@userbox/cli 0.0.0-stage → 0.1.0-alpha.1

package/dist/bin.js

@@ -0,0 +1,1177 @@
+#!/usr/bin/env node
+
+// src/bin.ts
+import { parseArgs } from "util";
+
+// src/commands/apply.ts
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+import { join as join2 } from "path";
+
+// src/credentials.ts
+import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+function configDir() {
+  const base = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
+  return join(base, "userbox");
+}
+function credentialsPath() {
+  return join(configDir(), "credentials.json");
+}
+function loadCredentials() {
+  try {
+    return JSON.parse(readFileSync(credentialsPath(), "utf8"));
+  } catch {
+    return null;
+  }
+}
+function saveCredentials(creds) {
+  const dir = configDir();
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  chmodSync(dir, 448);
+  const path = credentialsPath();
+  writeFileSync(path, `${JSON.stringify(creds, null, 2)}
+`, { mode: 384 });
+  chmodSync(path, 384);
+}
+function clearCredentials() {
+  rmSync(credentialsPath(), { force: true });
+}
+
+// src/output.ts
+var CliError = class extends Error {
+  constructor(code, message, hint) {
+    super(message);
+    this.code = code;
+    this.hint = hint;
+  }
+  code;
+  hint;
+};
+function createOutput(json) {
+  const warnings = [];
+  return {
+    json,
+    step(message) {
+      if (!json) process.stdout.write(`  ${message}
+`);
+    },
+    warn(message) {
+      warnings.push(message);
+      if (!json) process.stderr.write(`  ! ${message}
+`);
+    },
+    done(result, lines) {
+      if (json) {
+        process.stdout.write(`${JSON.stringify({ ok: true, ...result, warnings }, null, 2)}
+`);
+      } else {
+        for (const line of lines) process.stdout.write(`${line}
+`);
+      }
+    }
+  };
+}
+function printError(err, json) {
+  const e = err instanceof CliError ? err : new CliError("UNEXPECTED", err instanceof Error ? err.message : String(err));
+  if (json) {
+    process.stdout.write(
+      `${JSON.stringify({ ok: false, error: { code: e.code, message: e.message, hint: e.hint ?? null } }, null, 2)}
+`
+    );
+  } else {
+    process.stderr.write(`error [${e.code}]: ${e.message}
+`);
+    if (e.hint) process.stderr.write(`hint: ${e.hint}
+`);
+  }
+}
+
+// src/api.ts
+var DEFAULT_API_URL = "https://api.test.userbox.app";
+var ApiError = class extends CliError {
+  constructor(status, code, message) {
+    super(code, `${message} (HTTP ${status})`);
+    this.status = status;
+  }
+  status;
+};
+async function parseError(res) {
+  let body = {};
+  try {
+    body = await res.json();
+  } catch {
+  }
+  const message = body.error ?? (typeof body.detail === "string" ? body.detail : body.detail ? JSON.stringify(body.detail) : res.statusText);
+  return new ApiError(res.status, body.code ?? `HTTP_${res.status}`, message);
+}
+async function rawRequest(apiUrl, path, opts = {}) {
+  let res;
+  try {
+    res = await fetch(`${apiUrl.replace(/\/$/, "")}${path}`, {
+      method: opts.method ?? "GET",
+      headers: {
+        Accept: "application/json",
+        ...opts.body !== void 0 ? { "Content-Type": "application/json" } : {},
+        ...opts.headers
+      },
+      body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0
+    });
+  } catch (err) {
+    throw new CliError("NETWORK", `cannot reach ${apiUrl}: ${err.message}`);
+  }
+  if (!res.ok) throw await parseError(res);
+  if (res.status === 204) return void 0;
+  return await res.json();
+}
+function expiryFrom(tokens) {
+  return Date.now() + (tokens.expires_in ?? 900) * 1e3;
+}
+var Session = class _Session {
+  constructor(creds) {
+    this.creds = creds;
+  }
+  creds;
+  static load() {
+    const creds = loadCredentials();
+    if (!creds) {
+      throw new CliError(
+        "NOT_LOGGED_IN",
+        "not logged in",
+        "Ask the human to run `npx @userbox/cli login` in their own terminal, then retry."
+      );
+    }
+    return new _Session(creds);
+  }
+  get apiUrl() {
+    return this.creds.apiUrl;
+  }
+  get tenantSlug() {
+    return this.creds.tenantSlug;
+  }
+  get tenantId() {
+    return this.creds.tenantId;
+  }
+  get email() {
+    return this.creds.email;
+  }
+  /** The logged-in user's id: the `sub` of our own access token (not an authorization decision). */
+  get userId() {
+    const payload = this.creds.accessToken.split(".")[1] ?? "";
+    return JSON.parse(Buffer.from(payload, "base64url").toString("utf8")).sub;
+  }
+  async refresh() {
+    try {
+      const tokens = await rawRequest(this.creds.apiUrl, "/v1/auth/refresh", {
+        method: "POST",
+        body: { refresh_token: this.creds.refreshToken },
+        headers: { "X-Tenant-ID": this.creds.tenantId }
+      });
+      this.creds = {
+        ...this.creds,
+        accessToken: tokens.access_token,
+        refreshToken: tokens.refresh_token,
+        accessExpiresAt: expiryFrom(tokens)
+      };
+      saveCredentials(this.creds);
+    } catch (err) {
+      if (err instanceof ApiError && err.status >= 400 && err.status < 500) {
+        throw new CliError(
+          "SESSION_EXPIRED",
+          "the CLI login has expired",
+          "Ask the human to run `npx @userbox/cli login` again."
