@parix/cli 0.1.5

package/README.md

@@ -0,0 +1,123 @@
+# parix
+
+`parix` is the Parix command line interface.
+
+## Install
+
+```bash
+npm install -g @parix/cli
+parix --help
+```
+
+Current commands:
+
+- `parix auth login`
+- `parix auth status`
+- `parix auth logout`
+- `parix api <path>`
+- `parix database catalog`
+- `parix database create <database>`
+- `parix database list`
+- `parix database info <database-id>`
+- `parix database remove <database-id>`
+- `parix tb create-accounts <database-id>`
+- `parix tb create-transfers <database-id>`
+- `parix tb lookup-accounts <database-id>`
+- `parix tb lookup-transfers <database-id>`
+- `parix tb get-account-transfers <database-id>`
+- `parix tb get-account-balances <database-id>`
+- `parix tb query-accounts <database-id>`
+- `parix tb query-transfers <database-id>`
+
+## Auth flow
+
+- Starts a local loopback callback server on `127.0.0.1`
+- Starts the Better Auth OIDC flow for the first-party `parix` client
+- Opens the browser authorization flow with PKCE
+- Forces the Better Auth consent screen on every `parix auth login`
+- Receives an authorization code through the local callback
+- Redirects the browser to the Parix success page at `/cli-oauth-consent-granted`
+- Exchanges the code for access and refresh tokens
+- Stores the local session at `~/.config/parix/session.json`
+
+`parix auth status` validates the stored session, refreshes tokens if needed, and prints the authenticated user plus active organization context.
+
+If you want to override the OIDC prompt manually, use `--prompt <value>`.
+
+## Database commands
+
+- `parix database catalog`: show the available provider, region, cluster config, cluster size, and storage tier options for database creation
+- `parix database create <database>`: create a database in the active organization, using defaults or explicit `--provider`, `--region`, `--cluster-config-id`, `--cluster-size-id`, `--storage-tier-id`, and `--storage-gb` inputs
+- `parix database list`: list databases in the active organization, including database IDs, with optional `--search`, `--limit`, and `--json`
+- `parix database info <database-id>`: show database metadata, profile state, gateway URL, latest provision job, and metrics summary
+- `parix database remove <database-id>`: queue database removal; use `--yes` for non-interactive runs
+
+## TigerBeetle commands
+
+Supported operations:
+
+- `create-accounts`
+- `create-transfers`
+- `lookup-accounts`
+- `lookup-transfers`
+- `get-account-transfers`
+- `get-account-balances`
+- `query-accounts`
+- `query-transfers`
+
+TigerBeetle commands support both styles:
+
+- flag-driven payloads for common workflows such as `--from`, `--to`, `--amount`, `--ledger`, `--code`, repeated `--id`, and repeated `--flag`
+- raw JSON overrides with `--payload '<json>'` or `--file ./payload.json`
+
+Operational notes:
+
+- database and TB commands use the active organization from the current `parix` token
+- `db:read` and `db:write` OIDC scopes are enforced on the Worker API surface
+- newly provisioned databases may take a short time to become ready for TB operations; the CLI/API includes readiness retries for fresh databases
+
+## Development
+
+```bash
+bun install
+bun run build
+bun run test
+bun run typecheck
+bun run cli -- auth login --base-url http://localhost:5173
+bun run cli -- auth status --base-url http://localhost:5173
+bun run cli -- api /api/v1/session --base-url http://localhost:5173
+bun run cli -- database catalog --json
+bun run cli -- database create demo-ledger --provider gcp --region asia-southeast1 --json
+bun run cli -- database list --json
+bun run cli -- database info <database-id>
+bun run cli -- database remove <database-id> --yes --json
+bun run cli -- tb query-accounts <database-id> --limit 10 --json
+bun run cli -- tb create-transfers <database-id> --from 1000 --to 1001 --amount 1 --ledger 1 --code 1
+```
+
+By default, the CLI targets `https://parix.io`. You can override the target app URL with `--base-url`
+or `PARIX_BASE_URL`.
+
+## Publishing
+
+```bash
+bun run publish:check
+bun run publish:npm
+```
+
+`publish:check` runs formatting, linting, tests, type checking, a fresh build, and `npm pack --dry-run` using a repo-local npm cache directory. `publish:npm` publishes the package publicly to npmjs.com using that same local cache.
+
+## GitHub Actions
+
+- `.github/workflows/ci.yml` runs lint, tests, typecheck, build, and `npm pack --dry-run` on pushes and pull requests
+- `.github/workflows/publish.yml` publishes to npm when a GitHub Release is published, using the `NPM_ACCESS_TOKEN` secret, and uploads the published npm tarball to the GitHub Release
+
+Recommended release flow:
+
+```bash
+# bump version in package.json
+git tag v0.1.2
+git push origin main --tags
+```
+
+Then publish a GitHub Release from tag `v0.1.2`. The publish workflow verifies that the release tag matches `package.json`, packs the npm tarball, publishes that tarball to npm, and uploads the same `.tgz` as a GitHub Release asset.

