sitevision-cli 1.0.0-beta.5 → 1.0.0-beta.7

package/dist/app.js

@@ -13,6 +13,7 @@ import { DeployScreen } from './commands/deploy.js';
 import { SignScreen } from './commands/sign.js';
 import { SigningPropertiesForm } from './components/SigningPropertiesForm.js';
 import { getSigningPassword, setDeployPassword as saveDeployPassword, setSigningPassword as saveSigningPassword, } from './utils/keychain.js';
+const NONBASIC_DEV_UNSUPPORTED = '\x1b[33mdev/watch support only basic auth. Use `svc deploy` for OAuth2/cookie.\x1b[0m';
 export default function App({ project: initialProject }) {
     // The project is loaded once at startup, but setup flows write new values to
     // disk and the OS keychain. Hold it in state so we can re-detect after setup
@@ -70,10 +71,18 @@ export default function App({ project: initialProject }) {
     };
     // Check if dev password is available (either from file or session)
     const hasDevPassword = Boolean(project.devProperties?.password || devPassword);
+    // OAuth2 / cookie configs authenticate with a token or session resolved at
+    // deploy time, so they need no basic password. `svc dev`/`watch` stay basic.
+    const authMethod = project.devProperties?.authMethod ?? 'basic';
+    const isTokenAuth = authMethod === 'oauth2' || authMethod === 'cookie';
+    const deployAuthReady = isTokenAuth || hasDevPassword;
     // Get effective dev properties with session password if needed
     const getEffectiveDevProperties = () => {
         if (!project.devProperties)
             return undefined;
+        // Non-basic configs authenticate by token/cookie — never graft a password.
+        if (isTokenAuth)
+            return project.devProperties;
         if (project.devProperties.password)
             return project.devProperties;
         return { ...project.devProperties, password: devPassword };
@@ -131,6 +140,10 @@ export default function App({ project: initialProject }) {
                     console.log('\x1b[31mDevelopment properties not configured. Create a .dev_properties.json file first.\x1b[0m');
                     return;
                 }
+                if (isTokenAuth) {
+                    console.log(NONBASIC_DEV_UNSUPPORTED);
+                    return;
+                }
                 if (!hasDevPassword) {
                     setState('dev-password-input');
                 }
@@ -147,6 +160,10 @@ export default function App({ project: initialProject }) {
                     console.log('\x1b[31mSigning credentials not configured. Run svc setup-signing first.\x1b[0m');
                     return;
                 }
+                if (isTokenAuth) {
+                    console.log(NONBASIC_DEV_UNSUPPORTED);
+                    return;
+                }
                 // Need both dev password and signing password
                 if (!hasDevPassword) {
                     setState('dev-password-input');
@@ -168,6 +185,10 @@ export default function App({ project: initialProject }) {
                     console.log('\x1b[31mSigning credentials not configured. Run svc setup-signing first.\x1b[0m');
                     return;
                 }
+                if (isTokenAuth) {
+                    console.log(NONBASIC_DEV_UNSUPPORTED);
+                    return;
+                }
                 routeToSigningStep(command);
                 break;
             case 'sign':
@@ -191,7 +212,7 @@ export default function App({ project: initialProject }) {
                     console.log('\x1b[31mDevelopment properties not configured. Create a .dev_properties.json file first.\x1b[0m');
                     return;
                 }
-                if (!hasDevPassword) {
+                if (!deployAuthReady) {
                     setState('dev-password-input');
                 }
                 else {

package/dist/cli.js

@@ -58,6 +58,12 @@ const cli = meow(`
             shortFlag: 'p',
             default: false,
         },
+        token: {
+            type: 'string',
+        },
+        cookie: {
+            type: 'string',
+        },
     },
 });
 const [commandName, ...args] = cli.input;
@@ -149,6 +155,22 @@ async function main() {
             process.exit(1);
         }
     })();
+    // --token / --cookie override the resolved bearer token / session cookie for
+    // this run (manual / CI path, alongside SITEVISION_ACCESS_TOKEN and
+    // SITEVISION_SESSION_COOKIE).
+    if (cli.flags.token || cli.flags.cookie) {
+        if (project.devProperties) {
+            if (cli.flags.token) {
+                project.devProperties.accessToken = cli.flags.token;
+            }
+            if (cli.flags.cookie) {
+                project.devProperties.sessionCookie = cli.flags.cookie;
+            }
+        }
+        else {
+            console.log('\x1b[33m--token/--cookie needs a .dev_properties.json (domain, site, addon) to deploy against.\x1b[0m');
+        }
+    }
     // First run: show the welcome (branding + optional signing-password save),
     // then continue to the normal flow once the user dismisses it.
     if (firstRun) {

