@orizm/cli 2.2.7 → 3.0.1

package/dist/logout-DC5TMJ5_.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout-DC5TMJ5_.cjs","names":["defineCommand","globalArgs","resolveEnv","Result","FileTokenStore","revokeToken"],"sources":["../src/cli/commands/auth/logout.ts"],"sourcesContent":["import { Result } from \"@praha/byethrow\";\nimport { defineCommand } from \"../define-command.js\";\nimport { globalArgs } from \"../shared.js\";\nimport { resolveEnv } from \"../../env.js\";\nimport { FileTokenStore } from \"../../auth/token-store.js\";\nimport { revokeToken } from \"../../auth/oauth-client.js\";\n\nexport default defineCommand({\n  meta: {\n    name: \"logout\",\n    description: \"Sign out of Orizm\",\n  },\n  args: { ...globalArgs },\n  run: async () => {\n    const env = resolveEnv();\n    if (Result.isFailure(env)) {\n      return Result.fail({\n        message: \"Invalid Orizm environment configuration.\",\n      });\n    }\n    const { issuerUrl } = env.value;\n\n    const store = new FileTokenStore();\n    const entry = await store.get(issuerUrl);\n    if (entry === undefined) {\n      return Result.succeed({\n        json: { loggedOut: false },\n        text: () => \"You are not logged in.\",\n      });\n    }\n\n    // Hydra 側 revoke は best-effort。失敗してもローカル破棄でログアウトは成立させる。\n    await revokeToken(issuerUrl, entry.refreshToken).catch(() => undefined);\n    await store.remove(issuerUrl);\n\n    return Result.succeed({\n      json: { loggedOut: true },\n      text: () => \"Logged out.\",\n    });\n  },\n});\n"],"mappings":";;;;;;;AAOA,qBAAeA,+BAAc;CAC3B,MAAM;EACJ,MAAM;EACN,aAAa;CACf;CACA,MAAM,EAAE,GAAGC,0BAAW;CACtB,KAAK,YAAY;EACf,MAAM,MAAMC,+BAAW;EACvB,IAAIC,uBAAO,UAAU,GAAG,GACtB,OAAOA,uBAAO,KAAK,EACjB,SAAS,2CACX,CAAC;EAEH,MAAM,EAAE,cAAc,IAAI;EAE1B,MAAM,QAAQ,IAAIC,mCAAe;EACjC,MAAM,QAAQ,MAAM,MAAM,IAAI,SAAS;EACvC,IAAI,UAAU,QACZ,OAAOD,uBAAO,QAAQ;GACpB,MAAM,EAAE,WAAW,MAAM;GACzB,YAAY;EACd,CAAC;EAIH,MAAME,iCAAY,WAAW,MAAM,YAAY,CAAC,CAAC,YAAY,MAAS;EACtE,MAAM,MAAM,OAAO,SAAS;EAE5B,OAAOF,uBAAO,QAAQ;GACpB,MAAM,EAAE,WAAW,KAAK;GACxB,YAAY;EACd,CAAC;CACH;AACF,CAAC"}

package/dist/management-BGYcZB4c.cjs

@@ -0,0 +1,19 @@
+const require_cli_main = require('./cli/main.cjs');
+
+//#region src/cli/commands/key/management/index.ts
+var management_default = require_cli_main.defineCommand({
+	meta: {
+		name: "management",
+		description: "Manage management keys (content CRUD with RBAC)"
+	},
+	subCommands: {
+		list: () => Promise.resolve().then(() => require("./list-CFwW0G9f.cjs")).then((m) => m.default),
+		create: () => Promise.resolve().then(() => require("./create-CmOriwGo.cjs")).then((m) => m.default),
+		update: () => Promise.resolve().then(() => require("./update-DRnN1kiu.cjs")).then((m) => m.default),
+		delete: () => Promise.resolve().then(() => require("./delete-WpMIIvjj.cjs")).then((m) => m.default)
+	}
+});
+
+//#endregion
+exports.default = management_default;
+//# sourceMappingURL=management-BGYcZB4c.cjs.map

package/dist/management-BGYcZB4c.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"management-BGYcZB4c.cjs","names":["defineCommand"],"sources":["../src/cli/commands/key/management/index.ts"],"sourcesContent":["import { defineCommand } from \"../../define-command.js\";\n\nexport default defineCommand({\n  meta: {\n    name: \"management\",\n    description: \"Manage management keys (content CRUD with RBAC)\",\n  },\n  subCommands: {\n    list: () => import(\"./list.js\").then((m) => m.default),\n    create: () => import(\"./create.js\").then((m) => m.default),\n    update: () => import(\"./update.js\").then((m) => m.default),\n    delete: () => import(\"./delete.js\").then((m) => m.default),\n  },\n});\n"],"mappings":";;;AAEA,yBAAeA,+BAAc;CAC3B,MAAM;EACJ,MAAM;EACN,aAAa;CACf;CACA,aAAa;EACX,iDAAY,wBAAoB,MAAM,MAAM,EAAE,OAAO;EACrD,mDAAc,0BAAsB,MAAM,MAAM,EAAE,OAAO;EACzD,mDAAc,0BAAsB,MAAM,MAAM,EAAE,OAAO;EACzD,mDAAc,0BAAsB,MAAM,MAAM,EAAE,OAAO;CAC3D;AACF,CAAC"}

package/dist/management-DDACMgbU.mjs

@@ -0,0 +1,19 @@
+import { t as defineCommand } from "./cli/main.mjs";
+
+//#region src/cli/commands/key/management/index.ts
+var management_default = defineCommand({
+	meta: {
+		name: "management",
+		description: "Manage management keys (content CRUD with RBAC)"
+	},
+	subCommands: {
+		list: () => import("./list-ocfd7631.mjs").then((m) => m.default),
+		create: () => import("./create-B1ZBOqcV.mjs").then((m) => m.default),
+		update: () => import("./update-CQ4n4Xuf.mjs").then((m) => m.default),
+		delete: () => import("./delete-XWJRhBFs.mjs").then((m) => m.default)
+	}
+});
+
+//#endregion
+export { management_default as default };
+//# sourceMappingURL=management-DDACMgbU.mjs.map

package/dist/management-DDACMgbU.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"management-DDACMgbU.mjs","names":[],"sources":["../src/cli/commands/key/management/index.ts"],"sourcesContent":["import { defineCommand } from \"../../define-command.js\";\n\nexport default defineCommand({\n  meta: {\n    name: \"management\",\n    description: \"Manage management keys (content CRUD with RBAC)\",\n  },\n  subCommands: {\n    list: () => import(\"./list.js\").then((m) => m.default),\n    create: () => import(\"./create.js\").then((m) => m.default),\n    update: () => import(\"./update.js\").then((m) => m.default),\n    delete: () => import(\"./delete.js\").then((m) => m.default),\n  },\n});\n"],"mappings":";;;AAEA,yBAAe,cAAc;CAC3B,MAAM;EACJ,MAAM;EACN,aAAa;CACf;CACA,aAAa;EACX,YAAY,OAAO,sBAAY,CAAC,MAAM,MAAM,EAAE,OAAO;EACrD,cAAc,OAAO,wBAAc,CAAC,MAAM,MAAM,EAAE,OAAO;EACzD,cAAc,OAAO,wBAAc,CAAC,MAAM,MAAM,EAAE,OAAO;EACzD,cAAc,OAAO,wBAAc,CAAC,MAAM,MAAM,EAAE,OAAO;CAC3D;AACF,CAAC"}

package/dist/mask-B1qD73jb.mjs

@@ -0,0 +1,22 @@
+//#region src/cli/commands/key/mask.ts
+const CONSUMER_KEY_PREFIX = "x_consumer_";
+const MANAGEMENT_KEY_PREFIX = "x_management_";
+function maskConsumerKey(key) {
+	return maskWithPrefix(key, CONSUMER_KEY_PREFIX);
+}
+function maskManagementKey(key) {
+	return maskWithPrefix(key, MANAGEMENT_KEY_PREFIX);
+}
+function maskWithPrefix(key, prefix) {
+	if (!key.startsWith(prefix)) return key.replace(/./g, "*");
+	return prefix + key.slice(prefix.length).replace(/./g, "*");
+}
+const showKeyArg = { "show-key": {
+	type: "boolean",
+	description: "Show key values in plaintext instead of masking them",
+	default: false
+} };
+
+//#endregion
+export { maskManagementKey as n, showKeyArg as r, maskConsumerKey as t };
+//# sourceMappingURL=mask-B1qD73jb.mjs.map

