@vendure/cloud 0.2.0 → 0.3.0

package/dist/cli/commands/identity-context/login.js

@@ -0,0 +1,158 @@
+import * as prompts from "@clack/prompts";
+import { API_AUTH_CONFIG_TIMEOUT_MS, WORKOS_AUTHENTICATE_URL, WORKOS_AUTH_REQUEST_TIMEOUT_MS, WORKOS_DEVICE_AUTHORIZE_URL, cloudInvocation, createApiClient, exchangeRefreshToken, getApiUrl, openBrowser, readAuthConfig, sleep, withSessionLock, writeAuthConfig, } from "../../index.js";
+// Answers with an exit code rather than setting `process.exitCode`: the host exits with whatever a
+// command action returns. A login that was cancelled at the organization picker saved nothing and
+// left the account signed out, so a script must not read it as a completed login.
+export async function login() {
+    prompts.intro("Vendure Cloud Login");
+    const existing = readAuthConfig();
+    if (existing) {
+        const shouldContinue = await prompts.confirm({
+            initialValue: false,
+            message: `Already logged in as ${existing.user.email}. Continue and re-authenticate?`,
+        });
+        if (prompts.isCancel(shouldContinue) || !shouldContinue) {
+            prompts.outro("Login cancelled.");
+            return undefined;
+        }
+    }
+    const apiUrl = getApiUrl();
+    const publicClient = createApiClient({ baseUrl: apiUrl });
+    const { workosClientId } = await publicClient.get("/auth/cli-config");
+    const deviceResponse = await fetchWorkos(WORKOS_DEVICE_AUTHORIZE_URL, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ client_id: workosClientId }),
+    }, API_AUTH_CONFIG_TIMEOUT_MS);
+    if (!deviceResponse.ok) {
+        throw new Error("Failed to start device authorization flow");
+    }
+    const device = (await deviceResponse.json());
+    prompts.note(`Your code: ${device.user_code}\n\nIf the browser doesn't open, visit:\n${device.verification_uri_complete}`, "Open the URL in your browser to authenticate");
+    openBrowser(device.verification_uri_complete);
+    const spinner = prompts.spinner();
+    spinner.start("Waiting for authentication...");
+    let token;
+    try {
+        token = await pollForToken(workosClientId, device.device_code, device.interval, device.expires_in);
+    }
+    catch (error) {
+        spinner.stop("Authentication failed.");
+        throw error;
+    }
+    spinner.stop("Authenticated!");
+    const userName = [token.user.first_name, token.user.last_name].filter(Boolean).join(" ") || null;
+    const authedClient = createApiClient({ baseUrl: apiUrl, token: token.access_token });
+    const orgs = await authedClient.get("/auth/organizations");
+    if (orgs.length === 0) {
+        throw new Error("No organization is set up for your account. Contact support to get started.");
+    }
+    const activeOrg = await resolveActiveOrganization(orgs, token.organization_id);
+    if (!activeOrg) {
+        // Nothing was saved and the account is not signed in, so a caller must not read this exit as a
+        // completed login.
+        prompts.outro("Login cancelled.");
+        return 1;
+    }
+    // The device-flow token is scoped to WorkOS's default org for this user. If they picked (or only
+    // have) a different org, re-mint the token scoped to it so its `org_id` + `permissions` claims
+    // match the active org — otherwise permissioned calls 403 against the "wrong" org's claims.
+    //
+    // Under the session lock: the re-mint spends a single-use refresh token, and the write must not
+    // interleave with a concurrent command's refresh writing its rotated pair over this brand-new
+    // session.
+    await withSessionLock(async () => {
+        let accessToken = token.access_token;
+        let refreshToken = token.refresh_token;
+        try {
+            const pair = await exchangeRefreshToken(token.refresh_token, activeOrg.workosOrgId);
+            accessToken = pair.accessToken;
+            refreshToken = pair.refreshToken;
+        }
+        catch {
+            // The re-mint failed (network blip, authentication service hiccup). Persist the device-flow
+            // tokens anyway so the user lands logged in rather than stranded with a consumed token and
+            // no config. The session is just unscoped (default org) until they retry — `org switch`
+            // re-mints.
+            prompts.log.warn(`Signed in, but couldn't scope your session to ${activeOrg.name}. Run \`${cloudInvocation()} org switch\` to finish scoping.`);
+        }
+        writeAuthConfig({
+            accessToken,
+            refreshToken,
+            user: { id: token.user.id, email: token.user.email, name: userName },
+            activeOrganizationId: activeOrg.id,
+            organizations: orgs,
+        });
+    });
+    prompts.outro(`Logged in as ${token.user.email} (org: ${activeOrg.name})`);
+    return undefined;
+}
+// The browser step already asks a multi-organization user which organization to sign in to, and
+// reports it back as an external organization id. Honouring that answer stops the CLI asking the
+// same question again, and lets a login finish where there is no terminal to answer a prompt. The
+// picker is only reached when the browser sent no organization, or named one this account can no
+// longer see. Returns null when the user cancels the picker.
+async function resolveActiveOrganization(orgs, browserOrganizationId) {
+    const fromBrowser = browserOrganizationId
+        ? orgs.find((org) => org.workosOrgId === browserOrganizationId)
+        : undefined;
+    if (fromBrowser) {
+        return fromBrowser;
+    }
+    if (orgs.length === 1) {
+        return orgs[0];
+    }
+    if (!process.stdin.isTTY) {
+        throw new Error(`Could not tell which organization this session belongs to. Run \`${cloudInvocation()} login\` again in an interactive terminal and choose one.`);
+    }
+    const selected = await prompts.select({
+        message: "Select an organization:",
+        options: orgs.map((org) => ({ value: org, label: `${org.name} (${org.slug})` })),
+    });
+    return prompts.isCancel(selected) ? null : selected;
+}
+async function pollForToken(clientId, deviceCode, initialInterval, expiresIn) {
+    const deadline = Date.now() + expiresIn * 1000;
+    let pollInterval = initialInterval;
+    while (Date.now() < deadline) {
+        await sleep(pollInterval * 1000);
+        const response = await fetchWorkos(WORKOS_AUTHENTICATE_URL, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+                client_id: clientId,
+                device_code: deviceCode,
+                grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+            }),
+        }, WORKOS_AUTH_REQUEST_TIMEOUT_MS);
+        if (response.ok) {
+            return response.json();
+        }
+        const body = (await response.json().catch(() => ({})));
+        const error = typeof body.error === "string" ? body.error : undefined;
+        if (error === "authorization_pending") {
+            continue;
+        }
+        if (error === "slow_down") {
+            pollInterval += 1;
+            continue;
+        }
+        if (error === "expired_token") {
+            throw new Error("Device code expired. Please try again.");
+        }
+        throw new Error(`Authentication failed: ${error || response.statusText}`);
+    }
+    throw new Error("Device code expired. Please try again.");
+}
+async function fetchWorkos(url, init, timeoutMs) {
+    try {
+        return await fetch(url, {
+            ...init,
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+    }
+    catch (error) {
+        throw new Error("Could not reach the authentication service. Check your connection and try again.", { cause: error });
+    }
+}
+//# sourceMappingURL=login.js.map

