@objectstack/cli 4.0.4 → 4.1.0

package/dist/utils/api-client.d.ts

@@ -4,13 +4,18 @@ import { ObjectStackClient } from '@objectstack/client';
  */
 export interface ApiClientOptions {
     /**
-     * Server URL (defaults to OBJECTSTACK_URL env var or http://localhost:3000)
+     * Server URL (defaults to OS_CLOUD_URL env var or http://localhost:3000)
      */
     url?: string;
     /**
-     * Authentication token (defaults to stored credentials or OBJECTSTACK_TOKEN env var)
+     * Authentication token (defaults to stored credentials or OS_TOKEN env var)
      */
     token?: string;
+    /**
+     * Explicit project id. Overrides the stored `activeProjectId` from
+     * `~/.objectstack/credentials.json` (written by `os projects switch`).
+     */
+    projectId?: string;
     /**
      * Enable debug logging
      */
@@ -23,14 +28,15 @@ export interface ApiClientOptions {
 export interface ApiClientResult {
     client: ObjectStackClient;
     token?: string;
+    projectId?: string;
 }
 /**
  * Create an authenticated ObjectStack API client for CLI commands.
  *
  * Resolves configuration in this priority order:
  * 1. Explicit options passed to the function
- * 2. Environment variables (OBJECTSTACK_URL, OBJECTSTACK_TOKEN)
- * 3. Stored credentials from `os auth login`
+ * 2. Environment variables (OS_CLOUD_URL, OS_TOKEN)
+ * 3. Stored credentials from `os login`
  * 4. Defaults (http://localhost:3000)
  */
 export declare function createApiClient(options?: ApiClientOptions): Promise<ApiClientResult>;

package/dist/utils/api-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../../src/utils/api-client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAGxD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC,CAkC9F;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAMhD"}
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../../src/utils/api-client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAGxD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC,CAyC9F;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAMhD"}

package/dist/utils/api-client.js

@@ -6,17 +6,19 @@ import { readAuthConfig } from './auth-config.js';
  *
  * Resolves configuration in this priority order:
  * 1. Explicit options passed to the function
- * 2. Environment variables (OBJECTSTACK_URL, OBJECTSTACK_TOKEN)
- * 3. Stored credentials from `os auth login`
+ * 2. Environment variables (OS_CLOUD_URL, OS_TOKEN)
+ * 3. Stored credentials from `os login`
  * 4. Defaults (http://localhost:3000)
  */
 export async function createApiClient(options = {}) {
     // Resolve server URL (without applying defaults yet)
-    let baseUrl = options.url || process.env.OBJECTSTACK_URL;
+    let baseUrl = options.url || process.env.OS_CLOUD_URL;
     // Resolve authentication token
-    let token = options.token || process.env.OBJECTSTACK_TOKEN;
+    let token = options.token || process.env.OS_TOKEN;
+    // Resolve active project id (explicit > env > stored credentials)
+    let projectId = options.projectId || process.env.OS_PROJECT_ID;
     // If URL or token is missing, try to load from stored credentials
-    if (!baseUrl || !token) {
+    if (!baseUrl || !token || !projectId) {
         try {
             const authConfig = await readAuthConfig();
             if (!token && authConfig.token) {
@@ -25,6 +27,9 @@ export async function createApiClient(options = {}) {
             if (!baseUrl && authConfig.url) {
                 baseUrl = authConfig.url;
             }
+            if (!projectId && authConfig.activeProjectId) {
+                projectId = authConfig.activeProjectId;
+            }
         }
         catch {
             // No stored credentials - commands will fail if auth is required
@@ -37,9 +42,10 @@ export async function createApiClient(options = {}) {
     const client = new ObjectStackClient({
         baseUrl,
         token,
+        projectId,
         debug: options.debug || false,
     });
-    return { client, token };
+    return { client, token, projectId };
 }
 /**
  * Ensure authentication is present, throwing an error if not.
@@ -47,7 +53,7 @@ export async function createApiClient(options = {}) {
  */
 export function requireAuth(token) {
     if (!token) {
-        throw new Error('Authentication required. Please run `os auth login` or set OBJECTSTACK_TOKEN environment variable.');
+        throw new Error('Authentication required. Please run `os login` or set OS_TOKEN environment variable.');
     }
 }
 //# sourceMappingURL=api-client.js.map

