dropsh 0.0.1

package/LICENSE

@@ -0,0 +1,51 @@
+drupal-cli is dual-licensed. You may use this software under the terms of
+either the MIT License or the GNU General Public License version 2 or any
+later version, at your option.
+
+SPDX-License-Identifier: (MIT OR GPL-2.0-or-later)
+
+================================================================================
+MIT License
+================================================================================
+
+Copyright (c) 2026 Christian Wiedemann
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+================================================================================
+GNU General Public License, version 2 or later
+================================================================================
+
+The full text of the GNU GPL v2 is available at:
+  https://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
+
+The full text of any later GPL version is available at:
+  https://www.gnu.org/licenses/
+
+Copyright (C) 2026 Christian Wiedemann
+
+This program is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free Software
+Foundation; either version 2 of the License, or (at your option) any later
+version.
+
+This program is distributed in the hope that it will be useful, but WITHOUT
+ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
+details.

package/README.md

@@ -0,0 +1,78 @@
+# dropsh
+
+Entity-agnostic helper CLI for Drupal 11 JSON:API. Written in TypeScript, used directly by the `dropsh` Claude skill for editorial publishing workflows.
+
+This is the foundation CLI. Discovery, schema generation, and the skill layer are delivered by follow-up plans.
+
+## Install
+
+```bash
+npm install
+npm run build
+```
+
+## Configure
+
+Copy `.dropsh.yml.example` to `.dropsh.yml` in your project and set the auth fields. Secrets are referenced as `${ENV_VAR}` and expanded at load time.
+
+```yaml
+site:
+  base_url: https://my-drupal.example.com
+  auth:
+    type: basic
+    username: ${DRUPAL_USER}
+    password: ${DRUPAL_PASSWORD}
+```
+
+## Commands
+
+All commands write JSON to stdout, structured errors to stderr, and use exit codes 0-5.
+
+```bash
+dropsh read <entity_type>/<bundle>/<uuid>
+dropsh search <entity_type> [--bundle=<b>] [--filter=key:value]… [--limit=N]
+dropsh create <entity_type> --bundle=<b> --data=<json|@file> [--dry-run] [--no-validate]
+dropsh update <entity_type>/<bundle>/<uuid> --data=<json|@file> [--dry-run] [--no-validate]
+dropsh delete <entity_type>/<bundle>/<uuid> [--dry-run]
+dropsh upload-file --target=<entity_type>/<bundle>/<uuid>/<field> --file=<path> [--dry-run]
+dropsh schema [--refresh]
+dropsh schema <entity_type>/<bundle> [--for=create|update] [--refresh]
+```
+
+### `schema`
+
+Without a target, prints the list of available `<entity_type>/<bundle>` targets on the site.
+
+With a target (e.g. `node/article`), prints a JSON Schema document that validates a JSON:API request body for that resource.
+
+- `--for=create` (default) / `--for=update` — operation variant (update clears required fields)
+- `--refresh` — bypass the cache for this call
+
+If the site has `drupal/schemata` + `drupal/schemata_json_schema` installed, the schema is authoritative (required fields, constraints). Otherwise, a shallow schema is returned from sample records with a warning on stderr (field names only, no required fields, no constraints). The output carries `x-dropsh-source: "schemata" | "heuristic" | "heuristic-empty"` so consumers can tell how strict the schema is.
+
+Schemas are cached under `.dropsh/cache/` next to your `.dropsh.yml`. The `.dropsh/` directory is gitignored.
+
+### Client-side validation in `create` / `update`
+
+`dropsh create` and `dropsh update` run the payload through the bundle's schema before sending it. A validation failure exits with code 4 (`E_VALIDATION`) and emits the Ajv errors on stderr without issuing an HTTP request. Pass `--no-validate` to skip the check.
+
+## Development
+
+```bash
+npm test            # Vitest unit suite
+npm run test:watch
+npm run typecheck
+npm run build
+```
+
+### Integration tests
+
+Local-only, requires DDEV. See `tests/integrations/README.md`.
+
+```bash
+npm run drupal:up
+npm run test:integration
+npm run drupal:down
+```
+
+See `docs/superpowers/specs/2026-04-21-dropsh-design.md` for the full design.

