adapty 0.8.5 → 0.8.6

package/README.md

@@ -34,9 +34,14 @@ Other auth commands:
 adapty auth whoami     # verify token, show user info
 adapty auth status     # show local auth state
 adapty auth logout     # clear stored token (local only)
-adapty auth revoke     # revoke token server-side and clear local
+adapty auth revoke     # revoke active token and clear any matching stored session
 ```
 
+`auth revoke` uses `ADAPTY_TOKEN` when set, otherwise the stored token. A different token in the
+session file is preserved. After revoking an environment token, unset `ADAPTY_TOKEN`; a preserved
+stored session will then become active again. With no token, revoke succeeds without a request
+and returns `{"status":"not_authenticated"}` under `--json`.
+
 ## Commands
 
 All resource commands require `--app APP_ID` (UUID). Use `adapty apps list` to find your app ID.

package/dist/cli/base/adapty/adapty-command.d.ts

@@ -0,0 +1,21 @@
+import { BaseCommand } from '../base-command.js';
+import type { ResolvedSession } from './openSession.js';
+import type { Adapty } from '../../../sdk/adapty/index.js';
+export type AuthenticatedSession = ResolvedSession & {
+    token: string;
+};
+/**
+ * Commands that require a token; auth commands other than `whoami` also work without one.
+ *
+ * "Needs authorization" becomes a fact of the type system, written in what the command extends
+ * instead of checked inside run(). One lazy class would put a "what if we are not logged in"
+ * branch into all 75 commands, and one of them would forget it.
+ */
+export declare abstract class AdaptyCommand extends BaseCommand {
+    #private;
+    static enableJsonFlag: boolean;
+    protected get adapty(): Adapty;
+    /** Narrowed once here, so nothing downstream re-checks the token. */
+    protected get session(): AuthenticatedSession;
+    protected init(): Promise<void>;
+}

package/dist/cli/base/adapty/adapty-command.js

@@ -0,0 +1,47 @@
+import { AuthRequiredError } from '../../../sdk/core/errors.js';
+import { BaseCommand } from '../base-command.js';
+import { build } from './build.js';
+import { openSession } from './openSession.js';
+/**
+ * Commands that require a token; auth commands other than `whoami` also work without one.
+ *
+ * "Needs authorization" becomes a fact of the type system, written in what the command extends
+ * instead of checked inside run(). One lazy class would put a "what if we are not logged in"
+ * branch into all 75 commands, and one of them would forget it.
+ */
+export class AdaptyCommand extends BaseCommand {
+    // Keep one own static so oclif's manifest cache walks through this intermediate class and
+    // includes statics inherited from BaseCommand.
+    static enableJsonFlag = true;
+    #adapty;
+    #resolved;
+    get adapty() {
+        this.#adapty ??= build(this.session, {
+            config: this.config,
+            signal: this.signal,
+            warn: message => this.warn(message),
+        });
+        return this.#adapty;
+    }
+    /** Narrowed once here, so nothing downstream re-checks the token. */
+    get session() {
+        const resolved = this.#resolved;
+        if (resolved === undefined) {
+            // A bug, not a user error, and deliberately not an SdkError: it lands as exit 1 with a
+            // stack instead of passing for a normal scenario.
+            throw new Error('session is available only after init()');
+        }
+        if (resolved.token === undefined) {
+            throw new AuthRequiredError('missing');
+        }
+        return { ...resolved, token: resolved.token };
+    }
+    async init() {
+        await super.init();
+        // The session is read here, the sdk built lazily from run(), because this.parse() runs
+        // after init(). Demanding the token here would answer `apps list --pge 2` with "Not
+        // authenticated" instead of "Nonexistent flag": input errors come before state errors.
+        // Commands also validate business rules before accessing this.adapty or this.session.