package/dist/utils/api-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../../src/utils/api-client.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAEzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AA6BlD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,UAA4B,EAAE;IAClE,qDAAqD;IACrD,IAAI,OAAO,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAEzD,+BAA+B;IAC/B,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAE3D,kEAAkE;IAClE,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAC;YAC1C,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;gBAC/B,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;YAC3B,CAAC;YACD,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,GAAG,EAAE,CAAC;gBAC/B,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC;YAC3B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,uBAAuB,CAAC;IACpC,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC;QACnC,OAAO;QACP,KAAK;QACL,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK;KAC9B,CAAC,CAAC;IAEH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,oGAAoG,CACrG,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../../src/utils/api-client.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAEzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAmClD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,UAA4B,EAAE;IAClE,qDAAqD;IACrD,IAAI,OAAO,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAEtD,+BAA+B;IAC/B,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;IAElD,kEAAkE;IAClE,IAAI,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAE/D,kEAAkE;IAClE,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAC;YAC1C,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;gBAC/B,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;YAC3B,CAAC;YACD,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,GAAG,EAAE,CAAC;gBAC/B,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC;YAC3B,CAAC;YACD,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,eAAe,EAAE,CAAC;gBAC7C,SAAS,GAAG,UAAU,CAAC,eAAe,CAAC;YACzC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,uBAAuB,CAAC;IACpC,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC;QACnC,OAAO;QACP,KAAK;QACL,SAAS;QACT,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK;KAC9B,CAAC,CAAC;IAEH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/utils/auth-config.d.ts

@@ -26,6 +26,12 @@ export interface AuthConfig {
      * Timestamp when credentials were last used
      */
     lastUsedAt?: string;
+    /**
+     * Active project id for subsequent CLI calls. Set via `os projects switch`;
+     * read by `createApiClient` so every command lands in the right project
+     * without an explicit flag.
+     */
+    activeProjectId?: string;
 }
 /**
  * Get the path to the credentials file

package/dist/utils/auth-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-config.d.ts","sourceRoot":"","sources":["../../src/utils/auth-config.ts"],"names":[],"mappings":"AAMA;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;GAEG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,UAAU,CAAC,CAW1D;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBvE;AAED;;GAEG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAUtD;AAED;;GAEG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAQrD"}
+{"version":3,"file":"auth-config.d.ts","sourceRoot":"","sources":["../../src/utils/auth-config.ts"],"names":[],"mappings":"AAMA;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;GAEG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,UAAU,CAAC,CAW1D;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBvE;AAED;;GAEG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAUtD;AAED;;GAEG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAQrD"}

package/dist/utils/auth-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-config.js","sourceRoot":"","sources":["../../src/utils/auth-config.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAEzE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAgCrE;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;AAC7D,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAe,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAkB;IACtD,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;IAE5C,0BAA0B;IAC1B,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEtC,yBAAyB;IACzB,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAExE,qFAAqF;IACrF,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACpD,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;QACtC,MAAM,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;AACH,CAAC"}
+{"version":3,"file":"auth-config.js","sourceRoot":"","sources":["../../src/utils/auth-config.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAEzE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAsCrE;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;AAC7D,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAe,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAkB;IACtD,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;IAE5C,0BAA0B;IAC1B,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEtC,yBAAyB;IACzB,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAExE,qFAAqF;IACrF,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACpD,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;QACtC,MAAM,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;AACH,CAAC"}

