sitevision-cli 1.0.0-beta.2 → 1.0.0-beta.21

package/dist/app.d.ts

@@ -2,5 +2,5 @@ import { type ProjectInfo } from './utils/project-detection.js';
 type Props = {
     project: ProjectInfo;
 };
-export default function App({ project }: Props): import("react").JSX.Element | null;
+export default function App({ project: initialProject }: Props): import("react").JSX.Element | null;
 export {};

package/dist/app.js

@@ -1,8 +1,10 @@
 import { jsx as _jsx } from "react/jsx-runtime";
-import { useMemo, useState } from 'react';
+import { useCallback, useMemo, useState } from 'react';
+import { detectProject } from './utils/project-detection.js';
 import { MainMenu } from './components/MainMenu.js';
 import { InfoScreen } from './components/InfoScreen.js';
 import { SetupFlow } from './components/SetupFlow.js';
+import { DevPropertiesForm } from './components/DevPropertiesForm.js';
 import { PasswordInput } from './components/PasswordInput.js';
 import { KeychainPasswordChoice } from './components/KeychainPasswordChoice.js';
 import { decideSigningStep } from './utils/signing-step.js';
@@ -12,7 +14,23 @@ import { DeployScreen } from './commands/deploy.js';
 import { SignScreen } from './commands/sign.js';
 import { SigningPropertiesForm } from './components/SigningPropertiesForm.js';
 import { getSigningPassword, setDeployPassword as saveDeployPassword, setSigningPassword as saveSigningPassword, } from './utils/keychain.js';
-export default function App({ project }) {
+const NONBASIC_DEV_UNSUPPORTED = '\x1b[33mdev/watch support only basic auth. Use `svc deploy` for OAuth2/cookie.\x1b[0m';
+export default function App({ project: initialProject }) {
+    // The project is loaded once at startup, but setup flows write new values to
+    // disk and the OS keychain. Hold it in state so we can re-detect after setup
+    // and pick up those changes (e.g. saved passwords) without restarting the CLI.
+    const [project, setProject] = useState(initialProject);
+    const reloadProject = useCallback(() => {
+        try {
+            const refreshed = detectProject(initialProject.root);
+            if (refreshed)
+                setProject(refreshed);
+        }
+        catch {
+            // Re-detection failed (e.g. manifest became unparseable mid-session) —
+            // keep the existing in-memory project rather than crashing.
+        }
+    }, [initialProject.root]);
     const [state, setState] = useState('setup');
     const [currentCommand, setCurrentCommand] = useState('');
     const [signingPassword, setSigningPassword] = useState('');
@@ -54,10 +72,18 @@ export default function App({ project }) {
     };
     // Check if dev password is available (either from file or session)
     const hasDevPassword = Boolean(project.devProperties?.password || devPassword);
+    // OAuth2 / cookie configs authenticate with a token or session resolved at
+    // deploy time, so they need no basic password. `svc dev`/`watch` stay basic.
+    const authMethod = project.devProperties?.authMethod ?? 'basic';
+    const isTokenAuth = authMethod === 'oauth2' || authMethod === 'cookie';
+    const deployAuthReady = isTokenAuth || hasDevPassword;
     // Get effective dev properties with session password if needed
     const getEffectiveDevProperties = () => {
         if (!project.devProperties)
             return undefined;
+        // Non-basic configs authenticate by token/cookie — never graft a password.
+        if (isTokenAuth)
+            return project.devProperties;
         if (project.devProperties.password)
             return project.devProperties;
         return { ...project.devProperties, password: devPassword };
@@ -110,11 +136,22 @@ export default function App({ project }) {
             case 'setup-signing':
                 setState('setup-signing');
                 break;
+            case 'change-auth':
+                if (!project.hasDevProperties || !project.devProperties) {
+                    console.log('\x1b[31mDevelopment properties not configured. Create a .dev_properties.json file first.\x1b[0m');
+                    return;
+                }
+                setState('change-auth-method');
+                break;
             case 'dev':
                 if (!project.hasDevProperties || !project.devProperties) {
                     console.log('\x1b[31mDevelopment properties not configured. Create a .dev_properties.json file first.\x1b[0m');
                     return;
                 }
+                if (isTokenAuth) {
+                    console.log(NONBASIC_DEV_UNSUPPORTED);
+                    return;
+                }
                 if (!hasDevPassword) {
                     setState('dev-password-input');
                 }
@@ -131,6 +168,10 @@ export default function App({ project }) {
                     console.log('\x1b[31mSigning credentials not configured. Run svc setup-signing first.\x1b[0m');
                     return;
                 }
+                if (isTokenAuth) {
+                    console.log(NONBASIC_DEV_UNSUPPORTED);
+                    return;
+                }
                 // Need both dev password and signing password
                 if (!hasDevPassword) {
                     setState('dev-password-input');
@@ -152,6 +193,10 @@ export default function App({ project }) {
                     console.log('\x1b[31mSigning credentials not configured. Run svc setup-signing first.\x1b[0m');
                     return;
                 }
+                if (isTokenAuth) {
+                    console.log(NONBASIC_DEV_UNSUPPORTED);
+                    return;
+                }
                 routeToSigningStep(command);
                 break;
             case 'sign':
@@ -175,7 +220,7 @@ export default function App({ project }) {
                     console.log('\x1b[31mDevelopment properties not configured. Create a .dev_properties.json file first.\x1b[0m');
                     return;
                 }
-                if (!hasDevPassword) {
+                if (!deployAuthReady) {
                     setState('dev-password-input');
                 }
                 else {
@@ -184,8 +229,14 @@ export default function App({ project }) {
                 break;
         }
     };
+    if (state === 'change-auth-method') {
+        return (_jsx(DevPropertiesForm, { projectRoot: project.root, initialProperties: project.devProperties, packageJson: project.packageJson, authOnly: true, onComplete: () => {
+                reloadProject();
+                setState('menu');
+            }, onCancel: () => setState('menu') }));
+    }
     if (state === 'setup') {
-        return _jsx(SetupFlow, { project: project, onComplete: () => setState('menu') });
+        return (_jsx(SetupFlow, { project: project, onReload: reloadProject, onComplete: () => setState('menu') }));
     }
     if (state === 'menu') {
         return _jsx(MainMenu, { project: project, onSelect: handleCommandSelect });
@@ -256,13 +307,13 @@ export default function App({ project }) {
                 if (project.devProperties)
                     project.devProperties.password = undefined;
                 setState('dev-password-input');
-            } }));
+            }, onChangeAuthMethod: () => setState('change-auth-method') }));
     }
     if (state === 'setup-signing') {
         return (_jsx(SigningPropertiesForm, { projectRoot: project.root, onComplete: () => {
-                // We can't easily update project info here without full reload,
-                // but since we are just returning to menu, it's fine.
-                // The user might need to restart CLI or we implement a reload mechanism.
+                // Re-detect so the newly written signing credentials are reflected
+                // in memory (hasSigningProperties, keychain password) without a restart.
+                reloadProject();
                 setState('menu');
             }, onCancel: () => setState('menu') }));
     }

