sitevision-cli 1.0.0-beta.4 → 1.0.0-beta.6

package/dist/app.js

@@ -13,6 +13,7 @@ import { DeployScreen } from './commands/deploy.js';
 import { SignScreen } from './commands/sign.js';
 import { SigningPropertiesForm } from './components/SigningPropertiesForm.js';
 import { getSigningPassword, setDeployPassword as saveDeployPassword, setSigningPassword as saveSigningPassword, } from './utils/keychain.js';
+const NONBASIC_DEV_UNSUPPORTED = '\x1b[33mdev/watch support only basic auth. Use `svc deploy` for OAuth2/cookie.\x1b[0m';
 export default function App({ project: initialProject }) {
     // The project is loaded once at startup, but setup flows write new values to
     // disk and the OS keychain. Hold it in state so we can re-detect after setup
@@ -70,10 +71,18 @@ export default function App({ project: initialProject }) {
     };
     // Check if dev password is available (either from file or session)
     const hasDevPassword = Boolean(project.devProperties?.password || devPassword);
+    // OAuth2 / cookie configs authenticate with a token or session resolved at
+    // deploy time, so they need no basic password. `svc dev`/`watch` stay basic.
+    const authMethod = project.devProperties?.authMethod ?? 'basic';
+    const isTokenAuth = authMethod === 'oauth2' || authMethod === 'cookie';
+    const deployAuthReady = isTokenAuth || hasDevPassword;
     // Get effective dev properties with session password if needed
     const getEffectiveDevProperties = () => {
         if (!project.devProperties)
             return undefined;
+        // Non-basic configs authenticate by token/cookie — never graft a password.
+        if (isTokenAuth)
+            return project.devProperties;
         if (project.devProperties.password)
             return project.devProperties;
         return { ...project.devProperties, password: devPassword };
@@ -131,6 +140,10 @@ export default function App({ project: initialProject }) {
                     console.log('\x1b[31mDevelopment properties not configured. Create a .dev_properties.json file first.\x1b[0m');
                     return;
                 }
+                if (isTokenAuth) {
+                    console.log(NONBASIC_DEV_UNSUPPORTED);
+                    return;
+                }
                 if (!hasDevPassword) {
                     setState('dev-password-input');
                 }
@@ -147,6 +160,10 @@ export default function App({ project: initialProject }) {
                     console.log('\x1b[31mSigning credentials not configured. Run svc setup-signing first.\x1b[0m');
                     return;
                 }
+                if (isTokenAuth) {
+                    console.log(NONBASIC_DEV_UNSUPPORTED);
+                    return;
+                }
                 // Need both dev password and signing password
                 if (!hasDevPassword) {
                     setState('dev-password-input');
@@ -168,6 +185,10 @@ export default function App({ project: initialProject }) {
                     console.log('\x1b[31mSigning credentials not configured. Run svc setup-signing first.\x1b[0m');
                     return;
                 }
+                if (isTokenAuth) {
+                    console.log(NONBASIC_DEV_UNSUPPORTED);
+                    return;
+                }
                 routeToSigningStep(command);
                 break;
             case 'sign':
@@ -191,7 +212,7 @@ export default function App({ project: initialProject }) {
                     console.log('\x1b[31mDevelopment properties not configured. Create a .dev_properties.json file first.\x1b[0m');
                     return;
                 }
-                if (!hasDevPassword) {
+                if (!deployAuthReady) {
                     setState('dev-password-input');
                 }
                 else {

package/dist/cli.js

@@ -58,6 +58,12 @@ const cli = meow(`
             shortFlag: 'p',
             default: false,
         },
+        token: {
+            type: 'string',
+        },
+        cookie: {
+            type: 'string',
+        },
     },
 });
 const [commandName, ...args] = cli.input;
@@ -149,6 +155,22 @@ async function main() {
             process.exit(1);
         }
     })();
+    // --token / --cookie override the resolved bearer token / session cookie for
+    // this run (manual / CI path, alongside SITEVISION_ACCESS_TOKEN and
+    // SITEVISION_SESSION_COOKIE).