+        this.#resolved = await openSession(this.config);
+    }
+}

package/dist/cli/base/adapty/build.d.ts

@@ -0,0 +1,11 @@
+import type { ResolvedSession } from './openSession.js';
+import type { Adapty } from '../../../sdk/adapty/index.js';
+import type { Config } from '@oclif/core';
+type CommandContext = {
+    config: Config;
+    signal: AbortSignal;
+    warn: (message: string) => void;
+};
+/** Shared by authenticated commands and login/revoke, which can run without a token. */
+export declare const build: (session: ResolvedSession, context: CommandContext) => Adapty;
+export {};

package/dist/cli/base/adapty/build.js

@@ -0,0 +1,13 @@
+import { buildUserAgent } from '../../../lib/client-from-config.js';
+import { createAdapty } from '../../../sdk/adapty/index.js';
+/** Shared by authenticated commands and login/revoke, which can run without a token. */
+export const build = (session, context) => createAdapty({
+    baseUrl: session.apiUrl,
+    onRetry: ({ attempt, delayMs }) => {
+        context.warn(`Request failed, retrying in ${delayMs / 1000}s (attempt ${attempt + 1})`);
+    },
+    signal: context.signal,
+    token: session.token,
+    // Both CLI stacks use the same User-Agent while migration is in progress.
+    userAgent: buildUserAgent(context.config),
+});

package/dist/cli/base/adapty/index.d.ts

@@ -0,0 +1,5 @@
+export { AdaptyCommand } from './adapty-command.js';
+export { build } from './build.js';
+export { openSession } from './openSession.js';
+export type { AuthenticatedSession } from './adapty-command.js';
+export type { ResolvedSession } from './openSession.js';

package/dist/cli/base/adapty/index.js

@@ -0,0 +1,3 @@
+export { AdaptyCommand } from './adapty-command.js';
+export { build } from './build.js';
+export { openSession } from './openSession.js';

package/dist/cli/base/adapty/openSession.d.ts

@@ -0,0 +1,22 @@
+import type { SessionStore, SessionUser } from '../../../sdk/core/session.js';
+import type { Config } from '@oclif/core';
+/**
+ * The CLI's world resolved into what the sdk asks for: where to talk, as whom, and where the
+ * session lives. Env vars are read here and only here — the sdk never touches process.env, which
+ * is what lets the same product code run under an MCP server.
+ */
+export type ResolvedSession = {
+    apiUrl: string;
+    /**
+     * Where the token came from. With ADAPTY_TOKEN in play, "no token in the file" and "not
+     * authenticated" are different answers, and `auth status` has to say which one it means.
+     */
+    source: 'env' | 'file' | 'none';
+    /** The store itself, not its path: `auth login`/`logout` write through it. */
+    store: SessionStore;
+    token?: string | undefined;
+    user?: SessionUser | undefined;
+};
+/** ADAPTY_TOKEN wins over the stored session, as the published CLI already does. */
+export declare const resolveSession: (config: Config) => Promise<ResolvedSession>;
+export declare const openSession: (config: Config) => Promise<ResolvedSession>;

package/dist/cli/base/adapty/openSession.js

@@ -0,0 +1,25 @@
+import { DEFAULT_ADAPTY_API_URL } from '../../../sdk/adapty/index.js';
+import { createFileSessionStore } from '../../../sdk/core/session.js';
+/** ADAPTY_TOKEN wins over the stored session, as the published CLI already does. */
+export const resolveSession = async (config) => {
+    const apiUrl = process.env.ADAPTY_API_URL ?? DEFAULT_ADAPTY_API_URL;
+    // oclif's configDir already knows XDG on unix and LOCALAPPDATA on Windows
+    const store = createFileSessionStore(config.configDir);
+    const envToken = process.env.ADAPTY_TOKEN;
+    if (envToken !== undefined && envToken !== '') {
+        return { apiUrl, source: 'env', store, token: envToken };
+    }
+    const stored = await store.load();
+    if (stored === undefined) {
+        return { apiUrl, source: 'none', store };
+    }
+    return { apiUrl, source: 'file', store, token: stored.token, user: stored.user };
+};
+export const openSession = async (config) => {
+    const session = await resolveSession(config);
+    if (session.apiUrl !== DEFAULT_ADAPTY_API_URL) {
+        // oclif's warn() is silent under --json; the destination warning must remain visible.
