rkb-cli 0.3.0-beta.1

package/lib/adapters/pop/transport.js

@@ -0,0 +1,120 @@
+import OpenApiClient, { Config, OpenApiRequest, Params, } from "@alicloud/openapi-client";
+import { RuntimeOptions } from "@alicloud/tea-util";
+import { CapabilityError } from "../../core/result.js";
+import { getConfigValue } from "../../config/index.js";
+import { runtimeProfile } from "../../runtime/profile.js";
+import { readSandboxStsCredentials, } from "./sandbox-sts.js";
+import { OfficialCliSession } from "../aliyun/official-cli.js";
+// The SDK's CommonJS default export is wrapped once when loaded by native ESM.
+const Client = (typeof OpenApiClient === "function"
+    ? OpenApiClient
+    : OpenApiClient.default);
+export function record(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new CapabilityError("POP_INVALID_RESPONSE", "POP returned an invalid response object.");
+    return value;
+}
+// Java DTO fixtures use lowerCamelCase; the POP gateway normally uses PascalCase.
+export function field(value, name) {
+    const object = record(value);
+    return object[name] ?? object[name[0].toUpperCase() + name.slice(1)];
+}
+export function requiredString(value, name) {
+    const result = field(value, name);
+    if (typeof result !== "string" || !result.trim())
+        throw new CapabilityError("POP_INVALID_RESPONSE", `POP response is missing ${name}.`);
+    return result;
+}
+function requestId(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const raw = field(value, "requestId");
+    return typeof raw === "string" ? raw : undefined;
+}
+export class PopTransport {
+    deployment;
+    timeout;
+    credentialProvider;
+    execute;
+    constructor(deployment, timeout = 30000, execute, credentialProvider = async () => readSandboxStsCredentials() ?? new OfficialCliSession().get()) {
+        this.deployment = deployment;
+        this.timeout = timeout;
+        this.credentialProvider = credentialProvider;
+        this.execute = execute;
+    }
+    async call(action, fields = {}) {
+        const deployment = this.deployment;
+        if (!deployment?.endpoint || !deployment.apiVersion)
+            throw new CapabilityError("POP_NOT_CONFIGURED", "This external build has no POP endpoint/API Version. Configure editions/external.json and rebuild.");
+        if (!/^[a-zA-Z0-9.-]+(?::[0-9]+)?$/.test(deployment.endpoint))
+            throw new CapabilityError("POP_INVALID_ENDPOINT", "POP endpoint must be a hostname without a URL path.");
+        if (!Number.isFinite(this.timeout) || this.timeout <= 0)
+            throw new CapabilityError("POP_INVALID_TIMEOUT", "request.timeout must be a positive number.");
+        const params = new Params({
+            action,
+            version: deployment.apiVersion,
+            protocol: "HTTPS",
+            pathname: "/",
+            method: "POST",
+            authType: "AK",
+            style: "RPC",
+            reqBodyType: deployment.requestBodyType,
+            bodyType: "json",
+        });
+        const body = Object.fromEntries(Object.entries(fields).filter(([, value]) => value !== undefined));
+        const credentials = await this.credentialProvider();
+        const request = new OpenApiRequest({ body });
+        const runtime = new RuntimeOptions({
+            readTimeout: this.timeout,
+            connectTimeout: this.timeout,
+            autoretry: false,
+            maxAttempts: 1,
+        });
+        let response;
+        try {
+            // Build with the currently valid STS credentials on every call, including pagination.
+            // Reusing a client initialized with old credentials would break automatic renewal.
+            const execute = this.execute ??
+                new Client(new Config({
+                    endpoint: deployment.endpoint,
+                    accessKeyId: credentials.accessKeyId,
+                    accessKeySecret: credentials.accessKeySecret,
+                    securityToken: credentials.securityToken,
+                }));
+            response =
+                typeof execute === "function"
+                    ? await execute(params, request, runtime)
+                    : await execute.callApi(params, request, runtime);
+        }
+        catch (error) {
+            // SDK messages can include signed request URLs. Expose only stable error metadata.
+            const object = error && typeof error === "object"
+                ? error
+                : {};
+            const code = typeof object.code === "string" ? object.code : "POP_REQUEST_FAILED";
+            const id = requestId(object.data) ?? requestId(object);
+            throw new CapabilityError(code, `POP ${action} failed (${code})${id ? `; RequestId: ${id}` : ""}. Check the deployment, network and external login.`, id);
+        }
+        const envelope = record(response.body);
+        const success = field(envelope, "success");
+        const code = field(envelope, "code");
+        const status = field(envelope, "httpStatusCode");
+        if (success === false ||
+            (code !== undefined && String(code) !== "200") ||
+            (typeof status === "number" && status >= 400)) {
+            const id = requestId(envelope);
+            const detail = field(envelope, "message");
+            const errorCode = code === undefined ? "POP_REQUEST_FAILED" : String(code);
+            throw new CapabilityError(errorCode, `${typeof detail === "string" ? detail : "POP request failed"}${id ? `; RequestId: ${id}` : ""}`, id);
+        }
+        if (success !== true && String(code) !== "200")
+            throw new CapabilityError("POP_INVALID_RESPONSE", "POP response has no success status.");
+        const data = field(envelope, "data");
+        if (data === undefined || data === null)
+            throw new CapabilityError("POP_INVALID_RESPONSE", "POP response has no data.");
+        return data;
+    }
+}
+export function createTransport() {
+    return new PopTransport(runtimeProfile.pop, Number(getConfigValue("request.timeout") ?? 30000));
+}

