@sanity/cli 6.5.2 → 6.6.0

package/README.md

@@ -2489,13 +2489,14 @@ Log in to your Sanity account
 
 ```
 USAGE
-  $ sanity login [--open] [--provider <providerId> | --sso <slug>] [--sso-provider <name> ]
+  $ sanity login [--open] [--provider <providerId> | --sso <slug> | --with-token] [--sso-provider <name> ]
 
 FLAGS
   --[no-]open              Open a browser window to log in (`--no-open` only prints URL)
   --provider=<providerId>  Log in using the given provider
   --sso=<slug>             Log in using Single Sign-On, using the given organization slug
   --sso-provider=<name>    Select a specific SSO provider by name (use with --sso)
+  --with-token             Read token from standard input
 
 DESCRIPTION
   Log in to your Sanity account
@@ -2516,6 +2517,10 @@ EXAMPLES
   Log in using a specific SSO provider within an organization
 
     $ sanity login --sso my-organization --sso-provider "Okta SSO"
+
+  Log in using a token from standard input
+
+    $ sanity login --with-token < token.txt
 ```
 
 ## `sanity logout`

package/bin/run.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import {execute} from '@oclif/core'
+import {execute, settings} from '@oclif/core'
 
 var err = '\u001B[31m\u001B[1mERROR:\u001B[22m\u001B[39m '
 var nodeVersionParts = process.version.replace(/^v/i, '').split('.').map(Number)
@@ -30,4 +30,6 @@ if (!isSupportedNodeVersion(majorVersion, minorVersion, patchVersion)) {
   process.exit(1)
 }
 
+settings.enableAutoTranspile = false
+
 await execute({dir: import.meta.url})

package/dist/actions/auth/login/login.js

@@ -1,16 +1,19 @@
 import { getCliToken, getUserConfig, setCliUserConfig, subdebug } from '@sanity/cli-core';
 import { spinner } from '@sanity/cli-core/ux';
+import { isHttpError } from '@sanity/client';
 import open from 'open';
 import { logout } from '../../../services/auth.js';
 import { LoginTrace } from '../../../telemetry/login.telemetry.js';
 import { canLaunchBrowser } from '../../../util/canLaunchBrowser.js';
 import { startServerForTokenCallback } from '../authServer.js';
 import { getProvider } from './getProvider.js';
+import { isSanityApiToken, validateToken } from './validateToken.js';
 const debug = subdebug('login');
 /**
  * Trigger the authentication flow for the CLI.
  *
- * NOTE: This uses terminal prompts and will not work for non-interactive/programmatic uses.
+ * NOTE: Without a token option, this uses terminal prompts and will not work for
+ * non-interactive/programmatic uses.
  *
  * @param options - Options for the login operation
  * @returns Promise that resolves when the login operation is complete
@@ -19,9 +22,19 @@ const debug = subdebug('login');
  */ export async function login(options) {
     const { output, telemetry } = options;
     const previousToken = await getCliToken();
-    const hasExistingToken = Boolean(previousToken);
     const trace = telemetry.trace(LoginTrace);
     trace.start();
+    if (typeof options.token === 'string') {
+        try {
+            const authToken = await validateToken(options.token);
+            await storeAuthToken(authToken, previousToken, output);
+            trace.complete();
+        } catch (err) {
+            trace.error(err);
+            throw err;
+        }
+        return;
+    }
     const provider = await getProvider({
         experimental: options.experimental,
         orgSlug: options.sso,
@@ -62,20 +75,30 @@ const debug = subdebug('login');
             server.close(()=>resolve());
         });
     }
-    // Store the token
+    await storeAuthToken(authToken, previousToken, output);
+    trace.complete();
+}
+async function storeAuthToken(authToken, previousToken, output) {
     setCliUserConfig('authToken', authToken);
-    // Clear cached telemetry consent
     getUserConfig().delete('telemetryConsent');
     // If we had a session previously, attempt to clear it
-    if (hasExistingToken) {
-        await logout(previousToken).catch((err)=>{
-            const statusCode = err && err.response && err.response.statusCode;
-            if (statusCode !== 401) {
-                output.warn('Failed to invalidate previous session');
-            }
-        });
+    if (previousToken && previousToken !== authToken) {
+        await invalidateAuthToken(previousToken, output);
+    }
+}
+async function invalidateAuthToken(token, output) {
+    try {
+        if (await isSanityApiToken(token)) return;
+    } catch (err) {
+        if (isHttpError(err) && err.statusCode === 401) return;
+    }
+    try {
+        await logout(token);
+    } catch (err) {
+        if (!isHttpError(err) || err.statusCode !== 401) {
+            output.warn('Failed to invalidate previous session');
+        }
     }
-    trace.complete();
 }
 
