convex 1.46.0 → 1.48.0-alpha.0

package/dist/esm/cli/lib/profileManagement.js

@@ -0,0 +1,179 @@
+"use strict";
+import { logMessage, logWarning } from "../../bundler/log.js";
+import { provisionHost } from "./config.js";
+import { version } from "../version.js";
+import {
+  isAnonymousDeployment,
+  getDeploymentTypeFromConfiguredDeployment,
+  stripDeploymentTypePrefix
+} from "./deployment.js";
+import { CONVEX_DEPLOYMENT_ENV_VAR_NAME } from "./utils/utils.js";
+import { promptYesNo } from "./utils/prompts.js";
+import { loadProjectEnvironmentVariables } from "./envvars.js";
+import {
+  readProfileCredentials,
+  readProfileSettings,
+  readProfileToken,
+  savedProfileNames,
+  writeProfileDirectory
+} from "./profiles.js";
+export async function profileApi(token, pathname, body) {
+  return await fetch(`${provisionHost}${pathname}`, {
+    method: body === void 0 ? "GET" : "POST",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Convex-Client": `npm-cli-${version}`,
+      ...body === void 0 ? {} : { "Content-Type": "application/json" }
+    },
+    ...body === void 0 ? {} : { body: JSON.stringify(body) },
+    signal: AbortSignal.timeout(1e4)
+  });
+}
+export async function deploymentAccess(token, deploymentName) {
+  try {
+    const response = await profileApi(
+      token,
+      `/v1/deployments/${encodeURIComponent(deploymentName)}`
+    );
+    if (response.ok) return "yes";
+    return [401, 403, 404].includes(response.status) ? "no" : "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+export async function projectAccess(token, target) {
+  if (target.kind === "deploymentName")
+    return deploymentAccess(token, target.deploymentName);
+  if (target.kind !== "teamAndProjectSlugs") return "unknown";
+  try {
+    const response = await profileApi(
+      token,
+      `/v1/teams/${encodeURIComponent(target.teamSlug)}/projects/${encodeURIComponent(target.projectSlug)}`
+    );
+    if (response.ok) return "yes";
+    return [401, 403, 404].includes(response.status) ? "no" : "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+function configuredCloudDeployment() {
+  const configured = process.env[CONVEX_DEPLOYMENT_ENV_VAR_NAME]?.trim();
+  if (!configured || getDeploymentTypeFromConfiguredDeployment(configured) === "local")
+    return null;
+  const name = stripDeploymentTypePrefix(configured);
+  return isAnonymousDeployment(name) ? null : name;
+}
+export async function bindProfileToDirectory(ctx, name, force = false, target) {
+  const credentials = await readProfileCredentials(ctx, {
+    name,
+    source: "account selection"
+  });
+  loadProjectEnvironmentVariables();
+  const deployment = configuredCloudDeployment();
+  const selectedTarget = target ?? (deployment === null ? null : {
+    kind: "deploymentName",
+    deploymentName: deployment,
+    deploymentType: null
+  });
+  if (!force && selectedTarget !== null) {
+    const label = selectedTarget.kind === "teamAndProjectSlugs" ? `project "${selectedTarget.teamSlug}/${selectedTarget.projectSlug}"` : `deployment "${selectedTarget.kind === "deploymentName" ? selectedTarget.deploymentName : "configured"}"`;
+    const access = await projectAccess(
+      credentials.accessToken,
+      selectedTarget
+    );
+    if (access !== "yes") {
+      logWarning(
+        access === "no" ? `Account "${name}" cannot access ${label}.` : `Could not verify whether account "${name}" can access ${label}.`
+      );
+      if (!process.stdin.isTTY || !await promptYesNo(ctx, {
+        message: `Use account "${name}" here anyway?`,
+        default: false
+      })) {
+        logMessage(
+          `Directory selection unchanged. To select this account anyway, run \`npx convex account select ${name} --force\`.`
+        );
+        return false;
+      }
+    }
+  }
+  await writeProfileDirectory(ctx, name);
+  return true;
+}
+export async function profileLoginMetadata(ctx, profile, loginToken, previous) {
+  let identity = null;
+  try {
+    const response = await profileApi(loginToken, "/api/dashboard/profile");
+    if (response.ok) {
+      const data = await response.json();
+      if ((typeof data.id === "number" || typeof data.id === "string") && typeof data.email === "string") {
+        identity = { memberId: String(data.id), email: data.email };
+      }
+    }
+  } catch {
+  }
+  const sameAccount = previous !== null && (previous.memberId === void 0 || identity === null) ? await tokensBelongToSameAccount(previous.accessToken, loginToken) : null;
+  if (previous !== null && (previous.memberId === void 0 || identity === null ? sameAccount !== true : identity.memberId !== previous.memberId)) {
+    return await ctx.crash({
+      exitCode: 1,
+      errorType: "fatal",
+      printedMessage: sameAccount === null && (previous.memberId === void 0 || identity === null) ? `Could not verify the identity of saved account "${profile.name}". To replace this saved login, run \`npx convex logout --account ${profile.name}\` followed by \`npx convex login --account ${profile.name}\`. Choose the intended account when logging in.` : `The login does not match saved account "${profile.name}". Log in with the matching account, or choose another name with \`npx convex login --account <name>\`.`
+    });
+  }
+  return {
+    ...identity ?? (previous?.memberId === void 0 ? {} : { memberId: previous.memberId, email: previous.email })
+  };
+}
+async function tokensBelongToSameAccount(older, newer) {
+  try {
+    const responses = await Promise.all(
+      [older, newer].map(
+        (token) => profileApi(token, "/v1/list_personal_access_tokens?limit=100")
+      )
+    );
+    if (responses.some((response) => !response.ok)) return null;
+    const lists = await Promise.all(
+      responses.map((response) => response.json())
+    );
+    if (lists.some(
+      (list) => !Array.isArray(list.items) || list.items.length === 0
+    ))
+      return null;
+    const ids = new Set(
+      lists[0].items.map((token) => String(token.id))
+    );
+    if (lists[1].items.some((token) => ids.has(String(token.id))))
+      return true;
+    return lists.some((list) => list.pagination?.hasMore !== false) ? null : false;
+  } catch {
+    return null;
+  }
+}
+export async function revokeReplacedProfileToken(ctx, previous, accessToken) {
+  if (previous === void 0 || previous === accessToken) return;
+  const settings = await readProfileSettings(ctx);
+  if (settings.revokeReplacedTokens === false || settings.accessToken === previous)
+    return;
+  for (const name of savedProfileNames(ctx)) {
+    const token = readProfileToken(ctx, name);
+    if (token === null) {
+      logWarning(
+        `The new login was saved, but account "${name}" could not be read. Skipping revocation of the replaced token.`
+      );
+      return;
+    }
+    if (token === previous) return;
+  }
+  try {
+    const response = await profileApi(
+      accessToken,
+      "/v1/delete_personal_access_token",
+      { id: previous }
+    );
+    if (response.ok) return;
+  } catch {
+  }
+  logWarning(
+    "The new login was saved, but the replaced token could not be revoked. You can remove it in the dashboard's account settings."