+    if (cli.flags.token || cli.flags.cookie) {
+        if (project.devProperties) {
+            if (cli.flags.token) {
+                project.devProperties.accessToken = cli.flags.token;
+            }
+            if (cli.flags.cookie) {
+                project.devProperties.sessionCookie = cli.flags.cookie;
+            }
+        }
+        else {
+            console.log('\x1b[33m--token/--cookie needs a .dev_properties.json (domain, site, addon) to deploy against.\x1b[0m');
+        }
+    }
     // First run: show the welcome (branding + optional signing-password save),
     // then continue to the normal flow once the user dismisses it.
     if (firstRun) {

package/dist/commands/deploy.js

@@ -6,7 +6,9 @@ import { deployApp, deployProduction } from '../utils/sitevision-api.js';
 import { getZipPath, getSignedZipPath, getAppType, } from '../utils/project-detection.js';
 import { zipExists } from '../utils/zip.js';
 import { promptPassword, promptYesNo } from '../utils/password-prompt.js';
-import { setDeployPassword } from '../utils/keychain.js';
+import { setDeployPassword, deleteSessionCookie } from '../utils/keychain.js';
+import { resolveOAuth2AccessToken } from '../utils/oauth2-auth.js';
+import { resolveSessionCookie } from '../utils/session-cookie-auth.js';
 export function DeployScreen({ projectRoot, manifest, devProperties, force, production, activate, signingPassword, onBack, onRetryCredentials, }) {
     const [state, setState] = React.useState({
         status: 'deploying',
@@ -26,6 +28,52 @@ export function DeployScreen({ projectRoot, manifest, devProperties, force, prod
         async function runDeploy() {
             try {
                 const appType = getAppType(manifest);
+                // Resolve an OAuth2 token silently (env/keychain refresh). A fresh
+                // browser login happens only in the direct `svc deploy` command, which
+                // sets accessToken before rendering — the Ink menu can't own the
+                // terminal for a login, so it resolves refresh-only here.
+                const authMethod = devProperties.authMethod ?? 'basic';
+                let accessToken = devProperties.accessToken;
+                if (authMethod === 'oauth2' && !accessToken) {
+                    accessToken =
+                        (await resolveOAuth2AccessToken(devProperties, {
+                            interactive: false,
+                        })) ?? undefined;
+                    if (!accessToken) {
+                        setState({
+                            status: 'error',
+                            error: 'No OAuth2 access token. Run `svc deploy` from a terminal to log in, or set SITEVISION_ACCESS_TOKEN.',
+                        });
+                        return;
+                    }
+                }
+                let sessionCookie = devProperties.sessionCookie;
+                if (authMethod === 'cookie' && !sessionCookie) {
+                    sessionCookie =
+                        (await resolveSessionCookie(devProperties, {
+                            interactive: false,
+                        })) ?? undefined;
+                    if (!sessionCookie) {
+                        setState({
+                            status: 'error',
+                            error: 'No session cookie. Run `svc deploy` from a terminal to log in, or set SITEVISION_SESSION_COOKIE.',
+                        });
+                        return;
+                    }
+                }
+                // A stale session fails without a clean 401 — clear the stored cookie
+                // so the next run re-authenticates. Skip when SITEVISION_SESSION_COOKIE
+                // is set: detection re-reads it first, so clearing would just replay
+                // the same dead cookie in a loop.
