orizu 0.5.23 → 0.5.25

package/dist/cli-auth-browser-page.js

@@ -0,0 +1,107 @@
+export function renderCliAuthBrowserPage(status) {
+    const isSuccess = status === 'success';
+    const eyebrow = isSuccess ? '// cli login complete' : '// cli login';
+    const title = isSuccess ? 'Browser authorization complete' : 'Missing authorization code';
+    const detail = isSuccess
+        ? 'Your terminal will finish connecting the Orizu CLI. You can close this tab.'
+        : 'Close this tab and run orizu login again to start a fresh browser request.';
+    const accent = isSuccess ? '#E8923C' : '#C8442A';
+    return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>Orizu CLI Login</title>
+    <style>
+      @import url('https://fonts.googleapis.com/css2?family=Geist+Mono:wght@400;500;700&display=swap');
+      :root {
+        color-scheme: light;
+        --paper: #F4EFE3;
+        --border: #E6DFCE;
+        --ink: #353535;
+        --muted: #6B6358;
+      }
+      * { box-sizing: border-box; }
+      body {
+        margin: 0;
+        min-height: 100vh;
+        background: #FFFFFF;
+        color: #4B4B4B;
+        font-family: 'Geist Mono', Menlo, Monaco, Consolas, monospace;
+        letter-spacing: -0.025em;
+      }
+      main {
+        min-height: 100vh;
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        padding: 48px 24px;
+      }
+      section {
+        width: min(100%, 520px);
+        text-align: center;
+      }
+      .brand {
+        display: flex;
+        flex-direction: column;
+        align-items: center;
+        gap: 12px;
+        margin-bottom: 28px;
+      }
+      .brand svg {
+        width: 42px;
+        height: 42px;
+        color: #202124;
+      }
+      .brand span {
+        color: #000000;
+        font-size: 16px;
+        font-weight: 700;
+      }
+      .eyebrow {
+        margin: 0 0 12px;
+        color: ${accent};
+        font-size: 12px;
+        text-transform: lowercase;
+      }
+      h1 {
+        margin: 0 0 8px;
+        color: var(--ink);
+        font-size: 24px;
+        line-height: 1.15;
+        letter-spacing: -0.05em;
+      }
+      .detail {
+        margin: 0;
+        color: var(--muted);
+        font-size: 13px;
+        line-height: 1.6;
+      }
+    </style>
+  </head>
+  <body>
+    <main>
+      <section>
+        <div class="brand" aria-hidden="true">
+          <svg viewBox="0 0 2048 2048" xmlns="http://www.w3.org/2000/svg">
+            <g fill="currentColor">
+              <polygon points="1545,879 787,1195 1189,1577"></polygon>
+              <polygon points="992,624 444,1104 688,1338"></polygon>
+              <polygon points="602,1593 1180,1594 768,1202"></polygon>
+              <polygon points="1650,1195 1398,1203 1204,1594 1229,1593"></polygon>
+              <polygon points="807,413 751,509 823,744 980,608"></polygon>
+              <polygon points="441,1127 592,1572 681,1356"></polygon>
+              <polygon points="793,399 611,457 604,471 658,602"></polygon>
+              <polygon points="593,493 498,667 636,600"></polygon>
+            </g>
+          </svg>
+          <span>orizu</span>
+        </div>
+        <p class="eyebrow">${eyebrow}</p>
+        <h1>${title}</h1>
+        <p class="detail">${detail}</p>
+      </section>
+    </main>
+  </body>
+</html>`;
+}

package/dist/credentials.d.ts

@@ -1,8 +1,22 @@
 import { ServerCredentials, StoredCredentialsV2, StoredCredentialsV3 } from './types.js';
+/**
+ * Runs a synchronous credentials transaction under the one process-wide and
+ * cross-process lock. Exported so real-process fixtures can hold the production
+ * lock; CLI credential mutations use this same helper.