package/dist/commands/deploy.js

@@ -6,7 +6,9 @@ import { deployApp, deployProduction } from '../utils/sitevision-api.js';
 import { getZipPath, getSignedZipPath, getAppType, } from '../utils/project-detection.js';
 import { zipExists } from '../utils/zip.js';
 import { promptPassword, promptYesNo } from '../utils/password-prompt.js';
-import { setDeployPassword } from '../utils/keychain.js';
+import { setDeployPassword, deleteSessionCookie } from '../utils/keychain.js';
+import { resolveOAuth2AccessToken } from '../utils/oauth2-auth.js';
+import { resolveSessionCookie } from '../utils/session-cookie-auth.js';
 export function DeployScreen({ projectRoot, manifest, devProperties, force, production, activate, signingPassword, onBack, onRetryCredentials, }) {
     const [state, setState] = React.useState({
         status: 'deploying',
@@ -26,6 +28,52 @@ export function DeployScreen({ projectRoot, manifest, devProperties, force, prod
         async function runDeploy() {
             try {
                 const appType = getAppType(manifest);
+                // Resolve an OAuth2 token silently (env/keychain refresh). A fresh
+                // browser login happens only in the direct `svc deploy` command, which
+                // sets accessToken before rendering — the Ink menu can't own the
+                // terminal for a login, so it resolves refresh-only here.
+                const authMethod = devProperties.authMethod ?? 'basic';
+                let accessToken = devProperties.accessToken;
+                if (authMethod === 'oauth2' && !accessToken) {
+                    accessToken =
+                        (await resolveOAuth2AccessToken(devProperties, {
+                            interactive: false,
+                        })) ?? undefined;
+                    if (!accessToken) {
+                        setState({
+                            status: 'error',
+                            error: 'No OAuth2 access token. Run `svc deploy` from a terminal to log in, or set SITEVISION_ACCESS_TOKEN.',
+                        });
+                        return;
+                    }
+                }
+                let sessionCookie = devProperties.sessionCookie;
+                if (authMethod === 'cookie' && !sessionCookie) {
+                    sessionCookie =
+                        (await resolveSessionCookie(devProperties, {
+                            interactive: false,
+                        })) ?? undefined;
+                    if (!sessionCookie) {
+                        setState({
+                            status: 'error',
+                            error: 'No session cookie. Run `svc deploy` from a terminal to log in, or set SITEVISION_SESSION_COOKIE.',
+                        });
+                        return;
+                    }
+                }
+                // A stale session fails without a clean 401 — clear the stored cookie
+                // so the next run re-authenticates. Skip when SITEVISION_SESSION_COOKIE
+                // is set: detection re-reads it first, so clearing would just replay
+                // the same dead cookie in a loop.
+                const clearStaleCookie = (result) => {
+                    if (result.authExpired &&
+                        authMethod === 'cookie' &&
+                        !process.env['SITEVISION_SESSION_COOKIE'] &&
+                        devProperties.domain &&
+                        devProperties.username) {
+                        deleteSessionCookie(devProperties.domain, devProperties.username);
+                    }
+                };
                 if (production) {
                     // Production deployment requires a signed zip
                     const signedZipPath = getSignedZipPath(projectRoot, manifest);
@@ -42,11 +90,14 @@ export function DeployScreen({ projectRoot, manifest, devProperties, force, prod
                         addonName: devProperties.addonName,
                         username: devProperties.username,
                         password: devProperties.password,
+                        accessToken,
+                        sessionCookie,
                         useHTTP: devProperties.useHTTPForDevDeploy,
                         activate,
                     };
                     const result = await deployProduction(signedZipPath, config, appType);
                     if (!result.success) {
+                        clearStaleCookie(result);
                         setState({
                             status: 'error',
                             error: result.error || 'Deployment failed',
@@ -75,10 +126,13 @@ export function DeployScreen({ projectRoot, manifest, devProperties, force, prod
                         addonName: devProperties.addonName,
                         username: devProperties.username,
                         password: devProperties.password,
+                        accessToken,
+                        sessionCookie,
                         useHTTP: devProperties.useHTTPForDevDeploy,
                     };
                     const result = await deployApp(zipPath, config, appType, force);
                     if (!result.success) {
+                        clearStaleCookie(result);
                         setState({
                             status: 'error',
                             error: result.error || 'Deployment failed',
@@ -146,8 +200,32 @@ export const deployCommand = {
             console.log('Create a .dev_properties.json file with domain, siteName, addonName, and username, then run setup.\n');
             return;
         }
-        // Resolve deploy password (already loaded from keychain/env in detectProject — prompt if missing)
-        if (!project.devProperties.password) {
+        // Resolve deploy credentials. A token/cookie from env/--flag (already
+        // loaded in detectProject / cli) short-circuits everything.
+        const authMethod = project.devProperties.authMethod ?? 'basic';
+        if (project.devProperties.accessToken ||
+            project.devProperties.sessionCookie) {
+            // Nothing to acquire — a bearer token or session cookie is in hand.
+        }
+        else if (authMethod === 'oauth2') {
+            const token = await resolveOAuth2AccessToken(project.devProperties);
+            if (!token) {
+                console.log('\n\x1b[31mError: No OAuth2 access token available.\x1b[0m');
+                console.log('Set SITEVISION_ACCESS_TOKEN, pass --token, or configure the oauth2 endpoints in .dev_properties.json to log in.\n');
+                return;
+            }
+            project.devProperties.accessToken = token;
+        }
+        else if (authMethod === 'cookie') {
+            const cookie = await resolveSessionCookie(project.devProperties);
+            if (!cookie) {
+                console.log('\n\x1b[31mError: No session cookie available.\x1b[0m');
+                console.log('Log in when the browser opens, or set SITEVISION_SESSION_COOKIE / pass --cookie.\n');
+                return;
+            }
+            project.devProperties.sessionCookie = cookie;
+        }
+        else if (!project.devProperties.password) {
             const { domain, username } = project.devProperties;
             console.log('');
             const password = await promptPassword(`Deploy password for ${username}@${domain}: `);

