@portaidentity/cli 1.7.3 → 1.9.0

package/dist/auth/login-coordinator.js

@@ -0,0 +1,190 @@
+/** UI-neutral coordination for the CLI Authorization Code + PKCE flow. */
+import open from 'open';
+import { MANUAL_REDIRECT_URI, startCallbackServer } from './callback-server.js';
+import { exchangeAuthorizationCode } from './browser-flow.js';
+import { fetchIssuerJwks, verifyCliIdToken } from './id-token-verifier.js';
+import { fetchAdminMetadata } from './metadata.js';
+import { generateCodeChallenge, generateCodeVerifier, generateState } from './pkce.js';
+import { fetchVerifiedUserInfo } from '../admin/session-service.js';
+const AUTHORIZATION_SCOPES = 'openid profile email offline_access';
+/** Keeps a definite credential-write failure distinct from cancellation. */
+class CredentialPersistenceError extends Error {
+    /** Creates a sanitized persistence failure while retaining its internal cause. */
+    constructor(cause) {
+        super('Unable to save credentials.', { cause });
+        this.name = 'CredentialPersistenceError';
+    }
+}
+/** Creates fresh state, PKCE, and nonce values for one browser request. */
+export async function createAuthorizationRequest(options) {
+    const state = generateState();
+    const nonce = generateState();
+    const codeVerifier = generateCodeVerifier();
+    const redirectUri = options.redirectUri ?? MANUAL_REDIRECT_URI;
+    const url = new URL(`${options.issuer.replace(/\/+$/, '')}/auth`);
+    url.searchParams.set('response_type', 'code');
+    url.searchParams.set('client_id', options.clientId);
+    url.searchParams.set('redirect_uri', redirectUri);
+    url.searchParams.set('scope', AUTHORIZATION_SCOPES);
+    url.searchParams.set('code_challenge', generateCodeChallenge(codeVerifier));
+    url.searchParams.set('code_challenge_method', 'S256');
+    url.searchParams.set('state', state);
+    url.searchParams.set('nonce', nonce);
+    url.searchParams.set('prompt', 'login consent');
+    return { url, state, nonce, codeVerifier, redirectUri };
+}
+/** Validates one callback URL against its exact request state. */
+export function validateAuthorizationCallback(callbackUrl, request) {
+    try {
+        const url = new URL(callbackUrl);
+        const expected = new URL(request.redirectUri);
+        const code = url.searchParams.get('code');
+        if (url.origin !== expected.origin ||
+            url.pathname !== expected.pathname ||
+            url.username ||
+            url.password ||
+            url.hash ||
+            url.searchParams.get('state') !== request.state ||
+            !code ||
+            code.length > 4_096) {
+            throw new Error('Invalid callback');
+        }
+        return code;
+    }
+    catch {
+        throw new Error('Authentication failed');
+    }
+}
+/** Returns true only for cancellation raised by a caller-owned signal. */
+function isAbortError(error) {
+    return error instanceof DOMException && error.name === 'AbortError';
+}
+/** Ignores late UI completions once the owning operation is cancelled. */
+async function waitForInteraction(operation, signal) {
+    if (signal.aborted)
+        throw new DOMException('The operation was aborted', 'AbortError');
+    return new Promise((resolveInteraction, rejectInteraction) => {
+        const abort = () => rejectInteraction(new DOMException('The operation was aborted', 'AbortError'));
+        signal.addEventListener('abort', abort, { once: true });
+        operation.then(resolveInteraction, rejectInteraction).finally(() => {
+            signal.removeEventListener('abort', abort);
+        });
+    });
+}
+/** Waits for a callback while ensuring cancellation closes its listener. */
+async function waitForBrowserCallback(callback, close, signal) {
+    if (signal.aborted) {
+        close();
+        throw new DOMException('The operation was aborted', 'AbortError');
+    }
+    return new Promise((resolveCallback, rejectCallback) => {
+        const abort = () => {
+            close();
+            rejectCallback(new DOMException('The operation was aborted', 'AbortError'));
+        };
+        signal.addEventListener('abort', abort, { once: true });
+        callback.then(resolveCallback, rejectCallback).finally(() => {
+            signal.removeEventListener('abort', abort);
+        });
+    });
+}
+/** Completes one authentication attempt and persists only verified credentials. */
+export async function authenticateCliSession(request, interaction, options) {
+    if (options.signal.aborted)
+        return { status: 'cancelled' };