package/dist/cli/commands/identity-context/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../../src/cli/commands/identity-context/login.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EACL,0BAA0B,EAE1B,uBAAuB,EACvB,8BAA8B,EAC9B,2BAA2B,EAC3B,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,SAAS,EACT,WAAW,EACX,cAAc,EACd,KAAK,EACL,eAAe,EACf,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAsBxB,mGAAmG;AACnG,kGAAkG;AAClG,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,KAAK;IACzB,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAErC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;YAC3C,YAAY,EAAE,KAAK;YACnB,OAAO,EAAE,wBAAwB,QAAQ,CAAC,IAAI,CAAC,KAAK,iCAAiC;SACtF,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACxD,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,YAAY,GAAG,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1D,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,YAAY,CAAC,GAAG,CAA6B,kBAAkB,CAAC,CAAC;IAElG,MAAM,cAAc,GAAG,MAAM,WAAW,CACtC,2BAA2B,EAC3B;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;KACzD,EACD,0BAA0B,CAC3B,CAAC;IACF,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,CAAuB,CAAC;IAEnE,OAAO,CAAC,IAAI,CACV,cAAc,MAAM,CAAC,SAAS,4CAA4C,MAAM,CAAC,yBAAyB,EAAE,EAC5G,8CAA8C,CAC/C,CAAC;IAEF,WAAW,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAE9C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAClC,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAE/C,IAAI,KAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,YAAY,CACxB,cAAc,EACd,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,UAAU,CAClB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACvC,MAAM,KAAK,CAAC;IACd,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAE/B,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IAEjG,MAAM,YAAY,GAAG,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAqB,qBAAqB,CAAC,CAAC;IAE/E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,IAAI,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IAC/E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,+FAA+F;QAC/F,mBAAmB;QACnB,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,iGAAiG;IACjG,+FAA+F;IAC/F,4FAA4F;IAC5F,EAAE;IACF,gGAAgG;IAChG,8FAA8F;IAC9F,WAAW;IACX,MAAM,eAAe,CAAC,KAAK,IAAI,EAAE;QAC/B,IAAI,WAAW,GAAG,KAAK,CAAC,YAAY,CAAC;QACrC,IAAI,YAAY,GAAG,KAAK,CAAC,aAAa,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,aAAa,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;YACpF,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;YAC/B,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,4FAA4F;YAC5F,2FAA2F;YAC3F,wFAAwF;YACxF,YAAY;YACZ,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,iDAAiD,SAAS,CAAC,IAAI,WAAW,eAAe,EAAE,kCAAkC,CAC9H,CAAC;QACJ,CAAC;QAED,eAAe,CAAC;YACd,WAAW;YACX,YAAY;YACZ,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE;YACpE,oBAAoB,EAAE,SAAS,CAAC,EAAE;YAClC,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,KAAK,CAAC,gBAAgB,KAAK,CAAC,IAAI,CAAC,KAAK,UAAU,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC;IAC3E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gGAAgG;AAChG,iGAAiG;AACjG,kGAAkG;AAClG,iGAAiG;AACjG,6DAA6D;AAC7D,KAAK,UAAU,yBAAyB,CACtC,IAAwB,EACxB,qBAAyC;IAEzC,MAAM,WAAW,GAAG,qBAAqB;QACvC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,qBAAqB,CAAC;QAC/D,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,oEAAoE,eAAe,EAAE,2DAA2D,CACjJ,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAmB;QACtD,OAAO,EAAE,yBAAyB;QAClC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;KACjF,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,QAAgB,EAChB,UAAkB,EAClB,eAAuB,EACvB,SAAiB;IAEjB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;IAC/C,IAAI,YAAY,GAAG,eAAe,CAAC;IAEnC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;QAEjC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAChC,uBAAuB,EACvB;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS,EAAE,QAAQ;gBACnB,WAAW,EAAE,UAAU;gBACvB,UAAU,EAAE,8CAA8C;aAC3D,CAAC;SACH,EACD,8BAA8B,CAC/B,CAAC;QAEF,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,QAAQ,CAAC,IAAI,EAAkC,CAAC;QACzD,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;QAClF,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAEtE,IAAI,KAAK,KAAK,uBAAuB,EAAE,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YAC1B,YAAY,IAAI,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,IAAiB,EAAE,SAAiB;IAC1E,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE;YACtB,GAAG,IAAI;YACP,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,kFAAkF,EAClF,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/cli/commands/identity-context/logout.d.ts