package/bin/dropsh

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import("../dist/src/index.js")
+  .then((m) => m.main())
+  .catch((err) => {
+    console.error(err);
+    process.exit(1);
+  });

package/bin/dropsh-src

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import("../src/index.js")
+  .then((m) => m.main())
+  .catch((err) => {
+    console.error(err);
+    process.exit(1);
+  });

package/dist/src/commands/_data.js

@@ -0,0 +1,19 @@
+import { readFile } from "node:fs/promises";
+import { ValidationError } from "../errors.js";
+export async function readDataArg(raw) {
+    let text = raw;
+    if (raw.startsWith("@")) {
+        try {
+            text = await readFile(raw.slice(1), "utf8");
+        }
+        catch (err) {
+            throw new ValidationError(`Cannot read --data file ${raw.slice(1)}: ${err.message}`);
+        }
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch (err) {
+        throw new ValidationError(`--data is not valid JSON: ${err.message}`);
+    }
+}

package/dist/src/commands/create.js

@@ -0,0 +1,14 @@
+import { readDataArg } from "./_data.js";
+export async function runCreate(args, deps) {
+    const payload = await readDataArg(args.dataArg);
+    const target = `${args.entityType}/${args.bundle}`;
+    if (!args.noValidate && deps.validate) {
+        await deps.validate(payload, target);
+    }
+    if (args.dryRun) {
+        deps.emit({ dry_run: true, method: "POST", path: target, payload });
+        return;
+    }
+    const res = await deps.client.post(target, payload);
+    deps.emit(res);
+}

package/dist/src/commands/delete.js

@@ -0,0 +1,13 @@
+import { ValidationError } from "../errors.js";
+const TARGET_RE = /^[a-z0-9_]+\/[a-z0-9_]+\/[a-f0-9-]{8,}$/;
+export async function runDelete(args, deps) {
+    if (!TARGET_RE.test(args.target)) {
+        throw new ValidationError(`target must be <entity_type>/<bundle>/<uuid>, got "${args.target}"`);
+    }
+    if (args.dryRun) {
+        deps.emit({ dry_run: true, method: "DELETE", path: args.target });
+        return;
+    }
+    const res = await deps.client.delete(args.target);
+    deps.emit(res);
+}