package/dist/commands/dev.js

@@ -394,6 +394,12 @@ export const devCommand = {
             console.log('Create a .dev_properties.json file with domain, siteName, addonName, and username, then run setup.\n');
             return;
         }
+        // dev/watch continuously redeploy and only support basic auth. Fail clearly
+        // on an OAuth2/cookie config instead of prompting for an unusable password.
+        if ((project.devProperties.authMethod ?? 'basic') !== 'basic') {
+            console.log('\n\x1b[33mdev/watch support only basic auth. Use `svc deploy` for OAuth2/cookie.\x1b[0m\n');
+            return;
+        }
         // Resolve deploy password (already loaded from keychain/env in detectProject — prompt if missing)
         if (!project.devProperties.password) {
             const { domain, username } = project.devProperties;

package/dist/components/DevPropertiesForm.js

@@ -3,15 +3,35 @@ import { useState } from 'react';
 import { Box, Text, useInput } from 'ink';
 import { TextInput } from './TextInput.js';
 import { writeDevProperties } from '../utils/project-detection.js';
-import { setDeployPassword, deleteDeployPassword } from '../utils/keychain.js';
-const STEPS = [
-    { id: 'domain', label: 'Domain' },
-    { id: 'siteName', label: 'Site Name' },
-    { id: 'addonName', label: 'Addon Name' },
-    { id: 'username', label: 'Username' },
-    { id: 'password', label: 'Password' },
-    { id: 'useHTTP', label: 'Use HTTP' },
+import { setDeployPassword, deleteDeployPassword, setOAuth2ClientSecret, } from '../utils/keychain.js';
+import { DEFAULT_REDIRECT_PORT } from '../utils/oauth2-auth.js';
+const LABELS = {
+    domain: 'Domain',
+    siteName: 'Site Name',
+    addonName: 'Addon Name',
+    username: 'Username',
+    authMethod: 'Auth Method',
+    password: 'Password',
+    oauthClientId: 'Client ID',
+    oauthAuthEndpoint: 'Authorization Endpoint',
+    oauthTokenEndpoint: 'Token Endpoint',
+    oauthScopes: 'Scopes',
+    oauthClientSecret: 'Client Secret',
+    sessionLoginUrl: 'Login URL',
+    useHTTP: 'Use HTTP',
+};
+const AUTH_METHODS = [
+    { value: 'basic', label: 'Basic auth (username + password)' },
+    { value: 'oauth2', label: 'OAuth2 bearer token (PKCE)' },
+    { value: 'cookie', label: 'Session cookie (SAML / SSO login)' },
 ];
+function parseScopes(raw) {
+    const scopes = raw
+        .split(/[\s,]+/)
+        .map(s => s.trim())
+        .filter(Boolean);
+    return scopes.length > 0 ? scopes : undefined;
+}
 export function DevPropertiesForm({ projectRoot, initialProperties, packageJson, onComplete, onCancel, }) {
     const [stepIndex, setStepIndex] = useState(0);
     const [properties, setProperties] = useState(() => {
@@ -19,49 +39,158 @@ export function DevPropertiesForm({ projectRoot, initialProperties, packageJson,
             domain: packageJson.developmentDomain || '',
             addonName: packageJson.addonName || '',
             siteName: packageJson.siteName || '',
+            authMethod: 'basic',
         };
         return { ...defaults, ...initialProperties };
     });
-    const currentStep = STEPS[stepIndex];
-    const handleNext = (key, value) => {
-        const newProperties = { ...properties, [key]: value };
-        setProperties(newProperties);
-        if (stepIndex < STEPS.length - 1) {
+    const [oauth, setOauth] = useState(() => ({
+        authorizationEndpoint: initialProperties?.oauth2?.authorizationEndpoint ?? '',
+        tokenEndpoint: initialProperties?.oauth2?.tokenEndpoint ?? '',
+        clientId: initialProperties?.oauth2?.clientId ?? '',
+        scopes: initialProperties?.oauth2?.scopes?.join(' ') ?? '',
+        clientSecret: '',
+    }));
+    const method = properties.authMethod ?? 'basic';
