@ze-norm/cli 0.13.0 → 0.14.1

package/dist/api/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAyBA,kFAAkF;AAClF,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA0BD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAAS;IAIxB,OAAO,CAAC,aAAa,CAAgB;gBAEzB,IAAI,CAAC,EAAE,gBAAgB;IAKnC,wEAAwE;YAC1D,mBAAmB;IAMjC,OAAO,CAAC,YAAY;IA0BpB,OAAO,CAAC,cAAc;IAStB,2EAA2E;IAC3E,gBAAgB,IAAI,OAAO;IAI3B,uEAAuE;IACvE,qBAAqB,IAAI,OAAO;IAQhC,OAAO,CAAC,2BAA2B;YAIrB,QAAQ;YAqBR,OAAO;IAqEf,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIjD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhD,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIlD,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIzC;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;CAG7C"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AA0BA,kFAAkF;AAClF,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAiCD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAAS;IAIxB,OAAO,CAAC,aAAa,CAAgB;gBAEzB,IAAI,CAAC,EAAE,gBAAgB;IAKnC,wEAAwE;YAC1D,mBAAmB;IAMjC,OAAO,CAAC,YAAY;IA0BpB,OAAO,CAAC,cAAc;IAStB,2EAA2E;IAC3E,gBAAgB,IAAI,OAAO;IAI3B,uEAAuE;IACvE,qBAAqB,IAAI,OAAO;IAYhC,OAAO,CAAC,2BAA2B;YAIrB,QAAQ;YAqBR,OAAO;IAqEf,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIjD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhD,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIlD,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIzC;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;CAG7C"}

package/dist/api/client.js

@@ -3,6 +3,7 @@ import { join } from "node:path";
 import { ApiError, AuthError, UpgradeRequiredError } from "../util/errors.js";
 import { forceRefreshToken, hasRefreshableCredentials, resolveValidToken, } from "../auth/store.js";
 import { PRODUCTION_API_URL } from "../config/defaults.js";
+import { resolveEnvironment, ZENORM_CLI_ENV_VAR } from "../config/environments.js";
 import { getCliVersion } from "../util/package.js";
 import { log } from "../util/logger.js";
 const UPGRADE_COMMAND = "npm install -g @ze-norm/cli@latest";
@@ -23,11 +24,17 @@ function resolveBaseUrl(explicit) {
     // 1. Explicit option
     if (explicit)
         return explicit;
-    // 2. Environment variable
+    // 2. Named environment via ZENORM_CLI. A selected environment is an explicit
+    //    "talk to this stack" intent, so its API URL wins over a stray
+    //    ZENORM_API_URL / .zenorm.json left over from another workflow.
+    if (process.env[ZENORM_CLI_ENV_VAR]) {
+        return resolveEnvironment().apiUrl;
+    }
+    // 3. Environment variable
     const envUrl = process.env["ZENORM_API_URL"];
     if (envUrl)
         return envUrl;
-    // 3. .zenorm.json config file in cwd
+    // 4. .zenorm.json config file in cwd
     const configPath = join(process.cwd(), ".zenorm.json");
     if (existsSync(configPath)) {
         const raw = readFileSync(configPath, "utf-8");
@@ -35,7 +42,7 @@ function resolveBaseUrl(explicit) {
         if (config.apiUrl)
             return config.apiUrl;
     }
-    // 4. Public CLI default
+    // 5. Public CLI default
     return PRODUCTION_API_URL;
 }
 export class ZenormClient {
@@ -95,9 +102,12 @@ export class ZenormClient {
     }
     /** True when requests will intentionally ignore stored credentials. */
     isUsingLocalDevBypass() {
-        return (this.isLocalBaseUrl() &&
-            process.env["ZENORM_LOCAL_DEV_BYPASS_AUTH"] === "true" &&
-            !process.env["ZENORM_API_TOKEN"]);
+        // Selecting the `local` environment implies dev-bypass — that is what the
+        // local stack is (no real Clerk sign-in, dev-bypass headers). An explicit
+        // ZENORM_LOCAL_DEV_BYPASS_AUTH still enables it for a raw localhost URL.
+        const bypassEnabled = process.env["ZENORM_LOCAL_DEV_BYPASS_AUTH"] === "true" ||
+            resolveEnvironment().name === "local";
+        return (this.isLocalBaseUrl() && bypassEnabled && !process.env["ZENORM_API_TOKEN"]);
     }
     shouldBypassAuthForLocalDev() {
         return this.isUsingLocalDevBypass();

package/dist/auth/device-flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../../src/auth/device-flow.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAkUpD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CAuBD;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAkDpE"}
+{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../../src/auth/device-flow.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AA6UpD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CAuBD;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAkDpE"}