 //# sourceMappingURL=login.js.map

package/dist/actions/auth/login/login.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/actions/auth/login/login.ts"],"sourcesContent":["import {\n  type CLITelemetryStore,\n  getCliToken,\n  getUserConfig,\n  type Output,\n  setCliUserConfig,\n  subdebug,\n} from '@sanity/cli-core'\nimport {spinner} from '@sanity/cli-core/ux'\nimport open from 'open'\n\nimport {logout} from '../../../services/auth.js'\nimport {LoginTrace} from '../../../telemetry/login.telemetry.js'\nimport {canLaunchBrowser} from '../../../util/canLaunchBrowser.js'\nimport {startServerForTokenCallback} from '../authServer.js'\nimport {getProvider} from './getProvider.js'\n\nconst debug = subdebug('login')\n\ninterface LoginOptions {\n  output: Output\n\n  telemetry: CLITelemetryStore\n\n  experimental?: boolean\n  open?: boolean\n  provider?: string\n  sso?: string\n  ssoProvider?: string\n}\n\n/**\n * Trigger the authentication flow for the CLI.\n *\n * NOTE: This uses terminal prompts and will not work for non-interactive/programmatic uses.\n *\n * @param options - Options for the login operation\n * @returns Promise that resolves when the login operation is complete\n * @throws Will throw if login fails or is cancelled\n * @internal\n */\nexport async function login(options: LoginOptions) {\n  const {output, telemetry} = options\n  const previousToken = await getCliToken()\n  const hasExistingToken = Boolean(previousToken)\n\n  const trace = telemetry.trace(LoginTrace)\n  trace.start()\n\n  const provider = await getProvider({\n    experimental: options.experimental,\n    orgSlug: options.sso,\n    specifiedProvider: options.provider,\n    ssoProvider: options.ssoProvider,\n  })\n\n  trace.log({provider: provider?.name, step: 'selectProvider'})\n\n  if (provider === undefined) {\n    throw new Error('No authentication providers found')\n  }\n\n  const {loginUrl, server, token: tokenPromise} = await startServerForTokenCallback(provider.url)\n\n  trace.log({step: 'waitForToken'})\n\n  // Open a browser on the login page (or tell the user to)\n  const shouldLaunchBrowser = canLaunchBrowser() && options.open !== false\n  const actionText = shouldLaunchBrowser ? 'Opening browser at' : 'Please open a browser at'\n\n  output.log(`\\n${actionText} ${loginUrl.href}\\n`)\n\n  const spin = spinner('Waiting for browser login to complete... Press Ctrl + C to cancel').start()\n\n  if (shouldLaunchBrowser) {\n    open(loginUrl.href)\n  }\n\n  // Wait for a success/error on the HTTP callback server\n  let authToken: string\n  try {\n    authToken = (await tokenPromise).token\n    spin.stop()\n  } catch (err: unknown) {\n    spin.stop()\n    trace.error(err as Error)\n    debug('Error retrieving token: %O', err)\n    throw err\n  } finally {\n    await new Promise<void>((resolve) => {\n      server.close(() => resolve())\n    })\n  }\n\n  // Store the token\n  setCliUserConfig('authToken', authToken)\n\n  // Clear cached telemetry consent\n  getUserConfig().delete('telemetryConsent')\n\n  // If we had a session previously, attempt to clear it\n  if (hasExistingToken) {\n    await logout(previousToken).catch((err) => {\n      const statusCode = err && err.response && err.response.statusCode\n      if (statusCode !== 401) {\n        output.warn('Failed to invalidate previous session')\n      }\n    })\n  }\n\n  trace.complete()\n}\n"],"names":["getCliToken","getUserConfig","setCliUserConfig","subdebug","spinner","open","logout","LoginTrace","canLaunchBrowser","startServerForTokenCallback","getProvider","debug","login","options","output","telemetry","previousToken","hasExistingToken","Boolean","trace","start","provider","experimental","orgSlug","sso","specifiedProvider","ssoProvider","log","name","step","undefined","Error","loginUrl","server","token","tokenPromise","url","shouldLaunchBrowser","actionText","href","spin","authToken","stop","err","error","Promise","resolve","close","delete","catch","statusCode","response","warn","complete"],"mappings":"AAAA,SAEEA,WAAW,EACXC,aAAa,EAEbC,gBAAgB,EAChBC,QAAQ,QACH,mBAAkB;AACzB,SAAQC,OAAO,QAAO,sBAAqB;AAC3C,OAAOC,UAAU,OAAM;AAEvB,SAAQC,MAAM,QAAO,4BAA2B;AAChD,SAAQC,UAAU,QAAO,wCAAuC;AAChE,SAAQC,gBAAgB