+                const clearStaleCookie = (result) => {
+                    if (result.authExpired &&
+                        authMethod === 'cookie' &&
+                        !process.env['SITEVISION_SESSION_COOKIE'] &&
+                        devProperties.domain &&
+                        devProperties.username) {
+                        deleteSessionCookie(devProperties.domain, devProperties.username);
+                    }
+                };
                 if (production) {
                     // Production deployment requires a signed zip
                     const signedZipPath = getSignedZipPath(projectRoot, manifest);
@@ -42,11 +90,14 @@ export function DeployScreen({ projectRoot, manifest, devProperties, force, prod
                         addonName: devProperties.addonName,
                         username: devProperties.username,
                         password: devProperties.password,
+                        accessToken,
+                        sessionCookie,
                         useHTTP: devProperties.useHTTPForDevDeploy,
                         activate,
                     };
                     const result = await deployProduction(signedZipPath, config, appType);
                     if (!result.success) {
+                        clearStaleCookie(result);
                         setState({
                             status: 'error',
                             error: result.error || 'Deployment failed',
@@ -75,10 +126,13 @@ export function DeployScreen({ projectRoot, manifest, devProperties, force, prod
                         addonName: devProperties.addonName,
                         username: devProperties.username,
                         password: devProperties.password,
+                        accessToken,
+                        sessionCookie,
                         useHTTP: devProperties.useHTTPForDevDeploy,
                     };
                     const result = await deployApp(zipPath, config, appType, force);
                     if (!result.success) {
+                        clearStaleCookie(result);
                         setState({
                             status: 'error',
                             error: result.error || 'Deployment failed',
@@ -146,8 +200,32 @@ export const deployCommand = {
             console.log('Create a .dev_properties.json file with domain, siteName, addonName, and username, then run setup.\n');
             return;
         }
-        // Resolve deploy password (already loaded from keychain/env in detectProject — prompt if missing)
-        if (!project.devProperties.password) {
+        // Resolve deploy credentials. A token/cookie from env/--flag (already
+        // loaded in detectProject / cli) short-circuits everything.
+        const authMethod = project.devProperties.authMethod ?? 'basic';
+        if (project.devProperties.accessToken ||
+            project.devProperties.sessionCookie) {
+            // Nothing to acquire — a bearer token or session cookie is in hand.
+        }
+        else if (authMethod === 'oauth2') {
+            const token = await resolveOAuth2AccessToken(project.devProperties);
+            if (!token) {
+                console.log('\n\x1b[31mError: No OAuth2 access token available.\x1b[0m');
+                console.log('Set SITEVISION_ACCESS_TOKEN, pass --token, or configure the oauth2 endpoints in .dev_properties.json to log in.\n');
+                return;
+            }
+            project.devProperties.accessToken = token;
+        }
+        else if (authMethod === 'cookie') {
+            const cookie = await resolveSessionCookie(project.devProperties);
+            if (!cookie) {
+                console.log('\n\x1b[31mError: No session cookie available.\x1b[0m');
+                console.log('Log in when the browser opens, or set SITEVISION_SESSION_COOKIE / pass --cookie.\n');
+                return;
+            }
+            project.devProperties.sessionCookie = cookie;
+        }
+        else if (!project.devProperties.password) {
             const { domain, username } = project.devProperties;
             console.log('');
             const password = await promptPassword(`Deploy password for ${username}@${domain}: `);

package/dist/commands/dev.js

@@ -11,9 +11,10 @@ import { signApp, deployApp } from '../utils/sitevision-api.js';
 import { setDeployPassword } from '../utils/keychain.js';
 import { resolveSigningPassword } from '../utils/signing-password.js';
 import { copyStaticToBuild, createBuildZip, cleanBuild } from '../utils/zip.js';
-import { isBundledApp, getAppType, getFullAppId, getZipPath, getSignedZipPath, localizedText, } from '../utils/project-detection.js';
+import { isBundledApp, getAppType, getFullAppId, getZipPath, getSignedZipPath, localizedText, readManifest, } from '../utils/project-detection.js';
 export function DevScreen({ projectRoot, manifest, devProperties, signed, deploy = true, signingCredentials, onBack, onRetryCredentials, }) {
     const { exit } = useApp();
+    const [version, setVersion] = React.useState(manifest.version);
     const [state, setState] = React.useState({
         status: 'initializing',
         message: 'Starting webpack watch...',
@@ -34,6 +35,16 @@ export function DevScreen({ projectRoot, manifest, devProperties, signed, deploy
     const isBuildingRef = React.useRef(false);
     const pendingRebuildRef = React.useRef(false);
     // Sign (if needed) and deploy an already-built zip, updating UI state.
