carto-cli 0.1.0-rc.1

package/dist/commands/auth.js

@@ -0,0 +1,652 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildReauthCommand = buildReauthCommand;
+exports.authLogin = authLogin;
+exports.authLogout = authLogout;
+exports.authUse = authUse;
+exports.authStatus = authStatus;
+exports.authWhoami = authWhoami;
+exports.authLoginM2M = authLoginM2M;
+const api_1 = require("../api");
+const config_1 = require("../config");
+const colors_1 = require("../colors");
+const auth_server_1 = require("../auth-server");
+const auth_oauth_1 = require("../auth-oauth");
+const browser_1 = require("../browser");
+/**
+ * Build the correct re-authentication command for the current profile and environment
+ * @param profileName Current profile name
+ * @param credentials Current profile credentials (null if not available)
+ * @returns Properly formatted carto auth login command
+ */
+function buildReauthCommand(profileName, credentials) {
+    let cmd = 'carto auth login';
+    // Add profile name if not default profile
+    // Quote profile names with spaces or special characters
+    if (profileName && profileName !== 'default') {
+        const needsQuotes = profileName.includes(' ') || profileName.includes('@') || profileName.includes('/');
+        cmd += needsQuotes ? ` "${profileName}"` : ` ${profileName}`;
+    }
+    // Add --env flag if not production environment
+    if (credentials?.auth_environment && credentials.auth_environment !== 'production') {
+        cmd += ` --env ${credentials.auth_environment}`;
+    }
+    // Add --organization-name flag if organization was used during login
+    if (credentials?.organization_name_used) {
+        const orgName = credentials.organization_name_used;
+        const needsQuotes = orgName.includes(' ') || orgName.includes('@') || orgName.includes('/');
+        cmd += needsQuotes ? ` --organization-name "${orgName}"` : ` --organization-name ${orgName}`;
+    }
+    return cmd;
+}
+async function authLogin(profileName, jsonOutput, env, organizationName, organizationId) {
+    try {
+        // Fixed port for OAuth callback (authorized in Auth0)
+        const port = 3003;
+        // Get OAuth configuration
+        const config = (0, auth_oauth_1.getAuthConfig)(env);
+        // Get accounts URL for organization lookup
+        const accountsUrl = (0, auth_oauth_1.getAccountsUrl)(env || auth_oauth_1.DEFAULT_AUTH_ENVIRONMENT);
+        // Resolve Auth0 Organization ID if organization name provided
+        let auth0OrganizationId = null;
+        if (organizationName) {
+            if (!jsonOutput) {
+                console.log((0, colors_1.info)(`🔍 Looking up organization: ${organizationName}...`));
+            }
+            try {
+                auth0OrganizationId = await (0, auth_oauth_1.getAuth0OrganizationIdByName)(accountsUrl, organizationName);
+            }
+            catch (err) {
+                if (jsonOutput) {
+                    console.log(JSON.stringify({ success: false, error: `Failed to lookup organization: ${err.message}` }));
+                }
+                else {
+                    console.log((0, colors_1.error)(`✗ Failed to lookup organization: ${err.message}`));
+                    console.log((0, colors_1.info)('  Tip: Verify the organization name is correct'));
+                }
+                process.exit(1);
+            }
+            if (!auth0OrganizationId) {
+                if (!jsonOutput) {
+                    console.log((0, colors_1.warning)('⚠ SSO not configured for this organization'));
+                    console.log((0, colors_1.info)('  Proceeding with standard login...'));
+                }
+            }
+            else {
+                if (!jsonOutput) {
+                    console.log((0, colors_1.success)(`✓ SSO enabled - redirecting to organization login`));
+                }
+            }
+        }
+        else if (organizationId) {
+            if (jsonOutput) {
+                console.log(JSON.stringify({ success: false, error: 'Organization ID lookup not yet supported. Use --organization-name instead.' }));
+            }
+            else {
+                console.log((0, colors_1.error)(`✗ Organization ID lookup not yet supported`));