package/dist/mask-B1qD73jb.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mask-B1qD73jb.mjs","names":[],"sources":["../src/cli/commands/key/mask.ts"],"sourcesContent":["import type { ArgsDef } from \"citty\";\n\n// Orizm の key は発行後も API から常に平文で返る仕様だが、画面共有やログ転記での\n// 露出事故を防ぐため、--show-key が明示されない限りマスクして表示する。\n// 見せ方は apps/console の SecretTokenView (revealedPrefix + 残りを * 置換) に揃える。\nconst CONSUMER_KEY_PREFIX = \"x_consumer_\";\nconst MANAGEMENT_KEY_PREFIX = \"x_management_\";\n\nexport function maskConsumerKey(key: string): string {\n  return maskWithPrefix(key, CONSUMER_KEY_PREFIX);\n}\n\nexport function maskManagementKey(key: string): string {\n  return maskWithPrefix(key, MANAGEMENT_KEY_PREFIX);\n}\n\nfunction maskWithPrefix(key: string, prefix: string): string {\n  // 想定外の形式の key で prefix.length 分を素通しすると本物の秘密文字が露出するため全マスク。\n  if (!key.startsWith(prefix)) return key.replace(/./g, \"*\");\n  return prefix + key.slice(prefix.length).replace(/./g, \"*\");\n}\n\nexport const showKeyArg = {\n  \"show-key\": {\n    type: \"boolean\",\n    description: \"Show key values in plaintext instead of masking them\",\n    default: false,\n  },\n} satisfies ArgsDef;\n"],"mappings":";AAKA,MAAM,sBAAsB;AAC5B,MAAM,wBAAwB;AAE9B,SAAgB,gBAAgB,KAAqB;CACnD,OAAO,eAAe,KAAK,mBAAmB;AAChD;AAEA,SAAgB,kBAAkB,KAAqB;CACrD,OAAO,eAAe,KAAK,qBAAqB;AAClD;AAEA,SAAS,eAAe,KAAa,QAAwB;CAE3D,IAAI,CAAC,IAAI,WAAW,MAAM,GAAG,OAAO,IAAI,QAAQ,MAAM,GAAG;CACzD,OAAO,SAAS,IAAI,MAAM,OAAO,MAAM,CAAC,CAAC,QAAQ,MAAM,GAAG;AAC5D;AAEA,MAAa,aAAa,EACxB,YAAY;CACV,MAAM;CACN,aAAa;CACb,SAAS;AACX,EACF"}

package/dist/mask-CqYLib9p.cjs

@@ -0,0 +1,40 @@
+
+//#region src/cli/commands/key/mask.ts
+const CONSUMER_KEY_PREFIX = "x_consumer_";
+const MANAGEMENT_KEY_PREFIX = "x_management_";
+function maskConsumerKey(key) {
+	return maskWithPrefix(key, CONSUMER_KEY_PREFIX);
+}
+function maskManagementKey(key) {
+	return maskWithPrefix(key, MANAGEMENT_KEY_PREFIX);
+}
+function maskWithPrefix(key, prefix) {
+	if (!key.startsWith(prefix)) return key.replace(/./g, "*");
+	return prefix + key.slice(prefix.length).replace(/./g, "*");
+}
+const showKeyArg = { "show-key": {
+	type: "boolean",
+	description: "Show key values in plaintext instead of masking them",
+	default: false
+} };
+
+//#endregion
+Object.defineProperty(exports, 'maskConsumerKey', {
+  enumerable: true,
+  get: function () {
+    return maskConsumerKey;
+  }
+});
+Object.defineProperty(exports, 'maskManagementKey', {
+  enumerable: true,
+  get: function () {
+    return maskManagementKey;
+  }
+});
+Object.defineProperty(exports, 'showKeyArg', {
+  enumerable: true,
+  get: function () {
+    return showKeyArg;
+  }
+});
+//# sourceMappingURL=mask-CqYLib9p.cjs.map

package/dist/mask-CqYLib9p.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mask-CqYLib9p.cjs","names":[],"sources":["../src/cli/commands/key/mask.ts"],"sourcesContent":["import type { ArgsDef } from \"citty\";\n\n// Orizm の key は発行後も API から常に平文で返る仕様だが、画面共有やログ転記での\n// 露出事故を防ぐため、--show-key が明示されない限りマスクして表示する。\n// 見せ方は apps/console の SecretTokenView (revealedPrefix + 残りを * 置換) に揃える。\nconst CONSUMER_KEY_PREFIX = \"x_consumer_\";\nconst MANAGEMENT_KEY_PREFIX = \"x_management_\";\n\nexport function maskConsumerKey(key: string): string {\n  return maskWithPrefix(key, CONSUMER_KEY_PREFIX);\n}\n\nexport function maskManagementKey(key: string): string {\n  return maskWithPrefix(key, MANAGEMENT_KEY_PREFIX);\n}\n\nfunction maskWithPrefix(key: string, prefix: string): string {\n  // 想定外の形式の key で prefix.length 分を素通しすると本物の秘密文字が露出するため全マスク。\n  if (!key.startsWith(prefix)) return key.replace(/./g, \"*\");\n  return prefix + key.slice(prefix.length).replace(/./g, \"*\");\n}\n\nexport const showKeyArg = {\n  \"show-key\": {\n    type: \"boolean\",\n    description: \"Show key values in plaintext instead of masking them\",\n    default: false,\n  },\n} satisfies ArgsDef;\n"],"mappings":";;AAKA,MAAM,sBAAsB;AAC5B,MAAM,wBAAwB;AAE9B,SAAgB,gBAAgB,KAAqB;CACnD,OAAO,eAAe,KAAK,mBAAmB;AAChD;AAEA,SAAgB,kBAAkB,KAAqB;CACrD,OAAO,eAAe,KAAK,qBAAqB;AAClD;AAEA,SAAS,eAAe,KAAa,QAAwB;CAE3D,IAAI,CAAC,IAAI,WAAW,MAAM,GAAG,OAAO,IAAI,QAAQ,MAAM,GAAG;CACzD,OAAO,SAAS,IAAI,MAAM,OAAO,MAAM,CAAC,CAAC,QAAQ,MAAM,GAAG;AAC5D;AAEA,MAAa,aAAa,EACxB,YAAY;CACV,MAAM;CACN,aAAa;CACb,SAAS;AACX,EACF"}

