@wave-ai-os/wave-cli 0.1.60 → 0.1.61

package/dist/index.cjs

@@ -2137,13 +2137,18 @@ function resolveFromSources(options, stdin, config, env) {
     normalize3(env.WAVE_API_URL),
     normalize3(config.baseUrl)
   );
-  const organizationId = firstDefined(
-    normalize3(options.organizationId),
-    normalize3(stdin.organizationId),
-    normalize3(env.WAVE_ORGANIZATION_ID),
-    normalize3(env.WAVE_ORG_ID),
-    normalize3(config.organizationId)
-  );
+  const organizationCandidates = [
+    { organizationId: normalize3(options.organizationId), source: "flag" },
+    { organizationId: normalize3(stdin.organizationId), source: "stdin" },
+    { organizationId: normalize3(env.WAVE_ORGANIZATION_ID), source: "env" },
+    { organizationId: normalize3(env.WAVE_ORG_ID), source: "env" },
+    { organizationId: normalize3(config.organizationId), source: "config" }
+  ];
+  const resolvedOrganization = organizationCandidates.find((candidate) => candidate.organizationId) ?? {
+    organizationId: void 0,
+    source: "none"
+  };
+  const organizationId = resolvedOrganization.organizationId;
   const timeoutMs = firstDefined(options.timeoutMs, stdin.timeoutMs, env.WAVE_TIMEOUT_MS, config.timeoutMs);
   const debug = firstDefined(
     options.debug,
@@ -2232,6 +2237,7 @@ function resolveFromSources(options, stdin, config, env) {
   const resolvedAuth = resolveAuthToken(options, stdin, config, env);
   return {
     organizationId,
+    organizationIdSource: resolvedOrganization.source,
     runtimeOptions: {
       token: resolvedAuth.token,
       tokenSource: resolvedAuth.token ? resolvedAuth.source : "none",
@@ -2441,6 +2447,140 @@ function registerGraphqlSearchCommand(command, config) {
   });
 }
 
+// src/authClient.ts
+var import_node_crypto2 = require("crypto");
+
+// src/redaction.ts
+var TOKENISH_PATTERNS = [
+  /\b(?:cli|wave|token|secret|bearer)[A-Za-z0-9._~+/=-]{8,}\b/gi,
+  /\b[A-Za-z0-9._~+/=-]{24,}\b/g
+];
+function redactOne(value) {
+  if (value.length <= 8) {
+    return "[redacted]";
+  }
+  return `${value.slice(0, 4)}...[redacted]...${value.slice(-4)}`;
+}
+function redactSecrets(input, knownSecrets = []) {
+  let output = input;
+  for (const secret of knownSecrets) {
+    if (!secret) continue;
+    output = output.split(secret).join(redactOne(secret));
+  }
+  for (const pattern of TOKENISH_PATTERNS) {
+    output = output.replace(pattern, (match) => redactOne(match));
+  }
+  return output;
+}
+function redactUnknown(input, knownSecrets = []) {
+  if (typeof input === "string") {
+    return redactSecrets(input, knownSecrets);
+  }
+  if (Array.isArray(input)) {
+    return input.map((entry2) => redactUnknown(entry2, knownSecrets));
+  }
+  if (!input || typeof input !== "object") {
+    return input;
+  }
+  const output = {};
+  for (const [key, value] of Object.entries(input)) {
+    if (/token|secret|authorization|bearer/i.test(key)) {
+      output[key] = typeof value === "string" ? redactSecrets(value, knownSecrets) : "[redacted]";
+      continue;
+    }
+    output[key] = redactUnknown(value, knownSecrets);
+  }
+  return output;
+}
+
+// src/authClient.ts
+function parseJsonSafely2(input) {
+  try {
+    return JSON.parse(input);
+  } catch {
+    return null;
+  }
+}
+function graphqlErrors(payload, knownSecrets) {
+  const errors = payload.errors;
+  if (!Array.isArray(errors) || errors.length === 0) return null;
+  return {
+    code: "upstream_error",
+    message: "GraphQL request failed.",
+    status: 400,
+    details: {
+      errors: redactUnknown(errors, knownSecrets)
+    }
+  };
+}
+async function authGraphqlRequest(params) {
+  const requestId = (0, import_node_crypto2.randomUUID)();
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), params.timeoutMs);
+  const knownSecrets = [params.token, ...params.knownSecrets ?? []].filter(
+    (secret) => typeof secret === "string" && secret.length > 0
+  );
+  try {
+    const url = new URL("/graphql", params.baseUrl);
+    const response = await fetch(url, {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json",
+        "X-Origin": "wave-cli",
+        "X-Request-Id": requestId,
+        ...params.token ? { Authorization: `Bearer ${params.token}` } : {}
+      },
+      body: JSON.stringify({ query: params.query, variables: params.variables ?? {} }),
+      signal: controller.signal
+    });
