@loxtep/sdk 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -6,6 +6,19 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.0] - 2026-07-14
+
+### Added
+
+- **`client.approvals`** — programmatic parity with the web inbox and
+  Slack/email channels for pipeline HITL gates. `list(filters)`,
+  `list_pending(organization_id?)`, `resolve(id, action, organization_id?)`,
+  `approve(id, organization_id?)`, `reject(id, organization_id?)`. Backed by
+  the agent-orchestration `approval-requests` REST API; resolving an approval
+  via the SDK resolves the same shared record as the inbox, Slack, and email
+  buttons. Mirrors the new `loxtep_approvals` MCP facade
+  (`list_pending_approvals` / `resolve_approval`).
+
 ## [0.5.0] - 2026-07-13
 
 ### Breaking changes — API surface redesign

package/dist/cli/auth-resolve.d.ts

@@ -1,6 +1,6 @@
 /**
  * Resolve API access token and optional api_url override for CLI.
- * Order: LOXTEP_AUTH_TOKEN → ~/.loxtep/credentials.json.
+ * Order: LOXTEP_AUTH_TOKEN → project-local `.loxtep/credentials.json` → ~/.loxtep/credentials.json.
  */
 export type CliAuthSource = 'env' | 'credentials';
 export interface ResolvedCliAuth {
@@ -9,11 +9,14 @@ export interface ResolvedCliAuth {
     /** When tokens came from credentials.json, use as api_url if config.api_url is empty. */
     api_url_from_mcp?: string;
     source: CliAuthSource;
+    /** File the token was read from, when `source === 'credentials'` — used to persist refreshes back to the same file. */
+    credentials_path?: string;
 }
 /**
  * Resolve bearer token for Loxtep API calls (CLI).
  */
 export declare function resolveCliAccessToken(options?: {
     credentialsPath?: string;
+    cwd?: string;
 }): Promise<ResolvedCliAuth | null>;
 //# sourceMappingURL=auth-resolve.d.ts.map

package/dist/cli/auth-resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-resolve.d.ts","sourceRoot":"","sources":["../../src/cli/auth-resolve.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,aAAa,CAAC;AAElD,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,aAAa,CAAC;CACvB;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,CAAC,EAAE;IACpD,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAelC"}
+{"version":3,"file":"auth-resolve.d.ts","sourceRoot":"","sources":["../../src/cli/auth-resolve.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,aAAa,CAAC;AAElD,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,aAAa,CAAC;IACtB,uHAAuH;IACvH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,CAAC,EAAE;IACpD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAiBlC"}

package/dist/cli/auth-resolve.js

@@ -1,8 +1,8 @@
 /**
  * Resolve API access token and optional api_url override for CLI.
- * Order: LOXTEP_AUTH_TOKEN → ~/.loxtep/credentials.json.
+ * Order: LOXTEP_AUTH_TOKEN → project-local `.loxtep/credentials.json` → ~/.loxtep/credentials.json.
  */
-import { readCredentials } from './credentials.js';
+import { readCredentials, resolveCredentialsPath } from './credentials.js';
 /**
  * Resolve bearer token for Loxtep API calls (CLI).
  */
@@ -11,13 +11,15 @@ export async function resolveCliAccessToken(options) {
     if (envTok) {
         return { access_token: envTok, source: 'env' };
     }
-    const creds = await readCredentials(options?.credentialsPath);
+    const resolvedPath = options?.credentialsPath ?? resolveCredentialsPath(options?.cwd).path;
+    const creds = await readCredentials(resolvedPath);
     if (creds?.access_token) {
         return {
             access_token: creds.access_token,
             refresh_token: creds.refresh_token,
             api_url_from_mcp: creds.api_base_url,
             source: 'credentials',
+            credentials_path: resolvedPath,
         };
     }
     return null;

package/dist/cli/auth-resolve.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-resolve.js","sourceRoot":"","sources":["../../src/cli/auth-resolve.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAYnD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAE3C;IACC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACrD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC9D,IAAI,KAAK,EAAE,YAAY,EAAE,CAAC;QACxB,OAAO;YACL,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,gBAAgB,EAAE,KAAK,CAAC,YAAY;YACpC,MAAM,EAAE,aAAa;SACtB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"auth-resolve.js","sourceRoot":"","sources":["../../src/cli/auth-resolve.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAc3E;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAG3C;IACC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACrD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,EAAE,eAAe,IAAI,sBAAsB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3F,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,KAAK,EAAE,YAAY,EAAE,CAAC;QACxB,OAAO;YACL,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,gBAAgB,EAAE,KAAK,CAAC,YAAY;YACpC,MAAM,EAAE,aAAa;YACrB,gBAAgB,EAAE,YAAY;SAC/B,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cli/commands/login.d.ts

@@ -1,3 +1,4 @@
+import { type CredentialsScope } from '../credentials.js';
 export interface LoginOptions {
     email?: string;
     password?: string;
@@ -16,8 +17,16 @@ export interface LoginOptions {
     fetchFn?: typeof fetch;
     /** For tests: config file path (default: env/file). */
     configFilePath?: string;
-    /** For tests: credentials file path to write. */
+    /** For tests: credentials file path to write. Takes precedence over --local/--global. */
     credentialsPath?: string;
+    /**
+     * Force credentials scope: `local` writes to `<project>/.loxtep/credentials.json`
+     * (requires a project found via `.loxtep/project.json`); `global` writes to
+     * `~/.loxtep/credentials.json`. Default: local when run inside a project, else global.
+     */
+    scope?: CredentialsScope;
+    /** Working directory used to resolve the project for local scoping (default: `process.cwd()`). */
+    cwd?: string;
     /** Override config auth first path segment (default: `app` when omitted in config). */
     auth_path_prefix?: string;
     /** Don't auto-open browser — just print the URL. */

package/dist/cli/commands/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/login.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,uDAAuD;IACvD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uFAAuF;IACvF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAuBD;;GAEG;AACH,wBAAsB,QAAQ,CAAC,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0GxE"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/login.ts"],"names":[],"mappings":"AAIA,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,uDAAuD;IACvD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yFAAyF;IACzF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,kGAAkG;IAClG,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAuBD;;GAEG;AACH,wBAAsB,QAAQ,CAAC,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmIxE"}