+        );
+      }
+      throw err;
+    }
+  }
+  async request(path, opts = {}) {
+    if (Date.now() > this.creds.accessExpiresAt - 3e4) await this.refresh();
+    const headers = {
+      Authorization: `Bearer ${this.creds.accessToken}`,
+      "X-Tenant-ID": this.creds.tenantId,
+      ...opts.headers
+    };
+    if (opts.envId) headers["X-Environment-ID"] = opts.envId;
+    try {
+      return await rawRequest(this.creds.apiUrl, path, { ...opts, headers });
+    } catch (err) {
+      if (err instanceof ApiError && err.status === 401) {
+        await this.refresh();
+        headers.Authorization = `Bearer ${this.creds.accessToken}`;
+        return rawRequest(this.creds.apiUrl, path, { ...opts, headers });
+      }
+      throw err;
+    }
+  }
+};
+
+// src/manifest.ts
+import { parse } from "yaml";
+var PERMISSION_KEY = /^[a-z][a-z0-9_-]*(\.[a-z][a-z0-9_-]*){1,4}$/;
+function parseManifest(text) {
+  let raw;
+  try {
+    raw = parse(text);
+  } catch (err) {
+    throw new CliError("MANIFEST_INVALID", `userbox.yaml is not valid YAML: ${err.message}`);
+  }
+  const doc = raw ?? {};
+  const permissions = doc.permissions ?? [];
+  if (!Array.isArray(permissions) || permissions.some((p) => typeof p !== "string")) {
+    throw new CliError("MANIFEST_INVALID", "`permissions` must be a list of strings");
+  }
+  for (const p of permissions) {
+    if (!PERMISSION_KEY.test(p)) {
+      throw new CliError(
+        "MANIFEST_INVALID",
+        `invalid permission key "${p}"`,
+        "Use 2 to 5 lowercase segments separated by dots, for example projects.delete."
+      );
+    }
+  }
+  const rolesRaw = doc.roles ?? {};
+  if (typeof rolesRaw !== "object" || Array.isArray(rolesRaw)) {
+    throw new CliError("MANIFEST_INVALID", "`roles` must map role names to lists of permissions");
+  }
+  const declared = new Set(permissions);
+  const roles = {};
+  for (const [name, list] of Object.entries(rolesRaw)) {
+    if (!Array.isArray(list) || list.some((p) => typeof p !== "string")) {
+      throw new CliError("MANIFEST_INVALID", `role "${name}" must be a list of permission keys`);
+    }
+    const expanded = /* @__PURE__ */ new Set();
+    for (const entry of list) {
+      if (entry.endsWith(".*")) {
+        const prefix = entry.slice(0, -1);
+        const matches = [...declared].filter((p) => p.startsWith(prefix));
+        if (matches.length === 0) {
+          throw new CliError("MANIFEST_INVALID", `role "${name}": "${entry}" matches no declared permission`);
+        }
+        matches.forEach((m) => expanded.add(m));
+      } else if (!declared.has(entry)) {
+        throw new CliError(
+          "MANIFEST_INVALID",
+          `role "${name}" uses "${entry}", which is not under \`permissions\``
+        );
+      } else {
+        expanded.add(entry);
+      }
+    }
+    roles[name] = [...expanded].sort();
+  }
+  return { permissions: [...declared].sort(), roles };
+}
+function planApply(manifest, remote) {
+  const remotePerms = new Set(remote.permissions);
+  const plan = {
+    createPermissions: manifest.permissions.filter((p) => !remotePerms.has(p)),
+    createRoles: Object.keys(manifest.roles).filter((r) => !(r in remote.roles)).sort(),
+    grant: [],
+    revoke: [],
+    extraPermissions: remote.permissions.filter((p) => !manifest.permissions.includes(p)).sort(),
+    extraRoles: Object.keys(remote.roles).filter((r) => !(r in manifest.roles)).sort()
+  };
+  for (const [role, wanted] of Object.entries(manifest.roles)) {
+    const have = new Set(remote.roles[role] ?? []);
+    for (const p of wanted) if (!have.has(p)) plan.grant.push({ role, permission: p });
+    for (const p of have) if (!wanted.includes(p)) plan.revoke.push({ role, permission: p });
+  }
+  return plan;
+}
+function planIsEmpty(plan) {
+  return plan.createPermissions.length === 0 && plan.createRoles.length === 0 && plan.grant.length === 0 && plan.revoke.length === 0;
+}
+function planRevokes(plan) {
+  return plan.revoke.length > 0;
+}
+
+// src/prompt.ts
+import { createInterface } from "readline";
+import { Writable } from "stream";
+function requireTty(command) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    throw new CliError(
+      "NEEDS_HUMAN",
+      `\`userbox ${command}\` must be run by a human in an interactive terminal`,
+      `Ask the human to run \`npx @userbox/cli ${command}\` in their own terminal, then continue.`
+    );
+  }
+}
+async function ask(question, { secret = false, fallback = "" } = {}) {
+  let muted = false;
+  const output = new Writable({
+    write(chunk, _enc, cb) {
+      if (!muted) process.stdout.write(chunk);
+      cb();
+    }
+  });
+  const rl = createInterface({ input: process.stdin, output, terminal: true });
+  const label = fallback ? `${question} (${fallback}): ` : `${question}: `;
+  try {
+    return await new Promise((resolve) => {
+      rl.question(label, (answer) => {
+        if (secret) process.stdout.write("\n");
+        resolve(answer.trim() || fallback);
+      });
+      muted = secret;
+    });
+  } finally {
+    rl.close();
+  }
+}
+async function confirm(question) {
+  const answer = await ask(`${question} [y/N]`);
+  return /^y(es)?$/i.test(answer);
+}
+
+// src/userbox.ts
+async function defaultEnvironment(s) {
+  const { environments } = await s.request("/v1/environments");
+  const env = environments.find((e) => e.isDefault);
+  if (!env) throw new CliError("NO_DEFAULT_ENVIRONMENT", "the tenant has no default environment");
+  return env;
+}
+function getAuthSettings(s, env) {
+  return s.request(`/v1/environments/${env.id}/auth-settings`);
+}
+async function ensureRedirectDomain(s, env, host) {
+  const settings = await getAuthSettings(s, env);
+  const domains = settings.allowed_redirect_domains ?? [];
+  if (domains.includes(host)) return false;
+  await s.request(`/v1/environments/${env.id}/auth-settings`, {
+    method: "PATCH",
+    body: { allowed_redirect_domains: [...domains, host] }
+  });
+  return true;
+}
+async function createApiKey(s, env, name, scopes) {
+  const res = await s.request("/v1/api-keys", {
+    method: "POST",
+    envId: env.id,
+    body: { name, scopes }
+  });
+  return res.key;
+}
+async function listWorkspaces(s, env) {
+  const res = await s.request("/v1/workspaces?status=active&per_page=100", {
+    envId: env.id
+  });
+  return res.items;
+}
+function createWorkspace(s, env, name, slug) {
+  return s.request("/v1/workspaces", { method: "POST", envId: env.id, body: { name, slug } });
+}
+async function listExternalPermissions(s, env) {
+  const all = [];
+  let cursor = null;
+  do {
+    const q = cursor ? `&cursor=${encodeURIComponent(cursor)}` : "";
