@vendure/cloud 0.4.0 → 0.5.0-dev.20261014172655.g652e750

package/dist/cli/host-arguments.js

@@ -1,26 +1,18 @@
 // Reading what a CLI host passed a command action.
 //
-// The Vendure CLI host appends three values after everything Commander supplies — the parsed
-// options, the Commander command, then its own context — and reads them back by counting from the
-// end. `@vendure/cli` exports `readCommandContext` and `readCommandOptions` for that, and this is a
-// restatement of them rather than a call to them.
+// The Vendure CLI host appends three values after everything Commander supplies (the parsed
+// options, the Commander command, then its own context) and reads them back by counting from the
+// end. `@vendure/cli` exports `readCommandContext` and `readCommandOptions` for that; this file
+// restates them for the same reason `dev/cli-host.ts` does: `import("@vendure/cli")` resolves to
+// the copy nearest this package, which in a workspace is not always the running one. Reaching the
+// running host needs a helper it does not expose (CLO-646).
 //
-// It is a restatement for the same reason `dev/cli-host.ts` is one, and for one more. The first:
-// `import("@vendure/cli")` answers with whichever copy sits nearest this package, which in a
-// workspace is not always the copy that is running, so reading the convention from it proves
-// nothing about the host that actually called. Reaching the running host needs a helper it does not
-// expose (CLO-646). The second: the same actions run under the transitional `vcloud` executable,
-// which is not the Vendure CLI and does not install it — resolving the host there would fail on a
-// customer's machine, and bundling it would pull the whole Vendure CLI, `vite` and `ts-morph`
-// included, into a standalone binary that never runs any of it.
-//
-// A restated convention is a cross-component claim, so it is held by a test rather than by this
-// comment: `test/cli-host-arguments.test.ts` reads the same argument list with these and with the
-// host's own exported readers and requires the same answer.
+// `test/cli-host-arguments.test.ts` holds the restated convention: it reads the same argument list
+// with these and with the host's exported readers and requires the same answer.
 const CONTEXT_FROM_END = 1;
 const OPTIONS_FROM_END = 3;
-// Throws rather than defaulting, because a tail that is not there is a calling convention that has
-// moved. A command run with the wrong context would resolve the wrong VC Environment.
+// Throws because a missing tail means the calling convention has moved. A command run with the
+// wrong context would resolve the wrong VC Environment.
 export function readCommandContext(args) {
     const context = args[args.length - CONTEXT_FROM_END];
     if (!isPlainObject(context) || !Array.isArray(context.commandPath)) {

package/dist/cli/host-arguments.js.map

@@ -1 +1 @@
-{"version":3,"file":"host-arguments.js","sourceRoot":"","sources":["../../src/cli/host-arguments.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,EAAE;AACF,6FAA6F;AAC7F,kGAAkG;AAClG,oGAAoG;AACpG,kDAAkD;AAClD,EAAE;AACF,iGAAiG;AACjG,6FAA6F;AAC7F,6FAA6F;AAC7F,oGAAoG;AACpG,iGAAiG;AACjG,kGAAkG;AAClG,8FAA8F;AAC9F,gEAAgE;AAChE,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,4DAA4D;AAE5D,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAC3B,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAO3B,mGAAmG;AACnG,sFAAsF;AACtF,MAAM,UAAU,kBAAkB,CAAC,IAAwB;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC,CAAC;IACrD,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAC5C,CAAC,OAAO,EAAqB,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,CAC5D,CAAC;IACF,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAClD,OAAO;QACL,gBAAgB,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE;QACzE,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAwB;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC,CAAC;IACrD,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"host-arguments.js","sourceRoot":"","sources":["../../src/cli/host-arguments.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,EAAE;AACF,4FAA4F;AAC5F,iGAAiG;AACjG,gGAAgG;AAChG,iGAAiG;AACjG,kGAAkG;AAClG,4DAA4D;AAC5D,EAAE;AACF,mGAAmG;AACnG,gFAAgF;AAEhF,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAC3B,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAO3B,+FAA+F;AAC/F,wDAAwD;AACxD,MAAM,UAAU,kBAAkB,CAAC,IAAwB;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC,CAAC;IACrD,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAC5C,CAAC,OAAO,EAAqB,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,CAC5D,CAAC;IACF,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAClD,OAAO;QACL,gBAAgB,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE;QACzE,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAwB;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC,CAAC;IACrD,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/cli/host-nodes.js

@@ -1,4 +1,4 @@
-// The Vendure CLI host's command shape, restated rather than imported from `@vendure/cli`.
+// The Vendure CLI host's command shape, restated here and not imported from `@vendure/cli`.
 //
 // Loading the CLI plugin must resolve no package, and that covers a type-only import. TypeScript
 // erases one, so it cannot fail a `vendure` run, but it still has to resolve the specifier to

package/dist/cli/host-nodes.js.map

@@ -1 +1 @@
-{"version":3,"file":"host-nodes.js","sourceRoot":"","sources":["../../src/cli/host-nodes.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,EAAE;AACF,iGAAiG;AACjG,8FAA8F;AAC9F,gGAAgG;AAChG,mGAAmG;AACnG,+FAA+F;AAC/F,EAAE;AACF,mGAAmG;AACnG,oGAAoG;AACpG,6EAA6E;AAC7E,EAAE;AACF,oGAAoG;AACpG,6FAA6F;AAC7F,0EAA0E"}
+{"version":3,"file":"host-nodes.js","sourceRoot":"","sources":["../../src/cli/host-nodes.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,EAAE;AACF,iGAAiG;AACjG,8FAA8F;AAC9F,gGAAgG;AAChG,mGAAmG;AACnG,+FAA+F;AAC/F,EAAE;AACF,mGAAmG;AACnG,oGAAoG;AACpG,6EAA6E;AAC7E,EAAE;AACF,oGAAoG;AACpG,6FAA6F;AAC7F,0EAA0E"}

