ts-prorm-orm 1.1.0 → 1.2.0

package/dist/cli/cloud.js

@@ -0,0 +1,318 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NetworkError = exports.AuthError = exports.ApiError = void 0;
+exports.configPath = configPath;
+exports.loadConfig = loadConfig;
+exports.saveConfig = saveConfig;
+exports.updateConfig = updateConfig;
+exports.storeToken = storeToken;
+exports.clearAuth = clearAuth;
+exports.requireAuth = requireAuth;
+exports.api = api;
+// Shared state + transport for the cloud/account CLI commands. Config lives at
+// ~/.prorm/config.json (overridable via PRORM_CONFIG or --config; profiles via
+// --profile / PRORM_PROFILE). Commands authenticate against the dashboard API
+// (the Next.js app), which brokers AWS Secrets Manager (the vault), the S3
+// bucket, and the connected-database registry.
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const framework_1 = require("./framework");
+const keychain = __importStar(require("./keychain"));
+const DEFAULT_API = process.env.PRORM_API_URL || 'https://docs-next-alpha.vercel.app';
+/** CLI version, best-effort, for the User-Agent header. */
+function cliVersion() {
+    for (const rel of ['../package.json', '../../package.json']) {
+        try {
+            const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, rel), 'utf8'));
+            if (pkg.version)
+                return pkg.version;
+        }
+        catch {
+            // try next
+        }
+    }
+    return '0.0.0';
+}
+/** Active profile name from --profile or PRORM_PROFILE (undefined = default). */
+function activeProfile() {
+    return (0, framework_1.getGlobalOptions)().profile || process.env.PRORM_PROFILE || undefined;
+}
+function configPath() {
+    const override = (0, framework_1.getGlobalOptions)().configPath || process.env.PRORM_CONFIG;
+    if (override)
+        return override;
+    const profile = activeProfile();
+    const file = profile ? `config.${profile}.json` : 'config.json';
+    return path.join(os.homedir(), '.prorm', file);
+}
+function loadConfig() {
+    let cfg = {};
+    try {
+        cfg = JSON.parse(fs.readFileSync(configPath(), 'utf8'));
+    }
+    catch {
+        cfg = {};
+    }
+    const merged = { ...cfg, apiUrl: cfg.apiUrl || DEFAULT_API };
+    // Pull the token out of the OS keychain when it lives there.
+    if (merged.tokenInKeychain && !merged.token) {
+        const kc = keychain.getToken();
+        if (kc)
+            merged.token = kc;
+    }
+    // Per-invocation overrides (flags/env) win over the stored file.
+    const g = (0, framework_1.getGlobalOptions)();
+    if (g.apiUrl)
+        merged.apiUrl = g.apiUrl;
+    if (g.team)
+        merged.teamSlug = g.team;
+    return merged;
+}
+function saveConfig(cfg) {
+    const p = configPath();
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    // Never persist the raw token to disk when a keychain is holding it.
+    const toWrite = { ...cfg };
+    if (cfg.tokenInKeychain)
+        delete toWrite.token;
+    fs.writeFileSync(p, JSON.stringify(toWrite, null, 2), { mode: 0o600 });
+}
+function updateConfig(patch) {
+    const next = { ...loadConfig(), ...patch };
+    saveConfig(next);
+    return next;
+}
+/**
+ * Store the access token, preferring the OS keychain. Returns whether the
+ * keychain was used (false = written to the config file as a fallback).