+    const isOAuth = method === 'oauth2';
+    const methodSteps = method === 'oauth2'
+        ? [
+            'oauthClientId',
+            'oauthAuthEndpoint',
+            'oauthTokenEndpoint',
+            'oauthScopes',
+            'oauthClientSecret',
+        ]
+        : method === 'cookie'
+            ? ['sessionLoginUrl']
+            : ['password'];
+    const steps = [
+        'domain',
+        'siteName',
+        'addonName',
+        'username',
+        'authMethod',
+        ...methodSteps,
+        'useHTTP',
+    ];
+    const currentStep = steps[stepIndex];
+    const redirectPort = initialProperties?.oauth2?.redirectPort ?? DEFAULT_REDIRECT_PORT;
+    const advance = () => {
+        if (stepIndex < steps.length - 1) {
             setStepIndex(stepIndex + 1);
         }
-        else {
-            const finalProperties = newProperties;
-            const { password, domain, username } = finalProperties;
-            if (password && domain && username) {
-                setDeployPassword(domain, username, password);
+    };
+    const finalize = (props, fields) => {
+        const authMethod = props.authMethod ?? 'basic';
+        const domain = props.domain ?? '';
+        const username = props.username ?? '';
+        const finalProps = {
+            domain,
+            siteName: props.siteName ?? '',
+            addonName: props.addonName ?? '',
+            username,
+            authMethod,
+            useHTTPForDevDeploy: props.useHTTPForDevDeploy ?? false,
+        };
+        if (authMethod === 'oauth2') {
+            finalProps.oauth2 = {
+                authorizationEndpoint: fields.authorizationEndpoint,
+                tokenEndpoint: fields.tokenEndpoint,
+                clientId: fields.clientId,
+                scopes: parseScopes(fields.scopes),
+                ...(initialProperties?.oauth2?.redirectPort && {
+                    redirectPort: initialProperties.oauth2.redirectPort,
+                }),
+            };
+            if (fields.clientSecret && domain && fields.clientId) {
+                setOAuth2ClientSecret(domain, fields.clientId, fields.clientSecret);
             }
-            else if (domain && username) {
-                // Empty password — clear any stale keychain entry so deploy falls through to prompt
-                deleteDeployPassword(domain, username);
+        }
+        else if (authMethod === 'cookie') {
+            if (props.sessionLoginUrl) {
+                finalProps.sessionLoginUrl = props.sessionLoginUrl;
             }
-            writeDevProperties(projectRoot, finalProperties);
-            onComplete();
+        }
+        else if (props.password && domain && username) {
+            setDeployPassword(domain, username, props.password);
+        }
+        else if (domain && username) {
+            // Empty password — clear any stale keychain entry so deploy prompts.
+            deleteDeployPassword(domain, username);
+        }
+        writeDevProperties(projectRoot, finalProps);
+        onComplete();
+    };
+    // Update a top-level DevProperties field, then advance or finalize.
+    const submitProperty = (key, value) => {
+        const next = { ...properties, [key]: value };
+        setProperties(next);
+        if (steps[stepIndex] === steps[steps.length - 1]) {
+            finalize(next, oauth);
+        }
+        else {
+            advance();
+        }
+    };
+    // Update an OAuth field, then advance or finalize.
+    const submitOAuth = (key, value) => {
+        const next = { ...oauth, [key]: value };
+        setOauth(next);
+        if (steps[stepIndex] === steps[steps.length - 1]) {
+            finalize(properties, next);
+        }
+        else {