+    const responseRequestId = response.headers.get("x-request-id") ?? requestId;
+    const text = await response.text();
+    const payload = text ? parseJsonSafely2(text) : null;
+    const graph = payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
+    const gqlError = graphqlErrors(graph, knownSecrets);
+    if (gqlError) {
+      return { ok: false, error: gqlError, requestId: responseRequestId };
+    }
+    if (!response.ok) {
+      return {
+        ok: false,
+        requestId: responseRequestId,
+        error: {
+          code: `http_${response.status}`,
+          message: "Auth request failed.",
+          status: response.status,
+          details: { body: redactUnknown(graph, knownSecrets) }
+        }
+      };
+    }
+    const data = graph.data && typeof graph.data === "object" && !Array.isArray(graph.data) ? graph.data : {};
+    return {
+      ok: true,
+      result: {
+        status: response.status,
+        requestId: responseRequestId,
+        data
+      }
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Network error.";
+    const timedOut = error instanceof Error && error.name === "AbortError";
+    return {
+      ok: false,
+      requestId,
+      error: {
+        code: timedOut ? "timeout" : "network_error",
+        message: redactSecrets(timedOut ? "Auth request timed out." : message, knownSecrets),
+        status: timedOut ? 408 : 503,
+        details: {}
+      }
+    };
+  } finally {
+    clearTimeout(timeoutId);
+  }
+}
+
 // src/commands/tasks.ts
 var projectIdSchema = import_zod2.z.string().min(1);
 var idSchema = import_zod2.z.string().min(1);
@@ -2469,6 +2609,44 @@ function parseTaskUpdateJson(raw) {
 function parseLabelIds(raw) {
   return raw.split(",").map((labelId) => labelId.trim()).filter((labelId) => labelId.length > 0);
 }
+function asRecord3(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+  return value;
+}
+function asNonEmptyString2(value) {
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+async function resolveTaskReadOrganizationId(params) {
+  const resolvedOrganizationId = asNonEmptyString2(params.organizationId);
+  if (params.organizationIdSource === "flag" && resolvedOrganizationId) {
+    return resolvedOrganizationId;
+  }
+  const baseUrl = asNonEmptyString2(params.runtimeOptions.baseUrl);
+  const token = asNonEmptyString2(params.runtimeOptions.token);
+  if (baseUrl && token) {
+    const result = await authGraphqlRequest({
+      baseUrl,
+      token,
+      timeoutMs: typeof params.runtimeOptions.timeoutMs === "number" ? params.runtimeOptions.timeoutMs : 1e4,
+      query: "query WaveCliTaskReadOrganization { cliAuthStatus { authenticated baseAuthStatus organization { id slug } } }"
+    });
+    if (result.ok) {
+      const status = asRecord3(result.result.data.cliAuthStatus);
+      const organization = status ? asRecord3(status.organization) : null;
+      const organizationId = organization ? asNonEmptyString2(organization.id) : void 0;
+      if (organizationId) {
+        return organizationId;
+      }
+    }
+  }
+  return resolveOrganizationId(resolvedOrganizationId);
+}
 function registerTaskCommands(program) {
   const tasks = program.command("tasks").description("Task operations");
   tasks.command("list").option("--project-id <projectId>").option("--page <page>").option("--per <per>").option("--team-id <teamId>").option("--team-ids <teamIds>").option("--member-id <memberId>").option("--meeting-id <meetingId>").option("--field-name <fieldName>").option("--field-value <fieldValue>").option("--field-blank <fieldBlank>").option("--open <open>").option("--rank-direction <rankDirection>").option("--include-archived <includeArchived>").action(async (opts, cmd) => {
@@ -2505,7 +2683,11 @@ function registerTaskCommands(program) {
   tasks.command("show").requiredOption("--id <id>").action(async (opts, cmd) => {
     const parsed = idSchema.parse(opts.id);
     const context = await resolveCommandContext(cmd.optsWithGlobals());
-    const organizationId = resolveOrganizationId(context.organizationId);
+    const organizationId = await resolveTaskReadOrganizationId({
+      organizationId: context.organizationId,
+      organizationIdSource: context.organizationIdSource,
+      runtimeOptions: context.runtimeOptions
+    });
     await runGraphqlQueryCommand({
       command: "tasks.show",
       runtimeOptions: context.runtimeOptions,