package/dist/cli/commands/login.js

@@ -2,7 +2,7 @@ import * as readline from 'node:readline';
 import { login as authLogin, LoginMfaRequiredError } from '../../auth/login.js';
 import { browserLogin } from '../../auth/browser-login.js';
 import { loadConfig } from '../../config/load.js';
-import { getCredentialsPath, writeCredentials } from '../credentials.js';
+import { writeCredentials, resolveCredentialsWriteTarget, ensureLocalCredentialsGitignored, } from '../credentials.js';
 /** Prompt for a single line (e.g. email or password). */
 function prompt(question) {
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
@@ -28,9 +28,25 @@ function parseOptionalMfaInput(raw) {
 export async function runLogin(options = {}) {
     // Default to browser login unless --console or --email/--password forces console mode
     const useBrowser = !options.console && !options.email && !options.password;
+    let credentialsPath;
+    let scope;
+    if (options.credentialsPath) {
+        credentialsPath = options.credentialsPath;
+    }
+    else {
+        try {
+            const target = resolveCredentialsWriteTarget(options.cwd, options.scope);
+            credentialsPath = target.path;
+            scope = target.scope;
+        }
+        catch (err) {
+            console.error(err instanceof Error ? err.message : String(err));
+            process.exitCode = 1;
+            return;
+        }
+    }
     if (useBrowser) {
         const config = await loadConfig(options.configFilePath);
-        const credentialsPath = options.credentialsPath ?? getCredentialsPath();
         // Determine app URL from config or default
         const apiUrl = (config.api_url || '').replace(/\/$/, '');
         let appUrl;
@@ -56,7 +72,13 @@ export async function runLogin(options = {}) {
                 api_base_url: apiUrl || undefined,
                 aws_credentials: result.aws_credentials,
             }, credentialsPath);
-            console.log(`\nLogged in successfully. Tokens saved to ${credentialsPath}`);
+            if (scope === 'local') {
+                const target = resolveCredentialsWriteTarget(options.cwd, 'local');
+                if (target.projectDir)
+                    await ensureLocalCredentialsGitignored(target.projectDir);
+            }
+            const scopeNote = scope === 'local' ? ' (project-local)' : scope === 'global' ? ' (global)' : '';
+            console.log(`\nLogged in successfully. Tokens saved to ${credentialsPath}${scopeNote}`);
         }
         catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
@@ -106,8 +128,14 @@ export async function runLogin(options = {}) {
             refresh_token: result.refresh_token,
             expires_at: result.expires_at,
             aws_credentials: result.aws_credentials,
-        }, options.credentialsPath);
-        console.log('Logged in successfully.');
+        }, credentialsPath);
+        if (scope === 'local') {
+            const target = resolveCredentialsWriteTarget(options.cwd, 'local');
+            if (target.projectDir)
+                await ensureLocalCredentialsGitignored(target.projectDir);
+        }
+        const scopeNote = scope === 'local' ? ' (project-local)' : scope === 'global' ? ' (global)' : '';
+        console.log(`Logged in successfully. Tokens saved to ${credentialsPath}${scopeNote}`);
     }
     catch (err) {
         if (err instanceof LoginMfaRequiredError) {

package/dist/cli/commands/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/cli/commands/login.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AA4BzE,yDAAyD;AACzD,SAAS,MAAM,CAAC,QAAgB;IAC9B,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE;YAC7B,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,wEAAwE;AACxE,SAAS,qBAAqB,CAAC,GAAW;IACxC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACvC,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,UAAwB,EAAE;IACvD,sFAAsF;IACtF,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IAE3E,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACxD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,kBAAkB,EAAE,CAAC;QAExE,2CAA2C;QAC3C,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzD,IAAI,MAAc,CAAC;QACnB,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/B,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAChD,CAAC;aAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,uBAAuB,CAAC;QACnC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;gBAChC,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE,MAAM,IAAI,SAAS;gBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC,CAAC;YACH,MAAM,gBAAgB,CACpB;gBACE,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,YAAY,EAAE,MAAM,IAAI,SAAS;gBACjC,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,EACD,eAAe,CAChB,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,6CAA6C,eAAe,EAAE,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;YACpC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,OAAO;IACT,CAAC;IAED,sDAAsD;IACtD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAC;QAC7F,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC1B,IAAI,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,KAAK,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ;QAAE,QAAQ,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;IAErD,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAClD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,IAAI,GAAuB,CAAC;IAC5B,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,iEAAiE,CAAC,CAAC;QAC7F,GAAG,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC;IAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAEhC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE;YACtD,eAAe,EAAE,GAAG;YACpB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,MAAM,CAAC,gBAAgB;YACrE,OAAO;SACR,CAAC,CAAC;QACH,MAAM,gBAAgB,CACpB;YACE,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,EACD,OAAO,CAAC,eAAe,CACxB,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;YACzC,OAAO,CAAC,KAAK,CACX,2HAA2H,CAC5H,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;YACpC,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,OAAO,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/cli/commands/login.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,6BAA6B,EAC7B,gCAAgC,GAEjC,MAAM,mBAAmB,CAAC;AAoC3B,yDAAyD;AACzD,SAAS,MAAM,CAAC,QAAgB;IAC9B,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE;YAC7B,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,wEAAwE;AACxE,SAAS,qBAAqB,CAAC,GAAW;IACxC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACvC,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,UAAwB,EAAE;IACvD,sFAAsF;IACtF,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IAE3E,IAAI,eAAuB,CAAC;IAC5B,IAAI,KAAmC,CAAC;IACxC,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,6BAA6B,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACzE,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC;YAC9B,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAChE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;IACH,CAAC;IAED,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAExD,2CAA2C;QAC3C,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzD,IAAI,MAAc,CAAC;QACnB,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/B,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAChD,CAAC;aAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,uBAAuB,CAAC;QACnC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;gBAChC,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE,MAAM,IAAI,SAAS;gBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC,CAAC;YACH,MAAM,gBAAgB,CACpB;gBACE,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,YAAY,EAAE,MAAM,IAAI,SAAS;gBACjC,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,EACD,eAAe,CAChB,CAAC;YACF,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;gBACtB,MAAM,MAAM,GAAG,6BAA6B,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBACnE,IAAI,MAAM,CAAC,UAAU;oBAAE,MAAM,gCAAgC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,SAAS,GAAG,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YACjG,OAAO,CAAC,GAAG,CAAC,6CAA6C,eAAe,GAAG,SAAS,EAAE,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;YACpC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,OAAO;IACT,CAAC;IAED,sDAAsD;IACtD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAC;QAC7F,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC1B,IAAI,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,KAAK,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ;QAAE,QAAQ,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;IAErD,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAClD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,IAAI,GAAuB,CAAC;IAC5B,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,GAAG,GAAG,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,iEAAiE,CAAC,CAAC;QAC7F,GAAG,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC;IAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAEhC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE;YACtD,eAAe,EAAE,GAAG;YACpB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,MAAM,CAAC,gBAAgB;YACrE,OAAO;SACR,CAAC,CAAC;QACH,MAAM,gBAAgB,CACpB;YACE,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,EACD,eAAe,CAChB,CAAC;QACF,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,6BAA6B,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACnE,IAAI,MAAM,CAAC,UAAU;gBAAE,MAAM,gCAAgC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,SAAS,GAAG,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACjG,OAAO,CAAC,GAAG,CAAC,2CAA2C,eAAe,GAAG,SAAS,EAAE,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;YACzC,OAAO,CAAC,KAAK,CACX,2HAA2H,CAC5H,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;YACpC,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,OAAO,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/cli/commands/logout.d.ts