+                console.log((0, colors_1.info)('  Tip: Use --organization-name with the organization name'));
+            }
+            process.exit(1);
+        }
+        // Generate PKCE challenge and state
+        const { verifier, challenge } = (0, auth_oauth_1.generatePKCEChallenge)();
+        const state = (0, auth_oauth_1.generateState)();
+        // Build redirect URI
+        const redirectUri = `http://localhost:${port}/callback`;
+        // Build authorization URL
+        const authUrl = (0, auth_oauth_1.buildAuthorizationUrl)(config, redirectUri, challenge, state, auth0OrganizationId || undefined);
+        if (!jsonOutput) {
+            console.log('');
+            console.log((0, colors_1.info)(auth0OrganizationId ? '🔐 SSO Authentication' : '🔐 CARTO CLI Authentication'));
+            // Only show auth environment for non-production
+            const envName = env || auth_oauth_1.DEFAULT_AUTH_ENVIRONMENT;
+            if (envName !== 'production') {
+                console.log((0, colors_1.info)(`   Auth Environment: ${config.domain}`));
+            }
+            console.log('');
+            // Try to open browser automatically
+            try {
+                await (0, browser_1.openBrowser)(authUrl);
+                console.log((0, colors_1.success)('✓ Opening browser for authentication...'));
+                console.log('');
+            }
+            catch (browserError) {
+                // Fallback: show URL for manual opening
+                console.log((0, colors_1.warning)('⚠ Could not open browser automatically'));
+                console.log((0, colors_1.bold)('Please open this URL in your browser:'));
+                console.log('');
+                console.log((0, colors_1.dim)('  ') + authUrl);
+                console.log('');
+            }
+            console.log((0, colors_1.info)(`⏳ Waiting for authentication (listening on http://localhost:${port}/callback)...`));
+            console.log('');
+        }
+        // Start local callback server
+        const serverPromise = (0, auth_server_1.startOAuthCallbackServer)(port, state);
+        // Wait for OAuth callback
+        const { code } = await serverPromise;
+        if (!jsonOutput) {
+            console.log((0, colors_1.info)('🔄 Exchanging authorization code for access token...'));
+        }
+        // Exchange authorization code for access token
+        const tokenResponse = await (0, auth_oauth_1.exchangeCodeForToken)(config, code, verifier, redirectUri);
+        // Extract token
+        const accessToken = tokenResponse.access_token;
+        // Fetch full user info from CARTO accounts API (environment-specific)
+        // Use createMinimal because credentials don't exist yet during login
+        const tempClient = api_1.ApiClient.createMinimal(accessToken);
+        const userInfo = await tempClient.getFullUrl(`${accountsUrl}/users/me`, true);
+        // Build full credentials with org and user info
+        const fullCredentials = {
+            token: accessToken,
+            tenant_id: userInfo.user_metadata?.tenant_id || '',
+            tenant_domain: userInfo.user_metadata?.tenant_domain || '',
+            organization_id: userInfo.user_metadata?.account_id || '',
+            organization_name: userInfo.user_metadata?.account_name || '',
+            user_email: userInfo.email || '',
+            auth_environment: env || auth_oauth_1.DEFAULT_AUTH_ENVIRONMENT,
+            organization_name_used: organizationName || undefined,
+        };
+        // Determine profile name
+        let finalProfileName = profileName;
+        if (!finalProfileName) {
+            // Generate suggested name
+            finalProfileName = (0, config_1.suggestProfileName)(fullCredentials);
+        }
+        // Save credentials to file
+        (0, config_1.saveCredentials)(finalProfileName, fullCredentials);
+        if (jsonOutput) {
+            console.log(JSON.stringify({
+                success: true,
+                message: 'Authentication successful',
+                profile: finalProfileName,
+                tenant_id: fullCredentials.tenant_id,
+                tenant_domain: fullCredentials.tenant_domain,
+                organization_id: fullCredentials.organization_id,