package/dist/cli/index.d.ts

@@ -1,18 +1,15 @@
 export { readSingleValue, requiredArgument, variadicArgument } from "./arguments.js";
 export { type CloudCommandDefinition, type CloudCommandGroup, type CloudCommandInput, type CloudCommandRun, defineCloudCommand, defineCloudCommandGroup, } from "./command.js";
 export { CLOUD_ROOT_OPTIONS, type CredentialOptions, type GlobalOptions, readGlobalOptions, } from "./root-options.js";
-export { type ApiClient, createApiClient } from "./lib/api-client.js";
-export { API_AUTH_CONFIG_TIMEOUT_MS, type AuthConfig, type AuthOrganization, type CliCredential, clearAuthConfig, exchangeRefreshToken, readAuthConfig, refreshAccessToken, resolveCredential, rotateActiveOrganization, SESSION_LOCK_OPTIONS, type TokenPair, WORKOS_AUTH_REQUEST_TIMEOUT_MS, withSessionLock, writeAuthConfig, } from "./lib/auth.js";
-export { type ConsoleCredentialLocation, type StoredConsoleCredential, consoleCredentialPath, isConsoleCredentialExpired, readConsoleCredential, } from "./lib/console-credential.js";
-export { type ConsoleOrigins, consoleApiOrigin, consoleAppOrigin, consoleOrigins, DEFAULT_CONSOLE_API_ORIGIN, DEFAULT_CONSOLE_APP_ORIGIN, } from "./lib/console-origins.js";
-export { type ConsoleSessionOptions, type ResolvedConsoleSession, isSharedConsoleSessionEnabled, refreshConsoleSession, resolveConsoleSession, } from "./lib/console-session.js";
-export { CONSOLE_SESSION_LOCK_STALE_MS, CONSOLE_SESSION_LOCK_WAIT_MS, consoleSessionLockPath, withConsoleSessionLock, } from "./lib/console-session-lock.js";
-export { AUTH_FILE, CONFIG_DIR, getApiUrl, REFRESH_LOCK_FILE, WORKOS_AUTHENTICATE_URL, WORKOS_DEVICE_AUTHORIZE_URL, } from "./lib/config.js";
-export { parseDotEnv } from "./lib/dotenv.js";
+export { type ApiClient, type ApiCredential, createApiClient } from "./lib/api-client.js";
+export { type CliCredential, resolveCredential } from "./lib/auth.js";
+export { getUserAccessToken, refreshUserAccessToken } from "./lib/cli-login.js";
+export { CONFIG_DIR, getApiUrl } from "./lib/config.js";
+export { formatDotEnvAssignment, parseDotEnv } from "./lib/dotenv.js";
+export { readUtf8 } from "./lib/utf8.js";
 export { CONTEXT_FILE, type ProjectContext, readContext, setActiveEnvironment, writeContext, } from "./lib/context.js";
-export { ApiError, CONSOLE_LINK_COMMAND, ConsoleSessionLockUnavailableError, ConsoleSessionNotAcceptedError, ConsoleSessionRejectedError, ConsoleSessionUnavailableError, ForeignCredentialError, formatCommandErrorMessage, RefreshTokenRejectedError, RefreshUnavailableError, reportCommandError, SessionRefreshError, SessionUnstorableError, toSessionRefreshError, } from "./lib/errors.js";
+export { ApiError, CliLoginError, CliLoginFailure, ForeignCredentialError, formatCommandErrorMessage, LoginPairingError, reportCommandError, } from "./lib/errors.js";
 export { type DeploymentResourceLabelContext, formatInlineUserFacingErrorReason, formatUserFacingErrorDetails, } from "./lib/error-output.js";
-export { type FileLockOptions, withFileLock } from "./lib/file-lock.js";
 export { formatBytes, formatDateTime, formatDuration, formatTable, writeJson, } from "./lib/format.js";
 export { DEFAULT_NODE_MAJOR, PACKAGE_MANAGERS, type PackageManager, type ResolvedBuildSettings, SUPPORTED_NODE_MAJORS, type SourceBuildSettings, type SourceBuildSettingsResponse, type SupportedNodeMajor, appDirSchema, sourceBuildSettingsSchema, } from "./lib/contract/build-settings.js";
 export type { CreateEnvironmentResponse, EnvironmentDetailsResponse, InitialSuperadminCredentials, } from "./lib/contract/deployments.js";
@@ -22,7 +19,7 @@ export type { ProjectDetailsResponse, ProjectEnvironmentSummaryResponse, Project
 export { MANAGED_EMAIL_DOMAIN_STATUSES, MANAGED_EMAIL_EVENT_TYPES, type ManagedEmailDomainListResponse, type ManagedEmailDomainResponse, type ManagedEmailDomainStatus, type ManagedEmailEventListResponse, type ManagedEmailEventResponse, type ManagedEmailEventType, type ManagedEmailOwnershipRecord, type ManagedEmailTestSendingResponse, type ManagedEmailUsageResponse, type UpdateManagedEmailTestSendingRequest, } from "./lib/contract/managed-email.js";
 export type { SourceBranchMappingDetails, SourceBranchMappingStatus, SourceDisconnectReason, SourceRepositoryLinkDetails, SourceRepositoryLinkStatus, SourceRepositorySummary, SourceTriggerReason, SourceTriggerStatus, VcsInstallationSummary, VcsLinkSessionResponse, VcsLinkSessionStatus, VcsLinkSessionStatusValue, } from "./lib/contract/source-repository.js";
 export { type Identifiable, isIdPrefix, resolveUniqueIdPrefix } from "./lib/id-prefix.js";
-export { CLOUD_INVOCATIONS, type CloudInvocation, cloudInvocation, setCloudInvocation, underCurrentInvocation, } from "./lib/invocation.js";
+export { AUTH_LOGIN_COMMAND, AUTH_ORGANIZATION_LOGIN_COMMAND, AUTH_STATUS_COMMAND, CLOUD_INVOCATION, } from "./lib/invocation.js";
 export { logger, LOG_FILE_ENV_VAR, resolveLogFile } from "./lib/logger.js";
 export { openBrowser } from "./lib/open-browser.js";
 export { getAuthenticatedOrganizationSlug } from "./lib/organization.js";
@@ -34,6 +31,6 @@ export { pendingCommitSha, shortSha } from "./lib/commit.js";
 export { getBranchMappingOrNull, getRepositoryLinkOrNull, } from "./lib/source-repository-link.js";
 export { slugToName, toSlug } from "./lib/slug.js";
 export { sleep } from "./lib/sleep.js";
-export { output, wrapToWidth } from "./lib/terminal-output.js";
-export { type Deployment, type DeploymentApplicationSource, type DeploymentSummary, type DeploymentSummaryAction, type DeploymentSummaryCleanup, type DeploymentSummaryCleanupFailure, type DeploymentSummaryResourceRef, type Environment, type EnvVarSummary, FAILED_STATUSES, type IdentityEnvironmentType, type PaginatedDeployments, type Project, type ProtectedResource, type RollbackTarget, type RuntimeIntent, type RuntimeState, SUCCESS_STATUSES, TERMINAL_STATUSES, type VcEnvironmentType, } from "./lib/types.js";
+export { output } from "./lib/terminal-output.js";
+export { type Deployment, type DeploymentApplicationSource, type DeploymentSummary, type DeploymentSummaryAction, type DeploymentSummaryCleanup, type DeploymentSummaryCleanupFailure, type DeploymentSummaryResourceRef, type Environment, type EnvVarDetail, type EnvVarSummary, type EnvVarValues, FAILED_STATUSES, type IdentityEnvironmentType, type PaginatedDeployments, type Project, type ProtectedResource, type RollbackTarget, type RuntimeIntent, type RuntimeState, SUCCESS_STATUSES, TERMINAL_STATUSES, type VcEnvironmentType, } from "./lib/types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACrF,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,KAAK,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EACL,0BAA0B,EAC1B,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,KAAK,SAAS,EACd,8BAA8B,EAC9B,eAAe,EACf,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,KAAK,cAAc,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,EAC5B,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,iBAAiB,EACjB,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EACL,YAAY,EACZ,KAAK,cAAc,EACnB,WAAW,EACX,oBAAoB,EACpB,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,QAAQ,EACR,oBAAoB,EACpB,kCAAkC,EAClC,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,KAAK,8BAA8B,EACnC,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,KAAK,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EACL,WAAW,EACX,cAAc,EACd,cAAc,EACd,WAAW,EACX,SAAS,GACV,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,EAChC,KAAK,kBAAkB,EACvB,YAAY,EACZ,yBAAyB,GAC1B,MAAM,kCAAkC,CAAC;AAG1C,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EACL,gCAAgC,EAChC,mBAAmB,EACnB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,cAAc,EACd,UAAU,EACV,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,6BAA6B,EAC7B,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,GACf,MAAM,iCAAiC,CAAC;AAIzC,YAAY,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAMzF,YAAY,EACV,sBAAsB,EACtB,iCAAiC,EACjC,eAAe,EACf,2BAA2B,EAC3B,iCAAiC,EACjC,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,8BAA8B,EACnC,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,+BAA+B,EACpC,KAAK,yBAAyB,EAC9B,KAAK,oCAAoC,GAC1C,MAAM,iCAAiC,CAAC;AAIzC,YAAY,EACV,0BAA0B,EAC1B,yBAAyB,EACzB,sBAAsB,EACtB,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,KAAK,YAAY,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EACL,iBAAiB,EACjB,KAAK,eAAe,EACpB,eAAe,EACf,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EACL,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,WAAW,EAChB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,qCAAqC,EACrC,wBAAwB,GACzB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EACL,KAAK,UAAU,EACf,KAAK,2BAA2B,EAChC,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,+BAA+B,EACpC,KAAK,4BAA4B,EACjC,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,eAAe,EACf,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,iBAAiB,GACvB,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACrF,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,aAAa,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAE,KAAK,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EACL,YAAY,EACZ,KAAK,cAAc,EACnB,WAAW,EACX,oBAAoB,EACpB,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,QAAQ,EACR,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,KAAK,8BAA8B,EACnC,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,WAAW,EACX,cAAc,EACd,cAAc,EACd,WAAW,EACX,SAAS,GACV,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,EAChC,KAAK,kBAAkB,EACvB,YAAY,EACZ,yBAAyB,GAC1B,MAAM,kCAAkC,CAAC;AAG1C,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EACL,gCAAgC,EAChC,mBAAmB,EACnB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,cAAc,EACd,UAAU,EACV,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,6BAA6B,EAC7B,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,GACf,MAAM,iCAAiC,CAAC;AAIzC,YAAY,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAGzF,YAAY,EACV,sBAAsB,EACtB,iCAAiC,EACjC,eAAe,EACf,2BAA2B,EAC3B,iCAAiC,EACjC,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,8BAA8B,EACnC,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,+BAA+B,EACpC,KAAK,yBAAyB,EAC9B,KAAK,oCAAoC,GAC1C,MAAM,iCAAiC,CAAC;AAGzC,YAAY,EACV,0BAA0B,EAC1B,yBAAyB,EACzB,sBAAsB,EACtB,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,KAAK,YAAY,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EACL,kBAAkB,EAClB,+BAA+B,EAC/B,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EACL,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,WAAW,EAChB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,qCAAqC,EACrC,wBAAwB,GACzB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,OAAO,EACL,KAAK,UAAU,EACf,KAAK,2BAA2B,EAChC,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,+BAA+B,EACpC,KAAK,4BAA4B,EACjC,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,eAAe,EACf,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,iBAAiB,GACvB,MAAM,gBAAgB,CAAC"}