+    const refreshVersion = React.useCallback(() => {
+        try {
+            const fresh = readManifest(projectRoot)?.manifest.version;
+            if (fresh)
+                setVersion(fresh);
+        }
+        catch {
+            // keep last known version
+        }
+    }, [projectRoot]);
     const signAndDeploy = React.useCallback(async (zipPath, buildTime) => {
         try {
             let deployZipPath = zipPath;
@@ -57,6 +68,7 @@ export function DevScreen({ projectRoot, manifest, devProperties, signed, deploy
                 }
                 deployZipPath = signedZipPath;
             }
+            refreshVersion();
             // Watch/build-only mode: stop after building (and signing).
             if (!deploy || !devProperties) {
                 setState(prev => ({
@@ -113,7 +125,15 @@ export function DevScreen({ projectRoot, manifest, devProperties, signed, deploy
                 error: error instanceof Error ? error.message : String(error),
             }));
         }
-    }, [projectRoot, manifest, devProperties, signed, deploy, signingCredentials]);
+    }, [
+        projectRoot,
+        manifest,
+        devProperties,
+        signed,
+        deploy,
+        signingCredentials,
+        refreshVersion,
+    ]);
     // In-house webpack path: copy static, zip, then sign + deploy.
     const handleBuildComplete = React.useCallback(async (result) => {
         if (!result.success) {
@@ -353,7 +373,7 @@ export function DevScreen({ projectRoot, manifest, devProperties, signed, deploy
     };
     return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(StatusIndicator, { status: getStatusType(), label: getStatusLabel(), message: state.message }) }), state.warning && (_jsx(Box, { marginBottom: 1, children: _jsxs(Text, { color: "yellow", children: ["\u26A0 ", state.warning] }) })), state.buildCount > 0 && (_jsx(Box, { marginLeft: 2, marginBottom: 1, children: _jsxs(Text, { dimColor: true, children: ["Builds: ", state.buildCount, state.lastBuildTime
                             ? ` | Last build: ${state.lastBuildTime}ms`
-                            : '', signed ? ' | Signed mode' : ''] }) })), _jsx(Box, { marginLeft: 2, marginBottom: 1, children: _jsxs(Text, { dimColor: true, children: [localizedText(manifest.name), " v", manifest.version] }) }), deploy && devProperties && (_jsx(Box, { marginLeft: 2, marginBottom: 1, children: _jsxs(Text, { dimColor: true, children: ["Target: ", devProperties.domain, "/", devProperties.siteName, "/", devProperties.addonName] }) })), state.status === 'error' && state.error && (_jsx(Box, { flexDirection: "column", marginTop: 1, children: _jsx(Text, { color: "red", children: state.error }) })), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [state.status === 'error' && onRetryCredentials && (_jsx(Text, { dimColor: true, children: "Press r to retry with new credentials" })), onBack ? (_jsx(Text, { dimColor: true, children: "Press q or Esc to return to menu (Ctrl+C to stop process)" })) : (_jsx(Text, { dimColor: true, children: "Press Ctrl+C to stop" }))] })] }));
+                            : '', signed ? ' | Signed mode' : ''] }) })), _jsx(Box, { marginLeft: 2, marginBottom: 1, children: _jsxs(Text, { dimColor: true, children: [localizedText(manifest.name), " v", version] }) }), deploy && devProperties && (_jsx(Box, { marginLeft: 2, marginBottom: 1, children: _jsxs(Text, { dimColor: true, children: ["Target: ", devProperties.domain, "/", devProperties.siteName, "/", devProperties.addonName] }) })), state.status === 'error' && state.error && (_jsx(Box, { flexDirection: "column", marginTop: 1, children: _jsx(Text, { color: "red", children: state.error }) })), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [state.status === 'error' && onRetryCredentials && (_jsx(Text, { dimColor: true, children: "Press r to retry with new credentials" })), onBack ? (_jsx(Text, { dimColor: true, children: "Press q or Esc to return to menu (Ctrl+C to stop process)" })) : (_jsx(Text, { dimColor: true, children: "Press Ctrl+C to stop" }))] })] }));
 }
 export const devCommand = {
     name: 'dev',
@@ -374,6 +394,12 @@ export const devCommand = {
             console.log('Create a .dev_properties.json file with domain, siteName, addonName, and username, then run setup.\n');
             return;
         }
+        // dev/watch continuously redeploy and only support basic auth. Fail clearly
+        // on an OAuth2/cookie config instead of prompting for an unusable password.