package/dist/cli.cjs

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const prompts_1 = require("@clack/prompts");
+const commander_1 = require("commander");
+const node_module_1 = require("node:module");
+const api_1 = require("./commands/api.cjs");
+const auth_1 = require("./commands/auth.cjs");
+const database_1 = require("./commands/database.cjs");
+const tb_1 = require("./commands/tb.cjs");
+const loadPackageJson = (0, node_module_1.createRequire)(require("url").pathToFileURL(__filename));
+const packageJson = loadPackageJson('../package.json');
+async function main() {
+    const program = new commander_1.Command();
+    program
+        .name('parix')
+        .version(packageJson.version, '-v, --version')
+        .description('Parix command line interface')
+        .showHelpAfterError()
+        .addCommand((0, auth_1.createAuthCommand)())
+        .addCommand((0, api_1.createApiCommand)())
+        .addCommand((0, database_1.createDatabaseCommand)())
+        .addCommand((0, tb_1.createTbCommand)());
+    await program.parseAsync(process.argv);
+}
+main().catch((error) => {
+    const message = error instanceof Error ? error.message : String(error);
+    prompts_1.log.error(message);
+    process.exitCode = 1;
+});

package/dist/cli.d.cts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+import { log } from '@clack/prompts';
+import { Command } from 'commander';
+import { createRequire } from 'node:module';
+import { createApiCommand } from "./commands/api.js";
+import { createAuthCommand } from "./commands/auth.js";
+import { createDatabaseCommand } from "./commands/database.js";
+import { createTbCommand } from "./commands/tb.js";
+const loadPackageJson = createRequire(import.meta.url);
+const packageJson = loadPackageJson('../package.json');
+async function main() {
+    const program = new Command();
+    program
+        .name('parix')
+        .version(packageJson.version, '-v, --version')
+        .description('Parix command line interface')
+        .showHelpAfterError()
+        .addCommand(createAuthCommand())
+        .addCommand(createApiCommand())
+        .addCommand(createDatabaseCommand())
+        .addCommand(createTbCommand());
+    await program.parseAsync(process.argv);
+}
+main().catch((error) => {
+    const message = error instanceof Error ? error.message : String(error);
+    log.error(message);
+    process.exitCode = 1;
+});