package/dist/cli/index.js

@@ -1,48 +1,37 @@
 // The boundary a hosted Cloud command family builds against.
 //
 // A command family owns a directory under `./commands/`, declares its commands with
-// `defineCloudCommand` and `defineCloudCommandGroup`, and reaches everything else it needs through
-// this module. Nothing in a family's directory should import `./lib/**` directly: this file is what
-// stays the same while the modules behind it move, and it is the list to add to — rather than
-// `./lib/**` to edit — when a family needs a primitive that is not here yet.
+// `defineCloudCommand` and `defineCloudCommandGroup`, and reaches everything else through this
+// module. Nothing in a family's directory imports `./lib/**` directly. A family that needs a
+// primitive not exposed here adds it here, because a second copy of an authentication or output
+// rule is what this boundary prevents.
 //
-// This module is not part of the `@vendure/cloud` package's public exports. A Cloud application
-// imports `@vendure/cloud`, which is the Cloud Config surface and has nothing to do with the CLI.
-// The Vendure CLI host reaches the commands through `vendure.cliPlugin` instead.
+// This module is not part of the `@vendure/cloud` package's public exports. The Vendure CLI host
+// reaches the commands through `vendure.cliPlugin`.
 //
 // Importing this module pulls in the whole foundation, including `pino`, `zod` and
-// `@clack/prompts`. Do that from a command's `run`, not from the module that declares the command
-// tree — see `defineCloudCommand` for why, and `test/cli-published-surface.test.ts` for what holds
+// `@clack/prompts`. Import it from a command's `run`, not from the module that declares the command
+// tree; see `defineCloudCommand` for why and `test/cli-published-surface.test.ts` for what holds
 // the line.
 //
-// What is deliberately not here, because one command family uses it rather than all of them:
-// build detection and the `init` flow, environment-variable preflight, the deploy plan renderer,
-// log streaming, and the initial superadmin. Those belong in the directory of the family that owns
-// them. `apps/cli/src/lib/` still holds each of them, as the version to port from.
+// Not exported here because one command family uses it: build detection and the `init` flow,
+// environment-variable preflight, the deploy plan renderer, log streaming, and the initial
+// superadmin. Those belong in the directory of the family that owns them.
 //
-// `update-check.ts` and `commands.ts` have no equivalent here on purpose: the host owns version
-// notices, and `commands.ts` existed to find or create a Commander command, which the declarative
-// tree replaces.
-//
-// A family that needs a primitive this module does not expose should add it here rather than reach
-// past it into `./lib/**`. A second copy of an authentication or output rule is the thing this
-// boundary exists to prevent, and one that starts as a local helper in a command directory is the
-// way it usually arrives. (CLO-684 established the boundary.)
+// `update-check.ts` and `commands.ts` have no equivalent here: the host owns version notices, and
+// the declarative tree replaces `commands.ts`.
 export { readSingleValue, requiredArgument, variadicArgument } from "./arguments.js";
 export { defineCloudCommand, defineCloudCommandGroup, } from "./command.js";
 export { CLOUD_ROOT_OPTIONS, readGlobalOptions, } from "./root-options.js";
 export { createApiClient } from "./lib/api-client.js";
-export { API_AUTH_CONFIG_TIMEOUT_MS, clearAuthConfig, exchangeRefreshToken, readAuthConfig, refreshAccessToken, resolveCredential, rotateActiveOrganization, SESSION_LOCK_OPTIONS, WORKOS_AUTH_REQUEST_TIMEOUT_MS, withSessionLock, writeAuthConfig, } from "./lib/auth.js";
-export { consoleCredentialPath, isConsoleCredentialExpired, readConsoleCredential, } from "./lib/console-credential.js";
-export { consoleApiOrigin, consoleAppOrigin, consoleOrigins, DEFAULT_CONSOLE_API_ORIGIN, DEFAULT_CONSOLE_APP_ORIGIN, } from "./lib/console-origins.js";
-export { isSharedConsoleSessionEnabled, refreshConsoleSession, resolveConsoleSession, } from "./lib/console-session.js";
-export { CONSOLE_SESSION_LOCK_STALE_MS, CONSOLE_SESSION_LOCK_WAIT_MS, consoleSessionLockPath, withConsoleSessionLock, } from "./lib/console-session-lock.js";
-export { AUTH_FILE, CONFIG_DIR, getApiUrl, REFRESH_LOCK_FILE, WORKOS_AUTHENTICATE_URL, WORKOS_DEVICE_AUTHORIZE_URL, } from "./lib/config.js";
-export { parseDotEnv } from "./lib/dotenv.js";
+export { resolveCredential } from "./lib/auth.js";
+export { getUserAccessToken, refreshUserAccessToken } from "./lib/cli-login.js";
+export { CONFIG_DIR, getApiUrl } from "./lib/config.js";
+export { formatDotEnvAssignment, parseDotEnv } from "./lib/dotenv.js";
+export { readUtf8 } from "./lib/utf8.js";
 export { CONTEXT_FILE, readContext, setActiveEnvironment, writeContext, } from "./lib/context.js";
-export { ApiError, CONSOLE_LINK_COMMAND, ConsoleSessionLockUnavailableError, ConsoleSessionNotAcceptedError, ConsoleSessionRejectedError, ConsoleSessionUnavailableError, ForeignCredentialError, formatCommandErrorMessage, RefreshTokenRejectedError, RefreshUnavailableError, reportCommandError, SessionRefreshError, SessionUnstorableError, toSessionRefreshError, } from "./lib/errors.js";
+export { ApiError, CliLoginError, CliLoginFailure, ForeignCredentialError, formatCommandErrorMessage, LoginPairingError, reportCommandError, } from "./lib/errors.js";
 export { formatInlineUserFacingErrorReason, formatUserFacingErrorDetails, } from "./lib/error-output.js";
-export { withFileLock } from "./lib/file-lock.js";
 export { formatBytes, formatDateTime, formatDuration, formatTable, writeJson, } from "./lib/format.js";
 // The build-settings half of `config`, and the `appDir` rule `init` reads to place a detected app.