@@ -0,0 +1,2 @@
+export declare function logout(): Promise<void>;
+//# sourceMappingURL=logout.d.ts.map

package/dist/cli/commands/identity-context/logout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/identity-context/logout.ts"],"names":[],"mappings":"AAGA,wBAAsB,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAQ5C"}

package/dist/cli/commands/identity-context/logout.js

@@ -0,0 +1,12 @@
+import * as prompts from "@clack/prompts";
+import { clearAuthConfig, readAuthConfig } from "../../index.js";
+export async function logout() {
+    const existing = readAuthConfig();
+    if (!existing) {
+        prompts.log.info("Not currently logged in.");
+        return;
+    }
+    clearAuthConfig();
+    prompts.log.success("Logged out successfully.");
+}
+//# sourceMappingURL=logout.js.map

package/dist/cli/commands/identity-context/logout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../../../src/cli/commands/identity-context/logout.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEjE,MAAM,CAAC,KAAK,UAAU,MAAM;IAC1B,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC7C,OAAO;IACT,CAAC;IACD,eAAe,EAAE,CAAC;IAClB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAClD,CAAC"}

package/dist/cli/commands/identity-context/org-switch.d.ts

@@ -0,0 +1,3 @@
+import { type CloudCommandInput } from "../../index.js";
+export declare function switchOrganization({ globals, }: CloudCommandInput): Promise<number | undefined>;
+//# sourceMappingURL=org-switch.d.ts.map

package/dist/cli/commands/identity-context/org-switch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-switch.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/identity-context/org-switch.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,iBAAiB,EAMvB,MAAM,gBAAgB,CAAC;AAExB,wBAAsB,kBAAkB,CAAC,EACvC,OAAO,GACR,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA2EjD"}

package/dist/cli/commands/identity-context/org-switch.js

@@ -0,0 +1,71 @@
+import * as prompts from "@clack/prompts";
+import { cloudInvocation, createAuthenticatedClient, readAuthConfig, resolveCredential, rotateActiveOrganization, } from "../../index.js";
+export async function switchOrganization({ globals, }) {
+    // This command re-mints and rewrites the stored login, so it only ever operates on that
+    // credential. An API key is already scoped to a single organization and owns no session to
+    // rewrite — say so rather than acting on a credential the caller did not name.
+    if (resolveCredential(globals)?.kind === "apiKey") {
+        throw new Error(`\`${cloudInvocation()} org switch\` changes the organization of your stored login. An API key is scoped to one organization and cannot be switched.`);
+    }
+    const config = readAuthConfig();
+    if (!config) {
+        prompts.log.warn(`Not logged in. Run \`${cloudInvocation()} login\` to authenticate.`);
+        // The exit code is returned, not assigned to `process.exitCode`; see `defineCloudCommand`.
+        return 1;
+    }
+    // Re-fetch the membership list rather than trusting the stored copy: it gives us the up-to-date
+    // set (membership can change between logins) and, crucially, the `workosOrgId` needed to re-mint
+    // the token — older configs were persisted before that field existed. createAuthenticatedClient
+    // wires the 401-retry refresh so an expired stored token self-heals here.
+    const client = createAuthenticatedClient(globals);
+    const organizations = await client.get("/auth/organizations");
+    if (organizations.length <= 1) {
+        prompts.log.info("You only belong to one organization.");
+        return undefined;
+    }
+    const selected = await prompts.select({
+        message: "Select an organization:",
+        options: organizations.map((org) => ({
+            value: org.id,
+            label: `${org.name} (${org.slug})`,
+            hint: org.id === config.activeOrganizationId ? "current" : undefined,
+        })),
+    });
+    if (prompts.isCancel(selected)) {
+        prompts.log.info("Switch cancelled.");
+        return undefined;
+    }
+    const target = organizations.find((o) => o.id === selected);
+    if (!target) {
+        throw new Error("Selected organization not found.");
+    }
+    // Re-mint the access token scoped to the chosen org so its `org_id` + `permissions` claims
+    // match. Flipping `activeOrganizationId` alone would leave the JWT scoped to the previous org
+    // and 403 every permissioned call. rotateActiveOrganization does the exchange and the write as
+    // one locked unit so it cannot double-spend the refresh token against a concurrent command, or
+    // overwrite that command's rotation with a stale snapshot.
+    const spinner = prompts.spinner();
+    spinner.start(`Switching to ${target.name}...`);
+    try {
+        await rotateActiveOrganization({
+            organizationId: target.id,
+            workosOrgId: target.workosOrgId,
+            organizations,
+        });
+    }
+    catch (error) {
+        spinner.stop("Switch failed.");
+        // The config is never half-written: rotateActiveOrganization persists the new pair and the new
+        // active org in one atomic replace, or not at all, so a failed switch cannot strand the user
+        // between orgs.
+        //
+        // It can still end the session outright. If the re-mint comes back with the refresh token
+        // rejected, that token is dead no matter which command found out, and the stored credentials
+        // go with it — the user has to log in again. Every other failure leaves the existing session
+        // intact.
+        throw error;
+    }
+    spinner.stop(`Switched to ${target.name} (${target.slug}).`);
+    return undefined;
+}
+//# sourceMappingURL=org-switch.js.map