@@ -3407,16 +3589,16 @@ var displayPreferenceAttributesSelectionSet = "attributes { id viewType favorite
 var filterPreferenceAttributesSelectionSet = "attributes { id filterType filter memberId focusMemberId focusTeamId filterableId filterableType preferenceType agendaItemId }";
 var healthUpdateSummarySelectionSet = "id type value memberId status createdAt updatedAt updatableType updatableId parentUpdateId emojis { id name memberId } resources { ...ResourceSummaryFull }";
 var projectShowFullSelectionSet = `{ id type name slug description status priority createdAt updatedAt startDate targetDate archivedAt memberId organizationId teamIds emoji { id name memberId } backgroundImage { backgroundType gradientStart gradientEnd gradientDegrees color imageUrl image { url lowUrl } } favorites { id memberId } resources { ...ResourceSummaryFull } displayPreference { id type ${displayPreferenceAttributesSelectionSet} viewType favorite groupingField groupToggleState memberId focusMemberId focusTeamId displayableId displayableType preferenceType agendaItemId } filterPreferences { id type ${filterPreferenceAttributesSelectionSet} filterType filter memberId focusMemberId focusTeamId filterableId filterableType preferenceType agendaItemId } healthUpdates { ${healthUpdateSummarySelectionSet} replies { ${healthUpdateSummarySelectionSet} replies { id type } } } } fragment ResourceSummaryFull on ResourceSummary { id resourceType slug url skillId skill { id name slug emoji scope description } metadata { urlName imageUrl siteName providerName mediaType skillId skillName skillSlug skillScope skillEmoji skillDescription } attachment { id fileKey filename url } content { id name slug type firstChildSlug childCount } }`;
-function asRecord3(value) {
+function asRecord4(value) {
   return value && typeof value === "object" ? value : null;
 }
 function toNonEmptyString(value) {
   return typeof value === "string" && value.trim() !== "" ? value : void 0;
 }
 function normalizeProjectRowForDisplay(row) {
-  const record = asRecord3(row);
+  const record = asRecord4(row);
   if (!record) return row;
-  const attributes = asRecord3(record.attributes);
+  const attributes = asRecord4(record.attributes);
   const topLevelName = toNonEmptyString(record.name);
   const topLevelTitle = toNonEmptyString(record.title);
   const attributeName = toNonEmptyString(attributes?.name);
@@ -3431,7 +3613,7 @@ function normalizeProjectRowForDisplay(row) {
   };
 }
 function normalizeProjectsListForDisplay(payload) {
-  const record = asRecord3(payload);
+  const record = asRecord4(payload);
   if (!record || !Array.isArray(record.data)) return payload;
   return {
     ...record,
@@ -3639,7 +3821,7 @@ var MEETING_STATUSES = /* @__PURE__ */ new Set(["upcoming", "active", "completed
 var MEETING_REPEATS = /* @__PURE__ */ new Set(["never", "weekly", "biweekly", "monthly", "quarterly"]);
 var createHelp2 = buildDataJsonHelp("meeting", "create") ?? 'JSON object for meeting or {"meeting": {...}}';
 var updateHelp2 = buildDataJsonHelp("meeting", "update") ?? 'JSON object for meeting or {"meeting": {...}}';
-function asNonEmptyString2(value) {
+function asNonEmptyString3(value) {
   if (typeof value !== "string") {
     return void 0;
   }
@@ -3697,7 +3879,7 @@ function normalizeMeetingCreateBody(body) {
     });
   }
   const meeting = { ...entity };
-  const type = asNonEmptyString2(meeting.type);
+  const type = asNonEmptyString3(meeting.type);
   if (!type || !MEETING_TYPES.has(type)) {
     throw new CliError({
       message: "Invalid meeting.type. Use one of: TeamMeeting, OneOnOneMeeting.",
@@ -3707,8 +3889,8 @@ function normalizeMeetingCreateBody(body) {
       details: { field: "meeting.type", allowed: Array.from(MEETING_TYPES) }
     });
   }
-  const memberId = asNonEmptyString2(meeting.member_id);
-  const date = asNonEmptyString2(meeting.date);
+  const memberId = asNonEmptyString3(meeting.member_id);
+  const date = asNonEmptyString3(meeting.date);
   const startTime = toFiniteNumber(meeting.start_time, "meeting.start_time");
   const missingRequired = [];
   if (!memberId) missingRequired.push("member_id");
@@ -3723,7 +3905,7 @@ function normalizeMeetingCreateBody(body) {
       details: { requiredFields: ["member_id", "date", "start_time"], rootKey: "meeting" }
     });
   }
-  const status = asNonEmptyString2(meeting.status);