,QAAO,oCAAmC;AAClE,SAAQC,2BAA2B,QAAO,mBAAkB;AAC5D,SAAQC,WAAW,QAAO,mBAAkB;AAE5C,MAAMC,QAAQR,SAAS;AAcvB;;;;;;;;;CASC,GACD,OAAO,eAAeS,MAAMC,OAAqB;IAC/C,MAAM,EAACC,MAAM,EAAEC,SAAS,EAAC,GAAGF;IAC5B,MAAMG,gBAAgB,MAAMhB;IAC5B,MAAMiB,mBAAmBC,QAAQF;IAEjC,MAAMG,QAAQJ,UAAUI,KAAK,CAACZ;IAC9BY,MAAMC,KAAK;IAEX,MAAMC,WAAW,MAAMX,YAAY;QACjCY,cAAcT,QAAQS,YAAY;QAClCC,SAASV,QAAQW,GAAG;QACpBC,mBAAmBZ,QAAQQ,QAAQ;QACnCK,aAAab,QAAQa,WAAW;IAClC;IAEAP,MAAMQ,GAAG,CAAC;QAACN,UAAUA,UAAUO;QAAMC,MAAM;IAAgB;IAE3D,IAAIR,aAAaS,WAAW;QAC1B,MAAM,IAAIC,MAAM;IAClB;IAEA,MAAM,EAACC,QAAQ,EAAEC,MAAM,EAAEC,OAAOC,YAAY,EAAC,GAAG,MAAM1B,4BAA4BY,SAASe,GAAG;IAE9FjB,MAAMQ,GAAG,CAAC;QAACE,MAAM;IAAc;IAE/B,yDAAyD;IACzD,MAAMQ,sBAAsB7B,sBAAsBK,QAAQR,IAAI,KAAK;IACnE,MAAMiC,aAAaD,sBAAsB,uBAAuB;IAEhEvB,OAAOa,GAAG,CAAC,CAAC,EAAE,EAAEW,WAAW,CAAC,EAAEN,SAASO,IAAI,CAAC,EAAE,CAAC;IAE/C,MAAMC,OAAOpC,QAAQ,qEAAqEgB,KAAK;IAE/F,IAAIiB,qBAAqB;QACvBhC,KAAK2B,SAASO,IAAI;IACpB;IAEA,uDAAuD;IACvD,IAAIE;IACJ,IAAI;QACFA,YAAY,AAAC,CAAA,MAAMN,YAAW,EAAGD,KAAK;QACtCM,KAAKE,IAAI;IACX,EAAE,OAAOC,KAAc;QACrBH,KAAKE,IAAI;QACTvB,MAAMyB,KAAK,CAACD;QACZhC,MAAM,8BAA8BgC;QACpC,MAAMA;IACR,SAAU;QACR,MAAM,IAAIE,QAAc,CAACC;YACvBb,OAAOc,KAAK,CAAC,IAAMD;QACrB;IACF;IAEA,kBAAkB;IAClB5C,iBAAiB,aAAauC;IAE9B,iCAAiC;IACjCxC,gBAAgB+C,MAAM,CAAC;IAEvB,sDAAsD;IACtD,IAAI/B,kBAAkB;QACpB,MAAMX,OAAOU,eAAeiC,KAAK,CAAC,CAACN;YACjC,MAAMO,aAAaP,OAAOA,IAAIQ,QAAQ,IAAIR,IAAIQ,QAAQ,CAACD,UAAU;YACjE,IAAIA,eAAe,KAAK;gBACtBpC,OAAOsC,IAAI,CAAC;YACd;QACF;IACF;IAEAjC,MAAMkC,QAAQ;AAChB"}
+{"version":3,"sources":["../../../../src/actions/auth/login/login.ts"],"sourcesContent":["import {\n  type CLITelemetryStore,\n  getCliToken,\n  getUserConfig,\n  type Output,\n  setCliUserConfig,\n  subdebug,\n} from '@sanity/cli-core'\nimport {spinner} from '@sanity/cli-core/ux'\nimport {isHttpError} from '@sanity/client'\nimport open from 'open'\n\nimport {logout} from '../../../services/auth.js'\nimport {LoginTrace} from '../../../telemetry/login.telemetry.js'\nimport {canLaunchBrowser} from '../../../util/canLaunchBrowser.js'\nimport {startServerForTokenCallback} from '../authServer.js'\nimport {getProvider} from './getProvider.js'\nimport {isSanityApiToken, validateToken} from './validateToken.js'\n\nconst debug = subdebug('login')\n\ninterface LoginOptions {\n  output: Output\n\n  telemetry: CLITelemetryStore\n\n  experimental?: boolean\n  open?: boolean\n  provider?: string\n  sso?: string\n  ssoProvider?: string\n  token?: string\n}\n\n/**\n * Trigger the authentication flow for the CLI.\n *\n * NOTE: Without a token option, this uses terminal prompts and will not work for\n * non-interactive/programmatic uses.\n *\n * @param options - Options for the login operation\n * @returns Promise that resolves when the login operation is complete\n * @throws Will throw if login fails or is cancelled\n * @internal\n */\nexport async function login(options: LoginOptions) {\n  const {output, telemetry} = options\n  const previousToken = await getCliToken()\n\n  const trace = telemetry.trace(LoginTrace)\n  trace.start()\n\n  if (typeof options.token === 'string') {\n    try {\n      const authToken = await validateToken(options.token)\n      await storeAuthToken(authToken, previousToken, output)\n      trace.complete()\n    } catch (err: unknown) {\n      trace.error(err as Error)\n      throw err\n    }\n    return\n  }\n\n  const provider = await getProvider({\n    experimental: options.experimental,\n    orgSlug: options.sso,\n    specifiedProvider: options.provider,\n    ssoProvider: options.ssoProvider,\n  })\n\n  trace.log({provider: provider?.name, step: 'selectProvider'})\n\n  if (provider === undefined) {\n    throw new Error('No authentication providers found')\n  }\n\n  const {loginUrl, server, token: tokenPromise} = await startServerForTokenCallback(provider.url)\n\n  trace.log({step: 'waitForToken'})\n\n  // Open a browser on the login page (or tell the user to)\n  const shouldLaunchBrowser = canLaunchBrowser() && options.open !== false\n  const actionText = shouldLaunchBrowser ? 