package/dist/commands/api.cjs

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createApiCommand = createApiCommand;
+const prompts_1 = require("@clack/prompts");
+const commander_1 = require("commander");
+const api_client_1 = require("../lib/api-client.cjs");
+const config_1 = require("../lib/config.cjs");
+const session_1 = require("../lib/session.cjs");
+function createApiCommand() {
+    return new commander_1.Command('api')
+        .description('Make an authenticated API request with the stored bearer token')
+        .argument('<path>', 'Relative API path or absolute URL')
+        .option('-X, --method <method>', 'HTTP method', 'GET')
+        .option('-d, --body <body>', 'Raw request body')
+        .option('-H, --header <header>', 'Additional header in key:value form', collectValues, [])
+        .option('-b, --base-url <url>', 'Override the stored base URL')
+        .action(async (requestPath, options) => {
+        await handleApiRequest(requestPath, options);
+    });
+}
+async function handleApiRequest(requestPath, options) {
+    const storedSession = await (0, session_1.readStoredSession)();
+    if (!storedSession) {
+        throw new Error('No local session found. Run `parix auth login` first.');
+    }
+    const baseUrl = (0, config_1.resolveBaseUrl)(options.baseUrl, storedSession);
+    const headers = parseHeaders(options.header ?? []);
+    const body = options.body ?? undefined;
+    if (body && !hasHeader(headers, 'content-type')) {
+        headers.set('content-type', 'application/json');
+    }
+    const client = new api_client_1.ApiClient({
+        session: {
+            ...storedSession,
+            baseUrl,
+        },
+    });
+    const response = await client.request(requestPath, {
+        method: options.method ?? 'GET',
+        headers,
+        body,
+    });
+    const contentType = response.headers.get('content-type') ?? 'unknown';
+    const payload = await response.text();
+    (0, prompts_1.note)([`Status: ${response.status} ${response.statusText}`, `Content-Type: ${contentType}`].join('\n'), 'Response');
+    if (contentType.includes('application/json') && payload.length > 0) {
+        try {
+            prompts_1.log.message(JSON.stringify(JSON.parse(payload), null, 2));
+            (0, prompts_1.outro)('Request completed');
+            return;
+        }
+        catch { }
+    }
+    if (payload.length > 0) {
+        prompts_1.log.message(payload);
+    }
+    (0, prompts_1.outro)('Request completed');
+}
+function collectValues(value, previous) {
+    previous.push(value);
+    return previous;
+}
+function parseHeaders(values) {
+    const headers = new Headers();
+    for (const value of values) {
+        const separatorIndex = value.indexOf(':');
+        if (separatorIndex <= 0) {
+            throw new Error(`Invalid header format: ${value}. Use key:value.`);
+        }
+        const key = value.slice(0, separatorIndex).trim();
+        const headerValue = value.slice(separatorIndex + 1).trim();
+        if (!key) {
+            throw new Error(`Invalid header name: ${value}`);
+        }
+        headers.set(key, headerValue);
+    }
+    return headers;
+}
+function hasHeader(headers, name) {
+    return headers.has(name) || headers.has(name.toLowerCase());
+}

