orizu 0.5.28 → 0.5.30

package/dist/auth-commands.js

@@ -0,0 +1,321 @@
+// ORI-2044: moved from index.ts to keep auth commands together.
+import { randomBytes, createHash } from 'crypto';
+import { spawn } from 'child_process';
+import { createServer } from 'http';
+import { sanitizeTerminalText, parseJsonResponse } from './json-response.js';
+import { isInteractiveTerminal, hasArg, hasJsonFlag, getArg } from './command-line-arguments.js';
+import { getBaseUrl, resolveLoginTarget, resolveLogoutTarget, assertSecureTokenTransport, authedFetch, credentialRequestRedirectPolicy, } from './http.js';
+import { hasResolvableAuth, rememberProcessSecret, saveServerCredentials, getServerCredentials, clearServerCredentials, resolveAuthTokenForBaseUrl, } from './credentials.js';
+import { printJson, printLine, printLoginProgress } from './cli-console-output.js';
+import { shouldUseHeadlessLogin, waitForHeadlessAuthorization } from './headless-login.js';
+import { renderCliAuthBrowserPage } from './cli-auth-browser-page.js';
+import { describeLogoutHttpFailure, describeLogoutTransportFailure } from './logout-diagnostic.js';
+import { resolveProjectSelection } from './account-directory.js';
+function isNodeError(error) {
+    return error instanceof Error;
+}
+function createCodeVerifier() {
+    return randomBytes(32).toString('base64url');
+}
+export function createCodeChallenge(verifier) {
+    return createHash('sha256').update(verifier).digest('base64url');
+}
+function isStandardOrizuOrigin(url) {
+    return url.protocol === 'https:' && !url.port && !url.username && !url.password &&
+        url.hostname.length <= 253 &&
+        /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*orizu\.ai$/.test(url.hostname);
+}
+export function validateBrowserUrl(url, expectedOrigin) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new Error('Server returned an invalid browser URL.');
+    }
+    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+        throw new Error('Server returned an unsupported browser URL scheme.');
+    }
+    if (parsed.username || parsed.password) {
+        throw new Error('Server returned a browser URL containing credentials.');
+    }
+    if (expectedOrigin && parsed.origin !== expectedOrigin) {
+        const allowsOrizuHandoff = isStandardOrizuOrigin(parsed) && isStandardOrizuOrigin(new URL(expectedOrigin));
+        if (!allowsOrizuHandoff) {
+            throw new Error('Server returned a browser URL for an unexpected origin.');
+        }
+    }
+    return parsed;
+}
+function openInBrowser(url) {
+    const parsed = validateBrowserUrl(url);
+    const platform = process.platform;
+    const href = parsed.href;
+    if (platform === 'darwin') {
+        spawn('open', [href], {
+            detached: true,
+            stdio: 'ignore',
+        }).unref();
+        return;
+    }
+    if (platform === 'win32') {
+        spawn('rundll32.exe', ['url.dll,FileProtocolHandler', href], {
+            detached: true,
+            stdio: 'ignore',
+            windowsHide: true,
+        }).unref();
+        return;
+    }
+    spawn('xdg-open', [href], {
+        detached: true,
+        stdio: 'ignore',
+    }).unref();
+}
+export function formatTerminalLink(url) {
+    const safeUrl = sanitizeTerminalText(url);
+    try {
+        const parsed = validateBrowserUrl(safeUrl);
+        if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+            return safeUrl;
+        }
+    }
+    catch {
+        return safeUrl;
+    }
+    if (!isInteractiveTerminal()) {
+        return safeUrl;
+    }
+    return `\u001B]8;;${safeUrl}\u0007${safeUrl}\u001B]8;;\u0007`;
+}
+function shellQuote(value) {
+    return `"${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+}
+const DEFAULT_AUTH_CALLBACK_PORT = 43123;
+function resolveAuthCallbackPort() {
+    const envPort = process.env.ORIZU_AUTH_PORT;
+    if (!envPort) {
+        return DEFAULT_AUTH_CALLBACK_PORT;
+    }
+    const parsed = parseInt(envPort, 10);
+    if (Number.isNaN(parsed) || parsed < 1024 || parsed > 65535) {
+        throw new Error(`Invalid ORIZU_AUTH_PORT: '${envPort}'. Must be a number between 1024 and 65535.`);
+    }
+    return parsed;
+}
+async function login(baseUrlOverride) {
+    const target = baseUrlOverride !== undefined
+        ? { baseUrl: baseUrlOverride, isDefault: false }
+        : hasArg('--no-prompt-if-logged-in')
+            ? { baseUrl: getBaseUrl(), isDefault: false }
+            : resolveLoginTarget();
+    const { baseUrl } = target;