+    try {
+        const server = request.server.toString().replace(/\/$/, '');
+        const metadata = await fetchAdminMetadata(server, options);
+        let authorization = await createAuthorizationRequest({
+            issuer: metadata.issuer,
+            clientId: request.clientId ?? metadata.clientId,
+        });
+        let code;
+        if (request.noBrowser) {
+            await waitForInteraction(interaction.presentAuthorizationUrl(authorization.url, options.signal), options.signal);
+            code = validateAuthorizationCallback(await waitForInteraction(interaction.requestManualCallback(options.signal), options.signal), authorization);
+        }
+        else {
+            const callbackServer = await startCallbackServer(authorization.state);
+            const redirectUri = `http://127.0.0.1:${callbackServer.port}/callback`;
+            authorization.url.searchParams.set('redirect_uri', redirectUri);
+            authorization = { ...authorization, redirectUri };
+            const openBrowser = request.openBrowser ?? (async (url) => open(url.toString()));
+            try {
+                await waitForInteraction(openBrowser(authorization.url), options.signal);
+            }
+            catch (error) {
+                callbackServer.close();
+                if (isAbortError(error) || options.signal.aborted)
+                    throw error;
+                await waitForInteraction(interaction.presentAuthorizationUrl(authorization.url, options.signal), options.signal);
+                code = validateAuthorizationCallback(await waitForInteraction(interaction.requestManualCallback(options.signal), options.signal), authorization);
+                return await finishAuthentication(request, interaction, options, metadata, authorization, code, server);
+            }
+            code = await waitForBrowserCallback(callbackServer.authCode, callbackServer.close, options.signal);
+        }
+        return await finishAuthentication(request, interaction, options, metadata, authorization, code, server);
+    }
+    catch (error) {
+        if (error instanceof CredentialPersistenceError)
+            throw error;
+        if (options.signal.aborted || isAbortError(error))
+            return { status: 'cancelled' };
+        throw error;
+    }
+}
+/** Completes token verification, replacement approval, and persistence. */
+async function finishAuthentication(request, interaction, options, metadata, authorization, code, server) {
+    const clientId = request.clientId ?? metadata.clientId;
+    const tokens = await exchangeAuthorizationCode({
+        tokenEndpoint: `${metadata.issuer.replace(/\/+$/, '')}/token`,
+        clientId,
+        code,
+        codeVerifier: authorization.codeVerifier,
+        redirectUri: authorization.redirectUri,
+    }, options);
+    const jwks = await fetchIssuerJwks(`${metadata.issuer.replace(/\/+$/, '')}/jwks`, options);
+    const idTokenIdentity = await verifyCliIdToken({
+        token: tokens.id_token,
+        issuer: metadata.issuer,
+        clientId,
+        nonce: authorization.nonce,
+        jwks,
+    });
+    const profile = await fetchVerifiedUserInfo({
+        selectedServer: request.server,
+        orgSlug: metadata.orgSlug,
+        accessToken: tokens.access_token,
+        originalSubject: idTokenIdentity.sub,
+    }, options);
+    const { identity } = profile;
+    const credentials = {
+        server,
+        orgSlug: metadata.orgSlug,
+        clientId,
+        accessToken: tokens.access_token,
+        refreshToken: tokens.refresh_token,
+        idToken: tokens.id_token,
+        expiresAt: new Date(Date.now() + tokens.expires_in * 1000).toISOString(),
+        userInfo: {
+            sub: identity.sub,
+            email: identity.email ?? '',
+            name: identity.name,
+        },
+    };
+    if (request.currentServer && request.currentServer.origin !== request.server.origin) {
+        const approved = await waitForInteraction(interaction.confirmCredentialReplacement(request.currentServer, request.server, options.signal), options.signal);
+        if (!approved)
+            return { status: 'cancelled' };
+    }
+    if (options.signal.aborted)
+        return { status: 'cancelled' };
+    try {
+        await request.persistCredentials?.(credentials);
+    }
+    catch (error) {
+        throw new CredentialPersistenceError(error);
+    }
+    return { status: 'authenticated', identity, capabilities: profile.capabilities, credentials };
+}
+//# sourceMappingURL=login-coordinator.js.map