package/dist/oauth-client-CdD0evAV.cjs

@@ -0,0 +1,170 @@
+const require_cli_main = require('./cli/main.cjs');
+let _praha_byethrow = require("@praha/byethrow");
+let valibot = require("valibot");
+valibot = require_cli_main.__toESM(valibot, 1);
+let jose = require("jose");
+
+//#region src/cli/auth/oauth-client.ts
+const CLIENT_ID = "orizm-cli";
+const SCOPES = [
+	"openid",
+	"offline_access",
+	"profile",
+	"email",
+	"content:read",
+	"content:write",
+	"schema:read",
+	"schema:write",
+	"project:read",
+	"project:write",
+	"project-users:read",
+	"project-users:write",
+	"api-keys:read",
+	"api-keys:write",
+	"organization:read",
+	"organization:write",
+	"profile:write",
+	"invitation:read",
+	"invitation:write"
+];
+function authorizationEndpoint(issuerUrl) {
+	return `${issuerUrl}/oauth2/auth`;
+}
+function tokenEndpoint(issuerUrl) {
+	return `${issuerUrl}/oauth2/token`;
+}
+function revocationEndpoint(issuerUrl) {
+	return `${issuerUrl}/oauth2/revoke`;
+}
+function jwksUri(issuerUrl) {
+	return `${issuerUrl}/.well-known/jwks.json`;
+}
+function buildAuthorizationUrl(params) {
+	const url = new URL(authorizationEndpoint(params.issuerUrl));
+	url.searchParams.set("response_type", "code");
+	url.searchParams.set("client_id", CLIENT_ID);
+	url.searchParams.set("redirect_uri", params.redirectUri);
+	url.searchParams.set("scope", SCOPES.join(" "));
+	url.searchParams.set("state", params.state);
+	url.searchParams.set("code_challenge", params.codeChallenge);
+	url.searchParams.set("code_challenge_method", params.codeChallengeMethod);
+	return url.toString();
+}
+const TokenResponseSchema = valibot.pipe(valibot.object({
+	access_token: valibot.string(),
+	refresh_token: valibot.string(),
+	id_token: valibot.string(),
+	expires_in: valibot.number(),
+	scope: valibot.string()
+}), valibot.transform((raw) => ({
+	accessToken: raw.access_token,
+	refreshToken: raw.refresh_token,
+	idToken: raw.id_token,
+	scope: raw.scope,
+	expiresAt: new Date(Date.now() + raw.expires_in * 1e3).toISOString()
+})));
+const OAuthErrorSchema = valibot.object({
+	error: valibot.optional(valibot.string()),
+	error_description: valibot.optional(valibot.string())
+});
+async function postToken(issuerUrl, body) {
+	const response = await fetch(tokenEndpoint(issuerUrl), {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body
+	});
+	if (response.status >= 500) throw new Error(`Token endpoint returned ${response.status}`);
+	const json = await response.json().catch(() => void 0);
+	if (!response.ok) {
+		const reason = extractOAuthError(json) ?? `HTTP ${response.status}`;
+		return _praha_byethrow.Result.fail({
+			type: "token_exchange_failed",
+			reason
+		});
+	}
+	const parsed = valibot.safeParse(TokenResponseSchema, json);
+	if (!parsed.success) return _praha_byethrow.Result.fail({
+		type: "token_exchange_failed",
+		reason: "Token endpoint returned an unexpected payload"
+	});
+	return _praha_byethrow.Result.succeed(parsed.output);
+}
+function exchangeCode(params) {
+	const body = new URLSearchParams({
+		grant_type: "authorization_code",
+		code: params.code,
+		redirect_uri: params.redirectUri,
+		client_id: CLIENT_ID,
+		code_verifier: params.codeVerifier
+	});
+	return postToken(params.issuerUrl, body);
+}
+function refreshTokens(params) {
+	const body = new URLSearchParams({
+		grant_type: "refresh_token",
+		refresh_token: params.refreshToken,
+		client_id: CLIENT_ID
+	});
+	return postToken(params.issuerUrl, body);
+}
+async function verifyIdToken(issuerUrl, idToken) {
+	const { payload } = await (0, jose.jwtVerify)(idToken, (0, jose.createRemoteJWKSet)(new URL(jwksUri(issuerUrl))), {
+		issuer: issuerUrl,
+		audience: CLIENT_ID
+	});
+	return {
+		subject: payload.sub ?? "",
+		name: typeof payload.name === "string" ? payload.name : void 0,
+		email: typeof payload.email === "string" ? payload.email : void 0
+	};
+}
+async function revokeToken(issuerUrl, refreshToken) {
+	await fetch(revocationEndpoint(issuerUrl), {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			token: refreshToken,
+			client_id: CLIENT_ID
+		})
+	});
+}
+function extractOAuthError(value) {
+	const parsed = valibot.safeParse(OAuthErrorSchema, value);
+	if (!parsed.success) return void 0;
+	const { error, error_description } = parsed.output;
+	if (error == null && error_description == null) return void 0;
+	return [error, error_description].filter((part) => part != null).join(": ");
+}
+
+//#endregion
+Object.defineProperty(exports, 'buildAuthorizationUrl', {
+  enumerable: true,
+  get: function () {
+    return buildAuthorizationUrl;
+  }
+});
+Object.defineProperty(exports, 'exchangeCode', {
+  enumerable: true,
+  get: function () {
+    return exchangeCode;
+  }
+});
+Object.defineProperty(exports, 'refreshTokens', {
+  enumerable: true,
+  get: function () {
+    return refreshTokens;
+  }
+});
+Object.defineProperty(exports, 'revokeToken', {
+  enumerable: true,
+  get: function () {
+    return revokeToken;
+  }
+});
+Object.defineProperty(exports, 'verifyIdToken', {
+  enumerable: true,
+  get: function () {
+    return verifyIdToken;
+  }
+});
+//# sourceMappingURL=oauth-client-CdD0evAV.cjs.map

