLowerCase()) || /[\r\n\0]/.test(String(value))) fail("Unsafe or reserved request header");
+      if (["authorization", "cookie", "host", "content-type"].includes(parameter.name.toLowerCase()) || /[\r\n\0]/.test(String(value))) fail(message("arguments.unsafeHeader"));
       headers[parameter.name] = String(value);
     } else if (parameter.in === "query") for (const item of Array.isArray(value) ? value : [value]) query.append(parameter.name, String(item));
   }
   const path = operation.path.replace(/\{([^}]+)\}/g, (_match, key) => {
-    if (bindings[key] === undefined) fail(`Required path parameter: ${key}`);
+    if (bindings[key] === undefined) fail(message("arguments.requiredPathParameter", { name: key }));
     return encodeURIComponent(bindings[key]);
   });
-  if (operation.requestBody?.required && !bodyProvided) fail(binaryType ? "This public method requires --file PNG_PATH (or --file - for stdin)" : "This public method requires --data JSON");
+  if (operation.requestBody?.required && !bodyProvided) fail(binaryType ? message("arguments.fileRequired") : message("arguments.dataRequired"));
   if (bodyProvided && !binaryBody) validateJSON(contract, inputSchema, body);
   return { path, query, extraHeaders: headers, ...(binaryBody ? { binaryBody, binaryType,
     binarySummary: { media_type: binaryType, bytes: binaryBody.length, width: 256, height: 256, sha256: createHash("sha256").update(binaryBody).digest("hex") } } :

package/src/output.mjs

@@ -1,14 +1,19 @@
+import { currentLocalizer, message } from "./i18n.mjs";
 import { CLIError, redact } from "./protocol.mjs";
 
 export const formats = ["json", "ndjson", "table", "csv"];
+const columnLabels = {
+  command: "columns.command", operationId: "columns.operationId", method: "columns.method",
+  path: "columns.path", summary: "columns.summary", description: "columns.description", value: "columns.value",
+};
 
 export function outputOptions(parsed) {
   const format = parsed.get("json") ? "json" : parsed.get("format") ?? "json";
-  if (!formats.includes(format)) throw new CLIError("invalid_arguments", "--format must be json, ndjson, table or csv");
-  if (parsed.get("json") && parsed.get("format") && parsed.get("format") !== "json") throw new CLIError("invalid_arguments", "--json conflicts with --format");
+  if (!formats.includes(format)) throw new CLIError("invalid_arguments", message("arguments.invalidFormat"));
+  if (parsed.get("json") && parsed.get("format") && parsed.get("format") !== "json") throw new CLIError("invalid_arguments", message("arguments.formatConflict"));
   const fields = parsed.get("fields")?.split(",").map((value) => value.trim());
   if (fields?.some((value) => !/^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)*$/.test(value) || value.split(".").some((part) => ["__proto__", "prototype", "constructor"].includes(part)))) {
-    throw new CLIError("invalid_arguments", "--fields must be comma-separated field paths");
+    throw new CLIError("invalid_arguments", message("arguments.invalidFields"));
   }
   return { format, fields };
 }
@@ -38,18 +43,19 @@ export function success(io, value, { format = "json", fields, identity = "public
       const quote = (item) => `"${String(item ?? "").replaceAll('"', '""')}"`;
       io.stdout.write(`${[keys, ...rows.map((row) => keys.map((key) => typeof row[key] === "object" && row[key] !== null ? JSON.stringify(row[key]) : row[key]))].map((row) => row.map(quote).join(",")).join("\n")}\n`);
     } else {
-      const cells = [keys, ...rows.map((row) => keys.map((key) => text(row[key])))];
+      const headings = keys.map(key => Object.hasOwn(columnLabels, key) ? currentLocalizer().t(columnLabels[key]) : key);
+      const cells = [headings, ...rows.map((row) => keys.map((key) => text(row[key])))];
       const widths = keys.map((_key, index) => Math.min(80, Math.max(...cells.map((row) => row[index].length))));
       io.stdout.write(`${cells.map((row) => row.map((cell, index) => text(cell).slice(0, widths[index]).padEnd(widths[index])).join("  ").trimEnd()).join("\n")}\n`);
     }
   }
 }
 