package/dist/cli.js

@@ -1,22 +1,24 @@
 #!/usr/bin/env node
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
 import { render } from 'ink';
 import { Text, Box } from 'ink';
 import meow from 'meow';
 import { readFileSync } from 'node:fs';
-import App from './app.js';
+import { Shell } from './shell/Shell.js';
 import { getCommand } from './commands/index.js';
-import { requireProject, migrateLegacyPassword, } from './utils/project-detection.js';
+import { requireProject, detectProject, migrateLegacyPassword, } from './utils/project-detection.js';
+import { discoverApps } from './utils/workspace.js';
 import { promptYesNo } from './utils/password-prompt.js';
 import { checkForUpdate } from './utils/version-check.js';
-import { isFirstRun, markFirstRunComplete, getLastSeenVersion, setLastSeenVersion, } from './utils/config.js';
+import { isFirstRun, markFirstRunComplete, getLastSeenVersion, setLastSeenVersion, getSettings, } from './utils/config.js';
+import { setLanguage } from './utils/i18n.js';
 import { WelcomeScreen } from './components/WelcomeScreen.js';
 import { AnimatedLogo } from './components/AnimatedLogo.js';
 import { printBranding, BIG_LOGO, BIG_LOGO_WIDTH, SMALL_LOGO, SMALL_LOGO_WIDTH, } from './utils/branding.js';
 const pkg = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
 const cli = meow(`
 	Usage
-	  $ svc                    Start interactive menu
+	  $ svc                    Open the interactive shell (app or workspace)
 	  $ svc <command> [options]
 