package/dist/auth/login-coordinator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-coordinator.js","sourceRoot":"","sources":["../../src/auth/login-coordinator.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAE1E,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAIpE,MAAM,oBAAoB,GAAG,qCAAqC,CAAC;AAEnE,4EAA4E;AAC5E,MAAM,0BAA2B,SAAQ,KAAK;IAC5C,kFAAkF;IAClF,YAAY,KAAc;QACxB,KAAK,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AA0ED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAAoC;IAEpC,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;IAC5C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,mBAAmB,CAAC;IAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;IAClE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;IACpD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAChD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;AAC1D,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,6BAA6B,CAC3C,WAAmB,EACnB,OAA6B;IAE7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IACE,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YAC9B,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;YAClC,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,IAAI;YACR,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,KAAK;YAC/C,CAAC,IAAI;YACL,IAAI,CAAC,MAAM,GAAG,KAAK,EACnB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC;AACtE,CAAC;AAED,0EAA0E;AAC1E,KAAK,UAAU,kBAAkB,CAAI,SAAqB,EAAE,MAAmB;IAC7E,IAAI,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,YAAY,CAAC,2BAA2B,EAAE,YAAY,CAAC,CAAC;IACtF,OAAO,IAAI,OAAO,CAAI,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,EAAE;QAC9D,MAAM,KAAK,GAAG,GAAS,EAAE,CACvB,iBAAiB,CAAC,IAAI,YAAY,CAAC,2BAA2B,EAAE,YAAY,CAAC,CAAC,CAAC;QACjF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,SAAS,CAAC,IAAI,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACjE,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AAC5E,KAAK,UAAU,sBAAsB,CACnC,QAAyB,EACzB,KAAiB,EACjB,MAAmB;IAEnB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,EAAE,CAAC;QACR,MAAM,IAAI,YAAY,CAAC,2BAA2B,EAAE,YAAY,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,IAAI,OAAO,CAAS,CAAC,eAAe,EAAE,cAAc,EAAE,EAAE;QAC7D,MAAM,KAAK,GAAG,GAAS,EAAE;YACvB,KAAK,EAAE,CAAC;YACR,cAAc,CAAC,IAAI,YAAY,CAAC,2BAA2B,EAAE,YAAY,CAAC,CAAC,CAAC;QAC9E,CAAC,CAAC;QACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAC1D,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAqB,EACrB,WAA6B,EAC7B,OAAgC;IAEhC,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3D,IAAI,aAAa,GAAG,MAAM,0BAA0B,CAAC;YACnD,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ;SAChD,CAAC,CAAC;QACH,IAAI,IAAY,CAAC;QACjB,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,kBAAkB,CACtB,WAAW,CAAC,uBAAuB,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,EACtE,OAAO,CAAC,MAAM,CACf,CAAC;YACF,IAAI,GAAG,6BAA6B,CAClC,MAAM,kBAAkB,CAAC,WAAW,CAAC,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAC3F,aAAa,CACd,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,cAAc,GAAG,MAAM,mBAAmB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YACtE,MAAM,WAAW,GAAG,oBAAoB,cAAc,CAAC,IAAI,WAAW,CAAC;YACvE,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YAChE,aAAa,GAAG,EAAE,GAAG,aAAa,EAAE,WAAW,EAAE,CAAC;YAClD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,KAAK,EAAE,GAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YACtF,IAAI,CAAC;gBACH,MAAM,kBAAkB,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC3E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,cAAc,CAAC,KAAK,EAAE,CAAC;gBACvB,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;oBAAE,MAAM,KAAK,CAAC;gBAC/D,MAAM,kBAAkB,CACtB,WAAW,CAAC,uBAAuB,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,EACtE,OAAO,CAAC,MAAM,CACf,CAAC;gBACF,IAAI,GAAG,6BAA6B,CAClC,MAAM,kBAAkB,CACtB,WAAW,CAAC,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,EACjD,OAAO,CAAC,MAAM,CACf,EACD,aAAa,CACd,CAAC;gBACF,OAAO,MAAM,oBAAoB,CAC/B,OAAO,EACP,WAAW,EACX,OAAO,EACP,QAAQ,EACR,aAAa,EACb,IAAI,EACJ,MAAM,CACP,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,MAAM,sBAAsB,CACjC,cAAc,CAAC,QAAQ,EACvB,cAAc,CAAC,KAAK,EACpB,OAAO,CAAC,MAAM,CACf,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,oBAAoB,CAC/B,OAAO,EACP,WAAW,EACX,OAAO,EACP,QAAQ,EACR,aAAa,EACb,IAAI,EACJ,MAAM,CACP,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,0BAA0B;YAAE,MAAM,KAAK,CAAC;QAC7D,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAClF,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,KAAK,UAAU,oBAAoB,CACjC,OAAqB,EACrB,WAA6B,EAC7B,OAAgC,EAChC,QAAwD,EACxD,aAAmC,EACnC,IAAY,EACZ,MAAc;IAEd,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC;IACvD,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAC5C;QACE,aAAa,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ;QAC7D,QAAQ;QACR,IAAI;QACJ,YAAY,EAAE,aAAa,CAAC,YAAY;QACxC,WAAW,EAAE,aAAa,CAAC,WAAW;KACvC,EACD,OAAO,CACR,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3F,MAAM,eAAe,GAAG,MAAM,gBAAgB,CAAC;QAC7C,KAAK,EAAE,MAAM,CAAC,QAAQ;QACtB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,QAAQ;QACR,KAAK,EAAE,aAAa,CAAC,KAAK;QAC1B,IAAI;KACL,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,qBAAqB,CACzC;QACE,cAAc,EAAE,OAAO,CAAC,MAAM;QAC9B,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,eAAe,EAAE,eAAe,CAAC,GAAG;KACrC,EACD,OAAO,CACR,CAAC;IACF,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC7B,MAAM,WAAW,GAAmB;QAClC,MAAM;QACN,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,QAAQ;QACR,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,YAAY,EAAE,MAAM,CAAC,aAAa;QAClC,OAAO,EAAE,MAAM,CAAC,QAAQ;QACxB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QACxE,QAAQ,EAAE;YACR,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,EAAE;YAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB;KACF,CAAC;IACF,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACpF,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CACvC,WAAW,CAAC,4BAA4B,CACtC,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,MAAM,CACf,EACD,OAAO,CAAC,MAAM,CACf,CAAC;QACF,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,kBAAkB,EAAE,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,WAAW,EAAE,CAAC;AAChG,CAAC"}