+                organization_name: fullCredentials.organization_name,
+                user_email: fullCredentials.user_email,
+            }));
+        }
+        else {
+            console.log((0, colors_1.success)('\n✓ Authentication successful!'));
+            if (auth0OrganizationId) {
+                console.log((0, colors_1.success)('  Authenticated via SSO'));
+            }
+            console.log((0, colors_1.info)(`  Tenant: ${fullCredentials.tenant_domain} (${fullCredentials.tenant_id})`));
+            console.log((0, colors_1.info)(`  Organization: ${fullCredentials.organization_name} (${fullCredentials.organization_id})`));
+            console.log((0, colors_1.info)(`  User: ${fullCredentials.user_email}`));
+            console.log('');
+            console.log((0, colors_1.success)(`✓ Credentials saved as profile: ${(0, colors_1.bold)(finalProfileName)}`));
+            console.log((0, colors_1.success)(`✓ Set as current profile`));
+        }
+    }
+    catch (err) {
+        if (jsonOutput) {
+            console.log(JSON.stringify({ success: false, error: err.message }));
+        }
+        else {
+            console.log((0, colors_1.error)('\n✗ Authentication failed: ' + err.message));
+        }
+        process.exit(1);
+    }
+}
+async function authLogout(profileName, jsonOutput) {
+    try {
+        const targetProfile = profileName || (0, config_1.getCurrentProfile)();
+        // Delete credentials
+        (0, config_1.deleteCredentials)(targetProfile);
+        // Also delete legacy config if removing default profile
+        if (targetProfile === 'default') {
+            try {
+                (0, config_1.deleteConfig)();
+            }
+            catch {
+                // Ignore if legacy config doesn't exist
+            }
+        }
+        if (jsonOutput) {
+            console.log(JSON.stringify({ success: true, message: 'Credentials removed successfully', profile: targetProfile }));
+        }
+        else {
+            console.log((0, colors_1.success)(`✓ Credentials removed successfully from profile: ${(0, colors_1.bold)(targetProfile)}`));
+        }
+    }
+    catch (err) {
+        if (jsonOutput) {
+            console.log(JSON.stringify({ success: false, error: err.message }));
+        }
+        else {
+            console.log((0, colors_1.error)('✗ Failed to remove credentials: ' + err.message));
+        }
+        process.exit(1);
+    }
+}
+async function authUse(profileName, jsonOutput) {
+    try {
+        const allCreds = (0, config_1.loadAllCredentials)();
+        if (!allCreds.profiles[profileName]) {
+            const available = Object.keys(allCreds.profiles);
+            if (jsonOutput) {
+                console.log(JSON.stringify({
+                    success: false,
+                    error: `Profile '${profileName}' not found`,
+                    availableProfiles: available
+                }));
+            }
+            else {
+                console.log((0, colors_1.error)(`✗ Profile '${profileName}' not found`));
+                if (available.length > 0) {
+                    console.log((0, colors_1.info)('\nAvailable profiles:'));
+                    available.forEach(p => console.log((0, colors_1.info)(`  - ${p}`)));
+                }
+                else {
+                    console.log((0, colors_1.info)('\nNo profiles found. Run "carto auth login" to authenticate.'));
+                }
+            }
+            process.exit(1);
+        }
+        (0, config_1.setCurrentProfile)(profileName);
+        const credentials = allCreds.profiles[profileName];
+        if (jsonOutput) {
+            console.log(JSON.stringify({
+                success: true,
+                message: 'Switched profile successfully',
+                profile: profileName,
+                tenant_id: credentials.tenant_id,
+                tenant_domain: credentials.tenant_domain,
+                organization_id: credentials.organization_id,
+                organization_name: credentials.organization_name,
+                user_email: credentials.user_email,
+            }));
+        }
+        else {
+            console.log((0, colors_1.success)(`✓ Switched to profile: ${(0, colors_1.bold)(profileName)}`));