package/dist/utils/auth-flows.d.ts

@@ -0,0 +1,31 @@
+export interface AuthFlowUser {
+    id?: string;
+    email?: string;
+}
+export interface AuthFlowResult {
+    token: string;
+    user?: AuthFlowUser;
+}
+/**
+ * Email + password authentication (CI / non-interactive path).
+ */
+export declare function loginWithPassword(url: string, email: string, password: string): Promise<AuthFlowResult>;
+export interface BrowserFlowOptions {
+    /** OAuth client id; defaults to `OS_CLI_CLIENT_ID` env or `objectstack-cli`. */
+    clientId?: string;
+    /** If true, only print the verification URL — do not launch a browser. */
+    noBrowser?: boolean;
+    /** Suppress all human-readable stdout (callers using --json). */
+    silent?: boolean;
+    /** Override the spinner / verification-URL printer for custom UI. */
+    onDeviceCode?: (info: {
+        verificationUrl: string;
+        userCode: string;
+        expiresIn: number;
+    }) => void;
+}
+/**
+ * RFC 8628 OAuth 2.0 Device Authorization Grant.
+ */
+export declare function loginWithBrowser(url: string, opts?: BrowserFlowOptions): Promise<AuthFlowResult>;
+//# sourceMappingURL=auth-flows.d.ts.map

package/dist/utils/auth-flows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-flows.d.ts","sourceRoot":"","sources":["../../src/utils/auth-flows.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,YAAY;IAC3B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,YAAY,CAAC;CACrB;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,cAAc,CAAC,CAezB;AAmBD,MAAM,WAAW,kBAAkB;IACjC,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,iEAAiE;IACjE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,qEAAqE;IACrE,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE;QACpB,eAAe,EAAE,MAAM,CAAC;QACxB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;KACnB,KAAK,IAAI,CAAC;CACZ;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,cAAc,CAAC,CAiHzB"}