package/dist/auth/metadata.d.ts

@@ -10,6 +10,7 @@
  * @module auth/metadata
  */
 import type { AdminMetadata } from './types.js';
+import type { CliAuthOperationOptions } from './types.js';
 /**
  * Fetch admin metadata from the Porta server.
  *
@@ -20,7 +21,7 @@ import type { AdminMetadata } from './types.js';
  * @returns Admin metadata (issuer, clientId, orgSlug)
  * @throws Error if the server is not reachable or not initialized
  */
-export declare function fetchAdminMetadata(server: string): Promise<AdminMetadata>;
+export declare function fetchAdminMetadata(server: string, options?: CliAuthOperationOptions): Promise<AdminMetadata>;
 /**
  * Health check response from `GET /health`.
  */

package/dist/auth/metadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../src/auth/metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAMhD;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,aAAa,CAAC,CAsBxB;AAMD;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,qBAAqB;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAahC"}
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../src/auth/metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAkD1D;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,uBAAuB,GAChC,OAAO,CAAC,aAAa,CAAC,CAuCxB;AAMD;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,qBAAqB;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAatF"}

package/dist/auth/metadata.js

@@ -9,6 +9,45 @@
  *
  * @module auth/metadata
  */
+const ORGANIZATION_SLUG = /^[a-z0-9][a-z0-9-]{1,98}[a-z0-9]$/;
+/** Returns true for a bounded, non-empty discovery string. */
+function isDiscoveryString(value, maximumLength) {
+    return typeof value === 'string' && value.length > 0 && value.length <= maximumLength;
+}
+/** Validates metadata and binds its issuer to the selected Porta origin. */
+function parseAdminMetadata(value, server) {
+    if (!value || typeof value !== 'object')
+        throw new Error('Authentication failed');
+    const candidate = value;
+    if (!isDiscoveryString(candidate.clientId, 256) ||
+        !isDiscoveryString(candidate.orgSlug, 100) ||
+        !ORGANIZATION_SLUG.test(candidate.orgSlug) ||
+        !isDiscoveryString(candidate.issuer, 2_048)) {
+        throw new Error('Authentication failed');
+    }
+    let issuer;
+    try {
+        issuer = new URL(candidate.issuer);
+    }
+    catch {
+        throw new Error('Authentication failed');
+    }
+    const expectedPath = `/${candidate.orgSlug}`;
+    if (issuer.protocol !== 'https:' ||
+        issuer.username ||
+        issuer.password ||
+        issuer.origin !== server.origin ||
+        issuer.pathname.replace(/\/+$/, '') !== expectedPath ||
+        issuer.search ||
+        issuer.hash) {
+        throw new Error('Authentication failed');
+    }
+    return {
+        issuer: issuer.toString().replace(/\/$/, ''),
+        clientId: candidate.clientId,
+        orgSlug: candidate.orgSlug,
+    };
+}
 // ---------------------------------------------------------------------------
 // Metadata Fetch
 // ---------------------------------------------------------------------------
@@ -22,15 +61,32 @@
  * @returns Admin metadata (issuer, clientId, orgSlug)
  * @throws Error if the server is not reachable or not initialized
  */
-export async function fetchAdminMetadata(server) {
+export async function fetchAdminMetadata(server, options) {
+    let selectedServer;
+    try {
+        selectedServer = new URL(server);
+        if (selectedServer.protocol !== 'https:' ||
+            selectedServer.username ||
+            selectedServer.password ||
+            !/^\/*$/.test(selectedServer.pathname) ||
+            selectedServer.search ||
+            selectedServer.hash) {
+            throw new Error('invalid server');
+        }
+    }
+    catch {
+        throw new Error('Authentication failed');
+    }
     let response;
     try {
-        response = await fetch(`${server}/api/admin/metadata`, {
-            signal: AbortSignal.timeout(10_000), // 10s timeout
+        response = await fetch(`${selectedServer.origin}/api/admin/metadata`, {
+            signal: options?.signal ?? AbortSignal.timeout(10_000),
         });
     }
-    catch {
-        throw new Error(`Cannot connect to ${server}. Is the server running?`);
+    catch (error) {
+        if (error instanceof DOMException && error.name === 'AbortError')
+            throw error;
+        throw new Error('Cannot connect to the Porta server. Is it running?', { cause: error });
     }
     if (!response.ok) {
         if (response.status === 503) {
@@ -38,7 +94,12 @@ export async function fetchAdminMetadata(server) {
         }
         throw new Error(`Cannot fetch admin metadata: HTTP ${response.status}`);
     }
-    return response.json();
+    try {
+        return parseAdminMetadata(await response.json(), selectedServer);
+    }
+    catch {
+        throw new Error('Authentication failed');
+    }
 }
 /**
  * Check server health via `GET /health`.