+            console.log((0, colors_1.info)(`  Tenant: ${credentials.tenant_domain} (${credentials.tenant_id})`));
+            console.log((0, colors_1.info)(`  Organization: ${credentials.organization_name} (${credentials.organization_id})`));
+            console.log((0, colors_1.info)(`  User: ${credentials.user_email}`));
+        }
+    }
+    catch (err) {
+        if (jsonOutput) {
+            console.log(JSON.stringify({ success: false, error: err.message }));
+        }
+        else {
+            console.log((0, colors_1.error)('✗ Failed to switch profile: ' + err.message));
+        }
+        process.exit(1);
+    }
+}
+async function authStatus(profileName, jsonOutput) {
+    const currentProfile = profileName || (0, config_1.getCurrentProfile)();
+    const token = (0, config_1.getApiToken)(currentProfile);
+    const credentials = (0, config_1.loadCredentials)(currentProfile);
+    const config = (0, config_1.loadConfig)();
+    const allCredentials = (0, config_1.loadAllCredentials)();
+    const availableProfiles = Object.keys(allCredentials.profiles);
+    let tokenSource = 'none';
+    if (process.env.CARTO_API_TOKEN) {
+        tokenSource = 'environment';
+    }
+    else if (credentials) {
+        tokenSource = 'credentials';
+    }
+    else if (currentProfile === 'default' && config.apiToken) {
+        tokenSource = 'legacy_config';
+    }
+    // Get token expiration information
+    let tokenExpired = false;
+    let tokenExpiring = false;
+    let tokenExpirationTimestamp = null;
+    let tokenTimeRemaining = null;
+    let tokenExpirationFormatted = null;
+    if (token) {
+        tokenExpired = (0, auth_oauth_1.isTokenExpired)(token);
+        tokenExpiring = (0, auth_oauth_1.shouldWarnExpiration)(token);
+        tokenExpirationTimestamp = (0, auth_oauth_1.getTokenExpiration)(token);
+        tokenTimeRemaining = (0, auth_oauth_1.getTokenTimeRemaining)(token);
+        if (tokenExpirationTimestamp) {
+            const date = new Date(tokenExpirationTimestamp * 1000);
+            tokenExpirationFormatted = date.toLocaleString();
+        }
+    }
+    if (jsonOutput) {
+        console.log(JSON.stringify({
+            authenticated: !!token,
+            tokenSource,
+            currentProfile: allCredentials.current_profile,
+            requestedProfile: currentProfile,
+            credentialsFile: '~/.carto_credentials.json',
+            tenant_id: credentials?.tenant_id,
+            tenant_domain: credentials?.tenant_domain,
+            organization_id: credentials?.organization_id,
+            organization_name: credentials?.organization_name,
+            user_email: credentials?.user_email,
+            availableProfiles: availableProfiles,
+            tokenExpired,
+            tokenExpiring,
+            tokenExpirationTimestamp,
+            tokenExpirationFormatted,
+            tokenTimeRemaining,
+        }));
+    }
+    else {
+        if (token) {
+            // Show authentication status with expiration awareness
+            if (tokenExpired) {
+                console.log((0, colors_1.error)('✗ Token expired'));
+            }
+            else if (tokenExpiring) {
+                console.log((0, colors_1.warning)('⚠ Token expiring soon'));
+            }
+            else {
+                console.log((0, colors_1.success)('✓ Authenticated'));
+            }
+            console.log('');
+            console.log((0, colors_1.bold)(`Current profile: ${currentProfile}`) + (allCredentials.current_profile === currentProfile ? ' (default)' : ''));
+            console.log((0, colors_1.info)(`  Token source: ${tokenSource}`));
+            console.log((0, colors_1.info)(`  Token: ${token.substring(0, 20)}...`));
+            // Show expiration information if available
+            if (tokenExpirationTimestamp) {
+                console.log((0, colors_1.info)(`  Expiration: ${tokenExpirationFormatted}`));
+                if (tokenTimeRemaining !== null) {
+                    const timeStr = (0, auth_oauth_1.formatTimeRemaining)(tokenTimeRemaining);
+                    const timeDisplay = tokenExpired ? (0, colors_1.error)(`(${timeStr})`) :
+                        tokenExpiring ? (0, colors_1.warning)(`(in ${timeStr})`) :
+                            (0, colors_1.info)(`(in ${timeStr})`);