+            advance();
         }
     };
     const renderInput = () => {
-        switch (currentStep?.id) {
+        switch (currentStep) {
             case 'domain':
-                return (_jsx(TextInput, { label: "Development Domain (e.g. www.sitevision.se)", defaultValue: properties.domain, placeholder: "sitevision.se", onSubmit: (value) => handleNext('domain', value), onCancel: onCancel }, "domain"));
+                return (_jsx(TextInput, { label: "Development Domain (e.g. www.sitevision.se)", defaultValue: properties.domain, placeholder: "sitevision.se", onSubmit: value => submitProperty('domain', value), onCancel: onCancel }, "domain"));
             case 'siteName':
-                return (_jsx(TextInput, { label: "Site Name (Root node name)", defaultValue: properties.siteName, onSubmit: (value) => handleNext('siteName', value), onCancel: onCancel }, "siteName"));
+                return (_jsx(TextInput, { label: "Site Name (Root node name)", defaultValue: properties.siteName, onSubmit: value => submitProperty('siteName', value), onCancel: onCancel }, "siteName"));
             case 'addonName':
-                return (_jsx(TextInput, { label: "Addon Name", defaultValue: properties.addonName, onSubmit: (value) => handleNext('addonName', value), onCancel: onCancel }, "addonName"));
+                return (_jsx(TextInput, { label: "Addon Name", defaultValue: properties.addonName, onSubmit: value => submitProperty('addonName', value), onCancel: onCancel }, "addonName"));
             case 'username':
-                return (_jsx(TextInput, { label: "Username (usually your Sitevision Cloud email)", defaultValue: properties.username, onSubmit: (value) => handleNext('username', value), onCancel: onCancel }, "username"));
+                return (_jsx(TextInput, { label: "Username (usually your Sitevision Cloud email)", defaultValue: properties.username, onSubmit: value => submitProperty('username', value), onCancel: onCancel }, "username"));
+            case 'authMethod':
+                return (_jsx(MethodSelect, { defaultValue: method, onSubmit: value => submitProperty('authMethod', value) }, "authMethod"));
             case 'password':
-                return (_jsx(TextInput, { label: "Password (saved in OS keychain \u2014 leave empty to prompt on each run)", type: "password", defaultValue: properties.password, onSubmit: (value) => handleNext('password', value), onCancel: onCancel }, "password"));
+                return (_jsx(TextInput, { label: "Password (saved in OS keychain \u2014 leave empty to prompt on each run)", type: "password", defaultValue: properties.password, onSubmit: value => submitProperty('password', value), onCancel: onCancel }, "password"));
+            case 'oauthClientId':
+                return (_jsx(TextInput, { label: "OAuth2 Client ID", defaultValue: oauth.clientId, onSubmit: value => submitOAuth('clientId', value), onCancel: onCancel }, "oauthClientId"));
+            case 'oauthAuthEndpoint':
+                return (_jsx(TextInput, { label: "Authorization Endpoint URL", defaultValue: oauth.authorizationEndpoint, onSubmit: value => submitOAuth('authorizationEndpoint', value), onCancel: onCancel }, "oauthAuthEndpoint"));
+            case 'oauthTokenEndpoint':
+                return (_jsx(TextInput, { label: "Token Endpoint URL", defaultValue: oauth.tokenEndpoint, onSubmit: value => submitOAuth('tokenEndpoint', value), onCancel: onCancel }, "oauthTokenEndpoint"));
+            case 'oauthScopes':
+                return (_jsx(TextInput, { label: "Scopes (space-separated, optional)", defaultValue: oauth.scopes, onSubmit: value => submitOAuth('scopes', value), onCancel: onCancel }, "oauthScopes"));
+            case 'oauthClientSecret':