+    let loginData;
+    try {
+        loginData = await authenticateAtBaseUrl(baseUrl);
+        if (!loginData)
+            return;
+        saveServerCredentials(baseUrl, {
+            credentialType: 'pat',
+            apiKey: loginData.apiKey,
+        });
+    }
+    catch (error) {
+        if (target.isDefault) {
+            const detail = error instanceof Error ? error.message : String(error);
+            throw new Error(`${detail} Check connectivity to https://app.orizu.ai, then retry \`orizu login\`.`, { cause: error });
+        }
+        throw error;
+    }
+    if (hasJsonFlag()) {
+        printJson({
+            status: 'logged-in',
+            server: baseUrl,
+            user: { id: loginData.user.id, email: loginData.user.email ?? null },
+        });
+        return;
+    }
+    printLine(`Logged in as ${sanitizeTerminalText(loginData.user.email ?? loginData.user.id)}`);
+}
+async function authenticateAtBaseUrl(baseUrl) {
+    assertSecureTokenTransport(baseUrl);
+    // hasResolvableAuth (ALI-1090): an env bearer (ORIZU_TOKEN / ORIZU_TOKEN_FILE)
+    // counts as logged in — a pre-authenticated hosted sandbox must not fall into
+    // the interactive browser flow.
+    if (hasArg('--no-prompt-if-logged-in') && hasResolvableAuth(baseUrl)) {
+        if (hasJsonFlag()) {
+            printJson({ status: 'already-logged-in', server: baseUrl });
+            return;
+        }
+        printLine(`Already logged in to ${sanitizeTerminalText(baseUrl)}.`);
+        return;
+    }
+    const codeVerifier = rememberProcessSecret(createCodeVerifier());
+    const codeChallenge = createCodeChallenge(codeVerifier);
+    const isHeadlessLogin = shouldUseHeadlessLogin({ isForced: hasArg('--headless') });
+    const callbackPort = isHeadlessLogin ? undefined : resolveAuthCallbackPort();
+    const redirectUri = callbackPort === undefined ? undefined : `http://127.0.0.1:${callbackPort}/callback`;
+    const callbackCode = isHeadlessLogin
+        ? await waitForHeadlessAuthorization({ baseUrl, codeChallenge }, {
+            parseJsonResponse,
+            printProgress: printLoginProgress,
+            sanitizeTerminalText,
+            validateBrowserUrl,
+        })
+        : await new Promise((resolve, reject) => {
+            const server = createServer((request, response) => {
+                try {
+                    const url = new URL(request.url || '/', `http://127.0.0.1:${callbackPort}`);
+                    const code = url.searchParams.get('code');
+                    if (!code) {
+                        response.statusCode = 400;
+                        response.setHeader('content-type', 'text/html; charset=utf-8');
+                        response.end(renderCliAuthBrowserPage('error'));
+                        return;
+                    }
+                    response.statusCode = 200;
+                    response.setHeader('content-type', 'text/html; charset=utf-8');
+                    response.end(renderCliAuthBrowserPage('success'));
+                    server.close();
+                    resolve(code);
+                }
+                catch (error) {
+                    server.close();
+                    reject(error);
+                }
+            });
+            server.on('error', (error) => {
+                if (error.code === 'EADDRINUSE') {
+                    reject(new Error(`Port ${callbackPort} is already in use. Set ORIZU_AUTH_PORT to a different port (1024–65535) and retry.`));
+                }
+                else {
+                    reject(error);
+                }
+            });
+            server.listen(callbackPort, '127.0.0.1', async () => {
+                try {
+                    const response = await fetch(`${baseUrl}/api/cli/auth/start`, {
+                        method: 'POST',
+                        headers: { 'Content-Type': 'application/json' },
+                        body: JSON.stringify({ codeChallenge, redirectUri }),
+                    });
+                    if (!response.ok) {
+                        const text = await response.text();
+                        server.close();
+                        reject(new Error(`Failed to start login: ${text}`));
+                        return;
+                    }
+                    const { authorizeUrl } = await parseJsonResponse(response, 'CLI auth start');
+                    const safeAuthorizeUrl = validateBrowserUrl(authorizeUrl, baseUrl).href;
