sitevision-cli 1.0.0-beta.4 → 1.0.0-beta.6

package/dist/components/SetupFlow.js

@@ -1,7 +1,7 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { useState, useEffect } from 'react';
 import { Box, Text, useInput } from 'ink';
-import { getAppType, localizedText, migrateLegacyPassword, } from '../utils/project-detection.js';
+import { getAppType, localizedText, migrateLegacyPassword, getPackageJsonSyncChanges, syncDevPropertiesToPackageJson, readSvcConfig, writeSvcConfig, writeDevProperties, } from '../utils/project-detection.js';
 import { ProcessRunner } from '../utils/process-runner.js';
 import { ProcessOutputComponent } from './ProcessOutput.js';
 import { StatusIndicator } from './StatusIndicator.js';
@@ -11,6 +11,11 @@ export function SetupFlow({ project, onReload, onComplete }) {
     const [step, setStep] = useState('check-node-modules');
     const [runner, setRunner] = useState(null);
     const [commandStatus, setCommandStatus] = useState('running');
+    const [syncChanges, setSyncChanges] = useState([]);
+    const [syncDecision, setSyncDecision] = useState(false);
+    // Set when the user picks OAuth2 for an existing config, so the form opens in
+    // the OAuth2 branch without mutating the shared project object.
+    const [pendingAuthMethod, setPendingAuthMethod] = useState(undefined);
     const appType = getAppType(project.manifest);
     // Auto-advance through checks
     useEffect(() => {
@@ -27,14 +32,36 @@ export function SetupFlow({ project, onReload, onComplete }) {
                 if (project.hasLegacyPassword) {
                     setStep('confirm-password-migration');
                 }
+                else if (project.devProperties?.authMethod === undefined) {
+                    setStep('confirm-auth-method');
+                }
                 else {
-                    setStep('check-signing-properties');
+                    setStep('check-package-sync');
                 }
             }
             else {
                 setStep('confirm-dev-setup');
             }
         }
+        else if (step === 'check-package-sync') {
+            const preference = readSvcConfig(project.root).syncPackageJson;
+            const properties = project.devProperties;
+            const changes = preference !== false && properties
+                ? getPackageJsonSyncChanges(project.root, properties)
+                : [];
+            if (changes.length === 0 || !properties) {
+                setStep('check-signing-properties');
+            }
+            else if (preference === true) {
+                syncDevPropertiesToPackageJson(project.root, properties);
+                onReload();
+                setStep('check-signing-properties');
+            }
+            else {
+                setSyncChanges(changes);
+                setStep('confirm-package-sync');
+            }
+        }
         else if (step === 'check-signing-properties') {
             if (project.hasSigningProperties) {
                 setStep('show-info');
@@ -87,6 +114,26 @@ export function SetupFlow({ project, onReload, onComplete }) {
                 // The file was rewritten (plaintext stripped, password moved to
                 // keychain) — re-detect so hasLegacyPassword/password reflect that.
                 onReload();
+                setStep('check-package-sync');
+            }
+            else if (input === 'n' || input === 'N') {
+                setStep('check-package-sync');
+            }
+        }
+        else if (step === 'confirm-package-sync') {
+            if (['y', 'Y', 'n', 'N'].includes(input)) {
+                const accepted = input.toLowerCase() === 'y';
+                if (accepted && project.devProperties) {
+                    syncDevPropertiesToPackageJson(project.root, project.devProperties);
+                    onReload();
+                }
+                setSyncDecision(accepted);
+                setStep('confirm-save-sync-choice');
+            }
+        }
+        else if (step === 'confirm-save-sync-choice') {
+            if (input === 'y' || input === 'Y') {
+                writeSvcConfig(project.root, { syncPackageJson: syncDecision });
                 setStep('check-signing-properties');
             }
             else if (input === 'n' || input === 'N') {
@@ -101,15 +148,38 @@ export function SetupFlow({ project, onReload, onComplete }) {
                 setStep('show-info');
             }
         }
+        else if (step === 'confirm-auth-method') {
+            if (input === 'o' || input === 'O') {
+                // Choosing OAuth2 needs endpoints — collect them in the full form.
+                setPendingAuthMethod('oauth2');
+                setStep('setup-dev-properties');
+            }
+            else if (input === 'c' || input === 'C') {
+                setPendingAuthMethod('cookie');
+                setStep('setup-dev-properties');
+            }
+            else if (['b', 'B', '\r'].includes(input)) {
+                if (project.devProperties) {