package/lib/command-registry.js

@@ -0,0 +1,19 @@
+import './runtime/bootstrap.js';
+import Command0 from "./commands/doc/index.js";
+import Command1 from "./commands/doc/publish.js";
+import Command2 from "./features/auth/aliyun/command.js";
+import Command3 from "./features/auth/aliyun/logout-command.js";
+import Command4 from "./commands/space/index.js";
+import Command5 from "./commands/space/list.js";
+import Command6 from "./commands/space/use.js";
+import Command7 from "./commands/whoami.js";
+export default {
+"doc": Command0,
+"doc:publish": Command1,
+"login": Command2,
+"logout": Command3,
+"space": Command4,
+"space:list": Command5,
+"space:use": Command6,
+"whoami": Command7
+};

package/lib/commands/doc/index.js

@@ -0,0 +1,2 @@
+import {Command, Help} from '@oclif/core';
+export default class Topic extends Command { static summary = "Manage doc; available commands are listed below"; async run() { await this.parse(Topic); await new Help(this.config).showHelp(["doc"]); }}

package/lib/commands/doc/publish.js

@@ -0,0 +1,31 @@
+import { Command } from "@oclif/core";
+import open from "open";
+import { baseFlags } from "../../lib/command-flags.js";
+import { logger } from "../../lib/logger.js";
+import { getService } from "../../runtime/container.js";
+export default class DocPublish extends Command {
+    static summary = "Start a documentation publish pipeline";
+    static examples = ["<%= config.bin %> doc publish"];
+    static flags = { ...baseFlags };
+    async run() {
+        const { flags } = await this.parse(DocPublish);
+        const result = await getService("docPublish").startPipeline();
+        if (!result.success || !result.data) {
+            if (flags.json)
+                this.log(JSON.stringify(result, null, 2));
+            else
+                logger.error(result.error ?? "Failed to start publish pipeline");
+            this.exit(1);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        logger.success("Publish pipeline started!");
+        this.log(`Pipeline ID: ${result.data.pipelineId}`);
+        if (result.data.pipelineUrl) {
+            this.log(`Pipeline URL: ${result.data.pipelineUrl}`);
+            await open(result.data.pipelineUrl);
+        }
+    }
+}

package/lib/commands/space/index.js

@@ -0,0 +1,2 @@
+import {Command, Help} from '@oclif/core';
+export default class Topic extends Command { static summary = "Manage space; available commands are listed below"; async run() { await this.parse(Topic); await new Help(this.config).showHelp(["space"]); }}