+                    console.log((0, colors_1.info)(`  Time remaining: `) + timeDisplay);
+                }
+                // Status indicator
+                const statusEmoji = tokenExpired ? '🔴' : tokenExpiring ? '🟡' : '🟢';
+                const statusText = tokenExpired ? 'Expired' : tokenExpiring ? 'Expiring soon' : 'Valid';
+                const statusColor = tokenExpired ? (0, colors_1.error)(statusText) : tokenExpiring ? (0, colors_1.warning)(statusText) : (0, colors_1.success)(statusText);
+                console.log((0, colors_1.info)(`  Status: ${statusEmoji} `) + statusColor);
+            }
+            if (credentials) {
+                console.log('');
+                // Only show auth environment for non-production
+                if (credentials.auth_environment && credentials.auth_environment !== 'production') {
+                    console.log((0, colors_1.info)(`  Auth Environment: ${credentials.auth_environment}`));
+                }
+                console.log((0, colors_1.info)(`  Tenant: ${credentials.tenant_domain} (${credentials.tenant_id})`));
+                if (credentials.organization_name) {
+                    console.log((0, colors_1.info)(`  Organization: ${credentials.organization_name} (${credentials.organization_id})`));
+                }
+                if (credentials.user_email) {
+                    console.log((0, colors_1.info)(`  User: ${credentials.user_email}`));
+                }
+            }
+            // Show available profiles
+            if (availableProfiles.length > 0) {
+                console.log((0, colors_1.info)(`\nAvailable profiles (${availableProfiles.length}):`));
+                availableProfiles.forEach((profile) => {
+                    const profileCreds = allCredentials.profiles[profile];
+                    const isCurrent = profile === currentProfile;
+                    const marker = isCurrent ? '→' : ' ';
+                    // Only show auth environment label for non-production
+                    const envLabel = (profileCreds.auth_environment && profileCreds.auth_environment !== 'production')
+                        ? ` [${profileCreds.auth_environment}]`
+                        : '';
+                    console.log((0, colors_1.info)(`  ${marker} ${(0, colors_1.bold)(profile)}${envLabel}`));
+                    console.log((0, colors_1.info)(`      Tenant: ${profileCreds.tenant_domain} (${profileCreds.tenant_id})`));
+                    if (profileCreds.organization_name) {
+                        console.log((0, colors_1.info)(`      Organization: ${profileCreds.organization_name} (${profileCreds.organization_id})`));
+                    }
+                    if (profileCreds.user_email) {
+                        console.log((0, colors_1.info)(`      User: ${profileCreds.user_email}`));
+                    }
+                });
+                console.log('');
+                console.log((0, colors_1.dim)(`Use "carto auth use <profile>" to switch profiles`));
+            }
+            // Show warnings/errors for token expiration
+            const reauthCmd = buildReauthCommand(currentProfile, credentials);
+            if (tokenExpired) {
+                console.log('');
+                if (tokenSource === 'environment') {
+                    console.log((0, colors_1.error)('🔴 Token has EXPIRED (from CARTO_API_TOKEN environment variable)'));
+                    console.log((0, colors_1.error)('   Please update your CARTO_API_TOKEN with a fresh token'));
+                }
+                else {
+                    console.log((0, colors_1.error)('🔴 Token has EXPIRED'));
+                    console.log((0, colors_1.error)('   Please re-authenticate to continue using the CLI:'));
+                    console.log((0, colors_1.bold)('   ' + reauthCmd));
+                }
+            }
+            else if (tokenExpiring && tokenTimeRemaining !== null) {
+                console.log('');
+                console.log((0, colors_1.warning)('⚠️  Warning: Token is expiring soon'));
+                console.log((0, colors_1.warning)(`   Less than 10% of token lifetime remaining`));
+                if (tokenSource === 'environment') {