-export function errorEnvelope(error, cancelled) {
+export function errorEnvelope(error, cancelled, localizer = currentLocalizer()) {
   const known = error instanceof CLIError;
   const code = cancelled ? "cancelled" : known ? error.code : "cli_error";
   const type = error?.status ? "api" : ["login_required", "token_expired", "missing_scopes"].includes(code) ? "auth" :
     code === "request_failed" ? "transport" : code === "invalid_arguments" || code === "invalid_issuer" ? "validation" : "cli";
-  return { ok: false, error: { type, ...(type === "validation" ? { subtype: "invalid_argument" } : {}), code, message: cancelled ? "Command cancelled" : known ? error.message : "Command failed; check local configuration and retry",
+  return { ok: false, error: { type, ...(type === "validation" ? { subtype: "invalid_argument" } : {}), code, message: cancelled ? localizer.t("errors.cancelled") : known ? error.message : localizer.t("errors.failed"),
     ...(known && error.status ? { status: error.status } : {}), ...(known && error.retryAfter ? { retry_after: error.retryAfter } : {}) } };
 }

package/src/protocol.mjs

@@ -1,6 +1,7 @@
+import { currentLocalizer, message, translate } from "./i18n.mjs";
 export class CLIError extends Error {
   constructor(code, message, status, retryAfter) {
-    super(message);
+    super(typeof message === "object" && message?.key ? translate(message.key, message.values) : message);
     this.code = code;
     this.status = status;
     this.retryAfter = retryAfter;
@@ -9,20 +10,20 @@ export class CLIError extends Error {
 
 export function issuerOrigin(value) {
   let url;
-  try { url = new URL(value); } catch { throw new CLIError("invalid_issuer", "Issuer must be an absolute HTTPS origin"); }
+  try { url = new URL(value); } catch { throw new CLIError("invalid_issuer", message("protocol.invalidIssuer")); }
   const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
   if ((url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) || url.username || url.password ||
       url.pathname !== "/" || url.search || url.hash) {
-    throw new CLIError("invalid_issuer", "Issuer must be an HTTPS origin; HTTP is allowed only on loopback");
+    throw new CLIError("invalid_issuer", message("protocol.insecureIssuer"));
   }
   return url.origin;
 }
 