package/dist/auth/device-flow.js

@@ -5,6 +5,7 @@ import { platform } from "node:os";
 import { URL, URLSearchParams } from "node:url";
 import { log } from "../util/logger.js";
 import { CLI_CALLBACK_PORTS, PRODUCTION_CLERK_CLIENT_ID, PRODUCTION_CLERK_ISSUER, } from "../config/defaults.js";
+import { resolveEnvironment, ZENORM_CLI_ENV_VAR } from "../config/environments.js";
 /**
  * Find the first pre-registered callback port that is free to bind. Clerk
  * matches redirect_uris exactly, so the local listener must use one of the
@@ -26,6 +27,11 @@ async function pickFreeCallbackPort() {
         `Free one of them and run \`zenorm login\` again.`);
 }
 function getClerkIssuer() {
+    // A named environment (ZENORM_CLI) selects the whole Clerk instance, so it
+    // wins over a stray ZENORM_CLERK_ISSUER from another workflow.
+    if (process.env[ZENORM_CLI_ENV_VAR]) {
+        return resolveEnvironment().clerkIssuer;
+    }
     return process.env["ZENORM_CLERK_ISSUER"] ?? PRODUCTION_CLERK_ISSUER;
 }
 /** Escape user-influenced text before interpolating into the result page HTML. */
@@ -38,6 +44,11 @@ function escapeHtml(value) {
         .replace(/'/g, "'");
 }
 function getClerkClientId() {
+    // A named environment (ZENORM_CLI) selects the whole Clerk instance, so it
+    // wins over stray ZENORM_CLERK_CLIENT_ID / VITE_CLERK_PUBLISHABLE_KEY vars.
+    if (process.env[ZENORM_CLI_ENV_VAR]) {
+        return resolveEnvironment().clerkClientId;
+    }
     return (process.env["ZENORM_CLERK_CLIENT_ID"] ??
         process.env["VITE_CLERK_PUBLISHABLE_KEY"] ??
         PRODUCTION_CLERK_CLIENT_ID);

package/dist/auth/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAaD,wBAAgB,eAAe,IAAI,iBAAiB,GAAG,IAAI,CAO1D;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAM9D;AAED,wBAAgB,iBAAiB,IAAI,OAAO,CAO3C;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAU5C;AAWD;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwBhE;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,OAAO,CAInD;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,CAezD"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAmBD,wBAAgB,eAAe,IAAI,iBAAiB,GAAG,IAAI,CAO1D;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAM9D;AAED,wBAAgB,iBAAiB,IAAI,OAAO,CAO3C;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAU5C;AAWD;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwBhE;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,OAAO,CAInD;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,CAezD"}

package/dist/auth/store.js

@@ -2,12 +2,18 @@ import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { refreshAccessToken } from "./device-flow.js";
+import { resolveEnvironment } from "../config/environments.js";
 import { log } from "../util/logger.js";
 // Refresh the access token this many ms before it actually expires, so an
 // in-flight request never races the expiry boundary.
 const EXPIRY_SKEW_MS = 60_000;
+// Credentials are scoped per environment so a prod login and a dev login can
+// coexist instead of overwriting each other. Prod keeps the historical
+// `credentials.json` filename for back-compat; other stacks get a suffix.
 function getCredentialsPath() {
-    return join(homedir(), ".zenorm", "credentials.json");
+    const env = resolveEnvironment();
+    const filename = env.name === "prod" ? "credentials.json" : `credentials.${env.name}.json`;
+    return join(homedir(), ".zenorm", filename);
 }
 function ensureDir() {
     const dir = join(homedir(), ".zenorm");

package/dist/config/environments.d.ts

@@ -0,0 +1,31 @@
+/**
+ * A named CLI environment: the full bundle of endpoints the CLI talks to.
+ * Selecting one via the `ZENORM_CLI` env var switches API + Clerk together, so
+ * you never have to keep `ZENORM_API_URL`, `ZENORM_CLERK_ISSUER`, and
+ * `ZENORM_CLERK_CLIENT_ID` in sync by hand.
+ *
+ * IMPORTANT: only the **prod** preset is baked into this (published) module.
+ * The non-prod stacks point at an internal Clerk instance whose identifiers
+ * must NOT ship in the public npm tarball (the publish pipeline greps the
+ * package for them and blocks the release). Those stacks are launched by the
+ * non-shipped source entries (`local.ts` / `dev.ts`, run via their repo shims),
+ * which inject `ZENORM_API_URL` + `ZENORM_CLERK_*` before importing the CLI.
+ * When `ZENORM_CLI` selects a non-prod stack, this resolver reads those
+ * injected vars instead of baking the endpoints in.
+ */
+export interface CliEnvironment {
+    readonly name: "prod" | "dev" | "local";
+    readonly apiUrl: string;
+    readonly clerkIssuer: string;
+    readonly clerkClientId: string;
+}
+export declare const ZENORM_CLI_ENV_VAR = "ZENORM_CLI";
+/**
+ * Resolve the active CLI environment from `ZENORM_CLI`.
+ *
+ * Unset → production (the public default). A set-but-unrecognized value is a
+ * loud error rather than a silent fallback: a typo like `ZENORM_CLI=prd` must
+ * not quietly send `zenorm` commands at the wrong stack.
+ */
+export declare function resolveEnvironment(): CliEnvironment;
+//# sourceMappingURL=environments.d.ts.map