+                    console.log((0, colors_1.warning)('   Consider updating your CARTO_API_TOKEN with a fresh token'));
+                }
+                else {
+                    console.log((0, colors_1.warning)('   Consider re-authenticating to avoid interruptions:'));
+                    console.log((0, colors_1.bold)('   ' + reauthCmd));
+                }
+            }
+        }
+        else {
+            console.log((0, colors_1.error)('✗ Not authenticated'));
+            // Build suggested login command
+            // For not-authenticated case, we can't load credentials, so just use profile name
+            let loginCmd = 'carto auth login';
+            if (currentProfile && currentProfile !== 'default') {
+                const needsQuotes = currentProfile.includes(' ') || currentProfile.includes('@') || currentProfile.includes('/');
+                loginCmd += needsQuotes ? ` "${currentProfile}"` : ` ${currentProfile}`;
+            }
+            console.log((0, colors_1.info)(`Use "${loginCmd}" to authenticate`));
+            // Show available profiles even when not authenticated with current profile
+            if (availableProfiles.length > 0) {
+                console.log((0, colors_1.info)(`\nAvailable profiles (${availableProfiles.length}):`));
+                availableProfiles.forEach((profile) => {
+                    const profileCreds = allCredentials.profiles[profile];
+                    const isCurrent = profile === currentProfile;
+                    const marker = isCurrent ? '→' : ' ';
+                    console.log((0, colors_1.info)(`  ${marker} ${(0, colors_1.bold)(profile)}: ${profileCreds.tenant_domain}`));
+                });
+            }
+        }
+    }
+}
+async function authWhoami(token, baseUrl, jsonOutput, debug = false, profile) {
+    try {
+        const client = await api_1.ApiClient.create(token, baseUrl, debug, profile);
+        // Get accounts URL from profile credentials (environment-specific)
+        const profileName = profile || (0, config_1.getCurrentProfile)();
+        const credentials = (0, config_1.loadCredentials)(profileName);
+        const accountsUrl = (0, auth_oauth_1.getAccountsUrl)(credentials?.auth_environment || auth_oauth_1.DEFAULT_AUTH_ENVIRONMENT);
+        // Call the user info endpoint
+        const userInfo = await client.getFullUrl(`${accountsUrl}/users/me`, true);
+        if (jsonOutput) {
+            console.log(JSON.stringify(userInfo));
+        }
+        else {
+            console.log((0, colors_1.bold)('\n=== Current User ===\n'));
+            console.log((0, colors_1.bold)('User ID: ') + userInfo.user_id);
+            console.log((0, colors_1.bold)('Name: ') + (userInfo.name || 'N/A'));
+            console.log((0, colors_1.bold)('Email: ') + userInfo.email);
+            console.log((0, colors_1.bold)('Nickname: ') + (userInfo.nickname || 'N/A'));
+            if (userInfo.user_metadata) {
+                console.log((0, colors_1.bold)('\nAccount Info:'));
+                console.log('  Account ID: ' + userInfo.user_metadata.account_id);
+                console.log('  Account Name: ' + userInfo.user_metadata.account_name);
+                console.log('  Tenant: ' + userInfo.user_metadata.tenant_domain + ' (' + userInfo.user_metadata.tenant_id + ')');
+            }
+            if (userInfo.app_metadata?.roles && userInfo.app_metadata.roles.length > 0) {
+                console.log((0, colors_1.bold)('\nRoles: ') + userInfo.app_metadata.roles.join(', '));
+            }
+            console.log((0, colors_1.bold)('\nEmail Verified: ') + (userInfo.email_verified ? 'Yes' : 'No'));
+            console.log((0, colors_1.bold)('Created: ') + new Date(userInfo.created_at).toLocaleString());
+        }
+    }
+    catch (err) {
+        if (jsonOutput) {
+            console.log(JSON.stringify({ success: false, error: err.message }));
+        }
+        else {
+            if (err.message.includes('401') || err.message.includes('Token not defined')) {
+                console.log((0, colors_1.error)('✗ Authentication required'));
+                console.log('Please run: carto auth login');
+            }
+            else {
+                console.log((0, colors_1.error)('✗ Failed to get user info: ' + err.message));