+ */
+export declare function withCredentialsTransactionLock<T>(operation: () => T): T;
+/**
+ * Holds the credentials lock until an awaited transaction settles. Nested
+ * synchronous credential writes are admitted only from this transaction's
+ * async execution context; unrelated same-process work must wait or fail.
+ */
+export declare function withCredentialsTransactionLockAsync<T>(operation: () => Promise<T>): Promise<T>;
 export declare function loadCredentialsConfig(): StoredCredentialsV2 | StoredCredentialsV3 | null;
 export declare function getServerCredentials(baseUrl: string): ServerCredentials | null;
 export declare function saveServerCredentials(baseUrl: string, credentials: ServerCredentials): void;
 export declare function updateServerCredentials(baseUrl: string, credentials: ServerCredentials): void;
+export declare function credentialsEqual(left: ServerCredentials, right: ServerCredentials): boolean;
+export declare function updateServerCredentialsIfCurrent(baseUrl: string, expected: ServerCredentials, replacement: ServerCredentials): boolean;
 export declare function getActiveBaseUrl(): string | null;
 /**
  * In-sandbox bearer resolution (ALI-1044). Resolves a bearer supplied out-of-band
@@ -41,6 +55,7 @@ export declare function resolveAuthTokenForBaseUrl(baseUrl: string): string;
  */
 export declare function hasResolvableAuth(baseUrl: string): boolean;
 export declare function setActiveBaseUrl(baseUrl: string | null): void;
+export declare function clearServerCredentialsIfCurrent(baseUrl: string, expected: ServerCredentials): boolean;
 export declare function clearServerCredentials(baseUrl: string): boolean;
 export declare function clearCredentialsFile(): void;
 //# sourceMappingURL=credentials.d.ts.map

package/dist/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,iBAAiB,EAEjB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,YAAY,CAAA;AAkHnB,wBAAgB,qBAAqB,IAAI,mBAAmB,GAAG,mBAAmB,GAAG,IAAI,CA8BxF;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAW9E;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,QAapF;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,QAWtF;AAED,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAGhD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,IAAI,CA0BrD;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAYlE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAS1D;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,QAItD;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAY/D;AAED,wBAAgB,oBAAoB,SAKnC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAiBA,OAAO,EACL,iBAAiB,EAEjB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,YAAY,CAAA;AAqInB;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAgCvE;AAED;;;;GAIG;AACH,wBAAsB,mCAAmC,CAAC,CAAC,EACzD,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,CAAC,CAAC,CAiDZ;AAwGD,wBAAgB,qBAAqB,IAAI,mBAAmB,GAAG,mBAAmB,GAAG,IAAI,CA8BxF;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAW9E;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,QAepF;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,QAatF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAO3F;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAUT;AAED,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAGhD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,IAAI,CA0BrD;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAYlE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAS1D;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,QAMtD;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,iBAAiB,GAC1B,OAAO,CAWT;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAc/D;AAED,wBAAgB,oBAAoB,SAKnC"}

package/dist/credentials.js

@@ -1,7 +1,8 @@
-import { chmodSync, closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync, } from 'fs';
+import { chmodSync, closeSync, existsSync, fsyncSync, linkSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync, } from 'fs';
 import { join } from 'path';
-import { homedir } from 'os';
+import { homedir, hostname } from 'os';