+                    writeDevProperties(project.root, {
+                        ...project.devProperties,
+                        authMethod: 'basic',
+                    });
+                    onReload();
+                }
+                setStep('check-package-sync');
+            }
+        }
     });
     // Setup Dev Properties Form
     if (step === 'setup-dev-properties') {
-        return (_jsx(DevPropertiesForm, { projectRoot: project.root, initialProperties: project.devProperties, packageJson: project.packageJson, onComplete: () => {
+        return (_jsx(DevPropertiesForm, { projectRoot: project.root, initialProperties: pendingAuthMethod && project.devProperties
+                ? { ...project.devProperties, authMethod: pendingAuthMethod }
+                : project.devProperties, packageJson: project.packageJson, onComplete: () => {
                 // Re-detect from disk/keychain so devProperties (incl. the keychain
                 // password) populate in memory — otherwise the rest of this flow and
                 // the menu would see stale state until the CLI is restarted.
                 onReload();
-                setStep('check-signing-properties');
+                setStep('check-package-sync');
             }, onCancel: () => setStep('check-signing-properties') }));
     }
     // Setup Signing Properties Form
@@ -137,6 +207,20 @@ export function SetupFlow({ project, onReload, onComplete }) {
     if (step === 'confirm-password-migration') {
         return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(Text, { bold: true, color: "cyan", children: "Sitevision CLI" }) }), _jsx(Box, { marginBottom: 1, children: _jsx(Text, { color: "yellow", children: "\u26A0 Plaintext password found in .dev_properties.json" }) }), _jsxs(Box, { marginBottom: 1, flexDirection: "column", children: [_jsx(Text, { children: "Move it to the OS keychain and remove it from the file? (y/n)" }), _jsx(Text, { dimColor: true, children: "Recommended \u2014 storing passwords in project files is insecure." })] })] }));
     }
+    // Ask which auth method an existing config should use (setting is missing)
+    if (step === 'confirm-auth-method') {
+        return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(Text, { bold: true, color: "cyan", children: "Sitevision CLI" }) }), _jsx(Box, { marginBottom: 1, children: _jsx(Text, { color: "yellow", children: "\u26A0 Deploy authentication method not set" }) }), _jsxs(Box, { marginBottom: 1, flexDirection: "column", children: [_jsx(Text, { children: "Which method should deploys use? [B]asic / [O]Auth2 / [C]ookie" }), _jsx(Text, { dimColor: true, children: "B = Basic (default), O = OAuth2 bearer, C = session cookie (SSO)." })] })] }));
+    }
+    // Confirm package.json sync
+    if (step === 'confirm-package-sync') {
+        return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(Text, { bold: true, color: "cyan", children: "Sitevision CLI" }) }), _jsx(Box, { marginBottom: 1, children: _jsx(Text, { color: "yellow", children: "\u26A0 package.json is out of sync with .dev_properties.json" }) }), _jsx(Box, { marginBottom: 1, flexDirection: "column", marginLeft: 2, children: syncChanges.map(change => (_jsxs(Box, { children: [_jsx(Text, { color: change.from === undefined ? 'green' : 'yellow', children: change.from === undefined ? '+ ' : '~ ' }), _jsxs(Text, { bold: true, children: [change.key, ": "] }), change.from !== undefined && (_jsxs(Text, { dimColor: true, children: [change.from, " \u2192 "] })), _jsx(Text, { children: change.to })] }, change.key))) }), _jsxs(Box, { marginBottom: 1, flexDirection: "column", children: [_jsx(Text, { children: "Update package.json from .dev_properties.json? (y/n)" }), _jsx(Text, { dimColor: true, children: "sitevision-scripts reads these fields from package.json." })] })] }));
+    }
+    // Offer to persist the sync decision in .svcconfig
+    if (step === 'confirm-save-sync-choice') {
+        return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(Text, { bold: true, color: "cyan", children: "Sitevision CLI" }) }), _jsxs(Box, { marginBottom: 1, flexDirection: "column", children: [_jsx(Text, { children: "Remember this choice in .svcconfig? (y/n)" }), _jsx(Text, { dimColor: true, children: syncDecision
+                                ? 'svc will update package.json automatically from now on.'
+                                : 'svc will stop asking about package.json sync.' })] })] }));
+    }
     // Confirm signing setup
     if (step === 'confirm-signing-setup') {
         return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(Text, { bold: true, color: "cyan", children: "Sitevision CLI" }) }), _jsx(Box, { marginBottom: 1, children: _jsx(Text, { color: "yellow", children: "\u26A0 signing credentials not configured" }) }), _jsx(Box, { marginBottom: 1, children: _jsx(Text, { children: "Signing credentials are required for signing apps on developer.sitevision.se" }) }), _jsx(Box, { marginBottom: 1, children: _jsx(Text, { children: "Would you like to set up signing credentials? (y/n)" }) })] }));

