@portaidentity/cli 1.7.3 → 1.8.0

package/dist/credential-lock.d.ts

@@ -0,0 +1,20 @@
+/** Bounded cross-process kernel locking for the CLI credential file. */
+/** Options controlling one bounded credential lock acquisition. */
+export interface CredentialLockOptions {
+    /** Persistent lock-file path; the file is never unlinked. */
+    readonly lockPath: string;
+    /** Maximum wait before failing closed. */
+    readonly timeoutMs: number;
+    /** Caller-owned cancellation signal. */
+    readonly signal: AbortSignal;
+}
+/** Categorized error returned by credential lock acquisition. */
+export declare class CredentialLockError extends Error {
+    /** Stable machine-readable failure category. */
+    readonly code: 'AUTH_CANCELLED' | 'CREDENTIAL_LOCK_TIMEOUT';
+    /** Creates a bounded, non-sensitive lock error. */
+    constructor(code: CredentialLockError['code'], message: string);
+}
+/** Runs an operation under a bounded exclusive lock that survives as a file. */
+export declare function withCredentialLock<T>(options: CredentialLockOptions, operation: () => Promise<T>): Promise<T>;
+//# sourceMappingURL=credential-lock.d.ts.map

package/dist/credential-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-lock.d.ts","sourceRoot":"","sources":["../src/credential-lock.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAWxE,mEAAmE;AACnE,MAAM,WAAW,qBAAqB;IACpC,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,0CAA0C;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wCAAwC;IACxC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED,iEAAiE;AACjE,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,gBAAgB,GAAG,yBAAyB,CAAC;IAE5D,mDAAmD;IACnD,YAAY,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,EAI7D;CACF;AAyDD,gFAAgF;AAChF,wBAAsB,kBAAkB,CAAC,CAAC,EACxC,OAAO,EAAE,qBAAqB,EAC9B,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,CAAC,CAAC,CAmEZ"}

package/dist/credential-lock.js

@@ -0,0 +1,130 @@
+/** Bounded cross-process kernel locking for the CLI credential file. */
+import { constants as nativeConstants, fcntlSync, lockFileExSync, unlockFileExSync, } from 'fs-ext-extra-prebuilt';
+import { open } from 'node:fs/promises';
+import { resolve } from 'node:path';
+/** Categorized error returned by credential lock acquisition. */
+export class CredentialLockError extends Error {
+    /** Stable machine-readable failure category. */
+    code;
+    /** Creates a bounded, non-sensitive lock error. */
+    constructor(code, message) {
+        super(message);
+        this.name = 'CredentialLockError';
+        this.code = code;
+    }
+}
+const RETRY_DELAY_MS = 10;
+const activeProcessLocks = new Set();
+/** Returns true only for documented non-blocking contention failures. */
+function isContention(error) {
+    if (!error || typeof error !== 'object' || !('code' in error))
+        return false;
+    return error.code === 'EACCES' || error.code === 'EAGAIN' || error.code === 'EBUSY';
+}
+/** Applies the platform's exclusive non-blocking one-byte kernel lock. */
+function tryLock(descriptor) {
+    /* v8 ignore if -- @preserve */
+    if (process.platform === 'win32') {
+        lockFileExSync(descriptor, nativeConstants.LOCKFILE_EXCLUSIVE_LOCK | nativeConstants.LOCKFILE_FAIL_IMMEDIATELY, 0, 0, 1, 0);
+        return;
+    }
+    fcntlSync(descriptor, 'setlk', nativeConstants.F_WRLCK, 0, 1);
+}
+/** Releases the platform's one-byte kernel lock. */
+function unlock(descriptor) {
+    /* v8 ignore if -- @preserve */
+    if (process.platform === 'win32') {
+        unlockFileExSync(descriptor, 0, 0, 1, 0);
+        return;
+    }
+    fcntlSync(descriptor, 'setlk', nativeConstants.F_UNLCK, 0, 1);
+}
+/** Waits briefly while remaining immediately cancellable. */
+async function waitForRetry(signal) {
+    if (signal.aborted) {
+        throw new CredentialLockError('AUTH_CANCELLED', 'Authentication was cancelled.');
+    }
+    await new Promise((resolveWait, rejectWait) => {
+        const complete = () => {
+            signal.removeEventListener('abort', abort);
+            resolveWait();
+        };
+        const timeout = setTimeout(complete, RETRY_DELAY_MS);
+        const abort = () => {
+            clearTimeout(timeout);
+            rejectWait(new CredentialLockError('AUTH_CANCELLED', 'Authentication was cancelled.'));
+        };
+        signal.addEventListener('abort', abort, { once: true });
+    });
+}
+/** Runs an operation under a bounded exclusive lock that survives as a file. */
+export async function withCredentialLock(options, operation) {
+    const lockPath = resolve(options.lockPath);
+    const deadline = performance.now() + options.timeoutMs;
+    let handle;
+    let processReservation = false;
+    let acquired = false;
+    let keepProcessAlive;
+    try {
+        // POSIX record locks are released when this process closes any descriptor
+        // for the same file. Reserve the path in-process before opening it so a
+        // local waiter can never release the active operation's kernel lock.
+        while (!processReservation) {
+            if (options.signal.aborted) {
+                throw new CredentialLockError('AUTH_CANCELLED', 'Authentication was cancelled.');
+            }
+            if (!activeProcessLocks.has(lockPath)) {
+                activeProcessLocks.add(lockPath);
+                processReservation = true;
+                break;
+            }
+            if (performance.now() >= deadline) {
+                throw new CredentialLockError('CREDENTIAL_LOCK_TIMEOUT', 'Credential storage is busy. Try again.');
+            }
+            await waitForRetry(options.signal);
+        }
+        const activeHandle = await open(lockPath, 'a+', 0o600);
+        handle = activeHandle;
+        while (!acquired) {
+            if (options.signal.aborted) {
+                throw new CredentialLockError('AUTH_CANCELLED', 'Authentication was cancelled.');
+            }
+            try {
+                tryLock(activeHandle.fd);
+                acquired = true;
+                break;
+            }
+            catch (error) {
+                if (!isContention(error))
+                    throw error;
+            }
+            if (performance.now() >= deadline) {
+                throw new CredentialLockError('CREDENTIAL_LOCK_TIMEOUT', 'Credential storage is busy. Try again.');
+            }
+            await waitForRetry(options.signal);
+        }
+        // A pending promise alone does not keep Node alive. The referenced timer
+        // ensures the process cannot exit normally while its operation still owns
+        // the kernel lock; crashes and signals still release the lock in-kernel.
+        keepProcessAlive = setInterval(() => void activeHandle.fd, 60_000);
+        return await operation();
+    }
+    finally {
+        if (keepProcessAlive)
+            clearInterval(keepProcessAlive);
+        try {
+            if (acquired && handle)
+                unlock(handle.fd);
+        }
+        finally {
+            try {
+                await handle?.close();
+            }
+            finally {
+                if (processReservation)
+                    activeProcessLocks.delete(lockPath);
+            }
+        }
+    }
+}
+//# sourceMappingURL=credential-lock.js.map