'Opening browser at' : 'Please open a browser at'\n\n  output.log(`\\n${actionText} ${loginUrl.href}\\n`)\n\n  const spin = spinner('Waiting for browser login to complete... Press Ctrl + C to cancel').start()\n\n  if (shouldLaunchBrowser) {\n    open(loginUrl.href)\n  }\n\n  // Wait for a success/error on the HTTP callback server\n  let authToken: string\n  try {\n    authToken = (await tokenPromise).token\n    spin.stop()\n  } catch (err: unknown) {\n    spin.stop()\n    trace.error(err as Error)\n    debug('Error retrieving token: %O', err)\n    throw err\n  } finally {\n    await new Promise<void>((resolve) => {\n      server.close(() => resolve())\n    })\n  }\n\n  await storeAuthToken(authToken, previousToken, output)\n\n  trace.complete()\n}\n\nasync function storeAuthToken(\n  authToken: string,\n  previousToken: string | undefined,\n  output: Output,\n) {\n  setCliUserConfig('authToken', authToken)\n  getUserConfig().delete('telemetryConsent')\n\n  // If we had a session previously, attempt to clear it\n  if (previousToken && previousToken !== authToken) {\n    await invalidateAuthToken(previousToken, output)\n  }\n}\n\nasync function invalidateAuthToken(token: string, output: Output) {\n  try {\n    if (await isSanityApiToken(token)) return\n  } catch (err) {\n    if (isHttpError(err) && err.statusCode === 401) return\n  }\n\n  try {\n    await logout(token)\n  } catch (err) {\n    if (!isHttpError(err) || err.statusCode !== 401) {\n      output.warn('Failed to invalidate previous session')\n    }\n  }\n}\n"],"names":["getCliToken","getUserConfig","setCliUserConfig","subdebug","spinner","isHttpError","open","logout","LoginTrace","canLaunchBrowser","startServerForTokenCallback","getProvider","isSanityApiToken","validateToken","debug","login","options","output","telemetry","previousToken","trace","start","token","authToken","storeAuthToken","complete","err","error","provider","experimental","orgSlug","sso","specifiedProvider","ssoProvider","log","name","step","undefined","Error","loginUrl","server","tokenPromise","url","shouldLaunchBrowser","actionText","href","spin","stop","Promise","resolve","close","delete","invalidateAuthToken","statusCode","warn"],"mappings":"AAAA,SAEEA,WAAW,EACXC,aAAa,EAEbC,gBAAgB,EAChBC,QAAQ,QACH,mBAAkB;AACzB,SAAQC,OAAO,QAAO,sBAAqB;AAC3C,SAAQC,WAAW,QAAO,iBAAgB;AAC1C,OAAOC,UAAU,OAAM;AAEvB,SAAQC,MAAM,QAAO,4BAA2B;AAChD,SAAQC,UAAU,QAAO,wCAAuC;AAChE,SAAQC,gBAAgB,QAAO,oCAAmC;AAClE,SAAQC,2BAA2B,QAAO,mBAAkB;AAC5D,SAAQC,WAAW,QAAO,mBAAkB;AAC5C,SAAQC,gBAAgB,EAAEC,aAAa,QAAO,qBAAoB;AAElE,MAAMC,QAAQX,SAAS;AAevB;;;;;;;;;;CAUC,GACD,OAAO,eAAeY,MAAMC,OAAqB;IAC/C,MAAM,EAACC,MAAM,EAAEC,SAAS,EAAC,GAAGF;IAC5B,MAAMG,gBAAgB,MAAMnB;IAE5B,MAAMoB,QAAQF,UAAUE,KAAK,CAACZ;IAC9BY,MAAMC,KAAK;IAEX,IAAI,OAAOL,QAAQM,KAAK,KAAK,UAAU;QACrC,IAAI;YACF,MAAMC,YAAY,MAAMV,cAAcG,QAAQM,KAAK;YACnD,MAAME,eAAeD,WAAWJ,eAAeF;YAC/CG,MAAMK,QAAQ;QAChB,EAAE,OAAOC,KAAc;YACrBN,MAAMO,KAAK,CAACD;YACZ,MAAMA;QACR;QACA;IACF;IAEA,MAAME,WAAW,MAAMjB,YAAY;QACjCkB,cAAcb,QAAQa,YAAY;QAClCC,SAASd,QAAQe,GAAG;QACpBC,mBAAmBhB,QAAQY,QAAQ;QACnCK,aAAajB,QAAQiB,WAAW;IAClC;IAEAb,MAAMc,GAAG,CAAC;QAACN,UAAUA,UAAUO;QAAMC,MAAM;IAAgB;IAE3D,IAAIR,aAAaS,WAAW;QAC1B,MAAM,IAAIC,MAAM;IAClB;IAEA,MAAM,EAACC,QAAQ,EAAEC,MAAM,EAAElB,OAAOmB,YAAY,EAAC,GAAG,MAAM/B,4BAA4BkB,SAASc,GAAG;IAE9FtB,MAAMc,GAAG,CAAC;QAACE,MAAM;IAAc;IAE/B,yDAAyD;IACzD,MAAMO,sBAAsBlC,sBAAsBO,QAAQV,IAAI,KAAK;IACnE,MAAMsC,aAAaD,sBAAsB,uBAAuB;IAEhE1B,OAAOiB,GAAG,CAAC,CAAC,EAAE,EAAEU,WAAW,CAAC,EAAEL,SAASM,IAAI,CAAC,EAAE,CAAC;IAE/C,MAAMC,OAAO1C,QAAQ,qEAAqEiB,KAAK;IAE/F,IAAIsB,qBAAqB;QACvBrC,KAAKiC,SAASM,IAAI;IACpB;IAEA,uDAAuD;IACvD,IAAItB;IACJ,IAAI;QACFA,YAAY,AAAC,CAAA,MAAMkB,YAAW,EAAGnB,KAAK;QACtCwB,KAAKC,IAAI;IACX,EAAE,OAAOrB,KAAc;QACrBoB,KAAKC,IAAI;QACT3B,MAAMO,KAAK,CAACD;QACZZ,MAAM,8BAA8BY;QACpC,MAAMA;IACR,SAAU;QACR,MAAM,IAAIsB,QAAc,CAACC;YACvBT,OAAOU,KAAK,CAAC,IAAMD;QACrB;IACF;IAEA,MAAMzB,eAAeD,WAAWJ,eAAeF;IAE/CG,MAAMK,QAAQ;AAChB;AAEA,eAAeD,eACbD,SAAiB,EACjBJ,aAAiC,EACjCF,MAAc;IAEdf,iBAAiB,aAAaqB;IAC9BtB,gBAAgBkD,MAAM,CAAC;IAEvB,sDAAsD;IACtD,IAAIhC,iBAAiBA,kBAAkBI,WAAW;QAChD,MAAM6B,oBAAoBjC,eAAeF;IAC3C;AACF;AAEA,eAAemC,oBAAoB9B,KAAa,EAAEL,MAAc;IAC9D,IAAI;QACF,IAAI,MAAML,iBAAiBU,QAAQ;IACrC,EAAE,OAAOI,KAAK;QACZ,IAAIrB,YAAYqB,QAAQA,IAAI2B,UAAU,KAAK,KAAK;IAClD;IAEA,IAAI;QACF,MAAM9C,OAAOe;IACf,EAAE,OAAOI,KAAK;QACZ,IAAI,CAACrB,YAAYqB,QAAQA,IAAI2B,UAAU,KAAK,KAAK;YAC/CpC,OAAOqC,IAAI,CAAC;QACd;IACF;AACF"}