package/dist/auth/metadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../src/auth/metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc;IAEd,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,qBAAqB,EAAE;YACrD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,cAAc;SACpD,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,qBAAqB,MAAM,0BAA0B,CACtD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,EAA4B,CAAC;AACnD,CAAC;AAgBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,SAAS,EAAE;YAC/C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,aAAa;SAClD,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,QAAQ,CAAC,IAAI,EAA6B,CAAC;QACpD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../src/auth/metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,MAAM,iBAAiB,GAAG,mCAAmC,CAAC;AAE9D,8DAA8D;AAC9D,SAAS,iBAAiB,CAAC,KAAc,EAAE,aAAqB;IAC9D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,aAAa,CAAC;AACxF,CAAC;AAED,4EAA4E;AAC5E,SAAS,kBAAkB,CAAC,KAAc,EAAE,MAAW;IACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,IACE,CAAC,iBAAiB,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC;QAC3C,CAAC,iBAAiB,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC;QAC1C,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;QAC1C,CAAC,iBAAiB,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,EAC3C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;IAC7C,IACE,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAC5B,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAC/B,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,YAAY;QACpD,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,IAAI,EACX,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAC5C,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,OAAO,EAAE,SAAS,CAAC,OAAO;KAC3B,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,OAAiC;IAEjC,IAAI,cAAmB,CAAC;IACxB,IAAI,CAAC;QACH,cAAc,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,IACE,cAAc,CAAC,QAAQ,KAAK,QAAQ;YACpC,cAAc,CAAC,QAAQ;YACvB,cAAc,CAAC,QAAQ;YACvB,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;YACtC,cAAc,CAAC,MAAM;YACrB,cAAc,CAAC,IAAI,EACnB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,CAAC,MAAM,qBAAqB,EAAE;YACpE,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACvD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;YAAE,MAAM,KAAK,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,oDAAoD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,cAAc,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAgBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAc;IACpD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,SAAS,EAAE;YAC/C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,aAAa;SAClD,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,QAAQ,CAAC,IAAI,EAA6B,CAAC;QACpD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/auth/types.d.ts

@@ -80,4 +80,18 @@ export interface AuthFlowResult {
         name?: string;
     };
 }
+/** Allowlisted identity claims accepted from a verified OIDC ID token. */
+export interface VerifiedIdentity {
+    /** Stable, non-empty OIDC subject identifier. */
+    readonly sub: string;
+    /** Optional verified display email. */
+    readonly email?: string;
+    /** Optional verified display name. */
+    readonly name?: string;
+}
+/** Cancellation boundary shared by authentication network operations. */
+export interface CliAuthOperationOptions {
+    /** Aborts the active request without accepting late results. */
+    readonly signal: AbortSignal;
+}
 //# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;CACpB;AAMD;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,uBAAuB;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,QAAQ,EAAE;QACR,wCAAwC;QACxC,GAAG,EAAE,MAAM,CAAC;QACZ,yBAAyB;QACzB,KAAK,EAAE,MAAM,CAAC;QACd,mCAAmC;QACnC,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;CACH"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;CACpB;AAMD;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,uBAAuB;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,QAAQ,EAAE;QACR,wCAAwC;QACxC,GAAG,EAAE,MAAM,CAAC;QACZ,yBAAyB;QACzB,KAAK,EAAE,MAAM,CAAC;QACd,mCAAmC;QACnC,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC/B,iDAAiD;IACjD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,yEAAyE;AACzE,MAAM,WAAW,uBAAuB;IACtC,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B"}

package/dist/client-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-factory.d.ts","sourceRoot":"","sources":["../src/client-factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAM3E;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,aAAa,GAAG,WAAW,CAahE"}
+{"version":3,"file":"client-factory.d.ts","sourceRoot":"","sources":["../src/client-factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAA2C,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAWlG;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,aAAa,GAAG,WAAW,CA2BhE"}

package/dist/client-factory.js

@@ -13,7 +13,8 @@
  */
 import { createPortaClient } from '@portaidentity/sdk';
 import { createNodeTransport, createCliAuth } from '@portaidentity/sdk/node';
-import { resolveServerUrl } from './global-options.js';
+import { normalizeServerOrigin, resolveServerUrl } from './global-options.js';
+import { createCliCredentialPersistence, getCredentialsPath, loadCredentials, } from './credential-store.js';
 // ---------------------------------------------------------------------------
 // Client Creation
 // ---------------------------------------------------------------------------
@@ -31,12 +32,24 @@ import { resolveServerUrl } from './global-options.js';
  */
 export function createClient(options) {
     const baseUrl = resolveServerUrl(options);
+    const credentials = loadCredentials();
+    if (credentials &&
+        normalizeServerOrigin(credentials.server).origin !== normalizeServerOrigin(baseUrl).origin) {
+        throw new Error('Stored credentials belong to a different Porta server. Run porta login.');
+    }
     // Handle --insecure flag for self-signed certificates
     // This must be set before creating the transport so fetch() picks it up
     if (options.insecure) {
         process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
     }
-    const auth = createCliAuth();
+    const credentialsPath = getCredentialsPath();
+    const auth = createCliAuth({
+        credentialsPath,
+        credentialPersistence: createCliCredentialPersistence({
+            credentialsPath,
+            lockTimeoutMs: 5_000,
+        }),
+    });
     const transport = createNodeTransport({ baseUrl, auth });
     return createPortaClient({ transport });
 }