+            }
+        }
+        process.exit(1);
+    }
+}
+/**
+ * M2M (Machine-to-Machine) OAuth login for CI/CD environments
+ * Uses OAuth client_credentials grant - no browser interaction required
+ */
+async function authLoginM2M(profileName, jsonOutput, env, clientId, clientSecret, apiBaseUrl, force) {
+    try {
+        // Determine profile name early - for M2M, default to 'm2m' if not specified
+        const targetProfileName = profileName || 'm2m';
+        // Check for existing valid token (unless --force is used)
+        if (!force) {
+            const existingCredentials = (0, config_1.loadCredentials)(targetProfileName);
+            if (existingCredentials?.token) {
+                const tokenExpired = (0, auth_oauth_1.isTokenExpired)(existingCredentials.token);
+                const timeRemaining = (0, auth_oauth_1.getTokenTimeRemaining)(existingCredentials.token);
+                if (!tokenExpired && timeRemaining !== null && timeRemaining > 0) {
+                    // Token is still valid - reuse it
+                    if (jsonOutput) {
+                        console.log(JSON.stringify({
+                            success: true,
+                            message: 'Using existing valid M2M token',
+                            profile: targetProfileName,
+                            organization_id: existingCredentials.organization_id || null,
+                            api_base_url: existingCredentials.base_url,
+                            type: 'm2m-service-account',
+                            time_remaining_seconds: timeRemaining,
+                            reused: true
+                        }));
+                    }
+                    else {
+                        console.log('');
+                        console.log((0, colors_1.success)(`✓ Valid M2M token found for profile: ${(0, colors_1.bold)(targetProfileName)}`));
+                        console.log((0, colors_1.info)(`  Time remaining: ${(0, auth_oauth_1.formatTimeRemaining)(timeRemaining)}`));
+                        if (existingCredentials.organization_id) {
+                            console.log((0, colors_1.info)(`  Organization: ${existingCredentials.organization_id}`));
+                        }
+                        console.log((0, colors_1.info)(`  API Base URL: ${existingCredentials.base_url}`));
+                        console.log('');
+                        console.log((0, colors_1.dim)('  Use --force to request a new token'));
+                    }
+                    // Set as current profile
+                    (0, config_1.setCurrentProfile)(targetProfileName);
+                    return;
+                }
+            }
+        }
+        // Get credentials from: flags > env vars
+        const finalClientId = clientId || process.env.CARTO_M2M_CLIENT_ID;
+        const finalClientSecret = clientSecret || process.env.CARTO_M2M_CLIENT_SECRET;
+        if (!finalClientId || !finalClientSecret) {
+            const missing = [];
+            if (!finalClientId)
+                missing.push('client_id');
+            if (!finalClientSecret)
+                missing.push('client_secret');
+            if (jsonOutput) {
+                console.log(JSON.stringify({
+                    success: false,
+                    error: `Missing M2M credentials: ${missing.join(', ')}`,
+                    hint: 'Provide via --client-id/--client-secret flags or CARTO_M2M_CLIENT_ID/CARTO_M2M_CLIENT_SECRET environment variables'
+                }));
+            }
+            else {
+                console.log((0, colors_1.error)(`✗ Missing M2M credentials: ${missing.join(', ')}`));
+                console.log((0, colors_1.info)('  Provide via flags:'));
+                console.log((0, colors_1.info)('    carto auth login --m2m --client-id <id> --client-secret <secret>'));
+                console.log((0, colors_1.info)('  Or via environment variables:'));
+                console.log((0, colors_1.info)('    export CARTO_M2M_CLIENT_ID="your-client-id"'));
+                console.log((0, colors_1.info)('    export CARTO_M2M_CLIENT_SECRET="your-client-secret"'));
+                console.log((0, colors_1.info)('    carto auth login --m2m'));
+            }
