@sequenceholdings/studio-cli 0.1.9

package/dist/atlas-client.js

@@ -0,0 +1,173 @@
+/**
+ * Minimal authenticated HTTP client for Atlas. Same retry-on-503 contract
+ * as `shared/services/artifact-studio/src/api.ts` so behavior is
+ * consistent across both Sequence CLIs. Token + baseUrl are passed in by
+ * the caller — this file knows nothing about token files or config TOMLs.
+ */
+import { PREVIEW_DOMAIN } from './preview.js';
+const MAX_503_RETRIES = 5;
+const DEFAULT_RETRY_AFTER_SECONDS = 2;
+const LOG_PREFIX = '[seq-studio]';
+export class AtlasApiError extends Error {
+    status;
+    path;
+    statusText;
+    body;
+    name = 'AtlasApiError';
+    constructor(status, message, path, statusText = '', body = null) {
+        super(message);
+        this.status = status;
+        this.path = path;
+        this.statusText = statusText;
+        this.body = body;
+    }
+}
+async function fetchWith503Retry(input, init) {
+    let attempt = 0;
+    for (;;) {
+        const response = await fetch(input, init);
+        if (response.status !== 503 || attempt >= MAX_503_RETRIES)
+            return response;
+        const retryAfter = Number(response.headers.get('Retry-After')) || DEFAULT_RETRY_AFTER_SECONDS;
+        attempt += 1;
+        console.warn(`${LOG_PREFIX} backend warming up (503); retrying in ${retryAfter}s (attempt ${attempt}/${MAX_503_RETRIES})`);
+        await new Promise((resolve) => setTimeout(resolve, retryAfter * 1000));
+    }
+}
+function previewAccessHeaders(baseUrl) {
+    const secret = process.env.PREVIEW_ACCESS_HEADER?.trim();
+    if (!secret)
+        return {};
+    try {
+        const parsed = new URL(baseUrl);
+        if (parsed.protocol !== 'https:')
+            return {};
+        if (!parsed.hostname.toLowerCase().endsWith(`.${PREVIEW_DOMAIN}`))
+            return {};
+        return { 'x-preview-access': secret };
+    }
+    catch {
+        return {};
+    }
+}
+function messageFromBody(body, status, statusText) {
+    if (body && typeof body === 'object') {
+        const record = body;
+        if (typeof record.detail === 'string' && record.detail.length > 0)
+            return record.detail;
+        if (typeof record.error === 'string' && record.error.length > 0)
+            return record.error;
+        if (typeof record.message === 'string' && record.message.length > 0)
+            return record.message;
+    }
+    if (typeof body === 'string' && body.trim().length > 0) {
+        const trimmed = body.trim();
+        return trimmed.length > 500 ? `${trimmed.slice(0, 500)}…` : trimmed;
+    }
+    if (statusText)
+        return statusText;
+    return `HTTP ${status}`;
+}
+function parseErrorBody(rawText, contentType) {
+    if (rawText.length === 0)
+        return null;
+    const looksLikeJson = contentType.toLowerCase().includes('json') || /^\s*[{[]/.test(rawText);
+    if (!looksLikeJson)
+        return rawText;
+    try {
+        return JSON.parse(rawText);
+    }
+    catch {
+        return rawText;
+    }
+}
+async function responseError(response, path) {
+    const contentType = response.headers.get('content-type') ?? '';
+    const rawText = await response.text();
+    const body = parseErrorBody(rawText, contentType);
+    const message = messageFromBody(body, response.status, response.statusText);