 import { randomBytes } from 'crypto';
+import { AsyncLocalStorage } from 'async_hooks';
 function isNodeError(error) {
     return error instanceof Error;
 }
@@ -14,6 +15,186 @@ function getConfigDir() {
 function getCredentialsPath() {
     return join(getConfigDir(), 'credentials.json');
 }
+const DEFAULT_CREDENTIALS_LOCK_TIMEOUT_MS = 2_000;
+const MAX_CREDENTIALS_LOCK_TIMEOUT_MS = 10_000;
+const CREDENTIALS_LOCK_RETRY_MS = 20;
+let heldCredentialsLock = null;
+const credentialsTransactionOwner = new AsyncLocalStorage();
+function getCredentialsLockPath() {
+    return `${getCredentialsPath()}.lock`;
+}
+function readLockDuration(name, fallback, maximum = Number.MAX_SAFE_INTEGER) {
+    const raw = process.env[name];
+    if (!raw)
+        return fallback;
+    const parsed = Number(raw);
+    return Number.isSafeInteger(parsed) && parsed > 0
+        ? Math.min(parsed, maximum)
+        : fallback;
+}
+function sleepSync(milliseconds) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, milliseconds);
+}
+function acquireCredentialsLock() {
+    const dir = getConfigDir();
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    chmodSync(dir, 0o700);
+    const lockPath = getCredentialsLockPath();
+    const timeoutMs = readLockDuration('ORIZU_CREDENTIALS_LOCK_TIMEOUT_MS', DEFAULT_CREDENTIALS_LOCK_TIMEOUT_MS, MAX_CREDENTIALS_LOCK_TIMEOUT_MS);
+    const deadline = Date.now() + timeoutMs;
+    while (true) {
+        const metadata = JSON.stringify({
+            version: 1,
+            pid: process.pid,
+            hostname: hostname(),
+            createdAt: Date.now(),
+            instanceId: randomBytes(16).toString('hex'),
+        });
+        const tempPath = join(dir, `.credentials.json.lock.${process.pid}.${randomBytes(8).toString('hex')}.tmp`);
+        try {
+            const fd = openSync(tempPath, 'wx', 0o600);
+            try {
+                writeFileSync(fd, metadata, 'utf8');
+                fsyncSync(fd);
+                chmodSync(tempPath, 0o600);
+            }
+            finally {
+                closeSync(fd);
+            }
+            try {
+                // link(2) publishes the already-complete inode without replacing an
+                // existing owner. No contender ever unlinks the canonical lock.
+                linkSync(tempPath, lockPath);
+            }
+            catch (error) {
+                if (!(isNodeError(error) && error.code === 'EEXIST'))
+                    throw error;
+                if (Date.now() >= deadline) {
+                    throw new Error(`ORIZU_CREDENTIALS_LOCK_TIMEOUT: credentials mutation did not acquire the lock within ${timeoutMs}ms. Verify no Orizu process is running, then remove credentials.json.lock manually.`);
+                }
+                sleepSync(Math.min(CREDENTIALS_LOCK_RETRY_MS, Math.max(1, deadline - Date.now())));
+                continue;
+            }
+            let resolveReleased = () => { };
+            const released = new Promise(resolve => { resolveReleased = resolve; });
+            return { path: lockPath, metadata, depth: 1, released, resolveReleased };
+        }
+        finally {
+            // The unique owner-only preparation link is never retained, whether
+            // publication succeeds, loses to an owner, or fails unexpectedly.
+            rmSync(tempPath, { force: true });
+        }
+    }
+}
+function releaseCredentialsLock(lock) {
+    let currentMetadata;
+    try {
+        currentMetadata = readFileSync(lock.path, 'utf8');
+    }
+    catch (error) {
+        if (isNodeError(error) && error.code === 'ENOENT')
+            return;
+        throw error;
+    }
+    // Preserve a changed/replaced lock rather than risking removal of another owner.
+    if (currentMetadata !== lock.metadata)
+        return;
+    rmSync(lock.path);
+}
+/**
+ * Runs a synchronous credentials transaction under the one process-wide and
+ * cross-process lock. Exported so real-process fixtures can hold the production
+ * lock; CLI credential mutations use this same helper.