package/dist/config/environments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environments.d.ts","sourceRoot":"","sources":["../../src/config/environments.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,OAAO,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AASD,eAAO,MAAM,kBAAkB,eAAe,CAAC;AAyC/C;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,cAAc,CAiBnD"}

package/dist/config/environments.js

@@ -0,0 +1,65 @@
+import { CliError } from "../util/errors.js";
+import { PRODUCTION_API_URL, PRODUCTION_CLERK_CLIENT_ID, PRODUCTION_CLERK_ISSUER, } from "./defaults.js";
+const PROD_ENVIRONMENT = {
+    name: "prod",
+    apiUrl: PRODUCTION_API_URL,
+    clerkIssuer: PRODUCTION_CLERK_ISSUER,
+    clerkClientId: PRODUCTION_CLERK_CLIENT_ID,
+};
+export const ZENORM_CLI_ENV_VAR = "ZENORM_CLI";
+const ENV_NAMES = ["prod", "dev", "local"];
+/**
+ * Normalize a raw `ZENORM_CLI` value to a canonical env name. Accepts the bare
+ * name (`prod`/`dev`/`local`), `production`, and each name with a `-zenorm`
+ * suffix (constructed here so the suffixed literal is never a static token).
+ */
+function parseEnvName(raw) {
+    const key = raw.trim().toLowerCase();
+    if (key === "production")
+        return "prod";
+    for (const name of ENV_NAMES) {
+        if (key === name || key === `${name}-zenorm`)
+            return name;
+    }
+    return null;
+}
+/**
+ * Build a non-prod environment from the endpoint env vars injected by the
+ * repo launchers. Fails loud if they are missing — that means the public
+ * `zenorm` was pointed at an internal stack without the launcher that carries
+ * its (non-shipped) endpoints, and we must not silently fall back to prod.
+ */
+function environmentFromInjectedVars(name) {
+    const apiUrl = process.env["ZENORM_API_URL"];
+    const clerkIssuer = process.env["ZENORM_CLERK_ISSUER"];
+    const clerkClientId = process.env["ZENORM_CLERK_CLIENT_ID"];
+    if (!apiUrl || !clerkIssuer || !clerkClientId) {
+        const shim = `${name}${"-zenorm"}`;
+        throw new CliError(`${ZENORM_CLI_ENV_VAR}=${name} needs the ${name} endpoints, which are not ` +
+            `bundled in the public CLI. Launch it with \`${shim}\` (from the repo), ` +
+            `or set ZENORM_API_URL, ZENORM_CLERK_ISSUER, and ZENORM_CLERK_CLIENT_ID.`);
+    }
+    return { name, apiUrl, clerkIssuer, clerkClientId };
+}
+/**
+ * Resolve the active CLI environment from `ZENORM_CLI`.
+ *
+ * Unset → production (the public default). A set-but-unrecognized value is a
+ * loud error rather than a silent fallback: a typo like `ZENORM_CLI=prd` must
+ * not quietly send `zenorm` commands at the wrong stack.
+ */
+export function resolveEnvironment() {
+    const raw = process.env[ZENORM_CLI_ENV_VAR];
+    if (raw === undefined || raw.trim() === "") {
+        return PROD_ENVIRONMENT;
+    }
+    const name = parseEnvName(raw);
+    if (!name) {
+        const allowed = ENV_NAMES.join(", ");
+        throw new CliError(`Invalid ${ZENORM_CLI_ENV_VAR}=${JSON.stringify(raw)}. ` +
+            `Expected one of: ${allowed} (or a "-zenorm" suffixed form).`);
+    }
+    if (name === "prod")
+        return PROD_ENVIRONMENT;
+    return environmentFromInjectedVars(name);
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ze-norm/cli",
   "private": false,
-  "version": "0.13.0",
+  "version": "0.14.1",
   "license": "SEE LICENSE IN README.md",
   "type": "module",
   "repository": {