+    return new AtlasApiError(response.status, message, path, response.statusText, body);
+}
+export async function getJson({ baseUrl, token, path, }) {
+    const response = await fetchWith503Retry(`${baseUrl}${path}`, {
+        headers: { ...previewAccessHeaders(baseUrl), Authorization: `Bearer ${token}` },
+    });
+    if (!response.ok)
+        throw await responseError(response, path);
+    return response.json();
+}
+export async function getJsonOr404({ baseUrl, token, path, }) {
+    const response = await fetchWith503Retry(`${baseUrl}${path}`, {
+        headers: { ...previewAccessHeaders(baseUrl), Authorization: `Bearer ${token}` },
+    });
+    if (response.status === 404)
+        return null;
+    if (!response.ok)
+        throw await responseError(response, path);
+    return response.json();
+}
+export async function postJson({ baseUrl, token, path, body, }) {
+    const response = await fetchWith503Retry(`${baseUrl}${path}`, {
+        method: 'POST',
+        headers: {
+            ...previewAccessHeaders(baseUrl),
+            Authorization: `Bearer ${token}`,
+            'Content-Type': 'application/json',
+        },
+        body: body === undefined ? undefined : JSON.stringify(body),
+    });
+    if (!response.ok)
+        throw await responseError(response, path);
+    return response.json();
+}
+export async function putJson({ baseUrl, token, path, body, }) {
+    const response = await fetchWith503Retry(`${baseUrl}${path}`, {
+        method: 'PUT',
+        headers: {
+            ...previewAccessHeaders(baseUrl),
+            Authorization: `Bearer ${token}`,
+            'Content-Type': 'application/json',
+        },
+        body: body === undefined ? undefined : JSON.stringify(body),
+    });
+    if (!response.ok)
+        throw await responseError(response, path);
+    return response.json();
+}
+export async function patchJson({ baseUrl, token, path, body, }) {
+    const response = await fetchWith503Retry(`${baseUrl}${path}`, {
+        method: 'PATCH',
+        headers: {
+            ...previewAccessHeaders(baseUrl),
+            Authorization: `Bearer ${token}`,
+            'Content-Type': 'application/json',
+        },
+        body: body === undefined ? undefined : JSON.stringify(body),
+    });
+    if (!response.ok)
+        throw await responseError(response, path);
+    return response.json();
+}
+export async function deleteJson({ baseUrl, token, path, body, }) {
+    const response = await fetchWith503Retry(`${baseUrl}${path}`, {
+        method: 'DELETE',
+        headers: {
+            ...previewAccessHeaders(baseUrl),
+            Authorization: `Bearer ${token}`,
+            'Content-Type': 'application/json',
+        },
+        body: body === undefined ? undefined : JSON.stringify(body),
+    });
+    if (!response.ok)
+        throw await responseError(response, path);
+    return response.json();
+}
+/** DELETE for endpoints that return 204 with an empty body (deleteJson would choke on it). */
+export async function deleteNoContent({ baseUrl, token, path, }) {
+    const response = await fetchWith503Retry(`${baseUrl}${path}`, {
+        method: 'DELETE',
+        headers: { ...previewAccessHeaders(baseUrl), Authorization: `Bearer ${token}` },
+    });
+    if (!response.ok)
+        throw await responseError(response, path);
+}