+    const page = await s.request(
+      `/v1/permissions?type=external&limit=200${q}`,
+      { envId: env.id }
+    );
+    all.push(...page.items);
+    cursor = page.next_cursor;
+  } while (cursor);
+  return all;
+}
+function createPermission(s, env, key) {
+  return s.request("/v1/permissions", { method: "POST", envId: env.id, body: { key, name: key } });
+}
+async function listRoles(s, env, workspaceId) {
+  const res = await s.request(`/v1/workspaces/${workspaceId}/roles?limit=200`, {
+    envId: env.id
+  });
+  return res.items;
+}
+function createRole(s, env, workspaceId, name) {
+  return s.request(`/v1/workspaces/${workspaceId}/roles`, { method: "POST", envId: env.id, body: { name } });
+}
+async function listRolePermissions(s, env, workspaceId, roleId) {
+  const res = await s.request(
+    `/v1/workspaces/${workspaceId}/roles/${roleId}/permissions?limit=200`,
+    { envId: env.id }
+  );
+  return res.items;
+}
+async function listMemberships(s, workspaceId) {
+  const res = await s.request(
+    `/v1/memberships?workspace_id=${workspaceId}&per_page=100`
+  );
+  return res.items;
+}
+function inviteMember(s, workspaceId, email) {
+  return s.request("/v1/memberships", { method: "POST", body: { email, workspace_id: workspaceId } });
+}
+function assignRole(s, membershipId, roleId) {
+  return s.request(`/v1/memberships/${membershipId}/roles`, { method: "POST", body: { role_id: roleId } });
+}
+function grantRolePermission(s, env, workspaceId, roleId, permissionId) {
+  return s.request(`/v1/workspaces/${workspaceId}/roles/${roleId}/permissions`, {
+    method: "POST",
+    envId: env.id,
+    body: { permission_id: permissionId, effect: "allow" }
+  });
+}
+function revokeRolePermission(s, env, workspaceId, roleId, permissionId) {
+  return s.request(`/v1/workspaces/${workspaceId}/roles/${roleId}/permissions/${permissionId}`, {
+    method: "DELETE",
+    envId: env.id
+  });
+}
+
+// src/commands/apply.ts
+function isInteractive(flags) {
+  return Boolean(process.stdin.isTTY && process.stdout.isTTY) && !flags.json;
+}
+async function confirmRevokes(sync, flags, command) {
+  if (!sync.plans.some((p) => planRevokes(p.plan))) return true;
+  const lines = describe(sync).filter((l) => l.startsWith("  - "));
+  if (!isInteractive(flags)) {
+    throw new CliError(
+      "NEEDS_HUMAN",
+      `the plan removes permissions from existing roles:
+${lines.join("\n")}`,
+      `Ask the human to review it and run \`npx @userbox/cli ${command}\` in their own terminal.`
+    );
+  }
+  process.stdout.write(`This removes permissions from existing roles:
+${lines.join("\n")}
+`);
+  return confirm("Remove them?");
+}
+function loadManifest(root) {
+  const path = join2(root, "userbox.yaml");
+  if (!existsSync(path)) {
+    throw new CliError(
+      "NO_MANIFEST",
+      "no userbox.yaml in this directory",
+      "Create one:\n  permissions: [projects.read, projects.delete]\n  roles:\n    admin: [projects.*]\n    member: [projects.read]"
+    );
+  }
+  return parseManifest(readFileSync2(path, "utf8"));
+}
+async function workspacePlan(s, env, manifest, ws, envPerms) {
+  const roles = await listRoles(s, env, ws.id);
+  const remoteRoles = {};
+  const roleIds = /* @__PURE__ */ new Map();
+  for (const role of roles) {
+    roleIds.set(role.name, role.id);
+    const perms = await listRolePermissions(s, env, ws.id, role.id);
+    remoteRoles[role.name] = perms.filter((p) => p.type === "external").map((p) => p.key);
+  }
+  return { workspace: ws, plan: planApply(manifest, { permissions: envPerms, roles: remoteRoles }), roleIds };
+}
+async function executeRoles(s, env, wp, permissionIds) {
+  const ids = new Map(wp.roleIds);
+  for (const name of wp.plan.createRoles) {
+    ids.set(name, (await createRole(s, env, wp.workspace.id, name)).id);
+  }
+  for (const { role, permission } of wp.plan.grant) {
+    await grantRolePermission(s, env, wp.workspace.id, ids.get(role), permissionIds.get(permission));
+  }
+  for (const { role, permission } of wp.plan.revoke) {
+    const pid = permissionIds.get(permission);
+    if (pid) await revokeRolePermission(s, env, wp.workspace.id, ids.get(role), pid);
+  }
+}
+async function syncManifest(s, env, manifest, workspaces) {
+  const existing = await listExternalPermissions(s, env);
+  const permissionIds = new Map(existing.map((p) => [p.key, p.id]));
+  const plans = [];
+  for (const ws of workspaces) plans.push(await workspacePlan(s, env, manifest, ws, [...permissionIds.keys()]));
+  return { createdPermissions: manifest.permissions.filter((p) => !permissionIds.has(p)), plans, permissionIds };
+}
+async function executeSync(s, env, sync) {
+  for (const key of sync.createdPermissions) {
+    sync.permissionIds.set(key, (await createPermission(s, env, key)).id);
+  }
+  for (const wp of sync.plans) await executeRoles(s, env, wp, sync.permissionIds);
+}
+function describe(sync) {
+  const lines = [];
+  for (const p of sync.createdPermissions) lines.push(`  + permission ${p}`);
+  for (const { workspace, plan } of sync.plans) {
+    const label = workspace.slug ?? workspace.name;
+    for (const r of plan.createRoles) lines.push(`  + role ${r} in ${label}`);
+    for (const g of plan.grant) lines.push(`  + ${g.role} \u2192 ${g.permission} in ${label}`);
+    for (const r of plan.revoke) lines.push(`  - ${r.role} \u2192 ${r.permission} in ${label}`);
+  }
+  return lines;
+}
+async function apply(flags, out) {
+  const manifest = loadManifest(process.cwd());
+  const session = Session.load();
+  const env = await defaultEnvironment(session);
+  const workspaces = await listWorkspaces(session, env);
+  if (workspaces.length === 0) {
+    out.warn("No workspaces yet: roles are created per workspace. Run `userbox dev seed` to create one.");
+  }
+  const sync = await syncManifest(session, env, manifest, workspaces);
+  const changes = describe(sync);
+  const extras = new Set(sync.plans.flatMap((p) => p.plan.extraPermissions));
+  if (extras.size > 0) out.warn(`Not in userbox.yaml, left as they are: ${[...extras].join(", ")}`);
+  const empty = sync.createdPermissions.length === 0 && sync.plans.every((p) => planIsEmpty(p.plan));
+  const summary = {
+    environment: { id: env.id, name: env.name },
+    workspaces: workspaces.map((w) => w.slug ?? w.id),
+    changes
+  };
+  if (empty) {
+    out.done({ ...summary, applied: false, upToDate: true }, ["Up to date: nothing to apply."]);
+    return;
+  }
+  if (!flags.yes) {
+    if (!isInteractive(flags)) {
+      out.done({ ...summary, applied: false, hint: "Re-run with --yes to apply." }, [
+        "Plan:",
+        ...changes,
+        "Re-run with --yes to apply."