+  );
+}
+//# sourceMappingURL=profileManagement.js.map

package/dist/esm/cli/lib/profileManagement.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/cli/lib/profileManagement.ts"],
+  "sourcesContent": ["import { ProjectSelection } from \"./deploymentSelection.js\";\nimport { Context } from \"../../bundler/context.js\";\nimport { logMessage, logWarning } from \"../../bundler/log.js\";\nimport { provisionHost } from \"./config.js\";\nimport { version } from \"../version.js\";\nimport {\n  isAnonymousDeployment,\n  getDeploymentTypeFromConfiguredDeployment,\n  stripDeploymentTypePrefix,\n} from \"./deployment.js\";\nimport { CONVEX_DEPLOYMENT_ENV_VAR_NAME } from \"./utils/utils.js\";\nimport { promptYesNo } from \"./utils/prompts.js\";\nimport { loadProjectEnvironmentVariables } from \"./envvars.js\";\nimport {\n  ProfileCredentials,\n  ProfileSelection,\n  readProfileCredentials,\n  readProfileSettings,\n  readProfileToken,\n  savedProfileNames,\n  writeProfileDirectory,\n} from \"./profiles.js\";\n\nexport async function profileApi(\n  token: string,\n  pathname: string,\n  body?: unknown,\n) {\n  return await fetch(`${provisionHost}${pathname}`, {\n    method: body === undefined ? \"GET\" : \"POST\",\n    headers: {\n      Authorization: `Bearer ${token}`,\n      \"Convex-Client\": `npm-cli-${version}`,\n      ...(body === undefined ? {} : { \"Content-Type\": \"application/json\" }),\n    },\n    ...(body === undefined ? {} : { body: JSON.stringify(body) }),\n    signal: AbortSignal.timeout(10_000),\n  });\n}\n\nexport async function deploymentAccess(\n  token: string,\n  deploymentName: string,\n): Promise<\"yes\" | \"no\" | \"unknown\"> {\n  try {\n    const response = await profileApi(\n      token,\n      `/v1/deployments/${encodeURIComponent(deploymentName)}`,\n    );\n    if (response.ok) return \"yes\";\n    return [401, 403, 404].includes(response.status) ? \"no\" : \"unknown\";\n  } catch {\n    return \"unknown\";\n  }\n}\n\nexport async function projectAccess(\n  token: string,\n  target: ProjectSelection,\n): Promise<\"yes\" | \"no\" | \"unknown\"> {\n  if (target.kind === \"deploymentName\")\n    return deploymentAccess(token, target.deploymentName);\n  if (target.kind !== \"teamAndProjectSlugs\") return \"unknown\";\n  try {\n    const response = await profileApi(\n      token,\n      `/v1/teams/${encodeURIComponent(target.teamSlug)}/projects/${encodeURIComponent(target.projectSlug)}`,\n    );\n    if (response.ok) return \"yes\";\n    return [401, 403, 404].includes(response.status) ? \"no\" : \"unknown\";\n  } catch {\n    return \"unknown\";\n  }\n}\n\nfunction configuredCloudDeployment(): string | null {\n  const configured = process.env[CONVEX_DEPLOYMENT_ENV_VAR_NAME]?.trim();\n  if (\n    !configured ||\n    getDeploymentTypeFromConfiguredDeployment(configured) === \"local\"\n  )\n    return null;\n  const name = stripDeploymentTypePrefix(configured);\n  return isAnonymousDeployment(name) ? null : name;\n}\n\nexport async function bindProfileToDirectory(\n  ctx: Context,\n  name: string,\n  force = false,\n  target?: ProjectSelection,\n): Promise<boolean> {\n  const credentials = await readProfileCredentials(ctx, {\n    name,\n    source: \"account selection\",\n  });\n  loadProjectEnvironmentVariables();\n  const deployment = configuredCloudDeployment();\n  const selectedTarget =\n    target ??\n    (deployment === null\n      ? null\n      : {\n          kind: \"deploymentName\" as const,\n          deploymentName: deployment,\n          deploymentType: null,\n        });\n  if (!force && selectedTarget !== null) {\n    const label =\n      selectedTarget.kind === \"teamAndProjectSlugs\"\n        ? `project \"${selectedTarget.teamSlug}/${selectedTarget.projectSlug}\"`\n        : `deployment \"${selectedTarget.kind === \"deploymentName\" ? selectedTarget.deploymentName : \"configured\"}\"`;\n    const access = await projectAccess(\n      credentials!.accessToken,\n      selectedTarget,\n    );\n    if (access !== \"yes\") {\n      logWarning(\n        access === \"no\"\n          ? `Account \"${name}\" cannot access ${label}.`\n          : `Could not verify whether account \"${name}\" can access ${label}.`,\n      );\n      if (\n        !process.stdin.isTTY ||\n        !(await promptYesNo(ctx, {\n          message: `Use account \"${name}\" here anyway?`,\n          default: false,\n        }))\n      ) {\n        logMessage(\n          `Directory selection unchanged. To select this account anyway, run \\`npx convex account select ${name} --force\\`.`,\n        );\n        return false;\n      }\n    }\n  }\n  await writeProfileDirectory(ctx, name);\n  return true;\n}\n\nexport async function profileLoginMetadata(\n  ctx: Context,\n  profile: ProfileSelection,\n  loginToken: string,\n  previous: ProfileCredentials | null,\n): Promise<Omit<ProfileCredentials, \"accessToken\">> {\n  let identity: { memberId: string; email: string } | null = null;\n  try {\n    const response = await profileApi(loginToken, \"/api/dashboard/profile\");\n    if (response.ok) {\n      const data = await response.json();\n      if (\n        (typeof data.id === \"number\" || typeof data.id === \"string\") &&\n        typeof data.email === \"string\"\n      ) {\n        identity = { memberId: String(data.id), email: data.email };\n      }\n    }\n  } catch {\n    // Older authentication tokens can be valid without access to the dashboard profile API.\n  }\n  const sameAccount =\n    previous !== null && (previous.memberId === undefined || identity === null)\n      ? await tokensBelongToSameAccount(previous.accessToken, loginToken)\n      : null;\n  if (\n    previous !== null &&\n    (previous.memberId === undefined || identity === null\n      ? sameAccount !== true\n      : identity.memberId !== previous.memberId)\n  ) {\n    return await ctx.crash({\n      exitCode: 1,\n      errorType: \"fatal\",\n      printedMessage:\n        sameAccount === null &&\n        (previous.memberId === undefined || identity === null)\n          ? `Could not verify the identity of saved account \"${profile.name}\". To replace this saved login, run \\`npx convex logout --account ${profile.name}\\` followed by \\`npx convex login --account ${profile.name}\\`. Choose the intended account when logging in.`\n          : `The login does not match saved account \"${profile.name}\". Log in with the matching account, or choose another name with \\`npx convex login --account <name>\\`.