@vendure/cloud 0.3.2 → 0.5.0-dev.20261014172655.g652e750

package/dist/cli/lib/api-client.js

@@ -1,21 +1,16 @@
-import { ApiError, toSessionRefreshError } from "./errors.js";
+import { ApiError } from "./errors.js";
 import { logger } from "./logger.js";
+// No organization header is sent: the organization comes from the login's token or the API key, and
+// a header could contradict it.
 export function createApiClient(options) {
-    const { baseUrl, token, apiKey, organizationId, onUnauthorized } = options;
-    let currentToken = token;
+    const { baseUrl, credential } = options;
+    let currentToken = credential.kind === "userLogin" ? credential.accessToken : undefined;
     let refreshPromise;
     function buildHeaders(bearerToken) {
-        const headers = {};
-        if (apiKey) {
-            headers["x-api-key"] = apiKey;
+        if (credential.kind === "apiKey") {
+            return { "x-api-key": credential.key };
         }
-        else if (bearerToken) {
-            headers.authorization = `Bearer ${bearerToken}`;
-        }
-        if (organizationId) {
-            headers["x-organization-id"] = organizationId;
-        }
-        return headers;
+        return bearerToken ? { authorization: `Bearer ${bearerToken}` } : {};
     }
     async function doFetch(method, path, bearerToken, body, signal) {
         const headers = buildHeaders(bearerToken);
@@ -29,40 +24,25 @@ export function createApiClient(options) {
             signal,
         });
     }
-    // The first of two dedup layers, and the only one this file can see. It collapses the concurrent
-    // 401s of one client into a single `refresh` call, keyed on the token that failed.
-    //
-    // `refresh` is `refreshAccessToken` in `auth.ts`, which dedups again on its own terms: a
-    // process-wide `activeRefresh` and, under that, a `refresh.lock` file that serializes the WorkOS
-    // exchange across processes. The two are not redundant — this one knows which request already
-    // retried, that one knows whether an exchange is in flight anywhere on the machine — but neither
-    // is enough alone, and the single-use refresh token that CLO-164 stranded is what both exist for.
+    // Collapses one client's concurrent 401s into one renewal, keyed on the failed token. Core dedups
+    // again in-process and locks across processes, because the refresh token is single-use.
     async function getRetryToken(failedToken, refresh) {
-        if (currentToken !== failedToken) {
-            // Another request already refreshed; retry this stale 401 with the current token.
+        if (currentToken !== undefined && currentToken !== failedToken) {
+            // Another request already renewed; retry this stale 401 with the current token.
             return currentToken;
         }
         if (!refreshPromise) {
-            refreshPromise = (async () => {
-                try {
-                    const refreshedToken = await refresh(failedToken);
-                    currentToken = refreshedToken;
-                    return refreshedToken;
-                }
-                catch (error) {
-                    // Keep the classified session errors intact — whether the failure
-                    // was definitive decides the message and whether credentials were
-                    // discarded. Anything unclassified keeps its cause for the logs.
-                    throw toSessionRefreshError(error);
-                }
-            })();
+            refreshPromise = refresh(failedToken).then((refreshedToken) => {
+                currentToken = refreshedToken;
+                return refreshedToken;
+            });
         }
         const activeRefresh = refreshPromise;
         try {
             return await activeRefresh;
         }
         finally {
-            // Let a later token expiry start a new refresh instead of reusing this settled result.
+            // Let a later expiry start a new renewal instead of reusing this settled result.
             if (refreshPromise === activeRefresh) {
                 refreshPromise = undefined;
             }
@@ -71,10 +51,11 @@ export function createApiClient(options) {
     async function doAuthenticatedFetch(method, path, body, signal) {
         const requestToken = currentToken;
         const response = await doFetch(method, path, requestToken, body, signal);
-        if (response.status !== 401 || !onUnauthorized) {
+        if (response.status !== 401 || credential.kind !== "userLogin" || requestToken === undefined) {
             return response;
         }
-        const retryToken = await getRetryToken(requestToken, onUnauthorized);
+        // One retry: a second 401 is about the credential, not its age.
