sitevision-cli 1.0.0-beta.1 → 1.0.0-beta.11

package/dist/app.d.ts

@@ -2,5 +2,5 @@ import { type ProjectInfo } from './utils/project-detection.js';
 type Props = {
     project: ProjectInfo;
 };
-export default function App({ project }: Props): import("react").JSX.Element | null;
+export default function App({ project: initialProject }: Props): import("react").JSX.Element | null;
 export {};

package/dist/app.js

@@ -1,8 +1,10 @@
 import { jsx as _jsx } from "react/jsx-runtime";
-import { useMemo, useState } from 'react';
+import { useCallback, useMemo, useState } from 'react';
+import { detectProject } from './utils/project-detection.js';
 import { MainMenu } from './components/MainMenu.js';
 import { InfoScreen } from './components/InfoScreen.js';
 import { SetupFlow } from './components/SetupFlow.js';
+import { DevPropertiesForm } from './components/DevPropertiesForm.js';
 import { PasswordInput } from './components/PasswordInput.js';
 import { KeychainPasswordChoice } from './components/KeychainPasswordChoice.js';
 import { decideSigningStep } from './utils/signing-step.js';
@@ -12,7 +14,23 @@ import { DeployScreen } from './commands/deploy.js';
 import { SignScreen } from './commands/sign.js';
 import { SigningPropertiesForm } from './components/SigningPropertiesForm.js';
 import { getSigningPassword, setDeployPassword as saveDeployPassword, setSigningPassword as saveSigningPassword, } from './utils/keychain.js';
-export default function App({ project }) {
+const NONBASIC_DEV_UNSUPPORTED = '\x1b[33mdev/watch support only basic auth. Use `svc deploy` for OAuth2/cookie.\x1b[0m';
+export default function App({ project: initialProject }) {
+    // The project is loaded once at startup, but setup flows write new values to
+    // disk and the OS keychain. Hold it in state so we can re-detect after setup
+    // and pick up those changes (e.g. saved passwords) without restarting the CLI.
+    const [project, setProject] = useState(initialProject);
+    const reloadProject = useCallback(() => {
+        try {
+            const refreshed = detectProject(initialProject.root);
+            if (refreshed)
+                setProject(refreshed);
+        }
+        catch {
+            // Re-detection failed (e.g. manifest became unparseable mid-session) —
+            // keep the existing in-memory project rather than crashing.
+        }
+    }, [initialProject.root]);
     const [state, setState] = useState('setup');
     const [currentCommand, setCurrentCommand] = useState('');
     const [signingPassword, setSigningPassword] = useState('');
@@ -54,10 +72,18 @@ export default function App({ project }) {
     };
     // Check if dev password is available (either from file or session)
     const hasDevPassword = Boolean(project.devProperties?.password || devPassword);
+    // OAuth2 / cookie configs authenticate with a token or session resolved at
+    // deploy time, so they need no basic password. `svc dev`/`watch` stay basic.
+    const authMethod = project.devProperties?.authMethod ?? 'basic';
+    const isTokenAuth = authMethod === 'oauth2' || authMethod === 'cookie';
+    const deployAuthReady = isTokenAuth || hasDevPassword;
     // Get effective dev properties with session password if needed
     const getEffectiveDevProperties = () => {
         if (!project.devProperties)
             return undefined;
+        // Non-basic configs authenticate by token/cookie — never graft a password.
+        if (isTokenAuth)
+            return project.devProperties;
         if (project.devProperties.password)
             return project.devProperties;
         return { ...project.devProperties, password: devPassword };
@@ -110,11 +136,22 @@ export default function App({ project }) {
             case 'setup-signing':
                 setState('setup-signing');
                 break;
+            case 'change-auth':
+                if (!project.hasDevProperties || !project.devProperties) {
+                    console.log('\x1b[31mDevelopment properties not configured. Create a .dev_properties.json file first.\x1b[0m');
+                    return;
+                }
+                setState('change-auth-method');
+                break;
             case 'dev':
                 if (!project.hasDevProperties || !project.devProperties) {
                     console.log('\x1b[31mDevelopment properties not configured. Create a .dev_properties.json file first.\x1b[0m');
                     return;
                 }
+                if (isTokenAuth) {
+                    console.log(NONBASIC_DEV_UNSUPPORTED);
+                    return;
+                }
                 if (!hasDevPassword) {
                     setState('dev-password-input');
                 }
@@ -131,6 +168,10 @@ export default function App({ project }) {
                     console.log('\x1b[31mSigning credentials not configured. Run svc setup-signing first.\x1b[0m');
                     return;
                 }
+                if (isTokenAuth) {
+                    console.log(NONBASIC_DEV_UNSUPPORTED);
+                    return;
+                }
                 // Need both dev password and signing password
                 if (!hasDevPassword) {
                     setState('dev-password-input');
@@ -152,6 +193,10 @@ export default function App({ project }) {
                     console.log('\x1b[31mSigning credentials not configured. Run svc setup-signing first.\x1b[0m');
                     return;
                 }
+                if (isTokenAuth) {
+                    console.log(NONBASIC_DEV_UNSUPPORTED);
+                    return;
+                }
                 routeToSigningStep(command);
                 break;
             case 'sign':
@@ -175,7 +220,7 @@ export default function App({ project }) {
                     console.log('\x1b[31mDevelopment properties not configured. Create a .dev_properties.json file first.\x1b[0m');
                     return;
                 }
-                if (!hasDevPassword) {
+                if (!deployAuthReady) {
                     setState('dev-password-input');
                 }
                 else {
@@ -184,8 +229,14 @@ export default function App({ project }) {
                 break;
         }
     };
+    if (state === 'change-auth-method') {
+        return (_jsx(DevPropertiesForm, { projectRoot: project.root, initialProperties: project.devProperties, packageJson: project.packageJson, authOnly: true, onComplete: () => {
+                reloadProject();
+                setState('menu');
+            }, onCancel: () => setState('menu') }));
+    }
     if (state === 'setup') {
-        return _jsx(SetupFlow, { project: project, onComplete: () => setState('menu') });
+        return (_jsx(SetupFlow, { project: project, onReload: reloadProject, onComplete: () => setState('menu') }));
     }
     if (state === 'menu') {
         return _jsx(MainMenu, { project: project, onSelect: handleCommandSelect });
@@ -256,13 +307,13 @@ export default function App({ project }) {
                 if (project.devProperties)
                     project.devProperties.password = undefined;
                 setState('dev-password-input');
-            } }));
+            }, onChangeAuthMethod: () => setState('change-auth-method') }));
     }
     if (state === 'setup-signing') {
         return (_jsx(SigningPropertiesForm, { projectRoot: project.root, onComplete: () => {
-                // We can't easily update project info here without full reload,
-                // but since we are just returning to menu, it's fine.
-                // The user might need to restart CLI or we implement a reload mechanism.
+                // Re-detect so the newly written signing credentials are reflected
+                // in memory (hasSigningProperties, keychain password) without a restart.
+                reloadProject();
                 setState('menu');
             }, onCancel: () => setState('menu') }));
     }