package/dist/commands/api.d.cts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare function createApiCommand(): Command;

package/dist/commands/api.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare function createApiCommand(): Command;

package/dist/commands/api.js

@@ -0,0 +1,78 @@
+import { log, note, outro } from '@clack/prompts';
+import { Command } from 'commander';
+import { ApiClient } from "../lib/api-client.js";
+import { resolveBaseUrl } from "../lib/config.js";
+import { readStoredSession } from "../lib/session.js";
+export function createApiCommand() {
+    return new Command('api')
+        .description('Make an authenticated API request with the stored bearer token')
+        .argument('<path>', 'Relative API path or absolute URL')
+        .option('-X, --method <method>', 'HTTP method', 'GET')
+        .option('-d, --body <body>', 'Raw request body')
+        .option('-H, --header <header>', 'Additional header in key:value form', collectValues, [])
+        .option('-b, --base-url <url>', 'Override the stored base URL')
+        .action(async (requestPath, options) => {
+        await handleApiRequest(requestPath, options);
+    });
+}
+async function handleApiRequest(requestPath, options) {
+    const storedSession = await readStoredSession();
+    if (!storedSession) {
+        throw new Error('No local session found. Run `parix auth login` first.');
+    }
+    const baseUrl = resolveBaseUrl(options.baseUrl, storedSession);
+    const headers = parseHeaders(options.header ?? []);
+    const body = options.body ?? undefined;
+    if (body && !hasHeader(headers, 'content-type')) {
+        headers.set('content-type', 'application/json');
+    }
+    const client = new ApiClient({
+        session: {
+            ...storedSession,
+            baseUrl,
+        },
+    });
+    const response = await client.request(requestPath, {
+        method: options.method ?? 'GET',
+        headers,
+        body,
+    });
+    const contentType = response.headers.get('content-type') ?? 'unknown';
+    const payload = await response.text();
+    note([`Status: ${response.status} ${response.statusText}`, `Content-Type: ${contentType}`].join('\n'), 'Response');
+    if (contentType.includes('application/json') && payload.length > 0) {
+        try {
+            log.message(JSON.stringify(JSON.parse(payload), null, 2));
+            outro('Request completed');
+            return;
+        }
+        catch { }
+    }
+    if (payload.length > 0) {
+        log.message(payload);
+    }
+    outro('Request completed');
+}
+function collectValues(value, previous) {
+    previous.push(value);
+    return previous;
+}
+function parseHeaders(values) {
+    const headers = new Headers();
+    for (const value of values) {
+        const separatorIndex = value.indexOf(':');
+        if (separatorIndex <= 0) {
+            throw new Error(`Invalid header format: ${value}. Use key:value.`);
+        }
+        const key = value.slice(0, separatorIndex).trim();
+        const headerValue = value.slice(separatorIndex + 1).trim();
+        if (!key) {
+            throw new Error(`Invalid header name: ${value}`);
+        }
+        headers.set(key, headerValue);
+    }
+    return headers;
+}
+function hasHeader(headers, name) {
+    return headers.has(name) || headers.has(name.toLowerCase());
+}