+        const retryToken = await getRetryToken(requestToken, credential.refresh);
         return doFetch(method, path, retryToken, body, signal);
     }
     async function request(method, path, body) {
@@ -83,7 +64,7 @@ export function createApiClient(options) {
         if (!response.ok) {
             const responseBody = await response.json().catch(() => null);
             logger.error({ method, path, status: response.status, responseBody }, "API error");
-            throw new ApiError(response.status, responseBody);
+            throw new ApiError(response.status, responseBody, credential.kind);
         }
         logger.debug({ method, path, status: response.status }, "API response");
         return response.json();
@@ -94,12 +75,12 @@ export function createApiClient(options) {
         if (!response.ok) {
             const responseBody = await response.text().catch(() => null);
             logger.error({ method: "GET", path, status: response.status, responseBody }, "API stream error");
-            throw new ApiError(response.status, responseBody);
+            throw new ApiError(response.status, responseBody, credential.kind);
         }
         return response;
     }
     return {
-        organizationId,
+        credentialKind: credential.kind,
         get: (path) => request("GET", path),
         post: (path, body) => request("POST", path, body),
         put: (path, body) => request("PUT", path, body),

package/dist/cli/lib/api-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../../../src/cli/lib/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAyBrC,MAAM,UAAU,eAAe,CAAC,OAAyB;IACvD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAC3E,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,cAA2C,CAAC;IAEhD,SAAS,YAAY,CAAC,WAAoB;QACxC,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,WAAW,CAAC,GAAG,MAAM,CAAC;QAChC,CAAC;aAAM,IAAI,WAAW,EAAE,CAAC;YACvB,OAAO,CAAC,aAAa,GAAG,UAAU,WAAW,EAAE,CAAC;QAClD,CAAC;QACD,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,CAAC,mBAAmB,CAAC,GAAG,cAAc,CAAC;QAChD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,OAAO,CACpB,MAAc,EACd,IAAY,EACZ,WAAoB,EACpB,IAAc,EACd,MAAoB;QAEpB,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC/C,CAAC;QACD,OAAO,KAAK,CAAC,GAAG,OAAO,GAAG,IAAI,EAAE,EAAE;YAChC,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YAC7C,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,iGAAiG;IACjG,mFAAmF;IACnF,EAAE;IACF,yFAAyF;IACzF,iGAAiG;IACjG,8FAA8F;IAC9F,iGAAiG;IACjG,kGAAkG;IAClG,KAAK,UAAU,aAAa,CAC1B,WAA+B,EAC/B,OAA6D;QAE7D,IAAI,YAAY,KAAK,WAAW,EAAE,CAAC;YACjC,kFAAkF;YAClF,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,cAAc,GAAG,CAAC,KAAK,IAAI,EAAE;gBAC3B,IAAI,CAAC;oBACH,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;oBAClD,YAAY,GAAG,cAAc,CAAC;oBAC9B,OAAO,cAAc,CAAC;gBACxB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,kEAAkE;oBAClE,kEAAkE;oBAClE,iEAAiE;oBACjE,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QAED,MAAM,aAAa,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,aAAa,CAAC;QAC7B,CAAC;gBAAS,CAAC;YACT,uFAAuF;YACvF,IAAI,cAAc,KAAK,aAAa,EAAE,CAAC;gBACrC,cAAc,GAAG,SAAS,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,UAAU,oBAAoB,CACjC,MAAc,EACd,IAAY,EACZ,IAAc,EACd,MAAoB;QAEpB,MAAM,YAAY,GAAG,YAAY,CAAC;QAClC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACzE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YAC/C,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QACrE,OAAO,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,UAAU,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACpE,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,aAAa,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAEhE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC7D,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,WAAW,CAAC,CAAC;YACnF,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC;QACxE,OAAO,QAAQ,CAAC,IAAI,EAAgB,CAAC;IACvC,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,IAAY,EAAE,MAAoB;QACtD,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,oBAAoB,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAE5E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC7D,MAAM,CAAC,KAAK,CACV,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,EAC9D,kBAAkB,CACnB,CAAC;YACF,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO;QACL,cAAc;QACd,GAAG,EAAE,CAAI,IAAY,EAAE,EAAE,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,CAAC;QACjD,IAAI,EAAE,CAAI,IAAY,EAAE,IAAc,EAAE,EAAE,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;QACzE,GAAG,EAAE,CAAI,IAAY,EAAE,IAAc,EAAE,EAAE,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;QACvE,KAAK,EAAE,CAAI,IAAY,EAAE,IAAc,EAAE,EAAE,CAAC,OAAO,CAAI,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;QAC3E,MAAM,EAAE,CAAI,IAAY,EAAE,EAAE,CAAC,OAAO,CAAI,QAAQ,EAAE,IAAI,CAAC;QACvD,MAAM;KACP,CAAC;AACJ,CAAC"}