`,\n    });\n  }\n  return {\n    ...(identity ??\n      (previous?.memberId === undefined\n        ? {}\n        : { memberId: previous.memberId, email: previous.email })),\n  };\n}\n\nasync function tokensBelongToSameAccount(\n  older: string,\n  newer: string,\n): Promise<boolean | null> {\n  try {\n    const responses = await Promise.all(\n      [older, newer].map((token) =>\n        profileApi(token, \"/v1/list_personal_access_tokens?limit=100\"),\n      ),\n    );\n    if (responses.some((response) => !response.ok)) return null;\n    const lists = await Promise.all(\n      responses.map((response) => response.json()),\n    );\n    if (\n      lists.some(\n        (list) => !Array.isArray(list.items) || list.items.length === 0,\n      )\n    )\n      return null;\n    const ids = new Set(\n      lists[0].items.map((token: { id: unknown }) => String(token.id)),\n    );\n    if (\n      lists[1].items.some((token: { id: unknown }) => ids.has(String(token.id)))\n    )\n      return true;\n    // Disjoint partial pages cannot establish that the accounts differ.\n    return lists.some((list) => list.pagination?.hasMore !== false)\n      ? null\n      : false;\n  } catch {\n    return null;\n  }\n}\n\nexport async function revokeReplacedProfileToken(\n  ctx: Context,\n  previous: string | undefined,\n  accessToken: string,\n) {\n  if (previous === undefined || previous === accessToken) return;\n  const settings = await readProfileSettings(ctx);\n  if (\n    settings.revokeReplacedTokens === false ||\n    settings.accessToken === previous\n  )\n    return;\n  for (const name of savedProfileNames(ctx)) {\n    const token = readProfileToken(ctx, name);\n    if (token === null) {\n      logWarning(\n        `The new login was saved, but account \"${name}\" could not be read. Skipping revocation of the replaced token.`,\n      );\n      return;\n    }\n    if (token === previous) return;\n  }\n  try {\n    // The API verifies token ownership using the newly authenticated account.\n    const response = await profileApi(\n      accessToken,\n      \"/v1/delete_personal_access_token\",\n      { id: previous },\n    );\n    if (response.ok) return;\n  } catch {\n    // The new credentials are already saved, so a failed revocation can be retried in the dashboard.\n  }\n  logWarning(\n    \"The new login was saved, but the replaced token could not be revoked. You can remove it in the dashboard's account settings.\",\n  );\n}\n"],
+  "mappings": ";AAEA,SAAS,YAAY,kBAAkB;AACvC,SAAS,qBAAqB;AAC9B,SAAS,eAAe;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sCAAsC;AAC/C,SAAS,mBAAmB;AAC5B,SAAS,uCAAuC;AAChD;AAAA,EAGE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,sBAAsB,WACpB,OACA,UACA,MACA;AACA,SAAO,MAAM,MAAM,GAAG,aAAa,GAAG,QAAQ,IAAI;AAAA,IAChD,QAAQ,SAAS,SAAY,QAAQ;AAAA,IACrC,SAAS;AAAA,MACP,eAAe,UAAU,KAAK;AAAA,MAC9B,iBAAiB,WAAW,OAAO;AAAA,MACnC,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;AAAA,IACrE;AAAA,IACA,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,IAAI,EAAE;AAAA,IAC3D,QAAQ,YAAY,QAAQ,GAAM;AAAA,EACpC,CAAC;AACH;AAEA,sBAAsB,iBACpB,OACA,gBACmC;AACnC,MAAI;AACF,UAAM,WAAW,MAAM;AAAA,MACrB;AAAA,MACA,mBAAmB,mBAAmB,cAAc,CAAC;AAAA,IACvD;AACA,QAAI,SAAS,GAAI,QAAO;AACxB,WAAO,CAAC,KAAK,KAAK,GAAG,EAAE,SAAS,SAAS,MAAM,IAAI,OAAO;AAAA,EAC5D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,sBAAsB,cACpB,OACA,QACmC;AACnC,MAAI,OAAO,SAAS;AAClB,WAAO,iBAAiB,OAAO,OAAO,cAAc;AACtD,MAAI,OAAO,SAAS,sBAAuB,QAAO;AAClD,MAAI;AACF,UAAM,WAAW,MAAM;AAAA,MACrB;AAAA,MACA,aAAa,mBAAmB,OAAO,QAAQ,CAAC,aAAa,mBAAmB,OAAO,WAAW,CAAC;AAAA,IACrG;AACA,QAAI,SAAS,GAAI,QAAO;AACxB,WAAO,CAAC,KAAK,KAAK,GAAG,EAAE,SAAS,SAAS,MAAM,IAAI,OAAO;AAAA,EAC5D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,4BAA2C;AAClD,QAAM,aAAa,QAAQ,IAAI,8BAA8B,GAAG,KAAK;AACrE,MACE,CAAC,cACD,0CAA0C,UAAU,MAAM;AAE1D,WAAO;AACT,QAAM,OAAO,0BAA0B,UAAU;AACjD,SAAO,sBAAsB,IAAI,IAAI,OAAO;AAC9C;AAEA,sBAAsB,uBACpB,KACA,MACA,QAAQ,OACR,QACkB;AAClB,QAAM,cAAc,MAAM,uBAAuB,KAAK;AAAA,IACpD;AAAA,IACA,QAAQ;AAAA,EACV,CAAC;AACD,kCAAgC;AAChC,QAAM,aAAa,0BAA0B;AAC7C,QAAM,iBACJ,WACC,eAAe,OACZ,OACA;AAAA,IACE,MAAM;AAAA,IACN,gBAAgB;AAAA,IAChB,gBAAgB;AAAA,EAClB;AACN,MAAI,CAAC,SAAS,mBAAmB,MAAM;AACrC,UAAM,QACJ,eAAe,SAAS,wBACpB,YAAY,eAAe,QAAQ,IAAI,eAAe,WAAW,MACjE,eAAe,eAAe,SAAS,mBAAmB,eAAe,iBAAiB,YAAY;AAC5G,UAAM,SAAS,MAAM;AAAA,MACnB,YAAa;AAAA,MACb;AAAA,IACF;AACA,QAAI,WAAW,OAAO;AACpB;AAAA,QACE,WAAW,OACP,YAAY,IAAI,mBAAmB,KAAK,MACxC,qCAAqC,IAAI,gBAAgB,KAAK;AAAA,MACpE;AACA,UACE,CAAC,QAAQ,MAAM,SACf,CAAE,MAAM,YAAY,KAAK;AAAA,QACvB,SAAS,gBAAgB,IAAI;AAAA,QAC7B,SAAS;AAAA,MACX,CAAC,GACD;AACA;AAAA,UACE,iGAAiG,IAAI;AAAA,QACvG;AACA,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACA,QAAM,sBAAsB,KAAK,IAAI;AACrC,SAAO;AACT;AAEA,sBAAsB,qBACpB,KACA,SACA,YACA,UACkD;AAClD,MAAI,WAAuD;AAC3D,MAAI;AACF,UAAM,WAAW,MAAM,WAAW,YAAY,wBAAwB;AACtE,QAAI,SAAS,IAAI;AACf,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,WACG,OAAO,KAAK,OAAO,YAAY,OAAO,KAAK,OAAO,aACnD,OAAO,KAAK,UAAU,UACtB;AACA,mBAAW,EAAE,UAAU,OAAO,KAAK,EAAE,GAAG,OAAO,KAAK,MAAM;AAAA,MAC5D;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AACA,QAAM,cACJ,aAAa,SAAS,SAAS,aAAa,UAAa,aAAa,QAClE,MAAM,0BAA0B,SAAS,aAAa,UAAU,IAChE;AACN,MACE,aAAa,SACZ,SAAS,aAAa,UAAa,aAAa,OAC7C,gBAAgB,OAChB,SAAS,aAAa,SAAS,WACnC;AACA,WAAO,MAAM,IAAI,MAAM;AAAA,MACrB,UAAU;AAAA,MACV,WAAW;AAAA,MACX,gBACE,gBAAgB,SACf,SAAS,aAAa,UAAa,aAAa,QAC7C,mDAAmD,QAAQ,IAAI,qEAAqE,QAAQ,IAAI,+CAA+C,QAAQ,IAAI,qDAC3M,2CAA2C,QAAQ,IAAI;AAAA,IAC/D,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,GAAI,aACD,UAAU,aAAa,SACpB,CAAC,IACD,EAAE,UAAU,SAAS,UAAU,OAAO,SAAS,MAAM;AAAA,EAC7D;AACF;AAEA,eAAe,0BACb,OACA,OACyB;AACzB,MAAI;AACF,UAAM,YAAY,MAAM,QAAQ;AAAA,MAC9B,CAAC,OAAO,KAAK,EAAE;AAAA,QAAI,CAAC,UAClB,WAAW,OAAO,2CAA2C;AAAA,MAC/D;AAAA,IACF;AACA,QAAI,UAAU,KAAK,CAAC,aAAa,CAAC,SAAS,EAAE,EAAG,QAAO;AACvD,UAAM,QAAQ,MAAM,QAAQ;AAAA,MAC1B,UAAU,IAAI,CAAC,aAAa,SAAS,KAAK,CAAC;AAAA,IAC7C;AACA,QACE,MAAM;AAAA,MACJ,CAAC,SAAS,CAAC,MAAM,QAAQ,KAAK,KAAK,KAAK,KAAK,MAAM,WAAW;AAAA,IAChE;AAEA,aAAO;AACT,UAAM,MAAM,IAAI;AAAA,MACd,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC,UAA2B,OAAO,MAAM,EAAE,CAAC;AAAA,IACjE;AACA,QACE,MAAM,CAAC,EAAE,MAAM,KAAK,CAAC,UAA2B,IAAI,IAAI,OAAO,MAAM,EAAE,CAAC,CAAC;AAEzE,aAAO;AAET,WAAO,MAAM,KAAK,CAAC,SAAS,KAAK,YAAY,YAAY,KAAK,IAC1D,OACA;AAAA,EACN,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,sBAAsB,2BACpB,KACA,UACA,aACA;AACA,MAAI,aAAa,UAAa,aAAa,YAAa;AACxD,QAAM,WAAW,MAAM,oBAAoB,GAAG;AAC9C,MACE,SAAS,yBAAyB,SAClC,SAAS,gBAAgB;AAEzB;AACF,aAAW,QAAQ,kBAAkB,GAAG,GAAG;AACzC,UAAM,QAAQ,iBAAiB,KAAK,IAAI;AACxC,QAAI,UAAU,MAAM;AAClB;AAAA,QACE,yCAAyC,IAAI;AAAA,MAC/C;AACA;AAAA,IACF;AACA,QAAI,UAAU,SAAU;AAAA,EAC1B;AACA,MAAI;AAEF,UAAM,WAAW,MAAM;AAAA,MACrB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,SAAS;AAAA,IACjB;AACA,QAAI,SAAS,GAAI;AAAA,EACnB,QAAQ;AAAA,EAER;AACA;AAAA,IACE;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/esm/cli/lib/profiles.js