package/dist/src/commands/login.js

@@ -0,0 +1,121 @@
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { writeToken } from "../core/auth/token-store.js";
+import { loadConfig } from "../core/config.js";
+import { createHttpClient } from "../core/http.js";
+import { AuthError } from "../errors.js";
+const DEFAULT_PORT = 7432;
+const DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;
+export function generatePkce() {
+    const verifier = randomBytes(96).toString("base64url");
+    const challenge = createHash("sha256").update(verifier).digest("base64url");
+    return { verifier, challenge };
+}
+export function generateState() {
+    return randomBytes(16).toString("base64url");
+}
+export async function runLogin(deps = {}) {
+    const stdout = deps.stdout ?? ((s) => process.stdout.write(`${s}\n`));
+    const configPath = deps.configPath ?? (process.env.DRUPAL_CLI_CONFIG ?? ".drupal-cli.yml");
+    const timeoutMs = deps.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const now = deps.now ?? Date.now;
+    const http = deps.http ?? createHttpClient();
+    const pkce = (deps._generatePkce ?? generatePkce)();
+    const state = (deps._generateState ?? generateState)();
+    const cfg = await loadConfig(configPath);
+    const { auth, base_url: baseUrl } = cfg.site;
+    if (auth.type !== "oauth2_authcode") {
+        throw new AuthError("login requires auth.type: oauth2_authcode in config");
+    }
+    const clientId = auth.client_id;
+    if (typeof clientId !== "string" || clientId.length === 0) {
+        throw new AuthError("oauth2_authcode auth requires client_id");
+    }
+    const scope = typeof auth.scope === "string" ? auth.scope : "";
+    const port = typeof auth.redirect_port === "number" ? auth.redirect_port : DEFAULT_PORT;
+    const redirectUri = `http://localhost:${port}/callback`;
+    const baseUrlNorm = baseUrl.replace(/\/$/, "");
+    const tokenEndpoint = `${baseUrlNorm}/oauth/token`;
+    const authUrl = new URL(`${baseUrlNorm}/oauth/authorize`);
+    authUrl.searchParams.set("response_type", "code");
+    authUrl.searchParams.set("client_id", clientId);
+    authUrl.searchParams.set("redirect_uri", redirectUri);
+    authUrl.searchParams.set("code_challenge", pkce.challenge);
+    authUrl.searchParams.set("code_challenge_method", "S256");
+    authUrl.searchParams.set("state", state);
+    if (scope)
+        authUrl.searchParams.set("scope", scope);
+    const code = await new Promise((resolve, reject) => {
+        let settled = false;
+        const finish = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            server.close(() => fn());
+        };
+        const server = createServer((req, res) => {
+            const url = new URL(req.url ?? "/", `http://localhost:${port}`);
+            if (url.pathname !== "/callback") {
+                res.writeHead(404);
+                res.end();
+                return;
+            }
+            res.writeHead(200, { "Content-Type": "text/html" });
+            res.end("<html><body><p>Login successful. You can close this tab.</p></body></html>");
+            const receivedState = url.searchParams.get("state");
+            const receivedCode = url.searchParams.get("code");
+            if (receivedState !== state) {
+                finish(() => reject(new AuthError("OAuth state mismatch — possible CSRF attack")));
+                return;
+            }
+            if (!receivedCode) {
+                finish(() => reject(new AuthError("No authorization code received")));
+                return;
+            }
+            finish(() => resolve(receivedCode));
+        });
+        server.on("error", (err) => {
+            finish(() => reject(err));
+        });
+        const timer = setTimeout(() => {
+            finish(() => reject(new AuthError("Login timed out. Run 'drupal-cli login' to try again.")));
+        }, timeoutMs);
+        server.listen(port, () => {
+            stdout("Opening browser for login...");
+            stdout(`If the browser does not open, visit:\n${authUrl.toString()}`);
+            const openBrowser = deps.openBrowser ?? (async (url) => {
+                const { default: open } = await import("open");
+                await open(url);
+            });
+            openBrowser(authUrl.toString()).catch(() => {
+                // The URL is printed above, so the user still has a manual fallback.
+            });
+        });
+    });
+    const params = new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        code_verifier: pkce.verifier,
+        client_id: clientId,
+        redirect_uri: redirectUri,
+    });
+    const res = await http.send({
+        method: "POST",
+        url: tokenEndpoint,
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: params.toString(),
+    });
+    const body = JSON.parse(res.body);
+    if (typeof body.access_token !== "string") {
+        throw new AuthError("Token endpoint returned no access_token");
+    }
+    const ttlSec = typeof body.expires_in === "number" ? body.expires_in : 3600;
+    const expiresAt = now() + ttlSec * 1000 - 5000;
+    await writeToken(baseUrl, {
+        access_token: body.access_token,
+        ...(typeof body.refresh_token === "string" ? { refresh_token: body.refresh_token } : {}),
+        expires_at: expiresAt,
+    }, deps.tokenDir);
+    stdout(`Logged in · token valid until ${new Date(expiresAt).toISOString()}`);
+}

package/dist/src/commands/read.js

@@ -0,0 +1,10 @@
+import { ValidationError } from "../errors.js";
+// Allow short test UUIDs (e.g. "u1") and full Drupal UUIDs (36 chars)
+const TARGET_RE = /^[a-z0-9_]+\/[a-z0-9_]+\/[a-z0-9_-]+$/;
+export async function runRead(args, deps) {
+    if (!TARGET_RE.test(args.target)) {
+        throw new ValidationError(`target must be <entity_type>/<bundle>/<uuid>, got "${args.target}"`);
+    }
+    const res = await deps.client.get(args.target);
+    deps.emit(res);
+}