package/dist/auth-cmds/commands.d.ts

@@ -0,0 +1,15 @@
+import type { ParsedArgs } from '../process/commands.js';
+declare const PAT_SCOPES: readonly ["repo:read", "repo:write", "repo:admin"];
+type PatScope = (typeof PAT_SCOPES)[number];
+export declare const AUTH_USAGE = "usage:\n  seq-studio auth pat create --name <n> [--scopes repo:read,repo:write] [-e env]\n                             [--expires 7d|30d|90d|1y|never] [--store-credentials]\n  seq-studio auth pat list [-e env]\n  seq-studio auth pat revoke <id> [-e env] [--yes]\n\n  Issue a personal access token for git clone / git push against the platform\n  git service.\n\n  Most users (no seqapi): open Atlas \u2192 Settings \u2192 Tokens, or:\n    https://<atlas-host>/settings/tokens\n  Sign in, create a token (repo:read / repo:write), copy once, then:\n    export ATLAS_GIT_PAT=<token>\n\n  Sequence staff: `seqapi login` then `auth pat create` (same Auth0 session\n  as the Atlas UI). The CLI cannot mint a PAT without that login.\n\n  On create the raw token is printed ONCE \u2014 store it; Atlas cannot re-show it.\n  Git Basic auth: any username (e.g. git), PAT as the password.\n\n  Flags: -e/--env <local|staging|production|banksouth>\n";
+export declare function parsePatScopes(raw: string | undefined): PatScope[];
+/**
+ * Map UI-style duration choices to an absolute ISO-8601 expiresAt, or undefined
+ * for never. Matches Settings Tokens dialog choices.
+ */
+export declare function resolveExpiresAt(choice: string | undefined): string | undefined;
+export declare function authPatCreateCommand(args: ParsedArgs): Promise<number>;
+export declare function authPatListCommand(args: ParsedArgs): Promise<number>;
+export declare function authPatRevokeCommand(args: ParsedArgs): Promise<number>;
+export declare function runAuthCommand(sub: string | undefined, args: ParsedArgs): Promise<number>;
+export {};