package/dist/actions/auth/login/validateToken.js

@@ -0,0 +1,39 @@
+import { getGlobalCliClient } from '@sanity/cli-core';
+import { isHttpError } from '@sanity/client';
+import { USERS_API_VERSION } from '../../../services/user.js';
+import { getErrorMessage } from '../../../util/getErrorMessage.js';
+export async function validateToken(token) {
+    const trimmedToken = token.trim();
+    if (!trimmedToken) {
+        throw new Error('Token is required on standard input. Run `sanity login --with-token < token.txt`.');
+    }
+    try {
+        await getTokenUser(trimmedToken);
+    } catch (error) {
+        if (isHttpError(error) && (error.statusCode === 401 || error.statusCode === 403)) {
+            throw new Error('Token is invalid or expired. Check the token and try again.', {
+                cause: error
+            });
+        }
+        throw new Error(`Could not verify token: ${getErrorMessage(error)}`, {
+            cause: error
+        });
+    }
+    return trimmedToken;
+}
+export async function isSanityApiToken(token) {
+    return isSanityApiTokenUser(await getTokenUser(token));
+}
+async function getTokenUser(token) {
+    const client = await getGlobalCliClient({
+        apiVersion: USERS_API_VERSION,
+        requireUser: true,
+        token
+    });
+    return client.users.getById('me');
+}
+function isSanityApiTokenUser(user) {
+    return typeof user === 'object' && user !== null && 'provider' in user && user.provider === 'sanity-token';
+}
+
+//# sourceMappingURL=validateToken.js.map

package/dist/actions/auth/login/validateToken.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/actions/auth/login/validateToken.ts"],"sourcesContent":["import {getGlobalCliClient} from '@sanity/cli-core'\nimport {isHttpError} from '@sanity/client'\n\nimport {USERS_API_VERSION} from '../../../services/user.js'\nimport {getErrorMessage} from '../../../util/getErrorMessage.js'\n\nexport async function validateToken(token: string): Promise<string> {\n  const trimmedToken = token.trim()\n\n  if (!trimmedToken) {\n    throw new Error(\n      'Token is required on standard input. Run `sanity login --with-token < token.txt`.',\n    )\n  }\n\n  try {\n    await getTokenUser(trimmedToken)\n  } catch (error) {\n    if (isHttpError(error) && (error.statusCode === 401 || error.statusCode === 403)) {\n      throw new Error('Token is invalid or expired. Check the token and try again.', {cause: error})\n    }\n\n    throw new Error(`Could not verify token: ${getErrorMessage(error)}`, {cause: error})\n  }\n\n  return trimmedToken\n}\n\nexport async function isSanityApiToken(token: string): Promise<boolean> {\n  return isSanityApiTokenUser(await getTokenUser(token))\n}\n\nasync function getTokenUser(token: string): Promise<unknown> {\n  const client = await getGlobalCliClient({\n    apiVersion: USERS_API_VERSION,\n    requireUser: true,\n    token,\n  })\n\n  return client.users.getById('me')\n}\n\nfunction isSanityApiTokenUser(user: unknown): boolean {\n  return (\n    typeof user === 'object' &&\n    user !== null &&\n    'provider' in user &&\n    (user as {provider?: unknown}).provider === 'sanity-token'\n  )\n}\n"],"names":["getGlobalCliClient","isHttpError","USERS_API_VERSION","getErrorMessage","validateToken","token","trimmedToken","trim","Error","getTokenUser","error","statusCode","cause","isSanityApiToken","isSanityApiTokenUser","client","apiVersion","requireUser","users","getById","user","provider"],"mappings":"AAAA,SAAQA,kBAAkB,QAAO,mBAAkB;AACnD,SAAQC,WAAW,QAAO,iBAAgB;AAE1C,SAAQC,iBAAiB,QAAO,4BAA2B;AAC3D,SAAQC,eAAe,QAAO,mCAAkC;AAEhE,OAAO,eAAeC,cAAcC,KAAa;IAC/C,MAAMC,eAAeD,MAAME,IAAI;IAE/B,IAAI,CAACD,cAAc;QACjB,MAAM,IAAIE,MACR;IAEJ;IAEA,IAAI;QACF,MAAMC,aAAaH;IACrB,EAAE,OAAOI,OAAO;QACd,IAAIT,YAAYS,UAAWA,CAAAA,MAAMC,UAAU,KAAK,OAAOD,MAAMC,UAAU,KAAK,GAAE,GAAI;YAChF,MAAM,IAAIH,MAAM,+DAA+D;gBAACI,OAAOF;YAAK;QAC9F;QAEA,MAAM,IAAIF,MAAM,CAAC,wBAAwB,EAAEL,gBAAgBO,QAAQ,EAAE;YAACE,OAAOF;QAAK;IACpF;IAEA,OAAOJ;AACT;AAEA,OAAO,eAAeO,iBAAiBR,KAAa;IAClD,OAAOS,qBAAqB,MAAML,aAAaJ;AACjD;AAEA,eAAeI,aAAaJ,KAAa;IACvC,MAAMU,SAAS,MAAMf,mBAAmB;QACtCgB,YAAYd;QACZe,aAAa;QACbZ;IACF;IAEA,OAAOU,OAAOG,KAAK,CAACC,OAAO,CAAC;AAC9B;AAEA,SAASL,qBAAqBM,IAAa;IACzC,OACE,OAAOA,SAAS,YAChBA,SAAS,QACT,cAAcA,QACd,AAACA,KAA8BC,QAAQ,KAAK;AAEhD"}