+        if ((project.devProperties.authMethod ?? 'basic') !== 'basic') {
+            console.log('\n\x1b[33mdev/watch support only basic auth. Use `svc deploy` for OAuth2/cookie.\x1b[0m\n');
+            return;
+        }
         // Resolve deploy password (already loaded from keychain/env in detectProject — prompt if missing)
         if (!project.devProperties.password) {
             const { domain, username } = project.devProperties;

package/dist/components/DevPropertiesForm.js

@@ -3,15 +3,35 @@ import { useState } from 'react';
 import { Box, Text, useInput } from 'ink';
 import { TextInput } from './TextInput.js';
 import { writeDevProperties } from '../utils/project-detection.js';
-import { setDeployPassword, deleteDeployPassword } from '../utils/keychain.js';
-const STEPS = [
-    { id: 'domain', label: 'Domain' },
-    { id: 'siteName', label: 'Site Name' },
-    { id: 'addonName', label: 'Addon Name' },
-    { id: 'username', label: 'Username' },
-    { id: 'password', label: 'Password' },
-    { id: 'useHTTP', label: 'Use HTTP' },
+import { setDeployPassword, deleteDeployPassword, setOAuth2ClientSecret, } from '../utils/keychain.js';
+import { DEFAULT_REDIRECT_PORT } from '../utils/oauth2-auth.js';
+const LABELS = {
+    domain: 'Domain',
+    siteName: 'Site Name',
+    addonName: 'Addon Name',
+    username: 'Username',
+    authMethod: 'Auth Method',
+    password: 'Password',
+    oauthClientId: 'Client ID',
+    oauthAuthEndpoint: 'Authorization Endpoint',
+    oauthTokenEndpoint: 'Token Endpoint',
+    oauthScopes: 'Scopes',
+    oauthClientSecret: 'Client Secret',
+    sessionLoginUrl: 'Login URL',
+    useHTTP: 'Use HTTP',
+};
+const AUTH_METHODS = [
+    { value: 'basic', label: 'Basic auth (username + password)' },
+    { value: 'oauth2', label: 'OAuth2 bearer token (PKCE)' },
+    { value: 'cookie', label: 'Session cookie (SAML / SSO login)' },
 ];
+function parseScopes(raw) {
+    const scopes = raw
+        .split(/[\s,]+/)
+        .map(s => s.trim())
+        .filter(Boolean);
+    return scopes.length > 0 ? scopes : undefined;
+}
 export function DevPropertiesForm({ projectRoot, initialProperties, packageJson, onComplete, onCancel, }) {
     const [stepIndex, setStepIndex] = useState(0);
     const [properties, setProperties] = useState(() => {
@@ -19,49 +39,158 @@ export function DevPropertiesForm({ projectRoot, initialProperties, packageJson,
             domain: packageJson.developmentDomain || '',
             addonName: packageJson.addonName || '',
             siteName: packageJson.siteName || '',
+            authMethod: 'basic',
         };
         return { ...defaults, ...initialProperties };
     });
-    const currentStep = STEPS[stepIndex];
-    const handleNext = (key, value) => {
-        const newProperties = { ...properties, [key]: value };
-        setProperties(newProperties);
-        if (stepIndex < STEPS.length - 1) {
+    const [oauth, setOauth] = useState(() => ({
+        authorizationEndpoint: initialProperties?.oauth2?.authorizationEndpoint ?? '',
+        tokenEndpoint: initialProperties?.oauth2?.tokenEndpoint ?? '',
+        clientId: initialProperties?.oauth2?.clientId ?? '',
+        scopes: initialProperties?.oauth2?.scopes?.join(' ') ?? '',
+        clientSecret: '',
+    }));
+    const method = properties.authMethod ?? 'basic';
+    const isOAuth = method === 'oauth2';
+    const methodSteps = method === 'oauth2'