+                return (_jsx(TextInput, { label: "Client Secret (OS keychain \u2014 leave empty for a public/PKCE client)", type: "password", defaultValue: oauth.clientSecret, onSubmit: value => submitOAuth('clientSecret', value), onCancel: onCancel }, "oauthClientSecret"));
+            case 'sessionLoginUrl':
+                return (_jsx(TextInput, { label: "Login URL (opened in a browser; blank = site root)", defaultValue: properties.sessionLoginUrl ??
+                        (properties.domain ? `https://${properties.domain}/` : ''), onSubmit: value => submitProperty('sessionLoginUrl', value), onCancel: onCancel }, "sessionLoginUrl"));
             case 'useHTTP':
-                return (_jsx(BooleanInput, { label: "Use HTTP for deployment? (y/n)", defaultValue: properties.useHTTPForDevDeploy ?? false, onSubmit: (value) => handleNext('useHTTPForDevDeploy', value) }, "useHTTP"));
+                return (_jsx(BooleanInput, { label: "Use HTTP for deployment? (y/n)", defaultValue: properties.useHTTPForDevDeploy ?? false, onSubmit: value => submitProperty('useHTTPForDevDeploy', value) }, "useHTTP"));
             default:
                 return null;
         }
     };
-    return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsxs(Box, { marginBottom: 1, children: [_jsx(Text, { bold: true, color: "cyan", children: "Setup Development Properties" }), _jsxs(Text, { children: [' ', "Step ", stepIndex + 1, " of ", STEPS.length, ": ", currentStep?.label] })] }), _jsx(Box, { marginBottom: 1, children: STEPS.map((s, i) => (_jsx(Box, { marginRight: 1, children: _jsx(Text, { color: i === stepIndex ? 'green' : i < stepIndex ? 'green' : 'gray', children: i < stepIndex ? '✓' : i === stepIndex ? '●' : '○' }) }, s.id))) }), _jsx(Box, { borderStyle: "single", borderColor: "gray", padding: 1, children: renderInput() })] }));
+    return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsxs(Box, { marginBottom: 1, children: [_jsx(Text, { bold: true, color: "cyan", children: "Setup Development Properties" }), _jsxs(Text, { children: [' ', "Step ", stepIndex + 1, " of ", steps.length, ":", ' ', currentStep ? LABELS[currentStep] : ''] })] }), isOAuth && (_jsx(Box, { marginBottom: 1, children: _jsxs(Text, { dimColor: true, children: ["Whitelist this redirect URI on the OAuth2 client: http://127.0.0.1:", redirectPort, "/callback"] }) })), _jsx(Box, { marginBottom: 1, children: steps.map((s, i) => (_jsx(Box, { marginRight: 1, children: _jsx(Text, { color: i <= stepIndex ? 'green' : 'gray', children: i < stepIndex ? '✓' : i === stepIndex ? '●' : '○' }) }, s))) }), _jsx(Box, { borderStyle: "single", borderColor: "gray", padding: 1, children: renderInput() })] }));
+}
+function MethodSelect({ defaultValue, onSubmit, }) {
+    const [index, setIndex] = useState(() => Math.max(0, AUTH_METHODS.findIndex(m => m.value === defaultValue)));
+    useInput((_input, key) => {
+        if (key.upArrow) {
+            setIndex(p => (p === 0 ? AUTH_METHODS.length - 1 : p - 1));
+        }
+        else if (key.downArrow) {
+            setIndex(p => (p === AUTH_METHODS.length - 1 ? 0 : p + 1));
+        }
+        else if (key.return) {
+            onSubmit(AUTH_METHODS[index].value);
+        }
+    });
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsx(Box, { marginBottom: 1, children: _jsx(Text, { bold: true, color: "cyan", children: "Authentication method" }) }), AUTH_METHODS.map((m, i) => (_jsxs(Text, { color: i === index ? 'green' : undefined, children: [i === index ? '❯ ' : '  ', m.label] }, m.value))), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: "\u2191/\u2193 to move, Enter to select" }) })] }));
 }
 function BooleanInput({ label, defaultValue, onSubmit, }) {
     useInput(input => {