package/dist/types/index.d.ts

@@ -48,6 +48,24 @@ export interface DevProperties {
     useHTTPForDevDeploy?: boolean;
     signingUsername?: string;
     certificateName?: string;
+    authMethod?: 'basic' | 'oauth2' | 'cookie';
+    oauth2?: OAuth2Config;
+    sessionLoginUrl?: string;
+    accessToken?: string;
+    sessionCookie?: string;
+}
+/**
+ * OAuth2 provider config for bearer-token deploys.
+ *
+ * Deliberately secret-free: the client secret and refresh token live in the OS
+ * keychain, so nothing here is unsafe to write to .dev_properties.json.
+ */
+export interface OAuth2Config {
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    clientId: string;
+    scopes?: string[];
+    redirectPort?: number;
 }
 /**
  * Signing credentials (password is runtime-only, not persisted)
@@ -65,7 +83,9 @@ export interface DeployConfig {
     siteName: string;
     addonName: string;
     username: string;
-    password: string;
+    password?: string;
+    accessToken?: string;
+    sessionCookie?: string;
     useHTTP?: boolean;
 }
 /**
@@ -149,6 +169,7 @@ export interface DeployResponse {
     executableId?: string;
     message?: string;
     error?: string;
+    authExpired?: boolean;
 }
 /**
  * API response from addon creation
@@ -157,6 +178,7 @@ export interface CreateAddonResponse {
     success: boolean;
     addonId?: string;
     error?: string;
+    authExpired?: boolean;
 }
 /**
  * API response from activation
@@ -164,6 +186,7 @@ export interface CreateAddonResponse {
 export interface ActivationResponse {
     success: boolean;
     error?: string;
+    authExpired?: boolean;
 }
 /**
  * Build mode

package/dist/utils/keychain.d.ts

@@ -4,3 +4,12 @@ export declare function deleteDeployPassword(domain: string, username: string):
 export declare function getSigningPassword(username: string): string | null;
 export declare function setSigningPassword(username: string, password: string): boolean;
 export declare function deleteSigningPassword(username: string): void;
+export declare function getOAuth2RefreshToken(domain: string, clientId: string): string | null;
+export declare function setOAuth2RefreshToken(domain: string, clientId: string, token: string): boolean;
+export declare function deleteOAuth2RefreshToken(domain: string, clientId: string): void;
+export declare function getOAuth2ClientSecret(domain: string, clientId: string): string | null;
+export declare function setOAuth2ClientSecret(domain: string, clientId: string, secret: string): boolean;
+export declare function deleteOAuth2ClientSecret(domain: string, clientId: string): void;
+export declare function getSessionCookie(domain: string, username: string): string | null;
+export declare function setSessionCookie(domain: string, username: string, cookie: string): boolean;
+export declare function deleteSessionCookie(domain: string, username: string): void;