package/dist/cli/commands/identity-context/org-switch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-switch.js","sourceRoot":"","sources":["../../../../src/cli/commands/identity-context/org-switch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAGL,eAAe,EACf,yBAAyB,EACzB,cAAc,EACd,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AAExB,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,OAAO,GACW;IAClB,wFAAwF;IACxF,2FAA2F;IAC3F,+EAA+E;IAC/E,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,KAAK,eAAe,EAAE,+HAA+H,CACtJ,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,eAAe,EAAE,2BAA2B,CAAC,CAAC;QACvF,2FAA2F;QAC3F,OAAO,CAAC,CAAC;IACX,CAAC;IAED,gGAAgG;IAChG,iGAAiG;IACjG,gGAAgG;IAChG,0EAA0E;IAC1E,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,GAAG,CAAqB,qBAAqB,CAAC,CAAC;IAElF,IAAI,aAAa,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QACzD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;QACpC,OAAO,EAAE,yBAAyB;QAClC,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACnC,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,KAAK,EAAE,GAAG,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,GAAG;YAClC,IAAI,EAAE,GAAG,CAAC,EAAE,KAAK,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;SACrE,CAAC,CAAC;KACJ,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACtC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,2FAA2F;IAC3F,8FAA8F;IAC9F,+FAA+F;IAC/F,+FAA+F;IAC/F,2DAA2D;IAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAClC,OAAO,CAAC,KAAK,CAAC,gBAAgB,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,wBAAwB,CAAC;YAC7B,cAAc,EAAE,MAAM,CAAC,EAAE;YACzB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC/B,+FAA+F;QAC/F,6FAA6F;QAC7F,gBAAgB;QAChB,EAAE;QACF,0FAA0F;QAC1F,6FAA6F;QAC7F,6FAA6F;QAC7F,UAAU;QACV,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;IAC7D,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/cli/commands/identity-context/use.d.ts

@@ -0,0 +1,3 @@
+import { type CloudCommandInput } from "../../index.js";
+export declare function useEnvironment({ args, globals }: CloudCommandInput): Promise<void>;
+//# sourceMappingURL=use.d.ts.map

package/dist/cli/commands/identity-context/use.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/identity-context/use.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,KAAK,iBAAiB,EAUvB,MAAM,gBAAgB,CAAC;AAExB,wBAAsB,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBxF"}

package/dist/cli/commands/identity-context/use.js

@@ -0,0 +1,23 @@
+import * as prompts from "@clack/prompts";
+import { requiredArgument } from "../../arguments.js";
+import { createAuthenticatedClient, findEnvironmentOrNull, getAuthenticatedOrganizationSlug, listEnvironments, readContext, resolveProject, setActiveEnvironment, writeContext, writeJson, } from "../../index.js";
+export async function useEnvironment({ args, globals }) {
+    const environment = requiredArgument(args, 0, "environment");
+    const project = await resolveProject(globals);
+    const client = createAuthenticatedClient(globals);
+    const environments = await listEnvironments(client, project.id);
+    const match = findEnvironmentOrNull(environments, environment);
+    if (!match) {
+        throw new Error(`Environment "${environment}" not found in project "${project.slug}". Available: ${environments.map((e) => e.slug).join(", ") || "none"}`);
+    }
+    // Not fetched under `--json`: the organization slug only words the terminal line, and asking for
+    // it would put a second request behind a machine-readable command.
+    const organization = globals.json ? "" : await getAuthenticatedOrganizationSlug(client);
+    writeContext(setActiveEnvironment(readContext(), project, match.slug));
+    if (globals.json === true) {
+        writeJson({ project: { id: project.id, slug: project.slug }, environment: match });
+        return;
+    }
+    prompts.log.info(`Active environment set to ${organization}/${project.slug}/${match.slug}`);
+}
+//# sourceMappingURL=use.js.map