@@ -0,0 +1,288 @@
+"use strict";
+import path from "path";
+import { isDeepStrictEqual } from "util";
+import { randomUUID } from "crypto";
+import * as dotenv from "dotenv";
+import { z } from "zod";
+import { logFinishedStep, logWarning } from "../../bundler/log.js";
+import { globalConfigPath, readGlobalConfig } from "./utils/globalConfig.js";
+import { ENV_VAR_FILE_PATH, rootDirectory } from "./utils/utils.js";
+import { CONVEX_ACCOUNT_ENV_VAR } from "./envvars.js";
+const settingsSchema = z.object({
+  defaultProfile: z.string().optional(),
+  directories: z.record(z.string()).optional(),
+  revokeReplacedTokens: z.boolean().optional()
+}).passthrough();
+const credentialsSchema = z.object({
+  accessToken: z.string().min(1),
+  memberId: z.string().optional(),
+  email: z.string().optional()
+}).passthrough();
+export async function readProfileSettings(ctx) {
+  if (!ctx.fs.exists(globalConfigPath())) return {};
+  try {
+    return settingsSchema.parse(
+      JSON.parse(ctx.fs.readUtf8File(globalConfigPath()))
+    );
+  } catch {
+    return await ctx.crash({
+      exitCode: 1,
+      errorType: "invalid filesystem data",
+      printedMessage: `Unable to read account settings from ${globalConfigPath()}. Check defaultProfile, directories, and revokeReplacedTokens.`
+    });
+  }
+}
+function writeProfileSettings(ctx, settings) {
+  if (Object.keys(settings).length === 0) {
+    if (ctx.fs.exists(globalConfigPath())) ctx.fs.unlink(globalConfigPath());
+    return;
+  }
+  const temporary = `${globalConfigPath()}.${randomUUID()}.tmp`;
+  try {
+    ctx.fs.writeUtf8File(temporary, JSON.stringify(settings, null, 2), 384);
+    ctx.fs.swapTmpFile(temporary, globalConfigPath());
+  } finally {
+    if (ctx.fs.exists(temporary)) ctx.fs.unlink(temporary);
+  }
+}
+export async function updateProfileSettings(ctx, update, afterWrite) {
+  const lockPath = `${globalConfigPath()}.lock`;
+  ctx.fs.mkdir(rootDirectory(), { allowExisting: true });
+  const deadline = Date.now() + 5e3;
+  for (; ; ) {
+    try {
+      ctx.fs.mkdir(lockPath);
+      break;
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+      if (Date.now() >= deadline) {
+        return await ctx.crash({
+          exitCode: 1,
+          errorType: "fatal",
+          printedMessage: `Another command is updating Convex accounts. Retry after it finishes. If it was interrupted, remove ${lockPath}.`
+        });
+      }
+      await new Promise((resolve) => setTimeout(resolve, 25));
+    }
+  }
+  let released = false;
+  const release = () => {
+    if (released) return;
+    ctx.fs.rmdir(lockPath);
+    released = true;
+  };
+  const cleanup = ctx.registerCleanup(async () => release());
+  try {
+    const settings = await readProfileSettings(ctx);
+    const result = await update(settings);
+    writeProfileSettings(ctx, settings);
+    afterWrite?.();
+    return result;
+  } finally {
+    ctx.removeCleanup(cleanup);
+    release();
+  }
+}
+export function profileConfigPath(name) {
+  return path.join(
+    rootDirectory(),
+    "profiles",
+    `${encodeURIComponent(name)}.json`
+  );
+}
+export async function validateProfileName(ctx, name) {
+  if (!/^[a-z0-9][a-z0-9_-]*$/.test(name)) {
+    await ctx.crash({
+      exitCode: 1,
+      errorType: "invalid filesystem or env vars",
+      printedMessage: "Account names must start with a lowercase letter or number and contain only lowercase letters, numbers, hyphens, and underscores."
+    });
+  }
+}
+export async function getProfileSelection(ctx, options = {}) {
+  let name = options.name;
+  let source = "--account";
+  if (name === void 0 && process.env[CONVEX_ACCOUNT_ENV_VAR] !== void 0) {
+    name = process.env[CONVEX_ACCOUNT_ENV_VAR];
+    source = `${CONVEX_ACCOUNT_ENV_VAR} environment variable`;
+  }
+  if (name === void 0) {
+    const files = options.envFile ? [options.envFile] : [ENV_VAR_FILE_PATH, ".env"];
+    for (const file of files) {
+      if (!ctx.fs.exists(file)) continue;
+      name = dotenv.parse(ctx.fs.readUtf8File(file))[CONVEX_ACCOUNT_ENV_VAR];
+      if (name !== void 0) {
+        source = `${CONVEX_ACCOUNT_ENV_VAR} in ${file}`;
+        break;
+      }
+    }
+  }
+  if (name === void 0) {
+    const config = await readProfileSettings(ctx);
+    const binding = findProfileDirectory(
+      config.directories ?? {},
+      process.cwd()
+    );
+    name = binding?.name ?? config.defaultProfile;
+    source = binding ? `directory selection for ${binding.directory}` : `default account in ${globalConfigPath()}`;
+  }
+  if (name === void 0) return null;
+  await validateProfileName(ctx, name);
+  return { name, source };
+}
+export async function readProfileAuth(ctx, profile, allowMissing = false) {
+  const credentials = await readProfileCredentials(ctx, profile, allowMissing);
+  return credentials === null ? null : {
+    kind: "accessToken",
+    accessToken: credentials.accessToken,
+    header: `Bearer ${credentials.accessToken}`,
+    profile
+  };
+}
+export async function readProfileCredentials(ctx, profile, allowMissing = false) {
+  await validateProfileName(ctx, profile.name);
+  const configPath = profileConfigPath(profile.name);
+  if (!ctx.fs.exists(configPath)) {
+    if (allowMissing) return null;
+    return await ctx.crash({
+      exitCode: 1,
+      errorType: "invalid filesystem data",
+      printedMessage: `Account "${profile.name}" selected by ${profile.source} is not logged in. Run \`npx convex login --account ${profile.name}\`.`
+    });
+  }
+  try {
+    return credentialsSchema.parse(JSON.parse(ctx.fs.readUtf8File(configPath)));
+  } catch {
+    return await ctx.crash({
+      exitCode: 1,
+      errorType: "invalid filesystem data",
+      printedMessage: `Unable to read credentials for account "${profile.name}" from ${configPath}.`
+    });
+  }
+}
+export function readProfileToken(ctx, name) {
+  try {
+    const token = JSON.parse(
+      ctx.fs.readUtf8File(profileConfigPath(name))
+    ).accessToken;