+        process.stderr.write(`Warning: Using non-default API URL: ${session.apiUrl}\n`);
+    }
+    return session;
+};

package/dist/cli/base/base-command.d.ts

@@ -0,0 +1,30 @@
+import { Command } from '@oclif/core';
+import type { ErrorJson } from '../errors.js';
+/**
+ * What every command gets and nothing more: the output channel, cancellation, the single place
+ * where sdk errors become CLI errors. Product SDKs and sessions belong to their adapters.
+ *
+ * Whatever lives here is paid for by 75 commands, so what stays out matters as much: flags stay
+ * composable objects, views stay plain functions, and one command's needs stay in that command.
+ */
+export declare abstract class BaseCommand extends Command {
+    #private;
+    /** --json is a property of the CLI, not a per-command opt-in; `auth login` opts back out. */
+    static enableJsonFlag: boolean;
+    protected get signal(): AbortSignal;
+    protected catch(error: Error): Promise<unknown>;
+    protected toErrorJson(error: unknown): {
+        error: ErrorJson;
+    };
+    protected finally(error: Error | undefined): Promise<unknown>;
+    protected init(): Promise<void>;
+    /**
+     * run() returns the data and render() prints it, so run()'s return type *is* the --json
+     * contract, checked by the compiler: change a response shape in the sdk and the command stops
+     * compiling instead of quietly changing what users parse.
+     *
+     * The guard is not what keeps --json clean — oclif's `log` is already silent then. It keeps the
+     * view from being built at all, so a human view may cost whatever it needs.
+     */
+    protected render<T>(value: T, view: (value: T) => string): void;
+}

package/dist/cli/base/base-command.js

@@ -0,0 +1,64 @@
+import { Command } from '@oclif/core';
+import { CliError, toCliError } from '../errors.js';
+/**
+ * What every command gets and nothing more: the output channel, cancellation, the single place
+ * where sdk errors become CLI errors. Product SDKs and sessions belong to their adapters.
+ *
+ * Whatever lives here is paid for by 75 commands, so what stays out matters as much: flags stay
+ * composable objects, views stay plain functions, and one command's needs stay in that command.
+ */
+export class BaseCommand extends Command {
+    /** --json is a property of the CLI, not a per-command opt-in; `auth login` opts back out. */
+    static enableJsonFlag = true;
+    #abort = new AbortController();
+    // A field, not an inline closure: removeListener needs this very reference, or listeners pile
+    // up whenever several commands run in one process — which tests do.
+    #onSigint = () => {
+        this.#abort.abort();
+    };
+    get signal() {
+        return this.#abort.signal;
+    }
+    async catch(error) {
+        return super.catch(toCliError(error));
+    }
+    toErrorJson(error) {
+        if (error instanceof CliError) {
+            return { error: error.json };
+        }
+        // Error.message is non-enumerable; serializing the Error itself drops the explanation.
+        // Only expose public fields, not oclif's parser context or a command's internal state.
+        const cause = error instanceof Error ? error : new Error(String(error));
+        return {
+            error: {
+                code: 'code' in cause && typeof cause.code === 'string' ? cause.code : undefined,
+                message: cause.message,
+            },
+        };
+    }
+    async finally(error) {
+        process.removeListener('SIGINT', this.#onSigint);
+        return super.finally(error);
+    }
+    async init() {
+        await super.init();
+        // Abort instead of exit: the command unwinds, the sdk raises CancelledError and
+        // cli/errors.ts turns it into exit 130 — exiting from the handler is how the published
+        // `auth login` ends a cancelled login with exit 0. `once` leaves a second Ctrl+C to the
+        // runtime, so an unresponsive command can still be killed the usual way.