 export { DEFAULT_NODE_MAJOR, PACKAGE_MANAGERS, SUPPORTED_NODE_MAJORS, appDirSchema, sourceBuildSettingsSchema, } from "./lib/contract/build-settings.js";
@@ -50,10 +39,10 @@ export { DEFAULT_NODE_MAJOR, PACKAGE_MANAGERS, SUPPORTED_NODE_MAJORS, appDirSche
 // runtime values, so this module is reached from inside a command's `run` and never from the module
 // that declares the command tree.
 export { DEFAULT_SERVER_HEALTH_CHECK_PATH, DEFAULT_SERVER_PORT, VC_ADDON_PLANS, VC_REGIONS, environmentDesiredStateSchema, vcAddonPlanSchema, vcEnvironmentTypeSchema, vcRegionSchema, } from "./lib/contract/desired-state.js";
-// The managed-email shapes the `config email` family reads (CLO-772).
+// The managed-email shapes the `config email` family reads.
 export { MANAGED_EMAIL_DOMAIN_STATUSES, MANAGED_EMAIL_EVENT_TYPES, } from "./lib/contract/managed-email.js";
 export { isIdPrefix, resolveUniqueIdPrefix } from "./lib/id-prefix.js";
-export { CLOUD_INVOCATIONS, cloudInvocation, setCloudInvocation, underCurrentInvocation, } from "./lib/invocation.js";
+export { AUTH_LOGIN_COMMAND, AUTH_ORGANIZATION_LOGIN_COMMAND, AUTH_STATUS_COMMAND, CLOUD_INVOCATION, } from "./lib/invocation.js";
 export { logger, LOG_FILE_ENV_VAR, resolveLogFile } from "./lib/logger.js";
 export { openBrowser } from "./lib/open-browser.js";
 export { getAuthenticatedOrganizationSlug } from "./lib/organization.js";
@@ -65,6 +54,6 @@ export { pendingCommitSha, shortSha } from "./lib/commit.js";
 export { getBranchMappingOrNull, getRepositoryLinkOrNull, } from "./lib/source-repository-link.js";
 export { slugToName, toSlug } from "./lib/slug.js";
 export { sleep } from "./lib/sleep.js";
-export { output, wrapToWidth } from "./lib/terminal-output.js";
+export { output } from "./lib/terminal-output.js";
 export { FAILED_STATUSES, SUCCESS_STATUSES, TERMINAL_STATUSES, } from "./lib/types.js";
 //# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,EAAE;AACF,oFAAoF;AACpF,mGAAmG;AACnG,oGAAoG;AACpG,8FAA8F;AAC9F,6EAA6E;AAC7E,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,iFAAiF;AACjF,EAAE;AACF,mFAAmF;AACnF,kGAAkG;AAClG,mGAAmG;AACnG,YAAY;AACZ,EAAE;AACF,6FAA6F;AAC7F,iGAAiG;AACjG,mGAAmG;AACnG,mFAAmF;AACnF,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,iBAAiB;AACjB,EAAE;AACF,mGAAmG;AACnG,+FAA+F;AAC/F,kGAAkG;AAClG,8DAA8D;AAE9D,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACrF,OAAO,EAKL,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAGlB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAkB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EACL,0BAA0B,EAI1B,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EAEpB,8BAA8B,EAC9B,eAAe,EACf,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EAGL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAEL,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,EAC5B,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,iBAAiB,EACjB,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EACL,YAAY,EAEZ,WAAW,EACX,oBAAoB,EACpB,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,QAAQ,EACR,oBAAoB,EACpB,kCAAkC,EAClC,8BAA8B,EAC9B,2BAA2B,EAC3B,8BAA8B,EAC9B,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAwB,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EACL,WAAW,EACX,cAAc,EACd,cAAc,EACd,WAAW,EACX,SAAS,GACV,MAAM,iBAAiB,CAAC;AACzB,mGAAmG;AACnG,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAGhB,qBAAqB,EAIrB,YAAY,EACZ,yBAAyB,GAC1B,MAAM,kCAAkC,CAAC;AAQ1C,mGAAmG;AACnG,oGAAoG;AACpG,kCAAkC;AAClC,OAAO,EACL,gCAAgC,EAChC,mBAAmB,EAGnB,cAAc,EACd,UAAU,EAGV,6BAA6B,EAC7B,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,GACf,MAAM,iCAAiC,CAAC;AAkBzC,sEAAsE;AACtE,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,GAW1B,MAAM,iCAAiC,CAAC;AAkBzC,OAAO,EAAqB,UAAU,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EACL,iBAAiB,EAEjB,eAAe,EACf,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EACL,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EAErB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,qCAAqC,EACrC,wBAAwB,GACzB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAUL,eAAe,EAQf,gBAAgB,EAChB,iBAAiB,GAElB,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,EAAE;AACF,oFAAoF;AACpF,+FAA+F;AAC/F,6FAA6F;AAC7F,gGAAgG;AAChG,uCAAuC;AACvC,EAAE;AACF,iGAAiG;AACjG,oDAAoD;AACpD,EAAE;AACF,mFAAmF;AACnF,oGAAoG;AACpG,iGAAiG;AACjG,YAAY;AACZ,EAAE;AACF,6FAA6F;AAC7F,2FAA2F;AAC3F,0EAA0E;AAC1E,EAAE;AACF,kGAAkG;AAClG,+CAA+C;AAE/C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACrF,OAAO,EAKL,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAGlB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAsC,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAsB,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EACL,YAAY,EAEZ,WAAW,EACX,oBAAoB,EACpB,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,QAAQ,EACR,aAAa,EACb,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,WAAW,EACX,cAAc,EACd,cAAc,EACd,WAAW,EACX,SAAS,GACV,MAAM,iBAAiB,CAAC;AACzB,mGAAmG;AACnG,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAGhB,qBAAqB,EAIrB,YAAY,EACZ,yBAAyB,GAC1B,MAAM,kCAAkC,CAAC;AAQ1C,mGAAmG;AACnG,oGAAoG;AACpG,kCAAkC;AAClC,OAAO,EACL,gCAAgC,EAChC,mBAAmB,EAGnB,cAAc,EACd,UAAU,EAGV,6BAA6B,EAC7B,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,GACf,MAAM,iCAAiC,CAAC;AAezC,4DAA4D;AAC5D,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,GAW1B,MAAM,iCAAiC,CAAC;AAiBzC,OAAO,EAAqB,UAAU,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EACL,kBAAkB,EAClB,+BAA+B,EAC/B,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EACL,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EAErB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,qCAAqC,EACrC,wBAAwB,GACzB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,OAAO,EAYL,eAAe,EAQf,gBAAgB,EAChB,iBAAiB,GAElB,MAAM,gBAAgB,CAAC"}