+    return typeof token === "string" && token.length > 0 ? token : null;
+  } catch {
+    return null;
+  }
+}
+async function writeCredentialsFile(ctx, name, credentials) {
+  const configPath = profileConfigPath(name);
+  const directory = path.dirname(configPath);
+  ctx.fs.mkdir(directory, { allowExisting: true });
+  for (const dir of [rootDirectory(), directory]) {
+    if (!ctx.fs.lstat(dir).isDirectory()) {
+      return await ctx.crash({
+        exitCode: 1,
+        errorType: "invalid filesystem data",
+        printedMessage: `Cannot save account credentials through a symlink or non-directory: ${dir}.`
+      });
+    }
+  }
+  const temporary = `${configPath}.${randomUUID()}.tmp`;
+  try {
+    ctx.fs.writeUtf8File(
+      temporary,
+      JSON.stringify(credentials, null, 2),
+      384
+    );
+    ctx.fs.swapTmpFile(temporary, configPath);
+  } finally {
+    if (ctx.fs.exists(temporary)) ctx.fs.unlink(temporary);
+  }
+}
+export async function writeProfileCredentials(ctx, name, accessToken, metadata = {}, expected) {
+  await validateProfileName(ctx, name);
+  await updateProfileSettings(ctx, async (settings) => {
+    if (expected !== void 0) {
+      const current = await readProfileCredentials(
+        ctx,
+        { name, source: "login" },
+        true
+      );
+      if (!isDeepStrictEqual(current, expected)) {
+        return await ctx.crash({
+          exitCode: 1,
+          errorType: "fatal",
+          printedMessage: `Account "${name}" changed during login. Retry the login.`
+        });
+      }
+    }
+    await writeCredentialsFile(ctx, name, { ...metadata, accessToken });
+    if (settings.defaultProfile === name) settings.accessToken = accessToken;
+  });
+}
+export async function legacyAuthForFirstProfile(ctx, profile) {
+  const settings = await readProfileSettings(ctx);
+  const profilesDir = path.dirname(profileConfigPath(profile.name));
+  if (settings.defaultProfile !== void 0 || ctx.fs.exists(profilesDir) && ctx.fs.listDir(profilesDir).some((entry) => entry.name.endsWith(".json"))) {
+    return null;
+  }
+  const config = readGlobalConfig(ctx);
+  return config === null ? null : {
+    kind: "accessToken",
+    accessToken: config.accessToken,
+    header: `Bearer ${config.accessToken}`,
+    profile
+  };
+}
+export async function initializeDefaultProfile(ctx, profile, namingLegacyAccount, select = true) {
+  const defaultProfile = await updateProfileSettings(ctx, async (settings) => {
+    if (settings.defaultProfile !== void 0) return void 0;
+    const credentials = await readProfileCredentials(ctx, profile);
+    const accessToken = credentials.accessToken;
+    const legacyToken = settings.accessToken;
+    if (!select && (savedProfileNames(ctx).some((name) => name !== profile.name) || !namingLegacyAccount && typeof legacyToken === "string" && legacyToken.length > 0 && legacyToken !== accessToken))
+      return void 0;
+    if (!namingLegacyAccount && typeof legacyToken === "string" && legacyToken.length > 0 && legacyToken !== accessToken) {
+      let legacyName = "default";
+      for (let suffix = 2; ctx.fs.exists(profileConfigPath(legacyName)); suffix++) {
+        legacyName = `default-${suffix}`;
+      }
+      await writeCredentialsFile(ctx, legacyName, { accessToken: legacyToken });
+      settings.defaultProfile = legacyName;
+    } else {
+      settings.defaultProfile = profile.name;
+      settings.accessToken = accessToken;
+    }
+    return settings.defaultProfile;
+  });
+  if (defaultProfile !== void 0)
+    logFinishedStep(`Default account: ${defaultProfile}`);
+}
+export function findProfileDirectory(directories, cwd) {
+  let directory = path.resolve(cwd);
+  for (; ; ) {
+    if (Object.hasOwn(directories, directory)) {
+      return { directory, name: directories[directory] };
+    }
+    const parent = path.dirname(directory);
+    if (parent === directory) return null;
+    directory = parent;
+  }
+}
+export function savedProfileNames(ctx) {
+  const directory = path.join(rootDirectory(), "profiles");
+  if (!ctx.fs.exists(directory)) return [];
+  return ctx.fs.listDir(directory).filter((entry) => entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -5)).sort();
+}
+export async function writeProfileDirectory(ctx, name) {
+  await validateProfileName(ctx, name);
+  await updateProfileSettings(ctx, (settings) => {
+    settings.directories = { ...settings.directories, [process.cwd()]: name };
+  });
+  logFinishedStep(
+    `Saved directory selection: ${name} (applies to this directory and its subdirectories).`
+  );
+  const selected = await getProfileSelection(ctx);
+  if (selected !== null && selected.name !== name) {
+    logWarning(
+      `Account "${selected.name}" selected by ${selected.source} overrides this directory selection. Remove that override to use account "${name}".`
+    );
+  }
+}
+//# sourceMappingURL=profiles.js.map

package/dist/esm/cli/lib/profiles.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/cli/lib/profiles.ts"],
+  "sourcesContent": ["import path from \"path\";\nimport { isDeepStrictEqual } from \"util\";\nimport { randomUUID } from \"crypto\";\nimport { TempPath } from \"../../bundler/fs.js\";\nimport * as dotenv from \"dotenv\";\nimport { z } from \"zod\";\nimport { BigBrainAuth, Context } from \"../../bundler/context.js\";\nimport { logFinishedStep, logWarning } from \"../../bundler/log.js\";\nimport { globalConfigPath, readGlobalConfig } from \"./utils/globalConfig.js\";\nimport { ENV_VAR_FILE_PATH, rootDirectory } from \"./utils/utils.js\";\n\nimport { CONVEX_ACCOUNT_ENV_VAR } from \"./envvars.js\";\n\nexport type ProfileSelection = {\n  name: string;\n  source: string;\n};\n\nconst settingsSchema = z\n  .object({\n    defaultProfile: z.string().optional(),\n    directories: z.record(z.string()).optional(),\n    revokeReplacedTokens: z.boolean().optional(),\n  })\n  .passthrough();\n\nconst credentialsSchema = z\n  .object({\n    accessToken: z.string().min(1),\n    memberId: z.string().optional(),\n    email: z.string().optional(),\n  })\n  .passthrough();\n\nexport type ProfileCredentials = z.infer<typeof credentialsSchema>;\n\nexport async function readProfileSettings(\n  ctx: Context,\n): Promise<z.infer<typeof settingsSchema>> {\n  if (!ctx.fs.exists(globalConfigPath())) return {};\n  try {\n    return settingsSchema.parse(\n      JSON.parse(ctx.fs.readUtf8File(globalConfigPath())),\n    );\n  } catch {\n    return await ctx.crash({\n      exitCode: 1,\n      errorType: \"invalid filesystem data\",\n      printedMessage: `Unable to read account settings from ${globalConfigPath()}. Check defaultProfile, directories, and revokeReplacedTokens.