+  const status = asNonEmptyString3(meeting.status);
   if (status && !MEETING_STATUSES.has(status)) {
     throw new CliError({
       message: "Invalid meeting.status. Use one of: upcoming, active, completed.",
@@ -3733,7 +3915,7 @@ function normalizeMeetingCreateBody(body) {
       details: { field: "meeting.status", allowed: Array.from(MEETING_STATUSES) }
     });
   }
-  const repeats = asNonEmptyString2(meeting.repeats) ?? "never";
+  const repeats = asNonEmptyString3(meeting.repeats) ?? "never";
   if (!MEETING_REPEATS.has(repeats)) {
     throw new CliError({
       message: "Invalid meeting.repeats. Use one of: never, weekly, biweekly, monthly, quarterly.",
@@ -4022,7 +4204,7 @@ var SKILL_SELECTION = `{
   createdAt
   updatedAt
 }`;
-function asRecord4(value) {
+function asRecord5(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function findSkillById(id) {
@@ -4030,7 +4212,7 @@ function findSkillById(id) {
     if (!Array.isArray(payload)) {
       return null;
     }
-    return payload.find((entry2) => String(asRecord4(entry2)?.id ?? "") === id) ?? null;
+    return payload.find((entry2) => String(asRecord5(entry2)?.id ?? "") === id) ?? null;
   };
 }
 function registerSkillCommands(program) {
@@ -4422,7 +4604,7 @@ function normalizeTodosCreateBody(body) {
   }
   return { ...body, todo };
 }
-function asNonEmptyString3(value) {
+function asNonEmptyString4(value) {
   if (typeof value !== "string") {
     return void 0;
   }
@@ -4430,7 +4612,7 @@ function asNonEmptyString3(value) {
   return trimmed.length > 0 ? trimmed : void 0;
 }
 function validateEnumField(params) {
-  const value = asNonEmptyString3(params.rawValue);
+  const value = asNonEmptyString4(params.rawValue);
   if (!value) {
     return void 0;
   }
@@ -4464,7 +4646,7 @@ function normalizeKnowledgeCreateBody(body) {
     message: "Invalid content.status. Use one of: draft, published."
   });
   content.status = status ?? "draft";
-  const memberId = asNonEmptyString3(content.member_id);
+  const memberId = asNonEmptyString4(content.member_id);
   if (!memberId) {
     throwMissingRequiredCreateFields("content", ["member_id"]);
   }
@@ -4473,7 +4655,7 @@ function normalizeKnowledgeCreateBody(body) {
 }
 function normalizeNewsCreateBody(body) {
   const headline = ensureEntityObject(body, "headline");
-  const memberId = asNonEmptyString3(headline.member_id);
+  const memberId = asNonEmptyString4(headline.member_id);
   if (!memberId) {
     throwMissingRequiredCreateFields("headline", ["member_id"]);
   }
@@ -4502,14 +4684,14 @@ function normalizeNewsCreateBody(body) {
 }
 function normalizeQuestionsCreateBody(body) {
   const question = ensureEntityObject(body, "question");
-  const summary = asNonEmptyString3(question.summary);
-  const currentName = asNonEmptyString3(question.name);
+  const summary = asNonEmptyString4(question.summary);
+  const currentName = asNonEmptyString4(question.name);
   if (!currentName && summary) {
     question.name = summary;
   }
   delete question.summary;
-  const name = asNonEmptyString3(question.name);
-  const memberId = asNonEmptyString3(question.member_id);
+  const name = asNonEmptyString4(question.name);
+  const memberId = asNonEmptyString4(question.member_id);
   const missing = [];
   if (!name) missing.push("name");
   if (!memberId) missing.push("member_id");
@@ -4531,13 +4713,13 @@ function normalizeQuestionsCreateBody(body) {
 }
 function normalizeQuestionsUpdateBody(body) {
   const question = ensureEntityObject(body, "question");
-  const summary = asNonEmptyString3(question.summary);
-  const currentName = asNonEmptyString3(question.name);
+  const summary = asNonEmptyString4(question.summary);
+  const currentName = asNonEmptyString4(question.name);
   if (!currentName && summary) {
     question.name = summary;
   }
   delete question.summary;
-  const name = asNonEmptyString3(question.name);
+  const name = asNonEmptyString4(question.name);
   if (name) {
     question.name = name;
   }
@@ -4554,9 +4736,9 @@ function normalizeQuestionsUpdateBody(body) {
 }
 function normalizePulseCreateBody(body) {
   const healthUpdate = ensureEntityObject(body, "health_update");
-  const healthUpdatableId = asNonEmptyString3(healthUpdate.health_updatable_id) ?? asNonEmptyString3(healthUpdate.updatable_id);