package/lib/commands/space/list.js

@@ -0,0 +1,40 @@
+import { runtimeProfile } from "../../runtime/profile.js";
+import { Command } from "@oclif/core";
+import { baseFlags } from "../../lib/command-flags.js";
+import { logger } from "../../lib/logger.js";
+import { getService } from "../../runtime/container.js";
+export default class SpaceList extends Command {
+    static summary = runtimeProfile.edition === "internal"
+        ? "List spaces accessible to the current API key"
+        : "List spaces accessible to the current credentials";
+    static examples = [
+        "<%= config.bin %> space list",
+        "<%= config.bin %> space list --json",
+    ];
+    static flags = { ...baseFlags };
+    async run() {
+        const { flags } = await this.parse(SpaceList);
+        const result = await getService("spaceRead").list();
+        if (!result.success || !result.data) {
+            if (flags.json)
+                this.log(JSON.stringify(result, null, 2));
+            else
+                logger.error(result.error ?? "Failed to list spaces");
+            this.exit(1);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(result.data, null, 2));
+            return;
+        }
+        if (result.data.spaces.length === 0) {
+            logger.info("No accessible spaces found");
+            return;
+        }
+        const codeWidth = Math.max(4, ...result.data.spaces.map((space) => space.code.length));
+        this.log(`  ${"CODE".padEnd(codeWidth)}  NAME`);
+        for (const space of result.data.spaces) {
+            const current = space.code === result.data.currentSpaceCode ? "*" : " ";
+            this.log(`${current} ${space.code.padEnd(codeWidth)}  ${space.name}`);
+        }
+    }
+}

package/lib/commands/space/use.js

@@ -0,0 +1,29 @@
+import { Args, Command } from "@oclif/core";
+import { baseFlags } from "../../lib/command-flags.js";
+import { logger } from "../../lib/logger.js";
+import { getService } from "../../runtime/container.js";
+export default class SpaceUse extends Command {
+    static summary = "Switch the current rkb space";
+    static examples = ["<%= config.bin %> space use docs"];
+    static args = {
+        spaceCode: Args.string({ description: "Space code", required: true }),
+    };
+    static flags = { ...baseFlags };
+    async run() {
+        const { args, flags } = await this.parse(SpaceUse);
+        const result = await getService("spaceRead").use(args.spaceCode);
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+        }
+        else if (result.success) {
+            logger.success(result.message ?? `Switched to space: ${args.spaceCode}`);
+            if (flags.verbose && result.data)
+                logger.info(`Name: ${result.data.space.name}`);
+        }
+        else {
+            logger.error(result.error ?? "Failed to switch space");
+        }
+        if (!result.success)
+            this.exit(1);
+    }
+}

package/lib/commands/whoami.js

@@ -0,0 +1,34 @@
+import { Command } from "@oclif/core";
+import { baseFlags } from "../lib/command-flags.js";
+import { getService } from "../runtime/container.js";
+export default class Whoami extends Command {
+    static summary = "Show current logged in user";
+    static description = "Validate the current credentials and show the logged-in user.";
+    static flags = {
+        ...baseFlags,
+    };
+    async run() {
+        const { flags } = await this.parse(Whoami);
+        const result = await getService("identity").whoami();
+        if (!result.success) {
+            if (flags.json) {
+                this.log(JSON.stringify({ success: false, error: result.error, code: result.code }, null, 2));
+            }
+            else {
+                this.logToStderr(result.error);
+            }
+            this.exit(1);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify({ success: true, user: result.data }, null, 2));
+            return;
+        }
+        this.log(result.data.name);
+        if (flags.verbose) {
+            if (result.data.email)
+                this.logToStderr(`Email: ${result.data.email}`);
+            if (result.data.empId)
+                this.logToStderr(`Employee ID: ${result.data.empId}`);
+        }
+    }
+}