+ */
+export function withCredentialsTransactionLock(operation) {
+    const lockPath = getCredentialsLockPath();
+    if (heldCredentialsLock) {
+        if (heldCredentialsLock.path !== lockPath) {
+            throw new Error('ORIZU_CREDENTIALS_LOCK_NESTED_CONFIG: credentials config changed during a mutation.');
+        }
+        if (heldCredentialsLock.asyncOwner
+            && credentialsTransactionOwner.getStore() !== heldCredentialsLock.asyncOwner) {
+            throw new Error('ORIZU_CREDENTIALS_LOCK_REQUIRED: an asynchronous credentials transaction already owns the lock.');
+        }
+        heldCredentialsLock.depth += 1;
+        try {
+            return operation();
+        }
+        finally {
+            heldCredentialsLock.depth -= 1;
+        }
+    }
+    const lock = acquireCredentialsLock();
+    heldCredentialsLock = lock;
+    try {
+        return operation();
+    }
+    finally {
+        heldCredentialsLock = null;
+        try {
+            releaseCredentialsLock(lock);
+        }
+        finally {
+            lock.resolveReleased();
+        }
+    }
+}
+/**
+ * Holds the credentials lock until an awaited transaction settles. Nested
+ * synchronous credential writes are admitted only from this transaction's
+ * async execution context; unrelated same-process work must wait or fail.
+ */
+export async function withCredentialsTransactionLockAsync(operation) {
+    const lockPath = getCredentialsLockPath();
+    const currentOwner = credentialsTransactionOwner.getStore();
+    if (heldCredentialsLock) {
+        if (heldCredentialsLock.path !== lockPath) {
+            throw new Error('ORIZU_CREDENTIALS_LOCK_NESTED_CONFIG: credentials config changed during a mutation.');
+        }
+        if (heldCredentialsLock.asyncOwner === currentOwner && currentOwner) {
+            heldCredentialsLock.depth += 1;
+            try {
+                return await operation();
+            }
+            finally {
+                heldCredentialsLock.depth -= 1;
+            }
+        }
+        const timeoutMs = readLockDuration('ORIZU_CREDENTIALS_LOCK_TIMEOUT_MS', DEFAULT_CREDENTIALS_LOCK_TIMEOUT_MS, MAX_CREDENTIALS_LOCK_TIMEOUT_MS);
+        let timer;
+        const didRelease = await Promise.race([
+            heldCredentialsLock.released.then(() => true),
+            new Promise(resolve => { timer = setTimeout(() => resolve(false), timeoutMs); }),
+        ]);
+        if (timer)
+            clearTimeout(timer);
+        if (!didRelease) {
+            throw new Error(`ORIZU_CREDENTIALS_LOCK_TIMEOUT: credentials mutation did not acquire the lock within ${timeoutMs}ms. Verify no Orizu process is running, then remove credentials.json.lock manually.`);
+        }
+        return await withCredentialsTransactionLockAsync(operation);
+    }
+    const lock = acquireCredentialsLock();
+    const owner = Symbol('credentials-transaction-owner');
+    lock.asyncOwner = owner;
+    heldCredentialsLock = lock;
+    try {
+        return await credentialsTransactionOwner.run(owner, operation);
+    }
+    finally {
+        heldCredentialsLock = null;
+        try {
+            releaseCredentialsLock(lock);
+        }
+        finally {
+            lock.resolveReleased();
+        }
+    }
+}
+function assertCredentialsLockHeld() {
+    if (!heldCredentialsLock || heldCredentialsLock.path !== getCredentialsLockPath()) {
+        throw new Error('ORIZU_CREDENTIALS_LOCK_REQUIRED: credentials writes require a transaction lock.');
+    }
+}
 function isStoredCredentialsV2(value) {
     if (!value || typeof value !== 'object') {
         return false;
@@ -52,35 +233,33 @@ function migrateToV2(stored) {
     };
 }
 function writeCredentials(config) {
+    assertCredentialsLockHeld();
     const dir = getConfigDir();
     mkdirSync(dir, { recursive: true, mode: 0o700 });
     chmodSync(dir, 0o700);
     const path = getCredentialsPath();
     const tempPath = join(dir, `.credentials.json.${process.pid}.${randomBytes(8).toString('hex')}.tmp`);
     const payload = JSON.stringify(config, null, 2) + '\n';
-    const fd = openSync(tempPath, 'wx', 0o600);
     try {
-        writeFileSync(fd, payload, 'utf-8');
-        fsyncSync(fd);
-    }
-    finally {
-        closeSync(fd);
-    }
-    chmodSync(tempPath, 0o600);
-    try {
-        renameSync(tempPath, path);
-    }
-    catch (error) {
-        if (process.platform === 'win32' && isNodeError(error) && error.code === 'EEXIST') {
-            rmSync(path, { force: true });
-            renameSync(tempPath, path);
+        const fd = openSync(tempPath, 'wx', 0o600);
+        try {
+            writeFileSync(fd, payload, 'utf-8');
+            fsyncSync(fd);
         }
-        else {
-            rmSync(tempPath, { force: true });
-            throw error;
+        finally {
+            closeSync(fd);
         }
+        chmodSync(tempPath, 0o600);
+        // Never delete the destination to emulate replacement. If this platform
+        // cannot atomically replace it, preserve the old file and surface the error.
