@youkno/edge-cli 1.21.316 → 1.21.317

package/.pnp.cjs

@@ -273,7 +273,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["@gar/promise-retry", [\
       ["npm:1.0.2", {\
-        "packageLocation": "../../../.yarn/berry/cache/@gar-promise-retry-npm-1.0.2-960b209ddf-10c0.zip/node_modules/@gar/promise-retry/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/@gar-promise-retry-npm-1.0.2-960b209ddf-10c0.zip/node_modules/@gar/promise-retry/",\
         "packageDependencies": [\
           ["@gar/promise-retry", "npm:1.0.2"],\
           ["retry", "npm:0.13.1"]\
@@ -283,7 +283,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["@isaacs/fs-minipass", [\
       ["npm:4.0.1", {\
-        "packageLocation": "../../../.yarn/berry/cache/@isaacs-fs-minipass-npm-4.0.1-677026e841-10c0.zip/node_modules/@isaacs/fs-minipass/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/@isaacs-fs-minipass-npm-4.0.1-677026e841-10c0.zip/node_modules/@isaacs/fs-minipass/",\
         "packageDependencies": [\
           ["@isaacs/fs-minipass", "npm:4.0.1"],\
           ["minipass", "npm:7.1.3"]\
@@ -293,7 +293,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["@npmcli/agent", [\
       ["npm:4.0.0", {\
-        "packageLocation": "../../../.yarn/berry/cache/@npmcli-agent-npm-4.0.0-502e5ae4f0-10c0.zip/node_modules/@npmcli/agent/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/@npmcli-agent-npm-4.0.0-502e5ae4f0-10c0.zip/node_modules/@npmcli/agent/",\
         "packageDependencies": [\
           ["@npmcli/agent", "npm:4.0.0"],\
           ["agent-base", "npm:7.1.4"],\
@@ -307,7 +307,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["@npmcli/fs", [\
       ["npm:5.0.0", {\
-        "packageLocation": "../../../.yarn/berry/cache/@npmcli-fs-npm-5.0.0-9d737ae2f3-10c0.zip/node_modules/@npmcli/fs/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/@npmcli-fs-npm-5.0.0-9d737ae2f3-10c0.zip/node_modules/@npmcli/fs/",\
         "packageDependencies": [\
           ["@npmcli/fs", "npm:5.0.0"],\
           ["semver", "npm:7.7.4"]\
@@ -317,7 +317,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["@types/node", [\
       ["npm:24.12.0", {\
-        "packageLocation": "../../../.yarn/berry/cache/@types-node-npm-24.12.0-ce6de09e0d-10c0.zip/node_modules/@types/node/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/@types-node-npm-24.12.0-ce6de09e0d-10c0.zip/node_modules/@types/node/",\
         "packageDependencies": [\
           ["@types/node", "npm:24.12.0"],\
           ["undici-types", "npm:7.16.0"]\
@@ -340,7 +340,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["abbrev", [\
       ["npm:4.0.0", {\
-        "packageLocation": "../../../.yarn/berry/cache/abbrev-npm-4.0.0-7d848a1ef0-10c0.zip/node_modules/abbrev/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/abbrev-npm-4.0.0-7d848a1ef0-10c0.zip/node_modules/abbrev/",\
         "packageDependencies": [\
           ["abbrev", "npm:4.0.0"]\
         ],\
@@ -349,7 +349,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["agent-base", [\
       ["npm:7.1.4", {\
-        "packageLocation": "../../../.yarn/berry/cache/agent-base-npm-7.1.4-cb8b4604d5-10c0.zip/node_modules/agent-base/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/agent-base-npm-7.1.4-cb8b4604d5-10c0.zip/node_modules/agent-base/",\
         "packageDependencies": [\
           ["agent-base", "npm:7.1.4"]\
         ],\
@@ -358,7 +358,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["balanced-match", [\
       ["npm:4.0.4", {\
-        "packageLocation": "../../../.yarn/berry/cache/balanced-match-npm-4.0.4-fd666b3c7f-10c0.zip/node_modules/balanced-match/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/balanced-match-npm-4.0.4-fd666b3c7f-10c0.zip/node_modules/balanced-match/",\
         "packageDependencies": [\
           ["balanced-match", "npm:4.0.4"]\
         ],\
@@ -367,7 +367,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["brace-expansion", [\
       ["npm:5.0.4", {\
-        "packageLocation": "../../../.yarn/berry/cache/brace-expansion-npm-5.0.4-acb9332524-10c0.zip/node_modules/brace-expansion/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/brace-expansion-npm-5.0.4-acb9332524-10c0.zip/node_modules/brace-expansion/",\
         "packageDependencies": [\
           ["balanced-match", "npm:4.0.4"],\
           ["brace-expansion", "npm:5.0.4"]\
@@ -377,7 +377,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["cacache", [\
       ["npm:20.0.3", {\
-        "packageLocation": "../../../.yarn/berry/cache/cacache-npm-20.0.3-5f244d5bdd-10c0.zip/node_modules/cacache/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/cacache-npm-20.0.3-5f244d5bdd-10c0.zip/node_modules/cacache/",\
         "packageDependencies": [\
           ["@npmcli/fs", "npm:5.0.0"],\
           ["cacache", "npm:20.0.3"],\
@@ -397,7 +397,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["chownr", [\
       ["npm:3.0.0", {\
-        "packageLocation": "../../../.yarn/berry/cache/chownr-npm-3.0.0-5275e85d25-10c0.zip/node_modules/chownr/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/chownr-npm-3.0.0-5275e85d25-10c0.zip/node_modules/chownr/",\
         "packageDependencies": [\
           ["chownr", "npm:3.0.0"]\
         ],\
@@ -406,7 +406,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["commander", [\
       ["npm:14.0.3", {\
-        "packageLocation": "../../../.yarn/berry/cache/commander-npm-14.0.3-93ab31471d-10c0.zip/node_modules/commander/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/commander-npm-14.0.3-93ab31471d-10c0.zip/node_modules/commander/",\
         "packageDependencies": [\
           ["commander", "npm:14.0.3"]\
         ],\
@@ -415,14 +415,14 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["debug", [\
       ["npm:4.4.3", {\
-        "packageLocation": "../../../.yarn/berry/cache/debug-npm-4.4.3-0105c6123a-10c0.zip/node_modules/debug/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/debug-npm-4.4.3-0105c6123a-10c0.zip/node_modules/debug/",\
         "packageDependencies": [\
           ["debug", "npm:4.4.3"]\
         ],\
         "linkType": "SOFT"\
       }],\
       ["virtual:643ed7cc338bcf145a82d8b05b3bef6bcf150ca545df386225596f10ce53cc90b88b3ca83e348ade1ccea5f3f8e76c92d2f0e2ba544da60d40aff9921c56872d#npm:4.4.3", {\
-        "packageLocation": "./.yarn/__virtual__/debug-virtual-5da9fc757d/4/.yarn/berry/cache/debug-npm-4.4.3-0105c6123a-10c0.zip/node_modules/debug/",\
+        "packageLocation": "./.yarn/__virtual__/debug-virtual-5da9fc757d/7/.yarn/berry/cache/debug-npm-4.4.3-0105c6123a-10c0.zip/node_modules/debug/",\
         "packageDependencies": [\
           ["@types/supports-color", null],\
           ["debug", "virtual:643ed7cc338bcf145a82d8b05b3bef6bcf150ca545df386225596f10ce53cc90b88b3ca83e348ade1ccea5f3f8e76c92d2f0e2ba544da60d40aff9921c56872d#npm:4.4.3"],\
@@ -438,7 +438,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["env-paths", [\
       ["npm:2.2.1", {\
-        "packageLocation": "../../../.yarn/berry/cache/env-paths-npm-2.2.1-7c7577428c-10c0.zip/node_modules/env-paths/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/env-paths-npm-2.2.1-7c7577428c-10c0.zip/node_modules/env-paths/",\
         "packageDependencies": [\
           ["env-paths", "npm:2.2.1"]\
         ],\
@@ -482,7 +482,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["exponential-backoff", [\
       ["npm:3.1.3", {\
-        "packageLocation": "../../../.yarn/berry/cache/exponential-backoff-npm-3.1.3-28be78d98e-10c0.zip/node_modules/exponential-backoff/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/exponential-backoff-npm-3.1.3-28be78d98e-10c0.zip/node_modules/exponential-backoff/",\
         "packageDependencies": [\
           ["exponential-backoff", "npm:3.1.3"]\
         ],\
@@ -491,14 +491,14 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["fdir", [\
       ["npm:6.5.0", {\