@@ -1,5 +1,15 @@
+import { type CredentialsScope } from '../credentials.js';
+export interface LogoutOptions {
+    /** Force scope instead of the default local-first resolution. */
+    scope?: CredentialsScope;
+    /** Working directory used to resolve the project for local scoping (default: `process.cwd()`). */
+    cwd?: string;
+}
 /**
- * Run logout: remove stored credentials file.
+ * Run logout: remove stored credentials file. By default removes whichever
+ * credentials are currently active for `cwd` (project-local if present, else
+ * global) — same resolution used to authenticate. Pass `scope` to force
+ * removing the local or global file specifically.
  */
-export declare function runLogout(): Promise<void>;
+export declare function runLogout(options?: LogoutOptions): Promise<void>;
 //# sourceMappingURL=logout.d.ts.map

package/dist/cli/commands/logout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/logout.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,wBAAsB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAG/C"}
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAG3B,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,kGAAkG;IAClG,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAAC,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4B1E"}

package/dist/cli/commands/logout.js

@@ -1,9 +1,33 @@
-import { deleteCredentials } from '../credentials.js';
+import { deleteCredentials, resolveCredentialsPath, getCredentialsPath, getLocalCredentialsPath, } from '../credentials.js';
+import { findProjectDir } from '../project-context.js';
 /**
- * Run logout: remove stored credentials file.
+ * Run logout: remove stored credentials file. By default removes whichever
+ * credentials are currently active for `cwd` (project-local if present, else
+ * global) — same resolution used to authenticate. Pass `scope` to force
+ * removing the local or global file specifically.
  */
-export async function runLogout() {
-    await deleteCredentials();
-    console.log('Logged out.');
+export async function runLogout(options = {}) {
+    const cwd = options.cwd ?? process.cwd();
+    if (options.scope === 'global') {
+        const path = getCredentialsPath();
+        await deleteCredentials(path);
+        console.log(`Logged out (global: ${path}).`);
+        return;
+    }
+    if (options.scope === 'local') {
+        const projectDir = findProjectDir(cwd);
+        if (!projectDir) {
+            console.error('No .loxtep/project.json found in this directory or any parent — nothing local to log out of.');
+            process.exitCode = 1;
+            return;
+        }
+        const path = getLocalCredentialsPath(projectDir);
+        await deleteCredentials(path);
+        console.log(`Logged out (local: ${path}).`);
+        return;
+    }
+    const target = resolveCredentialsPath(cwd);
+    await deleteCredentials(target.path);
+    console.log(`Logged out (${target.scope}: ${target.path}).`);
 }
 //# sourceMappingURL=logout.js.map

package/dist/cli/commands/logout.js.map

@@ -1 +1 @@
-{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../../src/cli/commands/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,iBAAiB,EAAE,CAAC;IAC1B,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../../src/cli/commands/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,kBAAkB,EAClB,uBAAuB,GAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AASvD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,UAAyB,EAAE;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAEzC,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;QAClC,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,IAAI,CAAC,CAAC;QAC7C,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CACX,8FAA8F,CAC/F,CAAC;YACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,IAAI,CAAC,CAAC;QAC5C,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;AAC/D,CAAC"}

package/dist/cli/commands/whoami.js

@@ -15,7 +15,7 @@ export async function runWhoami(options = {}) {
                     customerMcpPath: options.customerMcpPath,
                 });
                 if (!authCtx) {
-                    console.error('Missing api_url or access token. Set LOXTEP_API_URL / LOXTEP_AUTH_TOKEN, or run: loxtep config set api_url <url> ; loxtep login | npx @loxtep/customer-mcp-server login');
+                    console.error('Missing api_url or access token. Set LOXTEP_API_URL / LOXTEP_AUTH_TOKEN, or run: loxtep config set api_url <url> ; loxtep login');
                     process.exitCode = 1;
                     return null;
                 }