package/dist/oauth-client-CdD0evAV.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client-CdD0evAV.cjs","names":["v","Result"],"sources":["../src/cli/auth/oauth-client.ts"],"sourcesContent":["import { createRemoteJWKSet, jwtVerify } from \"jose\";\nimport { Result } from \"@praha/byethrow\";\nimport * as v from \"valibot\";\n\nexport const CLIENT_ID = \"orizm-cli\";\n\n// orizm-cli client にサーバー側で登録されたスコープの複製。サーバーの登録内容と\n// 完全に一致している必要があり、ずれると認可リクエストが拒否されるので両方を揃えて変更する。\nexport const SCOPES = [\n  \"openid\",\n  \"offline_access\",\n  \"profile\",\n  \"email\",\n  \"content:read\",\n  \"content:write\",\n  \"schema:read\",\n  \"schema:write\",\n  \"project:read\",\n  \"project:write\",\n  \"project-users:read\",\n  \"project-users:write\",\n  \"api-keys:read\",\n  \"api-keys:write\",\n  \"organization:read\",\n  \"organization:write\",\n  \"profile:write\",\n  \"invitation:read\",\n  \"invitation:write\",\n] as const;\n\nexport type IdTokenClaims = {\n  subject: string;\n  name?: string;\n  email?: string;\n};\n\nexport type TokenSet = {\n  accessToken: string;\n  refreshToken: string;\n  idToken: string;\n  scope: string;\n  expiresAt: string;\n};\n\nexport type TokenExchangeError = {\n  type: \"token_exchange_failed\";\n  reason: string;\n};\n\nfunction authorizationEndpoint(issuerUrl: string): string {\n  return `${issuerUrl}/oauth2/auth`;\n}\n\nfunction tokenEndpoint(issuerUrl: string): string {\n  return `${issuerUrl}/oauth2/token`;\n}\n\nfunction revocationEndpoint(issuerUrl: string): string {\n  return `${issuerUrl}/oauth2/revoke`;\n}\n\nfunction jwksUri(issuerUrl: string): string {\n  return `${issuerUrl}/.well-known/jwks.json`;\n}\n\nexport function buildAuthorizationUrl(params: {\n  issuerUrl: string;\n  redirectUri: string;\n  codeChallenge: string;\n  codeChallengeMethod: string;\n  state: string;\n}): string {\n  const url = new URL(authorizationEndpoint(params.issuerUrl));\n  url.searchParams.set(\"response_type\", \"code\");\n  url.searchParams.set(\"client_id\", CLIENT_ID);\n  url.searchParams.set(\"redirect_uri\", params.redirectUri);\n  url.searchParams.set(\"scope\", SCOPES.join(\" \"));\n  url.searchParams.set(\"state\", params.state);\n  url.searchParams.set(\"code_challenge\", params.codeChallenge);\n  url.searchParams.set(\"code_challenge_method\", params.codeChallengeMethod);\n  return url.toString();\n}\n\nconst TokenResponseSchema = v.pipe(\n  v.object({\n    access_token: v.string(),\n    refresh_token: v.string(),\n    id_token: v.string(),\n    expires_in: v.number(),\n    scope: v.string(),\n  }),\n  v.transform(\n    (raw): TokenSet => ({\n      accessToken: raw.access_token,\n      refreshToken: raw.refresh_token,\n      idToken: raw.id_token,\n      scope: raw.scope,\n      expiresAt: new Date(Date.now() + raw.expires_in * 1000).toISOString(),\n    }),\n  ),\n);\n\nconst OAuthErrorSchema = v.object({\n  error: v.optional(v.string()),\n  error_description: v.optional(v.string()),\n});\n\n// 4xx は呼び出し側が分岐で扱える予測可能エラーなので Result.fail、\n// 回復しようのない 5xx / network は throw して上位の共通ハンドラに任せる。\nasync function postToken(\n  issuerUrl: string,\n  body: URLSearchParams,\n): Promise<Result.Result<TokenSet, TokenExchangeError>> {\n  const response = await fetch(tokenEndpoint(issuerUrl), {\n    method: \"POST\",\n    headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n    body,\n  });\n\n  if (response.status >= 500) {\n    throw new Error(`Token endpoint returned ${response.status}`);\n  }\n\n  const json: unknown = await response.json().catch(() => undefined);\n\n  if (!response.ok) {\n    const reason = extractOAuthError(json) ?? `HTTP ${response.status}`;\n    return Result.fail({ type: \"token_exchange_failed\", reason });\n  }\n\n  const parsed = v.safeParse(TokenResponseSchema, json);\n  if (!parsed.success) {\n    return Result.fail({\n      type: \"token_exchange_failed\",\n      reason: \"Token endpoint returned an unexpected payload\",\n    });\n  }\n\n  return Result.succeed(parsed.output);\n}\n\nexport function exchangeCode(params: {\n  issuerUrl: string;\n  code: string;\n  redirectUri: string;\n  codeVerifier: string;\n}): Promise<Result.Result<TokenSet, TokenExchangeError>> {\n  const body = new URLSearchParams({\n    grant_type: \"authorization_code\",\n    code: params.code,\n    redirect_uri: params.redirectUri,\n    client_id: CLIENT_ID,\n    code_verifier: params.codeVerifier,\n  });\n  return postToken(params.issuerUrl, body);\n}\n\nexport function refreshTokens(params: {\n  issuerUrl: string;\n  refreshToken: string;\n}): Promise<Result.Result<TokenSet, TokenExchangeError>> {\n  const body = new URLSearchParams({\n    grant_type: \"refresh_token\",\n    refresh_token: params.refreshToken,\n    client_id: CLIENT_ID,\n  });\n  return postToken(params.issuerUrl, body);\n}\n\nexport async function verifyIdToken(\n  issuerUrl: string,\n  idToken: string,\n): Promise<IdTokenClaims> {\n  const jwks = createRemoteJWKSet(new URL(jwksUri(issuerUrl)));\n  const { payload } = await jwtVerify(idToken, jwks, {\n    issuer: issuerUrl,\n    audience: CLIENT_ID,\n  });\n  return {\n    subject: payload.sub ?? \"\",\n    name: typeof payload.name === \"string\" ? payload.name : undefined,\n    email: typeof payload.email === \"string\" ? payload.email : undefined,\n  };\n}\n\n// refresh_token を Hydra 側でも無効化する。失敗してもログアウト自体は成立させる（best-effort）。\nexport async function revokeToken(\n  issuerUrl: string,\n  refreshToken: string,\n): Promise<void> {\n  await fetch(revocationEndpoint(issuerUrl), {\n    method: \"POST\",\n    headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n    body: new URLSearchParams({ token: refreshToken, client_id: CLIENT_ID }),\n  });\n}\n\nfunction extractOAuthError(value: unknown): string | undefined {\n  const parsed = v.safeParse(OAuthErrorSchema, value);\n  if (!parsed.success) return undefined;\n  const { error, error_description } = parsed.output;\n  if (error == null && error_description == null) return undefined;\n  return [error, error_description].filter((part) => part != null).join(\": \");\n}\n"],"mappings":";;;;;;;AAIA,MAAa,YAAY;AAIzB,MAAa,SAAS;CACpB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAqBA,SAAS,sBAAsB,WAA2B;CACxD,OAAO,GAAG,UAAU;AACtB;AAEA,SAAS,cAAc,WAA2B;CAChD,OAAO,GAAG,UAAU;AACtB;AAEA,SAAS,mBAAmB,WAA2B;CACrD,OAAO,GAAG,UAAU;AACtB;AAEA,SAAS,QAAQ,WAA2B;CAC1C,OAAO,GAAG,UAAU;AACtB;AAEA,SAAgB,sBAAsB,QAM3B;CACT,MAAM,MAAM,IAAI,IAAI,sBAAsB,OAAO,SAAS,CAAC;CAC3D,IAAI,aAAa,IAAI,iBAAiB,MAAM;CAC5C,IAAI,aAAa,IAAI,aAAa,SAAS;CAC3C,IAAI,aAAa,IAAI,gBAAgB,OAAO,WAAW;CACvD,IAAI,aAAa,IAAI,SAAS,OAAO,KAAK,GAAG,CAAC;CAC9C,IAAI,aAAa,IAAI,SAAS,OAAO,KAAK;CAC1C,IAAI,aAAa,IAAI,kBAAkB,OAAO,aAAa;CAC3D,IAAI,aAAa,IAAI,yBAAyB,OAAO,mBAAmB;CACxE,OAAO,IAAI,SAAS;AACtB;AAEA,MAAM,sBAAsBA,QAAE,KAC5BA,QAAE,OAAO;CACP,cAAcA,QAAE,OAAO;CACvB,eAAeA,QAAE,OAAO;CACxB,UAAUA,QAAE,OAAO;CACnB,YAAYA,QAAE,OAAO;CACrB,OAAOA,QAAE,OAAO;AAClB,CAAC,GACDA,QAAE,WACC,SAAmB;CAClB,aAAa,IAAI;CACjB,cAAc,IAAI;CAClB,SAAS,IAAI;CACb,OAAO,IAAI;CACX,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,aAAa,GAAI,CAAC,CAAC,YAAY;AACtE,EACF,CACF;AAEA,MAAM,mBAAmBA,QAAE,OAAO;CAChC,OAAOA,QAAE,SAASA,QAAE,OAAO,CAAC;CAC5B,mBAAmBA,QAAE,SAASA,QAAE,OAAO,CAAC;AAC1C,CAAC;AAID,eAAe,UACb,WACA,MACsD;CACtD,MAAM,WAAW,MAAM,MAAM,cAAc,SAAS,GAAG;EACrD,QAAQ;EACR,SAAS,EAAE,gBAAgB,oCAAoC;EAC/D;CACF,CAAC;CAED,IAAI,SAAS,UAAU,KACrB,MAAM,IAAI,MAAM,2BAA2B,SAAS,QAAQ;CAG9D,MAAM,OAAgB,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,MAAS;CAEjE,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,SAAS,kBAAkB,IAAI,KAAK,QAAQ,SAAS;EAC3D,OAAOC,uBAAO,KAAK;GAAE,MAAM;GAAyB;EAAO,CAAC;CAC9D;CAEA,MAAM,SAASD,QAAE,UAAU,qBAAqB,IAAI;CACpD,IAAI,CAAC,OAAO,SACV,OAAOC,uBAAO,KAAK;EACjB,MAAM;EACN,QAAQ;CACV,CAAC;CAGH,OAAOA,uBAAO,QAAQ,OAAO,MAAM;AACrC;AAEA,SAAgB,aAAa,QAK4B;CACvD,MAAM,OAAO,IAAI,gBAAgB;EAC/B,YAAY;EACZ,MAAM,OAAO;EACb,cAAc,OAAO;EACrB,WAAW;EACX,eAAe,OAAO;CACxB,CAAC;CACD,OAAO,UAAU,OAAO,WAAW,IAAI;AACzC;AAEA,SAAgB,cAAc,QAG2B;CACvD,MAAM,OAAO,IAAI,gBAAgB;EAC/B,YAAY;EACZ,eAAe,OAAO;EACtB,WAAW;CACb,CAAC;CACD,OAAO,UAAU,OAAO,WAAW,IAAI;AACzC;AAEA,eAAsB,cACpB,WACA,SACwB;CAExB,MAAM,EAAE,YAAY,0BAAgB,sCADJ,IAAI,IAAI,QAAQ,SAAS,CAAC,CACV,GAAG;EACjD,QAAQ;EACR,UAAU;CACZ,CAAC;CACD,OAAO;EACL,SAAS,QAAQ,OAAO;EACxB,MAAM,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;EACxD,OAAO,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ;CAC7D;AACF;AAGA,eAAsB,YACpB,WACA,cACe;CACf,MAAM,MAAM,mBAAmB,SAAS,GAAG;EACzC,QAAQ;EACR,SAAS,EAAE,gBAAgB,oCAAoC;EAC/D,MAAM,IAAI,gBAAgB;GAAE,OAAO;GAAc,WAAW;EAAU,CAAC;CACzE,CAAC;AACH;AAEA,SAAS,kBAAkB,OAAoC;CAC7D,MAAM,SAASD,QAAE,UAAU,kBAAkB,KAAK;CAClD,IAAI,CAAC,OAAO,SAAS,OAAO;CAC5B,MAAM,EAAE,OAAO,sBAAsB,OAAO;CAC5C,IAAI,SAAS,QAAQ,qBAAqB,MAAM,OAAO;CACvD,OAAO,CAAC,OAAO,iBAAiB,CAAC,CAAC,QAAQ,SAAS,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI;AAC5E"}