package/lib/config/index.js

@@ -0,0 +1,157 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { parse, stringify } from "yaml";
+import { runtimeProfile } from "../runtime/profile.js";
+export function getConfigDir() {
+    return (process.env[runtimeProfile.configDirEnv] ||
+        join(homedir(), runtimeProfile.configDirName));
+}
+export function getConfigFile() {
+    return join(getConfigDir(), "config.yaml");
+}
+export function getSchemaItems() {
+    return runtimeProfile.schema.map((item) => ({
+        ...item,
+        enum: item.enum ? [...item.enum] : undefined,
+    }));
+}
+export function configEnvKeyFor(key) {
+    return `${runtimeProfile.envPrefix}${key.toUpperCase().replace(/\./g, "_")}`;
+}
+export function isConfigFromEnv(key) {
+    return process.env[configEnvKeyFor(key)] !== undefined;
+}
+export function ensureConfigDir() {
+    const configDir = getConfigDir();
+    mkdirSync(configDir, { recursive: true, mode: 0o700 });
+    try {
+        chmodSync(configDir, 0o700);
+    }
+    catch {
+        // Some filesystems do not support POSIX permissions.
+    }
+}
+export function readConfigRaw() {
+    const configFile = getConfigFile();
+    if (!existsSync(configFile))
+        return {};
+    try {
+        const value = parse(readFileSync(configFile, "utf8"));
+        return isRecord(value) ? value : {};
+    }
+    catch (error) {
+        throw new Error(`Failed to read config file ${configFile}: ${errorMessage(error)}`);
+    }
+}
+export function readConfig() {
+    const config = {};
+    for (const item of runtimeProfile.schema) {
+        setNestedValue(config, item.key, getConfigValue(item.key));
+    }
+    return config;
+}
+export function getConfigValue(key) {
+    const schemaItem = runtimeProfile.schema.find((item) => item.key === key);
+    const envValue = process.env[configEnvKeyFor(key)];
+    if (envValue !== undefined) {
+        return coerceValue(key, envValue, schemaItem?.type ?? "string");
+    }
+    const fileValue = getNestedValue(readConfigRaw(), key);
+    if (fileValue !== undefined)
+        return fileValue;
+    return schemaItem?.default;
+}
+export function setConfigValue(key, value) {
+    const config = readConfigRaw();
+    setNestedValue(config, key, value);
+    writeConfig(config);
+}
+export function deleteConfigValue(key) {
+    const config = readConfigRaw();
+    const deleted = deleteNestedValue(config, key);
+    if (deleted)
+        writeConfig(config);
+    return deleted;
+}
+export function writeConfig(config) {
+    ensureConfigDir();
+    const configFile = getConfigFile();
+    const temporaryFile = `${configFile}.${process.pid}.tmp`;
+    writeFileSync(temporaryFile, stringify(config), {
+        encoding: "utf8",
+        mode: 0o600,
+    });
+    renameSync(temporaryFile, configFile);
+    try {
+        chmodSync(configFile, 0o600);
+    }
+    catch {
+        // Some filesystems do not support POSIX permissions.
+    }
+}
+export function flattenConfig(object, prefix = "") {
+    const result = {};
+    for (const [key, value] of Object.entries(object)) {
+        const path = prefix ? `${prefix}.${key}` : key;
+        if (isRecord(value)) {
+            Object.assign(result, flattenConfig(value, path));
+        }
+        else {
+            result[path] = value;
+        }
+    }
+    return result;
+}
+export function setNestedValue(object, key, value) {
+    const segments = key.split(".");
+    let current = object;
+    for (const segment of segments.slice(0, -1)) {
+        if (!isRecord(current[segment]))
+            current[segment] = {};
+        current = current[segment];
+    }
+    current[segments.at(-1)] = value;
+}
+function coerceValue(key, value, type) {
+    if (type === "number") {
+        const parsed = Number(value);
+        if (!Number.isFinite(parsed)) {
+            throw new Error(`${configEnvKeyFor(key)} must be a number`);
+        }
+        return parsed;
+    }
+    if (type === "boolean") {
+        if (["true", "1"].includes(value.toLowerCase()))
+            return true;
+        if (["false", "0"].includes(value.toLowerCase()))
+            return false;
+        throw new Error(`${configEnvKeyFor(key)} must be true, false, 1, or 0`);
+    }
+    return value;
+}
+function getNestedValue(object, key) {
+    return key.split(".").reduce((value, segment) => {
+        return isRecord(value) ? value[segment] : undefined;
+    }, object);
+}
+function deleteNestedValue(object, key) {
+    const segments = key.split(".");
+    let current = object;
+    for (const segment of segments.slice(0, -1)) {
+        const next = current[segment];
+        if (!isRecord(next))
+            return false;
+        current = next;
+    }
+    const leaf = segments.at(-1);
+    if (!Object.prototype.hasOwnProperty.call(current, leaf))
+        return false;
+    return delete current[leaf];
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/lib/core/context.js