package/dist/cli/commands/whoami.js.map

@@ -1 +1 @@
-{"version":3,"file":"whoami.js","sourceRoot":"","sources":["../../../src/cli/commands/whoami.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAuB/D,MAAM,WAAW,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAW,CAAC;AAE5E;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,UAAyB,EAAE;IACzD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS;YAC5B,CAAC,CAAC,MAAM,OAAO,CAAC,SAAS,EAAE;YAC3B,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;gBAChB,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC;oBACzC,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,eAAe,EAAE,OAAO,CAAC,eAAe;oBACxC,eAAe,EAAE,OAAO,CAAC,eAAe;iBACzC,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CACX,yKAAyK,CAC1K,CAAC;oBACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;oBACrB,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,MAAM,GAAG,IAAI,gBAAgB,CAAC;oBAClC,QAAQ,EAAE,OAAO,CAAC,OAAO;oBACzB,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;oBAClC,WAAW,EAAE,WAAW;oBACxB,QAAQ,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK;iBACnC,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC,GAAG,CAAiB,yBAAyB,CAAC,CAAC;YAC/D,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,IAAI,IAAI,IAAI;YAAE,OAAO;QACzB,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,GAAG,CAAC;QACjC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;QAClF,MAAM,GAAG,GAAG,IAAI,EAAE,iBAAiB,IAAI,IAAI,EAAE,eAAe,IAAI,GAAG,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;QAC5C,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}
+{"version":3,"file":"whoami.js","sourceRoot":"","sources":["../../../src/cli/commands/whoami.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAuB/D,MAAM,WAAW,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAW,CAAC;AAE5E;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,UAAyB,EAAE;IACzD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS;YAC5B,CAAC,CAAC,MAAM,OAAO,CAAC,SAAS,EAAE;YAC3B,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;gBAChB,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC;oBACzC,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,eAAe,EAAE,OAAO,CAAC,eAAe;oBACxC,eAAe,EAAE,OAAO,CAAC,eAAe;iBACzC,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CACX,iIAAiI,CAClI,CAAC;oBACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;oBACrB,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,MAAM,GAAG,IAAI,gBAAgB,CAAC;oBAClC,QAAQ,EAAE,OAAO,CAAC,OAAO;oBACzB,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;oBAClC,WAAW,EAAE,WAAW;oBACxB,QAAQ,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK;iBACnC,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC,GAAG,CAAiB,yBAAyB,CAAC,CAAC;YAC/D,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,IAAI,IAAI,IAAI;YAAE,OAAO;QACzB,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,GAAG,CAAC;QACjC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;QAClF,MAAM,GAAG,GAAG,IAAI,EAAE,iBAAiB,IAAI,IAAI,EAAE,eAAe,IAAI,GAAG,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;QAC5C,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/cli/create-cli-client.d.ts

@@ -8,6 +8,8 @@ export interface CreateCliClientOptions {
     configFilePath?: string;
     credentialsPath?: string;
     customerMcpPath?: string;
+    /** Working directory used to resolve project-local credentials (default: `process.cwd()`). */
+    cwd?: string;
     /** After refresh, apply STS (or other) side effects; used by {@link createCliClient} for SigV4. */
     on_after_refresh?: (result: RefreshResponse) => void;
 }

package/dist/cli/create-cli-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-cli-client.d.ts","sourceRoot":"","sources":["../../src/cli/create-cli-client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAI/C,OAAO,EAAW,KAAK,eAAe,EAA4B,MAAM,kBAAkB,CAAC;AAE3F,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,MAAM,WAAW,sBAAsB;IACrC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mGAAmG;IACnG,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,IAAI,CAAC;CACtD;AA4BD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACxC,YAAY,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CACtC;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA2DhC;AAED,wBAAsB,eAAe,CAAC,OAAO,GAAE,sBAA2B,GAAG,OAAO,CAAC;IACnF,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC;CAChD,GAAG,IAAI,CAAC,CA4FR;AAED,mDAAmD;AACnD,wBAAsB,gBAAgB,CAAC,OAAO,GAAE,sBAA2B,GAAG,OAAO,CAAC;IACpF,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC;CAChD,CAAC,CAUD"}
+{"version":3,"file":"create-cli-client.d.ts","sourceRoot":"","sources":["../../src/cli/create-cli-client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAI/C,OAAO,EAAW,KAAK,eAAe,EAA4B,MAAM,kBAAkB,CAAC;AAE3F,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,MAAM,WAAW,sBAAsB;IACrC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8FAA8F;IAC9F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mGAAmG;IACnG,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,IAAI,CAAC;CACtD;AA4BD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACxC,YAAY,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CACtC;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAiEhC;AAED,wBAAsB,eAAe,CAAC,OAAO,GAAE,sBAA2B,GAAG,OAAO,CAAC;IACnF,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC;CAChD,GAAG,IAAI,CAAC,CA4FR;AAED,mDAAmD;AACnD,wBAAsB,gBAAgB,CAAC,OAAO,GAAE,sBAA2B,GAAG,OAAO,CAAC;IACpF,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC;CAChD,CAAC,CAUD"}

package/dist/cli/create-cli-client.js

@@ -3,7 +3,7 @@
  */
 import { loadConfig } from '../config/load.js';
 import { resolveCliAccessToken } from './auth-resolve.js';
-import { writeCredentials, readCredentials, getCredentialsPath } from './credentials.js';
+import { writeCredentials, readCredentials, resolveCredentialsPath } from './credentials.js';
 import { TokenManager } from '../auth/token-manager.js';
 import { refresh } from '../auth/login.js';
 import { decodeJwtPayload } from '../auth/jwt.js';
@@ -12,16 +12,16 @@ function jwtExpSeconds(token) {
     const { exp } = decodeJwtPayload(token);
     return exp;
 }
-async function persistRefreshedTokens(source, access_token, refresh_token, expires_at, aws_credentials, options) {
+async function persistRefreshedTokens(source, access_token, refresh_token, expires_at, aws_credentials, credentialsPath) {
     if (source !== 'credentials')
         return;
-    const prev = await readCredentials(options.credentialsPath);
+    const prev = await readCredentials(credentialsPath);
     await writeCredentials({
         access_token,
         refresh_token,
         expires_at,
         aws_credentials: aws_credentials ?? prev?.aws_credentials,
-    }, options.credentialsPath);
+    }, credentialsPath);
 }
 /**
  * Shared CLI auth: proactive refresh near JWT expiry + {@link LoxtepHttpClient} 401 retry via refresh_auth.
@@ -30,6 +30,7 @@ export async function createCliAuthContext(options = {}) {
     const config = await loadConfig(options.configFilePath);
     const resolved = await resolveCliAccessToken({
         credentialsPath: options.credentialsPath,
+        cwd: options.cwd,
     });
     const api_url = (config.api_url || resolved?.api_url_from_mcp || '').replace(/\/$/, '');
     if (!api_url || !resolved?.access_token) {
@@ -39,13 +40,17 @@ export async function createCliAuthContext(options = {}) {
     const exp = jwtExpSeconds(resolved.access_token);
     tm.setToken(resolved.access_token, resolved.refresh_token, exp);
     const source = resolved.source;
+    // The exact file the token was read from — refreshed tokens must be written
+    // back to this same file (local project creds vs. global ~/.loxtep), not
+    // wherever the global default happens to point.
+    const credentialsPath = options.credentialsPath ?? resolved.credentials_path ?? resolveCredentialsPath(options.cwd).path;
     const refreshFn = async (apiUrl, refreshToken) => {
         const r = await refresh(apiUrl, refreshToken, { auth_path_prefix: config.auth_path_prefix });
         const nextExp = r.expires_at != null && r.expires_at !== ''
             ? Math.floor(new Date(r.expires_at).getTime() / 1000)
             : jwtExpSeconds(r.access_token);
         tm.setToken(r.access_token, r.refresh_token ?? refreshToken, nextExp);
-        await persistRefreshedTokens(source, r.access_token, r.refresh_token ?? refreshToken, r.expires_at, r.aws_credentials, options);
+        await persistRefreshedTokens(source, r.access_token, r.refresh_token ?? refreshToken, r.expires_at, r.aws_credentials, credentialsPath);
         options.on_after_refresh?.(r);
         return {
             access_token: r.access_token,
@@ -80,7 +85,7 @@ export async function createCliAuthContext(options = {}) {
 }
 export async function createCliClient(options = {}) {
     const config = await loadConfig(options.configFilePath);
-    const credsPath = options.credentialsPath ?? getCredentialsPath();
+    const credsPath = options.credentialsPath ?? resolveCredentialsPath(options.cwd).path;
     const fileCreds = await readCredentials(credsPath);
     const cliSigv4 = fileCreds?.aws_credentials
         ? {