-        "packageLocation": "../../../.yarn/berry/cache/fdir-npm-6.5.0-8814a0dec7-10c0.zip/node_modules/fdir/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/fdir-npm-6.5.0-8814a0dec7-10c0.zip/node_modules/fdir/",\
         "packageDependencies": [\
           ["fdir", "npm:6.5.0"]\
         ],\
         "linkType": "SOFT"\
       }],\
       ["virtual:0e783aadbd2b4b8e6f6056033c0b290501892d23bc7c5dad5477e00e48ad8bd3e4434c3962a52dd75a58e06dbb7218094a494bac954ef2f7f6fdb65d9717e5f4#npm:6.5.0", {\
-        "packageLocation": "./.yarn/__virtual__/fdir-virtual-abd4ab2082/4/.yarn/berry/cache/fdir-npm-6.5.0-8814a0dec7-10c0.zip/node_modules/fdir/",\
+        "packageLocation": "./.yarn/__virtual__/fdir-virtual-abd4ab2082/7/.yarn/berry/cache/fdir-npm-6.5.0-8814a0dec7-10c0.zip/node_modules/fdir/",\
         "packageDependencies": [\
           ["@types/picomatch", null],\
           ["fdir", "virtual:0e783aadbd2b4b8e6f6056033c0b290501892d23bc7c5dad5477e00e48ad8bd3e4434c3962a52dd75a58e06dbb7218094a494bac954ef2f7f6fdb65d9717e5f4#npm:6.5.0"],\
@@ -513,7 +513,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["fs-minipass", [\
       ["npm:3.0.3", {\
-        "packageLocation": "../../../.yarn/berry/cache/fs-minipass-npm-3.0.3-d148d6ac19-10c0.zip/node_modules/fs-minipass/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/fs-minipass-npm-3.0.3-d148d6ac19-10c0.zip/node_modules/fs-minipass/",\
         "packageDependencies": [\
           ["fs-minipass", "npm:3.0.3"],\
           ["minipass", "npm:7.1.3"]\
@@ -533,7 +533,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["get-tsconfig", [\
       ["npm:4.13.6", {\
-        "packageLocation": "../../../.yarn/berry/cache/get-tsconfig-npm-4.13.6-58e6ff95d9-10c0.zip/node_modules/get-tsconfig/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/get-tsconfig-npm-4.13.6-58e6ff95d9-10c0.zip/node_modules/get-tsconfig/",\
         "packageDependencies": [\
           ["get-tsconfig", "npm:4.13.6"],\
           ["resolve-pkg-maps", "npm:1.0.0"]\
@@ -543,7 +543,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["glob", [\
       ["npm:13.0.6", {\
-        "packageLocation": "../../../.yarn/berry/cache/glob-npm-13.0.6-864eb0cece-10c0.zip/node_modules/glob/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/glob-npm-13.0.6-864eb0cece-10c0.zip/node_modules/glob/",\
         "packageDependencies": [\
           ["glob", "npm:13.0.6"],\
           ["minimatch", "npm:10.2.4"],\
@@ -555,7 +555,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["graceful-fs", [\
       ["npm:4.2.11", {\
-        "packageLocation": "../../../.yarn/berry/cache/graceful-fs-npm-4.2.11-24bb648a68-10c0.zip/node_modules/graceful-fs/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/graceful-fs-npm-4.2.11-24bb648a68-10c0.zip/node_modules/graceful-fs/",\
         "packageDependencies": [\
           ["graceful-fs", "npm:4.2.11"]\
         ],\
@@ -564,7 +564,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["http-cache-semantics", [\
       ["npm:4.2.0", {\
-        "packageLocation": "../../../.yarn/berry/cache/http-cache-semantics-npm-4.2.0-fadacfb3ad-10c0.zip/node_modules/http-cache-semantics/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/http-cache-semantics-npm-4.2.0-fadacfb3ad-10c0.zip/node_modules/http-cache-semantics/",\
         "packageDependencies": [\
           ["http-cache-semantics", "npm:4.2.0"]\
         ],\
@@ -573,7 +573,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["http-proxy-agent", [\
       ["npm:7.0.2", {\
-        "packageLocation": "../../../.yarn/berry/cache/http-proxy-agent-npm-7.0.2-643ed7cc33-10c0.zip/node_modules/http-proxy-agent/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/http-proxy-agent-npm-7.0.2-643ed7cc33-10c0.zip/node_modules/http-proxy-agent/",\
         "packageDependencies": [\
           ["agent-base", "npm:7.1.4"],\
           ["debug", "virtual:643ed7cc338bcf145a82d8b05b3bef6bcf150ca545df386225596f10ce53cc90b88b3ca83e348ade1ccea5f3f8e76c92d2f0e2ba544da60d40aff9921c56872d#npm:4.4.3"],\
@@ -584,7 +584,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["https-proxy-agent", [\
       ["npm:7.0.6", {\
-        "packageLocation": "../../../.yarn/berry/cache/https-proxy-agent-npm-7.0.6-27a95c2690-10c0.zip/node_modules/https-proxy-agent/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/https-proxy-agent-npm-7.0.6-27a95c2690-10c0.zip/node_modules/https-proxy-agent/",\
         "packageDependencies": [\
           ["agent-base", "npm:7.1.4"],\
           ["debug", "virtual:643ed7cc338bcf145a82d8b05b3bef6bcf150ca545df386225596f10ce53cc90b88b3ca83e348ade1ccea5f3f8e76c92d2f0e2ba544da60d40aff9921c56872d#npm:4.4.3"],\
@@ -595,7 +595,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["iconv-lite", [\
       ["npm:0.7.2", {\
-        "packageLocation": "../../../.yarn/berry/cache/iconv-lite-npm-0.7.2-716fc012a0-10c0.zip/node_modules/iconv-lite/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/iconv-lite-npm-0.7.2-716fc012a0-10c0.zip/node_modules/iconv-lite/",\
         "packageDependencies": [\
           ["iconv-lite", "npm:0.7.2"],\
           ["safer-buffer", "npm:2.1.2"]\
@@ -605,7 +605,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["imurmurhash", [\
       ["npm:0.1.4", {\
-        "packageLocation": "../../../.yarn/berry/cache/imurmurhash-npm-0.1.4-610c5068a0-10c0.zip/node_modules/imurmurhash/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/imurmurhash-npm-0.1.4-610c5068a0-10c0.zip/node_modules/imurmurhash/",\
         "packageDependencies": [\
           ["imurmurhash", "npm:0.1.4"]\
         ],\
@@ -614,7 +614,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["ip-address", [\
       ["npm:10.1.0", {\
-        "packageLocation": "../../../.yarn/berry/cache/ip-address-npm-10.1.0-d5d5693401-10c0.zip/node_modules/ip-address/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/ip-address-npm-10.1.0-d5d5693401-10c0.zip/node_modules/ip-address/",\
         "packageDependencies": [\
           ["ip-address", "npm:10.1.0"]\
         ],\
@@ -623,7 +623,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["isexe", [\
       ["npm:4.0.0", {\
-        "packageLocation": "../../../.yarn/berry/cache/isexe-npm-4.0.0-588229ad74-10c0.zip/node_modules/isexe/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/isexe-npm-4.0.0-588229ad74-10c0.zip/node_modules/isexe/",\
         "packageDependencies": [\
           ["isexe", "npm:4.0.0"]\
         ],\
@@ -632,7 +632,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["lru-cache", [\
       ["npm:11.2.6", {\
-        "packageLocation": "../../../.yarn/berry/cache/lru-cache-npm-11.2.6-acb7d4323e-10c0.zip/node_modules/lru-cache/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/lru-cache-npm-11.2.6-acb7d4323e-10c0.zip/node_modules/lru-cache/",\
         "packageDependencies": [\
           ["lru-cache", "npm:11.2.6"]\
         ],\
@@ -641,7 +641,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["make-fetch-happen", [\
       ["npm:15.0.4", {\
-        "packageLocation": "../../../.yarn/berry/cache/make-fetch-happen-npm-15.0.4-cd90f16f9b-10c0.zip/node_modules/make-fetch-happen/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/make-fetch-happen-npm-15.0.4-cd90f16f9b-10c0.zip/node_modules/make-fetch-happen/",\
         "packageDependencies": [\
           ["@gar/promise-retry", "npm:1.0.2"],\
           ["@npmcli/agent", "npm:4.0.0"],\
@@ -661,7 +661,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["minimatch", [\
       ["npm:10.2.4", {\
-        "packageLocation": "../../../.yarn/berry/cache/minimatch-npm-10.2.4-11f0605299-10c0.zip/node_modules/minimatch/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/minimatch-npm-10.2.4-11f0605299-10c0.zip/node_modules/minimatch/",\
         "packageDependencies": [\
           ["brace-expansion", "npm:5.0.4"],\
           ["minimatch", "npm:10.2.4"]\
@@ -671,7 +671,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["minipass", [\