+      ]);
+      return;
+    }
+    process.stdout.write(`Plan for ${env.name}:
+${changes.join("\n")}
+`);
+    if (!await confirm("Apply these changes?")) {
+      out.done({ ...summary, applied: false }, ["Nothing applied."]);
+      return;
+    }
+  } else if (!await confirmRevokes(sync, flags, "apply")) {
+    out.done({ ...summary, applied: false }, ["Nothing applied."]);
+    return;
+  }
+  await executeSync(session, env, sync);
+  out.done({ ...summary, applied: true }, ["Applied:", ...changes]);
+}
+
+// src/commands/dev-seed.ts
+import { existsSync as existsSync2 } from "fs";
+import { join as join3 } from "path";
+var SLUG = "dev";
+async function devSeed(flags, out) {
+  const session = Session.load();
+  const env = await defaultEnvironment(session);
+  if (env.type === "production") {
+    out.warn(`The default environment "${env.name}" is a production environment; the dev workspace is created there.`);
+  }
+  const workspaces = await listWorkspaces(session, env);
+  let ws = workspaces.find((w) => w.slug === SLUG);
+  if (ws) out.step(`Workspace ${SLUG} exists`);
+  else {
+    ws = await createWorkspace(session, env, "Dev workspace", SLUG);
+    out.step(`Created workspace ${SLUG}`);
+  }
+  if (existsSync2(join3(process.cwd(), "userbox.yaml"))) {
+    const sync = await syncManifest(session, env, loadManifest(process.cwd()), [ws]);
+    if (await confirmRevokes(sync, flags, "dev seed")) {
+      await executeSync(session, env, sync);
+      out.step("Synced userbox.yaml roles into the workspace");
+    } else {
+      out.warn("Skipped the userbox.yaml sync: nothing was removed from the roles.");
+    }
+  } else {
+    out.warn("No userbox.yaml: the workspace has no roles yet. Add one and run `userbox apply`.");
+  }
+  const roles = new Map((await listRoles(session, env, ws.id)).map((r) => [r.name, r.id]));
+  const memberships = await listMemberships(session, ws.id);
+  const mine = memberships.find((m) => m.user_id === session.userId);
+  let adminAssigned = false;
+  const adminRole = roles.get("admin");
+  if (mine && adminRole) {
+    await assignRole(session, mine.id, adminRole);
+    adminAssigned = true;
+    out.step(`You (${session.email}) have the admin role in ${SLUG}`);
+  } else if (!adminRole) {
+    out.warn("No `admin` role in userbox.yaml, so your membership has no role.");
+  } else {
+    out.warn("You have no membership in the dev workspace; it was created by another user.");
+  }
+  const invited = [];
+  for (const spec of flags.invite) {
+    const [email, roleName = "member"] = spec.split(":");
+    if (!email) continue;
+    const already = memberships.find((m) => m.email?.toLowerCase() === email.toLowerCase());
+    const membership = already ?? await inviteMember(session, ws.id, email);
+    const roleId = roles.get(roleName);
+    if (roleId) await assignRole(session, membership.id, roleId);
+    else out.warn(`No role "${roleName}" for ${email}; invited without a role.`);
+    invited.push({ email, role: roleId ? roleName : null });
+    out.step(already ? `${email} is already a member` : `Invited ${email} as ${roleName}`);
+  }
+  out.done(
+    { workspace: { id: ws.id, slug: SLUG }, environment: { id: env.id, name: env.name }, adminAssigned, invited },
+    [
+      `Dev workspace: ${ws.id}`,
+      "Sign in to your app with your Userbox login; you are admin in this workspace.",
+      ...flags.invite.length === 0 ? ["Add a second user with `userbox dev seed --invite someone@example.com:member` (they get an email)."] : []
+    ]
+  );
+}
+
+// src/commands/doctor.ts
+import { randomUUID } from "crypto";
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { join as join5 } from "path";
+
+// src/envfile.ts
+var ENV_KEYS = [
+  "NEXT_PUBLIC_USERBOX_TENANT_SLUG",
+  "NEXT_PUBLIC_USERBOX_API_URL",
+  "USERBOX_TENANT_ID",
+  "USERBOX_API_KEY",
+  "APP_ORIGIN"
+];
+var LINE = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/;
+function parseEnv(text) {
+  const out = /* @__PURE__ */ new Map();
+  for (const raw of text.split(/\r?\n/)) {
+    const m = LINE.exec(raw);
+    if (!m) continue;
+    let value = (m[2] ?? "").trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    out.set(m[1], value);
+  }
+  return out;
+}
+function mergeEnv(existing, values, force = /* @__PURE__ */ new Set()) {
+  const current = parseEnv(existing);
+  const added = [];
+  const replaced = [];
+  const kept = [];
+  const lines = existing === "" ? [] : existing.replace(/\n$/, "").split(/\r?\n/);
+  const toAppend = [];
+  for (const [key, value] of Object.entries(values)) {
+    const had = current.get(key);
+    if (had && !force.has(key)) {
+      kept.push(key);
+      continue;
+    }
+    const idx = lines.findIndex((l) => LINE.exec(l)?.[1] === key);
+    if (idx >= 0) {
+      lines[idx] = `${key}=${value}`;
+      (had ? replaced : added).push(key);
+    } else {
+      toAppend.push(`${key}=${value}`);
+      added.push(key);
+    }
+  }
+  if (toAppend.length > 0) {
+    if (lines.length > 0 && lines[lines.length - 1] !== "") lines.push("");
+    lines.push("# Userbox (written by `userbox init`)", ...toAppend);
+  }
+  return { text: lines.length ? `${lines.join("\n")}
+` : "", added, replaced, kept };
+}
+
+// src/project.ts
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { join as join4 } from "path";
+function detectPackageManager(root) {
+  if (existsSync3(join4(root, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync3(join4(root, "yarn.lock"))) return "yarn";