+        renameSync(tempPath, path);
+        chmodSync(path, 0o600);
+    }
+    finally {
+        // On success rename has already removed this path; on every error this
+        // removes the owner-only temporary file containing credential material.
+        rmSync(tempPath, { force: true });
     }
-    chmodSync(path, 0o600);
 }
 function createEmptyCredentialsConfig() {
     return {
@@ -134,29 +313,52 @@ export function getServerCredentials(baseUrl) {
     return config.servers[baseUrl] || null;
 }
 export function saveServerCredentials(baseUrl, credentials) {
-    const loaded = loadCredentialsConfigForWrite();
-    const config = loaded.version === 3
-        ? loaded
-        : {
-            version: 3,
-            activeBaseUrl: loaded.activeBaseUrl,
-            servers: loaded.servers,
-        };
-    config.servers[baseUrl] = credentials;
-    config.activeBaseUrl = baseUrl;
-    writeCredentials(config);
+    return withCredentialsTransactionLock(() => {
+        const loaded = loadCredentialsConfigForWrite();
+        const config = loaded.version === 3
+            ? loaded
+            : {
+                version: 3,
+                activeBaseUrl: loaded.activeBaseUrl,
+                servers: loaded.servers,
+            };
+        config.servers[baseUrl] = credentials;
+        config.activeBaseUrl = baseUrl;
+        writeCredentials(config);
+    });
 }
 export function updateServerCredentials(baseUrl, credentials) {
-    const loaded = loadCredentialsConfigForWrite();
-    const config = loaded.version === 3
-        ? loaded
-        : {
-            version: 3,
-            activeBaseUrl: loaded.activeBaseUrl,
-            servers: loaded.servers,
-        };
-    config.servers[baseUrl] = credentials;
-    writeCredentials(config);
+    return withCredentialsTransactionLock(() => {
+        const loaded = loadCredentialsConfigForWrite();
+        const config = loaded.version === 3
+            ? loaded
+            : {
+                version: 3,
+                activeBaseUrl: loaded.activeBaseUrl,
+                servers: loaded.servers,
+            };
+        config.servers[baseUrl] = credentials;
+        writeCredentials(config);
+    });
+}
+export function credentialsEqual(left, right) {
+    if ('apiKey' in left || 'apiKey' in right) {
+        return 'apiKey' in left && 'apiKey' in right && left.apiKey === right.apiKey;
+    }
+    return left.accessToken === right.accessToken
+        && left.refreshToken === right.refreshToken
+        && left.expiresAt === right.expiresAt;
+}
+export function updateServerCredentialsIfCurrent(baseUrl, expected, replacement) {
+    return withCredentialsTransactionLock(() => {
+        const config = loadCredentialsConfig();
+        const current = config?.servers[baseUrl];
+        if (!config || !current || !credentialsEqual(current, expected))
+            return false;
+        config.servers[baseUrl] = replacement;
+        writeCredentials(config);
+        return true;
+    });
 }
 export function getActiveBaseUrl() {
     const config = loadCredentialsConfig();
@@ -244,25 +446,43 @@ export function hasResolvableAuth(baseUrl) {
     return getServerCredentials(baseUrl) !== null;
 }
 export function setActiveBaseUrl(baseUrl) {
-    const config = loadCredentialsConfigForWrite();
-    config.activeBaseUrl = baseUrl;
-    writeCredentials(config);
+    return withCredentialsTransactionLock(() => {
+        const config = loadCredentialsConfigForWrite();
+        config.activeBaseUrl = baseUrl;