       ["npm:3.3.6", {\
-        "packageLocation": "../../../.yarn/berry/cache/minipass-npm-3.3.6-b8d93a945b-10c0.zip/node_modules/minipass/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/minipass-npm-3.3.6-b8d93a945b-10c0.zip/node_modules/minipass/",\
         "packageDependencies": [\
           ["minipass", "npm:3.3.6"],\
           ["yallist", "npm:4.0.0"]\
@@ -679,7 +679,7 @@ const RAW_RUNTIME_STATE =
         "linkType": "HARD"\
       }],\
       ["npm:7.1.3", {\
-        "packageLocation": "../../../.yarn/berry/cache/minipass-npm-7.1.3-b73a16498d-10c0.zip/node_modules/minipass/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/minipass-npm-7.1.3-b73a16498d-10c0.zip/node_modules/minipass/",\
         "packageDependencies": [\
           ["minipass", "npm:7.1.3"]\
         ],\
@@ -688,7 +688,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["minipass-collect", [\
       ["npm:2.0.1", {\
-        "packageLocation": "../../../.yarn/berry/cache/minipass-collect-npm-2.0.1-73d3907e40-10c0.zip/node_modules/minipass-collect/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/minipass-collect-npm-2.0.1-73d3907e40-10c0.zip/node_modules/minipass-collect/",\
         "packageDependencies": [\
           ["minipass", "npm:7.1.3"],\
           ["minipass-collect", "npm:2.0.1"]\
@@ -698,7 +698,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["minipass-fetch", [\
       ["npm:5.0.2", {\
-        "packageLocation": "../../../.yarn/berry/cache/minipass-fetch-npm-5.0.2-cd03eefed8-10c0.zip/node_modules/minipass-fetch/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/minipass-fetch-npm-5.0.2-cd03eefed8-10c0.zip/node_modules/minipass-fetch/",\
         "packageDependencies": [\
           ["iconv-lite", "npm:0.7.2"],\
           ["minipass", "npm:7.1.3"],\
@@ -711,7 +711,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["minipass-flush", [\
       ["npm:1.0.5", {\
-        "packageLocation": "../../../.yarn/berry/cache/minipass-flush-npm-1.0.5-efe79d9826-10c0.zip/node_modules/minipass-flush/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/minipass-flush-npm-1.0.5-efe79d9826-10c0.zip/node_modules/minipass-flush/",\
         "packageDependencies": [\
           ["minipass", "npm:3.3.6"],\
           ["minipass-flush", "npm:1.0.5"]\
@@ -721,7 +721,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["minipass-pipeline", [\
       ["npm:1.2.4", {\
-        "packageLocation": "../../../.yarn/berry/cache/minipass-pipeline-npm-1.2.4-5924cb077f-10c0.zip/node_modules/minipass-pipeline/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/minipass-pipeline-npm-1.2.4-5924cb077f-10c0.zip/node_modules/minipass-pipeline/",\
         "packageDependencies": [\
           ["minipass", "npm:3.3.6"],\
           ["minipass-pipeline", "npm:1.2.4"]\
@@ -731,7 +731,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["minipass-sized", [\
       ["npm:2.0.0", {\
-        "packageLocation": "../../../.yarn/berry/cache/minipass-sized-npm-2.0.0-a911fc7d3f-10c0.zip/node_modules/minipass-sized/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/minipass-sized-npm-2.0.0-a911fc7d3f-10c0.zip/node_modules/minipass-sized/",\
         "packageDependencies": [\
           ["minipass", "npm:7.1.3"],\
           ["minipass-sized", "npm:2.0.0"]\
@@ -741,7 +741,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["minizlib", [\
       ["npm:3.1.0", {\
-        "packageLocation": "../../../.yarn/berry/cache/minizlib-npm-3.1.0-6680befdba-10c0.zip/node_modules/minizlib/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/minizlib-npm-3.1.0-6680befdba-10c0.zip/node_modules/minizlib/",\
         "packageDependencies": [\
           ["minipass", "npm:7.1.3"],\
           ["minizlib", "npm:3.1.0"]\
@@ -751,7 +751,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["ms", [\
       ["npm:2.1.3", {\
-        "packageLocation": "../../../.yarn/berry/cache/ms-npm-2.1.3-81ff3cfac1-10c0.zip/node_modules/ms/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/ms-npm-2.1.3-81ff3cfac1-10c0.zip/node_modules/ms/",\
         "packageDependencies": [\
           ["ms", "npm:2.1.3"]\
         ],\
@@ -760,7 +760,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["negotiator", [\
       ["npm:1.0.0", {\
-        "packageLocation": "../../../.yarn/berry/cache/negotiator-npm-1.0.0-47d727e27e-10c0.zip/node_modules/negotiator/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/negotiator-npm-1.0.0-47d727e27e-10c0.zip/node_modules/negotiator/",\
         "packageDependencies": [\
           ["negotiator", "npm:1.0.0"]\
         ],\
@@ -788,7 +788,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["nopt", [\
       ["npm:9.0.0", {\
-        "packageLocation": "../../../.yarn/berry/cache/nopt-npm-9.0.0-81316ec15c-10c0.zip/node_modules/nopt/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/nopt-npm-9.0.0-81316ec15c-10c0.zip/node_modules/nopt/",\
         "packageDependencies": [\
           ["abbrev", "npm:4.0.0"],\
           ["nopt", "npm:9.0.0"]\
@@ -798,7 +798,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["p-map", [\
       ["npm:7.0.4", {\
-        "packageLocation": "../../../.yarn/berry/cache/p-map-npm-7.0.4-39386109d0-10c0.zip/node_modules/p-map/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/p-map-npm-7.0.4-39386109d0-10c0.zip/node_modules/p-map/",\
         "packageDependencies": [\
           ["p-map", "npm:7.0.4"]\
         ],\
@@ -807,7 +807,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["path-scurry", [\
       ["npm:2.0.2", {\
-        "packageLocation": "../../../.yarn/berry/cache/path-scurry-npm-2.0.2-f10aa6a77e-10c0.zip/node_modules/path-scurry/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/path-scurry-npm-2.0.2-f10aa6a77e-10c0.zip/node_modules/path-scurry/",\
         "packageDependencies": [\
           ["lru-cache", "npm:11.2.6"],\
           ["minipass", "npm:7.1.3"],\
@@ -818,7 +818,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["picomatch", [\
       ["npm:4.0.3", {\
-        "packageLocation": "../../../.yarn/berry/cache/picomatch-npm-4.0.3-0a647b87cc-10c0.zip/node_modules/picomatch/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/picomatch-npm-4.0.3-0a647b87cc-10c0.zip/node_modules/picomatch/",\
         "packageDependencies": [\
           ["picomatch", "npm:4.0.3"]\
         ],\
@@ -827,7 +827,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["proc-log", [\
       ["npm:6.1.0", {\
-        "packageLocation": "../../../.yarn/berry/cache/proc-log-npm-6.1.0-84e609b3f4-10c0.zip/node_modules/proc-log/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/proc-log-npm-6.1.0-84e609b3f4-10c0.zip/node_modules/proc-log/",\
         "packageDependencies": [\
           ["proc-log", "npm:6.1.0"]\
         ],\
@@ -836,7 +836,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["resolve-pkg-maps", [\
       ["npm:1.0.0", {\
-        "packageLocation": "../../../.yarn/berry/cache/resolve-pkg-maps-npm-1.0.0-135b70c854-10c0.zip/node_modules/resolve-pkg-maps/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/resolve-pkg-maps-npm-1.0.0-135b70c854-10c0.zip/node_modules/resolve-pkg-maps/",\
         "packageDependencies": [\
           ["resolve-pkg-maps", "npm:1.0.0"]\
         ],\
@@ -845,7 +845,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["retry", [\
       ["npm:0.13.1", {\
-        "packageLocation": "../../../.yarn/berry/cache/retry-npm-0.13.1-89eb100ab6-10c0.zip/node_modules/retry/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/retry-npm-0.13.1-89eb100ab6-10c0.zip/node_modules/retry/",\
         "packageDependencies": [\
           ["retry", "npm:0.13.1"]\
         ],\
@@ -854,7 +854,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["safer-buffer", [\
       ["npm:2.1.2", {\