`,\n    });\n  }\n}\n\nfunction writeProfileSettings(ctx: Context, settings: Record<string, unknown>) {\n  if (Object.keys(settings).length === 0) {\n    if (ctx.fs.exists(globalConfigPath())) ctx.fs.unlink(globalConfigPath());\n    return;\n  }\n  const temporary = `${globalConfigPath()}.${randomUUID()}.tmp` as TempPath;\n  try {\n    ctx.fs.writeUtf8File(temporary, JSON.stringify(settings, null, 2), 0o600);\n    ctx.fs.swapTmpFile(temporary, globalConfigPath());\n  } finally {\n    if (ctx.fs.exists(temporary)) ctx.fs.unlink(temporary);\n  }\n}\n\nexport async function updateProfileSettings<T>(\n  ctx: Context,\n  update: (settings: z.infer<typeof settingsSchema>) => T | Promise<T>,\n  afterWrite?: () => void,\n): Promise<T> {\n  const lockPath = `${globalConfigPath()}.lock`;\n  ctx.fs.mkdir(rootDirectory(), { allowExisting: true });\n  const deadline = Date.now() + 5000;\n  for (;;) {\n    try {\n      ctx.fs.mkdir(lockPath);\n      break;\n    } catch (err: any) {\n      // Only the process that creates the directory owns the update lock.\n      // eslint-disable-next-line no-restricted-syntax\n      if (err.code !== \"EEXIST\") throw err;\n      if (Date.now() >= deadline) {\n        return await ctx.crash({\n          exitCode: 1,\n          errorType: \"fatal\",\n          printedMessage: `Another command is updating Convex accounts. Retry after it finishes. If it was interrupted, remove ${lockPath}.`,\n        });\n      }\n      await new Promise((resolve) => setTimeout(resolve, 25));\n    }\n  }\n  let released = false;\n  const release = () => {\n    if (released) return;\n    ctx.fs.rmdir(lockPath);\n    released = true;\n  };\n  const cleanup = ctx.registerCleanup(async () => release());\n  try {\n    const settings = await readProfileSettings(ctx);\n    const result = await update(settings);\n    writeProfileSettings(ctx, settings);\n    // Credential deletion follows persistence while sharing the lock with renewals.\n    afterWrite?.();\n    return result;\n  } finally {\n    ctx.removeCleanup(cleanup);\n    release();\n  }\n}\n\nexport function profileConfigPath(name: string): string {\n  return path.join(\n    rootDirectory(),\n    \"profiles\",\n    `${encodeURIComponent(name)}.json`,\n  );\n}\n\nexport async function validateProfileName(\n  ctx: Context,\n  name: string,\n): Promise<void> {\n  if (!/^[a-z0-9][a-z0-9_-]*$/.test(name)) {\n    await ctx.crash({\n      exitCode: 1,\n      errorType: \"invalid filesystem or env vars\",\n      printedMessage:\n        \"Account names must start with a lowercase letter or number and contain only lowercase letters, numbers, hyphens, and underscores.\",\n    });\n  }\n}\n\nexport async function getProfileSelection(\n  ctx: Context,\n  options: { name?: string | undefined; envFile?: string | undefined } = {},\n): Promise<ProfileSelection | null> {\n  let name = options.name;\n  let source = \"--account\";\n  if (name === undefined && process.env[CONVEX_ACCOUNT_ENV_VAR] !== undefined) {\n    name = process.env[CONVEX_ACCOUNT_ENV_VAR];\n    source = `${CONVEX_ACCOUNT_ENV_VAR} environment variable`;\n  }\n  if (name === undefined) {\n    const files = options.envFile\n      ? [options.envFile]\n      : [ENV_VAR_FILE_PATH, \".env\"];\n    for (const file of files) {\n      if (!ctx.fs.exists(file)) continue;\n      name = dotenv.parse(ctx.fs.readUtf8File(file))[CONVEX_ACCOUNT_ENV_VAR];\n      if (name !== undefined) {\n        source = `${CONVEX_ACCOUNT_ENV_VAR} in ${file}`;\n        break;\n      }\n    }\n  }\n  if (name === undefined) {\n    const config = await readProfileSettings(ctx);\n    const binding = findProfileDirectory(\n      config.directories ?? {},\n      process.cwd(),\n    );\n    name = binding?.name ?? config.defaultProfile;\n    source = binding\n      ? `directory selection for ${binding.directory}`\n      : `default account in ${globalConfigPath()}`;\n  }\n  if (name === undefined) return null;\n  await validateProfileName(ctx, name);\n  return { name, source };\n}\n\nexport async function readProfileAuth(\n  ctx: Context,\n  profile: ProfileSelection,\n  allowMissing = false,\n): Promise<Extract<BigBrainAuth, { kind: \"accessToken\" }> | null> {\n  const credentials = await readProfileCredentials(ctx, profile, allowMissing);\n  return credentials === null\n    ? null\n    : {\n        kind: \"accessToken\",\n        accessToken: credentials.accessToken,\n        header: `Bearer ${credentials.accessToken}`,\n        profile,\n      };\n}\n\nexport async function readProfileCredentials(\n  ctx: Context,\n  profile: ProfileSelection,\n  allowMissing = false,\n): Promise<ProfileCredentials | null> {\n  await validateProfileName(ctx, profile.name);\n  const configPath = profileConfigPath(profile.name);\n  if (!ctx.fs.exists(configPath)) {\n    if (allowMissing) return null;\n    return await ctx.crash({\n      exitCode: 1,\n      errorType: \"invalid filesystem data\",\n      printedMessage: `Account \"${profile.name}\" selected by ${profile.source} is not logged in. Run \\`npx convex login --account ${profile.name}\\`.`,\n    });\n  }\n  try {\n    return credentialsSchema.parse(JSON.parse(ctx.fs.readUtf8File(configPath)));\n  } catch {\n    return await ctx.crash({\n      exitCode: 1,\n      errorType: \"invalid filesystem data\",\n      printedMessage: `Unable to read credentials for account \"${profile.name}\" from ${configPath}.`,\n    });\n  }\n}\n\nexport function readProfileToken(ctx: Context, name: string): string | null {\n  try {\n    const token = JSON.parse(\n      ctx.fs.readUtf8File(profileConfigPath(name)),\n    ).accessToken;\n    return typeof token === \"string\" && token.length > 0 ? token : null;\n  } catch {\n    return null;\n  }\n}\n\nasync function writeCredentialsFile(\n  ctx: Context,\n  name: string,\n  credentials: ProfileCredentials,\n) {\n  const configPath = profileConfigPath(name);\n  const directory = path.dirname(configPath);\n  ctx.fs.mkdir(directory, { allowExisting: true });\n  for (const dir of [rootDirectory(), directory]) {\n    if (!ctx.fs.lstat(dir).isDirectory()) {\n      return await ctx.crash({\n        exitCode: 1,\n        errorType: \"invalid filesystem data\",\n        printedMessage: `Cannot save account credentials through a symlink or non-directory: ${dir}.