package/dist/src/commands/schema.js

@@ -0,0 +1,61 @@
+import { join } from "node:path";
+import { createFileStore } from "../core/cache/file-store.js";
+import { fetchCatalog } from "../core/schema/catalog.js";
+import { fetchJsonSchema } from "../core/schema/jsonschema-source.js";
+import { toOperationVariant } from "../core/schema/to-jsonschema.js";
+import { ValidationError } from "../errors.js";
+const TARGET_RE = /^[a-z0-9_]+\/[a-z0-9_]+$/;
+export async function runSchema(args, deps) {
+    const store = createFileStore({ rootDir: join(deps.cwd, ".dropsh/cache"), warn: deps.warn });
+    if (args.target === undefined) {
+        if (!args.refresh) {
+            const hit = await store.read("catalog.json");
+            if (hit !== undefined) {
+                deps.emit(hit);
+                return;
+            }
+        }
+        const fresh = await fetchCatalog({
+            http: deps.http,
+            auth: deps.auth,
+            baseUrl: deps.baseUrl,
+            jsonapiPrefix: deps.jsonapiPrefix,
+        });
+        await store.write("catalog.json", fresh);
+        deps.emit(fresh);
+        return;
+    }
+    if (!TARGET_RE.test(args.target)) {
+        throw new ValidationError(`target must be '<entity_type>/<bundle>', got '${args.target}'`);
+    }
+    // TARGET_RE guarantees two segments; non-null assertions are safe here.
+    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+    const [entity, bundle] = args.target.split("/", 2);
+    const cacheKey = `schema/${entity}--${bundle}.${args.operation}.json`;
+    if (!args.refresh) {
+        const hit = await store.read(cacheKey);
+        if (hit !== undefined) {
+            deps.emit(hit);
+            return;
+        }
+    }
+    const { schema: raw, source } = await fetchJsonSchema({
+        http: deps.http,
+        auth: deps.auth,
+        baseUrl: deps.baseUrl,
+        jsonapiPrefix: deps.jsonapiPrefix,
+        entity,
+        bundle,
+        warn: deps.warn,
+        plugins: deps.plugins ?? [],
+    });
+    const transformed = toOperationVariant(raw, args.operation);
+    const tagged = {
+        ...transformed,
+        "x-dropsh-source": source,
+        "x-dropsh-target": { entity_type: entity, bundle },
+        "x-dropsh-operation": args.operation,
+    };
+    await store.write(cacheKey, tagged);
+    deps.emit(tagged);
+}

package/dist/src/commands/search.js

@@ -0,0 +1,30 @@
+import { DrupalJsonApiParams } from "drupal-jsonapi-params";
+import { ValidationError } from "../errors.js";
+export function parseFilterFlag(raw) {
+    const parts = raw.split(":");
+    if (parts.length === 2) {
+        const [key, value] = parts;
+        return { key, value };
+    }
+    if (parts.length >= 3) {
+        const key = parts[0];
+        const operator = parts[1];
+        const value = parts.slice(2).join(":");
+        return { key, operator, value };
+    }
+    throw new ValidationError(`--filter must be key:value or key:op:value, got "${raw}"`);
+}
+export async function runSearch(args, deps) {
+    const params = new DrupalJsonApiParams();
+    for (const raw of args.filters) {
+        const f = parseFilterFlag(raw);
+        if (f.operator)
+            params.addFilter(f.key, f.value, f.operator);
+        else
+            params.addFilter(f.key, f.value);
+    }
+    params.addPageLimit(args.limit);
+    const path = args.bundle ? `${args.entityType}/${args.bundle}` : args.entityType;
+    const res = await deps.client.get(path, params);
+    deps.emit(res);
+}