package/dist/oauth-client-QHuDa4fW.mjs

@@ -0,0 +1,139 @@
+import { Result } from "@praha/byethrow";
+import * as v from "valibot";
+import { createRemoteJWKSet, jwtVerify } from "jose";
+
+//#region src/cli/auth/oauth-client.ts
+const CLIENT_ID = "orizm-cli";
+const SCOPES = [
+	"openid",
+	"offline_access",
+	"profile",
+	"email",
+	"content:read",
+	"content:write",
+	"schema:read",
+	"schema:write",
+	"project:read",
+	"project:write",
+	"project-users:read",
+	"project-users:write",
+	"api-keys:read",
+	"api-keys:write",
+	"organization:read",
+	"organization:write",
+	"profile:write",
+	"invitation:read",
+	"invitation:write"
+];
+function authorizationEndpoint(issuerUrl) {
+	return `${issuerUrl}/oauth2/auth`;
+}
+function tokenEndpoint(issuerUrl) {
+	return `${issuerUrl}/oauth2/token`;
+}
+function revocationEndpoint(issuerUrl) {
+	return `${issuerUrl}/oauth2/revoke`;
+}
+function jwksUri(issuerUrl) {
+	return `${issuerUrl}/.well-known/jwks.json`;
+}
+function buildAuthorizationUrl(params) {
+	const url = new URL(authorizationEndpoint(params.issuerUrl));
+	url.searchParams.set("response_type", "code");
+	url.searchParams.set("client_id", CLIENT_ID);
+	url.searchParams.set("redirect_uri", params.redirectUri);
+	url.searchParams.set("scope", SCOPES.join(" "));
+	url.searchParams.set("state", params.state);
+	url.searchParams.set("code_challenge", params.codeChallenge);
+	url.searchParams.set("code_challenge_method", params.codeChallengeMethod);
+	return url.toString();
+}
+const TokenResponseSchema = v.pipe(v.object({
+	access_token: v.string(),
+	refresh_token: v.string(),
+	id_token: v.string(),
+	expires_in: v.number(),
+	scope: v.string()
+}), v.transform((raw) => ({
+	accessToken: raw.access_token,
+	refreshToken: raw.refresh_token,
+	idToken: raw.id_token,
+	scope: raw.scope,
+	expiresAt: new Date(Date.now() + raw.expires_in * 1e3).toISOString()
+})));
+const OAuthErrorSchema = v.object({
+	error: v.optional(v.string()),
+	error_description: v.optional(v.string())
+});
+async function postToken(issuerUrl, body) {
+	const response = await fetch(tokenEndpoint(issuerUrl), {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body
+	});
+	if (response.status >= 500) throw new Error(`Token endpoint returned ${response.status}`);
+	const json = await response.json().catch(() => void 0);
+	if (!response.ok) {
+		const reason = extractOAuthError(json) ?? `HTTP ${response.status}`;
+		return Result.fail({
+			type: "token_exchange_failed",
+			reason
+		});
+	}
+	const parsed = v.safeParse(TokenResponseSchema, json);
+	if (!parsed.success) return Result.fail({
+		type: "token_exchange_failed",
+		reason: "Token endpoint returned an unexpected payload"
+	});
+	return Result.succeed(parsed.output);
+}
+function exchangeCode(params) {
+	const body = new URLSearchParams({
+		grant_type: "authorization_code",
+		code: params.code,
+		redirect_uri: params.redirectUri,
+		client_id: CLIENT_ID,
+		code_verifier: params.codeVerifier
+	});
+	return postToken(params.issuerUrl, body);
+}
+function refreshTokens(params) {
+	const body = new URLSearchParams({
+		grant_type: "refresh_token",
+		refresh_token: params.refreshToken,
+		client_id: CLIENT_ID
+	});
+	return postToken(params.issuerUrl, body);
+}
+async function verifyIdToken(issuerUrl, idToken) {
+	const { payload } = await jwtVerify(idToken, createRemoteJWKSet(new URL(jwksUri(issuerUrl))), {
+		issuer: issuerUrl,
+		audience: CLIENT_ID
+	});
+	return {
+		subject: payload.sub ?? "",
+		name: typeof payload.name === "string" ? payload.name : void 0,
+		email: typeof payload.email === "string" ? payload.email : void 0
+	};
+}
+async function revokeToken(issuerUrl, refreshToken) {
+	await fetch(revocationEndpoint(issuerUrl), {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			token: refreshToken,
+			client_id: CLIENT_ID
+		})
+	});
+}
+function extractOAuthError(value) {
+	const parsed = v.safeParse(OAuthErrorSchema, value);
+	if (!parsed.success) return void 0;
+	const { error, error_description } = parsed.output;
+	if (error == null && error_description == null) return void 0;
+	return [error, error_description].filter((part) => part != null).join(": ");
+}
+
+//#endregion
+export { verifyIdToken as a, revokeToken as i, exchangeCode as n, refreshTokens as r, buildAuthorizationUrl as t };
+//# sourceMappingURL=oauth-client-QHuDa4fW.mjs.map