+  if (existsSync3(join4(root, "bun.lockb")) || existsSync3(join4(root, "bun.lock"))) return "bun";
+  return "npm";
+}
+function detectNextProject(root) {
+  const pkgPath = join4(root, "package.json");
+  if (!existsSync3(pkgPath)) {
+    throw new CliError("NOT_A_PROJECT", `no package.json in ${root}`, "Run this in the root of your Next.js app.");
+  }
+  const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
+  const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+  if (!deps.next) {
+    throw new CliError(
+      "UNSUPPORTED_FRAMEWORK",
+      "this is not a Next.js app (no `next` dependency)",
+      "`userbox init` supports Next.js App Router only for now; see https://docs.test.userbox.app/llms.txt for other stacks."
+    );
+  }
+  const appDir = existsSync3(join4(root, "src", "app")) ? "src/app" : existsSync3(join4(root, "app")) ? "app" : null;
+  if (!appDir) {
+    throw new CliError(
+      "UNSUPPORTED_FRAMEWORK",
+      "no `app/` or `src/app/` directory: only the App Router is supported"
+    );
+  }
+  return {
+    root,
+    appDir,
+    packageManager: detectPackageManager(root),
+    nextVersion: deps.next ?? null,
+    typescript: existsSync3(join4(root, "tsconfig.json"))
+  };
+}
+function installCommand(pm, packages) {
+  switch (pm) {
+    case "pnpm":
+      return ["pnpm", ["add", ...packages]];
+    case "yarn":
+      return ["yarn", ["add", ...packages]];
+    case "bun":
+      return ["bun", ["add", ...packages]];
+    default:
+      return ["npm", ["install", ...packages]];
+  }
+}
+
+// src/commands/doctor.ts
+var MIN = { "@userbox/react": 4, "@userbox/node": 1 };
+function alphaNumber(version) {
+  const m = /^1\.0\.0-alpha\.(\d+)$/.exec(version);
+  if (m) return Number(m[1]);
+  return /^\d+\.\d+\.\d+$/.test(version) && !version.startsWith("0.") ? Number.POSITIVE_INFINITY : null;
+}
+async function doctor(flags, out) {
+  const root = process.cwd();
+  const checks = [];
+  const add = (c) => {
+    checks.push(c);
+    const mark = { pass: "\u2713", warn: "!", fail: "\u2717", skip: "-" }[c.status];
+    out.step(`${mark} ${c.name}: ${c.message}${c.hint && c.status !== "pass" ? `
+      \u2192 ${c.hint}` : ""}`);
+  };
+  let appDir = "app";
+  try {
+    const project = detectNextProject(root);
+    appDir = project.appDir;
+    add({ name: "project", status: "pass", message: `Next.js ${project.nextVersion ?? ""} (${appDir})`.trim() });
+  } catch (err) {
+    add({ name: "project", status: "fail", message: err.message, hint: err.hint });
+  }
+  for (const [name, min] of Object.entries(MIN)) {
+    const pkgPath = join5(root, "node_modules", name, "package.json");
+    if (!existsSync4(pkgPath)) {
+      add({ name, status: "fail", message: "not installed", hint: "Run `userbox init` or install @userbox/react@alpha @userbox/node@alpha." });
+      continue;
+    }
+    const version = JSON.parse(readFileSync4(pkgPath, "utf8")).version;
+    const n = alphaNumber(version);
+    add(
+      n !== null && n >= min ? { name, status: "pass", message: version } : { name, status: "fail", message: `${version} is too old`, hint: `Install ${name}@alpha (1.0.0-alpha.${min} or newer).` }
+    );
+  }
+  const files = [
+    `${appDir}/api/auth/refresh/route.ts`,
+    `${appDir}/auth/callback/page.tsx`
+  ];
+  for (const f of files) {
+    const found = [f, f.replace(/\.tsx?$/, ".js"), f.replace(/\.tsx$/, ".jsx")].some((p) => existsSync4(join5(root, p)));
+    add(found ? { name: f, status: "pass", message: "present" } : { name: f, status: "fail", message: "missing", hint: "Run `userbox init` to write it." });
+  }
+  const envPath = join5(root, ".env.local");
+  const env = existsSync4(envPath) ? parseEnv(readFileSync4(envPath, "utf8")) : /* @__PURE__ */ new Map();
+  const missing = ENV_KEYS.filter((k) => !env.get(k));
+  add(
+    missing.length === 0 ? { name: ".env.local", status: "pass", message: "all five variables set" } : { name: ".env.local", status: "fail", message: `missing ${missing.join(", ")}`, hint: "Run `userbox init` (it never overwrites existing values without --force)." }
+  );
+  const leaked = [...env.entries()].filter(
+    ([k, v]) => k.startsWith("NEXT_PUBLIC_") && (/KEY|SECRET|TOKEN|PASSWORD/.test(k) || /^ub_(live|prod|stg|dev)_/.test(v))
+  );
+  add(
+    leaked.length === 0 ? { name: "secrets", status: "pass", message: "no secret in a NEXT_PUBLIC_ variable" } : { name: "secrets", status: "fail", message: `${leaked.map(([k]) => k).join(", ")} is exposed to the browser`, hint: "Rename it without NEXT_PUBLIC_ and rotate the key in the console." }
+  );
+  const gitignore = existsSync4(join5(root, ".gitignore")) ? readFileSync4(join5(root, ".gitignore"), "utf8") : "";
+  add(
+    /^(\.env\*|\.env\.local|\.env\*\.local|\*\.local)\s*$/m.test(gitignore) ? { name: ".gitignore", status: "pass", message: ".env.local is ignored" } : { name: ".gitignore", status: "fail", message: ".env.local is not ignored", hint: "Add `.env.local` to .gitignore before committing." }
+  );
+  const apiUrl = env.get("NEXT_PUBLIC_USERBOX_API_URL");
+  const apiKey = env.get("USERBOX_API_KEY");
+  const tenantId = env.get("USERBOX_TENANT_ID");
+  if (apiUrl) {
+    try {
+      const jwks = await rawRequest(apiUrl, "/.well-known/jwks.json");
+      add({ name: "api", status: jwks.keys.length > 0 ? "pass" : "fail", message: `${apiUrl} reachable, JWKS has ${jwks.keys.length} key(s)` });
+    } catch (err) {
+      add({ name: "api", status: "fail", message: err.message, hint: "Check NEXT_PUBLIC_USERBOX_API_URL." });