 export function verificationURI(value, issuer) {
   let url;
-  try { url = new URL(value); } catch { throw new CLIError("invalid_response", "Invalid device verification URI"); }
+  try { url = new URL(value); } catch { throw new CLIError("invalid_response", message("protocol.invalidVerificationURI")); }
   if (url.origin !== issuer || url.username || url.password || url.pathname !== "/auth/device") {
-    throw new CLIError("invalid_response", "Device verification URI does not match this issuer");
+    throw new CLIError("invalid_response", message("protocol.verificationIssuerMismatch"));
   }
   return url.href;
 }
@@ -38,12 +39,12 @@ export async function protocolRequest({ issuer, origin = issuer, path, method =
   const targetOrigin = issuerOrigin(origin);
   const url = new URL(path, targetOrigin);
   if (url.origin !== targetOrigin || !path.startsWith("/") || path.startsWith("//") || url.pathname !== path || url.hash || url.search) {
-    throw new CLIError("invalid_endpoint", "Endpoint must be a contract path on this issuer");
+    throw new CLIError("invalid_endpoint", message("protocol.invalidEndpoint"));
   }
-  const headers = { ...extraHeaders, Accept: "application/json" };
+  const headers = { ...extraHeaders, Accept: "application/json", "Accept-Language": currentLocalizer().locale };
   const form = new URLSearchParams(parameters);
   if (clientSecret) {
-    if (!clientID) throw new CLIError("client_id_required", "Set LIMECLOUD_CLIENT_ID with LIMECLOUD_CLIENT_SECRET");
+    if (!clientID) throw new CLIError("client_id_required", message("protocol.basicClientRequired"));
     // OAuth Basic credentials use form encoding before Base64 encoding.
     const encode = (value) => new URLSearchParams({ v: value }).toString().slice(2);
     headers.Authorization = `Basic ${Buffer.from(`${encode(clientID)}:${encode(clientSecret)}`).toString("base64")}`;
@@ -63,17 +64,17 @@ export async function protocolRequest({ issuer, origin = issuer, path, method =
       redirect: "manual", signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(30_000)]) : AbortSignal.timeout(30_000),
     });
   } catch {
-    throw new CLIError("request_failed", "Request failed or timed out; a token exchange may have completed. Do not replay an uncertain token exchange");
+    throw new CLIError("request_failed", message("protocol.requestUncertain"));
   }
   if (response.status >= 300 && response.status < 400) {
-    throw new CLIError("redirect_refused", "Endpoint returned a redirect; no follow-up request was sent", response.status);
+    throw new CLIError("redirect_refused", message("protocol.redirectRefused"), response.status);
   }
   let data;
   const body = await response.text();
   if (!body) data = null;
   else {
     try { data = JSON.parse(body); } catch {
-      throw new CLIError("invalid_response", "Endpoint returned a non-JSON response", response.status);
+      throw new CLIError("invalid_response", message("protocol.nonJSONResponse"), response.status);
     }
   }
   if (!response.ok) {
@@ -81,7 +82,7 @@ export async function protocolRequest({ issuer, origin = issuer, path, method =
     const code = typeof errorCode === "string" && /^[A-Za-z0-9_.:-]{1,80}$/.test(errorCode) ? errorCode : "http_error";
     // Do not echo error descriptions: a server may include submitted secrets in them.
     const retry = Number(response.headers.get("Retry-After"));
-    throw new CLIError(code, `API request failed: ${code} (HTTP ${response.status})`, response.status,
+    throw new CLIError(code, message("protocol.apiFailed", { code, status: response.status }), response.status,
       Number.isFinite(retry) && retry > 0 ? retry : undefined);
   }
   return data;
@@ -92,7 +93,7 @@ export function tokenRecord(tokens, context, now = Date.now()) {
       !/^bearer$/i.test(tokens.token_type) || !Number.isFinite(tokens.expires_in) || tokens.expires_in <= 0 || tokens.expires_in > 31_536_000 ||
       (tokens.scope !== undefined && typeof tokens.scope !== "string") ||
       (tokens.refresh_token !== undefined && (typeof tokens.refresh_token !== "string" || !tokens.refresh_token))) {
-    throw new CLIError("invalid_response", "Invalid OAuth token response; start a new login");
+    throw new CLIError("invalid_response", message("protocol.invalidTokenResponse"));
   }
   return { issuer: context.issuer, ...(context.apiOrigin ? { api_origin: context.apiOrigin } : {}), client_id: context.clientID, access_token: tokens.access_token,
     refresh_token: tokens.refresh_token, scope: tokens.scope ?? "", expires_at: new Date(now + tokens.expires_in * 1000).toISOString() };
@@ -105,7 +106,7 @@ export async function startDevice({ context, request = protocolRequest, now = Da
   if (!device || typeof device.device_code !== "string" || !device.device_code || typeof device.user_code !== "string" ||
       !/^[A-Z2-7]{4}-[A-Z2-7]{4}$/.test(device.user_code) || !Number.isInteger(device.interval) || device.interval <= 0 ||
       !Number.isInteger(device.expires_in) || device.expires_in <= 0 || device.expires_in > 3600) {
-    throw new CLIError("invalid_response", "Invalid device authorization response");
+    throw new CLIError("invalid_response", message("protocol.invalidDeviceResponse"));
   }
   return { issuer: context.issuer, ...(context.apiOrigin ? { api_origin: context.apiOrigin } : {}), client_id: context.clientID, device_code: device.device_code, user_code: device.user_code,
     verification_uri: verificationURI(device.verification_uri_complete ?? device.verification_uri, context.issuer),
@@ -113,11 +114,11 @@ export async function startDevice({ context, request = protocolRequest, now = Da
 }
 
 export async function pollDevice({ pending, request = protocolRequest, wait, now = Date.now, persist = async () => {} }) {
-  if (pending.exchange_pending) throw new CLIError("login_required", "The previous device token exchange has an unknown result; start a new auth login");
+  if (pending.exchange_pending) throw new CLIError("login_required", message("protocol.deviceExchangeUncertain"));
   const deadline = Date.parse(pending.expires_at);
   const context = { issuer: pending.issuer, apiOrigin: pending.api_origin, clientID: pending.client_id };
   if (!Number.isFinite(deadline) || !Number.isFinite(pending.next_poll_at) || !Number.isInteger(pending.interval) || pending.interval <= 0 ||
-      typeof pending.device_code !== "string" || !pending.device_code || !context.clientID) throw new CLIError("invalid_credentials", "Invalid pending device authorization");
+      typeof pending.device_code !== "string" || !pending.device_code || !context.clientID) throw new CLIError("invalid_credentials", message("protocol.invalidPendingDevice"));
   const state = { ...pending };
   const form = new URLSearchParams({ client_id: context.clientID, grant_type: "urn:ietf:params:oauth:grant-type:device_code", device_code: state.device_code });
   while (now() < deadline) {
@@ -137,7 +138,7 @@ export async function pollDevice({ pending, request = protocolRequest, wait, now
       await persist(state);
     }
   }
-  throw new CLIError("expired_token", "Device authorization expired; start auth login again");
+  throw new CLIError("expired_token", message("protocol.deviceExpired"));
 }
 