+                    printLoginProgress(`Opening browser for login: ${sanitizeTerminalText(safeAuthorizeUrl)}`);
+                    openInBrowser(safeAuthorizeUrl);
+                }
+                catch (error) {
+                    server.close();
+                    reject(error);
+                }
+            });
+        });
+    rememberProcessSecret(callbackCode);
+    const exchangeResponse = await fetch(`${baseUrl}/api/cli/auth/exchange`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ code: callbackCode, codeVerifier, redirectUri }),
+    });
+    if (!exchangeResponse.ok) {
+        const text = await exchangeResponse.text();
+        throw new Error(`Failed to exchange auth code: ${text}`);
+    }
+    const loginData = await parseJsonResponse(exchangeResponse, 'CLI auth exchange');
+    if (!loginData.apiKey) {
+        throw new Error('Server did not return an API key. Upgrade the Orizu server and run `orizu login` again.');
+    }
+    return { ...loginData, apiKey: loginData.apiKey };
+}
+async function whoami() {
+    const response = await authedFetch('/api/cli/auth/whoami');
+    if (!response.ok) {
+        throw new Error(`whoami failed: ${await response.text()}`);
+    }
+    const data = await response.json();
+    if (hasJsonFlag()) {
+        printJson({ user: data.user, server: getBaseUrl() });
+        return;
+    }
+    printLine(sanitizeTerminalText(data.user.email ?? data.user.id));
+}
+async function logout(baseUrlOverride) {
+    const { baseUrl, credentialBaseUrl } = resolveLogoutTarget(baseUrlOverride);
+    const credentials = getServerCredentials(credentialBaseUrl);
+    if (!credentials) {
+        if (hasJsonFlag()) {
+            printJson({ status: 'already-logged-out', server: baseUrl });
+            return;
+        }
+        printLine(`Already logged out for ${sanitizeTerminalText(baseUrl)}.`);
+        return;
+    }
+    const authorizationToken = 'accessToken' in credentials
+        ? credentials.accessToken
+        : credentials.apiKey;
+    const logoutSecrets = [
+        authorizationToken,
+        ...('refreshToken' in credentials ? [credentials.refreshToken] : []),
+    ];
+    let remoteLogoutError = null;
+    try {
+        assertSecureTokenTransport(baseUrl);
+        const response = await fetch(`${baseUrl}/api/cli/auth/logout`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${authorizationToken}`,
+            },
+            body: 'refreshToken' in credentials
+                ? JSON.stringify({ refreshToken: credentials.refreshToken })
+                : undefined,
+            ...credentialRequestRedirectPolicy(),
+        });
+        if (!response.ok) {
+            remoteLogoutError = await describeLogoutHttpFailure(response, logoutSecrets);
+        }
+    }
+    catch (error) {
+        remoteLogoutError = describeLogoutTransportFailure(error, logoutSecrets);
+    }
+    clearServerCredentials(credentialBaseUrl);
+    if (hasJsonFlag()) {
+        printJson({ status: 'logged-out', server: baseUrl, remoteLogoutError });
+        return;
+    }
+    if (remoteLogoutError) {
+        console.warn(`Warning: remote logout failed: ${remoteLogoutError}`);
+    }
+    printLine(`Logged out from ${sanitizeTerminalText(baseUrl)}.`);
+}
+async function printEnv() {
+    const baseUrl = getBaseUrl();
+    // Uniform resolution (ALI-1090): env bearer (ORIZU_TOKEN / ORIZU_TOKEN_FILE)
+    // wins over credentials.json, so `orizu env` works in hosted sandboxes that
+    // never ran `orizu login`.
+    const token = resolveAuthTokenForBaseUrl(baseUrl);
+    const projectArg = getArg('--project');
+    const project = projectArg ? await resolveProjectSelection(projectArg) : null;
+    const projectId = project?.id || getArg('--project-id') || process.env.ORIZU_PROJECT_ID || '';
+    const projectSlug = project ? `${project.teamSlug}/${project.slug}` : process.env.ORIZU_PROJECT || '';
+    if (hasJsonFlag()) {
+        printJson({
+            ORIZU_API_URL: baseUrl,
+            ORIZU_TOKEN: token,
+            ORIZU_PROJECT_ID: projectId,
+            ...(projectSlug ? { ORIZU_PROJECT: projectSlug } : {}),
+        });
+        return;
+    }
+    printLine(`export ORIZU_API_URL=${shellQuote(baseUrl)}`);
+    printLine(`export ORIZU_TOKEN=${shellQuote(token)}`);
+    printLine(`export ORIZU_PROJECT_ID=${shellQuote(projectId)}`);
+    if (projectSlug) {
+        printLine(`export ORIZU_PROJECT=${shellQuote(projectSlug)}`);
+    }
+}
+export { isNodeError, login, shellQuote, logout, whoami, printEnv };