package/dist/cli/create-cli-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-cli-client.js","sourceRoot":"","sources":["../../src/cli/create-cli-client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAsB,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAkD,MAAM,kBAAkB,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAU1D,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,EAAE,GAAG,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,MAAqB,EACrB,YAAoB,EACpB,aAAiC,EACjC,UAA8B,EAC9B,eAAgD,EAChD,OAA+B;IAE/B,IAAI,MAAM,KAAK,aAAa;QAAE,OAAO;IACrC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5D,MAAM,gBAAgB,CACpB;QACE,YAAY;QACZ,aAAa;QACb,UAAU;QACV,eAAe,EAAE,eAAe,IAAI,IAAI,EAAE,eAAe;KAC1D,EACD,OAAO,CAAC,eAAe,CACxB,CAAC;AACJ,CAAC;AAQD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAkC,EAAE;IAEpC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC;QAC3C,eAAe,EAAE,OAAO,CAAC,eAAe;KACzC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,QAAQ,EAAE,gBAAgB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxF,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,IAAI,YAAY,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACjD,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAEhE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,MAAM,SAAS,GAAG,KAAK,EAAE,MAAc,EAAE,YAAoB,EAAE,EAAE;QAC/D,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC7F,MAAM,OAAO,GACX,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,UAAU,KAAK,EAAE;YACzC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;YACrD,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACpC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,aAAa,IAAI,YAAY,EAAE,OAAO,CAAC,CAAC;QACtE,MAAM,sBAAsB,CAC1B,MAAM,EACN,CAAC,CAAC,YAAY,EACd,CAAC,CAAC,aAAa,IAAI,YAAY,EAC/B,CAAC,CAAC,UAAU,EACZ,CAAC,CAAC,eAAe,EACjB,OAAO,CACR,CAAC;QACF,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9B,OAAO;YACL,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,YAAY;YAC9C,UAAU,EAAE,CAAC,CAAC,UAAU;SACzB,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,KAAK,IAA4B,EAAE;QACnD,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,QAAQ,CAAC,YAAY,CAAC;QACnD,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QACtE,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,KAAK,IAAsB,EAAE;QAChD,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QACnC,MAAM,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC;QAChC,IAAI,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,UAAkC,EAAE;IAIxE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,IAAI,kBAAkB,EAAE,CAAC;IAClE,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,QAAQ,GAIV,SAAS,EAAE,eAAe;QAC5B,CAAC,CAAC;YACE,WAAW,EAAE,SAAS,CAAC,eAAe,CAAC,aAAa;YACpD,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC,iBAAiB;YAC5D,YAAY,EAAE,SAAS,CAAC,eAAe,CAAC,aAAa;SACtD;QACH,CAAC,CAAC;YACE,WAAW,EAAE,KAAK;YAClB,eAAe,EAAE,KAAK;SACvB,CAAC;IAEN,+DAA+D;IAC/D,IAAI,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;QACvE,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACvB,2DAA2D;YAC3D,MAAM,iBAAiB,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;YAC9D,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,YAAY,EAAE,CAAC;gBACzD,IAAI,SAAS,EAAE,CAAC;oBACd,2EAA2E;oBAC3E,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;oBACxD,IAAI,cAAc,EAAE,eAAe,EAAE,CAAC;wBACpC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;wBAChF,IAAI,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;4BACtB,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE;gCACtB,WAAW,EAAE,cAAc,CAAC,eAAe,CAAC,aAAa;gCACzD,eAAe,EAAE,cAAc,CAAC,eAAe,CAAC,iBAAiB;gCACjE,YAAY,EAAE,cAAc,CAAC,eAAe,CAAC,aAAa;6BAC3D,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,uFAAuF;YACvF,MAAM,YAAY,GAChB,QAAQ,CAAC,WAAW,KAAK,SAAS,CAAC,eAAe,CAAC,aAAa;gBAChE,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACrB,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO,CAAC,KAAK,CACX,wEAAwE;oBACtE,+EAA+E,CAClF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC;QACzC,GAAG,OAAO;QACV,gBAAgB,EAAE,CAAC,CAAC,EAAE;YACpB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC;gBACtB,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE;oBACtB,WAAW,EAAE,CAAC,CAAC,eAAe,CAAC,aAAa;oBAC5C,eAAe,EAAE,CAAC,CAAC,eAAe,CAAC,iBAAiB;oBACpD,YAAY,EAAE,CAAC,CAAC,eAAe,CAAC,aAAa;iBAC9C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,eAAe,GACnB,MAAM,CAAC,eAAe,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,CAAC,eAAe;YACjB,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,cAAc,EAAE,QAAiB,EAAE;YAChF,CAAC,CAAC,EAAE,cAAc,EAAE,UAAmB,EAAE,CAAC;QAC5C,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE;QAChC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,QAAQ;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,OAAO;YAChB,CAAC,CAAC;gBACE,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAkC,EAAE;IAIzE,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,CAAC,KAAK,CACX,wDAAwD,CACzD,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO,CAAU,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"create-cli-client.js","sourceRoot":"","sources":["../../src/cli/create-cli-client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAsB,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAkD,MAAM,kBAAkB,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAY1D,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,EAAE,GAAG,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,MAAqB,EACrB,YAAoB,EACpB,aAAiC,EACjC,UAA8B,EAC9B,eAAgD,EAChD,eAAuB;IAEvB,IAAI,MAAM,KAAK,aAAa;QAAE,OAAO;IACrC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,gBAAgB,CACpB;QACE,YAAY;QACZ,aAAa;QACb,UAAU;QACV,eAAe,EAAE,eAAe,IAAI,IAAI,EAAE,eAAe;KAC1D,EACD,eAAe,CAChB,CAAC;AACJ,CAAC;AAQD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAkC,EAAE;IAEpC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC;QAC3C,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,QAAQ,EAAE,gBAAgB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxF,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,IAAI,YAAY,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACjD,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAEhE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,4EAA4E;IAC5E,yEAAyE;IACzE,gDAAgD;IAChD,MAAM,eAAe,GACnB,OAAO,CAAC,eAAe,IAAI,QAAQ,CAAC,gBAAgB,IAAI,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IACnG,MAAM,SAAS,GAAG,KAAK,EAAE,MAAc,EAAE,YAAoB,EAAE,EAAE;QAC/D,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC7F,MAAM,OAAO,GACX,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,UAAU,KAAK,EAAE;YACzC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;YACrD,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACpC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,aAAa,IAAI,YAAY,EAAE,OAAO,CAAC,CAAC;QACtE,MAAM,sBAAsB,CAC1B,MAAM,EACN,CAAC,CAAC,YAAY,EACd,CAAC,CAAC,aAAa,IAAI,YAAY,EAC/B,CAAC,CAAC,UAAU,EACZ,CAAC,CAAC,eAAe,EACjB,eAAe,CAChB,CAAC;QACF,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9B,OAAO;YACL,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,YAAY;YAC9C,UAAU,EAAE,CAAC,CAAC,UAAU;SACzB,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,KAAK,IAA4B,EAAE;QACnD,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,QAAQ,CAAC,YAAY,CAAC;QACnD,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QACtE,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,KAAK,IAAsB,EAAE;QAChD,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QACnC,MAAM,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC;QAChC,IAAI,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,UAAkC,EAAE;IAIxE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,IAAI,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IACtF,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,QAAQ,GAIV,SAAS,EAAE,eAAe;QAC5B,CAAC,CAAC;YACE,WAAW,EAAE,SAAS,CAAC,eAAe,CAAC,aAAa;YACpD,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC,iBAAiB;YAC5D,YAAY,EAAE,SAAS,CAAC,eAAe,CAAC,aAAa;SACtD;QACH,CAAC,CAAC;YACE,WAAW,EAAE,KAAK;YAClB,eAAe,EAAE,KAAK;SACvB,CAAC;IAEN,+DAA+D;IAC/D,IAAI,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;QACvE,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACvB,2DAA2D;YAC3D,MAAM,iBAAiB,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;YAC9D,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,YAAY,EAAE,CAAC;gBACzD,IAAI,SAAS,EAAE,CAAC;oBACd,2EAA2E;oBAC3E,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;oBACxD,IAAI,cAAc,EAAE,eAAe,EAAE,CAAC;wBACpC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;wBAChF,IAAI,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;4BACtB,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE;gCACtB,WAAW,EAAE,cAAc,CAAC,eAAe,CAAC,aAAa;gCACzD,eAAe,EAAE,cAAc,CAAC,eAAe,CAAC,iBAAiB;gCACjE,YAAY,EAAE,cAAc,CAAC,eAAe,CAAC,aAAa;6BAC3D,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,uFAAuF;YACvF,MAAM,YAAY,GAChB,QAAQ,CAAC,WAAW,KAAK,SAAS,CAAC,eAAe,CAAC,aAAa;gBAChE,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACrB,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO,CAAC,KAAK,CACX,wEAAwE;oBACtE,+EAA+E,CAClF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC;QACzC,GAAG,OAAO;QACV,gBAAgB,EAAE,CAAC,CAAC,EAAE;YACpB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC;gBACtB,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE;oBACtB,WAAW,EAAE,CAAC,CAAC,eAAe,CAAC,aAAa;oBAC5C,eAAe,EAAE,CAAC,CAAC,eAAe,CAAC,iBAAiB;oBACpD,YAAY,EAAE,CAAC,CAAC,eAAe,CAAC,aAAa;iBAC9C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,eAAe,GACnB,MAAM,CAAC,eAAe,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,CAAC,eAAe;YACjB,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,cAAc,EAAE,QAAiB,EAAE;YAChF,CAAC,CAAC,EAAE,cAAc,EAAE,UAAmB,EAAE,CAAC;QAC5C,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE;QAChC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,QAAQ;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,OAAO;YAChB,CAAC,CAAC;gBACE,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAkC,EAAE;IAIzE,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,CAAC,KAAK,CACX,wDAAwD,CACzD,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO,CAAU,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/cli/credentials.d.ts