package/dist/client-factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-factory.js","sourceRoot":"","sources":["../src/client-factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAE7E,OAAO,EAAE,gBAAgB,EAAsB,MAAM,qBAAqB,CAAC;AAE3E,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,OAAsB;IACjD,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE1C,sDAAsD;IACtD,wEAAwE;IACxE,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG,GAAG,CAAC;IACjD,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAEzD,OAAO,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"client-factory.js","sourceRoot":"","sources":["../src/client-factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAE7E,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAsB,MAAM,qBAAqB,CAAC;AAClG,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAE/B,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,OAAsB;IACjD,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;IACtC,IACE,WAAW;QACX,qBAAqB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,qBAAqB,CAAC,OAAO,CAAC,CAAC,MAAM,EAC1F,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IAED,sDAAsD;IACtD,wEAAwE;IACxE,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG,GAAG,CAAC;IACjD,CAAC;IAED,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAC7C,MAAM,IAAI,GAAG,aAAa,CAAC;QACzB,eAAe;QACf,qBAAqB,EAAE,8BAA8B,CAAC;YACpD,eAAe;YACf,aAAa,EAAE,KAAK;SACrB,CAAC;KACH,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAEzD,OAAO,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;AAC1C,CAAC"}

package/dist/commands/admin.d.ts

@@ -0,0 +1,22 @@
+/** Thin command adapter for the embedded terminal administration application. */
+import type { CommandModule } from 'yargs';
+import type { AdminApplicationOptions, AdminExitCode } from '../admin/index.js';
+import { type GlobalOptions } from '../global-options.js';
+/** Parsed arguments accepted by `porta admin`. */
+export type AdminArguments = GlobalOptions;
+/** Injectable command boundaries used by focused preflight tests. */
+export interface AdminCommandDependencies {
+    /** Whether standard input is attached to an interactive terminal. */
+    readonly stdinIsTTY: boolean;
+    /** Whether standard output is attached to an interactive terminal. */
+    readonly stdoutIsTTY: boolean;
+    /** Writes a concise preflight failure after no screen has been constructed. */
+    readonly writeStderr: (message: string) => void;
+    /** Starts the embedded application after all local checks pass. */
+    readonly runApplication: (options: AdminApplicationOptions) => Promise<AdminExitCode>;
+}
+/** Runs the command preflight and starts the application only when it is safe. */
+export declare function runAdminCommand(arguments_: AdminArguments, dependencies?: AdminCommandDependencies): Promise<AdminExitCode>;
+/** Registers the interactive administration application. */
+export declare const adminCommand: CommandModule<GlobalOptions, AdminArguments>;
+//# sourceMappingURL=admin.d.ts.map

package/dist/commands/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/commands/admin.ts"],"names":[],"mappings":"AAAA,iFAAiF;AAEjF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAE3C,OAAO,KAAK,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGhF,OAAO,EAA2C,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAEnG,kDAAkD;AAClD,MAAM,MAAM,cAAc,GAAG,aAAa,CAAC;AAE3C,qEAAqE;AACrE,MAAM,WAAW,wBAAwB;IACvC,qEAAqE;IACrE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD,mEAAmE;IACnE,QAAQ,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;CACvF;AAgDD,kFAAkF;AAClF,wBAAsB,eAAe,CACnC,UAAU,EAAE,cAAc,EAC1B,YAAY,GAAE,wBAA+C,GAC5D,OAAO,CAAC,aAAa,CAAC,CAiExB;AAED,4DAA4D;AAC5D,eAAO,MAAM,YAAY,EAAE,aAAa,CAAC,aAAa,EAAE,cAAc,CAMrE,CAAC"}