package/dist/cli-console-output.d.ts

@@ -0,0 +1,12 @@
+declare function getErrorMessage(error: unknown): string;
+declare function getCliVersion(): string;
+declare function printLine(message?: string): void;
+declare function printVersion(): void;
+declare function printBannerIfInteractive(): void;
+declare function printUsage(): void;
+declare function printError(message: string): void;
+declare function printLoginProgress(message: string): void;
+declare function printPushDisclosures(data: Record<string, unknown>): void;
+declare function printJson(value: Record<string, unknown>): void;
+export { getErrorMessage, printJson, printLine, printPushDisclosures, getCliVersion, printBannerIfInteractive, printVersion, printUsage, printError, printLoginProgress, };
+//# sourceMappingURL=cli-console-output.d.ts.map

package/dist/cli-console-output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-console-output.d.ts","sourceRoot":"","sources":["../src/cli-console-output.ts"],"names":[],"mappings":"AAUA,iBAAS,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE/C;AAED,iBAAS,aAAa,IAAI,MAAM,CAU/B;AAED,iBAAS,SAAS,CAAC,OAAO,SAAK,QAE9B;AAED,iBAAS,YAAY,SAEpB;AAED,iBAAS,wBAAwB,SAMhC;AAED,iBAAS,UAAU,SAGlB;AAED,iBAAS,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEzC;AAED,iBAAS,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAMjD;AAED,iBAAS,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAMjE;AAED,iBAAS,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QAEhD;AAED,OAAO,EACL,eAAe,EACf,SAAS,EACT,SAAS,EACT,oBAAoB,EACpB,aAAa,EACb,wBAAwB,EACxB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,kBAAkB,GACnB,CAAA"}