+        process.once('SIGINT', this.#onSigint);
+    }
+    /**
+     * run() returns the data and render() prints it, so run()'s return type *is* the --json
+     * contract, checked by the compiler: change a response shape in the sdk and the command stops
+     * compiling instead of quietly changing what users parse.
+     *
+     * The guard is not what keeps --json clean — oclif's `log` is already silent then. It keeps the
+     * view from being built at all, so a human view may cost whatever it needs.
+     */
+    render(value, view) {
+        if (!this.jsonEnabled()) {
+            this.log(view(value));
+        }
+    }
+}

package/dist/cli/commands/apps/create.d.ts

@@ -0,0 +1,19 @@
+import { AdaptyCommand } from '../../base/adapty/index.js';
+import type { AppSummary } from '../../../sdk/adapty/index.js';
+export default class AppsCreate extends AdaptyCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        title: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        platform: import("@oclif/core/interfaces").OptionFlag<("ios" | "android")[], import("@oclif/core/interfaces").CustomOptions>;
+        'apple-bundle-id': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'google-bundle-id': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<AppSummary>;
+    /**
+     * A courtesy for a human reader: the server creates a default access level with the app. Under
+     * --json the result is the app itself, so the request is skipped — and a failure to read it
+     * never fails the create, which has already happened.
+     */
+    private showDefaultAccessLevel;
+}

package/dist/cli/commands/apps/create.js

@@ -0,0 +1,68 @@
+import { Flags } from '@oclif/core';
+import { validateCreateApp } from '../../../sdk/adapty/apps/index.js';
+import { platforms } from '../../../sdk/adapty/index.js';
+import { CancelledError } from '../../../sdk/core/errors.js';
+import { assertValid } from '../../../sdk/core/validation.js';
+import { AdaptyCommand } from '../../base/adapty/index.js';
+import { renderRecord } from '../../views/record.js';
+export default class AppsCreate extends AdaptyCommand {
+    static description = 'Create a new Adapty app';
+    static examples = [
+        '<%= config.bin %> apps create --title "My App" --platform ios --apple-bundle-id com.example.app',
+        '<%= config.bin %> apps create --title "My App" --platform ios --platform android --apple-bundle-id com.example.app --google-bundle-id com.example.app',
+    ];
+    // Input shape here, the rule (a bundle id per platform) in sdk/adapty/apps/create.ts — where a
+    // future MCP server obeys it too.
+    static flags = {
+        'title': Flags.string({ description: 'App title', required: true }),
+        'platform': Flags.option({
+            description: 'Platform (ios, android). Repeat for multiple.',
+            multiple: true,
+            options: platforms,
+            required: true,
+        })(),
+        'apple-bundle-id': Flags.string({ description: 'Apple bundle ID (required with --platform ios)' }),
+        'google-bundle-id': Flags.string({ description: 'Google bundle ID (required with --platform android)' }),
+    };
+    async run() {
+        const { flags } = await this.parse(AppsCreate);
+        const input = {
+            appleBundleId: flags['apple-bundle-id'],
+            googleBundleId: flags['google-bundle-id'],
+            platforms: flags.platform,
+            title: flags.title,
+        };
+        assertValid(validateCreateApp(input));
+        const app = await this.adapty.apps.create(input);
+        this.log('App created!');
+        this.render(app, renderRecord);
+        await this.showDefaultAccessLevel(app.id);
+        return app;
+    }
+    /**
+     * A courtesy for a human reader: the server creates a default access level with the app. Under
+     * --json the result is the app itself, so the request is skipped — and a failure to read it
+     * never fails the create, which has already happened.
+     */
+    async showDefaultAccessLevel(appId) {
+        if (this.jsonEnabled()) {
+            return;
+        }
+        try {
+            const { items } = await this.adapty.accessLevels.list(appId);
+            const [first] = items ?? [];
+            if (first) {
+                this.log('\nDefault access level:');
+                this.log(renderRecord(first));
+            }
+        }
+        catch (error) {
+            // Ctrl+C is not a failed request: swallowing it would warn and carry on as if the
+            // user had not asked to stop.