-  const healthUpdatableType = asNonEmptyString3(healthUpdate.health_updatable_type) ?? asNonEmptyString3(healthUpdate.updatable_type);
-  const memberId = asNonEmptyString3(healthUpdate.member_id);
+  const healthUpdatableId = asNonEmptyString4(healthUpdate.health_updatable_id) ?? asNonEmptyString4(healthUpdate.updatable_id);
+  const healthUpdatableType = asNonEmptyString4(healthUpdate.health_updatable_type) ?? asNonEmptyString4(healthUpdate.updatable_type);
+  const memberId = asNonEmptyString4(healthUpdate.member_id);
   const status = validateEnumField({
     rawValue: healthUpdate.status,
     field: "health_update.status",
@@ -4581,8 +4763,8 @@ function normalizePulseCreateBody(body) {
 }
 function normalizeSurveysCreateBody(body) {
   const survey = ensureEntityObject(body, "survey");
-  const title = asNonEmptyString3(survey.title);
-  const currentName = asNonEmptyString3(survey.name);
+  const title = asNonEmptyString4(survey.title);
+  const currentName = asNonEmptyString4(survey.name);
   if (!currentName && title) {
     survey.name = title;
   }
@@ -4611,8 +4793,8 @@ function normalizeSurveysCreateBody(body) {
 }
 function normalizeSurveysUpdateBody(body) {
   const survey = ensureEntityObject(body, "survey");
-  const title = asNonEmptyString3(survey.title);
-  const currentName = asNonEmptyString3(survey.name);
+  const title = asNonEmptyString4(survey.title);
+  const currentName = asNonEmptyString4(survey.name);
   if (!currentName && title) {
     survey.name = title;
   }
@@ -4639,8 +4821,8 @@ function normalizeSurveysUpdateBody(body) {
 }
 function normalizeFeedbacksCreateBody(body) {
   const feedback = ensureEntityObject(body, "feedback");
-  const title = asNonEmptyString3(feedback.title);
-  const currentName = asNonEmptyString3(feedback.name);
+  const title = asNonEmptyString4(feedback.title);
+  const currentName = asNonEmptyString4(feedback.name);
   if (!currentName && title) {
     feedback.name = title;
   }
@@ -4657,7 +4839,7 @@ function normalizeFeedbacksCreateBody(body) {
     allowed: FEEDBACK_QUARTERS,
     message: "Invalid feedback.quarter. Use one of: q1, q2, q3, q4."
   });
-  const year = asNonEmptyString3(feedback.year);
+  const year = asNonEmptyString4(feedback.year);
   const missing = [];
   if (!name) missing.push("name");
   if (!quarter) missing.push("quarter");
@@ -4672,8 +4854,8 @@ function normalizeFeedbacksCreateBody(body) {
 }
 function normalizeFeedbacksUpdateBody(body) {
   const feedback = ensureEntityObject(body, "feedback");
-  const title = asNonEmptyString3(feedback.title);
-  const currentName = asNonEmptyString3(feedback.name);
+  const title = asNonEmptyString4(feedback.title);
+  const currentName = asNonEmptyString4(feedback.name);
   if (!currentName && title) {
     feedback.name = title;
   }
@@ -4700,14 +4882,14 @@ function normalizeFeedbacksUpdateBody(body) {
 }
 function normalizeAccountabilityCreateBody(body) {
   const responsibility = ensureEntityObject(body, "responsibility");
-  const summary = asNonEmptyString3(responsibility.summary);
-  const currentName = asNonEmptyString3(responsibility.name);
+  const summary = asNonEmptyString4(responsibility.summary);
+  const currentName = asNonEmptyString4(responsibility.name);
   if (!currentName && summary) {
     responsibility.name = summary;
   }
   delete responsibility.summary;
-  const name = asNonEmptyString3(responsibility.name);
-  const memberId = asNonEmptyString3(responsibility.member_id);
+  const name = asNonEmptyString4(responsibility.name);
+  const memberId = asNonEmptyString4(responsibility.member_id);
   const missing = [];
   if (!name) missing.push("name");
   if (!memberId) missing.push("member_id");
@@ -4722,8 +4904,8 @@ function normalizeAccountabilityCreateBody(body) {
 }
 function normalizeAccountabilityUpdateBody(body) {
   const responsibility = ensureEntityObject(body, "responsibility");
-  const summary = asNonEmptyString3(responsibility.summary);
-  const currentName = asNonEmptyString3(responsibility.name);
+  const summary = asNonEmptyString4(responsibility.summary);
+  const currentName = asNonEmptyString4(responsibility.name);
   if (!currentName && summary) {
     responsibility.name = summary;
   }
@@ -4755,7 +4937,7 @@ function parseSmartKpiViewCreateBody(raw) {
 }
 function normalizeSmartKpiViewCreateBody(body) {
   const smartKpiView = ensureEntityObject(body, "smart_kpi_view");
-  const name = asNonEmptyString3(smartKpiView.name);