package/dist/cli-console-output.js

@@ -0,0 +1,57 @@
+// ORI-2044: moved from index.ts to keep cli console output together.
+import { readFileSync } from 'fs';
+import { stdout as output } from 'process';
+import { renderBanner } from './banner.js';
+import { renderRootHelp } from './help.js';
+import { sanitizeTerminalText } from './json-response.js';
+import { hasJsonFlag } from './command-line-arguments.js';
+import { reportReplacementWarning } from './report-replacement-warning.js';
+function getErrorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function getCliVersion() {
+    const packageJson = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+    if (typeof packageJson.version !== 'string' || packageJson.version.length === 0) {
+        throw new Error('Unable to read orizu CLI version.');
+    }
+    return packageJson.version;
+}
+function printLine(message = '') {
+    output.write(`${message}\n`);
+}
+function printVersion() {
+    printLine(`orizu ${getCliVersion()}`);
+}
+function printBannerIfInteractive() {
+    if (!process.stdout.isTTY) {
+        return;
+    }
+    printLine(renderBanner());
+    printLine('');
+}
+function printUsage() {
+    printBannerIfInteractive();
+    printLine(renderRootHelp());
+}
+function printError(message) {
+    console.error(sanitizeTerminalText(message));
+}
+function printLoginProgress(message) {
+    if (hasJsonFlag()) {
+        printError(message);
+        return;
+    }
+    printLine(message);
+}
+function printPushDisclosures(data) {
+    const warning = reportReplacementWarning(data);
+    if (warning)
+        printError(warning);
+    if (data.metadata_updated === true) {
+        printError('Updated prompt metadata on the identical existing version');
+    }
+}
+function printJson(value) {
+    printLine(JSON.stringify(value));
+}
+export { getErrorMessage, printJson, printLine, printPushDisclosures, getCliVersion, printBannerIfInteractive, printVersion, printUsage, printError, printLoginProgress, };

package/dist/cli-project-slug.d.ts

@@ -0,0 +1,20 @@
+export declare const RESERVED_ROUTING_SLUGS: readonly string[];
+export declare function isReservedRoutingSlug(slug: string): boolean;
+export declare function isReservedRoutingName(name: string): boolean;
+export interface ParsedProjectSlug {
+    teamSlug: string;
+    projectSlug: string;
+}
+export interface SplitProjectArg {
+    /** null when the caller passed a bare project slug. */
+    teamSlug: string | null;
+    projectSlug: string;
+}
+export declare function normalizeSlugInput(slug: string): string;
+/**
+ * Accept a `--project` value in either documented form: `teamSlug/projectSlug`
+ * or a bare `projectSlug` (resolved within the caller's team).
+ */
+export declare function splitCliProjectArg(value: string): SplitProjectArg | null;
+export declare function parseCliProjectSlug(projectSlug: string): ParsedProjectSlug | null;
+//# sourceMappingURL=cli-project-slug.d.ts.map

package/dist/cli-project-slug.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-project-slug.d.ts","sourceRoot":"","sources":["../src/cli-project-slug.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAInD,CAAA;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAG3D;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAQxE;AAED,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAQjF"}

package/dist/cli-project-slug.js

@@ -0,0 +1,36 @@
+export const RESERVED_ROUTING_SLUGS = [
+    'account', 'teams', 'projects', 'task', 'preview', 'api', 'auth', 'login', 'logout', 'signup', 'signin',
+    'settings', 'new', 'admin', 'docs', 'learn', 'd', 'agents', 'subprocessors', 'llms.txt',
+    '_next', 'robots.txt', 'sitemap.xml', 'favicon.ico',
+];
+export function isReservedRoutingSlug(slug) {
+    return RESERVED_ROUTING_SLUGS.includes(normalizeSlugInput(slug));
+}
+export function isReservedRoutingName(name) {
+    const stem = normalizeSlugInput(name).replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
+    return isReservedRoutingSlug(name) || isReservedRoutingSlug(stem);
+}
+export function normalizeSlugInput(slug) {
+    return slug.trim().toLowerCase();
+}
+/**
+ * Accept a `--project` value in either documented form: `teamSlug/projectSlug`
+ * or a bare `projectSlug` (resolved within the caller's team).
+ */
+export function splitCliProjectArg(value) {
+    if (!value.includes('/')) {
+        const projectSlug = normalizeSlugInput(value);
+        return projectSlug ? { teamSlug: null, projectSlug } : null;
+    }
+    const parsed = parseCliProjectSlug(value);
+    return parsed ? { teamSlug: parsed.teamSlug, projectSlug: parsed.projectSlug } : null;
+}
+export function parseCliProjectSlug(projectSlug) {
+    const segments = projectSlug.split('/');
+    if (segments.length !== 2)
+        return null;
+    const [teamSlug, project] = segments.map(normalizeSlugInput);
+    if (!teamSlug || !project)
+        return null;
+    return { teamSlug, projectSlug: project };
+}