package/dist/credential-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-lock.js","sourceRoot":"","sources":["../src/credential-lock.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE,OAAO,EACL,SAAS,IAAI,eAAe,EAC5B,SAAS,EACT,cAAc,EACd,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,IAAI,EAAmB,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAYpC,iEAAiE;AACjE,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,gDAAgD;IACvC,IAAI,CAA+C;IAE5D,mDAAmD;IACnD,YAAY,IAAiC,EAAE,OAAe;QAC5D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;AAE7C,yEAAyE;AACzE,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5E,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC;AACtF,CAAC;AAED,0EAA0E;AAC1E,SAAS,OAAO,CAAC,UAAkB;IACjC,+BAA+B;IAC/B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,cAAc,CACZ,UAAU,EACV,eAAe,CAAC,uBAAuB,GAAG,eAAe,CAAC,yBAAyB,EACnF,CAAC,EACD,CAAC,EACD,CAAC,EACD,CAAC,CACF,CAAC;QACF,OAAO;IACT,CAAC;IACD,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,oDAAoD;AACpD,SAAS,MAAM,CAAC,UAAkB;IAChC,+BAA+B;IAC/B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,gBAAgB,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IACD,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,6DAA6D;AAC7D,KAAK,UAAU,YAAY,CAAC,MAAmB;IAC7C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,IAAI,OAAO,CAAO,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE;QAClD,MAAM,QAAQ,GAAG,GAAS,EAAE;YAC1B,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC3C,WAAW,EAAE,CAAC;QAChB,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,GAAS,EAAE;YACvB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,UAAU,CAAC,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC,CAAC;QACzF,CAAC,CAAC;QACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA8B,EAC9B,SAA2B;IAE3B,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IACvD,IAAI,MAA8B,CAAC;IACnC,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,gBAA4D,CAAC;IACjE,IAAI,CAAC;QACH,0EAA0E;QAC1E,wEAAwE;QACxE,qEAAqE;QACrE,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAC3B,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC3B,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;YACnF,CAAC;YACD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACjC,kBAAkB,GAAG,IAAI,CAAC;gBAC1B,MAAM;YACR,CAAC;YACD,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAClC,MAAM,IAAI,mBAAmB,CAC3B,yBAAyB,EACzB,wCAAwC,CACzC,CAAC;YACJ,CAAC;YACD,MAAM,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACvD,MAAM,GAAG,YAAY,CAAC;QACtB,OAAO,CAAC,QAAQ,EAAE,CAAC;YACjB,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC3B,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;YACnF,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;gBACzB,QAAQ,GAAG,IAAI,CAAC;gBAChB,MAAM;YACR,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;YACxC,CAAC;YACD,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAClC,MAAM,IAAI,mBAAmB,CAC3B,yBAAyB,EACzB,wCAAwC,CACzC,CAAC;YACJ,CAAC;YACD,MAAM,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,gBAAgB,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACnE,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,IAAI,gBAAgB;YAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,IAAI,QAAQ,IAAI,MAAM;gBAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC;YACxB,CAAC;oBAAS,CAAC;gBACT,IAAI,kBAAkB;oBAAE,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/credential-store.d.ts