 export async function deviceLogin({ context, request = protocolRequest, notify, wait, now = Date.now, parameters = new URLSearchParams() }) {

package/src/resources.mjs

@@ -0,0 +1,11 @@
+import { readFileSync } from "node:fs";
+
+let workspace = false;
+try {
+  workspace = JSON.parse(readFileSync(new URL("../../../package.json", import.meta.url), "utf8")).name === "lime-cloud";
+} catch (error) {
+  if (error.code !== "ENOENT") throw error;
+}
+
+export const contractURL = (name) => new URL(workspace ? `../../../contracts/openapi/${name}.json` : `../dist/${name}.json`, import.meta.url);
+export const localeRegistryURL = new URL(workspace ? "../../../contracts/i18n/locales.json" : "../dist/locales.json", import.meta.url);

package/src/storage.mjs

@@ -1,3 +1,4 @@
+import { message } from "./i18n.mjs";
 import { constants } from "node:fs";
 import { mkdir, open, rename, unlink } from "node:fs/promises";
 import { dirname, join } from "node:path";
@@ -15,7 +16,7 @@ export function settingsPath(env = process.env) {
 
 function checkPrivate(stat) {
   if (!stat.isFile() || (process.platform !== "win32" && ((stat.mode & 0o077) || stat.uid !== process.getuid()))) {
-    throw new CLIError("unsafe_credentials", "Local configuration must be a regular file owned by this user with mode 0600");
+    throw new CLIError("unsafe_credentials", message("storage.unsafeFile"));
   }
 }
 
@@ -32,7 +33,7 @@ export class PrivateJSONStore {
     } catch (error) {
       if (error.code === "ENOENT") return null;
       if (error instanceof CLIError) throw error;
-      throw new CLIError("invalid_credentials", "Unable to read private local configuration; check the file or select another path");
+      throw new CLIError("invalid_credentials", message("storage.unreadable"));
     } finally { await file?.close(); }
   }
   async write(record) {
@@ -49,7 +50,7 @@ export class PrivateJSONStore {
     let lock;
     try { lock = await open(lockPath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 0o600); }
     catch (error) {
-      if (error.code === "EEXIST") throw new CLIError("credentials_busy", "Another command holds this configuration lock; finish it before retrying");
+      if (error.code === "EEXIST") throw new CLIError("credentials_busy", message("storage.busy"));
       throw error;
     }
     try { await lock.writeFile(`${process.pid}\n`); return await callback(); }
@@ -66,25 +67,25 @@ export class CredentialStore extends PrivateJSONStore {
     if (typeof data.client_id !== "string" || !data.client_id || typeof data.access_token !== "string" ||
         !Number.isFinite(Date.parse(data.expires_at)) ||
         (data.refresh_token !== undefined && typeof data.refresh_token !== "string")) {
-      throw new CLIError("invalid_credentials", "Invalid saved credentials; use a separate LIMECLOUD_CONFIG and sign in again");
+      throw new CLIError("invalid_credentials", message("storage.invalidCredentials"));
     }
     return data;
   }
 }
 
 export function validateSettings(value) {
-  if (Object.keys(value).some((key) => !["issuer", "api_origin", "client_id", "scope"].includes(key))) throw new CLIError("invalid_arguments", "Supported config keys: issuer, api_origin, client_id, scope");
+  if (Object.keys(value).some((key) => !["issuer", "api_origin", "client_id", "scope"].includes(key))) throw new CLIError("invalid_arguments", message("arguments.configKeys"));
   const result = {};
   if (value.issuer !== undefined) result.issuer = issuerOrigin(value.issuer);
   if (value.api_origin !== undefined) result.api_origin = issuerOrigin(value.api_origin);
   if (value.client_id !== undefined) {
     if (typeof value.client_id !== "string" || !value.client_id || value.client_id.length > 200 || /[\x00-\x20\x7f]/.test(value.client_id)) {
-      throw new CLIError("invalid_arguments", "client_id must be a registered public client ID");
+      throw new CLIError("invalid_arguments", message("arguments.invalidClientID"));
     }
     result.client_id = value.client_id;
   }
   if (value.scope !== undefined) {
-    if (typeof value.scope !== "string") throw new CLIError("invalid_arguments", "scope must be a space-separated string");
+    if (typeof value.scope !== "string") throw new CLIError("invalid_arguments", message("arguments.invalidScope"));
     result.scope = scopeList(value.scope).join(" ");
   }
   return result;