package/dist/command-line-arguments.d.ts

@@ -0,0 +1,15 @@
+declare let cliArgs: string[];
+declare function getArg(name: string): string | null;
+declare function getArchiveListStatus(command: string): string;
+declare function getArgs(name: string): string[];
+declare function getOptionalArgValue(name: string): string | null;
+declare function rejectDashPrefixedOptionValue(name: string, value: string | null): void;
+export declare function normalizeSlugInput(slug: string): string;
+declare function isInteractiveTerminal(): boolean;
+declare function hasArg(name: string): boolean;
+export declare function expandHomePath(path: string): string;
+declare function getPositionalArg(index: number): string | null;
+declare function hasJsonFlag(): boolean;
+export { cliArgs, getArg, hasJsonFlag, getArchiveListStatus, getPositionalArg, hasArg, isInteractiveTerminal, getArgs, getOptionalArgValue, rejectDashPrefixedOptionValue, };
+export declare function setCommandLineArguments(args: string[], jsonOutput: boolean): void;
+//# sourceMappingURL=command-line-arguments.d.ts.map

package/dist/command-line-arguments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-line-arguments.d.ts","sourceRoot":"","sources":["../src/command-line-arguments.ts"],"names":[],"mappings":"AAEA,QAAA,IAAI,OAAO,UAAwB,CAAA;AAGnC,iBAAS,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAO3C;AAED,iBAAS,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CASrD;AAED,iBAAS,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAiBvC;AAED,iBAAS,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAYxD;AAED,iBAAS,6BAA6B,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,QAIxE;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,iBAAS,qBAAqB,YAE7B;AAED,iBAAS,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErC;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOnD;AAED,iBAAS,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGtD;AAED,iBAAS,WAAW,IAAI,OAAO,CAE9B;AAED,OAAO,EACL,OAAO,EACP,MAAM,EACN,WAAW,EACX,oBAAoB,EACpB,gBAAgB,EAChB,MAAM,EACN,qBAAqB,EACrB,OAAO,EACP,mBAAmB,EACnB,6BAA6B,GAC9B,CAAA;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,OAAO,GAAG,IAAI,CAGjF"}

package/dist/command-line-arguments.js

@@ -0,0 +1,77 @@
+// ORI-2044: moved from index.ts to keep command line arguments together.
+let cliArgs = process.argv.slice(2);
+let cliJsonOutput = false;
+function getArg(name) {
+    const index = cliArgs.indexOf(name);
+    if (index === -1 || index + 1 >= cliArgs.length) {
+        return null;
+    }
+    return cliArgs[index + 1];
+}
+function getArchiveListStatus(command) {
+    const status = getArg('--status') || 'active';
+    if (!['active', 'archived', 'all'].includes(status)) {
+        throw new Error(`Usage: orizu ${command} list [--project <team/project>] ` +
+            '[--status active|archived|all]');
+    }
+    return status;
+}
+function getArgs(name) {
+    const values = [];
+    for (let index = 0; index < cliArgs.length; index += 1) {
+        if (cliArgs[index] !== name) {
+            continue;
+        }
+        const value = cliArgs[index + 1];
+        if (!value || value.startsWith('-')) {
+            throw new Error(`Usage: ${name} <value>`);
+        }
+        values.push(value);
+        index += 1;
+    }
+    return values;
+}
+function getOptionalArgValue(name) {
+    const index = cliArgs.indexOf(name);
+    if (index === -1 || index + 1 >= cliArgs.length) {
+        return null;
+    }
+    const value = cliArgs[index + 1];
+    if (!value || value.startsWith('-')) {
+        return null;
+    }
+    return value;
+}
+function rejectDashPrefixedOptionValue(name, value) {
+    if (value && value.startsWith('-')) {
+        throw new Error(`Invalid value for ${name}: option values cannot start with a dash`);
+    }
+}
+export function normalizeSlugInput(slug) {
+    return slug.trim().toLowerCase();
+}
+function isInteractiveTerminal() {
+    return Boolean(process.stdin.isTTY && process.stdout.isTTY);
+}
+function hasArg(name) {
+    return cliArgs.includes(name);
+}
+export function expandHomePath(path) {
+    if (path.startsWith('~/')) {
+        const home = process.env.HOME || '';
+        return `${home}/${path.slice(2)}`;
+    }
+    return path;
+}
+function getPositionalArg(index) {
+    const value = cliArgs[index];
+    return value && !value.startsWith('--') ? value : null;
+}
+function hasJsonFlag() {
+    return cliJsonOutput || hasArg('--json');
+}
+export { cliArgs, getArg, hasJsonFlag, getArchiveListStatus, getPositionalArg, hasArg, isInteractiveTerminal, getArgs, getOptionalArgValue, rejectDashPrefixedOptionValue, };
+export function setCommandLineArguments(args, jsonOutput) {
+    cliArgs = args;
+    cliJsonOutput = jsonOutput;
+}