package/dist/auth-cmds/commands.js

@@ -0,0 +1,249 @@
+/**
+ * `seq-studio auth <sub>` — PAT management for the platform git service.
+ *
+ * Issues / lists / revokes Personal Access Tokens via Auth0 bearer auth
+ * (`seqapi login` — Sequence staff). Third-party / OpCo developers without
+ * seqapi should mint tokens in the Atlas UI at `/settings/tokens` instead;
+ * help text and error hints lead with that path.
+ *
+ * The raw token is printed exactly once on create; use it as the Basic-auth
+ * password for `git clone` / `git push` (username is ignored).
+ */
+import { deleteNoContent, getJson, postJson } from '../atlas-client.js';
+import { printCliError } from '../cli-errors.js';
+import { buildContext, clientOptions, flagBool, LOG, } from '../functions/commands.js';
+import { confirmYes } from '../prompt.js';
+import { storeGitCredentials } from '../repos/git-clone.js';
+import { formatPatSetupHint, settingsTokensUrl } from '../pat-hints.js';
+const PAT_SCOPES = ['repo:read', 'repo:write', 'repo:admin'];
+function stringFlag(flags, key) {
+    const value = flags[key];
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== 'string')
+        throw new Error(`--${key} requires a value.`);
+    return value;
+}
+export const AUTH_USAGE = `usage:
+  seq-studio auth pat create --name <n> [--scopes repo:read,repo:write] [-e env]
+                             [--expires 7d|30d|90d|1y|never] [--store-credentials]
+  seq-studio auth pat list [-e env]
+  seq-studio auth pat revoke <id> [-e env] [--yes]
+
+  Issue a personal access token for git clone / git push against the platform
+  git service.
+
+  Most users (no seqapi): open Atlas → Settings → Tokens, or:
+    https://<atlas-host>/settings/tokens
+  Sign in, create a token (repo:read / repo:write), copy once, then:
+    export ATLAS_GIT_PAT=<token>
+
+  Sequence staff: \`seqapi login\` then \`auth pat create\` (same Auth0 session
+  as the Atlas UI). The CLI cannot mint a PAT without that login.
+
+  On create the raw token is printed ONCE — store it; Atlas cannot re-show it.
+  Git Basic auth: any username (e.g. git), PAT as the password.
+
+  Flags: -e/--env <local|staging|production|banksouth>
+`;
+async function authContext(args) {
+    if (args.flags.env === true || args.flags.e === true) {
+        throw new Error('-e/--env requires a value (local|staging|production|banksouth|preview:<slug>).');
+    }
+    try {
+        return await buildContext(args);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        // Prefer the Atlas UI path — third-party / OpCo developers do not have seqapi.
+        // buildContext failed before we know the env URL; point at the common hosts.
+        throw new Error(`${message}\n` +
+            `  No seqapi? Mint a PAT in the Atlas UI (Settings → Tokens), then:\n` +
+            `    export ATLAS_GIT_PAT=<token>\n` +
+            `  Staging: https://staging.atlas.seqholdings.com/settings/tokens\n` +
+            `  Production: https://atlas.seqholdings.com/settings/tokens\n` +
+            `  BankSouth: https://banksouth.seqholdings.com/settings/tokens\n` +
+            `  Sequence staff: run \`seqapi login\`, then retry \`auth pat create\`.`);
+    }
+}
+export function parsePatScopes(raw) {
+    if (raw === undefined || raw.trim() === '')
+        return ['repo:read'];
+    const parts = raw.split(',').map((s) => s.trim()).filter(Boolean);
+    if (parts.length === 0) {
+        throw new Error('--scopes requires at least one of: repo:read, repo:write, repo:admin');
+    }
+    const out = [];
+    for (const part of parts) {
+        if (!PAT_SCOPES.includes(part)) {
+            throw new Error(`unknown scope "${part}" — expected repo:read, repo:write, or repo:admin`);
+        }
+        // Deduplicate while preserving order.
+        if (!out.includes(part))
+            out.push(part);
+    }
+    return out;
+}
+/**
+ * Map UI-style duration choices to an absolute ISO-8601 expiresAt, or undefined
+ * for never. Matches Settings Tokens dialog choices.
+ */
+export function resolveExpiresAt(choice) {
+    if (choice === undefined || choice === 'never')
+        return undefined;
+    const now = Date.now();
+    const day = 24 * 60 * 60 * 1000;
+    const map = {
+        '7d': 7 * day,
+        '30d': 30 * day,
+        '90d': 90 * day,
+        '1y': 365 * day,
+    };
+    const delta = map[choice];
+    if (delta === undefined) {
+        throw new Error(`--expires must be one of: 7d, 30d, 90d, 1y, never (got "${choice}")`);
+    }
+    return new Date(now + delta).toISOString();
+}
+export async function authPatCreateCommand(args) {
+    const name = stringFlag(args.flags, 'name');
+    if (!name) {
+        console.error('usage: seq-studio auth pat create --name <n> [--scopes ...] [-e env]');
+        return 1;
+    }
+    if (name.length < 3) {
+        throw new Error('--name must be at least 3 characters (e.g. laptop-cli)');
+    }
+    const scopes = parsePatScopes(stringFlag(args.flags, 'scopes'));
+    const expiresAt = resolveExpiresAt(stringFlag(args.flags, 'expires') ?? '30d');
+    const ctx = await authContext(args);
+    const issued = await postJson({
+        ...clientOptions(ctx),
+        path: '/api/git-service/pats',
+        body: {