package/dist/cli.js

@@ -58,6 +58,12 @@ const cli = meow(`
             shortFlag: 'p',
             default: false,
         },
+        token: {
+            type: 'string',
+        },
+        cookie: {
+            type: 'string',
+        },
     },
 });
 const [commandName, ...args] = cli.input;
@@ -149,6 +155,22 @@ async function main() {
             process.exit(1);
         }
     })();
+    // --token / --cookie override the resolved bearer token / session cookie for
+    // this run (manual / CI path, alongside SITEVISION_ACCESS_TOKEN and
+    // SITEVISION_SESSION_COOKIE).
+    if (cli.flags.token || cli.flags.cookie) {
+        if (project.devProperties) {
+            if (cli.flags.token) {
+                project.devProperties.accessToken = cli.flags.token;
+            }
+            if (cli.flags.cookie) {
+                project.devProperties.sessionCookie = cli.flags.cookie;
+            }
+        }
+        else {
+            console.log('\x1b[33m--token/--cookie needs a .dev_properties.json (domain, site, addon) to deploy against.\x1b[0m');
+        }
+    }
     // First run: show the welcome (branding + optional signing-password save),
     // then continue to the normal flow once the user dismisses it.
     if (firstRun) {

package/dist/commands/deploy.d.ts

@@ -8,10 +8,10 @@ interface DeployScreenProps {
     force: boolean;
     production: boolean;
     activate: boolean;
-    signingPassword?: string;
     onBack?: () => void;
     onRetryCredentials?: () => void;
+    onChangeAuthMethod?: () => void;
 }
-export declare function DeployScreen({ projectRoot, manifest, devProperties, force, production, activate, signingPassword, onBack, onRetryCredentials, }: DeployScreenProps): React.JSX.Element;
+export declare function DeployScreen({ projectRoot, manifest, devProperties, force, production, activate, onBack, onRetryCredentials, onChangeAuthMethod, }: DeployScreenProps): React.JSX.Element;
 export declare const deployCommand: Command;
 export {};