package/dist/oauth-client-QHuDa4fW.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client-QHuDa4fW.mjs","names":[],"sources":["../src/cli/auth/oauth-client.ts"],"sourcesContent":["import { createRemoteJWKSet, jwtVerify } from \"jose\";\nimport { Result } from \"@praha/byethrow\";\nimport * as v from \"valibot\";\n\nexport const CLIENT_ID = \"orizm-cli\";\n\n// orizm-cli client にサーバー側で登録されたスコープの複製。サーバーの登録内容と\n// 完全に一致している必要があり、ずれると認可リクエストが拒否されるので両方を揃えて変更する。\nexport const SCOPES = [\n  \"openid\",\n  \"offline_access\",\n  \"profile\",\n  \"email\",\n  \"content:read\",\n  \"content:write\",\n  \"schema:read\",\n  \"schema:write\",\n  \"project:read\",\n  \"project:write\",\n  \"project-users:read\",\n  \"project-users:write\",\n  \"api-keys:read\",\n  \"api-keys:write\",\n  \"organization:read\",\n  \"organization:write\",\n  \"profile:write\",\n  \"invitation:read\",\n  \"invitation:write\",\n] as const;\n\nexport type IdTokenClaims = {\n  subject: string;\n  name?: string;\n  email?: string;\n};\n\nexport type TokenSet = {\n  accessToken: string;\n  refreshToken: string;\n  idToken: string;\n  scope: string;\n  expiresAt: string;\n};\n\nexport type TokenExchangeError = {\n  type: \"token_exchange_failed\";\n  reason: string;\n};\n\nfunction authorizationEndpoint(issuerUrl: string): string {\n  return `${issuerUrl}/oauth2/auth`;\n}\n\nfunction tokenEndpoint(issuerUrl: string): string {\n  return `${issuerUrl}/oauth2/token`;\n}\n\nfunction revocationEndpoint(issuerUrl: string): string {\n  return `${issuerUrl}/oauth2/revoke`;\n}\n\nfunction jwksUri(issuerUrl: string): string {\n  return `${issuerUrl}/.well-known/jwks.json`;\n}\n\nexport function buildAuthorizationUrl(params: {\n  issuerUrl: string;\n  redirectUri: string;\n  codeChallenge: string;\n  codeChallengeMethod: string;\n  state: string;\n}): string {\n  const url = new URL(authorizationEndpoint(params.issuerUrl));\n  url.searchParams.set(\"response_type\", \"code\");\n  url.searchParams.set(\"client_id\", CLIENT_ID);\n  url.searchParams.set(\"redirect_uri\", params.redirectUri);\n  url.searchParams.set(\"scope\", SCOPES.join(\" \"));\n  url.searchParams.set(\"state\", params.state);\n  url.searchParams.set(\"code_challenge\", params.codeChallenge);\n  url.searchParams.set(\"code_challenge_method\", params.codeChallengeMethod);\n  return url.toString();\n}\n\nconst TokenResponseSchema = v.pipe(\n  v.object({\n    access_token: v.string(),\n    refresh_token: v.string(),\n    id_token: v.string(),\n    expires_in: v.number(),\n    scope: v.string(),\n  }),\n  v.transform(\n    (raw): TokenSet => ({\n      accessToken: raw.access_token,\n      refreshToken: raw.refresh_token,\n      idToken: raw.id_token,\n      scope: raw.scope,\n      expiresAt: new Date(Date.now() + raw.expires_in * 1000).toISOString(),\n    }),\n  ),\n);\n\nconst OAuthErrorSchema = v.object({\n  error: v.optional(v.string()),\n  error_description: v.optional(v.string()),\n});\n\n// 4xx は呼び出し側が分岐で扱える予測可能エラーなので Result.fail、\n// 回復しようのない 5xx / network は throw して上位の共通ハンドラに任せる。\nasync function postToken(\n  issuerUrl: string,\n  body: URLSearchParams,\n): Promise<Result.Result<TokenSet, TokenExchangeError>> {\n  const response = await fetch(tokenEndpoint(issuerUrl), {\n    method: \"POST\",\n    headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n    body,\n  });\n\n  if (response.status >= 500) {\n    throw new Error(`Token endpoint returned ${response.status}`);\n  }\n\n  const json: unknown = await response.json().catch(() => undefined);\n\n  if (!response.ok) {\n    const reason = extractOAuthError(json) ?? `HTTP ${response.status}`;\n    return Result.fail({ type: \"token_exchange_failed\", reason });\n  }\n\n  const parsed = v.safeParse(TokenResponseSchema, json);\n  if (!parsed.success) {\n    return Result.fail({\n      type: \"token_exchange_failed\",\n      reason: \"Token endpoint returned an unexpected payload\",\n    });\n  }\n\n  return Result.succeed(parsed.output);\n}\n\nexport function exchangeCode(params: {\n  issuerUrl: string;\n  code: string;\n  redirectUri: string;\n  codeVerifier: string;\n}): Promise<Result.Result<TokenSet, TokenExchangeError>> {\n  const body = new URLSearchParams({\n    grant_type: \"authorization_code\",\n    code: params.code,\n    redirect_uri: params.redirectUri,\n    client_id: CLIENT_ID,\n    code_verifier: params.codeVerifier,\n  });\n  return postToken(params.issuerUrl, body);\n}\n\nexport function refreshTokens(params: {\n  issuerUrl: string;\n  refreshToken: string;\n}): Promise<Result.Result<TokenSet, TokenExchangeError>> {\n  const body = new URLSearchParams({\n    grant_type: \"refresh_token\",\n    refresh_token: params.refreshToken,\n    client_id: CLIENT_ID,\n  });\n  return postToken(params.issuerUrl, body);\n}\n\nexport async function verifyIdToken(\n  issuerUrl: string,\n  idToken: string,\n): Promise<IdTokenClaims> {\n  const jwks = createRemoteJWKSet(new URL(jwksUri(issuerUrl)));\n  const { payload } = await jwtVerify(idToken, jwks, {\n    issuer: issuerUrl,\n    audience: CLIENT_ID,\n  });\n  return {\n    subject: payload.sub ?? \"\",\n    name: typeof payload.name === \"string\" ? payload.name : undefined,\n    email: typeof payload.email === \"string\" ? payload.email : undefined,\n  };\n}\n\n// refresh_token を Hydra 側でも無効化する。失敗してもログアウト自体は成立させる（best-effort）。\nexport async function revokeToken(\n  issuerUrl: string,\n  refreshToken: string,\n): Promise<void> {\n  await fetch(revocationEndpoint(issuerUrl), {\n    method: \"POST\",\n    headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n    body: new URLSearchParams({ token: refreshToken, client_id: CLIENT_ID }),\n  });\n}\n\nfunction extractOAuthError(value: unknown): string | undefined {\n  const parsed = v.safeParse(OAuthErrorSchema, value);\n  if (!parsed.success) return undefined;\n  const { error, error_description } = parsed.output;\n  if (error == null && error_description == null) return undefined;\n  return [error, error_description].filter((part) => part != null).join(\": \");\n}\n"],"mappings":";;;;;AAIA,MAAa,YAAY;AAIzB,MAAa,SAAS;CACpB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAqBA,SAAS,sBAAsB,WAA2B;CACxD,OAAO,GAAG,UAAU;AACtB;AAEA,SAAS,cAAc,WAA2B;CAChD,OAAO,GAAG,UAAU;AACtB;AAEA,SAAS,mBAAmB,WAA2B;CACrD,OAAO,GAAG,UAAU;AACtB;AAEA,SAAS,QAAQ,WAA2B;CAC1C,OAAO,GAAG,UAAU;AACtB;AAEA,SAAgB,sBAAsB,QAM3B;CACT,MAAM,MAAM,IAAI,IAAI,sBAAsB,OAAO,SAAS,CAAC;CAC3D,IAAI,aAAa,IAAI,iBAAiB,MAAM;CAC5C,IAAI,aAAa,IAAI,aAAa,SAAS;CAC3C,IAAI,aAAa,IAAI,gBAAgB,OAAO,WAAW;CACvD,IAAI,aAAa,IAAI,SAAS,OAAO,KAAK,GAAG,CAAC;CAC9C,IAAI,aAAa,IAAI,SAAS,OAAO,KAAK;CAC1C,IAAI,aAAa,IAAI,kBAAkB,OAAO,aAAa;CAC3D,IAAI,aAAa,IAAI,yBAAyB,OAAO,mBAAmB;CACxE,OAAO,IAAI,SAAS;AACtB;AAEA,MAAM,sBAAsB,EAAE,KAC5B,EAAE,OAAO;CACP,cAAc,EAAE,OAAO;CACvB,eAAe,EAAE,OAAO;CACxB,UAAU,EAAE,OAAO;CACnB,YAAY,EAAE,OAAO;CACrB,OAAO,EAAE,OAAO;AAClB,CAAC,GACD,EAAE,WACC,SAAmB;CAClB,aAAa,IAAI;CACjB,cAAc,IAAI;CAClB,SAAS,IAAI;CACb,OAAO,IAAI;CACX,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,aAAa,GAAI,CAAC,CAAC,YAAY;AACtE,EACF,CACF;AAEA,MAAM,mBAAmB,EAAE,OAAO;CAChC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;CAC5B,mBAAmB,EAAE,SAAS,EAAE,OAAO,CAAC;AAC1C,CAAC;AAID,eAAe,UACb,WACA,MACsD;CACtD,MAAM,WAAW,MAAM,MAAM,cAAc,SAAS,GAAG;EACrD,QAAQ;EACR,SAAS,EAAE,gBAAgB,oCAAoC;EAC/D;CACF,CAAC;CAED,IAAI,SAAS,UAAU,KACrB,MAAM,IAAI,MAAM,2BAA2B,SAAS,QAAQ;CAG9D,MAAM,OAAgB,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,MAAS;CAEjE,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,SAAS,kBAAkB,IAAI,KAAK,QAAQ,SAAS;EAC3D,OAAO,OAAO,KAAK;GAAE,MAAM;GAAyB;EAAO,CAAC;CAC9D;CAEA,MAAM,SAAS,EAAE,UAAU,qBAAqB,IAAI;CACpD,IAAI,CAAC,OAAO,SACV,OAAO,OAAO,KAAK;EACjB,MAAM;EACN,QAAQ;CACV,CAAC;CAGH,OAAO,OAAO,QAAQ,OAAO,MAAM;AACrC;AAEA,SAAgB,aAAa,QAK4B;CACvD,MAAM,OAAO,IAAI,gBAAgB;EAC/B,YAAY;EACZ,MAAM,OAAO;EACb,cAAc,OAAO;EACrB,WAAW;EACX,eAAe,OAAO;CACxB,CAAC;CACD,OAAO,UAAU,OAAO,WAAW,IAAI;AACzC;AAEA,SAAgB,cAAc,QAG2B;CACvD,MAAM,OAAO,IAAI,gBAAgB;EAC/B,YAAY;EACZ,eAAe,OAAO;EACtB,WAAW;CACb,CAAC;CACD,OAAO,UAAU,OAAO,WAAW,IAAI;AACzC;AAEA,eAAsB,cACpB,WACA,SACwB;CAExB,MAAM,EAAE,YAAY,MAAM,UAAU,SADvB,mBAAmB,IAAI,IAAI,QAAQ,SAAS,CAAC,CACV,GAAG;EACjD,QAAQ;EACR,UAAU;CACZ,CAAC;CACD,OAAO;EACL,SAAS,QAAQ,OAAO;EACxB,MAAM,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;EACxD,OAAO,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ;CAC7D;AACF;AAGA,eAAsB,YACpB,WACA,cACe;CACf,MAAM,MAAM,mBAAmB,SAAS,GAAG;EACzC,QAAQ;EACR,SAAS,EAAE,gBAAgB,oCAAoC;EAC/D,MAAM,IAAI,gBAAgB;GAAE,OAAO;GAAc,WAAW;EAAU,CAAC;CACzE,CAAC;AACH;AAEA,SAAS,kBAAkB,OAAoC;CAC7D,MAAM,SAAS,EAAE,UAAU,kBAAkB,KAAK;CAClD,IAAI,CAAC,OAAO,SAAS,OAAO;CAC5B,MAAM,EAAE,OAAO,sBAAsB,OAAO;CAC5C,IAAI,SAAS,QAAQ,qBAAqB,MAAM,OAAO;CACvD,OAAO,CAAC,OAAO,iBAAiB,CAAC,CAAC,QAAQ,SAAS,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI;AAC5E"}