+        ? [
+            'oauthClientId',
+            'oauthAuthEndpoint',
+            'oauthTokenEndpoint',
+            'oauthScopes',
+            'oauthClientSecret',
+        ]
+        : method === 'cookie'
+            ? ['sessionLoginUrl']
+            : ['password'];
+    const steps = [
+        'domain',
+        'siteName',
+        'addonName',
+        'username',
+        'authMethod',
+        ...methodSteps,
+        'useHTTP',
+    ];
+    const currentStep = steps[stepIndex];
+    const redirectPort = initialProperties?.oauth2?.redirectPort ?? DEFAULT_REDIRECT_PORT;
+    const advance = () => {
+        if (stepIndex < steps.length - 1) {
             setStepIndex(stepIndex + 1);
         }
-        else {
-            const finalProperties = newProperties;
-            const { password, domain, username } = finalProperties;
-            if (password && domain && username) {
-                setDeployPassword(domain, username, password);
+    };
+    const finalize = (props, fields) => {
+        const authMethod = props.authMethod ?? 'basic';
+        const domain = props.domain ?? '';
+        const username = props.username ?? '';
+        const finalProps = {
+            domain,
+            siteName: props.siteName ?? '',
+            addonName: props.addonName ?? '',
+            username,
+            authMethod,
+            useHTTPForDevDeploy: props.useHTTPForDevDeploy ?? false,
+        };
+        if (authMethod === 'oauth2') {
+            finalProps.oauth2 = {
+                authorizationEndpoint: fields.authorizationEndpoint,
+                tokenEndpoint: fields.tokenEndpoint,
+                clientId: fields.clientId,
+                scopes: parseScopes(fields.scopes),
+                ...(initialProperties?.oauth2?.redirectPort && {
+                    redirectPort: initialProperties.oauth2.redirectPort,
+                }),
+            };
+            if (fields.clientSecret && domain && fields.clientId) {
+                setOAuth2ClientSecret(domain, fields.clientId, fields.clientSecret);
             }
-            else if (domain && username) {
-                // Empty password — clear any stale keychain entry so deploy falls through to prompt
-                deleteDeployPassword(domain, username);
+        }
+        else if (authMethod === 'cookie') {
+            if (props.sessionLoginUrl) {
+                finalProps.sessionLoginUrl = props.sessionLoginUrl;
             }
-            writeDevProperties(projectRoot, finalProperties);
-            onComplete();
+        }
+        else if (props.password && domain && username) {
+            setDeployPassword(domain, username, props.password);
+        }
+        else if (domain && username) {
+            // Empty password — clear any stale keychain entry so deploy prompts.
+            deleteDeployPassword(domain, username);
+        }
+        writeDevProperties(projectRoot, finalProps);
+        onComplete();
+    };
+    // Update a top-level DevProperties field, then advance or finalize.
+    const submitProperty = (key, value) => {
+        const next = { ...properties, [key]: value };
+        setProperties(next);
+        if (steps[stepIndex] === steps[steps.length - 1]) {
+            finalize(next, oauth);
+        }
+        else {
+            advance();
+        }
+    };
+    // Update an OAuth field, then advance or finalize.