+  const name = asNonEmptyString4(smartKpiView.name);
   if (!name) {
     throwMissingRequiredCreateFields("smart_kpi_view", ["name"]);
   }
@@ -4793,9 +4975,9 @@ function buildKpisCreateMutation(params) {
     });
   }
   const smartKpi = { ...entity };
-  const name = asNonEmptyString3(smartKpi.name);
-  const smartKpiViewId = asNonEmptyString3(smartKpi.smart_kpi_view_id);
-  const measurableGroupId = asNonEmptyString3(smartKpi.measurable_group_id);
+  const name = asNonEmptyString4(smartKpi.name);
+  const smartKpiViewId = asNonEmptyString4(smartKpi.smart_kpi_view_id);
+  const measurableGroupId = asNonEmptyString4(smartKpi.measurable_group_id);
   const hasAllowedName = typeof name === "string" && SMART_KPI_NAME_SET.has(name);
   if (!name) {
     throw new CliError({
@@ -4815,7 +4997,7 @@ function buildKpisCreateMutation(params) {
       measurable_type: "number",
       condition: "greater_than_or_equal_to"
     };
-    const notes = asNonEmptyString3(smartKpi.notes);
+    const notes = asNonEmptyString4(smartKpi.notes);
     if (notes) {
       measurable.notes = notes;
     }
@@ -5218,7 +5400,7 @@ function ensureRootObject(body, rootKey) {
   }
   return { ...root };
 }
-function asNonEmptyString4(value) {
+function asNonEmptyString5(value) {
   if (typeof value !== "string") {
     return void 0;
   }
@@ -5228,7 +5410,7 @@ function asNonEmptyString4(value) {
 function normalizeOrganizationUpdateBody(body) {
   const organization = ensureRootObject(body, "organization");
   const detail = isRecord3(organization.organization_detail_attributes) ? { ...organization.organization_detail_attributes } : {};
-  const workspaceName = asNonEmptyString4(organization.workspace_name);
+  const workspaceName = asNonEmptyString5(organization.workspace_name);
   if (workspaceName) {
     detail.workspace_name = workspaceName;
   }
@@ -5241,7 +5423,7 @@ function normalizeOrganizationUpdateBody(body) {
 function normalizeOrganizationMetaProfileUpdateBody(body) {
   const root = ensureRootObject(body, "organization_meta_profile");
   const profile = isRecord3(root.profile) ? { ...root.profile } : {};
-  const title = asNonEmptyString4(root.title);
+  const title = asNonEmptyString5(root.title);
   if (title) {
     const companyIdentity = isRecord3(profile.company_identity) ? { ...profile.company_identity } : {};
     companyIdentity.one_sentence_summary = title;
@@ -5271,7 +5453,7 @@ function normalizeOrganizationMetaProfileUpdateBody(body) {
 function normalizeKeyMetricMetaProfileUpdateBody(body) {
   const root = ensureRootObject(body, "key_metric_meta_profile");
   const profile = isRecord3(root.profile) ? { ...root.profile } : {};
-  const annualRevenue = asNonEmptyString4(root.annual_revenue);
+  const annualRevenue = asNonEmptyString5(root.annual_revenue);
   if (annualRevenue) {
     const financial = isRecord3(profile.financial) ? { ...profile.financial } : {};
     financial.revenue = annualRevenue;
@@ -5442,7 +5624,7 @@ function ensureRootObject2(body, rootKey) {
   }
   return { ...root };
 }
-function asNonEmptyString5(value) {
+function asNonEmptyString6(value) {
   if (typeof value !== "string") {
     return void 0;
   }
@@ -5470,8 +5652,8 @@ function normalizeStrategicPlanUpdateBody(body) {
 }
 function normalizeStrategicObjectiveUpdateBody(body) {
   const strategicObjective = ensureRootObject2(body, "strategic_objective");
-  const title = asNonEmptyString5(strategicObjective.title);
-  if (!asNonEmptyString5(strategicObjective.summary) && title) {
+  const title = asNonEmptyString6(strategicObjective.title);
+  if (!asNonEmptyString6(strategicObjective.summary) && title) {
     strategicObjective.summary = title;
   }
   delete strategicObjective.title;
@@ -5494,8 +5676,8 @@ function normalizeStrategicObjectiveUpdateBody(body) {
 }
 function normalizeAnnualObjectiveCreateBody(body) {
   const annualObjective = ensureRootObject2(body, "annual_objective");
-  const title = asNonEmptyString5(annualObjective.title);
-  if (!asNonEmptyString5(annualObjective.name) && title) {
+  const title = asNonEmptyString6(annualObjective.title);
+  if (!asNonEmptyString6(annualObjective.name) && title) {
     annualObjective.name = title;
   }
   delete annualObjective.title;
@@ -5503,8 +5685,8 @@ function normalizeAnnualObjectiveCreateBody(body) {
 }
 function normalizeQuarterlyObjectiveCreateBody(body) {