package/dist/cli/lib/api-client.d.ts

@@ -1,12 +1,17 @@
+export type ApiCredential = {
+    kind: "apiKey";
+    key: string;
+} | {
+    kind: "userLogin";
+    accessToken: string;
+    refresh: (failedToken: string) => Promise<string>;
+};
 interface ApiClientOptions {
     baseUrl: string;
-    token?: string;
-    apiKey?: string;
-    organizationId?: string;
-    onUnauthorized?: (failedToken: string | undefined) => Promise<string>;
+    credential: ApiCredential;
 }
 export interface ApiClient {
-    readonly organizationId?: string;
+    readonly credentialKind: ApiCredential["kind"];
     get<T>(path: string): Promise<T>;
     post<T>(path: string, body?: unknown): Promise<T>;
     put<T>(path: string, body?: unknown): Promise<T>;

package/dist/cli/lib/api-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/api-client.ts"],"names":[],"mappings":"AAGA,UAAU,gBAAgB;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IAGxB,cAAc,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACvE;AAED,MAAM,WAAW,SAAS;IAIxB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAClD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACjD,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC/D;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,CAuIpE"}
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/api-client.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC/B;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IAGpB,OAAO,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACnD,CAAC;AAEN,UAAU,gBAAgB;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/C,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAClD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACjD,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC/D;AAID,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,CAoHpE"}