+    }
+  }
+  if (apiUrl && apiKey) {
+    const auth = { Authorization: `Bearer ${apiKey}` };
+    try {
+      const t = await rawRequest(apiUrl, "/v1/tenants/me", { headers: auth });
+      const slugOk = t.slug === env.get("NEXT_PUBLIC_USERBOX_TENANT_SLUG");
+      add(
+        t.id === tenantId && slugOk ? { name: "api key", status: "pass", message: `valid for tenant ${t.slug}` } : { name: "api key", status: "fail", message: `the key belongs to tenant ${t.slug} (${t.id}), not the one in .env.local`, hint: "Fix USERBOX_TENANT_ID / NEXT_PUBLIC_USERBOX_TENANT_SLUG, or run `userbox init --force`." }
+      );
+    } catch (err) {
+      add({ name: "api key", status: "fail", message: err.message, hint: "The key is revoked or wrong: run `userbox init --force` for a new one." });
+    }
+    try {
+      await rawRequest(apiUrl, "/v1/access/check", {
+        method: "POST",
+        headers: auth,
+        body: { user_id: randomUUID(), workspace_id: randomUUID(), permission_key: "doctor.probe" }
+      });
+      add({ name: "scope access:check", status: "pass", message: "granted" });
+    } catch (err) {
+      const scope = err instanceof ApiError && err.code === "INSUFFICIENT_SCOPE";
+      add(scope ? { name: "scope access:check", status: "fail", message: "missing: can() always returns false", hint: "Run `userbox init --force` for a key with the right scopes." } : { name: "scope access:check", status: "pass", message: "granted" });
+    }
+  }
+  const creds = loadCredentials();
+  if (!creds) {
+    add({ name: "redirect domain", status: "skip", message: "not logged in", hint: "Run `userbox login` to also check the tenant settings." });
+  } else {
+    try {
+      const session = Session.load();
+      if (tenantId && session.tenantId !== tenantId) {
+        add({ name: "login", status: "warn", message: `logged in to ${session.tenantSlug}, but .env.local points at another tenant` });
+      } else {
+        const envr = await defaultEnvironment(session);
+        const settings = await getAuthSettings(session, envr);
+        const host = new URL(env.get("APP_ORIGIN") ?? "http://localhost:3000").hostname;
+        const domains = settings.allowed_redirect_domains ?? [];
+        add(domains.includes(host) ? { name: "redirect domain", status: "pass", message: `${host} allowed` } : { name: "redirect domain", status: "fail", message: `${host} is not an allowed redirect domain`, hint: "Run `userbox init`, or add it in Console \u2192 Auth settings." });
+        add(settings.allow_self_signup ? { name: "sign-up", status: "pass", message: "self-service sign-up is on" } : { name: "sign-up", status: "warn", message: "sign-up is invitation-only", hint: "Fine for dev. Turn on self-service sign-up in the console if new users should register." });
+      }
+    } catch (err) {
+      add({ name: "login", status: "warn", message: err.message, hint: err.hint });
+    }
+  }
+  const failed = checks.filter((c) => c.status === "fail").length;
+  out.done({ healthy: failed === 0, checks }, [
+    failed === 0 ? "\nAll checks passed." : `
+${failed} check(s) failed.`
+  ]);
+  return failed === 0 ? 0 : 1;
+}
+
+// src/commands/init.ts
+import { spawnSync } from "child_process";
+import { existsSync as existsSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
+import { hostname } from "os";
+import { join as join7 } from "path";
+
+// src/scaffold.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
+import { dirname, join as join6 } from "path";
+function providers(ts) {
+  const props = ts ? "{ children }: { children: React.ReactNode }" : "{ children }";
+  const bang = ts ? "!" : "";
+  return `"use client";
+import { UserboxProvider } from "@userbox/react";
+
+export function Providers(${props}) {
+  return (
+    <UserboxProvider
+      tenantSlug={process.env.NEXT_PUBLIC_USERBOX_TENANT_SLUG${bang}}
+      baseUrl={process.env.NEXT_PUBLIC_USERBOX_API_URL${bang}}
+      tokenStorage="cookie"
+      refreshUrl="/api/auth/refresh"
+    >
+      {children}
+    </UserboxProvider>
+  );
+}
+`;
+}
+var CALLBACK = `"use client";
+import { useRouter } from "next/navigation";
+import { UserboxCallback } from "@userbox/react";
+
+export default function Callback() {
+  const router = useRouter();
+  return <UserboxCallback onSuccess={() => router.replace("/")} onError={(e) => console.error(e.message)} />;
+}
+`;
+var REFRESH = `import { createRefreshHandler } from "@userbox/react/nextjs";
+
+export const { POST } = createRefreshHandler();
+`;
+function writeIfMissing(root, rel, content, result) {
+  const path = join6(root, rel);
+  if (existsSync5(path)) {
+    result.skipped.push(rel);
+    return;
+  }
+  mkdirSync2(dirname(path), { recursive: true });
+  writeFileSync2(path, content);
+  result.written.push(rel);
+}
+function wrapLayout(text, importPath) {
+  if (/<Providers[\s>]/.test(text)) return null;
+  const occurrences = text.split("{children}").length - 1;
+  if (occurrences !== 1) return null;
+  const wrapped = text.replace("{children}", "<Providers>{children}</Providers>");
+  const importLine = `import { Providers } from "${importPath}";
+`;
+  const lastImport = [...wrapped.matchAll(/^import .*$/gm)].pop();
+  if (!lastImport || lastImport.index === void 0) return importLine + wrapped;
+  const at = lastImport.index + lastImport[0].length;
+  return `${wrapped.slice(0, at)}
+${importLine.trimEnd()}${wrapped.slice(at)}`;
+}
+function scaffold(project) {
+  const result = { written: [], skipped: [], todo: [] };