package/dist/utils/auth-flows.js

@@ -0,0 +1,151 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+/**
+ * Shared authentication flows for CLI login commands.
+ *
+ * Two commands consume this module:
+ *   - `os login`         — log in to a runtime ObjectOS instance.
+ *   - `os cloud login`   — log in to the hosted ObjectStack Cloud control plane.
+ *
+ * The flows themselves are identical (both target ObjectStack servers
+ * speaking the same plugin-auth endpoints); only the credential storage
+ * destination differs, which is the caller's responsibility.
+ *
+ * These helpers are intentionally side-effect-free with respect to disk
+ * I/O so callers can persist the resulting token wherever they need to.
+ * They DO write to stdout for the interactive device-flow UX; pass
+ * `silent: true` to suppress all human-readable output (used by `--json`).
+ */
+import { ObjectStackClient } from '@objectstack/client';
+/**
+ * Email + password authentication (CI / non-interactive path).
+ */
+export async function loginWithPassword(url, email, password) {
+    const client = new ObjectStackClient({ baseUrl: url });
+    const response = await client.auth.login({ type: 'email', email, password });
+    if (!response.data?.token && !response.data?.user) {
+        throw new Error('Login failed: Invalid response from server');
+    }
+    const token = response.data?.token || response.token;
+    if (!token)
+        throw new Error('Login failed: No token received from server');
+    return {
+        token,
+        user: response.data?.user ? { id: response.data.user.id, email: response.data.user.email } : { email },
+    };
+}
+/**
+ * Open a URL in the system default browser (best-effort, cross-platform).
+ */
+async function openBrowser(url) {
+    const { exec } = await import('node:child_process');
+    const platform = process.platform;
+    const cmd = platform === 'darwin'
+        ? `open "${url}"`
+        : platform === 'win32'
+            ? `start "" "${url}"`
+            : `xdg-open "${url}"`;
+    exec(cmd, () => {
+        /* best-effort */
+    });
+}
+/**
+ * RFC 8628 OAuth 2.0 Device Authorization Grant.
+ */
+export async function loginWithBrowser(url, opts = {}) {
+    const clientId = opts.clientId ?? process.env.OS_CLI_CLIENT_ID ?? 'objectstack-cli';
+    const silent = !!opts.silent;
+    // RFC 8628 §3.1 — Device Authorization Request
+    const res = await globalThis.fetch(`${url}/api/v1/auth/device/code`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ client_id: clientId, scope: 'openid profile email' }),
+    });
+    if (!res.ok) {
+        const err = await res.json().catch(() => ({}));
+        throw new Error(`Device request failed (${res.status}): ${err?.error_description || err?.message || res.statusText}`);
+    }
+    const deviceData = (await res.json());
+    const { device_code, user_code, verification_uri, verification_uri_complete, expires_in, interval = 5 } = deviceData ?? {};
+    if (!device_code || !user_code || !verification_uri) {
+        throw new Error('Server did not return RFC 8628 device authorization fields. Use `--email <email> --password <password>` instead.');
+    }
+    const verificationUrl = verification_uri_complete || `${verification_uri}?user_code=${encodeURIComponent(user_code)}`;
+    if (opts.onDeviceCode) {
+        opts.onDeviceCode({ verificationUrl, userCode: user_code, expiresIn: expires_in ?? 600 });
+    }
+    else if (!silent) {
+        console.log('  To authorize this CLI, visit:');
+        console.log('');
+        console.log(`  ${verificationUrl}`);
+        console.log('');
+        console.log(`  User code: ${user_code}`);
+        console.log('');
+    }
+    if (!opts.noBrowser && !silent) {
+        await openBrowser(verificationUrl);
+        console.log('  (Browser opened automatically. Press Ctrl+C to cancel.)');
+        console.log('');
+    }
+    // RFC 8628 §3.4 — Device Access Token Request (poll)
+    let pollMs = (interval || 5) * 1000;
+    const expiryTime = Date.now() + (expires_in || 600) * 1000;
+    let spinner = 0;
+    const spinChars = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
+    while (Date.now() < expiryTime) {
+        await new Promise((r) => setTimeout(r, pollMs));
+        const pollRes = await globalThis.fetch(`${url}/api/v1/auth/device/token`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                device_code,
+                client_id: clientId,
+            }),
+        });
+        const pollJson = (await pollRes.json());
+        if (pollRes.ok && pollJson?.access_token) {
+            const accessToken = pollJson.access_token;
+            // Resolve user info via /get-session (device-token response omits user details per RFC 8628)
+            let user;
+            try {
+                const sessionRes = await globalThis.fetch(`${url}/api/v1/auth/get-session`, {
+                    headers: { Authorization: `Bearer ${accessToken}` },
+                });
+                if (sessionRes.ok) {
+                    const sessionData = (await sessionRes.json());
+                    const u = sessionData?.user ?? sessionData?.data?.user;
+                    if (u)
+                        user = { id: u.id, email: u.email };
+                }
+            }
+            catch {
+                // best-effort
+            }
+            if (!silent)
+                process.stdout.write('\r\x1b[K');
+            return { token: accessToken, user };
+        }
+        // Standard RFC 8628 error codes
+        const errCode = pollJson?.error;
+        if (errCode === 'authorization_pending') {
+            // keep polling
+        }
+        else if (errCode === 'slow_down') {
+            pollMs += 5000;
+        }
+        else if (errCode === 'expired_token' || errCode === 'access_denied' || errCode === 'invalid_grant') {
+            throw new Error(errCode === 'access_denied'
+                ? 'Login denied by user.'
+                : 'Login timed out or device code is no longer valid. Please retry.');
+        }
+        else if (!pollRes.ok) {
+            throw new Error(`Polling failed (${pollRes.status}): ${pollJson?.error_description || pollJson?.message || pollRes.statusText}`);
+        }
+        if (!silent) {
+            process.stdout.write(`\r  ${spinChars[spinner % spinChars.length]} Waiting for browser approval...`);
+            spinner++;
+        }
+    }
+    throw new Error('Login timed out.');
+}
+//# sourceMappingURL=auth-flows.js.map