 	Commands
@@ -28,11 +30,13 @@ const cli = meow(`
 	  info          Show project information
 
 	Options
+	  --minimal     Shell: compact layout for small terminals
 	  --help        Show this help message
 	  --version     Show version number
 
 	Examples
-	  $ svc                     # Interactive menu
+	  $ svc                     # Shell: run inside an app, or at the repo root
+	  $ svc --minimal           # Shell without the sidebar, for a small pane
 	  $ svc dev
 	  $ svc dev --signed
 	  $ svc watch
@@ -58,9 +62,21 @@ const cli = meow(`
             shortFlag: 'p',
             default: false,
         },
+        token: {
+            type: 'string',
+        },
+        cookie: {
+            type: 'string',
+        },
+        minimal: {
+            type: 'boolean',
+            default: false,
+        },
     },
 });
 const [commandName, ...args] = cli.input;
+const settings = getSettings();
+setLanguage(settings.language);
 const CYAN = '\x1b[36m';
 const BOLD = '\x1b[1m';
 const DIM = '\x1b[2m';
@@ -89,8 +105,12 @@ function printMasthead(version) {
         `${spaces(gap)}${DIM}${right}${RESET}${spaces(padding)}${CYAN}│${RESET}`);
     console.log(`${CYAN}╰${border}╯${RESET}`);
 }
+function fail(message, hint) {
+    render(_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsxs(Text, { color: "red", children: ["Error: ", message] }), _jsx(Text, { dimColor: true, children: hint })] }));
+    process.exit(1);
+}
 // Pick the widest wordmark that fits the terminal, or undefined if even the
-// compact one would wrap (caller then falls back to the static masthead).
+// compact one would wrap.
 function pickIntroArt(columns) {
     if (columns >= BIG_LOGO_WIDTH)
         return BIG_LOGO;
@@ -105,6 +125,26 @@ async function playIntro(art) {
         app.waitUntilExit().then(() => resolve(), () => resolve());
     });
 }
+// Run the full-screen shell on the alternate screen buffer so the scrollback
+// is untouched, and restore it on exit. The animated wordmark plays first,
+// inside the same buffer, when the terminal is wide enough for it.
+async function runShell(apps, workspaceRoot) {
+    process.stdout.write('\x1b[?1049h\x1b[H');
+    try {
+        const art = process.stdin.isTTY && settings.introAnimation && !cli.flags.minimal
+            ? pickIntroArt(process.stdout.columns ?? 0)
+            : undefined;
+        if (art) {
+            await playIntro(art);
+            process.stdout.write('\x1b[2J\x1b[H');
+        }
+        const app = render(_jsx(Shell, { apps: apps, workspaceRoot: workspaceRoot, version: pkg.version, minimal: cli.flags.minimal }));
+        await app.waitUntilExit();
+    }
+    finally {
+        process.stdout.write('\x1b[?1049l');
+    }
+}
 async function main() {
     // On the very first run we show a dedicated welcome screen instead of the
     // masthead, so the branding is the moment. Only when stdin is a TTY — the
@@ -116,19 +156,12 @@ async function main() {
     // silently rather than claiming an update happened.
     const lastSeen = getLastSeenVersion();
     const isUpdate = !firstRun && lastSeen !== undefined && lastSeen !== pkg.version;
-    // On the plain interactive `svc` (no command), play the animated wordmark
-    // instead of the static masthead — sized to the terminal. Only on a TTY so it
-    // doesn't run in CI / piped input.
-    const introEligible = !firstRun && !isUpdate && !commandName && Boolean(process.stdin.isTTY);
-    const introArt = introEligible
-        ? pickIntroArt(process.stdout.columns ?? 0)
-        : undefined;
     if (!firstRun) {
         if (isUpdate) {
             printBranding();
             console.log(`\x1b[32m\n  ✨ Updated to v${pkg.version}\x1b[0m \x1b[2m(from v${lastSeen})\x1b[0m\n`);
         }
-        else if (!introArt) {
+        else if (commandName) {
             printMasthead(pkg.version);
         }
         // Record the current version so the banner shows once per upgrade.
@@ -139,36 +172,61 @@ async function main() {
             console.log(`\x1b[33m  ↑ update available: ${pkg.version} → ${latestVersion}  (run: npm i -g ${pkg.name})\x1b[0m`);
         }
     }