package/dist/commands/auth.cjs

@@ -0,0 +1,128 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAuthCommand = createAuthCommand;
+const prompts_1 = require("@clack/prompts");
+const commander_1 = require("commander");
+const config_1 = require("../lib/config.cjs");
+const loopback_server_1 = require("../lib/loopback-server.cjs");
+const oauth_1 = require("../lib/oauth.cjs");
+const oauth_api_1 = require("../lib/oauth-api.cjs");
+const oauth_session_1 = require("../lib/oauth-session.cjs");
+const open_url_1 = require("../lib/open-url.cjs");
+const session_1 = require("../lib/session.cjs");
+const DEFAULT_OIDC_PROMPT = 'consent';
+function createAuthCommand() {
+    const auth = new commander_1.Command('auth').description('Authenticate with Parix');
+    auth
+        .command('login')
+        .description('Sign in with OAuth consent and PKCE')
+        .option('-b, --base-url <url>', 'Parix base URL')
+        .option('-p, --port <port>', 'Loopback callback port', config_1.parsePortOption)
+        .option('--prompt <prompt>', 'OAuth prompt override', DEFAULT_OIDC_PROMPT)
+        .action(async (options) => {
+        await handleLogin(options);
+    });
+    auth
+        .command('status')
+        .description('Show the current authenticated session')
+        .option('-b, --base-url <url>', 'Override the stored base URL')
+        .action(async (options) => {
+        await handleStatus(options);
+    });
+    auth
+        .command('logout')
+        .description('Remove the local session file')
+        .action(async () => {
+        await (0, session_1.clearStoredSession)();
+        (0, prompts_1.outro)(`Removed local session at ${session_1.SESSION_FILE_PATH}`);
+    });
+    return auth;
+}
+async function handleLogin(options) {
+    (0, prompts_1.intro)('Parix sign in');
+    const storedSession = await (0, session_1.readStoredSession)();
+    const baseUrl = (0, config_1.resolveBaseUrl)(options.baseUrl, storedSession, { useStoredSession: false });
+    const loopbackServer = await (0, loopback_server_1.startLoopbackServer)({
+        callbackPath: oauth_1.PARIX_LOCAL_CALLBACK_PATH,
+        port: options.port,
+        successPage: {
+            redirectUrl: new URL(oauth_1.CLI_OAUTH_CONSENT_GRANTED_PATH, baseUrl).toString(),
+        },
+        timeoutMs: config_1.LOGIN_TIMEOUT_MS,
+    });
+    try {
+        const pkcePair = (0, oauth_1.createPkcePair)();
+        const state = (0, oauth_1.buildCliState)(loopbackServer.callbackUrl);
+        loopbackServer.setState(state);
+        const browserUrl = (0, oauth_1.buildAuthorizeUrl)({
+            baseUrl,
+            codeChallenge: pkcePair.codeChallenge,
+            prompt: options.prompt,
+            state,
+        });
+        const prepareSpinner = (0, prompts_1.spinner)();
+        prepareSpinner.start('Preparing browser sign-in');
+        prepareSpinner.stop('Browser sign-in ready');
+        const opened = await (0, open_url_1.openUrlInBrowser)(browserUrl);
+        (0, prompts_1.note)(opened ? browserUrl : `Open this URL manually:\n${browserUrl}`, opened ? 'Opened browser URL' : 'Manual browser URL');
+        const waitSpinner = (0, prompts_1.spinner)();
+        waitSpinner.start('Waiting for browser callback');
+        const callbackResult = await loopbackServer.waitForResult();
+        waitSpinner.stop('Received browser callback');
+        const tokenSet = await (0, oauth_api_1.exchangeAuthorizationCode)({
+            baseUrl,
+            code: callbackResult.code,
+            codeVerifier: pkcePair.codeVerifier,
+        });
+        const nextSession = await (0, oauth_session_1.createStoredSession)({
+            baseUrl,
+            createdAt: storedSession?.createdAt,
+            tokenSet,
+        });
+        await (0, session_1.writeStoredSession)(nextSession);
+        (0, prompts_1.note)(session_1.SESSION_FILE_PATH, 'Stored session file');
+        (0, prompts_1.outro)(`Signed in as ${formatUserLabel(nextSession.user)}`);
+    }
+    finally {
+        await loopbackServer.close().catch(() => { });
+    }
+}
+async function handleStatus(options) {
+    (0, prompts_1.intro)('Parix auth status');
+    const storedSession = await (0, session_1.readStoredSession)();
+    if (!storedSession) {
+        prompts_1.log.warn(`No local session found at ${session_1.SESSION_FILE_PATH}`);
+        process.exitCode = 1;
+        return;
+    }
+    const baseUrl = (0, config_1.resolveBaseUrl)(options.baseUrl, storedSession);
+    try {
+        const refreshedSession = await (0, oauth_session_1.hydrateStoredSessionOrganization)(await (0, oauth_session_1.ensureFreshSession)({
+            ...storedSession,
+            baseUrl,
+        }));
+        const userInfo = await (0, oauth_api_1.fetchOAuthUserInfo)({
+            accessToken: refreshedSession.accessToken,
+            baseUrl,
+        });
+        (0, prompts_1.note)([
+            `User: ${userInfo.email ?? formatUserLabel(refreshedSession.user)}`,
+            `Base URL: ${baseUrl}`,
+            `Expires: ${refreshedSession.accessTokenExpiresAt}`,
+            `Scopes: ${refreshedSession.scopes.join(', ')}`,
+            `Organization: ${refreshedSession.organization.name ?? 'none'}`,
+            `Organization slug: ${refreshedSession.organization.slug ?? 'none'}`,
+            `Member role: ${refreshedSession.organization.memberRole ?? 'none'}`,
+            `Session file: ${session_1.SESSION_FILE_PATH}`,
+        ].join('\n'), 'Authenticated session');
+        (0, prompts_1.outro)('Session is valid');
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        prompts_1.log.warn(`Stored session is invalid: ${message}`);
+        process.exitCode = 1;
+    }
+}
+function formatUserLabel(user) {
+    return user.email ?? user.name ?? user.id;
+}