package/dist/commands/login.js

@@ -1,3 +1,4 @@
+import { text } from 'node:stream/consumers';
 import { Flags } from '@oclif/core';
 import { SanityCommand } from '@sanity/cli-core';
 import { login } from '../actions/auth/login/login.js';
@@ -19,6 +20,10 @@ export class LoginCommand extends SanityCommand {
         {
             command: '<%= config.bin %> <%= command.id %> --sso my-organization --sso-provider "Okta SSO"',
             description: 'Log in using a specific SSO provider within an organization'
+        },
+        {
+            command: '<%= config.bin %> <%= command.id %> --with-token < token.txt',
+            description: 'Log in using a token from standard input'
         }
     ];
     static flags = {
@@ -34,14 +39,16 @@ export class LoginCommand extends SanityCommand {
         provider: Flags.string({
             description: 'Log in using the given provider',
             exclusive: [
-                'sso'
+                'sso',
+                'with-token'
             ],
             helpValue: '<providerId>'
         }),
         sso: Flags.string({
             description: 'Log in using Single Sign-On, using the given organization slug',
             exclusive: [
-                'provider'
+                'provider',
+                'with-token'
             ],
             helpValue: '<slug>'
         }),
@@ -51,16 +58,26 @@ export class LoginCommand extends SanityCommand {
             ],
             description: 'Select a specific SSO provider by name (use with --sso)',
             helpValue: '<name>'
+        }),
+        'with-token': Flags.boolean({
+            description: 'Read token from standard input',
+            exclusive: [
+                'provider',
+                'sso'
+            ]
         })
     };
     async run() {
         const { flags } = await this.parse(LoginCommand);
+        const { 'sso-provider': ssoProvider, 'with-token': withToken, ...loginFlags } = flags;
         try {
+            const token = withToken ? await readTokenFromStdin() : undefined;
             await login({
-                ...flags,
+                ...loginFlags,
                 output: this.output,
-                ssoProvider: flags['sso-provider'],
-                telemetry: this.telemetry
+                ssoProvider,
+                telemetry: this.telemetry,
+                token
             });
             this.log('Login successful');
         } catch (error) {
@@ -71,5 +88,11 @@ export class LoginCommand extends SanityCommand {
         }
     }
 }
+async function readTokenFromStdin() {
+    if (process.stdin.isTTY) {
+        throw new Error('Token is required on standard input. Run `sanity login --with-token < token.txt`.');
+    }
+    return text(process.stdin);
+}
 