+    const submitOAuth = (key, value) => {
+        const next = { ...oauth, [key]: value };
+        setOauth(next);
+        if (steps[stepIndex] === steps[steps.length - 1]) {
+            finalize(properties, next);
+        }
+        else {
+            advance();
         }
     };
     const renderInput = () => {
-        switch (currentStep?.id) {
+        switch (currentStep) {
             case 'domain':
-                return (_jsx(TextInput, { label: "Development Domain (e.g. www.sitevision.se)", defaultValue: properties.domain, placeholder: "sitevision.se", onSubmit: (value) => handleNext('domain', value), onCancel: onCancel }, "domain"));
+                return (_jsx(TextInput, { label: "Development Domain (e.g. www.sitevision.se)", defaultValue: properties.domain, placeholder: "sitevision.se", onSubmit: value => submitProperty('domain', value), onCancel: onCancel }, "domain"));
             case 'siteName':
-                return (_jsx(TextInput, { label: "Site Name (Root node name)", defaultValue: properties.siteName, onSubmit: (value) => handleNext('siteName', value), onCancel: onCancel }, "siteName"));
+                return (_jsx(TextInput, { label: "Site Name (Root node name)", defaultValue: properties.siteName, onSubmit: value => submitProperty('siteName', value), onCancel: onCancel }, "siteName"));
             case 'addonName':
-                return (_jsx(TextInput, { label: "Addon Name", defaultValue: properties.addonName, onSubmit: (value) => handleNext('addonName', value), onCancel: onCancel }, "addonName"));
+                return (_jsx(TextInput, { label: "Addon Name", defaultValue: properties.addonName, onSubmit: value => submitProperty('addonName', value), onCancel: onCancel }, "addonName"));
             case 'username':
-                return (_jsx(TextInput, { label: "Username (usually your Sitevision Cloud email)", defaultValue: properties.username, onSubmit: (value) => handleNext('username', value), onCancel: onCancel }, "username"));
+                return (_jsx(TextInput, { label: "Username (usually your Sitevision Cloud email)", defaultValue: properties.username, onSubmit: value => submitProperty('username', value), onCancel: onCancel }, "username"));
+            case 'authMethod':
+                return (_jsx(MethodSelect, { defaultValue: method, onSubmit: value => submitProperty('authMethod', value) }, "authMethod"));
             case 'password':
-                return (_jsx(TextInput, { label: "Password (saved in OS keychain \u2014 leave empty to prompt on each run)", type: "password", defaultValue: properties.password, onSubmit: (value) => handleNext('password', value), onCancel: onCancel }, "password"));
+                return (_jsx(TextInput, { label: "Password (saved in OS keychain \u2014 leave empty to prompt on each run)", type: "password", defaultValue: properties.password, onSubmit: value => submitProperty('password', value), onCancel: onCancel }, "password"));
+            case 'oauthClientId':
+                return (_jsx(TextInput, { label: "OAuth2 Client ID", defaultValue: oauth.clientId, onSubmit: value => submitOAuth('clientId', value), onCancel: onCancel }, "oauthClientId"));
+            case 'oauthAuthEndpoint':
+                return (_jsx(TextInput, { label: "Authorization Endpoint URL", defaultValue: oauth.authorizationEndpoint, onSubmit: value => submitOAuth('authorizationEndpoint', value), onCancel: onCancel }, "oauthAuthEndpoint"));
+            case 'oauthTokenEndpoint':
+                return (_jsx(TextInput, { label: "Token Endpoint URL", defaultValue: oauth.tokenEndpoint, onSubmit: value => submitOAuth('tokenEndpoint', value), onCancel: onCancel }, "oauthTokenEndpoint"));
+            case 'oauthScopes':
+                return (_jsx(TextInput, { label: "Scopes (space-separated, optional)", defaultValue: oauth.scopes, onSubmit: value => submitOAuth('scopes', value), onCancel: onCancel }, "oauthScopes"));
+            case 'oauthClientSecret':
+                return (_jsx(TextInput, { label: "Client Secret (OS keychain \u2014 leave empty for a public/PKCE client)", type: "password", defaultValue: oauth.clientSecret, onSubmit: value => submitOAuth('clientSecret', value), onCancel: onCancel }, "oauthClientSecret"));
+            case 'sessionLoginUrl':
+                return (_jsx(TextInput, { label: "Login URL (opened in a browser; blank = site root)", defaultValue: properties.sessionLoginUrl ??