package/dist/commands/deploy.js

@@ -6,26 +6,124 @@ import { deployApp, deployProduction } from '../utils/sitevision-api.js';
 import { getZipPath, getSignedZipPath, getAppType, } from '../utils/project-detection.js';
 import { zipExists } from '../utils/zip.js';
 import { promptPassword, promptYesNo } from '../utils/password-prompt.js';
-import { setDeployPassword } from '../utils/keychain.js';
-export function DeployScreen({ projectRoot, manifest, devProperties, force, production, activate, signingPassword, onBack, onRetryCredentials, }) {
+import { setDeployPassword, deleteSessionCookie, deleteOAuth2RefreshToken, } from '../utils/keychain.js';
+import { resolveOAuth2AccessToken } from '../utils/oauth2-auth.js';
+import { AuthLoginScreen } from '../components/AuthLoginScreen.js';
+export function DeployScreen({ projectRoot, manifest, devProperties, force, production, activate, onBack, onRetryCredentials, onChangeAuthMethod, }) {
     const [state, setState] = React.useState({
         status: 'deploying',
         message: production ? 'Deploying to production...' : 'Deploying to dev...',
     });
+    // 'init' resolves cached credentials, 'login' shows the Ink login screen,
+    // 'deploy' runs the upload. Token/cookie login now happens here, so both the
+    // TUI and the standalone command reach it.
+    const [phase, setPhase] = React.useState('init');
+    const [credential, setCredential] = React.useState({
+        accessToken: devProperties.accessToken,
+        sessionCookie: devProperties.sessionCookie,
+    });
+    const deployStartedRef = React.useRef(false);
+    const authMethod = devProperties.authMethod ?? 'basic';
+    // OAuth2 and cookie can re-authenticate in-place; basic re-prompts via the
+    // parent (TUI password entry).
+    const canRelogin = authMethod === 'oauth2' || authMethod === 'cookie';
+    // Discard the stored credential and force a fresh login. This is the
+    // "retry with new credentials" action for token/cookie auth — the usual fix
+    // when a session/token has expired (Sitevision reports that as a 400, not a
+    // 401, so it isn't auto-cleared).
+    const retryWithFreshLogin = () => {
+        const { domain, username } = devProperties;
+        if (authMethod === 'cookie' && domain && username) {
+            deleteSessionCookie(domain, username);
+            devProperties.sessionCookie = undefined;
+        }
+        else if (authMethod === 'oauth2' &&
+            domain &&
+            devProperties.oauth2?.clientId) {
+            deleteOAuth2RefreshToken(domain, devProperties.oauth2.clientId);
+            devProperties.accessToken = undefined;
+        }
+        setCredential({});
+        deployStartedRef.current = false;
+        setState({
+            status: 'deploying',
+            message: production
+                ? 'Deploying to production...'
+                : 'Deploying to dev...',
+        });
+        setPhase('login');
+    };
     useInput((input, key) => {
         if (state.status !== 'deploying') {
             if (onBack && (key.escape || input === 'q')) {
                 onBack();
             }
-            if (onRetryCredentials && state.status === 'error' && input === 'r') {
-                onRetryCredentials();
+            if (state.status === 'error' && input === 'r') {
+                if (canRelogin) {
+                    retryWithFreshLogin();
+                }
+                else if (onRetryCredentials) {
+                    onRetryCredentials();
+                }
+            }
+            if (state.status === 'error' && input === 'm' && onChangeAuthMethod) {
+                onChangeAuthMethod();
             }
         }
     });
+    // Decide once whether we can deploy straight away or must log in first.
+    React.useEffect(() => {
+        if (authMethod === 'basic' || devProperties.sessionCookie) {
+            setPhase('deploy');
+            return;
+        }
+        if (authMethod === 'cookie') {
+            // env/keychain cookie is already loaded in devProperties; none here.
+            setPhase('login');
+            return;
+        }
+        if (authMethod === 'oauth2') {
+            if (devProperties.accessToken) {
+                setPhase('deploy');
+                return;
+            }
+            void (async () => {
+                const token = await resolveOAuth2AccessToken(devProperties);
+                if (token) {
+                    setCredential({ accessToken: token });
+                    setPhase('deploy');
+                }
+                else {
+                    setPhase('login');
+                }