-        "packageLocation": "../../../.yarn/berry/cache/safer-buffer-npm-2.1.2-8d5c0b705e-10c0.zip/node_modules/safer-buffer/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/safer-buffer-npm-2.1.2-8d5c0b705e-10c0.zip/node_modules/safer-buffer/",\
         "packageDependencies": [\
           ["safer-buffer", "npm:2.1.2"]\
         ],\
@@ -863,7 +863,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["semver", [\
       ["npm:7.7.4", {\
-        "packageLocation": "../../../.yarn/berry/cache/semver-npm-7.7.4-746e538da5-10c0.zip/node_modules/semver/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/semver-npm-7.7.4-746e538da5-10c0.zip/node_modules/semver/",\
         "packageDependencies": [\
           ["semver", "npm:7.7.4"]\
         ],\
@@ -872,7 +872,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["smart-buffer", [\
       ["npm:4.2.0", {\
-        "packageLocation": "../../../.yarn/berry/cache/smart-buffer-npm-4.2.0-5ac3f668bb-10c0.zip/node_modules/smart-buffer/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/smart-buffer-npm-4.2.0-5ac3f668bb-10c0.zip/node_modules/smart-buffer/",\
         "packageDependencies": [\
           ["smart-buffer", "npm:4.2.0"]\
         ],\
@@ -881,7 +881,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["socks", [\
       ["npm:2.8.7", {\
-        "packageLocation": "../../../.yarn/berry/cache/socks-npm-2.8.7-d1d20aae19-10c0.zip/node_modules/socks/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/socks-npm-2.8.7-d1d20aae19-10c0.zip/node_modules/socks/",\
         "packageDependencies": [\
           ["ip-address", "npm:10.1.0"],\
           ["smart-buffer", "npm:4.2.0"],\
@@ -892,7 +892,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["socks-proxy-agent", [\
       ["npm:8.0.5", {\
-        "packageLocation": "../../../.yarn/berry/cache/socks-proxy-agent-npm-8.0.5-24d77a90dc-10c0.zip/node_modules/socks-proxy-agent/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/socks-proxy-agent-npm-8.0.5-24d77a90dc-10c0.zip/node_modules/socks-proxy-agent/",\
         "packageDependencies": [\
           ["agent-base", "npm:7.1.4"],\
           ["debug", "virtual:643ed7cc338bcf145a82d8b05b3bef6bcf150ca545df386225596f10ce53cc90b88b3ca83e348ade1ccea5f3f8e76c92d2f0e2ba544da60d40aff9921c56872d#npm:4.4.3"],\
@@ -904,7 +904,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["ssri", [\
       ["npm:13.0.1", {\
-        "packageLocation": "../../../.yarn/berry/cache/ssri-npm-13.0.1-c266f2233c-10c0.zip/node_modules/ssri/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/ssri-npm-13.0.1-c266f2233c-10c0.zip/node_modules/ssri/",\
         "packageDependencies": [\
           ["minipass", "npm:7.1.3"],\
           ["ssri", "npm:13.0.1"]\
@@ -914,7 +914,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["tar", [\
       ["npm:7.5.10", {\
-        "packageLocation": "../../../.yarn/berry/cache/tar-npm-7.5.10-83147ff192-10c0.zip/node_modules/tar/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/tar-npm-7.5.10-83147ff192-10c0.zip/node_modules/tar/",\
         "packageDependencies": [\
           ["@isaacs/fs-minipass", "npm:4.0.1"],\
           ["chownr", "npm:3.0.0"],\
@@ -928,7 +928,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["tinyglobby", [\
       ["npm:0.2.15", {\
-        "packageLocation": "../../../.yarn/berry/cache/tinyglobby-npm-0.2.15-0e783aadbd-10c0.zip/node_modules/tinyglobby/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/tinyglobby-npm-0.2.15-0e783aadbd-10c0.zip/node_modules/tinyglobby/",\
         "packageDependencies": [\
           ["fdir", "virtual:0e783aadbd2b4b8e6f6056033c0b290501892d23bc7c5dad5477e00e48ad8bd3e4434c3962a52dd75a58e06dbb7218094a494bac954ef2f7f6fdb65d9717e5f4#npm:6.5.0"],\
           ["picomatch", "npm:4.0.3"],\
@@ -939,7 +939,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["tsx", [\
       ["npm:4.21.0", {\
-        "packageLocation": "../../../.yarn/berry/cache/tsx-npm-4.21.0-3bc9626d81-10c0.zip/node_modules/tsx/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/tsx-npm-4.21.0-3bc9626d81-10c0.zip/node_modules/tsx/",\
         "packageDependencies": [\
           ["esbuild", "npm:0.27.3"],\
           ["fsevents", "patch:fsevents@npm%3A2.3.3#optional!builtin<compat/fsevents>::version=2.3.3&hash=df0bf1"],\
@@ -951,7 +951,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["typescript", [\
       ["patch:typescript@npm%3A5.9.3#optional!builtin<compat/typescript>::version=5.9.3&hash=5786d5", {\
-        "packageLocation": "../../../.yarn/berry/cache/typescript-patch-6fda4d02cf-10c0.zip/node_modules/typescript/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/typescript-patch-6fda4d02cf-10c0.zip/node_modules/typescript/",\
         "packageDependencies": [\
           ["typescript", "patch:typescript@npm%3A5.9.3#optional!builtin<compat/typescript>::version=5.9.3&hash=5786d5"]\
         ],\
@@ -960,7 +960,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["undici-types", [\
       ["npm:7.16.0", {\
-        "packageLocation": "../../../.yarn/berry/cache/undici-types-npm-7.16.0-0e23b08124-10c0.zip/node_modules/undici-types/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/undici-types-npm-7.16.0-0e23b08124-10c0.zip/node_modules/undici-types/",\
         "packageDependencies": [\
           ["undici-types", "npm:7.16.0"]\
         ],\
@@ -969,7 +969,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["unique-filename", [\
       ["npm:5.0.0", {\
-        "packageLocation": "../../../.yarn/berry/cache/unique-filename-npm-5.0.0-605f54f18e-10c0.zip/node_modules/unique-filename/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/unique-filename-npm-5.0.0-605f54f18e-10c0.zip/node_modules/unique-filename/",\
         "packageDependencies": [\
           ["unique-filename", "npm:5.0.0"],\
           ["unique-slug", "npm:6.0.0"]\
@@ -979,7 +979,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["unique-slug", [\
       ["npm:6.0.0", {\
-        "packageLocation": "../../../.yarn/berry/cache/unique-slug-npm-6.0.0-f26b186e99-10c0.zip/node_modules/unique-slug/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/unique-slug-npm-6.0.0-f26b186e99-10c0.zip/node_modules/unique-slug/",\
         "packageDependencies": [\
           ["imurmurhash", "npm:0.1.4"],\
           ["unique-slug", "npm:6.0.0"]\
@@ -989,7 +989,7 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["which", [\
       ["npm:6.0.1", {\
-        "packageLocation": "../../../.yarn/berry/cache/which-npm-6.0.1-afc3b2db90-10c0.zip/node_modules/which/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/which-npm-6.0.1-afc3b2db90-10c0.zip/node_modules/which/",\
         "packageDependencies": [\
           ["isexe", "npm:4.0.0"],\
           ["which", "npm:6.0.1"]\
@@ -999,14 +999,14 @@ const RAW_RUNTIME_STATE =
     ]],\
     ["yallist", [\
       ["npm:4.0.0", {\
-        "packageLocation": "../../../.yarn/berry/cache/yallist-npm-4.0.0-b493d9e907-10c0.zip/node_modules/yallist/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/yallist-npm-4.0.0-b493d9e907-10c0.zip/node_modules/yallist/",\
         "packageDependencies": [\
           ["yallist", "npm:4.0.0"]\
         ],\
         "linkType": "HARD"\
       }],\
       ["npm:5.0.0", {\
-        "packageLocation": "../../../.yarn/berry/cache/yallist-npm-5.0.0-8732dd9f1c-10c0.zip/node_modules/yallist/",\
+        "packageLocation": "../../../../../../.yarn/berry/cache/yallist-npm-5.0.0-8732dd9f1c-10c0.zip/node_modules/yallist/",\
         "packageDependencies": [\
           ["yallist", "npm:5.0.0"]\
         ],\
@@ -6718,7 +6718,7 @@ function getPathForDisplay(p) {
   return npath.normalize(npath.fromPortablePath(p));
 }
 
-const [major, minor] = process.versions.node.split(`.`).map((value) => parseInt(value, 10));
+const [major, minor, patch] = process.versions.node.split(`.`).map((value) => parseInt(value, 10));
 const WATCH_MODE_MESSAGE_USES_ARRAYS = major > 19 || major === 19 && minor >= 2 || major === 18 && minor >= 13;
 
 function readPackageScope(checkPath) {