@@ -17,6 +17,7 @@
  *
  * @module credential-store
  */
+import type { CliCredentialPersistence } from '@portaidentity/sdk/node';
 /**
  * User info embedded in stored credentials.
  * Contains the OIDC subject identifier and basic profile data.
@@ -77,6 +78,8 @@ export declare function loadCredentials(): StoredCredentials | null;
  * @param credentials - The credentials to persist
  */
 export declare function saveCredentials(credentials: StoredCredentials): void;
+/** Persists login credentials under the same lock and atomic-write contract as refresh. */
+export declare function saveCredentialsDurably(credentials: StoredCredentials, signal?: AbortSignal): Promise<void>;
 /**
  * Deletes the stored credentials file.
  *
@@ -97,6 +100,17 @@ export declare function hasCredentials(): boolean;
  * @returns Absolute path to credentials.json
  */
 export declare function getCredentialsPath(): string;
+/** Options for durable SDK refresh persistence owned by the CLI. */
+export interface CliCredentialPersistenceOptions {
+    /** Credential file to replace atomically. */
+    readonly credentialsPath?: string;
+    /** Maximum time to wait for another CLI process. */
+    readonly lockTimeoutMs: number;
+    /** Optional cancellation signal for lock acquisition. */
+    readonly signal?: AbortSignal;
+}
+/** Creates the CLI-owned lock and atomic-write hooks used by SDK refresh. */
+export declare function createCliCredentialPersistence(options: CliCredentialPersistenceOptions): CliCredentialPersistence;
 /**
  * Checks whether the access token is expired (with 60s safety buffer).
  *

package/dist/credential-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../src/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAgBH;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAsBD;;;;;;;GAOG;AACH,wBAAgB,eAAe,IAAI,iBAAiB,GAAG,IAAI,CAW1D;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,iBAAiB,GAAG,IAAI,CAUpE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAQvC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,OAAO,CAExC;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,iBAAiB,GAAG,OAAO,CAMtE"}
+{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../src/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAOxE;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAmFD;;;;;;;GAOG;AACH,wBAAgB,eAAe,IAAI,iBAAiB,GAAG,IAAI,CAW1D;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,iBAAiB,GAAG,IAAI,CAUpE;AAED,2FAA2F;AAC3F,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,iBAAiB,EAC9B,MAAM,GAAE,WAA0C,GACjD,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAQvC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,OAAO,CAExC;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,oEAAoE;AACpE,MAAM,WAAW,+BAA+B;IAC9C,6CAA6C;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,oDAAoD;IACpD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,yDAAyD;IACzD,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AA8BD,6EAA6E;AAC7E,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,+BAA+B,GACvC,wBAAwB,CAiB1B;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,iBAAiB,GAAG,OAAO,CAMtE"}

package/dist/credential-store.js

@@ -17,9 +17,12 @@
  *
  * @module credential-store
  */
-import { readFileSync, writeFileSync, mkdirSync, unlinkSync, existsSync, } from 'node:fs';
-import { join } from 'node:path';
+import { readFileSync, writeFileSync, mkdirSync, unlinkSync, existsSync } from 'node:fs';
+import { chmod, mkdir, open, rename, rm } from 'node:fs/promises';
+import { randomBytes } from 'node:crypto';
+import { dirname, join } from 'node:path';
 import { homedir } from 'node:os';
+import { withCredentialLock } from './credential-lock.js';
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -31,6 +34,62 @@ const CREDENTIALS_PATH = join(PORTA_DIR, 'credentials.json');
 const FILE_MODE = 0o600;
 /** Directory permissions: owner access only (0700) */
 const DIR_MODE = 0o700;
+/** Maximum wait for another CLI process to finish a credential update. */
+const LOGIN_LOCK_TIMEOUT_MS = 5_000;
+/** Organization slug format shared with Porta's server-side validator. */
+const ORGANIZATION_SLUG = /^[a-z0-9][a-z0-9-]{1,98}[a-z0-9]$/;
+/** Returns true for a non-empty string accepted at a credential boundary. */
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+/** Validates a stored credential snapshot before any field is trusted. */
+function parseStoredCredentials(value) {
+    if (!value || typeof value !== 'object')
+        return null;
+    const candidate = value;
+    const userInfoValue = candidate.userInfo;
+    if (!userInfoValue || typeof userInfoValue !== 'object')
+        return null;
+    const userInfo = userInfoValue;
+    if (!isNonEmptyString(candidate.server) ||
+        !isNonEmptyString(candidate.orgSlug) ||
+        !ORGANIZATION_SLUG.test(candidate.orgSlug) ||
+        !isNonEmptyString(candidate.clientId) ||
+        !isNonEmptyString(candidate.accessToken) ||
+        (candidate.refreshToken !== undefined && typeof candidate.refreshToken !== 'string') ||
+        !isNonEmptyString(candidate.idToken) ||
+        !isNonEmptyString(candidate.expiresAt) ||
+        Number.isNaN(Date.parse(candidate.expiresAt)) ||
+        !isNonEmptyString(userInfo.sub) ||
+        typeof userInfo.email !== 'string' ||
+        (userInfo.name !== undefined && typeof userInfo.name !== 'string')) {
+        return null;
+    }
+    try {
+        const server = new URL(candidate.server);
+        if (server.protocol !== 'https:' ||
+            server.username ||
+            server.password ||
+            !/^\/*$/.test(server.pathname) ||
+            server.search ||
+            server.hash) {
+            return null;
+        }
+    }
+    catch {
+        return null;
+    }
+    return {
+        server: candidate.server,
+        orgSlug: candidate.orgSlug,
+        clientId: candidate.clientId,
+        accessToken: candidate.accessToken,
+        refreshToken: isNonEmptyString(candidate.refreshToken) ? candidate.refreshToken : undefined,
+        idToken: candidate.idToken,
+        expiresAt: candidate.expiresAt,
+        userInfo: { sub: userInfo.sub, email: userInfo.email, name: userInfo.name },
+    };
+}
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------
@@ -48,7 +107,7 @@ export function loadCredentials() {
             return null;
         }
         const raw = readFileSync(CREDENTIALS_PATH, 'utf-8');
-        return JSON.parse(raw);
+        return parseStoredCredentials(JSON.parse(raw));
     }
     catch {
         // Corrupt file or parse error — treat as no credentials
@@ -73,6 +132,15 @@ export function saveCredentials(credentials) {
         encoding: 'utf-8',
     });
 }
+/** Persists login credentials under the same lock and atomic-write contract as refresh. */
+export async function saveCredentialsDurably(credentials, signal = new AbortController().signal) {
+    await prepareCredentialDirectory(CREDENTIALS_PATH);
+    await withCredentialLock({
+        lockPath: `${CREDENTIALS_PATH}.lock`,
+        timeoutMs: LOGIN_LOCK_TIMEOUT_MS,
+        signal,
+    }, async () => persistAtomically(CREDENTIALS_PATH, credentials));
+}
 /**
  * Deletes the stored credentials file.
  *
@@ -106,6 +174,49 @@ export function hasCredentials() {
 export function getCredentialsPath() {
     return CREDENTIALS_PATH;
 }
+/** Creates and corrects the owner-only directory needed by a credential path. */
+async function prepareCredentialDirectory(path) {
+    const directory = dirname(path);
+    await mkdir(directory, { recursive: true, mode: DIR_MODE });
+    await chmod(directory, DIR_MODE);
+}
+/** Writes a credential snapshot through an owner-only sibling and atomic rename. */
+async function persistAtomically(path, credentials) {
+    await prepareCredentialDirectory(path);
+    const temporaryPath = `${path}.${randomBytes(12).toString('hex')}.tmp`;
+    const handle = await open(temporaryPath, 'wx', FILE_MODE);
+    try {
+        try {
+            await handle.writeFile(JSON.stringify(credentials), 'utf8');
+            await handle.sync();
+            await handle.chmod(FILE_MODE);
+        }
+        finally {
+            await handle.close();
+        }
+        await rename(temporaryPath, path);
+        await chmod(path, FILE_MODE);
+    }
+    catch (error) {
+        await rm(temporaryPath, { force: true });
+        throw error;
+    }
+}
+/** Creates the CLI-owned lock and atomic-write hooks used by SDK refresh. */
+export function createCliCredentialPersistence(options) {
+    const credentialsPath = options.credentialsPath ?? CREDENTIALS_PATH;
+    const signal = options.signal ?? new AbortController().signal;
+    return {
+        withRefreshLock: (operation) => withCredentialLock({
+            lockPath: `${credentialsPath}.lock`,
+            timeoutMs: options.lockTimeoutMs,
+            signal,
+        }, operation),
+        persistRefreshedCredentials: async (_previous, refreshed) => {
+            await persistAtomically(credentialsPath, refreshed);
+        },
+    };
+}
 /**
  * Checks whether the access token is expired (with 60s safety buffer).
  *