package/dist/utils/auth-flows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-flows.js","sourceRoot":"","sources":["../../src/utils/auth-flows.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAEzE;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAYxD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,KAAa,EACb,QAAgB;IAEhB,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAE7E,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAK,QAAgB,CAAC,KAAK,CAAC;IAC9D,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAE3E,OAAO;QACL,KAAK;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE;KACvG,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,WAAW,CAAC,GAAW;IACpC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,GAAG,GACP,QAAQ,KAAK,QAAQ;QACnB,CAAC,CAAC,SAAS,GAAG,GAAG;QACjB,CAAC,CAAC,QAAQ,KAAK,OAAO;YACtB,CAAC,CAAC,aAAa,GAAG,GAAG;YACrB,CAAC,CAAC,aAAa,GAAG,GAAG,CAAC;IAC1B,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;QACb,iBAAiB;IACnB,CAAC,CAAC,CAAC;AACL,CAAC;AAiBD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,OAA2B,EAAE;IAE7B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,iBAAiB,CAAC;IACpF,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAE7B,+CAA+C;IAC/C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,GAAG,GAAG,0BAA0B,EAAE;QACnE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;KAC7E,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,0BAA0B,GAAG,CAAC,MAAM,MAAO,GAAW,EAAE,iBAAiB,IAAK,GAAW,EAAE,OAAO,IAAI,GAAG,CAAC,UAAU,EAAE,CACvH,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAQ,CAAC;IAC7C,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,UAAU,EAAE,QAAQ,GAAG,CAAC,EAAE,GACrG,UAAU,IAAI,EAAE,CAAC;IAEnB,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,kHAAkH,CACnH,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GACnB,yBAAyB,IAAI,GAAG,gBAAgB,cAAc,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;IAEhG,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,IAAI,CAAC,YAAY,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,IAAI,GAAG,EAAE,CAAC,CAAC;IAC5F,CAAC;SAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,eAAe,EAAE,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,gBAAgB,SAAS,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,WAAW,CAAC,eAAe,CAAC,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IAED,qDAAqD;IACrD,IAAI,MAAM,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC;IAC3D,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAErE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAEhD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,GAAG,GAAG,2BAA2B,EAAE;YACxE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,8CAA8C;gBAC1D,WAAW;gBACX,SAAS,EAAE,QAAQ;aACpB,CAAC;SACH,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAQ,CAAC;QAE/C,IAAI,OAAO,CAAC,EAAE,IAAI,QAAQ,EAAE,YAAY,EAAE,CAAC;YACzC,MAAM,WAAW,GAAG,QAAQ,CAAC,YAAsB,CAAC;YAEpD,6FAA6F;YAC7F,IAAI,IAA8B,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,GAAG,GAAG,0BAA0B,EAAE;oBAC1E,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;iBACpD,CAAC,CAAC;gBACH,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;oBAClB,MAAM,WAAW,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAAQ,CAAC;oBACrD,MAAM,CAAC,GAAG,WAAW,EAAE,IAAI,IAAI,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC;oBACvD,IAAI,CAAC;wBAAE,IAAI,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;gBAC7C,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;YAED,IAAI,CAAC,MAAM;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC9C,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QACtC,CAAC;QAED,gCAAgC;QAChC,MAAM,OAAO,GAAG,QAAQ,EAAE,KAAK,CAAC;QAChC,IAAI,OAAO,KAAK,uBAAuB,EAAE,CAAC;YACxC,eAAe;QACjB,CAAC;aAAM,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;YACnC,MAAM,IAAI,IAAI,CAAC;QACjB,CAAC;aAAM,IAAI,OAAO,KAAK,eAAe,IAAI,OAAO,KAAK,eAAe,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;YACrG,MAAM,IAAI,KAAK,CACb,OAAO,KAAK,eAAe;gBACzB,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,kEAAkE,CACvE,CAAC;QACJ,CAAC;aAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,mBAAmB,OAAO,CAAC,MAAM,MAAM,QAAQ,EAAE,iBAAiB,IAAI,QAAQ,EAAE,OAAO,IAAI,OAAO,CAAC,UAAU,EAAE,CAChH,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC;YACrG,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;AACtC,CAAC"}