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../../../src/cli/lib/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA6BrC,oGAAoG;AACpG,gCAAgC;AAChC,MAAM,UAAU,eAAe,CAAC,OAAyB;IACvD,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IACxC,IAAI,YAAY,GAAG,UAAU,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,IAAI,cAA2C,CAAC;IAEhD,SAAS,YAAY,CAAC,WAA+B;QACnD,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC;QACzC,CAAC;QACD,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,CAAC;IAED,KAAK,UAAU,OAAO,CACpB,MAAc,EACd,IAAY,EACZ,WAA+B,EAC/B,IAAc,EACd,MAAoB;QAEpB,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC/C,CAAC;QACD,OAAO,KAAK,CAAC,GAAG,OAAO,GAAG,IAAI,EAAE,EAAE;YAChC,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YAC7C,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,kGAAkG;IAClG,wFAAwF;IACxF,KAAK,UAAU,aAAa,CAC1B,WAAmB,EACnB,OAAiD;QAEjD,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,WAAW,EAAE,CAAC;YAC/D,gFAAgF;YAChF,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,EAAE;gBAC5D,YAAY,GAAG,cAAc,CAAC;gBAC9B,OAAO,cAAc,CAAC;YACxB,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,aAAa,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,aAAa,CAAC;QAC7B,CAAC;gBAAS,CAAC;YACT,iFAAiF;YACjF,IAAI,cAAc,KAAK,aAAa,EAAE,CAAC;gBACrC,cAAc,GAAG,SAAS,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,UAAU,oBAAoB,CACjC,MAAc,EACd,IAAY,EACZ,IAAc,EACd,MAAoB;QAEpB,MAAM,YAAY,GAAG,YAAY,CAAC;QAClC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACzE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC7F,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,gEAAgE;QAChE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;QACzE,OAAO,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,UAAU,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACpE,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,aAAa,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAEhE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC7D,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,WAAW,CAAC,CAAC;YACnF,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC;QACxE,OAAO,QAAQ,CAAC,IAAI,EAAgB,CAAC;IACvC,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,IAAY,EAAE,MAAoB;QACtD,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,oBAAoB,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAE5E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC7D,MAAM,CAAC,KAAK,CACV,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,EAC9D,kBAAkB,CACnB,CAAC;YACF,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QACrE,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO;QACL,cAAc,EAAE,UAAU,CAAC,IAAI;QAC/B,GAAG,EAAE,CAAI,IAAY,EAAE,EAAE,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,CAAC;QACjD,IAAI,EAAE,CAAI,IAAY,EAAE,IAAc,EAAE,EAAE,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;QACzE,GAAG,EAAE,CAAI,IAAY,EAAE,IAAc,EAAE,EAAE,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;QACvE,KAAK,EAAE,CAAI,IAAY,EAAE,IAAc,EAAE,EAAE,CAAC,OAAO,CAAI,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;QAC3E,MAAM,EAAE,CAAI,IAAY,EAAE,EAAE,CAAC,OAAO,CAAI,QAAQ,EAAE,IAAI,CAAC;QACvD,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/cli/lib/auth.d.ts

@@ -1,132 +1,10 @@
 import type { CredentialOptions } from "../root-options.js";
-import { type FileLockOptions } from "./file-lock.js";
-export interface AuthOrganization {
-    id: string;
-    workosOrgId: string;
-    name: string;
-    slug: string;
-    role: string;
-}
-export interface AuthConfig {
-    accessToken: string;
-    refreshToken: string;
-    user: {
-        id: string;
-        email: string;
-        name: string | null;
-    };
-    activeOrganizationId: string | null;
-    organizations: AuthOrganization[];
-}
-export interface TokenPair {
-    accessToken: string;
-    refreshToken: string;
-}
-export declare const API_AUTH_CONFIG_TIMEOUT_MS = 15000;
-export declare const WORKOS_AUTH_REQUEST_TIMEOUT_MS = 60000;
-/**
- * The credential a single CLI invocation runs under.
- *
- * `apiKey` covers both `--token` and `VENDURE_CLOUD_TOKEN`: the control plane
- * validates those as WorkOS API keys, resolves the organization they belong to
- * itself, and never issues a refresh token for them. `session` is the stored
- * browser login, which does have a refresh token and does carry an active
- * organization the CLI selected locally.
- */
 export type CliCredential = {
     kind: "apiKey";
-    token: string;
+    key: string;
 } | {
-    kind: "session";
-    token: string;
-    organizationId: string | null;
+    kind: "userLogin";
+    accessToken: string;
 };
-/**
- * Precedence: the explicit `--token`, then `VENDURE_CLOUD_TOKEN`, then the
- * stored session. Returns null when the machine has no credential at all, so
- * each caller can word its own "not logged in" response.
- *
- * An explicitly supplied credential is never mixed with the stored session:
- * spending the session's single-use refresh token on a credential that does
- * not own it strands the login (CLO-164), and sending the locally selected
- * organization alongside a key that resolves its own would contradict it.
- *
- * Throws rather than returns null for a credential another Vendure product
- * issued. Someone who set `--token` to their project's environment credential
- * has made a specific mistake, and falling back to the stored session would
- * answer it with whatever that session happens to be — or with "not logged in",
- * which is not what went wrong. Refusing here is also what keeps the value on
- * the machine; the control plane refuses it again for callers that are not
- * this CLI.