package/dist/cli/commands/identity-context/use.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"use.js","sourceRoot":"","sources":["../../../../src/cli/commands/identity-context/use.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAEL,yBAAyB,EACzB,qBAAqB,EACrB,gCAAgC,EAChC,gBAAgB,EAChB,WAAW,EACX,cAAc,EACd,oBAAoB,EACpB,YAAY,EACZ,SAAS,GACV,MAAM,gBAAgB,CAAC;AAExB,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,EAAqB;IACvE,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAElD,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,qBAAqB,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IAE/D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,gBAAgB,WAAW,2BAA2B,OAAO,CAAC,IAAI,iBAAiB,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAC1I,CAAC;IACJ,CAAC;IAED,iGAAiG;IACjG,mEAAmE;IACnE,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,gCAAgC,CAAC,MAAM,CAAC,CAAC;IACxF,YAAY,CAAC,oBAAoB,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC1B,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACnF,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,YAAY,IAAI,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AAC9F,CAAC"}

package/dist/cli/commands/identity-context/whoami.d.ts

@@ -0,0 +1,3 @@
+import { type CloudCommandInput } from "../../index.js";
+export declare function whoami({ globals }: CloudCommandInput): Promise<number | undefined>;
+//# sourceMappingURL=whoami.d.ts.map

package/dist/cli/commands/identity-context/whoami.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"whoami.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/identity-context/whoami.ts"],"names":[],"mappings":"AACA,OAAO,EAIL,KAAK,iBAAiB,EAOvB,MAAM,gBAAgB,CAAC;AASxB,wBAAsB,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAkBxF"}

package/dist/cli/commands/identity-context/whoami.js

@@ -0,0 +1,80 @@
+import * as prompts from "@clack/prompts";
+import { cloudInvocation, createApiClient, getApiUrl, readAuthConfig, refreshAccessToken, resolveCredential, } from "../../index.js";
+export async function whoami({ globals }) {
+    const credential = resolveCredential(globals);
+    if (!credential) {
+        prompts.log.warn(`Not logged in. Run \`${cloudInvocation()} login\` to authenticate.`);
+        // The exit code is returned, not assigned to `process.exitCode`; see `defineCloudCommand`.
+        return 1;
+    }
+    // `/auth/me` echoes the credential's own resolved identity, so it reports what the credential is
+    // rather than what local config claims.
+    const me = await createWhoamiClient(credential).get("/auth/me");
+    if (credential.kind === "apiKey") {
+        reportApiKey(me);
+        return undefined;
+    }
+    reportSession(me, readAuthConfig());
+    return undefined;
+}
+// Not `createAuthenticatedClient`: whoami is the command you run to find out why the others are
+// refusing, so a session with no active organization has to reach `/auth/me` rather than be turned
+// away locally.
+function createWhoamiClient(credential) {
+    if (credential.kind === "apiKey") {
+        return createApiClient({ baseUrl: getApiUrl(), apiKey: credential.token });
+    }
+    return createApiClient({
+        baseUrl: getApiUrl(),
+        token: credential.token,
+        organizationId: credential.organizationId ?? undefined,
+        // Only a token that came from the stored session has a refresh token behind it, and this is
+        // that token.
+        onUnauthorized: (failedToken) => refreshAccessToken(failedToken),
+    });
+}
+// An API key authenticates an organization, not a person, so there is no user to report and no
+// local session to compare against.
+function reportApiKey(me) {
+    prompts.log.info("Auth:  API key");
+    if (me.dbOrganization?.slug) {
+        prompts.log.info(`Org:   ${me.dbOrganization.slug}`);
+    }
+    else {
+        prompts.log.warn("This API key does not resolve to an organization.");
+    }
+}
+function reportSession(me, authConfig) {
+    const email = me.dbUser?.email ?? "Unknown";
+    prompts.log.info(`Email: ${email}`);
+    if (authConfig?.user.name) {
+        prompts.log.info(`Name:  ${authConfig.user.name}`);
+    }
+    // The org the token is actually scoped to, taken from the token's own `org_id` claim. We do NOT
+    // report the org recorded in local config: config can drift from the token, and reporting config
+    // state would hide that drift. That masking is exactly what made the CLO-124 split-state bug so
+    // hard to diagnose. Map the WorkOS org_id to a friendly name via the stored membership list;
+    // fall back to the raw id if it isn't in the list (e.g. a token scoped to an org added since
+    // last login).
+    if (me.org_id) {
+        const tokenOrg = authConfig?.organizations.find((o) => o.workosOrgId === me.org_id);
+        prompts.log.info(`Org:   ${tokenOrg ? `${tokenOrg.name} (${me.org_id})` : me.org_id}`);
+        if (me.role) {
+            prompts.log.info(`Role:  ${me.role}`);
+        }
+    }
+    else {
+        // The token carries no org scope — e.g. a device-flow token whose org-scoped re-mint failed
+        // during login (see CLO-124 fallback). Say so explicitly rather than printing Email/Name and
+        // falling silent.
+        prompts.log.warn(`Your session has no organization scope. Run \`${cloudInvocation()} org switch\` to scope it.`);
+    }
+    // Surface a drift between the token's org and the CLI's "active" org rather than silently
+    // trusting config. Post-CLO-124 this shouldn't happen via login/org switch, but a stale token or
+    // hand-edited config still could.
+    const activeOrg = authConfig?.organizations.find((o) => o.id === authConfig.activeOrganizationId);
+    if (activeOrg && me.org_id && activeOrg.workosOrgId !== me.org_id) {
+        prompts.log.warn(`Your token is scoped to a different organization than your active org (${activeOrg.name}). Run \`${cloudInvocation()} org switch\` to re-scope.`);
+    }
+}
+//# sourceMappingURL=whoami.js.map