package/dist/utils/build-runtime.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Build a single ESM bundle that re-exports every inline handler function
+ * collected by `lowerCallables`. The bundle is the second half of the
+ * "two-product" build (alongside `objectstack.json`):
+ *
+ *   dist/
+ *   ├── objectstack.json
+ *   └── objectstack-runtime.{contenthash}.mjs   ← THIS
+ *
+ * At runtime, `StandaloneStack` (and `MultiProjectPlugin`) dynamic-import
+ * the mjs and merge `module.functions` into the bundle before
+ * `bindHooks(...)` runs — so string-named handlers resolve to real code
+ * even though the JSON artifact is pure metadata.
+ */
+export interface BuildRuntimeOptions {
+    /** Absolute path to the user's `objectstack.config.{ts,js,mjs}`. */
+    sourceConfigPath: string;
+    /** Lowered handler refs (`name → handlerName`) — mirrors `LoweringResult.functions`. */
+    refs: string[];
+    /** Output directory (e.g. `<cwd>/dist`). Created if missing. */
+    outputDir: string;
+    /** Base file name without hash, e.g. `objectstack-runtime`. */
+    baseName?: string;
+    /** External package names to mark as external (`@objectstack/*` etc.). */
+    externalPackages?: string[];
+}
+export interface BuildRuntimeResult {
+    /** Absolute path to the emitted mjs. */
+    outputPath: string;
+    /** File name (relative to outputDir) — embedded in objectstack.json. */
+    outputFileName: string;
+    /** Content hash (sha256, first 16 hex chars). */
+    hash: string;
+    /** Bundle size in bytes. */
+    size: number;
+}
+export declare function buildRuntimeBundle(opts: BuildRuntimeOptions): Promise<BuildRuntimeResult>;
+/** Best-effort cleanup of stale `objectstack-runtime.*.mjs` files. */
+export declare function cleanupOldRuntimeBundles(outputDir: string, keepFileName: string, baseName?: string): number;
+/** Reuse: read an existing bundle and recompute its size for stats. */
+export declare function statBundle(outputPath: string): {
+    size: number;
+} | null;
+export declare const runtimeBundlePathRelative: (outputDir: string, file: string) => string;
+//# sourceMappingURL=build-runtime.d.ts.map

package/dist/utils/build-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-runtime.d.ts","sourceRoot":"","sources":["../../src/utils/build-runtime.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,mBAAmB;IAClC,oEAAoE;IACpE,gBAAgB,EAAE,MAAM,CAAC;IACzB,wFAAwF;IACxF,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,cAAc,EAAE,MAAM,CAAC;IACvB,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd;AA6DD,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA4D/F;AAED,sEAAsE;AACtE,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,SAAe,GAAG,MAAM,CAejH;AAED,uEAAuE;AACvE,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAOtE;AAED,eAAO,MAAM,yBAAyB,GAAI,WAAW,MAAM,EAAE,MAAM,MAAM,KAAG,MACf,CAAC"}