package/dist/commands/auth.d.cts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare function createAuthCommand(): Command;

package/dist/commands/auth.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare function createAuthCommand(): Command;

package/dist/commands/auth.js

@@ -0,0 +1,125 @@
+import { intro, log, note, outro, spinner } from '@clack/prompts';
+import { Command } from 'commander';
+import { LOGIN_TIMEOUT_MS, parsePortOption, resolveBaseUrl } from "../lib/config.js";
+import { startLoopbackServer } from "../lib/loopback-server.js";
+import { buildAuthorizeUrl, buildCliState, CLI_OAUTH_CONSENT_GRANTED_PATH, createPkcePair, PARIX_LOCAL_CALLBACK_PATH, } from "../lib/oauth.js";
+import { exchangeAuthorizationCode, fetchOAuthUserInfo } from "../lib/oauth-api.js";
+import { createStoredSession, ensureFreshSession, hydrateStoredSessionOrganization } from "../lib/oauth-session.js";
+import { openUrlInBrowser } from "../lib/open-url.js";
+import { clearStoredSession, readStoredSession, SESSION_FILE_PATH, writeStoredSession } from "../lib/session.js";
+const DEFAULT_OIDC_PROMPT = 'consent';
+export function createAuthCommand() {
+    const auth = new Command('auth').description('Authenticate with Parix');
+    auth
+        .command('login')
+        .description('Sign in with OAuth consent and PKCE')
+        .option('-b, --base-url <url>', 'Parix base URL')
+        .option('-p, --port <port>', 'Loopback callback port', parsePortOption)
+        .option('--prompt <prompt>', 'OAuth prompt override', DEFAULT_OIDC_PROMPT)
+        .action(async (options) => {
+        await handleLogin(options);
+    });
+    auth
+        .command('status')
+        .description('Show the current authenticated session')
+        .option('-b, --base-url <url>', 'Override the stored base URL')
+        .action(async (options) => {
+        await handleStatus(options);
+    });
+    auth
+        .command('logout')
+        .description('Remove the local session file')
+        .action(async () => {
+        await clearStoredSession();
+        outro(`Removed local session at ${SESSION_FILE_PATH}`);
+    });
+    return auth;
+}
+async function handleLogin(options) {
+    intro('Parix sign in');
+    const storedSession = await readStoredSession();
+    const baseUrl = resolveBaseUrl(options.baseUrl, storedSession, { useStoredSession: false });
+    const loopbackServer = await startLoopbackServer({
+        callbackPath: PARIX_LOCAL_CALLBACK_PATH,
+        port: options.port,
+        successPage: {
+            redirectUrl: new URL(CLI_OAUTH_CONSENT_GRANTED_PATH, baseUrl).toString(),
+        },
+        timeoutMs: LOGIN_TIMEOUT_MS,
+    });
+    try {
+        const pkcePair = createPkcePair();
+        const state = buildCliState(loopbackServer.callbackUrl);
+        loopbackServer.setState(state);
+        const browserUrl = buildAuthorizeUrl({
+            baseUrl,
+            codeChallenge: pkcePair.codeChallenge,
+            prompt: options.prompt,
+            state,
+        });
+        const prepareSpinner = spinner();
+        prepareSpinner.start('Preparing browser sign-in');
+        prepareSpinner.stop('Browser sign-in ready');
+        const opened = await openUrlInBrowser(browserUrl);
+        note(opened ? browserUrl : `Open this URL manually:\n${browserUrl}`, opened ? 'Opened browser URL' : 'Manual browser URL');
+        const waitSpinner = spinner();
+        waitSpinner.start('Waiting for browser callback');
+        const callbackResult = await loopbackServer.waitForResult();
+        waitSpinner.stop('Received browser callback');
+        const tokenSet = await exchangeAuthorizationCode({
+            baseUrl,
+            code: callbackResult.code,
+            codeVerifier: pkcePair.codeVerifier,
+        });
+        const nextSession = await createStoredSession({
+            baseUrl,
+            createdAt: storedSession?.createdAt,
+            tokenSet,
+        });
+        await writeStoredSession(nextSession);
+        note(SESSION_FILE_PATH, 'Stored session file');
+        outro(`Signed in as ${formatUserLabel(nextSession.user)}`);
+    }
+    finally {
+        await loopbackServer.close().catch(() => { });
+    }
+}
+async function handleStatus(options) {
+    intro('Parix auth status');
+    const storedSession = await readStoredSession();
+    if (!storedSession) {
+        log.warn(`No local session found at ${SESSION_FILE_PATH}`);
+        process.exitCode = 1;
+        return;
+    }
+    const baseUrl = resolveBaseUrl(options.baseUrl, storedSession);
+    try {
+        const refreshedSession = await hydrateStoredSessionOrganization(await ensureFreshSession({
+            ...storedSession,
+            baseUrl,
+        }));
+        const userInfo = await fetchOAuthUserInfo({
+            accessToken: refreshedSession.accessToken,
+            baseUrl,
+        });
+        note([
+            `User: ${userInfo.email ?? formatUserLabel(refreshedSession.user)}`,
+            `Base URL: ${baseUrl}`,
+            `Expires: ${refreshedSession.accessTokenExpiresAt}`,
+            `Scopes: ${refreshedSession.scopes.join(', ')}`,
+            `Organization: ${refreshedSession.organization.name ?? 'none'}`,
+            `Organization slug: ${refreshedSession.organization.slug ?? 'none'}`,
+            `Member role: ${refreshedSession.organization.memberRole ?? 'none'}`,
+            `Session file: ${SESSION_FILE_PATH}`,
+        ].join('\n'), 'Authenticated session');
+        outro('Session is valid');
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        log.warn(`Stored session is invalid: ${message}`);
+        process.exitCode = 1;
+    }
+}
+function formatUserLabel(user) {
+    return user.email ?? user.name ?? user.id;
+}