package/dist/credentials.d.ts

@@ -1,4 +1,5 @@
 import { ServerCredentials, StoredCredentialsV2, StoredCredentialsV3 } from './types.js';
+export declare function getConfigDir(): string;
 /**
  * Runs a synchronous credentials transaction under the one process-wide and
  * cross-process lock. Exported so real-process fixtures can hold the production
@@ -18,6 +19,11 @@ export declare function updateServerCredentials(baseUrl: string, credentials: Se
 export declare function credentialsEqual(left: ServerCredentials, right: ServerCredentials): boolean;
 export declare function updateServerCredentialsIfCurrent(baseUrl: string, expected: ServerCredentials, replacement: ServerCredentials): boolean;
 export declare function getActiveBaseUrl(): string | null;
+/** Resolve the selected server and move a retired production credential atomically. */
+export declare function resolveCredentialServer(selected?: string): string | null;
+export declare function rememberProcessSecret(secret: string): string;
+export declare function rememberResolvedBearer(bearer: string): string;
+export declare function getSecretsSeenThisProcess(): readonly string[];
 /**
  * In-sandbox bearer resolution (ALI-1044). Resolves a bearer supplied out-of-band
  * to the hosted agent, WITHOUT consulting credentials.json:

package/dist/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAiBA,OAAO,EACL,iBAAiB,EAEjB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,YAAY,CAAA;AAqInB;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAgCvE;AAED;;;;GAIG;AACH,wBAAsB,mCAAmC,CAAC,CAAC,EACzD,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,CAAC,CAAC,CAiDZ;AAwGD,wBAAgB,qBAAqB,IAAI,mBAAmB,GAAG,mBAAmB,GAAG,IAAI,CA8BxF;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAW9E;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,QAepF;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,QAatF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAO3F;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAUT;AAED,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAGhD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,IAAI,CA0BrD;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAYlE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAS1D;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,QAMtD;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,iBAAiB,GAC1B,OAAO,CAWT;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAc/D;AAED,wBAAgB,oBAAoB,SAKnC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAkBA,OAAO,EACL,iBAAiB,EAEjB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,YAAY,CAAA;AAMnB,wBAAgB,YAAY,IAAI,MAAM,CAKrC;AA0HD;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAgCvE;AAED;;;;GAIG;AACH,wBAAsB,mCAAmC,CAAC,CAAC,EACzD,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,CAAC,CAAC,CAiDZ;AAwGD,wBAAgB,qBAAqB,IAAI,mBAAmB,GAAG,mBAAmB,GAAG,IAAI,CA8BxF;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAW9E;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,QAepF;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,QAatF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAO3F;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAUT;AAED,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAGhD;AAED,uFAAuF;AACvF,wBAAgB,uBAAuB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAqCxE;AAID,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAG5D;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,yBAAyB,IAAI,SAAS,MAAM,EAAE,CAE7D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,IAAI,CA0BrD;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAclE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAS1D;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,QAMtD;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,iBAAiB,GAC1B,OAAO,CAWT;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAc/D;AAED,wBAAgB,oBAAoB,SAKnC"}