package/dist/utils/keychain.js

@@ -6,6 +6,15 @@ function deployAccount(domain, username) {
 function signingAccount(username) {
     return `signing:${username}`;
 }
+function oauthRefreshAccount(domain, clientId) {
+    return `oauth2-refresh:${clientId}@${domain}`;
+}
+function oauthSecretAccount(domain, clientId) {
+    return `oauth2-secret:${clientId}@${domain}`;
+}
+function sessionCookieAccount(domain, username) {
+    return `session:${username}@${domain}`;
+}
 function safeGet(account) {
     try {
         return new Entry(SERVICE, account).getPassword();
@@ -61,3 +70,48 @@ export function deleteSigningPassword(username) {
         return;
     safeDelete(signingAccount(username));
 }
+export function getOAuth2RefreshToken(domain, clientId) {
+    if (!domain || !clientId)
+        return null;
+    return safeGet(oauthRefreshAccount(domain, clientId));
+}
+export function setOAuth2RefreshToken(domain, clientId, token) {
+    if (!domain || !clientId || !token)
+        return false;
+    return safeSet(oauthRefreshAccount(domain, clientId), token);
+}
+export function deleteOAuth2RefreshToken(domain, clientId) {
+    if (!domain || !clientId)
+        return;
+    safeDelete(oauthRefreshAccount(domain, clientId));
+}
+export function getOAuth2ClientSecret(domain, clientId) {
+    if (!domain || !clientId)
+        return null;
+    return safeGet(oauthSecretAccount(domain, clientId));
+}
+export function setOAuth2ClientSecret(domain, clientId, secret) {
+    if (!domain || !clientId || !secret)
+        return false;
+    return safeSet(oauthSecretAccount(domain, clientId), secret);
+}
+export function deleteOAuth2ClientSecret(domain, clientId) {
+    if (!domain || !clientId)
+        return;
+    safeDelete(oauthSecretAccount(domain, clientId));
+}
+export function getSessionCookie(domain, username) {
+    if (!domain || !username)
+        return null;
+    return safeGet(sessionCookieAccount(domain, username));
+}
+export function setSessionCookie(domain, username, cookie) {
+    if (!domain || !username || !cookie)
+        return false;
+    return safeSet(sessionCookieAccount(domain, username), cookie);
+}
+export function deleteSessionCookie(domain, username) {
+    if (!domain || !username)
+        return;
+    safeDelete(sessionCookieAccount(domain, username));
+}

package/dist/utils/oauth2-auth.d.ts

@@ -0,0 +1,20 @@
+import type { DevProperties } from '../types/index.js';
+/** Default loopback port. Fixed so a single redirect URI can be whitelisted. */
+export declare const DEFAULT_REDIRECT_PORT = 8137;
+/** RFC 7636 S256 pair. Exported for testing the challenge derivation. */
+export declare function createPkcePair(): {
+    verifier: string;
+    challenge: string;
+};
+/**
+ * Return a usable OAuth2 access token, or null if one can't be obtained.
+ *
+ * Order: silent refresh from the keychain refresh token, then (when
+ * `interactive`) a browser login. The access token is never persisted; the
+ * refresh token is stored in the keychain for next time. Pass
+ * `interactive: false` from contexts that can't own the terminal (the Ink
+ * menu) to get refresh-only resolution with no browser.
+ */
+export declare function resolveOAuth2AccessToken(dev: DevProperties, options?: {
+    interactive?: boolean;
+}): Promise<string | null>;