package/dist/commands/admin.js

@@ -0,0 +1,112 @@
+/** Thin command adapter for the embedded terminal administration application. */
+import { runAdminApplication } from '../admin/index.js';
+import { prepareAdminSession } from '../admin/session-service.js';
+import { createClient } from '../client-factory.js';
+import { normalizeServerOrigin, resolveServerUrl } from '../global-options.js';
+/** Production process and application boundaries. */
+const DEFAULT_DEPENDENCIES = {
+    stdinIsTTY: process.stdin.isTTY === true,
+    stdoutIsTTY: process.stdout.isTTY === true,
+    writeStderr: (message) => process.stderr.write(`${message}\n`),
+    runApplication: runAdminApplication,
+};
+const INSECURE_TLS_RUNTIME_WARNING = "Setting the NODE_TLS_REJECT_UNAUTHORIZED environment variable to '0' makes TLS connections and HTTPS requests insecure by disabling certificate verification.";
+/**
+ * Prevents Node's redundant insecure-TLS warning from writing outside JSVision's frame renderer.
+ *
+ * The application retains its own persistent insecure-mode warning. Every unrelated process warning
+ * still reaches Node's original warning handler, and the process hook is restored after the TUI exits.
+ */
+async function withoutInsecureTlsRuntimeWarning(operation) {
+    const originalEmitWarning = process.emitWarning;
+    const filteredEmitWarning = (warning, ...metadata) => {
+        const message = typeof warning === 'string' ? warning : warning.message;
+        if (message === INSECURE_TLS_RUNTIME_WARNING)
+            return;
+        Reflect.apply(originalEmitWarning, process, [warning, ...metadata]);
+    };
+    Object.defineProperty(process, 'emitWarning', {
+        configurable: true,
+        value: filteredEmitWarning,
+        writable: true,
+    });
+    try {
+        return await operation();
+    }
+    finally {
+        Object.defineProperty(process, 'emitWarning', {
+            configurable: true,
+            value: originalEmitWarning,
+            writable: true,
+        });
+    }
+}
+/** Reports one bounded usage failure without constructing terminal state. */
+function rejectUsage(dependencies, message) {
+    dependencies.writeStderr(message);
+    return 2;
+}
+/** Runs the command preflight and starts the application only when it is safe. */
+export async function runAdminCommand(arguments_, dependencies = DEFAULT_DEPENDENCIES) {
+    if (!dependencies.stdinIsTTY || !dependencies.stdoutIsTTY) {
+        return rejectUsage(dependencies, 'porta admin requires an interactive input and output TTY.');
+    }
+    if (arguments_.json || arguments_.force) {
+        return rejectUsage(dependencies, 'porta admin cannot be used with --json or --force.');
+    }
+    let server;
+    try {
+        server = arguments_.server
+            ? normalizeServerOrigin(arguments_.server)
+            : normalizeServerOrigin(resolveServerUrl(arguments_));
+    }
+    catch {
+        if (arguments_.server) {
+            return rejectUsage(dependencies, 'Select a valid HTTPS Porta server origin.');
+        }
+    }
+    if (arguments_.insecure)
+        process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
+    try {
+        const runApplication = () => {
+            let client;
+            const selectedClient = (selectedServer) => {
+                client ??= createClient({
+                    ...arguments_,
+                    server: selectedServer.origin,
+                });
+                return client;
+            };
+            return dependencies.runApplication({
+                server,
+                insecure: arguments_.insecure,
+                showInsecureWarning: arguments_.insecure,
+                prepareSession: (selectedServer, interaction) => prepareAdminSession(selectedServer, interaction, () => selectedClient(selectedServer).organizations, () => selectedClient(selectedServer).users, () => selectedClient(selectedServer).applications, () => selectedClient(selectedServer).clients, () => ({
+                    roles: selectedClient(selectedServer).roles,
+                    permissions: selectedClient(selectedServer).permissions,
+                    userRoles: selectedClient(selectedServer).userRoles,
+                }), {
+                    organizations: () => selectedClient(selectedServer).organizations,
+                    branding: () => selectedClient(selectedServer).branding,
+                    twoFactor: () => selectedClient(selectedServer).twoFactor,
+                }, () => selectedClient(selectedServer).exports, () => selectedClient(selectedServer).imports, () => selectedClient(selectedServer).config),
+            });
+        };
+        return await (arguments_.insecure
+            ? withoutInsecureTlsRuntimeWarning(runApplication)
+            : runApplication());
+    }
+    catch {
+        dependencies.writeStderr('Unable to start Porta administration.');
+        return 1;
+    }
+}
+/** Registers the interactive administration application. */
+export const adminCommand = {
+    command: 'admin',
+    describe: 'Open the interactive Porta administration application',
+    handler: async (arguments_) => {
+        process.exitCode = await runAdminCommand(arguments_);
+    },
+};
+//# sourceMappingURL=admin.js.map