package/dist/cli/lib/api-client.js

@@ -1,21 +1,16 @@
-import { ApiError, toSessionRefreshError } from "./errors.js";
+import { ApiError } from "./errors.js";
 import { logger } from "./logger.js";
+// No organization header is sent: the organization comes from the login's token or the API key, and
+// a header could contradict it.
 export function createApiClient(options) {
-    const { baseUrl, token, apiKey, organizationId, onUnauthorized } = options;
-    let currentToken = token;
+    const { baseUrl, credential } = options;
+    let currentToken = credential.kind === "userLogin" ? credential.accessToken : undefined;
     let refreshPromise;
     function buildHeaders(bearerToken) {
-        const headers = {};
-        if (apiKey) {
-            headers["x-api-key"] = apiKey;
+        if (credential.kind === "apiKey") {
+            return { "x-api-key": credential.key };
         }
-        else if (bearerToken) {
-            headers.authorization = `Bearer ${bearerToken}`;
-        }
-        if (organizationId) {
-            headers["x-organization-id"] = organizationId;
-        }
-        return headers;
+        return bearerToken ? { authorization: `Bearer ${bearerToken}` } : {};
     }
     async function doFetch(method, path, bearerToken, body, signal) {
         const headers = buildHeaders(bearerToken);
@@ -29,40 +24,25 @@ export function createApiClient(options) {
             signal,
         });
     }
-    // The first of two dedup layers, and the only one this file can see. It collapses the concurrent
-    // 401s of one client into a single `refresh` call, keyed on the token that failed.
-    //
-    // `refresh` is `refreshAccessToken` in `auth.ts`, which dedups again on its own terms: a
-    // process-wide `activeRefresh` and, under that, a `refresh.lock` file that serializes the WorkOS
-    // exchange across processes. The two are not redundant — this one knows which request already
-    // retried, that one knows whether an exchange is in flight anywhere on the machine — but neither
-    // is enough alone, and the single-use refresh token that CLO-164 stranded is what both exist for.
+    // Collapses one client's concurrent 401s into one renewal, keyed on the failed token. Core dedups
+    // again in-process and locks across processes, because the refresh token is single-use.
     async function getRetryToken(failedToken, refresh) {
-        if (currentToken !== failedToken) {
-            // Another request already refreshed; retry this stale 401 with the current token.
+        if (currentToken !== undefined && currentToken !== failedToken) {
+            // Another request already renewed; retry this stale 401 with the current token.
             return currentToken;
         }
         if (!refreshPromise) {
-            refreshPromise = (async () => {
-                try {
-                    const refreshedToken = await refresh(failedToken);
-                    currentToken = refreshedToken;
-                    return refreshedToken;
-                }
-                catch (error) {
-                    // Keep the classified session errors intact — whether the failure
-                    // was definitive decides the message and whether credentials were
-                    // discarded. Anything unclassified keeps its cause for the logs.
-                    throw toSessionRefreshError(error);
-                }
-            })();
+            refreshPromise = refresh(failedToken).then((refreshedToken) => {
+                currentToken = refreshedToken;
+                return refreshedToken;
+            });
         }
         const activeRefresh = refreshPromise;
         try {
             return await activeRefresh;
         }
         finally {
-            // Let a later token expiry start a new refresh instead of reusing this settled result.
+            // Let a later expiry start a new renewal instead of reusing this settled result.
             if (refreshPromise === activeRefresh) {
                 refreshPromise = undefined;
             }
@@ -71,10 +51,11 @@ export function createApiClient(options) {
     async function doAuthenticatedFetch(method, path, body, signal) {
         const requestToken = currentToken;
         const response = await doFetch(method, path, requestToken, body, signal);
-        if (response.status !== 401 || !onUnauthorized) {
+        if (response.status !== 401 || credential.kind !== "userLogin" || requestToken === undefined) {
             return response;
         }
-        const retryToken = await getRetryToken(requestToken, onUnauthorized);
+        // One retry: a second 401 is about the credential, not its age.
+        const retryToken = await getRetryToken(requestToken, credential.refresh);
         return doFetch(method, path, retryToken, body, signal);
     }
     async function request(method, path, body) {
@@ -83,7 +64,7 @@ export function createApiClient(options) {
         if (!response.ok) {
             const responseBody = await response.json().catch(() => null);
             logger.error({ method, path, status: response.status, responseBody }, "API error");
-            throw new ApiError(response.status, responseBody);
+            throw new ApiError(response.status, responseBody, credential.kind);
         }
         logger.debug({ method, path, status: response.status }, "API response");
         return response.json();
@@ -94,12 +75,12 @@ export function createApiClient(options) {
         if (!response.ok) {
             const responseBody = await response.text().catch(() => null);
             logger.error({ method: "GET", path, status: response.status, responseBody }, "API stream error");
-            throw new ApiError(response.status, responseBody);
+            throw new ApiError(response.status, responseBody, credential.kind);
         }
         return response;
     }
     return {
-        organizationId,
+        credentialKind: credential.kind,
         get: (path) => request("GET", path),
         post: (path, body) => request("POST", path, body),
         put: (path, body) => request("PUT", path, body),