+            })();
+            return;
+        }
+        setPhase('deploy');
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, []);
     React.useEffect(() => {
+        if (phase !== 'deploy' || deployStartedRef.current)
+            return;
+        deployStartedRef.current = true;
         async function runDeploy() {
             try {
                 const appType = getAppType(manifest);
+                // Credential resolved in the init effect / login screen.
+                const { accessToken, sessionCookie } = credential;
+                // A stale session fails without a clean 401 — clear the stored cookie
+                // so the next run re-authenticates. Skip when SITEVISION_SESSION_COOKIE
+                // is set: detection re-reads it first, so clearing would just replay
+                // the same dead cookie in a loop.
+                const clearStaleCookie = (result) => {
+                    if (result.authExpired &&
+                        authMethod === 'cookie' &&
+                        !process.env['SITEVISION_SESSION_COOKIE'] &&
+                        devProperties.domain &&
+                        devProperties.username) {
+                        deleteSessionCookie(devProperties.domain, devProperties.username);
+                    }
+                };
                 if (production) {
                     // Production deployment requires a signed zip
                     const signedZipPath = getSignedZipPath(projectRoot, manifest);
@@ -42,11 +140,14 @@ export function DeployScreen({ projectRoot, manifest, devProperties, force, prod
                         addonName: devProperties.addonName,
                         username: devProperties.username,
                         password: devProperties.password,
+                        accessToken,
+                        sessionCookie,
                         useHTTP: devProperties.useHTTPForDevDeploy,
                         activate,
                     };
                     const result = await deployProduction(signedZipPath, config, appType);
                     if (!result.success) {
+                        clearStaleCookie(result);
                         setState({
                             status: 'error',
                             error: result.error || 'Deployment failed',
@@ -75,10 +176,13 @@ export function DeployScreen({ projectRoot, manifest, devProperties, force, prod
                         addonName: devProperties.addonName,
                         username: devProperties.username,
                         password: devProperties.password,
+                        accessToken,
+                        sessionCookie,
                         useHTTP: devProperties.useHTTPForDevDeploy,
                     };
                     const result = await deployApp(zipPath, config, appType, force);
                     if (!result.success) {
+                        clearStaleCookie(result);
                         setState({
                             status: 'error',
                             error: result.error || 'Deployment failed',
@@ -100,20 +204,30 @@ export function DeployScreen({ projectRoot, manifest, devProperties, force, prod
             }
         }
         runDeploy();
-    }, [
-        projectRoot,
-        manifest,
-        devProperties,
-        force,
-        production,
-        activate,
-        signingPassword,
-    ]);
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [phase]);
+    if (phase === 'login' && state.status !== 'error') {
+        return (_jsx(AuthLoginScreen, { method: (devProperties.authMethod ?? 'basic') === 'cookie'
+                ? 'cookie'
+                : 'oauth2', devProperties: devProperties, onComplete: cred => {
+                setCredential(cred);
+                setPhase('deploy');
+            }, onError: message => {
+                setState({ status: 'error', error: message });
+            }, onCancel: () => {
+                if (onBack) {
+                    onBack();
+                }
+                else {
+                    setState({ status: 'error', error: 'Login cancelled.' });
+                }
+            } }));
+    }
     return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(StatusIndicator, { status: state.status === 'deploying' ? 'running' : state.status, label: state.status === 'deploying'
                         ? 'Deploying'
                         : state.status === 'success'
                             ? 'Deployed'