@@ -5,7 +5,7 @@ export interface CliCredentials {
     expires_at?: string;
     /**
      * API base URL (e.g. https://apidev.loxtep.io), same as in ~/.loxtep/credentials.json
-     * after `loxtep login` or `@loxtep/customer-mcp-server login`. Optional: config / env can supply api_url.
+     * after `loxtep login`. Optional: config / env can supply api_url.
      */
     api_base_url?: string;
     /**
@@ -14,10 +14,44 @@ export interface CliCredentials {
      */
     aws_credentials?: AwsCredentialsSnake;
 }
-/** Path to CLI credentials file: ~/.loxtep/credentials.json. */
+/** Path to global CLI credentials file: ~/.loxtep/credentials.json. */
 export declare function getCredentialsPath(): string;
-/** Read credentials from file. Returns null if missing or invalid. */
-export declare function readCredentials(filePath?: string): Promise<CliCredentials | null>;
+/** Path to project-local credentials file: `<projectDir>/.loxtep/credentials.json`. */
+export declare function getLocalCredentialsPath(projectDir: string): string;
+export type CredentialsScope = 'local' | 'global';
+export interface ResolvedCredentialsPath {
+    path: string;
+    scope: CredentialsScope;
+    /** Directory containing `.loxtep/project.json`, when one was found upward from `cwd`. */
+    projectDir?: string;
+}
+/**
+ * Resolve which credentials file to read from: a project-local
+ * `<projectDir>/.loxtep/credentials.json` (found by walking up from `cwd`, same
+ * search as `.loxtep/project.json`) takes precedence over the global
+ * `~/.loxtep/credentials.json`. Falls back to global when no local credentials
+ * file exists, even if a project directory was found — e.g. a project was
+ * scaffolded/attached but `loxtep login` was never run locally in it.
+ */
+export declare function resolveCredentialsPath(cwd?: string): ResolvedCredentialsPath;
+/**
+ * Resolve where `loxtep login` should write credentials: local to the current
+ * project (if one is found upward from `cwd`) unless `forceScope` says
+ * otherwise. Unlike {@link resolveCredentialsPath}, this doesn't require the
+ * local file to already exist — it's the write target, not the read fallback.
+ */
+export declare function resolveCredentialsWriteTarget(cwd?: string, forceScope?: CredentialsScope): ResolvedCredentialsPath;
+/**
+ * Idempotently add the local credentials file to `<projectDir>/.gitignore` so
+ * project-scoped tokens are never committed alongside `.loxtep/project.json`.
+ */
+export declare function ensureLocalCredentialsGitignored(projectDir: string): Promise<void>;
+/**
+ * Read credentials from file. Defaults to the local-first resolution
+ * ({@link resolveCredentialsPath}) when no explicit `filePath` is given.
+ * Returns null if missing or invalid.
+ */
+export declare function readCredentials(filePath?: string, cwd?: string): Promise<CliCredentials | null>;
 /** Write credentials to file. Creates directory if needed. Merges with an existing file so optional fields (api_base_url, etc.) are not dropped. */
 export declare function writeCredentials(creds: CliCredentials, filePath?: string): Promise<void>;
 /** Remove credentials file (logout). */