package/dist/utils/build-runtime.js

@@ -0,0 +1,154 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+import { createHash } from 'node:crypto';
+import { mkdirSync, writeFileSync, readFileSync, existsSync, unlinkSync, readdirSync } from 'node:fs';
+import { dirname, basename, resolve as resolvePath, relative, sep as PATH_SEP } from 'node:path';
+const DEFAULT_BASE = 'objectstack-runtime';
+/**
+ * Generate the entry source that re-extracts callable handlers from the
+ * compiled config. We bundle the user's config transitively (so every
+ * `*.hook.ts` import is captured), then walk the same shape the lowering
+ * pass walked and re-export the matching handlers under the same string
+ * keys. The runtime side merges this map into `bundle.functions`.
+ */
+function generateEntrySource(sourceConfigPath, refs, entryDir) {
+    // Use a POSIX-style relative path so esbuild's resolver bundles the
+    // user's config + every transitively-imported `*.hook.ts` into the
+    // emitted ESM. A `file://` URL would be treated as external.
+    let importPath = relative(entryDir, sourceConfigPath).split(PATH_SEP).join('/');
+    if (!importPath.startsWith('.'))
+        importPath = './' + importPath;
+    const refLiteral = JSON.stringify(refs);
+    return `// AUTO-GENERATED by @objectstack/cli — do not edit.
+import config from ${JSON.stringify(importPath)};
+
+const REFS = new Set(${refLiteral});
+
+function collect(cfg) {
+  const out = Object.create(null);
+  if (!cfg || typeof cfg !== 'object') return out;
+  // Hooks: { name, handler }
+  if (Array.isArray(cfg.hooks)) {
+    for (const h of cfg.hooks) {
+      if (h && typeof h === 'object' && typeof h.handler === 'function' && typeof h.name === 'string') {
+        if (REFS.has(h.name)) out[h.name] = h.handler;
+      }
+    }
+  }
+  // Top-level functions map
+  if (cfg.functions && !Array.isArray(cfg.functions) && typeof cfg.functions === 'object') {
+    for (const [k, v] of Object.entries(cfg.functions)) {
+      if (typeof v === 'function' && REFS.has(k)) out[k] = v;
+    }
+  }
+  // Top-level functions array
+  if (Array.isArray(cfg.functions)) {
+    for (const entry of cfg.functions) {
+      if (entry && typeof entry === 'object' && typeof entry.handler === 'function' && typeof entry.name === 'string') {
+        if (REFS.has(entry.name)) out[entry.name] = entry.handler;
+      }
+    }
+  }
+  return out;
+}
+
+const cfg = config && typeof config === 'object' && 'default' in config ? config.default : config;
+export const functions = collect(cfg);
+export const meta = {
+  builtAt: new Date().toISOString(),
+  refCount: ${refs.length},
+};
+`;
+}
+export async function buildRuntimeBundle(opts) {
+    const { sourceConfigPath, refs, outputDir } = opts;
+    const baseName = opts.baseName ?? DEFAULT_BASE;
+    if (!existsSync(outputDir))
+        mkdirSync(outputDir, { recursive: true });
+    const entryDir = dirname(sourceConfigPath);
+    const entryPath = resolvePath(entryDir, `.${baseName}.entry.${process.pid}.${Date.now()}.mjs`);
+    writeFileSync(entryPath, generateEntrySource(sourceConfigPath, refs, entryDir));
+    let esbuild;
+    try {
+        esbuild = await import('esbuild');
+    }
+    catch (err) {
+        try {
+            unlinkSync(entryPath);
+        }
+        catch { /* noop */ }
+        throw new Error(`[build-runtime] esbuild is required to bundle declarative handlers but is not installed: ${err.message}`);
+    }
+    // Bundle to an in-memory buffer first so we can hash, then rename.
+    let result;
+    try {
+        result = await esbuild.build({
+            entryPoints: [entryPath],
+            bundle: true,
+            format: 'esm',
+            platform: 'node',
+            target: 'node18',
+            write: false,
+            sourcemap: 'inline',
+            packages: 'external',
+            logLevel: 'silent',
+            legalComments: 'none',
+            resolveExtensions: ['.ts', '.tsx', '.mjs', '.js', '.cjs', '.json'],
+            loader: { '.ts': 'ts', '.tsx': 'tsx' },
+            banner: { js: '// @generated by @objectstack/cli — do not edit.' },
+        });
+    }
+    finally {
+        try {
+            unlinkSync(entryPath);
+        }
+        catch { /* noop */ }
+    }
+    const out = result.outputFiles?.[0];
+    if (!out)
+        throw new Error('[build-runtime] esbuild produced no output');
+    const code = out.text;
+    const hash = createHash('sha256').update(code).digest('hex').slice(0, 16);
+    const fileName = `${baseName}.${hash}.mjs`;
+    const outputPath = resolvePath(outputDir, fileName);
+    writeFileSync(outputPath, code);
+    return {
+        outputPath,
+        outputFileName: fileName,
+        hash,
+        size: Buffer.byteLength(code, 'utf8'),
+    };
+}
+/** Best-effort cleanup of stale `objectstack-runtime.*.mjs` files. */
+export function cleanupOldRuntimeBundles(outputDir, keepFileName, baseName = DEFAULT_BASE) {
+    if (!existsSync(outputDir))
+        return 0;
+    let removed = 0;
+    try {
+        const re = new RegExp(`^${baseName}\\.[a-f0-9]+\\.mjs(\\.map)?$`);
+        for (const f of readdirSync(outputDir)) {
+            if (!re.test(f))
+                continue;
+            if (f === keepFileName)
+                continue;
+            try {
+                unlinkSync(resolvePath(outputDir, f));
+                removed += 1;
+            }
+            catch { /* noop */ }
+        }
+    }
+    catch { /* noop */ }
+    return removed;
+}
+/** Reuse: read an existing bundle and recompute its size for stats. */
+export function statBundle(outputPath) {
+    try {
+        const buf = readFileSync(outputPath);
+        return { size: buf.byteLength };
+    }
+    catch {
+        return null;
+    }
+}
+export const runtimeBundlePathRelative = (outputDir, file) => relative(outputDir, resolvePath(outputDir, basename(file)));
+//# sourceMappingURL=build-runtime.js.map