+        writeCredentials(config);
+    });
+}
+export function clearServerCredentialsIfCurrent(baseUrl, expected) {
+    return withCredentialsTransactionLock(() => {
+        const config = loadCredentialsConfig();
+        const current = config?.servers[baseUrl];
+        if (!config || !current || !credentialsEqual(current, expected))
+            return false;
+        delete config.servers[baseUrl];
+        if (config.activeBaseUrl === baseUrl)
+            config.activeBaseUrl = null;
+        writeCredentials(config);
+        return true;
+    });
 }
 export function clearServerCredentials(baseUrl) {
-    const config = loadCredentialsConfig();
-    if (!config || !Object.hasOwn(config.servers, baseUrl)) {
-        return false;
-    }
-    delete config.servers[baseUrl];
-    if (config.activeBaseUrl === baseUrl) {
-        config.activeBaseUrl = null;
-    }
-    writeCredentials(config);
-    return true;
+    return withCredentialsTransactionLock(() => {
+        const config = loadCredentialsConfig();
+        if (!config || !Object.hasOwn(config.servers, baseUrl)) {
+            return false;
+        }
+        delete config.servers[baseUrl];
+        if (config.activeBaseUrl === baseUrl) {
+            config.activeBaseUrl = null;
+        }
+        writeCredentials(config);
+        return true;
+    });
 }
 export function clearCredentialsFile() {
-    const path = getCredentialsPath();
-    if (existsSync(path)) {
-        rmSync(path);
-    }
+    return withCredentialsTransactionLock(() => {
+        const path = getCredentialsPath();
+        if (existsSync(path))
+            rmSync(path);
+    });
 }

package/dist/github-setup.js

@@ -46,8 +46,8 @@ function alreadyInstalledHintLines(teamSlug) {
         '     • Install the App into a DIFFERENT GitHub org for this team (each org',
         '       installation can be linked to exactly one Orizu team).',
         '     • If the org is not linked to any Orizu team, uninstall the Orizu App',
-        '       from the org (GitHub → org Settings → GitHub Apps) and re-run',
-        `       \`orizu github link --team ${teamSlug}\` to do a fresh install.`,
+        '       from the org (GitHub → org Settings → GitHub Apps), then',
+        `       contact Orizu support to restart GitHub linking for team ${teamSlug}.`,
     ];
 }
 function defaultSleep(ms) {
@@ -99,7 +99,7 @@ export async function runGithubLink(teamSlug, io) {
     else {
         io.print('   Open the URL above and install the App, then return here.');
     }
-    io.print(`   Waiting for you to finish installing in the browser… (Ctrl+C to abort; resume later with \`orizu github link --team ${teamSlug}\`).`);
+    io.print('   Waiting for you to finish installing in the browser… (Ctrl+C to abort).');
     const now = io.now ?? (() => Date.now());
     const sleep = io.sleep ?? defaultSleep;
     const interval = io.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
@@ -125,7 +125,7 @@ export async function runGithubLink(teamSlug, io) {
             // the server's reason and exit non-zero instead of polling until timeout.
             if (data.status === 'unsupported_account' || data.status === 'expired') {
                 throw new Error(data.error ??
-                    `GitHub link could not be completed. Re-run \`orizu github link --team ${teamSlug}\`.`);
+                    `GitHub link could not be completed for team ${teamSlug}. Contact Orizu support to restart it.`);
             }
             // status 'pending' → keep waiting.