+    // No command: the shell. Inside an app it is single-app mode; anywhere
+    // above one or more apps it is workspace mode.
+    if (!commandName) {
+        let project = null;
+        try {
+            project = detectProject();
+        }
+        catch (error) {
+            fail(error.message, 'Fix the manifest and try again');
+        }
+        if (!project) {
+            const apps = discoverApps(process.cwd());
+            if (apps.length === 0) {
+                fail('No Sitevision apps found here.', 'Run svc inside an app directory (manifest.json) or at the root of a repo that contains apps.');
+            }
+            await runShell(apps, process.cwd());
+            return;
+        }
+        if (firstRun) {
+            await new Promise(resolve => {
+                const app = render(_jsx(WelcomeScreen, { project: project, onComplete: () => {
+                        markFirstRunComplete();
+                        setLastSeenVersion(pkg.version);
+                        app.unmount();
+                    } }));
+                app.waitUntilExit().then(() => resolve(), () => resolve());
+            });
+        }
+        await runShell([project]);
+        return;
+    }
     // Check if we're in a Sitevision project
     const project = (() => {
         try {
             return requireProject();
         }
         catch (error) {
-            render(_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsxs(Text, { color: "red", children: ["Error: ", error.message] }), _jsx(Text, { dimColor: true, children: "Make sure you're in a Sitevision project directory" })] }));
-            process.exit(1);
+            return fail(error.message, "Make sure you're in a Sitevision project directory");
         }
     })();
-    // First run: show the welcome (branding + optional signing-password save),
-    // then continue to the normal flow once the user dismisses it.
-    if (firstRun) {
-        await new Promise(resolve => {
-            const app = render(_jsx(WelcomeScreen, { project: project, onComplete: () => {
-                    markFirstRunComplete();
-                    setLastSeenVersion(pkg.version);
-                    app.unmount();
-                } }));
-            app.waitUntilExit().then(() => resolve(), () => resolve());
-        });
-    }
-    // If no command, show interactive menu (with the animated intro first when
-    // the terminal can fit it).
-    if (!commandName) {
-        if (introArt) {
-            await playIntro(introArt);
+    // --token / --cookie override the resolved bearer token / session cookie for
+    // this run (manual / CI path, alongside SITEVISION_ACCESS_TOKEN and
+    // SITEVISION_SESSION_COOKIE).
+    if (cli.flags.token || cli.flags.cookie) {
+        if (project.devProperties) {
+            if (cli.flags.token) {
+                project.devProperties.accessToken = cli.flags.token;
+            }
+            if (cli.flags.cookie) {
+                project.devProperties.sessionCookie = cli.flags.cookie;
+            }
+        }
+        else {
+            console.log('\x1b[33m--token/--cookie needs a .dev_properties.json (domain, site, addon) to deploy against.\x1b[0m');
         }
-        render(_jsx(App, { project: project }));
-        return;
     }
     // Get the command
     const command = getCommand(commandName);
@@ -177,9 +235,8 @@ async function main() {
         process.exit(1);
     }
     // Offer to migrate a legacy plaintext password into the OS keychain.
-    // Interactive `svc` handles this in SetupFlow; this covers direct commands
-    // (svc deploy/dev/sign/…). Skip on non-TTY stdin (e.g. CI) where prompting
-    // would fail — the plaintext password is still used for this run.
+    // Skip on non-TTY stdin (e.g. CI) where prompting would fail — the
+    // plaintext password is still used for this run.
     if (project.hasLegacyPassword && process.stdin.isTTY) {
         console.log('\n\x1b[33m⚠ Plaintext password found in .dev_properties.json\x1b[0m');
         const move = await promptYesNo('Move it to the OS keychain and remove it from the file? (y/N): ');