-                            : 'Failed', message: state.message }) }), state.status === 'success' && (_jsxs(Box, { flexDirection: "column", marginLeft: 2, children: [_jsxs(Text, { color: "green", children: [production ? 'Production deployment' : 'Dev deployment', " complete"] }), state.executableId && (_jsxs(Text, { dimColor: true, children: ["Executable ID: ", state.executableId] })), force && _jsx(Text, { dimColor: true, children: "(Force mode - overwrote existing)" }), activate && production && _jsx(Text, { dimColor: true, children: "(Activated)" })] })), state.status === 'error' && state.error && (_jsx(Box, { flexDirection: "column", marginTop: 1, children: _jsx(Text, { color: "red", children: state.error }) })), state.status !== 'deploying' && (_jsxs(Box, { marginTop: 1, flexDirection: "column", children: [state.status === 'error' && onRetryCredentials && (_jsx(Text, { dimColor: true, children: "Press r to retry with new credentials" })), onBack && _jsx(Text, { dimColor: true, children: "Press q or Esc to return to menu" })] }))] }));
+                            : 'Failed', message: state.message }) }), state.status === 'success' && (_jsxs(Box, { flexDirection: "column", marginLeft: 2, children: [_jsxs(Text, { color: "green", children: [production ? 'Production deployment' : 'Dev deployment', " complete"] }), state.executableId && (_jsxs(Text, { dimColor: true, children: ["Executable ID: ", state.executableId] })), force && _jsx(Text, { dimColor: true, children: "(Force mode - overwrote existing)" }), activate && production && _jsx(Text, { dimColor: true, children: "(Activated)" })] })), state.status === 'error' && state.error && (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsx(Text, { color: "red", children: state.error }), canRelogin && (_jsx(Text, { color: "yellow", children: "This can happen when your session or token has expired \u2014 log in again to get fresh credentials." }))] })), state.status !== 'deploying' && (_jsxs(Box, { marginTop: 1, flexDirection: "column", children: [state.status === 'error' && canRelogin && (_jsx(Text, { dimColor: true, children: "Press r to log in again with fresh credentials" })), state.status === 'error' && !canRelogin && onRetryCredentials && (_jsx(Text, { dimColor: true, children: "Press r to retry with new credentials" })), state.status === 'error' && onChangeAuthMethod && (_jsx(Text, { dimColor: true, children: "Press m to change auth method" })), onBack && _jsx(Text, { dimColor: true, children: "Press q or Esc to return to menu" })] }))] }));
 }
 export const deployCommand = {
     name: 'deploy',
@@ -146,8 +260,11 @@ export const deployCommand = {
             console.log('Create a .dev_properties.json file with domain, siteName, addonName, and username, then run setup.\n');
             return;
         }
-        // Resolve deploy password (already loaded from keychain/env in detectProject — prompt if missing)
-        if (!project.devProperties.password) {
+        // Basic auth prompts for a password here; OAuth2 and cookie resolve or log
+        // in inside DeployScreen (Ink-native), so both the TUI and this command
+        // share one login path. env/--flag token/cookie are already loaded.
+        const authMethod = project.devProperties.authMethod ?? 'basic';
+        if (authMethod === 'basic' && !project.devProperties.password) {
             const { domain, username } = project.devProperties;
             console.log('');
             const password = await promptPassword(`Deploy password for ${username}@${domain}: `);
@@ -164,15 +281,8 @@ export const deployCommand = {
         const production = Boolean(flags['production']);
         const force = Boolean(flags['force']);
         const activate = Boolean(flags['activate']);
-        // For production, we need the signed zip, which requires signing credentials
-        let signingPassword;
-        if (production &&
-            project.hasSigningProperties &&
-            project.devProperties.signingUsername) {
-            // We already have a signed zip, no need to prompt for password here
-            // The sign command should have been run separately
-        }
-        const { waitUntilExit } = render(_jsx(DeployScreen, { projectRoot: project.root, manifest: project.manifest, devProperties: project.devProperties, force: force, production: production, activate: activate, signingPassword: signingPassword }));
+        // Production deploys use the already-signed zip; `sign` is run separately.
+        const { waitUntilExit } = render(_jsx(DeployScreen, { projectRoot: project.root, manifest: project.manifest, devProperties: project.devProperties, force: force, production: production, activate: activate }));
         await waitUntilExit();
     },
 };