package/dist/src/commands/update.js

@@ -0,0 +1,20 @@
+import { ValidationError } from "../errors.js";
+import { readDataArg } from "./_data.js";
+const TARGET_RE = /^[a-z0-9_]+\/[a-z0-9_]+\/[a-f0-9-]{8,}$/;
+export async function runUpdate(args, deps) {
+    if (!TARGET_RE.test(args.target)) {
+        throw new ValidationError(`target must be <entity_type>/<bundle>/<uuid>, got "${args.target}"`);
+    }
+    const payload = await readDataArg(args.dataArg);
+    const [entity, bundle] = args.target.split("/", 3);
+    const schemaTarget = `${entity}/${bundle}`;
+    if (!args.noValidate && deps.validate) {
+        await deps.validate(payload, schemaTarget);
+    }
+    if (args.dryRun) {
+        deps.emit({ dry_run: true, method: "PATCH", path: args.target, payload });
+        return;
+    }
+    const res = await deps.client.patch(args.target, payload);
+    deps.emit(res);
+}

package/dist/src/commands/upload-file.js

@@ -0,0 +1,30 @@
+import { readFile, stat } from "node:fs/promises";
+import path from "node:path";
+import { ValidationError } from "../errors.js";
+const TARGET_RE = /^[a-z0-9_]+\/[a-z0-9_]+\/[a-f0-9-]{8,}\/[a-z0-9_]+$/;
+export async function runUploadFile(args, deps) {
+    if (!TARGET_RE.test(args.target)) {
+        throw new ValidationError(`target must be <entity_type>/<bundle>/<uuid>/<field>, got "${args.target}"`);
+    }
+    let fileSize = 0;
+    try {
+        fileSize = (await stat(args.file)).size;
+    }
+    catch {
+        throw new ValidationError(`file does not exist: ${args.file}`);
+    }
+    const filename = path.basename(args.file);
+    if (args.dryRun) {
+        deps.emit({
+            dry_run: true,
+            method: "POST-upload",
+            path: args.target,
+            filename,
+            bytes: fileSize,
+        });
+        return;
+    }
+    const data = await readFile(args.file);
+    const res = await deps.client.upload(args.target, filename, data);
+    deps.emit(res);
+}

package/dist/src/core/auth/api-key.js

@@ -0,0 +1,13 @@
+import { AuthError } from "../../errors.js";
+export function createApiKeyAuth(cfg) {
+    const key = cfg.key;
+    const header = typeof cfg.header === "string" ? cfg.header : "X-API-Key";
+    if (typeof key !== "string" || key.length === 0) {
+        throw new AuthError("api_key auth requires key");
+    }
+    return {
+        async apply(req) {
+            return { ...req, headers: { ...(req.headers ?? {}), [header]: key } };
+        },
+    };
+}

package/dist/src/core/auth/basic.js

@@ -0,0 +1,24 @@
+import { ConfigError } from "../../errors.js";
+export function createBasicAuth(cfg) {
+    if (typeof cfg.username !== "string" || cfg.username.length === 0)
+        throw new ConfigError("basicAuthPlugin: username required");
+    if (typeof cfg.password !== "string" || cfg.password.length === 0)
+        throw new ConfigError("basicAuthPlugin: password required");
+    const token = Buffer.from(`${cfg.username}:${cfg.password}`).toString("base64");
+    return {
+        async apply(req) {
+            return { ...req, headers: { ...(req.headers ?? {}), Authorization: `Basic ${token}` } };
+        },
+    };
+}
+export function basicAuthPlugin(config) {
+    const adapter = createBasicAuth(config);
+    return {
+        id: "basic",
+        requiredModules: [],
+        createAuthAdapter: () => adapter,
+        async extendSchema(_entityType, _bundle, schema, _ctx) {
+            return schema;
+        },
+    };
+}