package/dist/object-DVqidsEc.cjs

@@ -0,0 +1,20 @@
+const require_cli_main = require('./cli/main.cjs');
+
+//#region src/cli/commands/bucket/object/index.ts
+var object_default = require_cli_main.defineCommand({
+	meta: {
+		name: "object",
+		description: "Manage objects in a bucket"
+	},
+	subCommands: {
+		list: () => Promise.resolve().then(() => require("./list-BzLraBnA.cjs")).then((m) => m.default),
+		get: () => Promise.resolve().then(() => require("./get-jwXRlIBJ.cjs")).then((m) => m.default),
+		upload: () => Promise.resolve().then(() => require("./upload-C43ZXxyb.cjs")).then((m) => m.default),
+		download: () => Promise.resolve().then(() => require("./download-ogGbb3FU.cjs")).then((m) => m.default),
+		delete: () => Promise.resolve().then(() => require("./delete-DozSxZQ7.cjs")).then((m) => m.default)
+	}
+});
+
+//#endregion
+exports.default = object_default;
+//# sourceMappingURL=object-DVqidsEc.cjs.map

package/dist/object-DVqidsEc.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-DVqidsEc.cjs","names":["defineCommand"],"sources":["../src/cli/commands/bucket/object/index.ts"],"sourcesContent":["import { defineCommand } from \"../../define-command.js\";\n\nexport default defineCommand({\n  meta: {\n    name: \"object\",\n    description: \"Manage objects in a bucket\",\n  },\n  subCommands: {\n    list: () => import(\"./list.js\").then((m) => m.default),\n    get: () => import(\"./get.js\").then((m) => m.default),\n    upload: () => import(\"./upload.js\").then((m) => m.default),\n    download: () => import(\"./download.js\").then((m) => m.default),\n    delete: () => import(\"./delete.js\").then((m) => m.default),\n  },\n});\n"],"mappings":";;;AAEA,qBAAeA,+BAAc;CAC3B,MAAM;EACJ,MAAM;EACN,aAAa;CACf;CACA,aAAa;EACX,iDAAY,wBAAoB,MAAM,MAAM,EAAE,OAAO;EACrD,gDAAW,uBAAmB,MAAM,MAAM,EAAE,OAAO;EACnD,mDAAc,0BAAsB,MAAM,MAAM,EAAE,OAAO;EACzD,qDAAgB,4BAAwB,MAAM,MAAM,EAAE,OAAO;EAC7D,mDAAc,0BAAsB,MAAM,MAAM,EAAE,OAAO;CAC3D;AACF,CAAC"}

package/dist/object-qdBdEghr.mjs

@@ -0,0 +1,20 @@
+import { t as defineCommand } from "./cli/main.mjs";
+
+//#region src/cli/commands/bucket/object/index.ts
+var object_default = defineCommand({
+	meta: {
+		name: "object",
+		description: "Manage objects in a bucket"
+	},
+	subCommands: {
+		list: () => import("./list-vbMaOiza.mjs").then((m) => m.default),
+		get: () => import("./get-DBxhbN1G.mjs").then((m) => m.default),
+		upload: () => import("./upload-DGgJ1TQk.mjs").then((m) => m.default),
+		download: () => import("./download-oFGzg30E.mjs").then((m) => m.default),
+		delete: () => import("./delete-BSLIXrAh.mjs").then((m) => m.default)
+	}
+});
+
+//#endregion
+export { object_default as default };
+//# sourceMappingURL=object-qdBdEghr.mjs.map

package/dist/object-qdBdEghr.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-qdBdEghr.mjs","names":[],"sources":["../src/cli/commands/bucket/object/index.ts"],"sourcesContent":["import { defineCommand } from \"../../define-command.js\";\n\nexport default defineCommand({\n  meta: {\n    name: \"object\",\n    description: \"Manage objects in a bucket\",\n  },\n  subCommands: {\n    list: () => import(\"./list.js\").then((m) => m.default),\n    get: () => import(\"./get.js\").then((m) => m.default),\n    upload: () => import(\"./upload.js\").then((m) => m.default),\n    download: () => import(\"./download.js\").then((m) => m.default),\n    delete: () => import(\"./delete.js\").then((m) => m.default),\n  },\n});\n"],"mappings":";;;AAEA,qBAAe,cAAc;CAC3B,MAAM;EACJ,MAAM;EACN,aAAa;CACf;CACA,aAAa;EACX,YAAY,OAAO,sBAAY,CAAC,MAAM,MAAM,EAAE,OAAO;EACrD,WAAW,OAAO,qBAAW,CAAC,MAAM,MAAM,EAAE,OAAO;EACnD,cAAc,OAAO,wBAAc,CAAC,MAAM,MAAM,EAAE,OAAO;EACzD,gBAAgB,OAAO,0BAAgB,CAAC,MAAM,MAAM,EAAE,OAAO;EAC7D,cAAc,OAAO,wBAAc,CAAC,MAAM,MAAM,EAAE,OAAO;CAC3D;AACF,CAAC"}

package/dist/org-C4cVovOM.cjs

@@ -0,0 +1,14 @@
+const require_cli_main = require('./cli/main.cjs');
+
+//#region src/cli/commands/org/index.ts
+var org_default = require_cli_main.defineCommand({
+	meta: {
+		name: "org",
+		description: "Work with organizations"
+	},
+	subCommands: { list: () => Promise.resolve().then(() => require("./list-BRh59EqI.cjs")).then((m) => m.default) }
+});
+
+//#endregion
+exports.default = org_default;
+//# sourceMappingURL=org-C4cVovOM.cjs.map