package/dist/credential-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../src/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EACL,YAAY,EACZ,aAAa,EACb,SAAS,EACT,UAAU,EACV,UAAU,GACX,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAkDlC,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,qDAAqD;AACrD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAE5C,wDAAwD;AACxD,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;AAE7D,qDAAqD;AACrD,MAAM,SAAS,GAAG,KAAK,CAAC;AAExB,sDAAsD;AACtD,MAAM,QAAQ,GAAG,KAAK,CAAC;AAEvB,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,WAA8B;IAC5D,kDAAkD;IAClD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,SAAS,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,aAAa,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QACpE,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACjC,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,UAAU,CAAC,gBAAgB,CAAC,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,WAA8B;IAC3D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,0BAA0B;IAEnD,OAAO,GAAG,IAAI,SAAS,GAAG,QAAQ,CAAC;AACrC,CAAC"}
+{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../src/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAkD1D,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,qDAAqD;AACrD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAE5C,wDAAwD;AACxD,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;AAE7D,qDAAqD;AACrD,MAAM,SAAS,GAAG,KAAK,CAAC;AAExB,sDAAsD;AACtD,MAAM,QAAQ,GAAG,KAAK,CAAC;AAEvB,0EAA0E;AAC1E,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAEpC,0EAA0E;AAC1E,MAAM,iBAAiB,GAAG,mCAAmC,CAAC;AAE9D,6EAA6E;AAC7E,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,0EAA0E;AAC1E,SAAS,sBAAsB,CAAC,KAAc;IAC5C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC;IACzC,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrE,MAAM,QAAQ,GAAG,aAAwC,CAAC;IAC1D,IACE,CAAC,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC;QACnC,CAAC,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC;QACpC,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QAC1C,CAAC,gBAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC;QACrC,CAAC,gBAAgB,CAAC,SAAS,CAAC,WAAW,CAAC;QACxC,CAAC,SAAS,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,SAAS,CAAC,YAAY,KAAK,QAAQ,CAAC;QACpF,CAAC,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC;QACpC,CAAC,gBAAgB,CAAC,SAAS,CAAC,SAAS,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC/B,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ;QAClC,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,EAClE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACzC,IACE,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAC5B,MAAM,CAAC,QAAQ;YACf,MAAM,CAAC,QAAQ;YACf,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC9B,MAAM,CAAC,MAAM;YACb,MAAM,CAAC,IAAI,EACX,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,YAAY,EAAE,gBAAgB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QAC3F,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,QAAQ,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;KAC5E,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACpD,OAAO,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,WAA8B;IAC5D,kDAAkD;IAClD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,SAAS,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,aAAa,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QACpE,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;AACL,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,WAA8B,EAC9B,MAAM,GAAgB,IAAI,eAAe,EAAE,CAAC,MAAM;IAElD,MAAM,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;IACnD,MAAM,kBAAkB,CACtB;QACE,QAAQ,EAAE,GAAG,gBAAgB,OAAO;QACpC,SAAS,EAAE,qBAAqB;QAChC,MAAM;KACP,EACD,KAAK,IAAI,EAAE,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACjC,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,UAAU,CAAC,gBAAgB,CAAC,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAYD,iFAAiF;AACjF,KAAK,UAAU,0BAA0B,CAAC,IAAY;IACpD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5D,MAAM,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,WAA8B;IAC3E,MAAM,0BAA0B,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,GAAG,IAAI,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IACvE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;YAC5D,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,MAAM,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAChC,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,MAAM,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAClC,MAAM,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,8BAA8B,CAC5C,OAAwC;IAExC,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,gBAAgB,CAAC;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC;IAC9D,OAAO;QACL,eAAe,EAAE,CAAC,SAAS,EAAE,EAAE,CAC7B,kBAAkB,CAChB;YACE,QAAQ,EAAE,GAAG,eAAe,OAAO;YACnC,SAAS,EAAE,OAAO,CAAC,aAAa;YAChC,MAAM;SACP,EACD,SAAS,CACV;QACH,2BAA2B,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE;YAC1D,MAAM,iBAAiB,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;QACtD,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,WAA8B;IAC3D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,0BAA0B;IAEnD,OAAO,GAAG,IAAI,SAAS,GAAG,QAAQ,CAAC;AACrC,CAAC"}