@@ -0,0 +1,12 @@
+import { configEnvKeyFor, getConfigValue, isConfigFromEnv, setConfigValue, } from "../config/index.js";
+import { runtimeProfile } from "../runtime/profile.js";
+export function resourceContext() {
+    return {
+        bin: runtimeProfile.bin,
+        credentialLabel: runtimeProfile.edition === "internal" ? "API key" : "credentials",
+        getSpace: () => String(getConfigValue(runtimeProfile.spaceKey) ?? "").trim(),
+        setSpace: (code) => setConfigValue(runtimeProfile.spaceKey, code),
+        spaceEnvKey: configEnvKeyFor(runtimeProfile.spaceKey),
+        isSpaceFromEnv: () => isConfigFromEnv(runtimeProfile.spaceKey),
+    };
+}

package/lib/core/result.js

@@ -0,0 +1,17 @@
+export class CapabilityError extends Error {
+    code;
+    requestId;
+    constructor(code, message, requestId) {
+        super(message);
+        this.code = code;
+        this.requestId = requestId;
+        this.name = "CapabilityError";
+    }
+}
+export function failure(prefix, error) {
+    return {
+        success: false,
+        error: `${prefix}: ${error instanceof Error ? error.message : String(error)}`,
+        ...(error instanceof CapabilityError ? { code: error.code } : {}),
+    };
+}

package/lib/features/auth/aliyun/command.js

@@ -0,0 +1,78 @@
+import { Command, Flags } from "@oclif/core";
+import { baseFlags } from "../../../lib/command-flags.js";
+import { CapabilityError } from "../../../core/result.js";
+import { createAliyunLoginService } from "./factory.js";
+export default class AliyunLogin extends Command {
+    static summary = "Sign in with your Alibaba Cloud identity";
+    static description = `Use the official Alibaba Cloud CLI OAuth login (PKCE) and obtain temporary STS credentials.
+Requires aliyun CLI 3.3.0 or later. No manual AccessKey configuration is needed.
+The official-cli application must be authorized for your account. Credentials are stored in ~/.rkb-external/aliyun/config.json (owner access only).
+External POP commands use AccessKey signatures and Alibaba Cloud RAM permissions.`;
+    static examples = [
+        "<%= config.bin %> login",
+        "<%= config.bin %> login --force",
+        "<%= config.bin %> login --json",
+    ];
+    static flags = {
+        ...baseFlags,
+        force: Flags.boolean({
+            description: "Authorize again instead of reusing the saved login",
+            default: false,
+        }),
+        timeout: Flags.integer({
+            description: "Login timeout in seconds (1-600)",
+            default: 180,
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(AliyunLogin);
+        const controller = new AbortController();
+        const cancel = () => controller.abort(new CapabilityError("OIDC_CANCELLED", "Login was cancelled."));
+        let timer;
+        let failure;
+        try {
+            if (flags.timeout < 1 || flags.timeout > 600)
+                throw new CapabilityError("OIDC_INVALID_TIMEOUT", "Login timeout must be between 1 and 600 seconds.");
+            timer = setTimeout(() => controller.abort(new CapabilityError("OIDC_TIMEOUT", "Login timed out. Run rkb login to try again.")), flags.timeout * 1000);
+            process.once("SIGINT", cancel);
+            process.once("SIGTERM", cancel);
+            const result = await createAliyunLoginService().login({
+                force: flags.force,
+                signal: controller.signal,
+                onAuthorization: (url) => {
+                    this.logToStderr("Complete Alibaba Cloud sign-in on this computer. If needed, open this URL manually:");
+                    // Deliberately bypass file logging; never persist authorization URLs or codes.
+                    this.logToStderr(url);
+                },
+            });
+            if (flags.json)
+                this.log(JSON.stringify({ success: true, provider: "aliyun", ...result }, null, 2));
+            else {
+                // JSON escaping prevents identity display names from injecting terminal control sequences.
+                this.log(`Alibaba Cloud identity verified: ${JSON.stringify(result.identity.name)}`);
+                this.log(`Account ID: ${JSON.stringify(result.identity.accountId)}; User ID: ${JSON.stringify(result.identity.userId)}`);
+                this.log("Official OAuth login saved. External POP commands use temporary STS credentials; API access depends on RAM permissions.");
+                if (flags.verbose)
+                    this.log(`STS credential expiry: ${result.expiresAt}; Saved login reused: ${result.reused}`);
+            }
+        }
+        catch (error) {
+            failure =
+                error instanceof CapabilityError
+                    ? error
+                    : new CapabilityError("OIDC_LOGIN_FAILED", "Alibaba Cloud login failed. Try again; no credentials are included in this error.");
+        }
+        finally {
+            clearTimeout(timer);
+            process.removeListener("SIGINT", cancel);
+            process.removeListener("SIGTERM", cancel);
+        }
+        if (failure) {
+            if (flags.json)
+                this.log(JSON.stringify({ success: false, code: failure.code, error: failure.message }, null, 2));
+            else
+                this.logToStderr(`${failure.code}: ${failure.message}`);
+            this.exit(1);
+        }
+    }
+}