package/dist/commands/build.js

@@ -87,7 +87,7 @@ export function BuildScreen({ projectRoot, manifest, createZip = true, onBack, }
                     const runner = new WebpackRunner(projectRoot, {
                         mode: 'production',
                         cssPrefix: manifest.id,
-                        restApp: appType === 'rest',
+                        restApp: appType !== 'web' && appType !== 'widget',
                     });
                     const result = await runner.run();
                     await runner.close();

package/dist/commands/deploy.d.ts

@@ -8,10 +8,10 @@ interface DeployScreenProps {
     force: boolean;
     production: boolean;
     activate: boolean;
-    signingPassword?: string;
     onBack?: () => void;
     onRetryCredentials?: () => void;
+    onChangeAuthMethod?: () => void;
 }
-export declare function DeployScreen({ projectRoot, manifest, devProperties, force, production, activate, signingPassword, onBack, onRetryCredentials, }: DeployScreenProps): React.JSX.Element;
+export declare function DeployScreen({ projectRoot, manifest, devProperties, force, production, activate, onBack, onRetryCredentials, onChangeAuthMethod, }: DeployScreenProps): React.JSX.Element;
 export declare const deployCommand: Command;
 export {};

package/dist/commands/deploy.js

@@ -6,26 +6,124 @@ import { deployApp, deployProduction } from '../utils/sitevision-api.js';
 import { getZipPath, getSignedZipPath, getAppType, } from '../utils/project-detection.js';
 import { zipExists } from '../utils/zip.js';
 import { promptPassword, promptYesNo } from '../utils/password-prompt.js';
-import { setDeployPassword } from '../utils/keychain.js';
-export function DeployScreen({ projectRoot, manifest, devProperties, force, production, activate, signingPassword, onBack, onRetryCredentials, }) {
+import { setDeployPassword, deleteSessionCookie, deleteOAuth2RefreshToken, } from '../utils/keychain.js';
+import { resolveOAuth2AccessToken } from '../utils/oauth2-auth.js';
+import { AuthLoginScreen } from '../components/AuthLoginScreen.js';
+export function DeployScreen({ projectRoot, manifest, devProperties, force, production, activate, onBack, onRetryCredentials, onChangeAuthMethod, }) {
     const [state, setState] = React.useState({
         status: 'deploying',
         message: production ? 'Deploying to production...' : 'Deploying to dev...',
     });
+    // 'init' resolves cached credentials, 'login' shows the Ink login screen,
+    // 'deploy' runs the upload. Token/cookie login now happens here, so both the
+    // TUI and the standalone command reach it.
+    const [phase, setPhase] = React.useState('init');
+    const [credential, setCredential] = React.useState({
+        accessToken: devProperties.accessToken,
+        sessionCookie: devProperties.sessionCookie,
+    });
+    const deployStartedRef = React.useRef(false);
+    const authMethod = devProperties.authMethod ?? 'basic';
+    // OAuth2 and cookie can re-authenticate in-place; basic re-prompts via the
+    // parent (TUI password entry).
+    const canRelogin = authMethod === 'oauth2' || authMethod === 'cookie';
+    // Discard the stored credential and force a fresh login. This is the
+    // "retry with new credentials" action for token/cookie auth — the usual fix
+    // when a session/token has expired (Sitevision reports that as a 400, not a
+    // 401, so it isn't auto-cleared).
+    const retryWithFreshLogin = () => {
+        const { domain, username } = devProperties;
+        if (authMethod === 'cookie' && domain && username) {
+            deleteSessionCookie(domain, username);
+            devProperties.sessionCookie = undefined;
+        }
+        else if (authMethod === 'oauth2' &&
+            domain &&
+            devProperties.oauth2?.clientId) {
+            deleteOAuth2RefreshToken(domain, devProperties.oauth2.clientId);
+            devProperties.accessToken = undefined;
+        }
+        setCredential({});
+        deployStartedRef.current = false;
+        setState({
+            status: 'deploying',
+            message: production
+                ? 'Deploying to production...'
+                : 'Deploying to dev...',
+        });
+        setPhase('login');
+    };
     useInput((input, key) => {
         if (state.status !== 'deploying') {
             if (onBack && (key.escape || input === 'q')) {
                 onBack();
             }
-            if (onRetryCredentials && state.status === 'error' && input === 'r') {
-                onRetryCredentials();
+            if (state.status === 'error' && input === 'r') {
+                if (canRelogin) {
+                    retryWithFreshLogin();
+                }
+                else if (onRetryCredentials) {
+                    onRetryCredentials();
+                }
+            }
+            if (state.status === 'error' && input === 'm' && onChangeAuthMethod) {
+                onChangeAuthMethod();
             }
         }
     });
+    // Decide once whether we can deploy straight away or must log in first.