package/dist/commands/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../src/commands/admin.ts"],"names":[],"mappings":"AAAA,iFAAiF;AAGjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAsB,MAAM,sBAAsB,CAAC;AAiBnG,qDAAqD;AACrD,MAAM,oBAAoB,GAA6B;IACrD,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI;IACxC,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI;IAC1C,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC;IAC9D,cAAc,EAAE,mBAAmB;CACpC,CAAC;AAEF,MAAM,4BAA4B,GAChC,+JAA+J,CAAC;AAElK;;;;;GAKG;AACH,KAAK,UAAU,gCAAgC,CAAI,SAA2B;IAC5E,MAAM,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC;IAChD,MAAM,mBAAmB,GAAG,CAAC,OAAuB,EAAE,GAAG,QAA4B,EAAQ,EAAE;QAC7F,MAAM,OAAO,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACxE,IAAI,OAAO,KAAK,4BAA4B;YAAE,OAAO;QACrD,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC;IACF,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,aAAa,EAAE;QAC5C,YAAY,EAAE,IAAI;QAClB,KAAK,EAAE,mBAAmB;QAC1B,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,aAAa,EAAE;YAC5C,YAAY,EAAE,IAAI;YAClB,KAAK,EAAE,mBAAmB;YAC1B,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,YAAsC,EAAE,OAAe;IAC1E,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAA0B,EAC1B,YAAY,GAA6B,oBAAoB;IAE7D,IAAI,CAAC,YAAY,CAAC,UAAU,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;QAC1D,OAAO,WAAW,CAAC,YAAY,EAAE,2DAA2D,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;QACxC,OAAO,WAAW,CAAC,YAAY,EAAE,oDAAoD,CAAC,CAAC;IACzF,CAAC;IAED,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,MAAM;YACxB,CAAC,CAAC,qBAAqB,CAAC,UAAU,CAAC,MAAM,CAAC;YAC1C,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACtB,OAAO,WAAW,CAAC,YAAY,EAAE,2CAA2C,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG,GAAG,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,GAAG,EAAE;YAC1B,IAAI,MAAmD,CAAC;YACxD,MAAM,cAAc,GAAG,CAAC,cAAmB,EAAmC,EAAE;gBAC9E,MAAM,KAAK,YAAY,CAAC;oBACtB,GAAG,UAAU;oBACb,MAAM,EAAE,cAAc,CAAC,MAAM;iBAC9B,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC;YACF,OAAO,YAAY,CAAC,cAAc,CAAC;gBACjC,MAAM;gBACN,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,mBAAmB,EAAE,UAAU,CAAC,QAAQ;gBACxC,cAAc,EAAE,CAAC,cAAc,EAAE,WAAW,EAAE,EAAE,CAC9C,mBAAmB,CACjB,cAAc,EACd,WAAW,EACX,GAAG,EAAE,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,aAAa,EAClD,GAAG,EAAE,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,KAAK,EAC1C,GAAG,EAAE,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,YAAY,EACjD,GAAG,EAAE,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,OAAO,EAC5C,GAAG,EAAE,CAAC,CAAC;oBACL,KAAK,EAAE,cAAc,CAAC,cAAc,CAAC,CAAC,KAAK;oBAC3C,WAAW,EAAE,cAAc,CAAC,cAAc,CAAC,CAAC,WAAW;oBACvD,SAAS,EAAE,cAAc,CAAC,cAAc,CAAC,CAAC,SAAS;iBACpD,CAAC,EACF;oBACE,aAAa,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,aAAa;oBACjE,QAAQ,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,QAAQ;oBACvD,SAAS,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,SAAS;iBAC1D,EACD,GAAG,EAAE,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,OAAO,EAC5C,GAAG,EAAE,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,OAAO,EAC5C,GAAG,EAAE,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,MAAM,CAC5C;aACJ,CAAC,CAAC;QACL,CAAC,CAAC;QACF,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ;YAC/B,CAAC,CAAC,gCAAgC,CAAC,cAAc,CAAC;YAClD,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,CAAC,WAAW,CAAC,uCAAuC,CAAC,CAAC;QAClE,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,MAAM,YAAY,GAAiD;IACxE,OAAO,EAAE,OAAO;IAChB,QAAQ,EAAE,uDAAuD;IACjE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;QAC5B,OAAO,CAAC,QAAQ,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,CAAC;IACvD,CAAC;CACF,CAAC"}

package/dist/commands/app-claim.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-claim.d.ts","sourceRoot":"","sources":["../../src/commands/app-claim.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAuC1D,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC,aAAa,EAAE,aAAa,CA4KvE,CAAC"}
+{"version":3,"file":"app-claim.d.ts","sourceRoot":"","sources":["../../src/commands/app-claim.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAwC1D,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC,aAAa,EAAE,aAAa,CAoLvE,CAAC"}

package/dist/commands/app-claim.js

@@ -6,6 +6,7 @@
 import { createClient } from '../client-factory.js';
 import { handleError } from '../error-handler.js';
 import { printTable, printJson, success, warn, info, formatDate } from '../output.js';
+import { confirm } from '../prompt.js';
 // ---------------------------------------------------------------------------
 // Command definition
 // ---------------------------------------------------------------------------
@@ -125,7 +126,7 @@ export const appClaimCommand = {
                 handleError(err, argv.verbose);
             }
         })
-            .command('archive <app-id> <claim-id>', 'Archive a claim definition', (y) => y
+            .command('delete <app-id> <claim-id>', 'Permanently delete a claim definition and its values', (y) => y
             .positional('app-id', {
             type: 'string',
             demandOption: true,
@@ -138,14 +139,20 @@ export const appClaimCommand = {
         }), async (argv) => {
             try {
                 const client = createClient(argv);
-                await client.customClaims.archive(argv['app-id'], argv['claim-id']);
-                success('Claim definition archived');
+                const claim = await client.customClaims.get(argv['app-id'], argv['claim-id']);
+                const confirmed = await confirm(`Keep claim "${claim.name}" (${claim.slug}), or Delete ${claim.name}? This permanently deletes its user values.`);
+                if (!confirmed) {
+                    warn('Operation cancelled');
+                    return;
+                }
+                await client.customClaims.delete(argv['app-id'], argv['claim-id']);
+                success(`Claim definition deleted: ${claim.name} (${claim.slug})`);
             }
             catch (err) {
                 handleError(err, argv.verbose);
             }
         })
-            .demandCommand(1, 'Specify a claim subcommand: create, list, show, archive');
+            .demandCommand(1, 'Specify a claim subcommand: create, list, show, delete');
     },
     handler: () => { },
 };