+            if (error instanceof CancelledError) {
+                throw error;
+            }
+            this.warn('Could not fetch access levels for new app');
+        }
+    }
+}

package/dist/cli/commands/apps/get.d.ts

@@ -0,0 +1,10 @@
+import { AdaptyCommand } from '../../base/adapty/index.js';
+import type { AppDetail } from '../../../sdk/adapty/index.js';
+export default class AppsGet extends AdaptyCommand {
+    static args: {
+        app_id: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    run(): Promise<AppDetail>;
+}

package/dist/cli/commands/apps/get.js

@@ -0,0 +1,14 @@
+import { AdaptyCommand } from '../../base/adapty/index.js';
+import { appIdArg } from '../../flags.js';
+import { renderRecord } from '../../views/record.js';
+export default class AppsGet extends AdaptyCommand {
+    static args = { ...appIdArg };
+    static description = 'Get app details';
+    static examples = ['<%= config.bin %> apps get 550e8400-e29b-41d4-a716-446655440000'];
+    async run() {
+        const { args } = await this.parse(AppsGet);
+        const app = await this.adapty.apps.get(args.app_id);
+        this.render(app, renderRecord);
+        return app;
+    }
+}

package/dist/cli/commands/apps/list.d.ts

@@ -0,0 +1,11 @@
+import { AdaptyCommand } from '../../base/adapty/index.js';
+import type { AppSummary, Paginated } from '../../../sdk/adapty/index.js';
+export default class AppsList extends AdaptyCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        page: import("@oclif/core/interfaces").OptionFlag<number, import("@oclif/core/interfaces").CustomOptions>;
+        'page-size': import("@oclif/core/interfaces").OptionFlag<number, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<Paginated<AppSummary>>;
+}

package/dist/cli/commands/apps/list.js

@@ -0,0 +1,14 @@
+import { AdaptyCommand } from '../../base/adapty/index.js';
+import { pageParams, paginationFlags } from '../../flags.js';
+import { renderPage } from '../../views/list.js';
+export default class AppsList extends AdaptyCommand {
+    static description = 'List Adapty apps';
+    static examples = ['<%= config.bin %> apps list', '<%= config.bin %> apps list --page 2 --page-size 10'];
+    static flags = { ...paginationFlags };
+    async run() {
+        const { flags } = await this.parse(AppsList);
+        const page = await this.adapty.apps.list(pageParams(flags));
+        this.render(page, renderPage);
+        return page;
+    }
+}

package/dist/cli/commands/apps/update.d.ts

@@ -0,0 +1,15 @@
+import { AdaptyCommand } from '../../base/adapty/index.js';
+import type { AppDetail } from '../../../sdk/adapty/index.js';
+export default class AppsUpdate extends AdaptyCommand {
+    static args: {
+        app_id: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        title: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'apple-bundle-id': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'google-bundle-id': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    run(): Promise<AppDetail>;
+}

package/dist/cli/commands/apps/update.js

@@ -0,0 +1,30 @@
+import { Flags } from '@oclif/core';
+import { validateUpdateApp } from '../../../sdk/adapty/apps/index.js';
+import { assertValid } from '../../../sdk/core/validation.js';
+import { AdaptyCommand } from '../../base/adapty/index.js';
+import { appIdArg } from '../../flags.js';
+import { renderRecord } from '../../views/record.js';
+export default class AppsUpdate extends AdaptyCommand {
+    static args = { ...appIdArg };
+    static description = 'Update an app';
+    static examples = ['<%= config.bin %> apps update 550e8400-... --title "My App"'];
+    // The "at least one field" rule lives in the sdk and is checked before requiring a token.