package/dist/cli/commands/identity-context/whoami.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"whoami.js","sourceRoot":"","sources":["../../../../src/cli/commands/identity-context/whoami.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAKL,eAAe,EACf,eAAe,EACf,SAAS,EACT,cAAc,EACd,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AASxB,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,EAAE,OAAO,EAAqB;IACzD,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,eAAe,EAAE,2BAA2B,CAAC,CAAC;QACvF,2FAA2F;QAC3F,OAAO,CAAC,CAAC;IACX,CAAC;IAED,iGAAiG;IACjG,wCAAwC;IACxC,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,CAAC,GAAG,CAAiB,UAAU,CAAC,CAAC;IAEhF,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACjC,YAAY,CAAC,EAAE,CAAC,CAAC;QACjB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,aAAa,CAAC,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;IACpC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gGAAgG;AAChG,mGAAmG;AACnG,gBAAgB;AAChB,SAAS,kBAAkB,CAAC,UAAyB;IACnD,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,eAAe,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,eAAe,CAAC;QACrB,OAAO,EAAE,SAAS,EAAE;QACpB,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,cAAc,EAAE,UAAU,CAAC,cAAc,IAAI,SAAS;QACtD,4FAA4F;QAC5F,cAAc;QACd,cAAc,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,kBAAkB,CAAC,WAAW,CAAC;KACjE,CAAC,CAAC;AACL,CAAC;AAED,+FAA+F;AAC/F,oCAAoC;AACpC,SAAS,YAAY,CAAC,EAAkB;IACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACnC,IAAI,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,EAAkB,EAAE,UAA6B;IACtE,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,EAAE,KAAK,IAAI,SAAS,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;IACpC,IAAI,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,gGAAgG;IAChG,iGAAiG;IACjG,gGAAgG;IAChG,6FAA6F;IAC7F,6FAA6F;IAC7F,eAAe;IACf,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;QACd,MAAM,QAAQ,GAAG,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC;QACpF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QACvF,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,4FAA4F;QAC5F,6FAA6F;QAC7F,kBAAkB;QAClB,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,iDAAiD,eAAe,EAAE,4BAA4B,CAC/F,CAAC;IACJ,CAAC;IAED,0FAA0F;IAC1F,iGAAiG;IACjG,kCAAkC;IAClC,MAAM,SAAS,GAAG,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAClG,IAAI,SAAS,IAAI,EAAE,CAAC,MAAM,IAAI,SAAS,CAAC,WAAW,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,0EAA0E,SAAS,CAAC,IAAI,YAAY,eAAe,EAAE,4BAA4B,CAClJ,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/cli/commands/index.d.ts

@@ -0,0 +1,4 @@
+import type { CloudCommandNode } from "../command.js";
+export declare const HELP_ORDER: string[];
+export declare const CLOUD_COMMANDS: CloudCommandNode[];
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/commands/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAuBtD,eAAO,MAAM,UAAU,UA6BtB,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,gBAAgB,EAK3C,CAAC"}

package/dist/cli/commands/index.js

@@ -0,0 +1,67 @@
+import { deploymentCommands } from "./deployment/index.js";
+import { identityContextCommands } from "./identity-context/index.js";
+import { PROJECT_CONFIG_COMMANDS } from "./project-config/index.js";
+import { runtimeDataCommands } from "./runtime-data/index.js";
+// Every hosted Cloud command, as one inventory.
+//
+// Both entry points read this. Neither holds a list of its own, so a command cannot exist under one
+// name and not the other.
+//
+// Declaration only: nothing here reaches an implementation or `./lib/**`, and every command's `run`
+// goes through `await import(...)`. The host `require`s this graph on every `vendure` invocation,
+// including the ones with nothing to do with Cloud.
+// `test/cli-published-surface.test.ts` walks it from `src/cli-plugin.ts` and holds that line.
+// The order `vcloud --help` listed the commands in. Its group headings are kept below as comments:
+// the host has no equivalent of Commander's help groups, so under `vendure` the order is all that
+// survives of them, and the compatibility executable prints the headings itself.
+//
+// Each family already declares its own commands in this order. This list interleaves the families,
+// because `vcloud` did not list them family by family — `init` opened the help and the account
+// commands closed it.
+export const HELP_ORDER = [
+    // Setup and context
+    "init",
+    "login",
+    "context",
+    "use",
+    // Projects and configuration
+    "project",
+    "environment",
+    "config",
+    "env",
+    "source",
+    // Deployments
+    "deploy",
+    "status",
+    "logs",
+    "deployment",
+    "rollback",
+    // Resources and data
+    "resource",
+    "backup",
+    "restore",
+    "tunnel",
+    "seed",
+    // Account and organization
+    "org",
+    "key",
+    "whoami",
+    "logout",
+];
+export const CLOUD_COMMANDS = inHelpOrder([
+    ...PROJECT_CONFIG_COMMANDS,
+    ...identityContextCommands,
+    ...deploymentCommands,
+    ...runtimeDataCommands,
+]);
+// A command `HELP_ORDER` does not name lands at the end rather than being dropped. A command
+// missing from the CLI is a worse failure than one listed out of place, and where it belongs is a
+// decision for whoever added it. `test/cli-plugin.test.ts` reports the omission.
+function inHelpOrder(nodes) {
+    const rank = (node) => {
+        const index = HELP_ORDER.indexOf(node.name);
+        return index === -1 ? HELP_ORDER.length : index;
+    };
+    return [...nodes].sort((first, second) => rank(first) - rank(second));
+}
+//# sourceMappingURL=index.js.map