+  const { root, appDir, typescript: ts } = project;
+  const x = ts ? "tsx" : "jsx";
+  const s = ts ? "ts" : "js";
+  writeIfMissing(root, `${appDir}/providers.${x}`, providers(ts), result);
+  writeIfMissing(root, `${appDir}/auth/callback/page.${x}`, CALLBACK, result);
+  writeIfMissing(root, `${appDir}/api/auth/refresh/route.${s}`, REFRESH, result);
+  const layoutRel = [`${appDir}/layout.tsx`, `${appDir}/layout.jsx`, `${appDir}/layout.js`].find(
+    (p) => existsSync5(join6(root, p))
+  );
+  if (!layoutRel) {
+    result.todo.push(`Wrap {children} in your root layout with <Providers> from ./providers.`);
+    return result;
+  }
+  const layoutPath = join6(root, layoutRel);
+  const layout = readFileSync5(layoutPath, "utf8");
+  if (/<Providers[\s>]/.test(layout)) {
+    result.skipped.push(layoutRel);
+    return result;
+  }
+  const next = wrapLayout(layout, "./providers");
+  if (next === null) {
+    result.todo.push(`Wrap {children} in ${layoutRel} with <Providers> (import { Providers } from "./providers").`);
+  } else {
+    writeFileSync2(layoutPath, next);
+    result.written.push(`${layoutRel} (wrapped {children} with <Providers>)`);
+  }
+  return result;
+}
+
+// src/commands/init.ts
+var KEY_SCOPES = ["access:check", "memberships:read", "workspaces:read"];
+var SDKS = ["@userbox/react@alpha", "@userbox/node@alpha"];
+function ensureGitignored(root) {
+  const path = join7(root, ".gitignore");
+  const text = existsSync6(path) ? readFileSync6(path, "utf8") : "";
+  const covered = text.split(/\r?\n/).map((l) => l.trim()).some((l) => [".env*", ".env.local", ".env*.local", "*.local"].includes(l));
+  if (covered) return false;
+  writeFileSync3(path, `${text}${text && !text.endsWith("\n") ? "\n" : ""}.env.local
+`);
+  return true;
+}
+async function init(flags, out) {
+  const root = process.cwd();
+  const project = detectNextProject(root);
+  const session = Session.load();
+  const origin = flags.origin ?? "http://localhost:3000";
+  let host;
+  try {
+    host = new URL(origin).hostname;
+  } catch {
+    throw new CliError("INVALID_ORIGIN", `--origin must be a URL such as http://localhost:3000, got "${origin}"`);
+  }
+  const env = await defaultEnvironment(session);
+  out.step(`Tenant ${session.tenantSlug}, environment ${env.name} (${env.type})`);
+  if (env.type === "production") out.warn("The default environment is production; the key created here is a production key.");
+  if (await ensureRedirectDomain(session, env, host)) out.step(`Added ${host} to the allowed redirect domains`);
+  else out.step(`${host} is already an allowed redirect domain`);
+  const envPath = join7(root, ".env.local");
+  const existing = existsSync6(envPath) ? readFileSync6(envPath, "utf8") : "";
+  const current = parseEnv(existing);
+  const values = {
+    NEXT_PUBLIC_USERBOX_TENANT_SLUG: session.tenantSlug,
+    NEXT_PUBLIC_USERBOX_API_URL: session.apiUrl,
+    USERBOX_TENANT_ID: session.tenantId,
+    APP_ORIGIN: origin
+  };
+  let keyCreated = false;
+  if (flags.force || !current.get("USERBOX_API_KEY")) {
+    const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+    values.USERBOX_API_KEY = await createApiKey(session, env, `cli ${hostname()} ${date}`, KEY_SCOPES);
+    keyCreated = true;
+    out.step(`Created an API key with scopes ${KEY_SCOPES.join(", ")}`);
+  }
+  const merged = mergeEnv(existing, values, flags.force ? new Set(ENV_KEYS) : /* @__PURE__ */ new Set());
+  writeFileSync3(envPath, merged.text, { mode: 384 });
+  out.step(`.env.local: ${merged.added.length} added, ${merged.replaced.length} replaced, ${merged.kept.length} kept`);
+  const ignored = ensureGitignored(root);
+  if (ignored) out.step("Added .env.local to .gitignore");
+  for (const key of merged.kept) {
+    if (current.get(key) !== values[key] && key !== "USERBOX_API_KEY") {
+      out.warn(`.env.local keeps a different ${key}; run with --force to replace it.`);
+    }
+  }
+  let installed = false;
+  if (!flags.skipInstall) {
+    const [cmd, args] = installCommand(project.packageManager, SDKS);
+    out.step(`Installing the SDKs: ${cmd} ${args.join(" ")}`);
+    const res = spawnSync(cmd, args, {
+      cwd: root,
+      stdio: flags.json ? ["ignore", "ignore", "inherit"] : "inherit",
+      shell: process.platform === "win32"
+    });
+    if (res.status !== 0) {
+      throw new CliError("INSTALL_FAILED", `${cmd} exited with ${res.status ?? res.signal}`, `Run \`${cmd} ${args.join(" ")}\` yourself.`);
+    }
+    installed = true;
+  }
+  const files = scaffold(project);
+  for (const f of files.written) out.step(`Wrote ${f}`);
+  for (const t of files.todo) out.warn(t);
+  out.done(
+    {
+      tenant: { id: session.tenantId, slug: session.tenantSlug },
+      environment: { id: env.id, name: env.name, type: env.type },
+      redirectDomain: host,
+      envFile: { path: ".env.local", added: merged.added, replaced: merged.replaced, kept: merged.kept },
+      apiKeyCreated: keyCreated,
+      sdksInstalled: installed,
+      files,
+      next: ["userbox apply", "userbox dev seed", "userbox doctor"]
+    },
+    [
+      "",
+      "Userbox is set up. Next:",
+      "  1. Declare permissions and roles in userbox.yaml, then run `userbox apply`.",
+      "  2. Run `userbox dev seed` for a workspace where you are admin.",
+      "  3. Run `userbox doctor`, then start the app and sign in.",
+      "Use verifyRequest() and can() from @userbox/node in your API routes (see https://docs.test.userbox.app/llms.txt)."