package/dist/utils/oauth2-auth.js

@@ -0,0 +1,160 @@
+import http from 'http';
+import crypto from 'crypto';
+import { spawn } from 'child_process';
+import { makeRequest } from './sitevision-api.js';
+import { getOAuth2RefreshToken, setOAuth2RefreshToken, deleteOAuth2RefreshToken, getOAuth2ClientSecret, } from './keychain.js';
+/** Default loopback port. Fixed so a single redirect URI can be whitelisted. */
+export const DEFAULT_REDIRECT_PORT = 8137;
+/** Seconds to wait for the user to finish logging in before giving up. */
+const LOGIN_TIMEOUT_MS = 300_000;
+function base64url(buffer) {
+    return buffer
+        .toString('base64')
+        .replaceAll('+', '-')
+        .replaceAll('/', '_')
+        .replaceAll('=', '');
+}
+/** RFC 7636 S256 pair. Exported for testing the challenge derivation. */
+export function createPkcePair() {
+    const verifier = base64url(crypto.randomBytes(32));
+    const challenge = base64url(crypto.createHash('sha256').update(verifier).digest());
+    return { verifier, challenge };
+}
+function hasOAuth2Config(config) {
+    return Boolean(config?.authorizationEndpoint && config.tokenEndpoint && config.clientId);
+}
+async function postToken(config, params, secret) {
+    const body = Buffer.from(new URLSearchParams(params).toString());
+    try {
+        const response = await makeRequest(config.tokenEndpoint, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                'Content-Length': String(body.length),
+            },
+            body,
+            // client_secret_basic when confidential; public+PKCE clients omit it.
+            auth: secret ? { username: config.clientId, password: secret } : undefined,
+        });
+        if (response.statusCode !== 200)
+            return null;
+        return JSON.parse(response.body.toString());
+    }
+    catch {
+        return null;
+    }
+}
+function openBrowser(url) {
+    const isWin = process.platform === 'win32';
+    const cmd = process.platform === 'darwin' ? 'open' : isWin ? 'cmd' : 'xdg-open';
+    const args = isWin ? ['/c', 'start', '', url] : [url];
+    try {
+        spawn(cmd, args, { stdio: 'ignore', detached: true }).unref();
+    }
+    catch {
+        // Fall back to the printed URL.
+    }
+}
+/** Serve the loopback redirect once, resolving the authorization code. */
+function waitForCode(port, state) {
+    return new Promise(resolve => {
+        let settled = false;
+        const finish = (code) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            server.close();
+            resolve(code);
+        };
+        const server = http.createServer((req, res) => {
+            const url = new URL(req.url ?? '/', `http://127.0.0.1:${port}`);
+            if (url.pathname !== '/callback') {
+                res.writeHead(404).end();
+                return;
+            }
+            const ok = url.searchParams.get('state') === state;
+            const code = url.searchParams.get('code');
+            const message = ok && code
+                ? 'Login complete. You can close this window and return to the terminal.'
+                : 'Login failed. Check the terminal.';
+            res.writeHead(200, { 'Content-Type': 'text/html' });
+            res.end(`<!doctype html><meta charset="utf-8"><p>${message}</p>`);
+            finish(ok ? code : null);
+        });
+        const timer = setTimeout(() => finish(null), LOGIN_TIMEOUT_MS);
+        server.on('error', () => finish(null));
+        server.listen(port, '127.0.0.1');
+    });
+}
+async function interactiveLogin(config, secret) {
+    const port = config.redirectPort ?? DEFAULT_REDIRECT_PORT;
+    const redirectUri = `http://127.0.0.1:${port}/callback`;
+    const { verifier, challenge } = createPkcePair();
+    const state = base64url(crypto.randomBytes(16));
+    const authUrl = new URL(config.authorizationEndpoint);
+    authUrl.searchParams.set('response_type', 'code');
+    authUrl.searchParams.set('client_id', config.clientId);
+    authUrl.searchParams.set('redirect_uri', redirectUri);
+    authUrl.searchParams.set('state', state);
+    authUrl.searchParams.set('code_challenge', challenge);
+    authUrl.searchParams.set('code_challenge_method', 'S256');
+    if (config.scopes?.length) {
+        authUrl.searchParams.set('scope', config.scopes.join(' '));
+    }
+    const codePromise = waitForCode(port, state);
+    openBrowser(authUrl.href);
+    console.log(`\nOpening browser to log in. If it doesn't open, visit:\n${authUrl.href}\n`);
+    const code = await codePromise;
+    if (!code)
+        return null;
+    return postToken(config, {
+        grant_type: 'authorization_code',
+        code,
+        redirect_uri: redirectUri,
+        client_id: config.clientId,
+        code_verifier: verifier,
+    }, secret);
+}
+/**
+ * Return a usable OAuth2 access token, or null if one can't be obtained.
+ *
+ * Order: silent refresh from the keychain refresh token, then (when
+ * `interactive`) a browser login. The access token is never persisted; the
+ * refresh token is stored in the keychain for next time. Pass
+ * `interactive: false` from contexts that can't own the terminal (the Ink
+ * menu) to get refresh-only resolution with no browser.
+ */
+export async function resolveOAuth2AccessToken(dev, options = {}) {
+    const { interactive = true } = options;
+    const config = dev.oauth2;
+    if (!hasOAuth2Config(config))
+        return null;
+    const { domain } = dev;
+    const secret = getOAuth2ClientSecret(domain, config.clientId) ?? undefined;
+    const storedRefresh = getOAuth2RefreshToken(domain, config.clientId);
+    if (storedRefresh) {
+        const tokens = await postToken(config, {
+            grant_type: 'refresh_token',
+            refresh_token: storedRefresh,
+            client_id: config.clientId,
+        }, secret);
+        if (tokens?.access_token) {
+            if (tokens.refresh_token) {
+                setOAuth2RefreshToken(domain, config.clientId, tokens.refresh_token);
+            }
+            return tokens.access_token;
+        }
+        // Stale/expired refresh token — drop it and log in fresh.
+        deleteOAuth2RefreshToken(domain, config.clientId);
+    }
+    if (!interactive || !process.stdin.isTTY)
+        return null;
+    const tokens = await interactiveLogin(config, secret);
+    if (!tokens?.access_token)
+        return null;
+    if (tokens.refresh_token) {
+        setOAuth2RefreshToken(domain, config.clientId, tokens.refresh_token);
+    }
+    return tokens.access_token;
+}