+    React.useEffect(() => {
+        if (authMethod === 'basic' || devProperties.sessionCookie) {
+            setPhase('deploy');
+            return;
+        }
+        if (authMethod === 'cookie') {
+            // env/keychain cookie is already loaded in devProperties; none here.
+            setPhase('login');
+            return;
+        }
+        if (authMethod === 'oauth2') {
+            if (devProperties.accessToken) {
+                setPhase('deploy');
+                return;
+            }
+            void (async () => {
+                const token = await resolveOAuth2AccessToken(devProperties);
+                if (token) {
+                    setCredential({ accessToken: token });
+                    setPhase('deploy');
+                }
+                else {
+                    setPhase('login');
+                }
+            })();
+            return;
+        }
+        setPhase('deploy');
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, []);
     React.useEffect(() => {
+        if (phase !== 'deploy' || deployStartedRef.current)
+            return;
+        deployStartedRef.current = true;
         async function runDeploy() {
             try {
                 const appType = getAppType(manifest);
+                // Credential resolved in the init effect / login screen.
+                const { accessToken, sessionCookie } = credential;
+                // A stale session fails without a clean 401 — clear the stored cookie
+                // so the next run re-authenticates. Skip when SITEVISION_SESSION_COOKIE
+                // is set: detection re-reads it first, so clearing would just replay
+                // the same dead cookie in a loop.
+                const clearStaleCookie = (result) => {
+                    if (result.authExpired &&
+                        authMethod === 'cookie' &&
+                        !process.env['SITEVISION_SESSION_COOKIE'] &&
+                        devProperties.domain &&
+                        devProperties.username) {
+                        deleteSessionCookie(devProperties.domain, devProperties.username);
+                    }
+                };
                 if (production) {
                     // Production deployment requires a signed zip
                     const signedZipPath = getSignedZipPath(projectRoot, manifest);
@@ -42,11 +140,14 @@ export function DeployScreen({ projectRoot, manifest, devProperties, force, prod
                         addonName: devProperties.addonName,
                         username: devProperties.username,
                         password: devProperties.password,
+                        accessToken,
+                        sessionCookie,
                         useHTTP: devProperties.useHTTPForDevDeploy,
                         activate,
                     };
                     const result = await deployProduction(signedZipPath, config, appType);
                     if (!result.success) {
+                        clearStaleCookie(result);
                         setState({
                             status: 'error',
                             error: result.error || 'Deployment failed',
@@ -75,10 +176,13 @@ export function DeployScreen({ projectRoot, manifest, devProperties, force, prod
                         addonName: devProperties.addonName,
                         username: devProperties.username,
                         password: devProperties.password,
+                        accessToken,
+                        sessionCookie,
                         useHTTP: devProperties.useHTTPForDevDeploy,
                     };
                     const result = await deployApp(zipPath, config, appType, force);
                     if (!result.success) {
+                        clearStaleCookie(result);
                         setState({
                             status: 'error',
                             error: result.error || 'Deployment failed',
@@ -100,20 +204,30 @@ export function DeployScreen({ projectRoot, manifest, devProperties, force, prod
             }
         }
         runDeploy();
-    }, [
-        projectRoot,
-        manifest,
-        devProperties,
-        force,
-        production,
-        activate,
-        signingPassword,
-    ]);
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [phase]);
+    if (phase === 'login' && state.status !== 'error') {
+        return (_jsx(AuthLoginScreen, { method: (devProperties.authMethod ?? 'basic') === 'cookie'
+                ? 'cookie'
+                : 'oauth2', devProperties: devProperties, onComplete: cred => {
+                setCredential(cred);
+                setPhase('deploy');
+            }, onError: message => {
+                setState({ status: 'error', error: message });
+            }, onCancel: () => {
+                if (onBack) {
+                    onBack();
+                }
+                else {
+                    setState({ status: 'error', error: 'Login cancelled.' });
+                }
+            } }));
+    }