+    ]
+  );
+}
+
+// src/commands/login.ts
+async function login(flags, out) {
+  requireTty("login");
+  const previous = loadCredentials();
+  const apiUrl = (flags.apiUrl ?? previous?.apiUrl ?? DEFAULT_API_URL).replace(/\/$/, "");
+  const tenantSlug = await ask("Tenant slug", { fallback: previous?.tenantSlug ?? "" });
+  const email = await ask("Email", { fallback: previous?.email ?? "" });
+  const password = await ask("Password", { secret: true });
+  const tokens = await rawRequest(apiUrl, "/v1/auth/login", {
+    method: "POST",
+    body: { email, password, tenant_slug: tenantSlug }
+  });
+  const tenant = await rawRequest(apiUrl, "/v1/tenants/me", {
+    headers: { Authorization: `Bearer ${tokens.access_token}` }
+  });
+  saveCredentials({
+    apiUrl,
+    tenantSlug: tenant.slug,
+    tenantId: tenant.id,
+    email,
+    accessToken: tokens.access_token,
+    refreshToken: tokens.refresh_token,
+    accessExpiresAt: expiryFrom(tokens)
+  });
+  out.done({ tenant: { id: tenant.id, slug: tenant.slug }, email, apiUrl }, [
+    `Logged in to ${tenant.name} (${tenant.slug}) as ${email}.`,
+    "The login is stored in ~/.config/userbox/credentials.json and lasts 7 days of inactivity."
+  ]);
+}
+function logout(out) {
+  clearCredentials();
+  out.done({}, ["Logged out."]);
+}
+async function whoami(out) {
+  const session = Session.load();
+  const tenant = await session.request("/v1/tenants/me");
+  out.done(
+    { tenant: { id: tenant.id, slug: tenant.slug }, email: session.email, apiUrl: session.apiUrl },
+    [`${session.email} on ${tenant.name} (${tenant.slug}), ${session.apiUrl}`]
+  );
+}
+
+// src/bin.ts
+var VERSION = "0.1.0-alpha.1";
+var HELP = `userbox \u2014 set up Userbox in your app
+
+Usage: userbox <command> [options]
+
+Commands
+  login              Log in as a tenant admin (interactive, human only)
+  logout             Forget the local login
+  whoami             Show the current login
+  init               Set up this Next.js app: env, API key, SDKs, auth files
+  apply              Sync userbox.yaml (permissions and roles) to the environment
+  dev seed           Create a dev workspace with an admin and a member user
+  doctor             Check this app's Userbox setup
+
+Options
+  --json             Machine-readable output (for coding agents)
+  --yes, -y          Apply without asking (apply)
+  --force            init: replace existing USERBOX_* values in .env.local
+  --origin <url>     init: the app origin (default http://localhost:3000)
+  --skip-install     init: do not install the SDKs
+  --api-url <url>    login: the Userbox API (default https://api.test.userbox.app)
+  --invite <email[:role]>  dev seed: invite a user (repeatable, role defaults to member)
+  --help, -h         Show this help
+  --version, -v      Show the version
+
+Docs: https://docs.test.userbox.app/llms.txt`;
+async function main(argv) {
+  const { values, positionals } = parseArgs({
+    args: argv,
+    allowPositionals: true,
+    strict: true,
+    options: {
+      json: { type: "boolean", default: false },
+      yes: { type: "boolean", short: "y", default: false },
+      force: { type: "boolean", default: false },
+      origin: { type: "string" },
+      "skip-install": { type: "boolean", default: false },
+      "api-url": { type: "string" },
+      invite: { type: "string", multiple: true, default: [] },
+      help: { type: "boolean", short: "h", default: false },
+      version: { type: "boolean", short: "v", default: false }
+    }
+  });
+  const flags = {
+    json: values.json,
+    yes: values.yes,
+    force: values.force,
+    origin: values.origin,
+    skipInstall: values["skip-install"],
+    apiUrl: values["api-url"],
+    invite: values.invite
+  };
+  if (values.version) {
+    process.stdout.write(`${VERSION}
+`);
+    return 0;
+  }
+  const command = positionals.join(" ");
+  if (values.help || command === "") {
+    process.stdout.write(`${HELP}
+`);
+    return 0;
+  }
+  const out = createOutput(flags.json);
+  try {
+    switch (command) {
+      case "login":
+        await login(flags, out);
+        break;
+      case "logout":
+        logout(out);
+        break;
+      case "whoami":
+        await whoami(out);
+        break;
+      case "init":
+        await init(flags, out);
+        break;
+      case "apply":
+        await apply(flags, out);
+        break;
+      case "dev seed":
+        await devSeed(flags, out);
+        break;
+      case "doctor":
+        return await doctor(flags, out);
+      default:
+        throw new CliError("UNKNOWN_COMMAND", `unknown command "${command}"`, "Run `userbox --help`.");
+    }
+    return 0;
+  } catch (err) {
+    printError(err, flags.json);
+    return 1;
+  }
+}
+main(process.argv.slice(2)).then(
+  (code) => process.exit(code),
+  (err) => {
+    printError(err, process.argv.includes("--json"));
+    process.exit(1);
+  }
+);
+//# sourceMappingURL=bin.js.map