@@ -6753,9 +6753,9 @@ Instead change the require of ${basename} in ${parentPath} to a dynamic import()
   err.code = `ERR_REQUIRE_ESM`;
   return err;
 }
-function reportRequiredFilesToWatchMode(files) {
+function reportRequiredFilesToWatchMode(paths) {
   if (process.env.WATCH_REPORT_DEPENDENCIES && process.send) {
-    files = files.map((filename) => npath.fromPortablePath(VirtualFS.resolveVirtual(npath.toPortablePath(filename))));
+    const files = paths.map((filename) => npath.fromPortablePath(VirtualFS.resolveVirtual(filename)));
     if (WATCH_MODE_MESSAGE_USES_ARRAYS) {
       process.send({ "watch:require": files });
     } else {
@@ -8398,9 +8398,10 @@ Required by: ${issuerLocator.name}@${issuerLocator.reference} (via ${issuerForDi
     const candidates = [];
     const qualifiedPath = applyNodeExtensionResolution(unqualifiedPath, candidates, { extensions });
     if (qualifiedPath) {
+      reportRequiredFilesToWatchMode([qualifiedPath]);
       return ppath.normalize(qualifiedPath);
     } else {
-      reportRequiredFilesToWatchMode(candidates.map((candidate) => npath.fromPortablePath(candidate)));
+      reportRequiredFilesToWatchMode(candidates);
       const unqualifiedPathForDisplay = getPathForDisplay(unqualifiedPath);
       const containingPackage = findPackageLocator(unqualifiedPath);
       if (containingPackage) {

package/.pnp.loader.mjs

@@ -1428,11 +1428,12 @@ class VirtualFS extends ProxiedFS {
 
 const URL = Number(process.versions.node.split('.', 1)[0]) < 20 ? URL$1 : globalThis.URL;
 
-const [major, minor] = process.versions.node.split(`.`).map((value) => parseInt(value, 10));
+const [major, minor, patch] = process.versions.node.split(`.`).map((value) => parseInt(value, 10));
 const WATCH_MODE_MESSAGE_USES_ARRAYS = major > 19 || major === 19 && minor >= 2 || major === 18 && minor >= 13;
 const HAS_LAZY_LOADED_TRANSLATORS = major === 20 && minor < 6 || major === 19 && minor >= 3;
 const SUPPORTS_IMPORT_ATTRIBUTES = major >= 21 || major === 20 && minor >= 10 || major === 18 && minor >= 20;
 const SUPPORTS_IMPORT_ATTRIBUTES_ONLY = major >= 22;
+const HAS_BROKEN_FSTAT_FOR_ZIP_FDS = major === 26 && minor < 1 || major === 25 && minor >= 7 || major === 24 && minor === 15 || major === 22 && (minor > 22 || minor === 22 && patch >= 3);
 
 function readPackageScope(checkPath) {
   const rootSeparatorIndex = checkPath.indexOf(npath.sep);
@@ -1549,9 +1550,11 @@ async function load$1(urlString, context, nextLoad) {
       "watch:import": WATCH_MODE_MESSAGE_USES_ARRAYS ? [pathToSend] : pathToSend
     });
   }
+  const shouldReadSource = format === `commonjs` && HAS_BROKEN_FSTAT_FOR_ZIP_FDS && filePath.includes(`.zip/`);
+  const source = format !== `commonjs` || shouldReadSource ? await fs.promises.readFile(filePath, `utf8`) : void 0;
   return {
     format,
-    source: format === `commonjs` ? void 0 : await fs.promises.readFile(filePath, `utf8`),
+    source,
     shortCircuit: true
   };
 }

package/README.md

@@ -48,6 +48,10 @@ edge-cli login
 
 This opens your browser to the admin sign-in page. After signing in, tokens are saved to `~/.edge-cli-auth/accounts.json`.
 
+Login creates **two** sessions from the one sign-in: a shell session that drives `edge-cli shell`, and an API-only session that `edge-cli token` prints. Token scope is fixed when the session is created and a refresh re-derives it from the session, so a shell token cannot be narrowed afterwards — the second session is what makes an API-only token possible without a second sign-in.
+
+Prefer the API-only token anywhere a token leaves the CLI (Postman, scripts, a colleague's terminal): a `--scope shell` token can run any shell command your account is allowed to, against whatever environment it was issued for. If you logged in before this existed, `edge-cli token` will tell you to log in again rather than hand back the shell-capable one.
+
 ```bash
 edge-cli login:list          # see saved accounts
 edge-cli login:use <email>   # switch default account
@@ -65,9 +69,10 @@ edge-cli health-check
 edge-cli config
 
 # Get an API token (useful for Postman or curl)
-edge-cli token
-edge-cli token --refresh     # force token refresh
-edge-cli token --header      # print as Authorization header
+edge-cli token                    # API-only token (aud: edge-api)
+edge-cli token --scope shell      # also carries edge-shell; can run shell commands
+edge-cli token --refresh          # force token refresh
+edge-cli token --header           # print as Authorization header
 
 # Run a shell command
 edge-cli shell "<command>"

package/dist/commands/token.js

@@ -3,17 +3,28 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerToken = registerToken;
 const auth_1 = require("../lib/auth");
 const config_1 = require("../lib/config");
+const SCOPES = ["api", "shell"];
 function registerToken(program) {
     program
         .command("token")
         .description("Print a JWT access token for API calls (e.g. Postman)")
         .option("--refresh", "Force refresh using refresh token when available")
         .option("--header", "Print as Authorization header line")
+        .option("--scope <scope>", `Which token to print: ${SCOPES.join(" | ")}. 'api' carries the edge-api audience only; ` +
+        `'shell' also carries edge-shell and can run shell commands`, "api")
         .action(async function tokenAction(commandOptions) {
         const parent = this.parent;
         const opts = (parent?.opts() ?? {});
         const cfg = await (0, config_1.resolveEffectiveConfig)(opts);
-        const token = await (0, auth_1.resolveAccessToken)(cfg, Boolean(commandOptions.refresh));
+        const requested = (commandOptions.scope ?? "api").toLowerCase();
+        if (!SCOPES.includes(requested)) {
+            // Refused rather than defaulted: printing a token of a scope nobody asked for is
+            // how a shell-capable credential ends up somewhere it was never meant to go.
+            throw new Error(`Unknown --scope: ${commandOptions.scope} (expected ${SCOPES.join(" or ")})`);
+        }
+        const token = requested === "shell"
+            ? await (0, auth_1.resolveAccessToken)(cfg, Boolean(commandOptions.refresh))
+            : await (0, auth_1.resolveApiAccessToken)(cfg, Boolean(commandOptions.refresh));
         if (commandOptions.header) {
             process.stdout.write(`Authorization: Bearer ${token}\n`);
             return;

package/dist/lib/auth.js

@@ -8,6 +8,7 @@ exports.setDefaultLogin = setDefaultLogin;
 exports.logout = logout;
 exports.login = login;
 exports.resolveAccessToken = resolveAccessToken;
+exports.resolveApiAccessToken = resolveApiAccessToken;
 exports.resolveAuthHeader = resolveAuthHeader;
 exports.resolveAuthHeaderFast = resolveAuthHeaderFast;
 const node_fs_1 = __importDefault(require("node:fs"));
@@ -45,6 +46,16 @@ const DEFAULT_DEVICE_NAME = "edge-cli";
  * exchange.
  */
 const EXCHANGE_SCOPE_SHELL = "shell";
+/**
+ * The app scope is the *absence* of a scope field -- `TokenScope.fromWire` maps blank to `APP` --
+ * so an API-only session is requested by omitting it, not by sending a name for it.
+ *
+ * `null`, never `undefined`: a default parameter fires when an argument is `undefined`, so passing
+ * an `undefined` sentinel to `authExchangeFirebaseToken` silently selected the shell default and
+ * every "API-only" session came back with the `edge-shell` audience. `f(null)` does not trigger the
+ * default.
+ */
+const EXCHANGE_SCOPE_APP = null;
 function scopeKey(cfg) {
     return `${cfg.product}/${cfg.env}`;
 }
@@ -124,6 +135,24 @@ function decodeJwtPayload(token) {
         return {};
     }
 }
+/**
+ * The extra audience `TokenScope.SHELL` stamps. Matched by name rather than by "anything that is
+ * not the API audience", because the API audience is server-configurable (`api.jwt.audience`) and
+ * the CLI cannot know what it was set to.