package/dist/commands/dev.js

@@ -11,9 +11,10 @@ import { signApp, deployApp } from '../utils/sitevision-api.js';
 import { setDeployPassword } from '../utils/keychain.js';
 import { resolveSigningPassword } from '../utils/signing-password.js';
 import { copyStaticToBuild, createBuildZip, cleanBuild } from '../utils/zip.js';
-import { isBundledApp, getAppType, getFullAppId, getZipPath, getSignedZipPath, } from '../utils/project-detection.js';
+import { isBundledApp, getAppType, getFullAppId, getZipPath, getSignedZipPath, localizedText, readManifest, } from '../utils/project-detection.js';
 export function DevScreen({ projectRoot, manifest, devProperties, signed, deploy = true, signingCredentials, onBack, onRetryCredentials, }) {
     const { exit } = useApp();
+    const [version, setVersion] = React.useState(manifest.version);
     const [state, setState] = React.useState({
         status: 'initializing',
         message: 'Starting webpack watch...',
@@ -34,6 +35,16 @@ export function DevScreen({ projectRoot, manifest, devProperties, signed, deploy
     const isBuildingRef = React.useRef(false);
     const pendingRebuildRef = React.useRef(false);
     // Sign (if needed) and deploy an already-built zip, updating UI state.
+    const refreshVersion = React.useCallback(() => {
+        try {
+            const fresh = readManifest(projectRoot)?.manifest.version;
+            if (fresh)
+                setVersion(fresh);
+        }
+        catch {
+            // keep last known version
+        }
+    }, [projectRoot]);
     const signAndDeploy = React.useCallback(async (zipPath, buildTime) => {
         try {
             let deployZipPath = zipPath;
@@ -57,6 +68,7 @@ export function DevScreen({ projectRoot, manifest, devProperties, signed, deploy
                 }
                 deployZipPath = signedZipPath;
             }
+            refreshVersion();
             // Watch/build-only mode: stop after building (and signing).
             if (!deploy || !devProperties) {
                 setState(prev => ({
@@ -113,7 +125,15 @@ export function DevScreen({ projectRoot, manifest, devProperties, signed, deploy
                 error: error instanceof Error ? error.message : String(error),
             }));
         }
-    }, [projectRoot, manifest, devProperties, signed, deploy, signingCredentials]);
+    }, [
+        projectRoot,
+        manifest,
+        devProperties,
+        signed,
+        deploy,
+        signingCredentials,
+        refreshVersion,
+    ]);
     // In-house webpack path: copy static, zip, then sign + deploy.
     const handleBuildComplete = React.useCallback(async (result) => {
         if (!result.success) {
@@ -353,7 +373,7 @@ export function DevScreen({ projectRoot, manifest, devProperties, signed, deploy
     };
     return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(StatusIndicator, { status: getStatusType(), label: getStatusLabel(), message: state.message }) }), state.warning && (_jsx(Box, { marginBottom: 1, children: _jsxs(Text, { color: "yellow", children: ["\u26A0 ", state.warning] }) })), state.buildCount > 0 && (_jsx(Box, { marginLeft: 2, marginBottom: 1, children: _jsxs(Text, { dimColor: true, children: ["Builds: ", state.buildCount, state.lastBuildTime
                             ? ` | Last build: ${state.lastBuildTime}ms`
-                            : '', signed ? ' | Signed mode' : ''] }) })), _jsx(Box, { marginLeft: 2, marginBottom: 1, children: _jsxs(Text, { dimColor: true, children: [manifest.name, " v", manifest.version] }) }), deploy && devProperties && (_jsx(Box, { marginLeft: 2, marginBottom: 1, children: _jsxs(Text, { dimColor: true, children: ["Target: ", devProperties.domain, "/", devProperties.siteName, "/", devProperties.addonName] }) })), state.status === 'error' && state.error && (_jsx(Box, { flexDirection: "column", marginTop: 1, children: _jsx(Text, { color: "red", children: state.error }) })), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [state.status === 'error' && onRetryCredentials && (_jsx(Text, { dimColor: true, children: "Press r to retry with new credentials" })), onBack ? (_jsx(Text, { dimColor: true, children: "Press q or Esc to return to menu (Ctrl+C to stop process)" })) : (_jsx(Text, { dimColor: true, children: "Press Ctrl+C to stop" }))] })] }));
+                            : '', signed ? ' | Signed mode' : ''] }) })), _jsx(Box, { marginLeft: 2, marginBottom: 1, children: _jsxs(Text, { dimColor: true, children: [localizedText(manifest.name), " v", version] }) }), deploy && devProperties && (_jsx(Box, { marginLeft: 2, marginBottom: 1, children: _jsxs(Text, { dimColor: true, children: ["Target: ", devProperties.domain, "/", devProperties.siteName, "/", devProperties.addonName] }) })), state.status === 'error' && state.error && (_jsx(Box, { flexDirection: "column", marginTop: 1, children: _jsx(Text, { color: "red", children: state.error }) })), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [state.status === 'error' && onRetryCredentials && (_jsx(Text, { dimColor: true, children: "Press r to retry with new credentials" })), onBack ? (_jsx(Text, { dimColor: true, children: "Press q or Esc to return to menu (Ctrl+C to stop process)" })) : (_jsx(Text, { dimColor: true, children: "Press Ctrl+C to stop" }))] })] }));
 }
 export const devCommand = {
     name: 'dev',
@@ -374,6 +394,12 @@ export const devCommand = {
             console.log('Create a .dev_properties.json file with domain, siteName, addonName, and username, then run setup.\n');
             return;
         }
+        // dev/watch continuously redeploy and only support basic auth. Fail clearly
+        // on an OAuth2/cookie config instead of prompting for an unusable password.
+        if ((project.devProperties.authMethod ?? 'basic') !== 'basic') {
+            console.log('\n\x1b[33mdev/watch support only basic auth. Use `svc deploy` for OAuth2/cookie.\x1b[0m\n');
+            return;
+        }
         // Resolve deploy password (already loaded from keychain/env in detectProject — prompt if missing)
         if (!project.devProperties.password) {
             const { domain, username } = project.devProperties;