- */
-export declare function resolveCredential(options: CredentialOptions): CliCredential | null;
-export declare function readAuthConfig(): AuthConfig | null;
-/**
- * Write via a temp file + rename so the config is replaced atomically.
- * A plain `writeFileSync` truncates in place: a crash mid-write leaves
- * unparseable JSON, which reads back as "not logged in" while the rotated
- * refresh token — already consumed at the authentication service — is gone
- * for good. Rename is atomic within a directory, so a reader sees either the
- * whole old config or the whole new one.
- */
-export declare function writeAuthConfig(config: AuthConfig): void;
-export declare function clearAuthConfig(): void;
-/**
- * Exchange a refresh token for a fresh access/refresh token pair via WorkOS.
- *
- * Pass `workosOrgId` to scope the new token to a specific organization:
- * WorkOS bakes the user's role + permissions for that org into the access
- * token's claims at issue time. Without it, WorkOS returns a token for the
- * user's current/default org. This is the mechanism that keeps the JWT's
- * `org_id` + `permissions` in step with the CLI's active org — see
- * `org switch` and the multi-org branch of `login`.
- *
- * Note: `workosOrgId` is the WorkOS organization id (`org_…`), NOT the
- * internal DB UUID stored in `AuthConfig.activeOrganizationId`.
- */
-export declare function exchangeRefreshToken(refreshToken: string, workosOrgId?: string): Promise<TokenPair>;
-/**
- * Exported so the `waitMs >= staleMs` invariant below can be asserted — it is
- * the load-bearing relationship in this whole mechanism and nothing else
- * enforces it.
- *
- * `staleMs` covers the worst case of both refresh requests timing out, so a
- * waiter never breaks a lock that is still doing useful work.
- *
- * `waitMs` must not be shorter. A waiter that gives up early goes down the
- * unlocked path *before* the holder has written its rotated pair, so the
- * already-rotated checks below still see the old token and spend it a second
- * time — the single-use double-spend this lock exists to prevent (CLO-164).
- * Equality is what makes "gave up" and "the holder is dead" the same condition.
- */
-export declare const SESSION_LOCK_OPTIONS: FileLockOptions;
-/**
- * Serializes everything that spends the single-use refresh token or rewrites
- * `auth.json`, across processes. Every such call site must go through this —
- * guarding one of them leaves the double-spend fully reachable via the others.
- *
- * The callback receives whether the lock was actually held; see `withFileLock`.
- */
-export declare function withSessionLock<T>(fn: (held: boolean) => Promise<T>): Promise<T>;
-/**
- * Pass the access token that got the 401. If the stored config has moved on
- * from it, another process (or an earlier command) already rotated the pair and
- * its access token is reused — refresh tokens are single-use, so spending ours
- * on a redundant exchange is what strands sessions. Reuse requires provable
- * lifetime left; see `hasUsableLifetime`.
- */
-export declare function refreshAccessToken(failedAccessToken?: string): Promise<string>;
-/**
- * Re-mint the stored session scoped to a different organization, then persist
- * it. The read-exchange-write runs as one locked unit and re-reads inside the
- * lock: a concurrent refresh may have rotated the pair since the caller last
- * looked, and spreading a stale snapshot over it would write back a refresh
- * token the authentication service has already retired. Atomic rename stops
- * torn files; it does nothing about lost updates.
- */
-export declare function rotateActiveOrganization(target: {
-    organizationId: string;
-    workosOrgId: string;
-    organizations: AuthOrganization[];
-}): Promise<AuthConfig>;
+export declare function resolveCredential(options: CredentialOptions): Promise<CliCredential>;
 //# sourceMappingURL=auth.d.ts.map

package/dist/cli/lib/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/auth.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAgB5D,OAAO,EAAE,KAAK,eAAe,EAAgB,MAAM,gBAAgB,CAAC;AAIpE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACzD,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,aAAa,EAAE,gBAAgB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,eAAO,MAAM,0BAA0B,QAAS,CAAC;AACjD,eAAO,MAAM,8BAA8B,QAAS,CAAC;AAErD;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAEtE;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,GAAG,aAAa,GAAG,IAAI,CAkBlF;AAED,wBAAgB,cAAc,IAAI,UAAU,GAAG,IAAI,CAUlD;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAexD;AAmFD,wBAAgB,eAAe,IAAI,IAAI,CAItC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,EACpB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,SAAS,CAAC,CAiCpB;AAwFD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,EAAE,eAYlC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAEhF;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAUpF;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,gBAAgB,EAAE,CAAC;CACnC,GAAG,OAAO,CAAC,UAAU,CAAC,CAyCtB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAO5D,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAK/C,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAU1F"}