+    static flags = {
+        'title': Flags.string({ description: 'App title' }),
+        'apple-bundle-id': Flags.string({ description: 'Apple bundle ID' }),
+        'google-bundle-id': Flags.string({ description: 'Google bundle ID' }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(AppsUpdate);
+        const input = {
+            appleBundleId: flags['apple-bundle-id'],
+            googleBundleId: flags['google-bundle-id'],
+            title: flags.title,
+        };
+        assertValid(validateUpdateApp(input));
+        const app = await this.adapty.apps.update(args.app_id, input);
+        this.log('App updated!');
+        this.render(app, renderRecord);
+        return app;
+    }
+}

package/dist/cli/commands/auth/login.d.ts

@@ -0,0 +1,11 @@
+import { BaseCommand } from '../../base/base-command.js';
+export default class AuthLogin extends BaseCommand {
+    static description: string;
+    /** The one command that opts out: an interactive flow has no result to serialize. */
+    static enableJsonFlag: boolean;
+    static examples: string[];
+    run(): Promise<void>;
+    /** ADAPTY_APP_URL is the CLI's business: the sdk knows nothing about browsers or dashboards. */
+    private dashboardLink;
+    private openBrowser;
+}

package/dist/cli/commands/auth/login.js

@@ -0,0 +1,68 @@
+import open from 'open';
+import { onAppHost } from '../../../lib/app-url.js';
+import { runDeviceFlow } from '../../../sdk/core/auth/device-flow.js';
+import { systemClock } from '../../../sdk/core/clock.js';
+import { build, openSession } from '../../base/adapty/index.js';
+import { BaseCommand } from '../../base/base-command.js';
+import { exitCode } from '../../errors.js';
+export default class AuthLogin extends BaseCommand {
+    static description = 'Authenticate with Adapty via browser';
+    /** The one command that opts out: an interactive flow has no result to serialize. */
+    static enableJsonFlag = false;
+    static examples = ['<%= config.bin %> auth login'];
+    async run() {
+        await this.parse(AuthLogin);
+        const session = await openSession(this.config);
+        if (session.user !== undefined) {
+            this.log(`Already authenticated as ${session.user.email}. Re-authenticating...`);
+        }
+        // No token yet: the same factory without one, which leaves only auth reachable
+        const adapty = build({ ...session, token: undefined }, {
+            config: this.config,
+            signal: this.signal,
+            warn: message => this.warn(message),
+        });
+        const issued = await runDeviceFlow(adapty.auth, {
+            clock: systemClock,
+            onCode: (code) => {
+                // The fallback comes before the host rewrite, so the printed link and the browser
+                // always agree
+                const link = this.dashboardLink(code.verificationUriComplete ?? code.verificationUri);
+                this.log(`\nYour code: ${code.userCode}\n`);
+                this.log(`If the browser doesn't open, visit: ${link}\n`);
+                this.openBrowser(link);
+                this.log('Waiting for authorization... (Ctrl+C to cancel)');
+            },
+            onTransientError: (error, consecutive) => {
+                // One failed poll is normal and stays quiet; three in a row is worth saying,
+                // because the screen otherwise looks stuck
+                if (consecutive >= 3) {
+                    const reason = error instanceof Error ? error.message : String(error);
+                    this.warn(`${consecutive} consecutive errors while polling: ${reason}`);
+                }
+            },
+            signal: this.signal,
+        });
+        await session.store.save({ token: issued.accessToken, user: issued.user });
+        this.log(`\nAuthenticated as ${issued.user.email}`);
+        this.log(`Session saved to ${session.store.path}`);
+    }
+    /** ADAPTY_APP_URL is the CLI's business: the sdk knows nothing about browsers or dashboards. */
+    dashboardLink(issuedUrl) {
+        try {
+            return onAppHost(issuedUrl);
+        }
+        catch (error) {
+            // A malformed ADAPTY_APP_URL is bad input, not a failed login
+            this.error(error instanceof Error ? error.message : String(error), { exit: exitCode.usage });
+        }
+    }
+    openBrowser(url) {
+        if (!process.stdin.isTTY) {