+            process.exit(1);
+        }
+        // Get M2M auth config for the environment
+        const m2mConfig = (0, auth_oauth_1.getM2MAuthConfig)(env);
+        if (!jsonOutput) {
+            console.log('');
+            console.log((0, colors_1.info)('🔐 M2M Authentication (CI/CD mode)'));
+            const envName = env || auth_oauth_1.DEFAULT_AUTH_ENVIRONMENT;
+            if (envName !== 'production') {
+                console.log((0, colors_1.info)(`   Auth Environment: ${m2mConfig.domain}`));
+            }
+            console.log('');
+            console.log((0, colors_1.info)('🔄 Exchanging M2M credentials for access token...'));
+        }
+        // Exchange M2M credentials for token
+        const tokenResponse = await (0, auth_oauth_1.exchangeM2MCredentialsForToken)(m2mConfig, finalClientId, finalClientSecret);
+        const accessToken = tokenResponse.access_token;
+        if (!jsonOutput) {
+            console.log((0, colors_1.success)('✓ Token obtained successfully'));
+        }
+        // M2M tokens don't have a user - extract info from JWT claims
+        let organizationId = '';
+        try {
+            const tokenPayload = (0, auth_oauth_1.decodeJWT)(accessToken);
+            // CARTO M2M tokens include account info in http://app.carto.com/account_id claim
+            organizationId = tokenPayload['http://app.carto.com/account_id'] || '';
+        }
+        catch (decodeErr) {
+            // If JWT decode fails, continue with empty values
+            if (!jsonOutput) {
+                console.log((0, colors_1.warning)('⚠ Could not extract details from token'));
+            }
+        }
+        // For M2M, we need the API base URL - default to production gcp-us-east1
+        const finalBaseUrl = apiBaseUrl || process.env.CARTO_API_BASE_URL || 'https://gcp-us-east1.api.carto.com';
+        // Build credentials object - M2M stores base_url directly since there's no tenant lookup
+        const fullCredentials = {
+            token: accessToken,
+            tenant_id: '',
+            tenant_domain: '',
+            organization_id: organizationId,
+            organization_name: '',
+            user_email: 'm2m-service-account',
+            auth_environment: env || auth_oauth_1.DEFAULT_AUTH_ENVIRONMENT,
+            base_url: finalBaseUrl,
+        };
+        // Save credentials (targetProfileName was determined at the start of the function)
+        (0, config_1.saveCredentials)(targetProfileName, fullCredentials);
+        if (jsonOutput) {
+            console.log(JSON.stringify({
+                success: true,
+                message: 'M2M authentication successful',
+                profile: targetProfileName,
+                organization_id: fullCredentials.organization_id || null,
+                api_base_url: fullCredentials.base_url,
+                type: 'm2m-service-account',
+                expires_in: tokenResponse.expires_in,
+            }));
+        }
+        else {
+            console.log((0, colors_1.success)('\n✓ M2M authentication successful!'));
+            if (fullCredentials.organization_id) {
+                console.log((0, colors_1.info)(`  Organization: ${fullCredentials.organization_id}`));
+            }
+            console.log((0, colors_1.info)(`  API Base URL: ${fullCredentials.base_url}`));
+            console.log((0, colors_1.info)(`  Type: M2M Service Account`));
+            console.log((0, colors_1.info)(`  Token expires in: ${Math.floor(tokenResponse.expires_in / 3600)} hours`));
+            console.log('');
+            console.log((0, colors_1.success)(`✓ Credentials saved as profile: ${(0, colors_1.bold)(targetProfileName)}`));
+            console.log((0, colors_1.success)(`✓ Set as current profile`));
+        }
+    }
+    catch (err) {
+        if (jsonOutput) {
+            console.log(JSON.stringify({ success: false, error: err.message }));
+        }
+        else {
+            console.log((0, colors_1.error)('\n✗ M2M authentication failed: ' + err.message));
+            if (err.message.includes('Invalid M2M credentials')) {
+                console.log((0, colors_1.info)('  Check your CARTO_M2M_CLIENT_ID and CARTO_M2M_CLIENT_SECRET values'));
+            }
+        }
+        process.exit(1);
+    }
+}