+ */
+const SHELL_AUDIENCE = "edge-shell";
+/**
+ * Whether a token can drive the shell.
+ *
+ * Read from the token rather than inferred from what was requested. Asking for an app-scoped
+ * session and checking nothing is how every "API-only" token shipped carrying `edge-shell`: the
+ * exchange succeeded, so nothing looked wrong, and the CLI handed out shell credentials for a day.
+ */
+function carriesShellAudience(accessToken) {
+    const aud = decodeJwtPayload(accessToken).aud;
+    const list = Array.isArray(aud) ? aud : typeof aud === "string" ? [aud] : [];
+    return list.some((entry) => entry === SHELL_AUDIENCE);
+}
 function extractEmailFromToken(accessToken) {
     const payload = decodeJwtPayload(accessToken);
     const email = payload.email;
@@ -151,12 +180,12 @@ async function requestTokenEndpoint(cfg, endpoint, payload) {
     }
     return (await response.json());
 }
-async function authExchangeFirebaseToken(cfg, firebaseToken) {
+async function authExchangeFirebaseToken(cfg, firebaseToken, scope = EXCHANGE_SCOPE_SHELL) {
     const resp = await requestTokenEndpoint(cfg, "exchange", {
         firebaseToken,
         deviceId: authDeviceId(),
         deviceName: DEFAULT_DEVICE_NAME,
-        scope: EXCHANGE_SCOPE_SHELL
+        ...(scope === null ? {} : { scope })
     });
     if (!resp?.accessToken) {
         throw new Error("Token exchange did not return accessToken");
@@ -222,9 +251,14 @@ async function logout(cfg, email) {
     if (!account) {
         throw new Error(`Account not found for ${cfg.product}/${cfg.env}: ${target}`);
     }
-    if (account.refreshToken) {
+    // Both sessions, or logout leaves the API-only one alive on the server after the CLI has
+    // forgotten it -- a session nobody can see and nobody will revoke.
+    for (const refreshToken of [account.refreshToken, account.api?.refreshToken]) {
+        if (!refreshToken) {
+            continue;
+        }
         try {
-            await authLogoutRefreshToken(cfg, account.refreshToken);
+            await authLogoutRefreshToken(cfg, refreshToken);
         }
         catch {
             // best effort
@@ -238,19 +272,44 @@ async function logout(cfg, email) {
     writeDb(db);
     return target;
 }
-function storeTokens(cfg, email, tokenResp) {
-    const db = readDb();
-    const scope = getScope(db, cfg);
-    const now = nowEpoch();
-    scope.accounts[email] = {
+function toSession(tokenResp, now) {
+    return {
         accessToken: tokenResp.accessToken,
         refreshToken: tokenResp.refreshToken,
         accessExpEpoch: now + (tokenResp.accessTokenExpiresInSec ?? 0),
         refreshExpEpoch: tokenResp.refreshToken ? now + (tokenResp.refreshTokenExpiresInSec ?? 0) : 0
     };
+}
+/**
+ * @param apiResp the API-only session, when this call has a fresh one. Omitted on a shell refresh,
+ *     which must leave any existing `api` session in place -- rewriting the account wholesale would
+ *     silently drop it and send `edge-cli token` back to "run login again" after every refresh.
+ */
+function storeTokens(cfg, email, tokenResp, apiResp) {
+    const db = readDb();
+    const scope = getScope(db, cfg);
+    const now = nowEpoch();
+    const existingApi = scope.accounts[email]?.api;
+    scope.accounts[email] = {
+        ...toSession(tokenResp, now),
+        api: apiResp ? toSession(apiResp, now) : existingApi
+    };
     scope.default = email;
     writeDb(db);
 }
+/**
+ * Replace only the API session, leaving the shell session untouched.
+ */
+function storeApiTokens(cfg, email, apiResp) {
+    const db = readDb();
+    const scope = getScope(db, cfg);
+    const account = scope.accounts[email];
+    if (!account) {
+        return;
+    }
+    account.api = toSession(apiResp, nowEpoch());
+    writeDb(db);
+}
 function parseCallbackQuery(queryString) {
     const query = queryString.startsWith("?") ? queryString.slice(1) : queryString;
     const params = new URLSearchParams(query);
@@ -401,8 +460,13 @@ async function login(cfg) {
         throw new Error("Authentication callback returned code-based response, exchange not implemented.");
     }
     let tokenResp;
+    // Kept so the API-only session can be exchanged from the same credential below. The
+    // already-first-party branch leaves it undefined: there is no Firebase token to re-exchange,
+    // so that path yields a shell session only.
+    let firebaseToken;
     if (parsed.firebaseToken) {
-        tokenResp = await authExchangeFirebaseToken(cfg, parsed.firebaseToken);
+        firebaseToken = parsed.firebaseToken;
+        tokenResp = await authExchangeFirebaseToken(cfg, firebaseToken);
     }
     else if (parsed.accessToken && parsed.refreshToken) {
         // Already a first-party pair; nothing to exchange.
@@ -415,15 +479,47 @@ async function login(cfg) {
     }
     else if (parsed.accessToken) {
         // No refresh token alongside it means this is the console's `?jwt=` Firebase token.
-        tokenResp = await exchangeCallbackToken(cfg, parsed.accessToken);
+        firebaseToken = parsed.accessToken;
+        tokenResp = await exchangeCallbackToken(cfg, firebaseToken);
     }
     if (!tokenResp?.accessToken) {
         throw new Error("Authentication callback did not include usable token data.");
     }
     const email = parsed.email ?? extractEmailFromToken(tokenResp.accessToken);
-    storeTokens(cfg, email, tokenResp);
+    storeTokens(cfg, email, tokenResp, await exchangeApiSession(cfg, firebaseToken));
     return email;
 }
+/**
+ * Exchange the same Firebase token a second time for an API-only session.
+ *
+ * Failure is reported and swallowed rather than failing the login: the shell session -- the reason
+ * anyone runs this CLI -- already succeeded by this point, and taking the whole login down over the
+ * optional half would turn a working setup into a broken one. `edge-cli token` says what to do when
+ * the session is missing.
+ */
+async function exchangeApiSession(cfg, firebaseToken) {
+    if (!firebaseToken) {
+        return undefined;
+    }
+    try {
+        const resp = await authExchangeFirebaseToken(cfg, firebaseToken, EXCHANGE_SCOPE_APP);
+        if (carriesShellAudience(resp.accessToken)) {
+            // Storing it would put a shell-capable token behind `edge-cli token`, which is the one
+            // outcome this whole feature exists to prevent. Better no API session than a mislabelled
+            // one.
+            process.stderr.write("Warning: the server returned a shell-scoped token for an app-scoped exchange; " +
+                "discarding it.\n'edge-cli token' will need --scope shell until this is resolved.\n");
+            return undefined;
+        }
+        return resp;
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`Warning: could not create an API-only session (${reason}).\n` +
+            `'edge-cli token' will need --scope shell until the next successful login.\n`);
+        return undefined;
+    }
+}
 async function validateAccessToken(cfg, accessToken) {
     const url = new URL(`${cfg.baseUrl.replace(/\/$/, "")}/shell`);
     url.searchParams.set("cmd", "help");
@@ -496,6 +592,60 @@ async function resolveAccessToken(cfg, forceRefresh = false, skipValidate = fals
     }
     return accessToken;
 }
+/**
+ * The account's API-only access token, refreshed when it is at or near expiry.
+ *
+ * Deliberately does no liveness probe. `validateAccessToken` asks `GET /shell?cmd=help`, which this
+ * token is *supposed* to be refused by -- running it here would read a correctly-scoped token as a
+ * broken one and refresh it on every call.
+ *
+ * A missing API session is an error rather than a silent fall back to the shell token: handing back
+ * a token with more audiences than the caller asked for is the same silent substitution the server
+ * refuses when it will not downgrade a shell request to APP.
+ */
+async function resolveApiAccessToken(cfg, forceRefresh = false) {
+    const db = readDb();
+    const scope = getScope(db, cfg);
+    const email = scope.default;
+    if (!email) {
+        throw new Error(`No JWT session for ${cfg.product}/${cfg.env}. Run 'edge-cli login'.`);
+    }
+    const account = scope.accounts[email];
+    if (!account) {
+        throw new Error(`No access token for ${email}. Run 'edge-cli login'.`);
+    }
+    const api = account.api;
+    if (!api?.accessToken) {
+        throw new Error(`No API-only session for ${email} on ${cfg.product}/${cfg.env}.\n` +
+            `Run 'edge-cli login' to create one, or 'edge-cli token --scope shell' to print the ` +
+            `shell-capable token instead (it also drives the shell, so do not paste it elsewhere).`);
+    }
+    // Checked on read, not only on write, so a session stored by a build that asked for the wrong
+    // scope is refused rather than handed out. Those tokens are already on disk in the wild.