   const quarterlyObjective = ensureRootObject2(body, "quarterly_objective");
-  const title = asNonEmptyString5(quarterlyObjective.title);
-  if (!asNonEmptyString5(quarterlyObjective.name) && title) {
+  const title = asNonEmptyString6(quarterlyObjective.title);
+  if (!asNonEmptyString6(quarterlyObjective.name) && title) {
     quarterlyObjective.name = title;
   }
   delete quarterlyObjective.title;
@@ -6305,7 +6487,7 @@ var import_zod16 = require("zod");
 
 // src/internalOptions.ts
 var INTERNAL_OPTIONS_KEY = "__waveInternalOptions";
-function asRecord5(value) {
+function asRecord6(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     return null;
   }
@@ -6319,7 +6501,7 @@ function setInternalCliOptions(program, options) {
 function getInternalCliOptions(command) {
   let current = command;
   while (current) {
-    const record = asRecord5(current[INTERNAL_OPTIONS_KEY]);
+    const record = asRecord6(current[INTERNAL_OPTIONS_KEY]);
     if (record) {
       return {
         enableRetryOnEmptyPhrase: record.enableRetryOnEmptyPhrase === true
@@ -9964,142 +10146,6 @@ function registerOsmdCommands(program) {
 
 // src/commands/auth.ts
 var import_node_child_process2 = require("child_process");
-
-// src/authClient.ts
-var import_node_crypto2 = require("crypto");
-
-// src/redaction.ts
-var TOKENISH_PATTERNS = [
-  /\b(?:cli|wave|token|secret|bearer)[A-Za-z0-9._~+/=-]{8,}\b/gi,
-  /\b[A-Za-z0-9._~+/=-]{24,}\b/g
-];
-function redactOne(value) {
-  if (value.length <= 8) {
-    return "[redacted]";
-  }
-  return `${value.slice(0, 4)}...[redacted]...${value.slice(-4)}`;
-}
-function redactSecrets(input, knownSecrets = []) {
-  let output = input;
-  for (const secret of knownSecrets) {
-    if (!secret) continue;
-    output = output.split(secret).join(redactOne(secret));
-  }
-  for (const pattern of TOKENISH_PATTERNS) {
-    output = output.replace(pattern, (match) => redactOne(match));
-  }
-  return output;
-}
-function redactUnknown(input, knownSecrets = []) {
-  if (typeof input === "string") {
-    return redactSecrets(input, knownSecrets);
-  }
-  if (Array.isArray(input)) {
-    return input.map((entry2) => redactUnknown(entry2, knownSecrets));
-  }
-  if (!input || typeof input !== "object") {
-    return input;
-  }
-  const output = {};
-  for (const [key, value] of Object.entries(input)) {
-    if (/token|secret|authorization|bearer/i.test(key)) {
-      output[key] = typeof value === "string" ? redactSecrets(value, knownSecrets) : "[redacted]";
-      continue;
-    }
-    output[key] = redactUnknown(value, knownSecrets);
-  }
-  return output;
-}
-
-// src/authClient.ts
-function parseJsonSafely2(input) {
-  try {
-    return JSON.parse(input);
-  } catch {
-    return null;
-  }
-}
-function graphqlErrors(payload, knownSecrets) {
-  const errors = payload.errors;
-  if (!Array.isArray(errors) || errors.length === 0) return null;
-  return {
-    code: "upstream_error",
-    message: "GraphQL request failed.",
-    status: 400,
-    details: {
-      errors: redactUnknown(errors, knownSecrets)
-    }
-  };
-}
-async function authGraphqlRequest(params) {
-  const requestId = (0, import_node_crypto2.randomUUID)();
-  const controller = new AbortController();
-  const timeoutId = setTimeout(() => controller.abort(), params.timeoutMs);
-  const knownSecrets = [params.token, ...params.knownSecrets ?? []].filter(
-    (secret) => typeof secret === "string" && secret.length > 0
-  );
-  try {
-    const url = new URL("/graphql", params.baseUrl);
-    const response = await fetch(url, {
-      method: "POST",
-      headers: {
-        Accept: "application/json",
-        "Content-Type": "application/json",
-        "X-Origin": "wave-cli",
-        "X-Request-Id": requestId,
-        ...params.token ? { Authorization: `Bearer ${params.token}` } : {}
-      },
-      body: JSON.stringify({ query: params.query, variables: params.variables ?? {} }),
-      signal: controller.signal
-    });
-    const responseRequestId = response.headers.get("x-request-id") ?? requestId;
-    const text = await response.text();
-    const payload = text ? parseJsonSafely2(text) : null;
-    const graph = payload && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
-    const gqlError = graphqlErrors(graph, knownSecrets);
-    if (gqlError) {
-      return { ok: false, error: gqlError, requestId: responseRequestId };