package/dist/utils/password-prompt.d.ts

@@ -3,6 +3,11 @@
  * Pressing Enter (empty answer) returns `defaultYes` (default: false).
  */
 export declare function promptYesNo(prompt: string, defaultYes?: boolean): Promise<boolean>;
+/**
+ * Wait for the user to press Enter (or Ctrl+C). Used to hand control to an
+ * external browser and resume once the user says they're done.
+ */
+export declare function promptEnter(prompt: string): Promise<void>;
 /**
  * Prompt for password input with masked display
  */

package/dist/utils/password-prompt.js

@@ -29,6 +29,34 @@ export function promptYesNo(prompt, defaultYes = false) {
         stdin.on('data', onData);
     });
 }
+/**
+ * Wait for the user to press Enter (or Ctrl+C). Used to hand control to an
+ * external browser and resume once the user says they're done.
+ */
+export function promptEnter(prompt) {
+    return new Promise(resolve => {
+        process.stdout.write(prompt);
+        const stdin = process.stdin;
+        stdin.setRawMode(true);
+        stdin.resume();
+        stdin.setEncoding('utf8');
+        const onData = (data) => {
+            const char = data[0] || '';
+            const charCode = char.charCodeAt(0);
+            if (charCode === 3) {
+                process.exit();
+            }
+            if (char === '' || charCode === 13 || charCode === 10) {
+                stdin.setRawMode(false);
+                stdin.removeListener('data', onData);
+                stdin.pause();
+                process.stdout.write('\n');
+                resolve();
+            }
+        };
+        stdin.on('data', onData);
+    });
+}
 /**
  * Prompt for password input with masked display
  */

package/dist/utils/project-detection.d.ts

@@ -69,6 +69,14 @@ export declare function buildImportEndpointUrl(domain: string, siteName: string,
 export declare class ManifestParseError extends Error {
     constructor(manifestPath: string, cause: unknown);
 }
+/**
+ * Read manifest.json from its supported locations (root, static/, src/).
+ * Throws ManifestParseError on malformed JSON.
+ */
+export declare function readManifest(cwd: string): {
+    manifestPath: string;
+    manifest: SitevisionManifest;
+} | null;
 /**
  * Detect if the current directory is a Sitevision project
  */
@@ -90,10 +98,37 @@ export declare function isBundledApp(manifest: SitevisionManifest): boolean;
  */
 export declare function readDevProperties(projectRoot: string): DevProperties | null;
 /**
- * Write dev properties to file. The `password` field is never persisted —
- * it is held in the OS keychain instead.
+ * Write dev properties to file. Secrets are never persisted — `password`,
+ * `accessToken` and `sessionCookie` are held in the OS keychain / resolved at
+ * runtime instead.
  */
 export declare function writeDevProperties(projectRoot: string, properties: DevProperties): void;
+/**
+ * CLI preferences stored in .svcconfig at the project root. Unknown keys are
+ * preserved on write so hand-edited entries survive.
+ */
+export interface SvcConfig {
+    syncPackageJson?: boolean;
+    [key: string]: unknown;
+}
+export declare function readSvcConfig(projectRoot: string): SvcConfig;
+export declare function writeSvcConfig(projectRoot: string, updates: SvcConfig): void;
+export interface PackageJsonSyncChange {
+    key: string;
+    from?: string;
+    to: string;
+}
+/**
+ * Which of the shared fields package.json is missing or disagrees on, relative
+ * to the given dev properties. Reads package.json from disk — an earlier
+ * `npm install` in the same session may have rewritten it.
+ */
+export declare function getPackageJsonSyncChanges(projectRoot: string, properties: DevProperties): PackageJsonSyncChange[];
+/**
+ * Copy the shared fields from dev properties into package.json, preserving the
+ * file's existing indentation and trailing newline.
+ */
+export declare function syncDevPropertiesToPackageJson(projectRoot: string, properties: DevProperties): boolean;
 /**
  * Move a plaintext password from .dev_properties.json into the OS keychain and
  * strip it from the file. Returns true if the password was migrated.