     return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(StatusIndicator, { status: state.status === 'deploying' ? 'running' : state.status, label: state.status === 'deploying'
                         ? 'Deploying'
                         : state.status === 'success'
                             ? 'Deployed'
-                            : 'Failed', message: state.message }) }), state.status === 'success' && (_jsxs(Box, { flexDirection: "column", marginLeft: 2, children: [_jsxs(Text, { color: "green", children: [production ? 'Production deployment' : 'Dev deployment', " complete"] }), state.executableId && (_jsxs(Text, { dimColor: true, children: ["Executable ID: ", state.executableId] })), force && _jsx(Text, { dimColor: true, children: "(Force mode - overwrote existing)" }), activate && production && _jsx(Text, { dimColor: true, children: "(Activated)" })] })), state.status === 'error' && state.error && (_jsx(Box, { flexDirection: "column", marginTop: 1, children: _jsx(Text, { color: "red", children: state.error }) })), state.status !== 'deploying' && (_jsxs(Box, { marginTop: 1, flexDirection: "column", children: [state.status === 'error' && onRetryCredentials && (_jsx(Text, { dimColor: true, children: "Press r to retry with new credentials" })), onBack && _jsx(Text, { dimColor: true, children: "Press q or Esc to return to menu" })] }))] }));
+                            : 'Failed', message: state.message }) }), state.status === 'success' && (_jsxs(Box, { flexDirection: "column", marginLeft: 2, children: [_jsxs(Text, { color: "green", children: [production ? 'Production deployment' : 'Dev deployment', " complete"] }), state.executableId && (_jsxs(Text, { dimColor: true, children: ["Executable ID: ", state.executableId] })), force && _jsx(Text, { dimColor: true, children: "(Force mode - overwrote existing)" }), activate && production && _jsx(Text, { dimColor: true, children: "(Activated)" })] })), state.status === 'error' && state.error && (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsx(Text, { color: "red", children: state.error }), canRelogin && (_jsx(Text, { color: "yellow", children: "This can happen when your session or token has expired \u2014 log in again to get fresh credentials." }))] })), state.status !== 'deploying' && (_jsxs(Box, { marginTop: 1, flexDirection: "column", children: [state.status === 'error' && canRelogin && (_jsx(Text, { dimColor: true, children: "Press r to log in again with fresh credentials" })), state.status === 'error' && !canRelogin && onRetryCredentials && (_jsx(Text, { dimColor: true, children: "Press r to retry with new credentials" })), state.status === 'error' && onChangeAuthMethod && (_jsx(Text, { dimColor: true, children: "Press m to change auth method" })), onBack && _jsx(Text, { dimColor: true, children: "Press q or Esc to return to menu" })] }))] }));
 }
 export const deployCommand = {
     name: 'deploy',
@@ -146,8 +260,11 @@ export const deployCommand = {
             console.log('Create a .dev_properties.json file with domain, siteName, addonName, and username, then run setup.\n');
             return;
         }
-        // Resolve deploy password (already loaded from keychain/env in detectProject — prompt if missing)
-        if (!project.devProperties.password) {
+        // Basic auth prompts for a password here; OAuth2 and cookie resolve or log
+        // in inside DeployScreen (Ink-native), so both the TUI and this command
+        // share one login path. env/--flag token/cookie are already loaded.
+        const authMethod = project.devProperties.authMethod ?? 'basic';
+        if (authMethod === 'basic' && !project.devProperties.password) {
             const { domain, username } = project.devProperties;
             console.log('');
             const password = await promptPassword(`Deploy password for ${username}@${domain}: `);
@@ -164,15 +281,8 @@ export const deployCommand = {
         const production = Boolean(flags['production']);
         const force = Boolean(flags['force']);
         const activate = Boolean(flags['activate']);
-        // For production, we need the signed zip, which requires signing credentials
-        let signingPassword;
-        if (production &&
-            project.hasSigningProperties &&
-            project.devProperties.signingUsername) {
-            // We already have a signed zip, no need to prompt for password here
-            // The sign command should have been run separately
-        }
-        const { waitUntilExit } = render(_jsx(DeployScreen, { projectRoot: project.root, manifest: project.manifest, devProperties: project.devProperties, force: force, production: production, activate: activate, signingPassword: signingPassword }));
+        // Production deploys use the already-signed zip; `sign` is run separately.
+        const { waitUntilExit } = render(_jsx(DeployScreen, { projectRoot: project.root, manifest: project.manifest, devProperties: project.devProperties, force: force, production: production, activate: activate }));
         await waitUntilExit();
     },
 };