-    }
-    if (!response.ok) {
-      return {
-        ok: false,
-        requestId: responseRequestId,
-        error: {
-          code: `http_${response.status}`,
-          message: "Auth request failed.",
-          status: response.status,
-          details: { body: redactUnknown(graph, knownSecrets) }
-        }
-      };
-    }
-    const data = graph.data && typeof graph.data === "object" && !Array.isArray(graph.data) ? graph.data : {};
-    return {
-      ok: true,
-      result: {
-        status: response.status,
-        requestId: responseRequestId,
-        data
-      }
-    };
-  } catch (error) {
-    const message = error instanceof Error ? error.message : "Network error.";
-    const timedOut = error instanceof Error && error.name === "AbortError";
-    return {
-      ok: false,
-      requestId,
-      error: {
-        code: timedOut ? "timeout" : "network_error",
-        message: redactSecrets(timedOut ? "Auth request timed out." : message, knownSecrets),
-        status: timedOut ? 408 : 503,
-        details: {}
-      }
-    };
-  } finally {
-    clearTimeout(timeoutId);
-  }
-}
-
-// src/commands/auth.ts
 var DEFAULT_LOGIN_TIMEOUT_MS = 12e4;
 var DEFAULT_POLL_INTERVAL_MS = 2e3;
 function envelope(params) {
@@ -10127,7 +10173,7 @@ function positiveInt2(raw, fallback) {
 function requestTimeoutMs(totalTimeoutMs) {
   return Math.max(1e3, Math.min(totalTimeoutMs, 1e4));
 }
-function asRecord6(value) {
+function asRecord7(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function asString(value) {
@@ -10174,9 +10220,9 @@ function cliTokenFromPoll(payload) {
   return asString(payload.cliToken) ?? asString(payload.cli_token) ?? asString(payload.token);
 }
 function unwrapMutationResult(value) {
-  const record = asRecord6(value);
+  const record = asRecord7(value);
   if (!record) return null;
-  const data = asRecord6(record.data);
+  const data = asRecord7(record.data);
   if (data && (Object.prototype.hasOwnProperty.call(record, "ok") || Object.prototype.hasOwnProperty.call(record, "errors") || Object.prototype.hasOwnProperty.call(record, "errorCode") || Object.prototype.hasOwnProperty.call(record, "error_code"))) {
     return data;
   }
@@ -10240,7 +10286,7 @@ async function runTokenLogin(cmd, opts) {
       exitCode: mapStatusToExitCode(status.error.status)
     });
   }
-  const statusData = asRecord6(status.result.data.cliAuthStatus) ?? {};
+  const statusData = asRecord7(status.result.data.cliAuthStatus) ?? {};
   const storage = await writeStoredToken(token, baseUrl);
   const configPath2 = opts.saveBaseUrl ? await persistBaseUrl(baseUrl) : void 0;
   return printEnvelopeAndExit({
@@ -10457,7 +10503,7 @@ async function runLogout(cmd) {
     });
     if (result.ok) {
       requestId = result.result.requestId;
-      const payload = asRecord6(result.result.data.revokeCliToken) ?? {};
+      const payload = asRecord7(result.result.data.revokeCliToken) ?? {};
       revokedRemote = payload.ok !== false;
     } else {
       requestId = result.requestId;
@@ -10520,7 +10566,8 @@ async function runAuthStatus(cmd) {
       exitCode: mapStatusToExitCode(result.error.status)
     });
   }
-  const status = asRecord6(result.result.data.cliAuthStatus) ?? {};
+  const status = asRecord7(result.result.data.cliAuthStatus) ?? {};
+  const baseAuthStatus = status.baseAuthStatus;
   return printEnvelopeAndExit({
     envelope: envelope({
       ok: true,
@@ -10529,6 +10576,7 @@ async function runAuthStatus(cmd) {
       requestId: result.result.requestId,
       data: {
         authenticated: Boolean(status.authenticated),
+        baseAuthStatus: typeof baseAuthStatus === "string" ? baseAuthStatus : null,
         baseUrl,
         tokenSource,
         member: redactUnknown(status.member, [token]) ?? null,
@@ -12169,11 +12217,11 @@ function sanitizePlannerJson(value) {
   }
   return output;
 }
-function asRecord7(value) {
+function asRecord8(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function readPlannerStateKey(value, keys) {
-  const record = asRecord7(value);
+  const record = asRecord8(value);
   if (!record) {
     return null;
   }
@@ -15798,7 +15846,7 @@ function attachDiscoveryHelp(program) {
 }
 
 // src/version.ts
-var CLI_VERSION = "0.1.60";
+var CLI_VERSION = "0.1.61";
 
 // src/cli.ts
 function buildCli(options) {