package/dist/cli/lib/api-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../../../src/cli/lib/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAyBrC,MAAM,UAAU,eAAe,CAAC,OAAyB;IACvD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAC3E,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,cAA2C,CAAC;IAEhD,SAAS,YAAY,CAAC,WAAoB;QACxC,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,WAAW,CAAC,GAAG,MAAM,CAAC;QAChC,CAAC;aAAM,IAAI,WAAW,EAAE,CAAC;YACvB,OAAO,CAAC,aAAa,GAAG,UAAU,WAAW,EAAE,CAAC;QAClD,CAAC;QACD,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,CAAC,mBAAmB,CAAC,GAAG,cAAc,CAAC;QAChD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,OAAO,CACpB,MAAc,EACd,IAAY,EACZ,WAAoB,EACpB,IAAc,EACd,MAAoB;QAEpB,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC/C,CAAC;QACD,OAAO,KAAK,CAAC,GAAG,OAAO,GAAG,IAAI,EAAE,EAAE;YAChC,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YAC7C,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,iGAAiG;IACjG,mFAAmF;IACnF,EAAE;IACF,yFAAyF;IACzF,iGAAiG;IACjG,8FAA8F;IAC9F,iGAAiG;IACjG,kGAAkG;IAClG,KAAK,UAAU,aAAa,CAC1B,WAA+B,EAC/B,OAA6D;QAE7D,IAAI,YAAY,KAAK,WAAW,EAAE,CAAC;YACjC,kFAAkF;YAClF,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,cAAc,GAAG,CAAC,KAAK,IAAI,EAAE;gBAC3B,IAAI,CAAC;oBACH,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;oBAClD,YAAY,GAAG,cAAc,CAAC;oBAC9B,OAAO,cAAc,CAAC;gBACxB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,kEAAkE;oBAClE,kEAAkE;oBAClE,iEAAiE;oBACjE,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QAED,MAAM,aAAa,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,aAAa,CAAC;QAC7B,CAAC;gBAAS,CAAC;YACT,uFAAuF;YACvF,IAAI,cAAc,KAAK,aAAa,EAAE,CAAC;gBACrC,cAAc,GAAG,SAAS,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,UAAU,oBAAoB,CACjC,MAAc,EACd,IAAY,EACZ,IAAc,EACd,MAAoB;QAEpB,MAAM,YAAY,GAAG,YAAY,CAAC;QAClC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACzE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YAC/C,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QACrE,OAAO,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,UAAU,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACpE,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,aAAa,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAEhE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC7D,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,WAAW,CAAC,CAAC;YACnF,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC;QACxE,OAAO,QAAQ,CAAC,IAAI,EAAgB,CAAC;IACvC,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,IAAY,EAAE,MAAoB;QACtD,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,oBAAoB,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAE5E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC7D,MAAM,CAAC,KAAK,CACV,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,EAC9D,kBAAkB,CACnB,CAAC;YACF,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO;QACL,cAAc;QACd,GAAG,EAAE,CAAI,IAAY,EAAE,EAAE,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,CAAC;QACjD,IAAI,EAAE,CAAI,IAAY,EAAE,IAAc,EAAE,EAAE,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;QACzE,GAAG,EAAE,CAAI,IAAY,EAAE,IAAc,EAAE,EAAE,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;QACvE,KAAK,EAAE,CAAI,IAAY,EAAE,IAAc,EAAE,EAAE,CAAC,OAAO,CAAI,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;QAC3E,MAAM,EAAE,CAAI,IAAY,EAAE,EAAE,CAAC,OAAO,CAAI,QAAQ,EAAE,IAAI,CAAC;QACvD,MAAM;KACP,CAAC;AACJ,CAAC"}
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../../../src/cli/lib/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA6BrC,oGAAoG;AACpG,gCAAgC;AAChC,MAAM,UAAU,eAAe,CAAC,OAAyB;IACvD,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IACxC,IAAI,YAAY,GAAG,UAAU,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,IAAI,cAA2C,CAAC;IAEhD,SAAS,YAAY,CAAC,WAA+B;QACnD,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC;QACzC,CAAC;QACD,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,CAAC;IAED,KAAK,UAAU,OAAO,CACpB,MAAc,EACd,IAAY,EACZ,WAA+B,EAC/B,IAAc,EACd,MAAoB;QAEpB,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC/C,CAAC;QACD,OAAO,KAAK,CAAC,GAAG,OAAO,GAAG,IAAI,EAAE,EAAE;YAChC,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YAC7C,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,kGAAkG;IAClG,wFAAwF;IACxF,KAAK,UAAU,aAAa,CAC1B,WAAmB,EACnB,OAAiD;QAEjD,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,WAAW,EAAE,CAAC;YAC/D,gFAAgF;YAChF,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,EAAE;gBAC5D,YAAY,GAAG,cAAc,CAAC;gBAC9B,OAAO,cAAc,CAAC;YACxB,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,aAAa,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,aAAa,CAAC;QAC7B,CAAC;gBAAS,CAAC;YACT,iFAAiF;YACjF,IAAI,cAAc,KAAK,aAAa,EAAE,CAAC;gBACrC,cAAc,GAAG,SAAS,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,UAAU,oBAAoB,CACjC,MAAc,EACd,IAAY,EACZ,IAAc,EACd,MAAoB;QAEpB,MAAM,YAAY,GAAG,YAAY,CAAC;QAClC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACzE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC7F,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,gEAAgE;QAChE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;QACzE,OAAO,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,UAAU,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACpE,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,aAAa,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAEhE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC7D,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,WAAW,CAAC,CAAC;YACnF,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC;QACxE,OAAO,QAAQ,CAAC,IAAI,EAAgB,CAAC;IACvC,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,IAAY,EAAE,MAAoB;QACtD,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,oBAAoB,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAE5E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC7D,MAAM,CAAC,KAAK,CACV,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,EAC9D,kBAAkB,CACnB,CAAC;YACF,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QACrE,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO;QACL,cAAc,EAAE,UAAU,CAAC,IAAI;QAC/B,GAAG,EAAE,CAAI,IAAY,EAAE,EAAE,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,CAAC;QACjD,IAAI,EAAE,CAAI,IAAY,EAAE,IAAc,EAAE,EAAE,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;QACzE,GAAG,EAAE,CAAI,IAAY,EAAE,IAAc,EAAE,EAAE,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;QACvE,KAAK,EAAE,CAAI,IAAY,EAAE,IAAc,EAAE,EAAE,CAAC,OAAO,CAAI,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;QAC3E,MAAM,EAAE,CAAI,IAAY,EAAE,EAAE,CAAC,OAAO,CAAI,QAAQ,EAAE,IAAI,CAAC;QACvD,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/cli/lib/auth.d.ts