package/dist/org-C4cVovOM.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-C4cVovOM.cjs","names":["defineCommand"],"sources":["../src/cli/commands/org/index.ts"],"sourcesContent":["import { defineCommand } from \"../define-command.js\";\n\nexport default defineCommand({\n  meta: {\n    name: \"org\",\n    description: \"Work with organizations\",\n  },\n  subCommands: {\n    list: () => import(\"./list.js\").then((m) => m.default),\n  },\n});\n"],"mappings":";;;AAEA,kBAAeA,+BAAc;CAC3B,MAAM;EACJ,MAAM;EACN,aAAa;CACf;CACA,aAAa,EACX,iDAAY,wBAAoB,MAAM,MAAM,EAAE,OAAO,EACvD;AACF,CAAC"}

package/dist/org-CPhTRTks.mjs

@@ -0,0 +1,14 @@
+import { t as defineCommand } from "./cli/main.mjs";
+
+//#region src/cli/commands/org/index.ts
+var org_default = defineCommand({
+	meta: {
+		name: "org",
+		description: "Work with organizations"
+	},
+	subCommands: { list: () => import("./list-CbvEh7eA.mjs").then((m) => m.default) }
+});
+
+//#endregion
+export { org_default as default };
+//# sourceMappingURL=org-CPhTRTks.mjs.map

package/dist/org-CPhTRTks.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-CPhTRTks.mjs","names":[],"sources":["../src/cli/commands/org/index.ts"],"sourcesContent":["import { defineCommand } from \"../define-command.js\";\n\nexport default defineCommand({\n  meta: {\n    name: \"org\",\n    description: \"Work with organizations\",\n  },\n  subCommands: {\n    list: () => import(\"./list.js\").then((m) => m.default),\n  },\n});\n"],"mappings":";;;AAEA,kBAAe,cAAc;CAC3B,MAAM;EACJ,MAAM;EACN,aAAa;CACf;CACA,aAAa,EACX,YAAY,OAAO,sBAAY,CAAC,MAAM,MAAM,EAAE,OAAO,EACvD;AACF,CAAC"}

package/dist/org-context-Bewx2NEW.cjs

@@ -0,0 +1,30 @@
+const require_run_with_context = require('./run-with-context-DJNnEigg.cjs');
+let _praha_byethrow = require("@praha/byethrow");
+
+//#region src/cli/commands/org-context.ts
+async function resolveOrganizationIdFromArgs(params) {
+	const name = await require_run_with_context.resolveOrganizationName({
+		flag: params.flag,
+		cwd: params.cwd
+	});
+	if (_praha_byethrow.Result.isFailure(name)) switch (name.error.type) {
+		case "project_json_invalid": return _praha_byethrow.Result.fail({ message: `Invalid project file: ${name.error.path}` });
+		case "no_project_context":
+		case "no_organization_context": return _praha_byethrow.Result.fail({ message: "No organization selected. Run `orizm link` or pass --organization <name>." });
+	}
+	const id = await require_run_with_context.resolveOrganizationId(params.client, name.value);
+	if (_praha_byethrow.Result.isFailure(id)) {
+		if (id.error.type === "organization_not_found") return _praha_byethrow.Result.fail({ message: `Organization not found: ${id.error.name}` });
+		return require_run_with_context.apiErrorFailure(id.error);
+	}
+	return _praha_byethrow.Result.succeed(id.value);
+}
+
+//#endregion
+Object.defineProperty(exports, 'resolveOrganizationIdFromArgs', {
+  enumerable: true,
+  get: function () {
+    return resolveOrganizationIdFromArgs;
+  }
+});
+//# sourceMappingURL=org-context-Bewx2NEW.cjs.map

package/dist/org-context-Bewx2NEW.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-context-Bewx2NEW.cjs","names":["resolveOrganizationName","Result","resolveOrganizationId","apiErrorFailure"],"sources":["../src/cli/commands/org-context.ts"],"sourcesContent":["import { Result } from \"@praha/byethrow\";\nimport type { DeveloperApiClient } from \"../api/client.js\";\nimport {\n  resolveOrganizationId,\n  type OrganizationId,\n} from \"../api/organizations.js\";\nimport { resolveOrganizationName } from \"../context/project.js\";\nimport { apiErrorFailure } from \"./api-errors.js\";\nimport type { CommandFailure } from \"./define-command.js\";\n\n// project list / create が --organization or .orizm/project.json から org id を解決する共通経路。\n// 解決失敗を user-facing メッセージへ畳む。\nexport async function resolveOrganizationIdFromArgs(params: {\n  client: DeveloperApiClient;\n  flag?: string;\n  cwd?: string;\n}): Promise<Result.Result<OrganizationId, CommandFailure>> {\n  const name = await resolveOrganizationName({\n    flag: params.flag,\n    cwd: params.cwd,\n  });\n  if (Result.isFailure(name)) {\n    switch (name.error.type) {\n      case \"project_json_invalid\":\n        return Result.fail({\n          message: `Invalid project file: ${name.error.path}`,\n        });\n      case \"no_project_context\":\n      case \"no_organization_context\":\n        return Result.fail({\n          message:\n            \"No organization selected. Run `orizm link` or pass --organization <name>.\",\n        });\n    }\n  }\n\n  const id = await resolveOrganizationId(params.client, name.value);\n  if (Result.isFailure(id)) {\n    if (id.error.type === \"organization_not_found\") {\n      return Result.fail({\n        message: `Organization not found: ${id.error.name}`,\n      });\n    }\n    return apiErrorFailure(id.error);\n  }\n  return Result.succeed(id.value);\n}\n"],"mappings":";;;;AAYA,eAAsB,8BAA8B,QAIO;CACzD,MAAM,OAAO,MAAMA,iDAAwB;EACzC,MAAM,OAAO;EACb,KAAK,OAAO;CACd,CAAC;CACD,IAAIC,uBAAO,UAAU,IAAI,GACvB,QAAQ,KAAK,MAAM,MAAnB;EACE,KAAK,wBACH,OAAOA,uBAAO,KAAK,EACjB,SAAS,yBAAyB,KAAK,MAAM,OAC/C,CAAC;EACH,KAAK;EACL,KAAK,2BACH,OAAOA,uBAAO,KAAK,EACjB,SACE,4EACJ,CAAC;CACL;CAGF,MAAM,KAAK,MAAMC,+CAAsB,OAAO,QAAQ,KAAK,KAAK;CAChE,IAAID,uBAAO,UAAU,EAAE,GAAG;EACxB,IAAI,GAAG,MAAM,SAAS,0BACpB,OAAOA,uBAAO,KAAK,EACjB,SAAS,2BAA2B,GAAG,MAAM,OAC/C,CAAC;EAEH,OAAOE,yCAAgB,GAAG,KAAK;CACjC;CACA,OAAOF,uBAAO,QAAQ,GAAG,KAAK;AAChC"}

package/dist/org-context-D0dwWC2M.mjs

@@ -0,0 +1,25 @@
+import { a as apiErrorFailure, d as resolveOrganizationName, l as resolveOrganizationId } from "./run-with-context-CVhmzAFZ.mjs";
+import { Result } from "@praha/byethrow";
+
+//#region src/cli/commands/org-context.ts
+async function resolveOrganizationIdFromArgs(params) {
+	const name = await resolveOrganizationName({
+		flag: params.flag,
+		cwd: params.cwd
+	});
+	if (Result.isFailure(name)) switch (name.error.type) {
+		case "project_json_invalid": return Result.fail({ message: `Invalid project file: ${name.error.path}` });
+		case "no_project_context":
+		case "no_organization_context": return Result.fail({ message: "No organization selected. Run `orizm link` or pass --organization <name>." });
+	}
+	const id = await resolveOrganizationId(params.client, name.value);
+	if (Result.isFailure(id)) {
+		if (id.error.type === "organization_not_found") return Result.fail({ message: `Organization not found: ${id.error.name}` });
+		return apiErrorFailure(id.error);
+	}
+	return Result.succeed(id.value);
+}
+
+//#endregion
+export { resolveOrganizationIdFromArgs as t };
+//# sourceMappingURL=org-context-D0dwWC2M.mjs.map