package/dist/cli/commands/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/commands/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,gDAAgD;AAChD,EAAE;AACF,oGAAoG;AACpG,0BAA0B;AAC1B,EAAE;AACF,oGAAoG;AACpG,kGAAkG;AAClG,oDAAoD;AACpD,8FAA8F;AAE9F,mGAAmG;AACnG,kGAAkG;AAClG,iFAAiF;AACjF,EAAE;AACF,mGAAmG;AACnG,+FAA+F;AAC/F,sBAAsB;AACtB,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,oBAAoB;IACpB,MAAM;IACN,OAAO;IACP,SAAS;IACT,KAAK;IACL,6BAA6B;IAC7B,SAAS;IACT,aAAa;IACb,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,cAAc;IACd,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,YAAY;IACZ,UAAU;IACV,qBAAqB;IACrB,UAAU;IACV,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,MAAM;IACN,2BAA2B;IAC3B,KAAK;IACL,KAAK;IACL,QAAQ;IACR,QAAQ;CACT,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAuB,WAAW,CAAC;IAC5D,GAAG,uBAAuB;IAC1B,GAAG,uBAAuB;IAC1B,GAAG,kBAAkB;IACrB,GAAG,mBAAmB;CACvB,CAAC,CAAC;AAEH,6FAA6F;AAC7F,kGAAkG;AAClG,iFAAiF;AACjF,SAAS,WAAW,CAAC,KAAkC;IACrD,MAAM,IAAI,GAAG,CAAC,IAAsB,EAAU,EAAE;QAC9C,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IAClD,CAAC,CAAC;IACF,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AACxE,CAAC"}

package/dist/cli/commands/project-config/config/build-fields.d.ts

@@ -0,0 +1,4 @@
+export declare const BUILD_FIELDS: readonly ["nodeVersion", "packageManager", "buildCommand", "appDir", "systemPackages"];
+export type BuildField = (typeof BUILD_FIELDS)[number];
+export declare function isBuildField(value: string): value is BuildField;
+//# sourceMappingURL=build-fields.d.ts.map

package/dist/cli/commands/project-config/config/build-fields.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-fields.d.ts","sourceRoot":"","sources":["../../../../../src/cli/commands/project-config/config/build-fields.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,YAAY,wFAMf,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,UAAU,CAE/D"}

package/dist/cli/commands/project-config/config/build-fields.js

@@ -0,0 +1,16 @@
+// The Source Build Settings overrides `config build clear` accepts.
+//
+// Its own module, and importing nothing, so both the command that validates against it and the
+// module that declares the command tree can read it. The declaration module may not reach anything
+// heavier — see `env/index.ts`.
+export const BUILD_FIELDS = [
+    "nodeVersion",
+    "packageManager",
+    "buildCommand",
+    "appDir",
+    "systemPackages",
+];
+export function isBuildField(value) {
+    return BUILD_FIELDS.some((field) => field === value);
+}
+//# sourceMappingURL=build-fields.js.map

package/dist/cli/commands/project-config/config/build-fields.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-fields.js","sourceRoot":"","sources":["../../../../../src/cli/commands/project-config/config/build-fields.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,+FAA+F;AAC/F,mGAAmG;AACnG,gCAAgC;AAChC,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,aAAa;IACb,gBAAgB;IAChB,cAAc;IACd,QAAQ;IACR,gBAAgB;CACR,CAAC;AAIX,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AACvD,CAAC"}

package/dist/cli/commands/project-config/config/build.d.ts

@@ -0,0 +1,4 @@
+import { type GlobalOptions } from "../../../index.js";
+export declare function buildSetAction(options: GlobalOptions, commandOptions: Record<string, unknown>): Promise<void>;
+export declare function buildClearAction(field: string, options: GlobalOptions): Promise<void>;
+//# sourceMappingURL=build.d.ts.map

package/dist/cli/commands/project-config/config/build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../../../src/cli/commands/project-config/config/build.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,aAAa,EAOnB,MAAM,mBAAmB,CAAC;AAI3B,wBAAsB,cAAc,CAClC,OAAO,EAAE,aAAa,EACtB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACtC,OAAO,CAAC,IAAI,CAAC,CAWf;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAO3F"}