 //# sourceMappingURL=login.js.map

package/dist/commands/login.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/commands/login.ts"],"sourcesContent":["import {Command, Flags} from '@oclif/core'\nimport {type FlagInput} from '@oclif/core/interfaces'\nimport {SanityCommand} from '@sanity/cli-core'\n\nimport {login} from '../actions/auth/login/login.js'\n\nexport class LoginCommand extends SanityCommand<typeof LoginCommand> {\n  static override description = 'Log in to your Sanity account'\n  static override examples: Array<Command.Example> = [\n    {\n      command: '<%= config.bin %> <%= command.id %>',\n      description: 'Log in using default settings',\n    },\n    {\n      command: '<%= config.bin %> <%= command.id %> --provider github --no-open',\n      description: 'Login with GitHub provider, but do not open a browser window automatically',\n    },\n    {\n      command: '<%= config.bin %> <%= command.id %> --sso my-organization',\n      description: 'Log in using Single Sign-On with the \"my-organization\" slug',\n    },\n    {\n      command:\n        '<%= config.bin %> <%= command.id %> --sso my-organization --sso-provider \"Okta SSO\"',\n      description: 'Log in using a specific SSO provider within an organization',\n    },\n  ]\n  static override flags = {\n    experimental: Flags.boolean({\n      default: false,\n      hidden: true,\n    }),\n    open: Flags.boolean({\n      allowNo: true,\n      default: true,\n      description: 'Open a browser window to log in (`--no-open` only prints URL)',\n    }),\n    provider: Flags.string({\n      description: 'Log in using the given provider',\n      exclusive: ['sso'],\n      helpValue: '<providerId>',\n    }),\n    sso: Flags.string({\n      description: 'Log in using Single Sign-On, using the given organization slug',\n      exclusive: ['provider'],\n      helpValue: '<slug>',\n    }),\n    'sso-provider': Flags.string({\n      dependsOn: ['sso'],\n      description: 'Select a specific SSO provider by name (use with --sso)',\n      helpValue: '<name>',\n    }),\n  } satisfies FlagInput\n\n  public async run(): Promise<void> {\n    const {flags} = await this.parse(LoginCommand)\n\n    try {\n      await login({\n        ...flags,\n        output: this.output,\n        ssoProvider: flags['sso-provider'],\n        telemetry: this.telemetry,\n      })\n      this.log('Login successful')\n    } catch (error) {\n      const message = error instanceof Error ? error.message : String(error)\n      this.error(`Login failed: ${message}`, {exit: 1})\n    }\n  }\n}\n"],"names":["Flags","SanityCommand","login","LoginCommand","description","examples","command","flags","experimental","boolean","default","hidden","open","allowNo","provider","string","exclusive","helpValue","sso","dependsOn","run","parse","output","ssoProvider","telemetry","log","error","message","Error","String","exit"],"mappings":"AAAA,SAAiBA,KAAK,QAAO,cAAa;AAE1C,SAAQC,aAAa,QAAO,mBAAkB;AAE9C,SAAQC,KAAK,QAAO,iCAAgC;AAEpD,OAAO,MAAMC,qBAAqBF;IAChC,OAAgBG,cAAc,gCAA+B;IAC7D,OAAgBC,WAAmC;QACjD;YACEC,SAAS;YACTF,aAAa;QACf;QACA;YACEE,SAAS;YACTF,aAAa;QACf;QACA;YACEE,SAAS;YACTF,aAAa;QACf;QACA;YACEE,SACE;YACFF,aAAa;QACf;KACD,CAAA;IACD,OAAgBG,QAAQ;QACtBC,cAAcR,MAAMS,OAAO,CAAC;YAC1BC,SAAS;YACTC,QAAQ;QACV;QACAC,MAAMZ,MAAMS,OAAO,CAAC;YAClBI,SAAS;YACTH,SAAS;YACTN,aAAa;QACf;QACAU,UAAUd,MAAMe,MAAM,CAAC;YACrBX,aAAa;YACbY,WAAW;gBAAC;aAAM;YAClBC,WAAW;QACb;QACAC,KAAKlB,MAAMe,MAAM,CAAC;YAChBX,aAAa;YACbY,WAAW;gBAAC;aAAW;YACvBC,WAAW;QACb;QACA,gBAAgBjB,MAAMe,MAAM,CAAC;YAC3BI,WAAW;gBAAC;aAAM;YAClBf,aAAa;YACba,WAAW;QACb;IACF,EAAqB;IAErB,MAAaG,MAAqB;QAChC,MAAM,EAACb,KAAK,EAAC,GAAG,MAAM,IAAI,CAACc,KAAK,CAAClB;QAEjC,IAAI;YACF,MAAMD,MAAM;gBACV,GAAGK,KAAK;gBACRe,QAAQ,IAAI,CAACA,MAAM;gBACnBC,aAAahB,KAAK,CAAC,eAAe;gBAClCiB,WAAW,IAAI,CAACA,SAAS;YAC3B;YACA,IAAI,CAACC,GAAG,CAAC;QACX,EAAE,OAAOC,OAAO;YACd,MAAMC,UAAUD,iBAAiBE,QAAQF,MAAMC,OAAO,GAAGE,OAAOH;YAChE,IAAI,CAACA,KAAK,CAAC,CAAC,cAAc,EAAEC,SAAS,EAAE;gBAACG,MAAM;YAAC;QACjD;IACF;AACF"}
+{"version":3,"sources":["../../src/commands/login.ts"],"sourcesContent":["import {text} from 'node:stream/consumers'\n\nimport {Command, Flags} from '@oclif/core'\nimport {type FlagInput} from '@oclif/core/interfaces'\nimport {SanityCommand} from '@sanity/cli-core'\n\nimport {login} from '../actions/auth/login/login.js'\n\nexport class LoginCommand extends SanityCommand<typeof LoginCommand> {\n  static override description = 'Log in to your Sanity account'\n  static override examples: Array<Command.Example> = [\n    {\n      command: '<%= config.bin %> <%= command.id %>',\n      description: 'Log in using default settings',\n    },\n    {\n      command: '<%= config.bin %> <%= command.id %> --provider github --no-open',\n      description: 'Login with GitHub provider, but do not open a browser window automatically',\n    },\n    {\n      command: '<%= config.bin %> <%= command.id %> --sso my-organization',\n      description: 'Log in using Single Sign-On with the \"my-organization\" slug',\n    },\n    {\n      command:\n        '<%= config.bin %> <%= command.id %> --sso my-organization --sso-provider \"Okta SSO\"',\n      description: 'Log in using a specific SSO provider within an organization',\n    },\n    {\n      command: '<%= config.bin %> <%= command.id %> --with-token < token.txt',\n      description: 'Log in using a token from standard input',\n    },\n  ]\n  static override flags = {\n    experimental: Flags.boolean({\n      default: false,\n      hidden: true,\n    }),\n    open: Flags.boolean({\n      allowNo: true,\n      default: true,\n      description: 'Open a browser window to log in (`--no-open` only prints URL)',\n    }),\n    provider: Flags.string({\n      description: 'Log in using the given provider',\n      exclusive: ['sso', 'with-token'],\n      helpValue: '<providerId>',\n    }),\n    sso: Flags.string({\n      description: 'Log in using Single Sign-On, using the given organization slug',\n      exclusive: ['provider', 'with-token'],\n      helpValue: '<slug>',\n    }),\n    'sso-provider': Flags.string({\n      dependsOn: ['sso'],\n      description: 'Select a specific SSO provider by name (use with --sso)',\n      helpValue: '<name>',\n    }),\n    'with-token': Flags.boolean({\n      description: 'Read token from standard input',\n      exclusive: ['provider', 'sso'],\n    }),\n  } satisfies FlagInput\n\n  public async run(): Promise<void> {\n    const {flags} = await this.parse(LoginCommand)\n    const {'sso-provider': ssoProvider, 'with-token': withToken, ...loginFlags} = flags\n\n    try {\n      const token = withToken ? await readTokenFromStdin() : undefined\n\n      await login({\n        ...loginFlags,\n        output: this.output,\n        ssoProvider,\n        telemetry: this.telemetry,\n        token,\n      })\n      this.log('Login successful')\n    } catch (error) {\n      const message = error instanceof Error ? error.message : String(error)\n      this.error(`Login failed: ${message}`, {exit: 1})\n    }\n  }\n}\n\nasync function readTokenFromStdin(): Promise<string> {\n  if (process.stdin.isTTY) {\n    throw new Error(\n      'Token is required on standard input. Run `sanity login --with-token < token.txt`.',\n    )\n  }\n\n  return text(process.stdin)\n}\n"],"names":["text","Flags","SanityCommand","login","LoginCommand","description","examples","command","flags","experimental","boolean","default","hidden","open","allowNo","provider","string","exclusive","helpValue","sso","dependsOn","run","parse","ssoProvider","withToken","loginFlags","token","readTokenFromStdin","undefined","output","telemetry","log","error","message","Error","String","exit","process","stdin","isTTY"],"mappings":"AAAA,SAAQA,IAAI,QAAO,wBAAuB;AAE1C,SAAiBC,KAAK,QAAO,cAAa;AAE1C,SAAQC,aAAa,QAAO,mBAAkB;AAE9C,SAAQC,KAAK,QAAO,iCAAgC;AAEpD,OAAO,MAAMC,qBAAqBF;IAChC,OAAgBG,cAAc,gCAA+B;IAC7D,OAAgBC,WAAmC;QACjD;YACEC,SAAS;YACTF,aAAa;QACf;QACA;YACEE,SAAS;YACTF,aAAa;QACf;QACA;YACEE,SAAS;YACTF,aAAa;QACf;QACA;YACEE,SACE;YACFF,aAAa;QACf;QACA;YACEE,SAAS;YACTF,aAAa;QACf;KACD,CAAA;IACD,OAAgBG,QAAQ;QACtBC,cAAcR,MAAMS,OAAO,CAAC;YAC1BC,SAAS;YACTC,QAAQ;QACV;QACAC,MAAMZ,MAAMS,OAAO,CAAC;YAClBI,SAAS;YACTH,SAAS;YACTN,aAAa;QACf;QACAU,UAAUd,MAAMe,MAAM,CAAC;YACrBX,aAAa;YACbY,WAAW;gBAAC;gBAAO;aAAa;YAChCC,WAAW;QACb;QACAC,KAAKlB,MAAMe,MAAM,CAAC;YAChBX,aAAa;YACbY,WAAW;gBAAC;gBAAY;aAAa;YACrCC,WAAW;QACb;QACA,gBAAgBjB,MAAMe,MAAM,CAAC;YAC3BI,WAAW;gBAAC;aAAM;YAClBf,aAAa;YACba,WAAW;QACb;QACA,cAAcjB,MAAMS,OAAO,CAAC;YAC1BL,aAAa;YACbY,WAAW;gBAAC;gBAAY;aAAM;QAChC;IACF,EAAqB;IAErB,MAAaI,MAAqB;QAChC,MAAM,EAACb,KAAK,EAAC,GAAG,MAAM,IAAI,CAACc,KAAK,CAAClB;QACjC,MAAM,EAAC,gBAAgBmB,WAAW,EAAE,cAAcC,SAAS,EAAE,GAAGC,YAAW,GAAGjB;QAE9E,IAAI;YACF,MAAMkB,QAAQF,YAAY,MAAMG,uBAAuBC;YAEvD,MAAMzB,MAAM;gBACV,GAAGsB,UAAU;gBACbI,QAAQ,IAAI,CAACA,MAAM;gBACnBN;gBACAO,WAAW,IAAI,CAACA,SAAS;gBACzBJ;YACF;YACA,IAAI,CAACK,GAAG,CAAC;QACX,EAAE,OAAOC,OAAO;YACd,MAAMC,UAAUD,iBAAiBE,QAAQF,MAAMC,OAAO,GAAGE,OAAOH;YAChE,IAAI,CAACA,KAAK,CAAC,CAAC,cAAc,EAAEC,SAAS,EAAE;gBAACG,MAAM;YAAC;QACjD;IACF;AACF;AAEA,eAAeT;IACb,IAAIU,QAAQC,KAAK,CAACC,KAAK,EAAE;QACvB,MAAM,IAAIL,MACR;IAEJ;IAEA,OAAOlC,KAAKqC,QAAQC,KAAK;AAC3B"}