+            name,
+            scopes,
+            ...(expiresAt ? { expiresAt } : {}),
+        },
+    });
+    console.log(`${LOG} issued PAT on ${ctx.env.name}:`);
+    console.log(`  id:     ${issued.id}`);
+    console.log(`  name:   ${issued.name}`);
+    console.log(`  prefix: ${issued.tokenPrefix}`);
+    console.log(`  scopes: ${issued.scopes.join(', ')}`);
+    console.log(`  expires:${issued.expiresAt ? ` ${issued.expiresAt}` : ' never'}`);
+    console.log('');
+    console.log('  ── copy this token now; it will not be shown again ──');
+    console.log(`  ${issued.token}`);
+    console.log('  ────────────────────────────────────────────────────');
+    console.log('');
+    console.log('  Git Basic auth: any username (e.g. git), this token as the password.');
+    console.log(`  UI: ${settingsTokensUrl(ctx.env.url)}`);
+    console.log(`  Clone with: ATLAS_GIT_PAT=<token> seq-studio repos clone <ns>/<name> -e ${ctx.env.name}`);
+    if (flagBool(args.flags, 'store-credentials')) {
+        // Store against the env origin so any repo under /api/git-service/repos/*
+        // can reuse the helper entry. Path is the git-service API prefix.
+        const credentialUrl = `${ctx.env.url.replace(/\/$/, '')}/api/git-service/repos/`;
+        try {
+            await storeGitCredentials({ cloneUrl: credentialUrl, pat: issued.token });
+            console.log(`${LOG} stored credentials via git credential approve for ${ctx.env.url}`);
+        }
+        catch (err) {
+            console.error(`${LOG} --store-credentials failed: ${err instanceof Error ? err.message : String(err)}`);
+            console.error(`${LOG} token was still issued — copy it from above and store manually.`);
+            // Exit 0: the PAT exists; a non-zero exit would encourage retries that mint duplicates.
+            return 0;
+        }
+    }
+    return 0;
+}
+export async function authPatListCommand(args) {
+    const ctx = await authContext(args);
+    const data = await getJson({
+        ...clientOptions(ctx),
+        path: '/api/git-service/pats',
+    });
+    if (data.items.length === 0) {
+        console.log(`${LOG} no PATs on ${ctx.env.name}.`);
+        for (const line of formatPatSetupHint({ envUrl: ctx.env.url, envName: ctx.env.name })) {
+            console.log(line);
+        }
+        return 0;
+    }
+    console.log(`${LOG} ${data.items.length} PAT${data.items.length === 1 ? '' : 's'} on ${ctx.env.name}:`);
+    const width = Math.max(...data.items.map((p) => p.name.length));
+    for (const pat of data.items) {
+        const expires = pat.expiresAt ? pat.expiresAt.slice(0, 10) : 'never';
+        const lastUsed = pat.lastUsedAt ? pat.lastUsedAt.slice(0, 10) : 'never';
+        console.log(`  ${pat.name.padEnd(width)}  ${pat.tokenPrefix}…  ${pat.scopes.join(',')}  expires=${expires}  lastUsed=${lastUsed}  id=${pat.id}`);
+    }
+    return 0;
+}
+export async function authPatRevokeCommand(args) {
+    const id = args.positional[0];
+    if (!id) {
+        console.error('usage: seq-studio auth pat revoke <id> [-e env] [--yes]');
+        return 1;
+    }
+    const ctx = await authContext(args);
+    const ok = await confirmYes({
+        preview: [
+            `${LOG} about to REVOKE PAT ${id} on ${ctx.env.name}.`,
+            `${LOG} any git clone/push using it will start failing immediately.`,
+        ],
+        confirmed: flagBool(args.flags, 'yes'),
+    });
+    if (!ok)
+        return 1;
+    await deleteNoContent({
+        ...clientOptions(ctx),
+        path: `/api/git-service/pats/${encodeURIComponent(id)}`,
+    });
+    console.log(`${LOG} revoked PAT ${id} on ${ctx.env.name}`);
+    return 0;
+}
+export async function runAuthCommand(sub, args) {
+    try {
+        switch (sub) {
+            case 'pat': {
+                const action = args.positional[0];
+                const nested = {
+                    positional: args.positional.slice(1),
+                    flags: args.flags,
+                };
+                switch (action) {
+                    case 'create':
+                        return await authPatCreateCommand(nested);
+                    case 'list':
+                        return await authPatListCommand(nested);
+                    case 'revoke':
+                        return await authPatRevokeCommand(nested);
+                    case 'help':
+                    case '--help':
+                    case '-h':
+                    case undefined:
+                        console.log(AUTH_USAGE);
+                        return action ? 0 : 1;
+                    default:
+                        console.error(`unknown auth pat command: ${action}`);
+                        console.error(AUTH_USAGE);
+                        return 1;
+                }
+            }
+            case 'help':
+            case '--help':
+            case '-h':
+            case undefined:
+                console.log(AUTH_USAGE);
+                return sub ? 0 : 1;
+            default:
+                console.error(`unknown auth command: ${sub}`);
+                console.error(AUTH_USAGE);
+                return 1;
+        }
+    }
+    catch (error) {
+        printCliError(error);
+        return 1;
+    }
+}