package/dist/error-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error-handler.d.ts","sourceRoot":"","sources":["../src/error-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAmBH,gCAAgC;AAChC,eAAO,MAAM,YAAY,IAAI,CAAC;AAC9B,eAAO,MAAM,kBAAkB,IAAI,CAAC;AACpC,eAAO,MAAM,eAAe,IAAI,CAAC;AACjC,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAMvC;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,OAAO,EAAE,EACnD,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,EACjC,OAAO,UAAQ,GACd,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAQ/B;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,UAAQ,GAAG,KAAK,CAsFhE"}
+{"version":3,"file":"error-handler.d.ts","sourceRoot":"","sources":["../src/error-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAmBH,gCAAgC;AAChC,eAAO,MAAM,YAAY,IAAI,CAAC;AAC9B,eAAO,MAAM,kBAAkB,IAAI,CAAC;AACpC,eAAO,MAAM,eAAe,IAAI,CAAC;AACjC,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAMvC;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,OAAO,EAAE,EACnD,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,EACjC,OAAO,UAAQ,GACd,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAQ/B;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,UAAQ,GAAG,KAAK,CAuFhE"}

package/dist/error-handler.js

@@ -114,6 +114,8 @@ export function handleError(err, verbose = false) {
     // --- SDK Server Error (5xx) ---
     if (err instanceof PortaServerError) {
         printError(`Server error (${err.status}): ${err.message}`);
+        if (err.requestId)
+            printError(`Request ID: ${err.requestId}`);
         if (verbose)
             printVerboseDetails(err);
         process.exit(EXIT_GENERAL_ERROR);