package/dist/utils/build-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-runtime.js","sourceRoot":"","sources":["../../src/utils/build-runtime.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAEzE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtG,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,WAAW,EAAE,QAAQ,EAAE,GAAG,IAAI,QAAQ,EAAE,MAAM,WAAW,CAAC;AAyCjG,MAAM,YAAY,GAAG,qBAAqB,CAAC;AAE3C;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,gBAAwB,EAAE,IAAc,EAAE,QAAgB;IACrF,oEAAoE;IACpE,mEAAmE;IACnE,6DAA6D;IAC7D,IAAI,UAAU,GAAG,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChF,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,UAAU,GAAG,IAAI,GAAG,UAAU,CAAC;IAChE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAExC,OAAO;qBACY,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;;uBAExB,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAkCnB,IAAI,CAAC,MAAM;;CAExB,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAyB;IAChE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC;IAE/C,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEtE,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,WAAW,CAC3B,QAAQ,EACR,IAAI,QAAQ,UAAU,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CACtD,CAAC;IACF,aAAa,CAAC,SAAS,EAAE,mBAAmB,CAAC,gBAAgB,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAEhF,IAAI,OAAiC,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,4FAA6F,GAAa,CAAC,OAAO,EAAE,CACrH,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC;YAC3B,WAAW,EAAE,CAAC,SAAS,CAAC;YACxB,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,QAAQ;YAClB,aAAa,EAAE,MAAM;YACrB,iBAAiB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC;YAClE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;YACtC,MAAM,EAAE,EAAE,EAAE,EAAE,kDAAkD,EAAE;SACnE,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAExE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,GAAG,QAAQ,IAAI,IAAI,MAAM,CAAC;IAC3C,MAAM,UAAU,GAAG,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACpD,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAEhC,OAAO;QACL,UAAU;QACV,cAAc,EAAE,QAAQ;QACxB,IAAI;QACJ,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,wBAAwB,CAAC,SAAiB,EAAE,YAAoB,EAAE,QAAQ,GAAG,YAAY;IACvG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,CAAC,CAAC;IACrC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,QAAQ,8BAA8B,CAAC,CAAC;QAClE,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC1B,IAAI,CAAC,KAAK,YAAY;gBAAE,SAAS;YACjC,IAAI,CAAC;gBACH,UAAU,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;gBACtC,OAAO,IAAI,CAAC,CAAC;YACf,CAAC;YAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;IACtB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,UAAU,CAAC,UAAkB;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,SAAiB,EAAE,IAAY,EAAU,EAAE,CACnF,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC"}

package/dist/utils/cloud-config.d.ts

@@ -0,0 +1,24 @@
+/** Canonical hosted control plane. */
+export declare const DEFAULT_CLOUD_URL = "https://cloud.objectos.app";
+export interface CloudConfig {
+    /** Base URL of the cloud control plane (defaults to `https://cloud.objectos.app`). */
+    url: string;
+    /** Bearer token returned by the device or password flow. */
+    token: string;
+    /** Authenticated user's email, for display. */
+    email?: string;
+    /** Authenticated user's id. */
+    userId?: string;
+    /** Active organization id chosen for publishing. */
+    activeOrgId?: string;
+    /** ISO timestamp when the credential was created. */
+    createdAt: string;
+    /** ISO timestamp of last use (best-effort). */
+    lastUsedAt?: string;
+}
+export declare function getCloudCredentialsPath(): string;
+export declare function readCloudConfig(): Promise<CloudConfig>;
+export declare function tryReadCloudConfig(): Promise<CloudConfig | undefined>;
+export declare function writeCloudConfig(config: CloudConfig): Promise<void>;
+export declare function deleteCloudConfig(): Promise<void>;
+//# sourceMappingURL=cloud-config.d.ts.map

package/dist/utils/cloud-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-config.d.ts","sourceRoot":"","sources":["../../src/utils/cloud-config.ts"],"names":[],"mappings":"AA4BA,sCAAsC;AACtC,eAAO,MAAM,iBAAiB,+BAA+B,CAAC;AAE9D,MAAM,WAAW,WAAW;IAC1B,sFAAsF;IACtF,GAAG,EAAE,MAAM,CAAC;IACZ,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,uBAAuB,IAAI,MAAM,CAEhD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,WAAW,CAAC,CAW5D;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAM3E;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAWzE;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CASvD"}