package/dist/auth.d.ts

@@ -0,0 +1,26 @@
+export declare function seqapiTokenDir(): string;
+export declare function seqapiTokenPath(): string;
+export declare class NotLoggedInError extends Error {
+    readonly name = "NotLoggedInError";
+    constructor();
+}
+/**
+ * Return a valid access token. Tries the M2M service account first when
+ * `AUTH0_M2M_CLIENT_SECRET` is set, then falls back to the cached user
+ * token (refreshed via the Auth0 refresh-token grant when within 60s of
+ * expiry). Same precedence as seqapi's `get_access_token`, so both CLIs
+ * resolve the same identity for the same environment.
+ */
+export declare function getAccessToken(): Promise<string>;
+/**
+ * Try to load a token without throwing. Returns `null` for any error
+ * condition (missing file, parse error, no token fields). Used by
+ * `doctor` for non-fatal "are you logged in?" checks.
+ */
+export declare function tryGetAccessToken(options?: {
+    /**
+     * When the M2M secret is configured, failing to mint an M2M token should fail
+     * closed (avoid silently falling back to some other cached identity).
+     */
+    failClosedForM2m?: boolean;
+}): Promise<string | null>;

package/dist/auth.js

@@ -0,0 +1,171 @@
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+/**
+ * seq-studio is a read-only consumer of the seqapi token file. Tokens
+ * are written by `seqapi login` (Python, in `shared/seqapi/seqapi/auth.py`)
+ * and shared between every Sequence CLI: same Auth0 tenant, same client
+ * id, same audience — so the same access token validates against every
+ * Atlas /api/* route.
+ *
+ * Two token sources, in the SAME precedence order as seqapi's
+ * `get_access_token` (`shared/seqapi/seqapi/auth.py`):
+ *   1. M2M service account — Auth0 client-credentials grant, used when
+ *      `AUTH0_M2M_CLIENT_SECRET` is set. This is the headless path: CI /
+ *      cloud agents with no interactive `seqapi login` can still push.
+ *      (M2M carries app scopes but NO user identity / workspace membership
+ *      — see the `atlas-test-access` rule.)
+ *   2. Cached user token — read from the seqapi token file and refreshed
+ *      via the Auth0 refresh-token grant when near expiry.
+ *
+ * Refresh is the only write path: when the cached access token is
+ * expired and we have a refresh token, we hit Auth0 and update the file
+ * with the rotated tokens. This mirrors `seqapi._save_tokens` exactly:
+ * same fields, same shape, same 0o600 permissions, atomic write via
+ * tmpfile + rename. The M2M token is in-memory only (never persisted).
+ */
+// Match `shared/seqapi/seqapi/config.py`. Hard-coded because the seqapi
+// CLI also hard-codes them — there's a single Sequence Auth0 tenant for
+// all Sequence CLIs.
+const AUTH0_DOMAIN = 'dev-n1t8ts403fp8oyxp.us.auth0.com';
+const AUTH0_CLIENT_ID = 'GD9riCDWocfc66odpWBjwBiX43qqAX8r';
+const AUTH0_AUDIENCE = 'https://api.studio.com';
+const AUTH0_M2M_CLIENT_ID = '5TLffZqvLq4ztLDjZhwKVJCpB5VNrWj0';
+// In-memory cache for the M2M token (seconds-based, mirrors seqapi's
+// `_m2m_cache`). Reused while > 60s from expiry to avoid re-minting on every
+// call within a single process (e.g. a long `artifact dev` watch).
+let m2mCache = null;
+/**
+ * Mint an M2M access token via the Auth0 client-credentials grant when
+ * `AUTH0_M2M_CLIENT_SECRET` is set. Returns null when the secret is unset
+ * (so the caller falls back to the user token). Throws on a configured-but-
+ * rejected secret, mirroring seqapi's `_get_m2m_token` (`raise_for_status`).
+ */
+async function getM2mToken() {
+    const clientSecret = process.env.AUTH0_M2M_CLIENT_SECRET;
+    if (!clientSecret)
+        return null;
+    const now = Date.now() / 1000;
+    if (m2mCache && m2mCache.expiresAt > now + 60)
+        return m2mCache.accessToken;
+    const response = await fetch(`https://${AUTH0_DOMAIN}/oauth/token`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            grant_type: 'client_credentials',
+            client_id: AUTH0_M2M_CLIENT_ID,
+            client_secret: clientSecret,
+            audience: AUTH0_AUDIENCE,
+        }),
+    });
+    if (!response.ok) {
+        throw new Error(`Auth0 M2M token request failed (${response.status}): ${await response.text()}`);
+    }
+    const data = (await response.json());
+    if (!data.access_token) {
+        throw new Error('Auth0 M2M response missing access_token');