+    if (carriesShellAudience(api.accessToken)) {
+        throw new Error(`The stored API session for ${email} carries the ${SHELL_AUDIENCE} audience, so it is ` +
+            `not API-only. Run 'edge-cli login' to replace it.`);
+    }
+    const expiry = api.accessExpEpoch ?? 0;
+    const stale = expiry > 0 && expiry <= nowEpoch() + 60;
+    if ((forceRefresh || stale) && api.refreshToken) {
+        try {
+            const refreshed = await authRefreshToken(cfg, api.refreshToken);
+            const merged = {
+                accessToken: refreshed.accessToken,
+                refreshToken: refreshed.refreshToken || api.refreshToken,
+                accessTokenExpiresInSec: refreshed.accessTokenExpiresInSec,
+                refreshTokenExpiresInSec: refreshed.refreshTokenExpiresInSec
+            };
+            storeApiTokens(cfg, email, merged);
+            return merged.accessToken;
+        }
+        catch {
+            // Fall through to the stored token; it may still have life left in it.
+        }
+    }
+    return api.accessToken;
+}
 async function resolveAuthHeader(cfg) {
     const accessToken = await resolveAccessToken(cfg);
     return `Bearer ${accessToken}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@youkno/edge-cli",
-  "version": "1.21.316",
+  "version": "1.21.317",
   "description": "Cross-platform Edge CLI",
   "bin": "dist/index.js",
   "publishConfig": {

package/src/commands/token.ts

@@ -1,20 +1,43 @@
 import { Command } from "commander";
 
-import { resolveAccessToken } from "../lib/auth";
+import { resolveAccessToken, resolveApiAccessToken } from "../lib/auth";
 import { resolveEffectiveConfig } from "../lib/config";
 import { CliOptions } from "../lib/types";
 
+const SCOPES = ["api", "shell"] as const;
+type TokenScope = (typeof SCOPES)[number];
+
 export function registerToken(program: Command): void {
     program
         .command("token")
         .description("Print a JWT access token for API calls (e.g. Postman)")
         .option("--refresh", "Force refresh using refresh token when available")
         .option("--header", "Print as Authorization header line")
-        .action(async function tokenAction(this: Command, commandOptions: { refresh?: boolean; header?: boolean }) {
+        .option(
+            "--scope <scope>",
+            `Which token to print: ${SCOPES.join(" | ")}. 'api' carries the edge-api audience only; ` +
+                `'shell' also carries edge-shell and can run shell commands`,
+            "api"
+        )
+        .action(async function tokenAction(
+            this: Command,
+            commandOptions: { refresh?: boolean; header?: boolean; scope?: string }
+        ) {
             const parent = this.parent;
             const opts = (parent?.opts() ?? {}) as CliOptions;
             const cfg = await resolveEffectiveConfig(opts);
-            const token = await resolveAccessToken(cfg, Boolean(commandOptions.refresh));
+
+            const requested = (commandOptions.scope ?? "api").toLowerCase();
+            if (!SCOPES.includes(requested as TokenScope)) {
+                // Refused rather than defaulted: printing a token of a scope nobody asked for is
+                // how a shell-capable credential ends up somewhere it was never meant to go.
+                throw new Error(`Unknown --scope: ${commandOptions.scope} (expected ${SCOPES.join(" or ")})`);
+            }
+
+            const token =
+                requested === "shell"
+                    ? await resolveAccessToken(cfg, Boolean(commandOptions.refresh))
+                    : await resolveApiAccessToken(cfg, Boolean(commandOptions.refresh));
 
             if (commandOptions.header) {
                 process.stdout.write(`Authorization: Bearer ${token}\n`);

package/src/lib/auth.ts

@@ -38,13 +38,40 @@ const DEFAULT_DEVICE_NAME = "edge-cli";
  */
 const EXCHANGE_SCOPE_SHELL = "shell";
 
-type AuthAccount = {
+/**
+ * The app scope is the *absence* of a scope field -- `TokenScope.fromWire` maps blank to `APP` --
+ * so an API-only session is requested by omitting it, not by sending a name for it.
+ *
+ * `null`, never `undefined`: a default parameter fires when an argument is `undefined`, so passing
+ * an `undefined` sentinel to `authExchangeFirebaseToken` silently selected the shell default and
+ * every "API-only" session came back with the `edge-shell` audience. `f(null)` does not trigger the
+ * default.
+ */
+const EXCHANGE_SCOPE_APP = null;
+
+type AuthSession = {
     accessToken: string;
     refreshToken?: string;
     accessExpEpoch?: number;
     refreshExpEpoch?: number;
 };
 
+type AuthAccount = AuthSession & {
+    /**
+     * A second session exchanged at login with no scope, so its tokens carry only the `edge-api`
+     * audience while the account's main session carries `edge-shell` as well.
+     *
+     * Two sessions rather than one downgraded token because scope is fixed at exchange time and
+     * persisted on `user_session.scope`; refresh re-derives it from the session and ignores the
+     * request, so a shell token cannot be narrowed after the fact. Both exchanges reuse the one
+     * Firebase token the callback delivered, so this costs an HTTP call rather than a second login.
+     *
+     * Optional: accounts stored before this existed have no `api` session, and `edge-cli token`
+     * says so rather than quietly handing back the shell-capable one.
+     */
+    api?: AuthSession;
+};
+
 type ScopeData = {
     default?: string;
     accounts: Record<string, AuthAccount>;
@@ -149,6 +176,26 @@ function decodeJwtPayload(token: string): Record<string, unknown> {
     }
 }
 
+/**
+ * The extra audience `TokenScope.SHELL` stamps. Matched by name rather than by "anything that is
+ * not the API audience", because the API audience is server-configurable (`api.jwt.audience`) and
+ * the CLI cannot know what it was set to.
+ */
+const SHELL_AUDIENCE = "edge-shell";
+
+/**
+ * Whether a token can drive the shell.
+ *
+ * Read from the token rather than inferred from what was requested. Asking for an app-scoped
+ * session and checking nothing is how every "API-only" token shipped carrying `edge-shell`: the
+ * exchange succeeded, so nothing looked wrong, and the CLI handed out shell credentials for a day.
+ */
+function carriesShellAudience(accessToken: string): boolean {
+    const aud = decodeJwtPayload(accessToken).aud;
+    const list = Array.isArray(aud) ? aud : typeof aud === "string" ? [aud] : [];
+    return list.some((entry) => entry === SHELL_AUDIENCE);
+}
+
 function extractEmailFromToken(accessToken: string): string {
     const payload = decodeJwtPayload(accessToken);
     const email = payload.email;
@@ -185,12 +232,16 @@ async function requestTokenEndpoint(
     return (await response.json()) as TokenResponse;
 }
 
-async function authExchangeFirebaseToken(cfg: EffectiveConfig, firebaseToken: string): Promise<TokenResponse> {
+async function authExchangeFirebaseToken(
+    cfg: EffectiveConfig,
+    firebaseToken: string,
+    scope: string | null = EXCHANGE_SCOPE_SHELL
+): Promise<TokenResponse> {
     const resp = await requestTokenEndpoint(cfg, "exchange", {
         firebaseToken,
         deviceId: authDeviceId(),
         deviceName: DEFAULT_DEVICE_NAME,
-        scope: EXCHANGE_SCOPE_SHELL
+        ...(scope === null ? {} : { scope })
     });
     if (!resp?.accessToken) {
         throw new Error("Token exchange did not return accessToken");
@@ -261,9 +312,14 @@ export async function logout(cfg: EffectiveConfig, email?: string): Promise<stri
         throw new Error(`Account not found for ${cfg.product}/${cfg.env}: ${target}`);
     }
 
-    if (account.refreshToken) {
+    // Both sessions, or logout leaves the API-only one alive on the server after the CLI has
+    // forgotten it -- a session nobody can see and nobody will revoke.