package/dist/components/SetupFlow.js

@@ -1,7 +1,7 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { useState, useEffect } from 'react';
 import { Box, Text, useInput } from 'ink';
-import { getAppType, localizedText, migrateLegacyPassword, getPackageJsonSyncChanges, syncDevPropertiesToPackageJson, readSvcConfig, writeSvcConfig, } from '../utils/project-detection.js';
+import { getAppType, localizedText, migrateLegacyPassword, getPackageJsonSyncChanges, syncDevPropertiesToPackageJson, readSvcConfig, writeSvcConfig, writeDevProperties, } from '../utils/project-detection.js';
 import { ProcessRunner } from '../utils/process-runner.js';
 import { ProcessOutputComponent } from './ProcessOutput.js';
 import { StatusIndicator } from './StatusIndicator.js';
@@ -13,6 +13,9 @@ export function SetupFlow({ project, onReload, onComplete }) {
     const [commandStatus, setCommandStatus] = useState('running');
     const [syncChanges, setSyncChanges] = useState([]);
     const [syncDecision, setSyncDecision] = useState(false);
+    // Set when the user picks OAuth2 for an existing config, so the form opens in
+    // the OAuth2 branch without mutating the shared project object.
+    const [pendingAuthMethod, setPendingAuthMethod] = useState(undefined);
     const appType = getAppType(project.manifest);
     // Auto-advance through checks
     useEffect(() => {
@@ -29,6 +32,9 @@ export function SetupFlow({ project, onReload, onComplete }) {
                 if (project.hasLegacyPassword) {
                     setStep('confirm-password-migration');
                 }
+                else if (project.devProperties?.authMethod === undefined) {
+                    setStep('confirm-auth-method');
+                }
                 else {
                     setStep('check-package-sync');
                 }
@@ -142,10 +148,33 @@ export function SetupFlow({ project, onReload, onComplete }) {
                 setStep('show-info');
             }
         }
+        else if (step === 'confirm-auth-method') {
+            if (input === 'o' || input === 'O') {
+                // Choosing OAuth2 needs endpoints — collect them in the full form.
+                setPendingAuthMethod('oauth2');
+                setStep('setup-dev-properties');
+            }
+            else if (input === 'c' || input === 'C') {
+                setPendingAuthMethod('cookie');
+                setStep('setup-dev-properties');
+            }
+            else if (['b', 'B', '\r'].includes(input)) {
+                if (project.devProperties) {
+                    writeDevProperties(project.root, {
+                        ...project.devProperties,
+                        authMethod: 'basic',
+                    });
+                    onReload();
+                }
+                setStep('check-package-sync');
+            }
+        }
     });
     // Setup Dev Properties Form
     if (step === 'setup-dev-properties') {
-        return (_jsx(DevPropertiesForm, { projectRoot: project.root, initialProperties: project.devProperties, packageJson: project.packageJson, onComplete: () => {
+        return (_jsx(DevPropertiesForm, { projectRoot: project.root, initialProperties: pendingAuthMethod && project.devProperties
+                ? { ...project.devProperties, authMethod: pendingAuthMethod }
+                : project.devProperties, packageJson: project.packageJson, onComplete: () => {
                 // Re-detect from disk/keychain so devProperties (incl. the keychain
                 // password) populate in memory — otherwise the rest of this flow and
                 // the menu would see stale state until the CLI is restarted.
@@ -178,6 +207,10 @@ export function SetupFlow({ project, onReload, onComplete }) {
     if (step === 'confirm-password-migration') {
         return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(Text, { bold: true, color: "cyan", children: "Sitevision CLI" }) }), _jsx(Box, { marginBottom: 1, children: _jsx(Text, { color: "yellow", children: "\u26A0 Plaintext password found in .dev_properties.json" }) }), _jsxs(Box, { marginBottom: 1, flexDirection: "column", children: [_jsx(Text, { children: "Move it to the OS keychain and remove it from the file? (y/n)" }), _jsx(Text, { dimColor: true, children: "Recommended \u2014 storing passwords in project files is insecure." })] })] }));
     }
+    // Ask which auth method an existing config should use (setting is missing)
+    if (step === 'confirm-auth-method') {
+        return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(Text, { bold: true, color: "cyan", children: "Sitevision CLI" }) }), _jsx(Box, { marginBottom: 1, children: _jsx(Text, { color: "yellow", children: "\u26A0 Deploy authentication method not set" }) }), _jsxs(Box, { marginBottom: 1, flexDirection: "column", children: [_jsx(Text, { children: "Which method should deploys use? [B]asic / [O]Auth2 / [C]ookie" }), _jsx(Text, { dimColor: true, children: "B = Basic (default), O = OAuth2 bearer, C = session cookie (SSO)." })] })] }));
+    }
     // Confirm package.json sync
     if (step === 'confirm-package-sync') {
         return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(Text, { bold: true, color: "cyan", children: "Sitevision CLI" }) }), _jsx(Box, { marginBottom: 1, children: _jsx(Text, { color: "yellow", children: "\u26A0 package.json is out of sync with .dev_properties.json" }) }), _jsx(Box, { marginBottom: 1, flexDirection: "column", marginLeft: 2, children: syncChanges.map(change => (_jsxs(Box, { children: [_jsx(Text, { color: change.from === undefined ? 'green' : 'yellow', children: change.from === undefined ? '+ ' : '~ ' }), _jsxs(Text, { bold: true, children: [change.key, ": "] }), change.from !== undefined && (_jsxs(Text, { dimColor: true, children: [change.from, " \u2192 "] })), _jsx(Text, { children: change.to })] }, change.key))) }), _jsxs(Box, { marginBottom: 1, flexDirection: "column", children: [_jsx(Text, { children: "Update package.json from .dev_properties.json? (y/n)" }), _jsx(Text, { dimColor: true, children: "sitevision-scripts reads these fields from package.json." })] })] }));