+    }
+    m2mCache = {
+        accessToken: data.access_token,
+        expiresAt: Date.now() / 1000 + (data.expires_in ?? 7200),
+    };
+    return m2mCache.accessToken;
+}
+export function seqapiTokenDir() {
+    return join(homedir(), '.config', 'sequence-api');
+}
+export function seqapiTokenPath() {
+    return join(seqapiTokenDir(), 'tokens.json');
+}
+export class NotLoggedInError extends Error {
+    name = 'NotLoggedInError';
+    constructor() {
+        super('Not logged in. Run: seqapi login\n' +
+            'seq-studio does not have its own login flow — it shares tokens with seqapi.\n' +
+            'For headless contexts (CI / cloud agents), set AUTH0_M2M_CLIENT_SECRET for ' +
+            'service-account (M2M) access instead.');
+    }
+}
+/**
+ * Return a valid access token. Tries the M2M service account first when
+ * `AUTH0_M2M_CLIENT_SECRET` is set, then falls back to the cached user
+ * token (refreshed via the Auth0 refresh-token grant when within 60s of
+ * expiry). Same precedence as seqapi's `get_access_token`, so both CLIs
+ * resolve the same identity for the same environment.
+ */
+export async function getAccessToken() {
+    const m2m = await getM2mToken();
+    if (m2m)
+        return m2m;
+    const tokens = await loadTokens();
+    if (!tokens)
+        throw new NotLoggedInError();
+    const now = Date.now() / 1000;
+    if (tokens.access_token && (tokens.expires_at ?? 0) > now + 60) {
+        return tokens.access_token;
+    }
+    if (!tokens.refresh_token)
+        throw new NotLoggedInError();
+    const response = await fetch(`https://${AUTH0_DOMAIN}/oauth/token`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            grant_type: 'refresh_token',
+            client_id: AUTH0_CLIENT_ID,
+            refresh_token: tokens.refresh_token,
+        }),
+    });
+    if (response.status === 401 || response.status === 403) {
+        throw new Error('Refresh token expired or revoked. Re-authenticate with: seqapi login');
+    }
+    if (!response.ok) {
+        throw new Error(`Auth0 token refresh failed (${response.status}): ${await response.text()}`);
+    }
+    const refreshed = (await response.json());
+    if (!refreshed.access_token) {
+        throw new Error('Auth0 refresh response missing access_token');
+    }
+    const updated = {
+        access_token: refreshed.access_token,
+        refresh_token: refreshed.refresh_token ?? tokens.refresh_token,
+        expires_at: Date.now() / 1000 + (refreshed.expires_in ?? 86400),
+    };
+    await saveTokens(updated);
+    return updated.access_token;
+}
+/**
+ * Try to load a token without throwing. Returns `null` for any error
+ * condition (missing file, parse error, no token fields). Used by
+ * `doctor` for non-fatal "are you logged in?" checks.
+ */
+export async function tryGetAccessToken(options) {
+    try {
+        return await getAccessToken();
+    }
+    catch (err) {
+        if (options?.failClosedForM2m && process.env.AUTH0_M2M_CLIENT_SECRET?.trim()) {
+            throw err;
+        }
+        return null;
+    }
+}
+async function loadTokens() {
+    const path = seqapiTokenPath();
+    if (!existsSync(path))
+        return null;
+    try {
+        return JSON.parse(await readFile(path, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+async function saveTokens(tokens) {
+    const path = seqapiTokenPath();
+    await mkdir(dirname(path), { recursive: true });
+    // Mirror seqapi's atomic-write pattern: write to tmpfile then rename.
+    const tmp = path + '.tmp';
+    await writeFile(tmp, JSON.stringify(tokens, null, 2), { encoding: 'utf8', mode: 0o600 });
+    await import('node:fs/promises').then((fs) => fs.rename(tmp, path));
+}

package/dist/bin.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import { run } from './main.js';
+run()
+    .then((code) => process.exit(code))
+    .catch((error) => {
+    console.error(error instanceof Error ? error.message : error);
+    process.exit(1);
+});

package/dist/cli-errors.d.ts

@@ -0,0 +1,5 @@
+export declare const LOG = "[seq-studio]";
+/** Map common apply failure reasons to clearer copy (original reason is preserved). */
+export declare function clarifyApplyFailureReason(reason: string): string;
+export declare function formatCliError(error: unknown): string[];
+export declare function printCliError(error: unknown): void;