package/oclif.manifest.json

@@ -808,6 +808,10 @@
         {
           "command": "<%= config.bin %> <%= command.id %> --sso my-organization --sso-provider \"Okta SSO\"",
           "description": "Log in using a specific SSO provider within an organization"
+        },
+        {
+          "command": "<%= config.bin %> <%= command.id %> --with-token < token.txt",
+          "description": "Log in using a token from standard input"
         }
       ],
       "flags": {
@@ -826,7 +830,8 @@
         "provider": {
           "description": "Log in using the given provider",
           "exclusive": [
-            "sso"
+            "sso",
+            "with-token"
           ],
           "name": "provider",
           "hasDynamicHelp": false,
@@ -837,7 +842,8 @@
         "sso": {
           "description": "Log in using Single Sign-On, using the given organization slug",
           "exclusive": [
-            "provider"
+            "provider",
+            "with-token"
           ],
           "name": "sso",
           "hasDynamicHelp": false,
@@ -855,6 +861,16 @@
           "helpValue": "<name>",
           "multiple": false,
           "type": "option"
+        },
+        "with-token": {
+          "description": "Read token from standard input",
+          "exclusive": [
+            "provider",
+            "sso"
+          ],
+          "name": "with-token",
+          "allowNo": false,
+          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
@@ -5082,5 +5098,5 @@
       ]
     }
   },
-  "version": "6.5.2"
+  "version": "6.6.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sanity/cli",
-  "version": "6.5.2",
+  "version": "6.6.0",
   "description": "Sanity CLI tool for managing Sanity projects and organizations",
   "keywords": [
     "cli",
@@ -116,7 +116,7 @@
     "which": "^6.0.1",
     "yaml": "^2.8.4",
     "zod": "^4.3.6",
-    "@sanity/cli-build": "^0.1.0",
+    "@sanity/cli-build": "^0.1.1",
     "@sanity/cli-core": "^1.3.2"
   },
   "devDependencies": {