package/dist/cli/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/cli/credentials.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,eAAe,CAAC,EAAE,mBAAmB,CAAC;CACvC;AAID,gEAAgE;AAChE,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,sEAAsE;AACtE,wBAAsB,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA0BvF;AAED,oJAAoJ;AACpJ,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,cAAc,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB9F;AAED,wCAAwC;AACxC,wBAAsB,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGxE"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/cli/credentials.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,eAAe,CAAC,EAAE,mBAAmB,CAAC;CACvC;AAID,uEAAuE;AACvE,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,uFAAuF;AACvF,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,QAAQ,CAAC;AAElD,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,gBAAgB,CAAC;IACxB,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,MAAsB,GAAG,uBAAuB,CAS3F;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,GAAG,GAAE,MAAsB,EAC3B,UAAU,CAAC,EAAE,gBAAgB,GAC5B,uBAAuB,CAiBzB;AAED;;;GAGG;AACH,wBAAsB,gCAAgC,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUxF;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,QAAQ,CAAC,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA0BhC;AAED,oJAAoJ;AACpJ,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,cAAc,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB9F;AAED,wCAAwC;AACxC,wBAAsB,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGxE"}

package/dist/cli/credentials.js

@@ -2,14 +2,79 @@ import { readFile, writeFile, rm, mkdir } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { getConfigDir } from '../config/paths.js';
+import { findProjectDir, PROJECT_DIR_NAME } from './project-context.js';
 const CREDENTIALS_FILENAME = 'credentials.json';
-/** Path to CLI credentials file: ~/.loxtep/credentials.json. */
+/** Path to global CLI credentials file: ~/.loxtep/credentials.json. */
 export function getCredentialsPath() {
     return join(getConfigDir(), CREDENTIALS_FILENAME);
 }
-/** Read credentials from file. Returns null if missing or invalid. */
-export async function readCredentials(filePath) {
-    const path = filePath ?? getCredentialsPath();
+/** Path to project-local credentials file: `<projectDir>/.loxtep/credentials.json`. */
+export function getLocalCredentialsPath(projectDir) {
+    return join(projectDir, PROJECT_DIR_NAME, CREDENTIALS_FILENAME);
+}
+/**
+ * Resolve which credentials file to read from: a project-local
+ * `<projectDir>/.loxtep/credentials.json` (found by walking up from `cwd`, same
+ * search as `.loxtep/project.json`) takes precedence over the global
+ * `~/.loxtep/credentials.json`. Falls back to global when no local credentials
+ * file exists, even if a project directory was found — e.g. a project was
+ * scaffolded/attached but `loxtep login` was never run locally in it.
+ */
+export function resolveCredentialsPath(cwd = process.cwd()) {
+    const projectDir = findProjectDir(cwd);
+    if (projectDir) {
+        const localPath = getLocalCredentialsPath(projectDir);
+        if (existsSync(localPath)) {
+            return { path: localPath, scope: 'local', projectDir };
+        }
+    }
+    return { path: getCredentialsPath(), scope: 'global', projectDir: projectDir ?? undefined };
+}
+/**
+ * Resolve where `loxtep login` should write credentials: local to the current
+ * project (if one is found upward from `cwd`) unless `forceScope` says
+ * otherwise. Unlike {@link resolveCredentialsPath}, this doesn't require the
+ * local file to already exist — it's the write target, not the read fallback.
+ */
+export function resolveCredentialsWriteTarget(cwd = process.cwd(), forceScope) {
+    const projectDir = findProjectDir(cwd) ?? undefined;
+    if (forceScope === 'global') {
+        return { path: getCredentialsPath(), scope: 'global', projectDir };
+    }
+    if (forceScope === 'local') {
+        if (!projectDir) {
+            throw new Error('No .loxtep/project.json found in this directory or any parent — cannot scope credentials locally. Run `loxtep init` first, or use --global.');
+        }
+        return { path: getLocalCredentialsPath(projectDir), scope: 'local', projectDir };
+    }
+    if (projectDir) {
+        return { path: getLocalCredentialsPath(projectDir), scope: 'local', projectDir };
+    }
+    return { path: getCredentialsPath(), scope: 'global', projectDir };
+}
+/**
+ * Idempotently add the local credentials file to `<projectDir>/.gitignore` so
+ * project-scoped tokens are never committed alongside `.loxtep/project.json`.
+ */
+export async function ensureLocalCredentialsGitignored(projectDir) {
+    const entry = `${PROJECT_DIR_NAME}/${CREDENTIALS_FILENAME}`;
+    const gitignorePath = join(projectDir, '.gitignore');
+    let existing = '';
+    if (existsSync(gitignorePath)) {
+        existing = String(await readFile(gitignorePath, 'utf-8'));
+        if (existing.split('\n').some(line => line.trim() === entry))
+            return;
+    }
+    const sep = existing.length > 0 && !existing.endsWith('\n') ? '\n' : '';
+    await writeFile(gitignorePath, `${existing}${sep}${entry}\n`, 'utf-8');
+}
+/**
+ * Read credentials from file. Defaults to the local-first resolution
+ * ({@link resolveCredentialsPath}) when no explicit `filePath` is given.
+ * Returns null if missing or invalid.
+ */
+export async function readCredentials(filePath, cwd) {
+    const path = filePath ?? resolveCredentialsPath(cwd).path;
     if (!existsSync(path))
         return null;
     try {