package/dist/types/index.d.ts

@@ -48,6 +48,24 @@ export interface DevProperties {
     useHTTPForDevDeploy?: boolean;
     signingUsername?: string;
     certificateName?: string;
+    authMethod?: 'basic' | 'oauth2' | 'cookie';
+    oauth2?: OAuth2Config;
+    sessionLoginUrl?: string;
+    accessToken?: string;
+    sessionCookie?: string;
+}
+/**
+ * OAuth2 provider config for bearer-token deploys.
+ *
+ * Deliberately secret-free: the client secret and refresh token live in the OS
+ * keychain, so nothing here is unsafe to write to .dev_properties.json.
+ */
+export interface OAuth2Config {
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    clientId: string;
+    scopes?: string[];
+    redirectPort?: number;
 }
 /**
  * Signing credentials (password is runtime-only, not persisted)
@@ -65,7 +83,9 @@ export interface DeployConfig {
     siteName: string;
     addonName: string;
     username: string;
-    password: string;
+    password?: string;
+    accessToken?: string;
+    sessionCookie?: string;
     useHTTP?: boolean;
 }
 /**
@@ -149,6 +169,7 @@ export interface DeployResponse {
     executableId?: string;
     message?: string;
     error?: string;
+    authExpired?: boolean;
 }
 /**
  * API response from addon creation
@@ -157,6 +178,7 @@ export interface CreateAddonResponse {
     success: boolean;
     addonId?: string;
     error?: string;
+    authExpired?: boolean;
 }
 /**
  * API response from activation
@@ -164,6 +186,7 @@ export interface CreateAddonResponse {
 export interface ActivationResponse {
     success: boolean;
     error?: string;
+    authExpired?: boolean;
 }
 /**
  * Build mode

package/dist/utils/keychain.d.ts

@@ -4,3 +4,12 @@ export declare function deleteDeployPassword(domain: string, username: string):
 export declare function getSigningPassword(username: string): string | null;
 export declare function setSigningPassword(username: string, password: string): boolean;
 export declare function deleteSigningPassword(username: string): void;
+export declare function getOAuth2RefreshToken(domain: string, clientId: string): string | null;
+export declare function setOAuth2RefreshToken(domain: string, clientId: string, token: string): boolean;
+export declare function deleteOAuth2RefreshToken(domain: string, clientId: string): void;
+export declare function getOAuth2ClientSecret(domain: string, clientId: string): string | null;
+export declare function setOAuth2ClientSecret(domain: string, clientId: string, secret: string): boolean;
+export declare function deleteOAuth2ClientSecret(domain: string, clientId: string): void;
+export declare function getSessionCookie(domain: string, username: string): string | null;
+export declare function setSessionCookie(domain: string, username: string, cookie: string): boolean;
+export declare function deleteSessionCookie(domain: string, username: string): void;