package/lib/features/auth/aliyun/factory.js

@@ -0,0 +1,3 @@
+import { OfficialCliSession } from "../../../adapters/aliyun/official-cli.js";
+export const createAliyunLoginService = () => new OfficialCliSession();
+export const createAliyunLogoutService = () => new OfficialCliSession();

package/lib/features/auth/aliyun/logout-command.js

@@ -0,0 +1,69 @@
+import { Command, Flags } from "@oclif/core";
+import { baseFlags } from "../../../lib/command-flags.js";
+import { CapabilityError } from "../../../core/result.js";
+import { createAliyunLogoutService } from "./factory.js";
+export default class AliyunLogout extends Command {
+    static summary = "Sign out of RKB's Alibaba Cloud identity session";
+    static description = `Revoke the saved Alibaba Cloud refresh token, then remove RKB's isolated official CLI credential file.
+If revocation fails, the saved login is retained for retry. Use --local to remove only local credentials, including a malformed record, without contacting Alibaba Cloud.
+This does not sign out the browser's Alibaba Cloud account or change other aliyun profiles. To change accounts, switch the account in your browser before running login again.`;
+    static examples = [
+        "<%= config.bin %> logout",
+        "<%= config.bin %> logout --json",
+        "<%= config.bin %> logout --local",
+    ];
+    static flags = {
+        ...baseFlags,
+        local: Flags.boolean({
+            description: "Remove only the local login without revoking Alibaba Cloud tokens",
+            default: false,
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(AliyunLogout);
+        const controller = new AbortController();
+        const cancel = () => controller.abort(new CapabilityError("OIDC_CANCELLED", "Logout was cancelled. Run logout again to complete cleanup."));
+        const timer = setTimeout(() => controller.abort(new CapabilityError("OIDC_TIMEOUT", "Logout timed out. Run logout again to complete cleanup.")), 30000);
+        process.once("SIGINT", cancel);
+        process.once("SIGTERM", cancel);
+        let failure;
+        try {
+            const result = await createAliyunLogoutService().logout({
+                local: flags.local,
+                signal: controller.signal,
+            });
+            if (flags.json)
+                this.log(JSON.stringify({ success: true, provider: "aliyun", ...result }, null, 2));
+            else {
+                this.log(result.cleared
+                    ? "RKB's saved Alibaba Cloud login was removed."
+                    : "No saved RKB login remains on this computer.");
+                if (result.revocation === "confirmed")
+                    this.log("Alibaba Cloud refresh token revocation confirmed.");
+                else if (result.revocation === "skipped")
+                    this.log("Local cleanup only; remote token revocation was skipped.");
+                else if (result.revocation === "no_refresh_token")
+                    this.log("No refresh token was saved; only local credentials were removed.");
+                this.log("Your browser's Alibaba Cloud sign-in remains active. Switch accounts there before logging in as another user.");
+            }
+        }
+        catch (error) {
+            failure =
+                error instanceof CapabilityError
+                    ? error
+                    : new CapabilityError("OIDC_LOGOUT_FAILED", "Logout could not be completed. Retry logout; no credentials are included in this error.");
+        }
+        finally {
+            clearTimeout(timer);
+            process.removeListener("SIGINT", cancel);
+            process.removeListener("SIGTERM", cancel);
+        }
+        if (failure) {
+            if (flags.json)
+                this.log(JSON.stringify({ success: false, code: failure.code, error: failure.message }, null, 2));
+            else
+                this.logToStderr(`${failure.code}: ${failure.message}`);
+            this.exit(1);
+        }
+    }
+}