package/dist/commands/info.js

@@ -1,10 +1,10 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { render } from 'ink';
 import { Box, Text } from 'ink';
-import { getAppType } from '../utils/project-detection.js';
+import { getAppType, localizedText } from '../utils/project-detection.js';
 function InfoScreen({ project }) {
     const appType = getAppType(project.manifest);
-    return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(Text, { bold: true, color: "cyan", children: "Sitevision Project Information" }) }), _jsxs(Box, { flexDirection: "column", marginLeft: 2, children: [_jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Name: " }), _jsx(Text, { children: project.manifest.name })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "ID: " }), _jsx(Text, { children: project.manifest.id })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Version: " }), _jsx(Text, { children: project.manifest.version })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Type: " }), _jsx(Text, { color: "green", children: project.manifest.type }), _jsxs(Text, { dimColor: true, children: [" (", appType, ")"] })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Bundled: " }), _jsx(Text, { children: project.manifest.bundled ? 'Yes' : 'No' })] })] }), project.hasDevProperties && project.devProperties && (_jsxs(_Fragment, { children: [_jsx(Box, { marginTop: 1, marginBottom: 1, children: _jsx(Text, { bold: true, color: "cyan", children: "Development Configuration" }) }), _jsxs(Box, { flexDirection: "column", marginLeft: 2, children: [_jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Domain: " }), _jsx(Text, { children: project.devProperties.domain })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Site: " }), _jsx(Text, { children: project.devProperties.siteName })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Addon: " }), _jsx(Text, { children: project.devProperties.addonName })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Username: " }), _jsx(Text, { children: project.devProperties.username })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Use HTTP: " }), _jsx(Text, { children: project.devProperties.useHTTPForDevDeploy ? 'Yes' : 'No' })] })] })] })), !project.hasDevProperties && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: "yellow", children: ["\u26A0 No dev properties found. Run", ' ', _jsx(Text, { bold: true, children: "setup-dev-properties" }), " to configure."] }) })), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { bold: true, children: "Project Root: " }), _jsx(Text, { dimColor: true, children: project.root })] })] }));
+    return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(Text, { bold: true, color: "cyan", children: "Sitevision Project Information" }) }), _jsxs(Box, { flexDirection: "column", marginLeft: 2, children: [_jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Name: " }), _jsx(Text, { children: localizedText(project.manifest.name) })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "ID: " }), _jsx(Text, { children: project.manifest.id })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Version: " }), _jsx(Text, { children: project.manifest.version })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Type: " }), _jsx(Text, { color: "green", children: project.manifest.type }), _jsxs(Text, { dimColor: true, children: [" (", appType, ")"] })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Bundled: " }), _jsx(Text, { children: project.manifest.bundled ? 'Yes' : 'No' })] })] }), project.hasDevProperties && project.devProperties && (_jsxs(_Fragment, { children: [_jsx(Box, { marginTop: 1, marginBottom: 1, children: _jsx(Text, { bold: true, color: "cyan", children: "Development Configuration" }) }), _jsxs(Box, { flexDirection: "column", marginLeft: 2, children: [_jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Domain: " }), _jsx(Text, { children: project.devProperties.domain })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Site: " }), _jsx(Text, { children: project.devProperties.siteName })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Addon: " }), _jsx(Text, { children: project.devProperties.addonName })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Username: " }), _jsx(Text, { children: project.devProperties.username })] }), _jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Use HTTP: " }), _jsx(Text, { children: project.devProperties.useHTTPForDevDeploy ? 'Yes' : 'No' })] })] })] })), !project.hasDevProperties && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { color: "yellow", children: ["\u26A0 No dev properties found. Run", ' ', _jsx(Text, { bold: true, children: "setup-dev-properties" }), " to configure."] }) })), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { bold: true, children: "Project Root: " }), _jsx(Text, { dimColor: true, children: project.root })] })] }));
 }
 export const infoCommand = {
     name: 'info',

package/dist/components/AuthLoginScreen.d.ts

@@ -0,0 +1,21 @@
+import React from 'react';
+import type { DevProperties } from '../types/index.js';
+interface Credential {
+    accessToken?: string;
+    sessionCookie?: string;
+}
+interface Props {
+    method: 'oauth2' | 'cookie';
+    devProperties: DevProperties;
+    onComplete: (credential: Credential) => void;
+    onError: (message: string) => void;
+    onCancel: () => void;
+}
+/**
+ * Ink-native interactive login for OAuth2 and session-cookie auth. Drives the
+ * browser and (for cookie) the "press Enter to capture" handoff through Ink's
+ * own input, so it works inside the TUI as well as the standalone command —
+ * neither needs to own raw stdin the way the old console prompt did.
+ */
+export declare function AuthLoginScreen({ method, devProperties, onComplete, onError, onCancel, }: Props): React.JSX.Element;
+export {};