package/dist/cli/commands/project-config/config/build.js

@@ -0,0 +1,46 @@
+import * as prompts from "@clack/prompts";
+import { createAuthenticatedClient, getAuthenticatedOrganizationSlug, resolveEnvironment, sourceBuildSettingsSchema, writeJson, } from "../../../index.js";
+import { assertNotEmpty, definedEntries, readInteger, readList, readString } from "../options.js";
+import { BUILD_FIELDS, isBuildField } from "./build-fields.js";
+export async function buildSetAction(options, commandOptions) {
+    await updateBuildSettings(options, definedEntries({
+        nodeVersion: readInteger(commandOptions.nodeVersion, "--node-version"),
+        packageManager: readString(commandOptions.packageManager),
+        buildCommand: readString(commandOptions.buildCommand),
+        appDir: readString(commandOptions.appDir),
+        systemPackages: readList(commandOptions.systemPackages),
+    }));
+}
+export async function buildClearAction(field, options) {
+    if (!isBuildField(field)) {
+        throw new Error(`Unknown build override "${field}". Valid: ${BUILD_FIELDS.join(", ")}.`);
+    }
+    // `null` is how one override is cleared back to automatic detection. It is dropped from the
+    // document before validation and sent as-is, which is what the control plane reads as a clear.
+    await updateBuildSettings(options, { [field]: null });
+}
+async function updateBuildSettings(options, patch) {
+    assertNotEmpty(patch, "Specify at least one build override.");
+    const { project, environment } = await resolveEnvironment(options);
+    const client = createAuthenticatedClient(options);
+    const current = await client.get(`/environments/${environment.id}/source-build-settings`);
+    const next = { ...current.settings, ...patch };
+    for (const [key, value] of Object.entries(next)) {
+        if (value === null)
+            delete next[key];
+    }
+    // Validated but not sent: the PATCH carries the sparse patch, and the control plane applies the
+    // schema's own transforms (the `appDir` trailing-slash strip, the `systemPackages` dedupe and
+    // sort). What this buys is the refusal happening before the round trip, with the schema's message.
+    sourceBuildSettingsSchema.parse(next);
+    const json = options.json === true;
+    const organization = json ? "" : await getAuthenticatedOrganizationSlug(client);
+    const updated = await client.patch(`/environments/${environment.id}/source-build-settings`, { expectedVersion: current.version, ...patch });
+    if (json) {
+        writeJson(updated);
+        return;
+    }
+    prompts.log.success(`Source Build Settings for ${organization}/${project.slug}/${environment.slug} updated to version ${updated.version}.`);
+    prompts.log.info("This change applies on the next source build.");
+}
+//# sourceMappingURL=build.js.map

package/dist/cli/commands/project-config/config/build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../../../../../src/cli/commands/project-config/config/build.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAGL,yBAAyB,EACzB,gCAAgC,EAChC,kBAAkB,EAClB,yBAAyB,EACzB,SAAS,GACV,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAClG,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE/D,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAsB,EACtB,cAAuC;IAEvC,MAAM,mBAAmB,CACvB,OAAO,EACP,cAAc,CAAC;QACb,WAAW,EAAE,WAAW,CAAC,cAAc,CAAC,WAAW,EAAE,gBAAgB,CAAC;QACtE,cAAc,EAAE,UAAU,CAAC,cAAc,CAAC,cAAc,CAAC;QACzD,YAAY,EAAE,UAAU,CAAC,cAAc,CAAC,YAAY,CAAC;QACrD,MAAM,EAAE,UAAU,CAAC,cAAc,CAAC,MAAM,CAAC;QACzC,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC,cAAc,CAAC;KACxD,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa,EAAE,OAAsB;IAC1E,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,aAAa,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,4FAA4F;IAC5F,+FAA+F;IAC/F,MAAM,mBAAmB,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAsB,EACtB,KAA8B;IAE9B,cAAc,CAAC,KAAK,EAAE,sCAAsC,CAAC,CAAC;IAC9D,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAC9B,iBAAiB,WAAW,CAAC,EAAE,wBAAwB,CACxD,CAAC;IACF,MAAM,IAAI,GAA4B,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC;IACxE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IACD,gGAAgG;IAChG,8FAA8F;IAC9F,mGAAmG;IACnG,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC;IACnC,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,gCAAgC,CAAC,MAAM,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC,iBAAiB,WAAW,CAAC,EAAE,wBAAwB,EACvD,EAAE,eAAe,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,KAAK,EAAE,CAC/C,CAAC;IACF,IAAI,IAAI,EAAE,CAAC;QACT,SAAS,CAAC,OAAO,CAAC,CAAC;QACnB,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,OAAO,CACjB,6BAA6B,YAAY,IAAI,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC,IAAI,uBAAuB,OAAO,CAAC,OAAO,GAAG,CACvH,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;AACpE,CAAC"}

package/dist/cli/commands/project-config/config/desired-state.d.ts

@@ -0,0 +1,4 @@
+import { type EnvironmentDesiredState, type GlobalOptions } from "../../../index.js";
+export type DesiredStateSection = "environment" | "server" | "worker" | "search";
+export declare function updateDesiredState(options: GlobalOptions, section: DesiredStateSection, createState: (state: EnvironmentDesiredState) => EnvironmentDesiredState): Promise<void>;
+//# sourceMappingURL=desired-state.d.ts.map

package/dist/cli/commands/project-config/config/desired-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"desired-state.d.ts","sourceRoot":"","sources":["../../../../../src/cli/commands/project-config/config/desired-state.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAMnB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAYjF,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,mBAAmB,EAC5B,WAAW,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,uBAAuB,GACvE,OAAO,CAAC,IAAI,CAAC,CAsBf"}