`,\n      });\n    }\n  }\n  const temporary = `${configPath}.${randomUUID()}.tmp` as TempPath;\n  try {\n    ctx.fs.writeUtf8File(\n      temporary,\n      JSON.stringify(credentials, null, 2),\n      0o600,\n    );\n    ctx.fs.swapTmpFile(temporary, configPath);\n  } finally {\n    if (ctx.fs.exists(temporary)) ctx.fs.unlink(temporary);\n  }\n}\n\nexport async function writeProfileCredentials(\n  ctx: Context,\n  name: string,\n  accessToken: string,\n  metadata: Omit<ProfileCredentials, \"accessToken\"> = {},\n  expected?: ProfileCredentials | null,\n): Promise<void> {\n  await validateProfileName(ctx, name);\n  await updateProfileSettings(ctx, async (settings) => {\n    if (expected !== undefined) {\n      const current = await readProfileCredentials(\n        ctx,\n        { name, source: \"login\" },\n        true,\n      );\n      if (!isDeepStrictEqual(current, expected)) {\n        return await ctx.crash({\n          exitCode: 1,\n          errorType: \"fatal\",\n          printedMessage: `Account \"${name}\" changed during login. Retry the login.`,\n        });\n      }\n    }\n    await writeCredentialsFile(ctx, name, { ...metadata, accessToken });\n    if (settings.defaultProfile === name) settings.accessToken = accessToken;\n  });\n}\n\nexport async function legacyAuthForFirstProfile(\n  ctx: Context,\n  profile: ProfileSelection,\n): Promise<Extract<BigBrainAuth, { kind: \"accessToken\" }> | null> {\n  const settings = await readProfileSettings(ctx);\n  const profilesDir = path.dirname(profileConfigPath(profile.name));\n  if (\n    settings.defaultProfile !== undefined ||\n    (ctx.fs.exists(profilesDir) &&\n      ctx.fs.listDir(profilesDir).some((entry) => entry.name.endsWith(\".json\")))\n  ) {\n    return null;\n  }\n  const config = readGlobalConfig(ctx);\n  return config === null\n    ? null\n    : {\n        kind: \"accessToken\",\n        accessToken: config.accessToken,\n        header: `Bearer ${config.accessToken}`,\n        profile,\n      };\n}\n\nexport async function initializeDefaultProfile(\n  ctx: Context,\n  profile: ProfileSelection,\n  namingLegacyAccount: boolean,\n  select = true,\n) {\n  const defaultProfile = await updateProfileSettings(ctx, async (settings) => {\n    if (settings.defaultProfile !== undefined) return undefined;\n    const credentials = await readProfileCredentials(ctx, profile);\n    const accessToken = credentials!.accessToken;\n    const legacyToken = settings.accessToken;\n    if (\n      !select &&\n      (savedProfileNames(ctx).some((name) => name !== profile.name) ||\n        (!namingLegacyAccount &&\n          typeof legacyToken === \"string\" &&\n          legacyToken.length > 0 &&\n          legacyToken !== accessToken))\n    )\n      return undefined;\n    if (\n      !namingLegacyAccount &&\n      typeof legacyToken === \"string\" &&\n      legacyToken.length > 0 &&\n      legacyToken !== accessToken\n    ) {\n      // An explicitly new login keeps the previous account as the default for\n      // directories that haven't selected an account.\n      let legacyName = \"default\";\n      for (\n        let suffix = 2;\n        ctx.fs.exists(profileConfigPath(legacyName));\n        suffix++\n      ) {\n        legacyName = `default-${suffix}`;\n      }\n      await writeCredentialsFile(ctx, legacyName, { accessToken: legacyToken });\n      settings.defaultProfile = legacyName;\n    } else {\n      settings.defaultProfile = profile.name;\n      settings.accessToken = accessToken;\n    }\n\n    return settings.defaultProfile;\n  });\n  if (defaultProfile !== undefined)\n    logFinishedStep(`Default account: ${defaultProfile}`);\n}\n\nexport function findProfileDirectory(\n  directories: Record<string, string>,\n  cwd: string,\n): { directory: string; name: string } | null {\n  let directory = path.resolve(cwd);\n  for (;;) {\n    if (Object.hasOwn(directories, directory)) {\n      return { directory, name: directories[directory] };\n    }\n    const parent = path.dirname(directory);\n    if (parent === directory) return null;\n    directory = parent;\n  }\n}\n\nexport function savedProfileNames(ctx: Context): string[] {\n  const directory = path.join(rootDirectory(), \"profiles\");\n  if (!ctx.fs.exists(directory)) return [];\n  return ctx.fs\n    .listDir(directory)\n    .filter((entry) => entry.name.endsWith(\".json\"))\n    .map((entry) => entry.name.slice(0, -5))\n    .sort();\n}\n\nexport async function writeProfileDirectory(ctx: Context, name: string) {\n  await validateProfileName(ctx, name);\n  await updateProfileSettings(ctx, (settings) => {\n    settings.directories = { ...settings.directories, [process.cwd()]: name };\n  });\n  logFinishedStep(\n    `Saved directory selection: ${name} (applies to this directory and its subdirectories).`,\n  );\n  const selected = await getProfileSelection(ctx);\n  if (selected !== null && selected.name !== name) {\n    logWarning(\n      `Account \"${selected.name}\" selected by ${selected.source} overrides this directory selection. Remove that override to use account \"${name}\".`,\n    );\n  }\n}\n"],
+  "mappings": ";AAAA,OAAO,UAAU;AACjB,SAAS,yBAAyB;AAClC,SAAS,kBAAkB;AAE3B,YAAY,YAAY;AACxB,SAAS,SAAS;AAElB,SAAS,iBAAiB,kBAAkB;AAC5C,SAAS,kBAAkB,wBAAwB;AACnD,SAAS,mBAAmB,qBAAqB;AAEjD,SAAS,8BAA8B;AAOvC,MAAM,iBAAiB,EACpB,OAAO;AAAA,EACN,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,EACpC,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EAC3C,sBAAsB,EAAE,QAAQ,EAAE,SAAS;AAC7C,CAAC,EACA,YAAY;AAEf,MAAM,oBAAoB,EACvB,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,OAAO,EAAE,OAAO,EAAE,SAAS;AAC7B,CAAC,EACA,YAAY;AAIf,sBAAsB,oBACpB,KACyC;AACzC,MAAI,CAAC,IAAI,GAAG,OAAO,iBAAiB,CAAC,EAAG,QAAO,CAAC;AAChD,MAAI;AACF,WAAO,eAAe;AAAA,MACpB,KAAK,MAAM,IAAI,GAAG,aAAa,iBAAiB,CAAC,CAAC;AAAA,IACpD;AAAA,EACF,QAAQ;AACN,WAAO,MAAM,IAAI,MAAM;AAAA,MACrB,UAAU;AAAA,MACV,WAAW;AAAA,MACX,gBAAgB,wCAAwC,iBAAiB,CAAC;AAAA,IAC5E,CAAC;AAAA,EACH;AACF;AAEA,SAAS,qBAAqB,KAAc,UAAmC;AAC7E,MAAI,OAAO,KAAK,QAAQ,EAAE,WAAW,GAAG;AACtC,QAAI,IAAI,GAAG,OAAO,iBAAiB,CAAC,EAAG,KAAI,GAAG,OAAO,iBAAiB,CAAC;AACvE;AAAA,EACF;AACA,QAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,WAAW,CAAC;AACvD,MAAI;AACF,QAAI,GAAG,cAAc,WAAW,KAAK,UAAU,UAAU,MAAM,CAAC,GAAG,GAAK;AACxE,QAAI,GAAG,YAAY,WAAW,iBAAiB,CAAC;AAAA,EAClD,UAAE;AACA,QAAI,IAAI,GAAG,OAAO,SAAS,EAAG,KAAI,GAAG,OAAO,SAAS;AAAA,EACvD;AACF;AAEA,sBAAsB,sBACpB,