+            return;
+        }
+        // onCode is synchronous, so the launch is fired and forgotten: the link is already on
+        // screen, and a browser that refuses to start must not fail the login
+        void open(url).catch(() => undefined);
+    }
+}

package/dist/cli/commands/auth/logout.d.ts

@@ -0,0 +1,12 @@
+import { BaseCommand } from '../../base/base-command.js';
+type Result = {
+    /** The env var outlives the file, so "Logged out" alone would be a lie. */
+    env_token_set: boolean;
+    status: 'logged_out' | 'not_authenticated';
+};
+export default class AuthLogout extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    run(): Promise<Result>;
+}
+export {};

package/dist/cli/commands/auth/logout.js

@@ -0,0 +1,28 @@
+import { openSession } from '../../base/adapty/index.js';
+import { BaseCommand } from '../../base/base-command.js';
+/** A record rather than an if: a new status cannot be added without a text for it. */
+const messages = {
+    logged_out: 'Logged out. Note: the token stays valid server-side until it expires — see `adapty auth revoke`.',
+    not_authenticated: 'Not currently authenticated.',
+};
+const ENV_STILL_SET = 'ADAPTY_TOKEN is still set in the environment, so commands stay authenticated. Unset it to finish logging out.';
+export default class AuthLogout extends BaseCommand {
+    static description = 'Remove the stored session';
+    static examples = ['<%= config.bin %> auth logout'];
+    async run() {
+        await this.parse(AuthLogout);
+        const session = await openSession(this.config);
+        const stored = await session.store.load();
+        if (stored !== undefined) {
+            await session.store.clear();
+        }
+        const result = {
+            env_token_set: session.source === 'env',
+            status: stored === undefined ? 'not_authenticated' : 'logged_out',
+        };
+        this.render(result, status => (status.env_token_set
+            ? `${messages[status.status]}\n${ENV_STILL_SET}`
+            : messages[status.status]));
+        return result;
+    }
+}

package/dist/cli/commands/auth/revoke.d.ts

@@ -0,0 +1,13 @@
+import { BaseCommand } from '../../base/base-command.js';
+type Result = {
+    status: 'not_authenticated';
+} | {
+    env_token_set: boolean;
+    status: 'revoked';
+};
+export default class AuthRevoke extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    run(): Promise<Result>;
+}
+export {};

package/dist/cli/commands/auth/revoke.js

@@ -0,0 +1,32 @@
+import { build, openSession } from '../../base/adapty/index.js';
+import { BaseCommand } from '../../base/base-command.js';
+export default class AuthRevoke extends BaseCommand {
+    static description = 'Revoke the current token on the server and remove any matching stored session';
+    static examples = ['<%= config.bin %> auth revoke'];
+    async run() {
+        await this.parse(AuthRevoke);
+        const session = await openSession(this.config);
+        if (session.token === undefined) {
+            this.log('Not currently authenticated.');
+            return { status: 'not_authenticated' };
+        }
+        // Server first, file second. The other order, on a failed request, leaves a live token on
+        // the server and no local copy to revoke it with — only the dashboard could undo that.
+        const adapty = build(session, {
+            config: this.config,
+            signal: this.signal,
+            warn: message => this.warn(message),
+        });
+        await adapty.auth.revokeToken(session.token);
+        // ADAPTY_TOKEN may override a different, still-valid session in the file.
+        const stored = await session.store.load();
+        if (stored?.token === session.token) {
+            await session.store.clear();
+        }
+        const result = { env_token_set: session.source === 'env', status: 'revoked' };
+        this.render(result, status => (status.env_token_set
+            ? 'Token revoked. ADAPTY_TOKEN is still set and now holds a dead token — unset it.'
+            : 'Token revoked and logged out.'));
+        return result;
+    }
+}

package/dist/cli/commands/auth/status/index.d.ts

@@ -0,0 +1,7 @@
+import { BaseCommand } from '../../../base/base-command.js';
+import type { Result } from './lib/result.js';
+export default class AuthStatus extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    run(): Promise<Result>;
+}