package/dist/src/core/auth/factory.js

@@ -0,0 +1,17 @@
+import { AuthError } from "../../errors.js";
+import { createBasicAuth } from "./basic.js";
+import { createOAuth2AuthCodeAuth } from "./oauth2-authcode.js";
+import { createOAuth2Auth } from "./oauth2.js";
+export function createAuthAdapter(cfg, deps) {
+    switch (cfg.type) {
+        case "basic":
+            return createBasicAuth(cfg);
+        case "oauth2_password":
+        case "oauth2_client_credentials":
+            return createOAuth2Auth(cfg, { http: deps.http, baseUrl: deps.baseUrl });
+        case "oauth2_authcode":
+            return createOAuth2AuthCodeAuth(cfg, { http: deps.http, baseUrl: deps.baseUrl });
+        default:
+            throw new AuthError(`Unknown auth.type: ${String(cfg.type)}`);
+    }
+}

package/dist/src/core/auth/jwt.js

@@ -0,0 +1,12 @@
+import { AuthError } from "../../errors.js";
+export function createJwtAuth(cfg) {
+    const token = cfg.token;
+    if (typeof token !== "string" || token.length === 0) {
+        throw new AuthError("jwt auth requires token");
+    }
+    return {
+        async apply(req) {
+            return { ...req, headers: { ...(req.headers ?? {}), Authorization: `Bearer ${token}` } };
+        },
+    };
+}

package/dist/src/core/auth/oauth2-authcode.js

@@ -0,0 +1,67 @@
+import { AuthError, HttpError } from "../../errors.js";
+import { readToken, writeToken } from "./token-store.js";
+function requireString(cfg, key) {
+    const value = cfg[key];
+    if (typeof value !== "string" || value.length === 0) {
+        throw new AuthError(`${cfg.type} auth requires ${key}`);
+    }
+    return value;
+}
+export function createOAuth2AuthCodeAuth(cfg, deps) {
+    const now = deps.now ?? Date.now;
+    const clientId = requireString(cfg, "client_id");
+    const tokenUrl = typeof cfg.token_url === "string" ? cfg.token_url : `${deps.baseUrl.replace(/\/$/, "")}/oauth/token`;
+    return {
+        async apply(req) {
+            const stored = await readToken(deps.baseUrl, deps.tokenDir);
+            if (!stored) {
+                throw new AuthError("Session expired. Run 'drupal-cli login' to authenticate.");
+            }
+            if (stored.expires_at - 30_000 > now()) {
+                return {
+                    ...req,
+                    headers: { ...(req.headers ?? {}), Authorization: `Bearer ${stored.access_token}` },
+                };
+            }
+            if (!stored.refresh_token) {
+                throw new AuthError("Session expired. Run 'drupal-cli login' to authenticate.");
+            }
+            try {
+                const params = new URLSearchParams({
+                    grant_type: "refresh_token",
+                    refresh_token: stored.refresh_token,
+                    client_id: clientId,
+                });
+                const res = await deps.http.send({
+                    method: "POST",
+                    url: tokenUrl,
+                    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+                    body: params.toString(),
+                });
+                const body = JSON.parse(res.body);
+                if (typeof body.access_token !== "string") {
+                    throw new AuthError("Token endpoint returned no access_token");
+                }
+                const ttlSec = typeof body.expires_in === "number" ? body.expires_in : 3600;
+                const refreshed = {
+                    access_token: body.access_token,
+                    refresh_token: typeof body.refresh_token === "string" ? body.refresh_token : stored.refresh_token,
+                    expires_at: now() + ttlSec * 1000 - 5000,
+                };
+                await writeToken(deps.baseUrl, refreshed, deps.tokenDir);
+                return {
+                    ...req,
+                    headers: { ...(req.headers ?? {}), Authorization: `Bearer ${refreshed.access_token}` },
+                };
+            }
+            catch (err) {
+                if (err instanceof AuthError)
+                    throw err;
+                if (err instanceof HttpError) {
+                    throw new AuthError("Session expired. Run 'drupal-cli login' to authenticate.", { status: err.status, body: err.body });
+                }
+                throw new AuthError("Session expired. Run 'drupal-cli login' to authenticate.");
+            }
+        },
+    };
+}