package/dist/error-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"error-handler.js","sourceRoot":"","sources":["../src/error-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EACL,UAAU,EACV,cAAc,EACd,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,IAAI,UAAU,EAAE,MAAM,aAAa,CAAC;AAElD,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,gCAAgC;AAChC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAC9B,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AACpC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC;AACjC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEvC,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,EAAiC,EACjC,OAAO,GAAG,KAAK;IAEf,OAAO,KAAK,EAAE,GAAG,IAAO,EAAE,EAAE;QAC1B,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,GAAY,EAAE,OAAO,GAAG,KAAK;IACvD,qCAAqC;IACrC,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;QACxC,UAAU,CAAC,sBAAsB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAChD,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;gBACjC,UAAU,CAAC,KAAK,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QACD,IAAI,OAAO;YAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACtC,CAAC;IAED,yCAAyC;IACzC,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;QAC5C,UAAU,CAAC,0BAA0B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACpD,UAAU,CAAC,oCAAoC,CAAC,CAAC;QACjD,IAAI,OAAO;YAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChC,CAAC;IAED,oCAAoC;IACpC,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,UAAU,CAAC,kBAAkB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5C,UAAU,CAAC,8DAA8D,CAAC,CAAC;QAC3E,IAAI,OAAO;YAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChC,CAAC;IAED,oCAAoC;IACpC,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;QACtC,UAAU,CAAC,cAAc,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxC,IAAI,OAAO;YAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnC,CAAC;IAED,mCAAmC;IACnC,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;QACtC,UAAU,CAAC,aAAa,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACvC,IAAI,OAAO;YAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnC,CAAC;IAED,qCAAqC;IACrC,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,UAAU,CAAC,wBAAwB,GAAG,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC,CAAC;QAC7D,IAAI,OAAO;YAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnC,CAAC;IAED,iCAAiC;IACjC,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;QACpC,UAAU,CAAC,iBAAiB,GAAG,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3D,IAAI,OAAO;YAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnC,CAAC;IAED,iCAAiC;IACjC,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;QAClC,UAAU,CAAC,QAAQ,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,IAAI,OAAO;YAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnC,CAAC;IAED,4BAA4B;IAC5B,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;QAC9B,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxB,IAAI,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnC,CAAC;IAED,yBAAyB;IACzB,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QACzB,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxB,IAAI,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnC,CAAC;IAED,wBAAwB;IACxB,UAAU,CAAC,iCAAiC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3D,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AACnC,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,GAAmB;IAC9C,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;AACH,CAAC"}
+{"version":3,"file":"error-handler.js","sourceRoot":"","sources":["../src/error-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EACL,UAAU,EACV,cAAc,EACd,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,IAAI,UAAU,EAAE,MAAM,aAAa,CAAC;AAElD,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,gCAAgC;AAChC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAC9B,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AACpC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC;AACjC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEvC,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,EAAiC,EACjC,OAAO,GAAG,KAAK;IAEf,OAAO,KAAK,EAAE,GAAG,IAAO,EAAE,EAAE;QAC1B,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,GAAY,EAAE,OAAO,GAAG,KAAK;IACvD,qCAAqC;IACrC,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;QACxC,UAAU,CAAC,sBAAsB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAChD,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;gBACjC,UAAU,CAAC,KAAK,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QACD,IAAI,OAAO;YAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACtC,CAAC;IAED,yCAAyC;IACzC,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;QAC5C,UAAU,CAAC,0BAA0B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACpD,UAAU,CAAC,oCAAoC,CAAC,CAAC;QACjD,IAAI,OAAO;YAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChC,CAAC;IAED,oCAAoC;IACpC,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,UAAU,CAAC,kBAAkB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5C,UAAU,CAAC,8DAA8D,CAAC,CAAC;QAC3E,IAAI,OAAO;YAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChC,CAAC;IAED,oCAAoC;IACpC,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;QACtC,UAAU,CAAC,cAAc,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxC,IAAI,OAAO;YAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnC,CAAC;IAED,mCAAmC;IACnC,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;QACtC,UAAU,CAAC,aAAa,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACvC,IAAI,OAAO;YAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnC,CAAC;IAED,qCAAqC;IACrC,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,UAAU,CAAC,wBAAwB,GAAG,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC,CAAC;QAC7D,IAAI,OAAO;YAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnC,CAAC;IAED,iCAAiC;IACjC,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;QACpC,UAAU,CAAC,iBAAiB,GAAG,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3D,IAAI,GAAG,CAAC,SAAS;YAAE,UAAU,CAAC,eAAe,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;QAC9D,IAAI,OAAO;YAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnC,CAAC;IAED,iCAAiC;IACjC,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;QAClC,UAAU,CAAC,QAAQ,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,IAAI,OAAO;YAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnC,CAAC;IAED,4BAA4B;IAC5B,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;QAC9B,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxB,IAAI,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnC,CAAC;IAED,yBAAyB;IACzB,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QACzB,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxB,IAAI,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACzB,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnC,CAAC;IAED,wBAAwB;IACxB,UAAU,CAAC,iCAAiC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3D,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AACnC,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,GAAmB;IAC9C,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;AACH,CAAC"}

package/dist/global-options.d.ts

@@ -47,4 +47,12 @@ export interface GlobalOptions {
  * @throws Error if no server URL can be determined
  */
 export declare function resolveServerUrl(options: GlobalOptions): string;
+/**
+ * Validates and canonicalizes an HTTPS server origin.
+ *
+ * @param value - Candidate URL from CLI, environment, or credentials.
+ * @returns Canonical URL containing only scheme, host, and optional port.
+ * @throws Error when the value is not an HTTPS origin.
+ */
+export declare function normalizeServerOrigin(value: string | URL): URL;
 //# sourceMappingURL=global-options.d.ts.map

package/dist/global-options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"global-options.d.ts","sourceRoot":"","sources":["../src/global-options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,IAAI,EAAE,OAAO,CAAC;IACd,0DAA0D;IAC1D,OAAO,EAAE,OAAO,CAAC;IACjB,gEAAgE;IAChE,QAAQ,EAAE,OAAO,CAAC;IAClB,2DAA2D;IAC3D,KAAK,EAAE,OAAO,CAAC;CAChB;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAsB/D"}
+{"version":3,"file":"global-options.d.ts","sourceRoot":"","sources":["../src/global-options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,IAAI,EAAE,OAAO,CAAC;IACd,0DAA0D;IAC1D,OAAO,EAAE,OAAO,CAAC;IACjB,gEAAgE;IAChE,QAAQ,EAAE,OAAO,CAAC;IAClB,2DAA2D;IAC3D,KAAK,EAAE,OAAO,CAAC;CAChB;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAsB/D;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,GAAG,CAc9D"}