package/dist/cli/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/cli/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAmBlD,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEhD,gEAAgE;AAChE,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,oBAAoB,CAAC,CAAC;AACpD,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAiB;IACrD,MAAM,IAAI,GAAG,QAAQ,IAAI,kBAAkB,EAAE,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QAC1D,IAAI,OAAO,MAAM,EAAE,YAAY,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC;QACnC,MAAM,KAAK,GACT,GAAG;YACH,OAAO,GAAG,KAAK,QAAQ;YACvB,OAAQ,GAA2B,CAAC,aAAa,KAAK,QAAQ;YAC9D,OAAQ,GAA2B,CAAC,iBAAiB,KAAK,QAAQ,CAAC;QACrE,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,aAAa,EAAE,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YAC1F,UAAU,EAAE,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACjF,YAAY,EACV,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE;gBAC1E,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBACxC,CAAC,CAAC,SAAS;YACf,eAAe,EAAE,KAAK,CAAC,CAAC,CAAE,GAA2B,CAAC,CAAC,CAAC,SAAS;SAClE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,oJAAoJ;AACpJ,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAqB,EAAE,QAAiB;IAC7E,MAAM,IAAI,GAAG,QAAQ,IAAI,kBAAkB,EAAE,CAAC;IAC9C,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAmB;QAC7B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,QAAQ,EAAE,aAAa;QAC7D,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,QAAQ,EAAE,UAAU;QACpD,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,QAAQ,EAAE,YAAY;QAC1D,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,QAAQ,EAAE,eAAe;KACpE,CAAC;IACF,MAAM,OAAO,GAA4B;QACvC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC;IACF,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IAC7C,CAAC;IACD,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC3B,OAAO,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;IACnD,CAAC;IACD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AACnE,CAAC;AAED,wCAAwC;AACxC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAiB;IACvD,MAAM,IAAI,GAAG,QAAQ,IAAI,kBAAkB,EAAE,CAAC;IAC9C,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/cli/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAmBxE,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEhD,uEAAuE;AACvE,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,oBAAoB,CAAC,CAAC;AACpD,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,uBAAuB,CAAC,UAAkB;IACxD,OAAO,IAAI,CAAC,UAAU,EAAE,gBAAgB,EAAE,oBAAoB,CAAC,CAAC;AAClE,CAAC;AAWD;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IAChE,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,IAAI,SAAS,EAAE,CAAC;AAC9F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,MAAc,OAAO,CAAC,GAAG,EAAE,EAC3B,UAA6B;IAE7B,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;IACpD,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,6IAA6I,CAC9I,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,uBAAuB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,uBAAuB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IACnF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,UAAkB;IACvE,MAAM,KAAK,GAAG,GAAG,gBAAgB,IAAI,oBAAoB,EAAE,CAAC;IAC5D,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACrD,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,QAAQ,GAAG,MAAM,CAAC,MAAM,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC;YAAE,OAAO;IACvE,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,SAAS,CAAC,aAAa,EAAE,GAAG,QAAQ,GAAG,GAAG,GAAG,KAAK,IAAI,EAAE,OAAO,CAAC,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAiB,EACjB,GAAY;IAEZ,MAAM,IAAI,GAAG,QAAQ,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC1D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QAC1D,IAAI,OAAO,MAAM,EAAE,YAAY,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC;QACnC,MAAM,KAAK,GACT,GAAG;YACH,OAAO,GAAG,KAAK,QAAQ;YACvB,OAAQ,GAA2B,CAAC,aAAa,KAAK,QAAQ;YAC9D,OAAQ,GAA2B,CAAC,iBAAiB,KAAK,QAAQ,CAAC;QACrE,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,aAAa,EAAE,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YAC1F,UAAU,EAAE,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACjF,YAAY,EACV,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE;gBAC1E,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBACxC,CAAC,CAAC,SAAS;YACf,eAAe,EAAE,KAAK,CAAC,CAAC,CAAE,GAA2B,CAAC,CAAC,CAAC,SAAS;SAClE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,oJAAoJ;AACpJ,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAqB,EAAE,QAAiB;IAC7E,MAAM,IAAI,GAAG,QAAQ,IAAI,kBAAkB,EAAE,CAAC;IAC9C,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAmB;QAC7B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,QAAQ,EAAE,aAAa;QAC7D,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,QAAQ,EAAE,UAAU;QACpD,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,QAAQ,EAAE,YAAY;QAC1D,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,QAAQ,EAAE,eAAe;KACpE,CAAC;IACF,MAAM,OAAO,GAA4B;QACvC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC;IACF,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IAC7C,CAAC;IACD,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC3B,OAAO,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;IACnD,CAAC;IACD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AACnE,CAAC;AAED,wCAAwC;AACxC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAiB;IACvD,MAAM,IAAI,GAAG,QAAQ,IAAI,kBAAkB,EAAE,CAAC;IAC9C,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC"}