+                        (properties.domain ? `https://${properties.domain}/` : ''), onSubmit: value => submitProperty('sessionLoginUrl', value), onCancel: onCancel }, "sessionLoginUrl"));
             case 'useHTTP':
-                return (_jsx(BooleanInput, { label: "Use HTTP for deployment? (y/n)", defaultValue: properties.useHTTPForDevDeploy ?? false, onSubmit: (value) => handleNext('useHTTPForDevDeploy', value) }, "useHTTP"));
+                return (_jsx(BooleanInput, { label: "Use HTTP for deployment? (y/n)", defaultValue: properties.useHTTPForDevDeploy ?? false, onSubmit: value => submitProperty('useHTTPForDevDeploy', value) }, "useHTTP"));
             default:
                 return null;
         }
     };
-    return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsxs(Box, { marginBottom: 1, children: [_jsx(Text, { bold: true, color: "cyan", children: "Setup Development Properties" }), _jsxs(Text, { children: [' ', "Step ", stepIndex + 1, " of ", STEPS.length, ": ", currentStep?.label] })] }), _jsx(Box, { marginBottom: 1, children: STEPS.map((s, i) => (_jsx(Box, { marginRight: 1, children: _jsx(Text, { color: i === stepIndex ? 'green' : i < stepIndex ? 'green' : 'gray', children: i < stepIndex ? '✓' : i === stepIndex ? '●' : '○' }) }, s.id))) }), _jsx(Box, { borderStyle: "single", borderColor: "gray", padding: 1, children: renderInput() })] }));
+    return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsxs(Box, { marginBottom: 1, children: [_jsx(Text, { bold: true, color: "cyan", children: "Setup Development Properties" }), _jsxs(Text, { children: [' ', "Step ", stepIndex + 1, " of ", steps.length, ":", ' ', currentStep ? LABELS[currentStep] : ''] })] }), isOAuth && (_jsx(Box, { marginBottom: 1, children: _jsxs(Text, { dimColor: true, children: ["Whitelist this redirect URI on the OAuth2 client: http://127.0.0.1:", redirectPort, "/callback"] }) })), _jsx(Box, { marginBottom: 1, children: steps.map((s, i) => (_jsx(Box, { marginRight: 1, children: _jsx(Text, { color: i <= stepIndex ? 'green' : 'gray', children: i < stepIndex ? '✓' : i === stepIndex ? '●' : '○' }) }, s))) }), _jsx(Box, { borderStyle: "single", borderColor: "gray", padding: 1, children: renderInput() })] }));
+}
+function MethodSelect({ defaultValue, onSubmit, }) {
+    const [index, setIndex] = useState(() => Math.max(0, AUTH_METHODS.findIndex(m => m.value === defaultValue)));
+    useInput((_input, key) => {
+        if (key.upArrow) {
+            setIndex(p => (p === 0 ? AUTH_METHODS.length - 1 : p - 1));
+        }
+        else if (key.downArrow) {
+            setIndex(p => (p === AUTH_METHODS.length - 1 ? 0 : p + 1));
+        }
+        else if (key.return) {
+            onSubmit(AUTH_METHODS[index].value);
+        }
+    });
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsx(Box, { marginBottom: 1, children: _jsx(Text, { bold: true, color: "cyan", children: "Authentication method" }) }), AUTH_METHODS.map((m, i) => (_jsxs(Text, { color: i === index ? 'green' : undefined, children: [i === index ? '❯ ' : '  ', m.label] }, m.value))), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: "\u2191/\u2193 to move, Enter to select" }) })] }));
 }
 function BooleanInput({ label, defaultValue, onSubmit, }) {
     useInput(input => {