package/dist/components/AuthLoginScreen.js

@@ -0,0 +1,87 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import React from 'react';
+import { Box, Text, useInput } from 'ink';
+import Spinner from 'ink-spinner';
+import { beginOAuth2Login, openBrowser } from '../utils/oauth2-auth.js';
+import { beginCookieLogin, } from '../utils/session-cookie-auth.js';
+/**
+ * Ink-native interactive login for OAuth2 and session-cookie auth. Drives the
+ * browser and (for cookie) the "press Enter to capture" handoff through Ink's
+ * own input, so it works inside the TUI as well as the standalone command —
+ * neither needs to own raw stdin the way the old console prompt did.
+ */
+export function AuthLoginScreen({ method, devProperties, onComplete, onError, onCancel, }) {
+    const [phase, setPhase] = React.useState('starting');
+    const [authUrl, setAuthUrl] = React.useState('');
+    const [note, setNote] = React.useState('');
+    const cookieRef = React.useRef(null);
+    const cancelOAuthRef = React.useRef(null);
+    React.useEffect(() => {
+        void (async () => {
+            if (method === 'oauth2') {
+                const session = beginOAuth2Login(devProperties);
+                if (!session) {
+                    onError('OAuth2 is not fully configured (authorization/token endpoint or client ID missing).');
+                    return;
+                }
+                cancelOAuthRef.current = session.cancel;
+                setAuthUrl(session.authUrl);
+                openBrowser(session.authUrl);
+                setPhase('awaiting');
+                const token = await session.complete();
+                cancelOAuthRef.current = null;
+                if (token) {
+                    onComplete({ accessToken: token });
+                }
+                else {
+                    onError('OAuth2 login failed, timed out, or was rejected.');
+                }
+            }
+            else {
+                const session = await beginCookieLogin(devProperties);
+                if (!session) {
+                    onError('Could not open a login browser (is Chrome installed?). Set SITEVISION_SESSION_COOKIE or pass --cookie with a cookie copied from your browser.');
+                    return;
+                }
+                cookieRef.current = session;
+                setPhase('awaiting');
+            }
+        })();
+        // Release resources if the screen unmounts before completing: close the
+        // browser (cookie) and the loopback server (oauth2, frees the port).
+        return () => {
+            void cookieRef.current?.close();
+            cookieRef.current = null;
+            cancelOAuthRef.current?.();
+            cancelOAuthRef.current = null;
+        };
+        // Run once: the parent mounts this fresh when a login is needed.
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, []);
+    useInput((_input, key) => {
+        if (key.escape) {
+            onCancel();
+            return;
+        }
+        if (method === 'cookie' && phase === 'awaiting' && key.return) {
+            const session = cookieRef.current;
+            if (!session)
+                return;
+            setPhase('capturing');
+            void (async () => {
+                const result = await session.capture();
+                if (result.cookie) {
+                    cookieRef.current = null;
+                    await session.close();
+                    onComplete({ sessionCookie: result.cookie });
+                }
+                else {
+                    // Keep the browser open so the user can navigate and retry.
+                    setNote(result.error ?? 'No session cookie found.');
+                    setPhase('awaiting');
+                }
+            })();
+        }
+    });
+    return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(Text, { bold: true, color: "cyan", children: method === 'oauth2' ? 'OAuth2 login' : 'Session cookie login' }) }), method === 'oauth2' ? (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: "green", children: _jsx(Spinner, { type: "dots" }) }), _jsx(Text, { children: " Waiting for you to finish login in the browser\u2026" })] }), authUrl && (_jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { dimColor: true, children: "If the browser didn't open, visit:" }), _jsx(Text, { children: authUrl })] }))] })) : (_jsxs(Box, { flexDirection: "column", children: [phase === 'starting' && (_jsxs(Box, { children: [_jsx(Text, { color: "green", children: _jsx(Spinner, { type: "dots" }) }), _jsx(Text, { children: " Opening browser\u2026" })] })), phase === 'awaiting' && (_jsx(Text, { children: "Log in in the opened browser, then press Enter to capture the session." })), phase === 'capturing' && (_jsxs(Box, { children: [_jsx(Text, { color: "green", children: _jsx(Spinner, { type: "dots" }) }), _jsx(Text, { children: " Capturing session\u2026" })] })), note && (_jsx(Box, { marginTop: 1, children: _jsx(Text, { color: "yellow", children: note }) }))] })), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: "Press Esc to cancel." }) })] }));
+}