@@ -1,151 +1,10 @@
 import type { CredentialOptions } from "../root-options.js";
-import { type FileLockOptions } from "./file-lock.js";
-export interface AuthOrganization {
-    id: string;
-    workosOrgId: string;
-    name: string;
-    slug: string;
-    role: string;
-}
-export interface AuthConfig {
-    accessToken: string;
-    refreshToken: string;
-    user: {
-        id: string;
-        email: string;
-        name: string | null;
-    };
-    activeOrganizationId: string | null;
-    organizations: AuthOrganization[];
-}
-export interface TokenPair {
-    accessToken: string;
-    refreshToken: string;
-}
-export declare const API_AUTH_CONFIG_TIMEOUT_MS = 15000;
-export declare const WORKOS_AUTH_REQUEST_TIMEOUT_MS = 60000;
-/**
- * The credential a single CLI invocation runs under.
- *
- * `apiKey` covers both `--token` and `VENDURE_CLOUD_TOKEN`: the control plane
- * validates those as WorkOS API keys, resolves the organization they belong to
- * itself, and never issues a refresh token for them. `session` is the stored
- * browser login, which does have a refresh token and does carry an active
- * organization the CLI selected locally.
- *
- * `consoleSession` is the shared Vendure Console CLI Session that Vendure
- * Platform stores in `~/.vendure/console-credentials.json`. It carries no
- * organization of its own here: the control plane resolves that server-side
- * from Console, so there is nothing for this machine to select and nothing for
- * it to assert (CLO-641).
- */
 export type CliCredential = {
     kind: "apiKey";
-    token: string;
+    key: string;
 } | {
-    kind: "session";
-    token: string;
-    organizationId: string | null;
-} | {
-    kind: "consoleSession";
-    token: string;
+    kind: "userLogin";
+    accessToken: string;
 };
-/**
- * Precedence: the explicit `--token`, then `VENDURE_CLOUD_TOKEN`, then the
- * shared Console session, then the stored Cloud login. Returns null when the
- * machine has no credential at all, so each caller can word its own "not logged
- * in" response.
- *
- * The shared session comes before the stored Cloud login because it is the one
- * a developer just approved, and reusing it is the point of CLO-641. It comes
- * after an explicit token for the same reason the stored login does: a
- * credential someone named on the command line is the one they meant.
- *
- * `~/.vendure-cloud/auth.json` keeps working underneath it. A machine that has
- * only that file resolves exactly as it did before, and so does every machine
- * while the shared path stays switched off.
- *
- * An explicitly supplied credential is never mixed with the stored session:
- * spending the session's single-use refresh token on a credential that does
- * not own it strands the login (CLO-164), and sending the locally selected
- * organization alongside a key that resolves its own would contradict it.
- *
- * Throws rather than returns null for a credential another Vendure product
- * issued. Someone who set `--token` to their project's environment credential
- * has made a specific mistake, and falling back to the stored session would
- * answer it with whatever that session happens to be — or with "not logged in",
- * which is not what went wrong. Refusing here is also what keeps the value on
- * the machine; the control plane refuses it again for callers that are not
- * this CLI.
- */
-export declare function resolveCredential(options: CredentialOptions): CliCredential | null;
-export declare function readAuthConfig(): AuthConfig | null;
-/**
- * Write via a temp file + rename so the config is replaced atomically.
- * A plain `writeFileSync` truncates in place: a crash mid-write leaves
- * unparseable JSON, which reads back as "not logged in" while the rotated
- * refresh token — already consumed at the authentication service — is gone
- * for good. Rename is atomic within a directory, so a reader sees either the
- * whole old config or the whole new one.
- */
-export declare function writeAuthConfig(config: AuthConfig): void;
-export declare function clearAuthConfig(): void;
-/**
- * Exchange a refresh token for a fresh access/refresh token pair via WorkOS.
- *
- * Pass `workosOrgId` to scope the new token to a specific organization:
- * WorkOS bakes the user's role + permissions for that org into the access
- * token's claims at issue time. Without it, WorkOS returns a token for the
- * user's current/default org. This is the mechanism that keeps the JWT's
- * `org_id` + `permissions` in step with the CLI's active org — see
- * `org switch` and the multi-org branch of `login`.
- *
- * Note: `workosOrgId` is the WorkOS organization id (`org_…`), NOT the
- * internal DB UUID stored in `AuthConfig.activeOrganizationId`.
- */
-export declare function exchangeRefreshToken(refreshToken: string, workosOrgId?: string): Promise<TokenPair>;
-/**
- * Exported so the `waitMs >= staleMs` invariant below can be asserted — it is
- * the load-bearing relationship in this whole mechanism and nothing else
- * enforces it.
- *
- * `staleMs` covers the worst case of both refresh requests timing out, so a
- * waiter never breaks a lock that is still doing useful work.
- *
- * `waitMs` must not be shorter. A waiter that gives up early goes down the
- * unlocked path *before* the holder has written its rotated pair, so the
- * already-rotated checks below still see the old token and spend it a second
- * time — the single-use double-spend this lock exists to prevent (CLO-164).
- * Equality is what makes "gave up" and "the holder is dead" the same condition.
- */
-export declare const SESSION_LOCK_OPTIONS: FileLockOptions;
-/**
- * Serializes everything that spends the single-use refresh token or rewrites
- * `auth.json`, across processes. Every such call site must go through this —
- * guarding one of them leaves the double-spend fully reachable via the others.
- *
- * The callback receives whether the lock was actually held; see `withFileLock`.
- */
-export declare function withSessionLock<T>(fn: (held: boolean) => Promise<T>): Promise<T>;
-/**
- * Pass the access token that got the 401. If the stored config has moved on
- * from it, another process (or an earlier command) already rotated the pair and
- * its access token is reused — refresh tokens are single-use, so spending ours
- * on a redundant exchange is what strands sessions. Reuse requires provable
- * lifetime left; see `hasUsableLifetime`.
- */
-export declare function refreshAccessToken(failedAccessToken?: string): Promise<string>;
-/**
- * Re-mint the stored session scoped to a different organization, then persist
- * it. The read-exchange-write runs as one locked unit and re-reads inside the
- * lock: a concurrent refresh may have rotated the pair since the caller last
- * looked, and spreading a stale snapshot over it would write back a refresh
- * token the authentication service has already retired. Atomic rename stops
- * torn files; it does nothing about lost updates.
- */
-export declare function rotateActiveOrganization(target: {
-    organizationId: string;
-    workosOrgId: string;
-    organizations: AuthOrganization[];
-}): Promise<AuthConfig>;
+export declare function resolveCredential(options: CredentialOptions): Promise<CliCredential>;
 //# sourceMappingURL=auth.d.ts.map

package/dist/cli/lib/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/auth.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAiB5D,OAAO,EAAE,KAAK,eAAe,EAAgB,MAAM,gBAAgB,CAAC;AAIpE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACzD,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,aAAa,EAAE,gBAAgB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,eAAO,MAAM,0BAA0B,QAAS,CAAC;AACjD,eAAO,MAAM,8BAA8B,QAAS,CAAC;AAErD;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACjE;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,GAAG,aAAa,GAAG,IAAI,CA2BlF;AAED,wBAAgB,cAAc,IAAI,UAAU,GAAG,IAAI,CAUlD;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAexD;AAmFD,wBAAgB,eAAe,IAAI,IAAI,CAItC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,EACpB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,SAAS,CAAC,CAiCpB;AAwFD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,EAAE,eAYlC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAEhF;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAUpF;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,gBAAgB,EAAE,CAAC;CACnC,GAAG,OAAO,CAAC,UAAU,CAAC,CAyCtB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAO5D,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAK/C,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAU1F"}