package/dist/global-options.js

@@ -35,28 +35,39 @@ import { loadCredentials } from './credential-store.js';
 export function resolveServerUrl(options) {
     // Priority 1: --server flag
     if (options.server) {
-        return normalizeUrl(options.server);
+        return normalizeServerOrigin(options.server).origin;
     }
     // Priority 2: PORTA_SERVER environment variable
     const envUrl = process.env.PORTA_SERVER;
     if (envUrl) {
-        return normalizeUrl(envUrl);
+        return normalizeServerOrigin(envUrl).origin;
     }
     // Priority 3: Credentials file
     const credentials = loadCredentials();
     if (credentials?.server) {
-        return normalizeUrl(credentials.server);
+        return normalizeServerOrigin(credentials.server).origin;
     }
     // Priority 4: No server configured
     throw new Error('No Porta server configured. Use --server, set PORTA_SERVER, or run "porta login" first.');
 }
 /**
- * Normalizes a URL by removing trailing slashes.
+ * Validates and canonicalizes an HTTPS server origin.
  *
- * @param url - The URL to normalize
- * @returns URL without trailing slash
+ * @param value - Candidate URL from CLI, environment, or credentials.
+ * @returns Canonical URL containing only scheme, host, and optional port.
+ * @throws Error when the value is not an HTTPS origin.
  */
-function normalizeUrl(url) {
-    return url.replace(/\/+$/, '');
+export function normalizeServerOrigin(value) {
+    const url = new URL(value);
+    if (url.protocol !== 'https:' ||
+        url.username ||
+        url.password ||
+        !/^\/*$/.test(url.pathname) ||
+        url.search ||
+        url.hash) {
+        throw new Error('Porta server must be an HTTPS origin without credentials or a path.');
+    }
+    url.pathname = '/';
+    return url;
 }
 //# sourceMappingURL=global-options.js.map

package/dist/global-options.js.map

@@ -1 +1 @@
-{"version":3,"file":"global-options.js","sourceRoot":"","sources":["../src/global-options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAyBxD,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAsB;IACrD,4BAA4B;IAC5B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,gDAAgD;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACxC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,+BAA+B;IAC/B,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,IAAI,WAAW,EAAE,MAAM,EAAE,CAAC;QACxB,OAAO,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,mCAAmC;IACnC,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC"}
+{"version":3,"file":"global-options.js","sourceRoot":"","sources":["../src/global-options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAyBxD,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAsB;IACrD,4BAA4B;IAC5B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACtD,CAAC;IAED,gDAAgD;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACxC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IAC9C,CAAC;IAED,+BAA+B;IAC/B,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,IAAI,WAAW,EAAE,MAAM,EAAE,CAAC;QACxB,OAAO,qBAAqB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IAC1D,CAAC;IAED,mCAAmC;IACnC,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAmB;IACvD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3B,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,IAAI,EACR,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC;IACnB,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/index.js

@@ -40,13 +40,14 @@ import { userCommand } from './commands/user.js';
 import { keysCommand } from './commands/keys.js';
 import { configCommand } from './commands/config.js';
 import { auditCommand } from './commands/audit.js';
-import { provisionCommand } from './commands/provision.js';
 import { healthCommand } from './commands/health.js';
 import { sessionsCommand } from './commands/sessions.js';
 import { bulkCommand } from './commands/bulk.js';
 import { statsCommand } from './commands/stats.js';
 import { exportsCommand } from './commands/exports.js';
-import { guiCommand } from './commands/gui.js';
+import { exportCommand } from './commands/export.js';
+import { importCommand } from './commands/import.js';
+import { adminCommand } from './commands/admin.js';
 /**
  * Builds and runs the CLI.
  *
@@ -106,11 +107,12 @@ async function main() {
         .command(statsCommand)
         .command(bulkCommand)
         .command(exportsCommand)
-        .command(provisionCommand)
+        .command(exportCommand)
+        .command(importCommand)
         // Unauthenticated commands
         .command(healthCommand)
-        // GUI launcher (no auth required — admin-gui handles its own auth)
-        .command(guiCommand)
+        // Embedded administration application (handles its own session)
+        .command(adminCommand)
         .demandCommand(1, 'Please specify a command')
         .strict()
         .help()