         }
@@ -135,12 +135,12 @@ export async function runGithubLink(teamSlug, io) {
             throw new Error(`Timed out waiting for the GitHub App install to complete after ${Math.round(timeout / 60000)} minutes. ` +
                 'If the Orizu GitHub App is already installed in that org, GitHub never notifies Orizu when you finish the "Configure" flow — ' +
                 'install the App into a DIFFERENT GitHub org for this team (or uninstall it from the org first if no other Orizu team uses it). ' +
-                `Resume with \`orizu github link --team ${teamSlug}\` after finishing the install.`);
+                `Contact Orizu support to resume GitHub linking for team ${teamSlug} after finishing the install.`);
         }
         if (!printedAlreadyInstalledHint && now() - started >= ALREADY_INSTALLED_HINT_MS) {
             for (const line of alreadyInstalledHintLines(teamSlug))
                 io.print(line);
-            io.print(`   Still waiting (Ctrl+C to abort; resume later with \`orizu github link --team ${teamSlug}\`)…`);
+            io.print('   Still waiting (Ctrl+C to abort)…');
             printedAlreadyInstalledHint = true;
             lastHeartbeat = now();
         }
@@ -160,12 +160,12 @@ async function confirmLink(teamSlug, orgLogin, io, fetcher) {
     io.print(`   GitHub reported installation on org: ${orgLogin ?? '(unknown)'}`);
     if (!io.confirm) {
         throw new Error(`Org ${orgLogin ?? '(unknown)'} is bound but needs confirmation. ` +
-            `Run \`orizu github link --team ${teamSlug}\` interactively to confirm.`);
+            `Contact Orizu support to confirm GitHub linking for team ${teamSlug}.`);
     }
     const approved = await io.confirm(orgLogin);
     if (!approved) {
         throw new Error(`Did not confirm org ${orgLogin ?? '(unknown)'}. ` +
-            `Re-run \`orizu github link --team ${teamSlug}\` to link the correct org.`);
+            `Contact Orizu support to link the correct GitHub organization for team ${teamSlug}.`);
     }
     const resp = await fetcher('/api/cli/github/link/confirm', {
         method: 'POST',

package/dist/headless-login.d.ts

@@ -0,0 +1,17 @@
+interface HeadlessLoginDependencies {
+    parseJsonResponse: <T>(response: Response, context: string) => Promise<T>;
+    printProgress: (message: string) => void;
+    sanitizeTerminalText: (text: string) => string;
+    validateBrowserUrl: (url: string, expectedOrigin?: string) => URL;
+}
+export declare function shouldUseHeadlessLogin({ isForced, platform, environment, }: {
+    isForced: boolean;
+    platform?: NodeJS.Platform;
+    environment?: Record<string, string | undefined>;
+}): boolean;
+export declare function waitForHeadlessAuthorization({ baseUrl, codeChallenge, }: {
+    baseUrl: string;
+    codeChallenge: string;
+}, dependencies: HeadlessLoginDependencies): Promise<string>;
+export {};
+//# sourceMappingURL=headless-login.d.ts.map

package/dist/headless-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headless-login.d.ts","sourceRoot":"","sources":["../src/headless-login.ts"],"names":[],"mappings":"AAYA,UAAU,yBAAyB;IACjC,iBAAiB,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAA;IACzE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IACxC,oBAAoB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IAC9C,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,KAAK,GAAG,CAAA;CAClE;AAED,wBAAgB,sBAAsB,CAAC,EACrC,QAAQ,EACR,QAA2B,EAC3B,WAAyB,GAC1B,EAAE;IACD,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CACjD,GAAG,OAAO,CAMV;AAsCD,wBAAsB,4BAA4B,CAChD,EACE,OAAO,EACP,aAAa,GACd,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;CACtB,EACD,YAAY,EAAE,yBAAyB,GACtC,OAAO,CAAC,MAAM,CAAC,CAiGjB"}