+    for (const refreshToken of [account.refreshToken, account.api?.refreshToken]) {
+        if (!refreshToken) {
+            continue;
+        }
         try {
-            await authLogoutRefreshToken(cfg, account.refreshToken);
+            await authLogoutRefreshToken(cfg, refreshToken);
         } catch {
             // best effort
         }
@@ -278,21 +334,53 @@ export async function logout(cfg: EffectiveConfig, email?: string): Promise<stri
     return target;
 }
 
-function storeTokens(cfg: EffectiveConfig, email: string, tokenResp: TokenResponse): void {
+function toSession(tokenResp: TokenResponse, now: number): AuthSession {
+    return {
+        accessToken: tokenResp.accessToken,
+        refreshToken: tokenResp.refreshToken,
+        accessExpEpoch: now + (tokenResp.accessTokenExpiresInSec ?? 0),
+        refreshExpEpoch: tokenResp.refreshToken ? now + (tokenResp.refreshTokenExpiresInSec ?? 0) : 0
+    };
+}
+
+/**
+ * @param apiResp the API-only session, when this call has a fresh one. Omitted on a shell refresh,
+ *     which must leave any existing `api` session in place -- rewriting the account wholesale would
+ *     silently drop it and send `edge-cli token` back to "run login again" after every refresh.
+ */
+function storeTokens(
+    cfg: EffectiveConfig,
+    email: string,
+    tokenResp: TokenResponse,
+    apiResp?: TokenResponse
+): void {
     const db = readDb();
     const scope = getScope(db, cfg);
     const now = nowEpoch();
+    const existingApi = scope.accounts[email]?.api;
 
     scope.accounts[email] = {
-        accessToken: tokenResp.accessToken,
-        refreshToken: tokenResp.refreshToken,
-        accessExpEpoch: now + (tokenResp.accessTokenExpiresInSec ?? 0),
-        refreshExpEpoch: tokenResp.refreshToken ? now + (tokenResp.refreshTokenExpiresInSec ?? 0) : 0
+        ...toSession(tokenResp, now),
+        api: apiResp ? toSession(apiResp, now) : existingApi
     };
     scope.default = email;
     writeDb(db);
 }
 
+/**
+ * Replace only the API session, leaving the shell session untouched.
+ */
+function storeApiTokens(cfg: EffectiveConfig, email: string, apiResp: TokenResponse): void {
+    const db = readDb();
+    const scope = getScope(db, cfg);
+    const account = scope.accounts[email];
+    if (!account) {
+        return;
+    }
+    account.api = toSession(apiResp, nowEpoch());
+    writeDb(db);
+}
+
 function parseCallbackQuery(queryString: string): {
     email?: string;
     accessToken?: string;
@@ -464,8 +552,13 @@ export async function login(cfg: EffectiveConfig): Promise<string> {
     }
 
     let tokenResp: TokenResponse | undefined;
+    // Kept so the API-only session can be exchanged from the same credential below. The
+    // already-first-party branch leaves it undefined: there is no Firebase token to re-exchange,
+    // so that path yields a shell session only.
+    let firebaseToken: string | undefined;
     if (parsed.firebaseToken) {
-        tokenResp = await authExchangeFirebaseToken(cfg, parsed.firebaseToken);
+        firebaseToken = parsed.firebaseToken;
+        tokenResp = await authExchangeFirebaseToken(cfg, firebaseToken);
     } else if (parsed.accessToken && parsed.refreshToken) {
         // Already a first-party pair; nothing to exchange.
         tokenResp = {
@@ -476,7 +569,8 @@ export async function login(cfg: EffectiveConfig): Promise<string> {
         };
     } else if (parsed.accessToken) {
         // No refresh token alongside it means this is the console's `?jwt=` Firebase token.
-        tokenResp = await exchangeCallbackToken(cfg, parsed.accessToken);
+        firebaseToken = parsed.accessToken;
+        tokenResp = await exchangeCallbackToken(cfg, firebaseToken);
     }
 
     if (!tokenResp?.accessToken) {
@@ -484,10 +578,48 @@ export async function login(cfg: EffectiveConfig): Promise<string> {
     }
 
     const email = parsed.email ?? extractEmailFromToken(tokenResp.accessToken);
-    storeTokens(cfg, email, tokenResp);
+    storeTokens(cfg, email, tokenResp, await exchangeApiSession(cfg, firebaseToken));
     return email;
 }
 
+/**
+ * Exchange the same Firebase token a second time for an API-only session.
+ *
+ * Failure is reported and swallowed rather than failing the login: the shell session -- the reason
+ * anyone runs this CLI -- already succeeded by this point, and taking the whole login down over the
+ * optional half would turn a working setup into a broken one. `edge-cli token` says what to do when
+ * the session is missing.
+ */
+async function exchangeApiSession(
+    cfg: EffectiveConfig,
+    firebaseToken: string | undefined
+): Promise<TokenResponse | undefined> {
+    if (!firebaseToken) {
+        return undefined;
+    }
+    try {
+        const resp = await authExchangeFirebaseToken(cfg, firebaseToken, EXCHANGE_SCOPE_APP);
+        if (carriesShellAudience(resp.accessToken)) {
+            // Storing it would put a shell-capable token behind `edge-cli token`, which is the one
+            // outcome this whole feature exists to prevent. Better no API session than a mislabelled
+            // one.
+            process.stderr.write(
+                "Warning: the server returned a shell-scoped token for an app-scoped exchange; " +
+                "discarding it.\n'edge-cli token' will need --scope shell until this is resolved.\n"
+            );
+            return undefined;
+        }
+        return resp;
+    } catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        process.stderr.write(
+            `Warning: could not create an API-only session (${reason}).\n` +
+            `'edge-cli token' will need --scope shell until the next successful login.\n`
+        );
+        return undefined;
+    }
+}
+
 async function validateAccessToken(cfg: EffectiveConfig, accessToken: string): Promise<boolean> {
     const url = new URL(`${cfg.baseUrl.replace(/\/$/, "")}/shell`);
     url.searchParams.set("cmd", "help");
@@ -569,6 +701,67 @@ export async function resolveAccessToken(cfg: EffectiveConfig, forceRefresh = fa
     return accessToken;
 }
 
+/**
+ * The account's API-only access token, refreshed when it is at or near expiry.
+ *
+ * Deliberately does no liveness probe. `validateAccessToken` asks `GET /shell?cmd=help`, which this
+ * token is *supposed* to be refused by -- running it here would read a correctly-scoped token as a
+ * broken one and refresh it on every call.
+ *
+ * A missing API session is an error rather than a silent fall back to the shell token: handing back
+ * a token with more audiences than the caller asked for is the same silent substitution the server
+ * refuses when it will not downgrade a shell request to APP.
+ */
+export async function resolveApiAccessToken(cfg: EffectiveConfig, forceRefresh = false): Promise<string> {
+    const db = readDb();
+    const scope = getScope(db, cfg);
+    const email = scope.default;
+    if (!email) {
+        throw new Error(`No JWT session for ${cfg.product}/${cfg.env}. Run 'edge-cli login'.`);
+    }
+    const account = scope.accounts[email];
+    if (!account) {
+        throw new Error(`No access token for ${email}. Run 'edge-cli login'.`);
+    }
+    const api = account.api;
+    if (!api?.accessToken) {
+        throw new Error(
+            `No API-only session for ${email} on ${cfg.product}/${cfg.env}.\n` +
+            `Run 'edge-cli login' to create one, or 'edge-cli token --scope shell' to print the ` +
+            `shell-capable token instead (it also drives the shell, so do not paste it elsewhere).`
+        );
+    }
+
+    // Checked on read, not only on write, so a session stored by a build that asked for the wrong
+    // scope is refused rather than handed out. Those tokens are already on disk in the wild.
+    if (carriesShellAudience(api.accessToken)) {
+        throw new Error(
+            `The stored API session for ${email} carries the ${SHELL_AUDIENCE} audience, so it is ` +
+            `not API-only. Run 'edge-cli login' to replace it.`
+        );
+    }
+
+    const expiry = api.accessExpEpoch ?? 0;
+    const stale = expiry > 0 && expiry <= nowEpoch() + 60;
+    if ((forceRefresh || stale) && api.refreshToken) {
+        try {
+            const refreshed = await authRefreshToken(cfg, api.refreshToken);
+            const merged: TokenResponse = {
+                accessToken: refreshed.accessToken,
+                refreshToken: refreshed.refreshToken || api.refreshToken,
+                accessTokenExpiresInSec: refreshed.accessTokenExpiresInSec,
+                refreshTokenExpiresInSec: refreshed.refreshTokenExpiresInSec
+            };
+            storeApiTokens(cfg, email, merged);
+            return merged.accessToken;
+        } catch {
+            // Fall through to the stored token; it may still have life left in it.
+        }
+    }
+
+    return api.accessToken;
+}
+
 export async function resolveAuthHeader(cfg: EffectiveConfig): Promise<string> {
     const accessToken = await resolveAccessToken(cfg);
     return `Bearer ${accessToken}`;