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C;;;;;GAKG;AACH,KAAK,UAAU,IAAI;IACjB,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;SAC/B,UAAU,CAAC,OAAO,CAAC;SACnB,KAAK,CAAC,wBAAwB,CAAC;SAC/B,MAAM,CAAC,QAAQ,EAAE;QAChB,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,kBAAkB;QAC5B,MAAM,EAAE,IAAI;KACb,CAAC;SACD,MAAM,CAAC,MAAM,EAAE;QACd,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,uBAAuB;QACjC,MAAM,EAAE,IAAI;KACb,CAAC;SACD,MAAM,CAAC,SAAS,EAAE;QACjB,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,sBAAsB;QAChC,MAAM,EAAE,IAAI;KACb,CAAC;SACD,MAAM,CAAC,UAAU,EAAE;QAClB,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,mCAAmC;QAC7C,MAAM,EAAE,IAAI;KACb,CAAC;SACD,MAAM,CAAC,OAAO,EAAE;QACf,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,2BAA2B;QACrC,MAAM,EAAE,IAAI;KACb,CAAC;QACF,wCAAwC;SACvC,OAAO,CAAC,YAAY,CAAC;SACrB,OAAO,CAAC,aAAa,CAAC;SACtB,OAAO,CAAC,aAAa,CAAC;SACtB,OAAO,CAAC,cAAc,CAAC;SACvB,OAAO,CAAC,aAAa,CAAC;SACtB,OAAO,CAAC,iBAAiB,CAAC;QAC3B,kCAAkC;SACjC,OAAO,CAAC,UAAU,CAAC;SACnB,OAAO,CAAC,UAAU,CAAC;SACnB,OAAO,CAAC,aAAa,CAAC;SACtB,OAAO,CAAC,WAAW,CAAC;QACrB,0CAA0C;SACzC,OAAO,CAAC,WAAW,CAAC;SACpB,OAAO,CAAC,aAAa,CAAC;SACtB,OAAO,CAAC,YAAY,CAAC;SACrB,OAAO,CAAC,eAAe,CAAC;SACxB,OAAO,CAAC,YAAY,CAAC;SACrB,OAAO,CAAC,WAAW,CAAC;SACpB,OAAO,CAAC,cAAc,CAAC;SACvB,OAAO,CAAC,gBAAgB,CAAC;QAC1B,2BAA2B;SAC1B,OAAO,CAAC,aAAa,CAAC;QACvB,mEAAmE;SAClE,OAAO,CAAC,UAAU,CAAC;SACnB,aAAa,CAAC,CAAC,EAAE,0BAA0B,CAAC;SAC5C,MAAM,EAAE;SACR,IAAI,EAAE;SACN,OAAO,CAAC,KAAK,CAAC,CAAC,6DAA6D;SAC5E,UAAU,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,uEAAuE;SACvG,KAAK,EAAE,CAAC;AACb,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD;;;;;GAKG;AACH,KAAK,UAAU,IAAI;IACjB,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;SAC/B,UAAU,CAAC,OAAO,CAAC;SACnB,KAAK,CAAC,wBAAwB,CAAC;SAC/B,MAAM,CAAC,QAAQ,EAAE;QAChB,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,kBAAkB;QAC5B,MAAM,EAAE,IAAI;KACb,CAAC;SACD,MAAM,CAAC,MAAM,EAAE;QACd,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,uBAAuB;QACjC,MAAM,EAAE,IAAI;KACb,CAAC;SACD,MAAM,CAAC,SAAS,EAAE;QACjB,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,sBAAsB;QAChC,MAAM,EAAE,IAAI;KACb,CAAC;SACD,MAAM,CAAC,UAAU,EAAE;QAClB,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,mCAAmC;QAC7C,MAAM,EAAE,IAAI;KACb,CAAC;SACD,MAAM,CAAC,OAAO,EAAE;QACf,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,2BAA2B;QACrC,MAAM,EAAE,IAAI;KACb,CAAC;QACF,wCAAwC;SACvC,OAAO,CAAC,YAAY,CAAC;SACrB,OAAO,CAAC,aAAa,CAAC;SACtB,OAAO,CAAC,aAAa,CAAC;SACtB,OAAO,CAAC,cAAc,CAAC;SACvB,OAAO,CAAC,aAAa,CAAC;SACtB,OAAO,CAAC,iBAAiB,CAAC;QAC3B,kCAAkC;SACjC,OAAO,CAAC,UAAU,CAAC;SACnB,OAAO,CAAC,UAAU,CAAC;SACnB,OAAO,CAAC,aAAa,CAAC;SACtB,OAAO,CAAC,WAAW,CAAC;QACrB,0CAA0C;SACzC,OAAO,CAAC,WAAW,CAAC;SACpB,OAAO,CAAC,aAAa,CAAC;SACtB,OAAO,CAAC,YAAY,CAAC;SACrB,OAAO,CAAC,eAAe,CAAC;SACxB,OAAO,CAAC,YAAY,CAAC;SACrB,OAAO,CAAC,WAAW,CAAC;SACpB,OAAO,CAAC,cAAc,CAAC;SACvB,OAAO,CAAC,aAAa,CAAC;SACtB,OAAO,CAAC,aAAa,CAAC;QACvB,2BAA2B;SAC1B,OAAO,CAAC,aAAa,CAAC;QACvB,gEAAgE;SAC/D,OAAO,CAAC,YAAY,CAAC;SACrB,aAAa,CAAC,CAAC,EAAE,0BAA0B,CAAC;SAC5C,MAAM,EAAE;SACR,IAAI,EAAE;SACN,OAAO,CAAC,KAAK,CAAC,CAAC,6DAA6D;SAC5E,UAAU,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,uEAAuE;SACvG,KAAK,EAAE,CAAC;AACb,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/output.d.ts

@@ -11,6 +11,17 @@
  *
  * @module output
  */
+/**
+ * Replace terminal control characters before rendering untrusted text.
+ *
+ * JSON output remains untouched because `JSON.stringify` escapes controls for machine consumers.
+ * Human output uses this boundary to prevent stored names or labels from emitting terminal escape
+ * sequences, changing the screen, or writing to the clipboard.
+ *
+ * @param value - Text that may originate from the server or command input
+ * @returns Printable text with C0, DEL, and C1 controls replaced
+ */
+export declare function sanitizeTerminalText(value: string): string;
 /**
  * Formats data as a table and prints to stdout.
  *

package/dist/output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,CAMpE;AAGD;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAE7C;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE7C;AAED;;;;GAIG;AACH,wBAAgB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE1C;AAED;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE3C;AAED;;;;GAIG;AACH,wBAAgB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE1C;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAIzE;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,SAAK,GAAG,MAAM,CAGzD"}
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQ1D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,CAMpE;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAE7C;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE7C;AAED;;;;GAIG;AACH,wBAAgB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE1C;AAED;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE3C;AAED;;;;GAIG;AACH,wBAAgB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE1C;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAIzE;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,SAAK,GAAG,MAAM,CAGzD"}