KACA,QACA,YACY;AACZ,QAAM,WAAW,GAAG,iBAAiB,CAAC;AACtC,MAAI,GAAG,MAAM,cAAc,GAAG,EAAE,eAAe,KAAK,CAAC;AACrD,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,aAAS;AACP,QAAI;AACF,UAAI,GAAG,MAAM,QAAQ;AACrB;AAAA,IACF,SAAS,KAAU;AAGjB,UAAI,IAAI,SAAS,SAAU,OAAM;AACjC,UAAI,KAAK,IAAI,KAAK,UAAU;AAC1B,eAAO,MAAM,IAAI,MAAM;AAAA,UACrB,UAAU;AAAA,UACV,WAAW;AAAA,UACX,gBAAgB,uGAAuG,QAAQ;AAAA,QACjI,CAAC;AAAA,MACH;AACA,YAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAAA,IACxD;AAAA,EACF;AACA,MAAI,WAAW;AACf,QAAM,UAAU,MAAM;AACpB,QAAI,SAAU;AACd,QAAI,GAAG,MAAM,QAAQ;AACrB,eAAW;AAAA,EACb;AACA,QAAM,UAAU,IAAI,gBAAgB,YAAY,QAAQ,CAAC;AACzD,MAAI;AACF,UAAM,WAAW,MAAM,oBAAoB,GAAG;AAC9C,UAAM,SAAS,MAAM,OAAO,QAAQ;AACpC,yBAAqB,KAAK,QAAQ;AAElC,iBAAa;AACb,WAAO;AAAA,EACT,UAAE;AACA,QAAI,cAAc,OAAO;AACzB,YAAQ;AAAA,EACV;AACF;AAEO,gBAAS,kBAAkB,MAAsB;AACtD,SAAO,KAAK;AAAA,IACV,cAAc;AAAA,IACd;AAAA,IACA,GAAG,mBAAmB,IAAI,CAAC;AAAA,EAC7B;AACF;AAEA,sBAAsB,oBACpB,KACA,MACe;AACf,MAAI,CAAC,wBAAwB,KAAK,IAAI,GAAG;AACvC,UAAM,IAAI,MAAM;AAAA,MACd,UAAU;AAAA,MACV,WAAW;AAAA,MACX,gBACE;AAAA,IACJ,CAAC;AAAA,EACH;AACF;AAEA,sBAAsB,oBACpB,KACA,UAAuE,CAAC,GACtC;AAClC,MAAI,OAAO,QAAQ;AACnB,MAAI,SAAS;AACb,MAAI,SAAS,UAAa,QAAQ,IAAI,sBAAsB,MAAM,QAAW;AAC3E,WAAO,QAAQ,IAAI,sBAAsB;AACzC,aAAS,GAAG,sBAAsB;AAAA,EACpC;AACA,MAAI,SAAS,QAAW;AACtB,UAAM,QAAQ,QAAQ,UAClB,CAAC,QAAQ,OAAO,IAChB,CAAC,mBAAmB,MAAM;AAC9B,eAAW,QAAQ,OAAO;AACxB,UAAI,CAAC,IAAI,GAAG,OAAO,IAAI,EAAG;AAC1B,aAAO,OAAO,MAAM,IAAI,GAAG,aAAa,IAAI,CAAC,EAAE,sBAAsB;AACrE,UAAI,SAAS,QAAW;AACtB,iBAAS,GAAG,sBAAsB,OAAO,IAAI;AAC7C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,QAAW;AACtB,UAAM,SAAS,MAAM,oBAAoB,GAAG;AAC5C,UAAM,UAAU;AAAA,MACd,OAAO,eAAe,CAAC;AAAA,MACvB,QAAQ,IAAI;AAAA,IACd;AACA,WAAO,SAAS,QAAQ,OAAO;AAC/B,aAAS,UACL,2BAA2B,QAAQ,SAAS,KAC5C,sBAAsB,iBAAiB,CAAC;AAAA,EAC9C;AACA,MAAI,SAAS,OAAW,QAAO;AAC/B,QAAM,oBAAoB,KAAK,IAAI;AACnC,SAAO,EAAE,MAAM,OAAO;AACxB;AAEA,sBAAsB,gBACpB,KACA,SACA,eAAe,OACiD;AAChE,QAAM,cAAc,MAAM,uBAAuB,KAAK,SAAS,YAAY;AAC3E,SAAO,gBAAgB,OACnB,OACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa,YAAY;AAAA,IACzB,QAAQ,UAAU,YAAY,WAAW;AAAA,IACzC;AAAA,EACF;AACN;AAEA,sBAAsB,uBACpB,KACA,SACA,eAAe,OACqB;AACpC,QAAM,oBAAoB,KAAK,QAAQ,IAAI;AAC3C,QAAM,aAAa,kBAAkB,QAAQ,IAAI;AACjD,MAAI,CAAC,IAAI,GAAG,OAAO,UAAU,GAAG;AAC9B,QAAI,aAAc,QAAO;AACzB,WAAO,MAAM,IAAI,MAAM;AAAA,MACrB,UAAU;AAAA,MACV,WAAW;AAAA,MACX,gBAAgB,YAAY,QAAQ,IAAI,iBAAiB,QAAQ,MAAM,uDAAuD,QAAQ,IAAI;AAAA,IAC5I,CAAC;AAAA,EACH;AACA,MAAI;AACF,WAAO,kBAAkB,MAAM,KAAK,MAAM,IAAI,GAAG,aAAa,UAAU,CAAC,CAAC;AAAA,EAC5E,QAAQ;AACN,WAAO,MAAM,IAAI,MAAM;AAAA,MACrB,UAAU;AAAA,MACV,WAAW;AAAA,MACX,gBAAgB,2CAA2C,QAAQ,IAAI,UAAU,UAAU;AAAA,IAC7F,CAAC;AAAA,EACH;AACF;AAEO,gBAAS,iBAAiB,KAAc,MAA6B;AAC1E,MAAI;AACF,UAAM,QAAQ,KAAK;AAAA,MACjB,IAAI,GAAG,aAAa,kBAAkB,IAAI,CAAC;AAAA,IAC7C,EAAE;AACF,WAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;AAAA,EACjE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,qBACb,KACA,MACA,aACA;AACA,QAAM,aAAa,kBAAkB,IAAI;AACzC,QAAM,YAAY,KAAK,QAAQ,UAAU;AACzC,MAAI,GAAG,MAAM,WAAW,EAAE,eAAe,KAAK,CAAC;AAC/C,aAAW,OAAO,CAAC,cAAc,GAAG,SAAS,GAAG;AAC9C,QAAI,CAAC,IAAI,GAAG,MAAM,GAAG,EAAE,YAAY,GAAG;AACpC,aAAO,MAAM,IAAI,MAAM;AAAA,QACrB,UAAU;AAAA,QACV,WAAW;AAAA,QACX,gBAAgB,uEAAuE,GAAG;AAAA,MAC5F,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,YAAY,GAAG,UAAU,IAAI,WAAW,CAAC;AAC/C,MAAI;AACF,QAAI,GAAG;AAAA,MACL;AAAA,MACA,KAAK,UAAU,aAAa,MAAM,CAAC;AAAA,MACnC;AAAA,IACF;AACA,QAAI,GAAG,YAAY,WAAW,UAAU;AAAA,EAC1C,UAAE;AACA,QAAI,IAAI,GAAG,OAAO,SAAS,EAAG,KAAI,GAAG,OAAO,SAAS;AAAA,EACvD;AACF;AAEA,sBAAsB,wBACpB,KACA,MACA,aACA,WAAoD,CAAC,GACrD,UACe;AACf,QAAM,oBAAoB,KAAK,IAAI;AACnC,QAAM,sBAAsB,KAAK,OAAO,aAAa;AACnD,QAAI,aAAa,QAAW;AAC1B,YAAM,UAAU,MAAM;AAAA,QACpB;AAAA,QACA,EAAE,MAAM,QAAQ,QAAQ;AAAA,QACxB;AAAA,MACF;AACA,UAAI,CAAC,kBAAkB,SAAS,QAAQ,GAAG;AACzC,eAAO,MAAM,IAAI,MAAM;AAAA,UACrB,UAAU;AAAA,UACV,WAAW;AAAA,UACX,gBAAgB,YAAY,IAAI;AAAA,QAClC,CAAC;AAAA,MACH;AAAA,IACF;AACA,UAAM,qBAAqB,KAAK,MAAM,EAAE,GAAG,UAAU,YAAY,CAAC;AAClE,QAAI,SAAS,mBAAmB,KAAM,UAAS,cAAc;AAAA,EAC/D,CAAC;AACH;AAEA,sBAAsB,0BACpB,KACA,SACgE;AAChE,QAAM,WAAW,MAAM,oBAAoB,GAAG;AAC9C,QAAM,cAAc,KAAK,QAAQ,kBAAkB,QAAQ,IAAI,CAAC;AAChE,MACE,SAAS,mBAAmB,UAC3B,IAAI,GAAG,OAAO,WAAW,KACxB,IAAI,GAAG,QAAQ,WAAW,EAAE,KAAK,CAAC,UAAU,MAAM,KAAK,SAAS,OAAO,CAAC,GAC1E;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAAS,iBAAiB,GAAG;AACnC,SAAO,WAAW,OACd,OACA;AAAA,IACE,MAAM;AAAA,IACN,aAAa,OAAO;AAAA,IACpB,QAAQ,UAAU,OAAO,WAAW;AAAA,IACpC;AAAA,EACF;AACN;AAEA,sBAAsB,yBACpB,KACA,SACA,qBACA,SAAS,MACT;AACA,QAAM,iBAAiB,MAAM,sBAAsB,KAAK,OAAO,aAAa;AAC1E,QAAI,SAAS,mBAAmB,OAAW,QAAO;AAClD,UAAM,cAAc,MAAM,uBAAuB,KAAK,OAAO;AAC7D,UAAM,cAAc,YAAa;AACjC,UAAM,cAAc,SAAS;AAC7B,QACE,CAAC,WACA,kBAAkB,GAAG,EAAE,KAAK,CAAC,SAAS,SAAS,QAAQ,IAAI,KACzD,CAAC,uBACA,OAAO,gBAAgB,YACvB,YAAY,SAAS,KACrB,gBAAgB;AAEpB,aAAO;AACT,QACE,CAAC,uBACD,OAAO,gBAAgB,YACvB,YAAY,SAAS,KACrB,gBAAgB,aAChB;AAGA,UAAI,aAAa;AACjB,eACM,SAAS,GACb,IAAI,GAAG,OAAO,kBAAkB,UAAU,CAAC,GAC3C,UACA;AACA,qBAAa,WAAW,MAAM;AAAA,MAChC;AACA,YAAM,qBAAqB,KAAK,YAAY,EAAE,aAAa,YAAY,CAAC;AACxE,eAAS,iBAAiB;AAAA,IAC5B,OAAO;AACL,eAAS,iBAAiB,QAAQ;AAClC,eAAS,cAAc;AAAA,IACzB;AAEA,WAAO,SAAS;AAAA,EAClB,CAAC;AACD,MAAI,mBAAmB;AACrB,oBAAgB,oBAAoB,cAAc,EAAE;AACxD;AAEO,gBAAS,qBACd,aACA,KAC4C;AAC5C,MAAI,YAAY,KAAK,QAAQ,GAAG;AAChC,aAAS;AACP,QAAI,OAAO,OAAO,aAAa,SAAS,GAAG;AACzC,aAAO,EAAE,WAAW,MAAM,YAAY,SAAS,EAAE;AAAA,IACnD;AACA,UAAM,SAAS,KAAK,QAAQ,SAAS;AACrC,QAAI,WAAW,UAAW,QAAO;AACjC,gBAAY;AAAA,EACd;AACF;AAEO,gBAAS,kBAAkB,KAAwB;AACxD,QAAM,YAAY,KAAK,KAAK,cAAc,GAAG,UAAU;AACvD,MAAI,CAAC,IAAI,GAAG,OAAO,SAAS,EAAG,QAAO,CAAC;AACvC,SAAO,IAAI,GACR,QAAQ,SAAS,EACjB,OAAO,CAAC,UAAU,MAAM,KAAK,SAAS,OAAO,CAAC,EAC9C,IAAI,CAAC,UAAU,MAAM,KAAK,MAAM,GAAG,EAAE,CAAC,EACtC,KAAK;AACV;AAEA,sBAAsB,sBAAsB,KAAc,MAAc;AACtE,QAAM,oBAAoB,KAAK,IAAI;AACnC,QAAM,sBAAsB,KAAK,CAAC,aAAa;AAC7C,aAAS,cAAc,EAAE,GAAG,SAAS,aAAa,CAAC,QAAQ,IAAI,CAAC,GAAG,KAAK;AAAA,EAC1E,CAAC;AACD;AAAA,IACE,8BAA8B,IAAI;AAAA,EACpC;AACA,QAAM,WAAW,MAAM,oBAAoB,GAAG;AAC9C,MAAI,aAAa,QAAQ,SAAS,SAAS,MAAM;AAC/C;AAAA,MACE,YAAY,SAAS,IAAI,iBAAiB,SAAS,MAAM,6EAA6E,IAAI;AAAA,IAC5I;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/esm/cli/lib/run.js

@@ -364,6 +364,10 @@ export async function pushToDeployment(ctx, args) {
       pushAllModules: false,
       largeIndexDeletionCheck: "no verification",
       // `convex run` can’t push to prod
+      largeIndexBackfillCheck: "no verification",
+      // ditto
+      stagedValidatorDeletionCheck: "no verification",
+      // ditto
       warnOnSlowSchemaValidation: true,
       message: null
     },