+ */
+function storeToken(token, extra = {}) {
+    const inKeychain = keychain.isAvailable() && keychain.setToken(token);
+    const patch = { ...extra, tokenInKeychain: inKeychain };
+    if (inKeychain)
+        patch.token = undefined;
+    else
+        patch.token = token;
+    updateConfig(patch);
+    return inKeychain;
+}
+function clearAuth() {
+    keychain.deleteToken();
+    const cfg = loadConfig();
+    delete cfg.token;
+    delete cfg.refreshToken;
+    delete cfg.tokenInKeychain;
+    delete cfg.user;
+    saveConfig(cfg);
+}
+function requireAuth() {
+    const cfg = loadConfig();
+    if (!cfg.token) {
+        throw new AuthError('Not authenticated. Run `orm-cli auth login` first.');
+    }
+    return cfg;
+}
+// ─── Typed transport errors ────────────────────────────────────────────────────
+class ApiError extends Error {
+    constructor(message, status, details) {
+        super(message);
+        this.status = status;
+        this.details = details;
+    }
+}
+exports.ApiError = ApiError;
+class AuthError extends ApiError {
+    constructor(message) {
+        super(message, 401);
+    }
+}
+exports.AuthError = AuthError;
+class NetworkError extends Error {
+    constructor() {
+        super(...arguments);
+        this.code = 'ENETWORK';
+    }
+}
+exports.NetworkError = NetworkError;
+// ─── Proxy support ─────────────────────────────────────────────────────────────
+// Best-effort: route requests through HTTP(S)_PROXY when undici's ProxyAgent is
+// available. NO_PROXY hosts bypass the proxy. Silently no-ops if unavailable.
+let proxyDispatcher;
+let proxyResolved = false;
+function noProxyMatch(host) {
+    const list = (process.env.NO_PROXY || process.env.no_proxy || '')
+        .split(',')
+        .map((s) => s.trim().toLowerCase())
+        .filter(Boolean);
+    if (list.includes('*'))
+        return true;
+    return list.some((entry) => host === entry || host.endsWith(entry.replace(/^\./, '.')) || host.endsWith(entry));
+}
+function dispatcherFor(url) {
+    const proxy = url.protocol === 'https:'
+        ? process.env.HTTPS_PROXY || process.env.https_proxy || process.env.ALL_PROXY
+        : process.env.HTTP_PROXY || process.env.http_proxy || process.env.ALL_PROXY;
+    if (!proxy || noProxyMatch(url.hostname.toLowerCase()))
+        return undefined;
+    if (!proxyResolved) {
+        proxyResolved = true;
+        try {
+            // undici ships with Node 18+; require lazily so environments without it
+            // (or without a proxy set) pay nothing.
+            const { ProxyAgent } = require('undici');
+            proxyDispatcher = new ProxyAgent(proxy);
+        }
+        catch {
+            proxyDispatcher = undefined;
+        }
+    }
+    return proxyDispatcher;
+}
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const RETRYABLE = new Set([429, 500, 502, 503, 504]);
+function defaultTimeoutMs() {
+    const g = (0, framework_1.getGlobalOptions)();
+    return g.timeoutSec && g.timeoutSec > 0 ? g.timeoutSec * 1000 : 30000;
+}
+/** Call the dashboard API with timeout, retry/backoff, and typed errors. */
+async function api(pathname, opts = {}) {
+    const cfg = loadConfig();
+    const auth = opts.auth !== false;
+    const token = opts.token ?? cfg.token;
+    if (auth && !token)
+        throw new AuthError('Not authenticated. Run `orm-cli auth login`.');
+    const url = new URL(pathname.replace(/^\//, ''), cfg.apiUrl.replace(/\/?$/, '/'));
+    for (const [k, v] of Object.entries(opts.query ?? {})) {
+        if (v !== undefined)
+            url.searchParams.set(k, String(v));
+    }
+    const timeoutMs = opts.timeoutMs ?? defaultTimeoutMs();
+    const maxRetries = opts.retries ?? 3;
+    const method = opts.method ?? 'GET';
+    const dispatcher = dispatcherFor(url);
+    const debug = Boolean(process.env.PRORM_DEBUG) || (0, framework_1.getGlobalOptions)().verbose;
+    let lastErr;
+    for (let attempt = 0; attempt <= maxRetries; attempt++) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+        if (debug)
+            console.error(`[http] ${method} ${url}${attempt ? ` (retry ${attempt})` : ''}`);
+        try {
+            const res = await fetch(url, {
+                method,
+                headers: {
+                    'content-type': 'application/json',
+                    'user-agent': `prorm-cli/${cliVersion()} (${process.platform}; node/${process.versions.node})`,
+                    ...(auth && token ? { authorization: `Bearer ${token}` } : {}),
+                },
+                body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,
+                signal: controller.signal,
+                ...(dispatcher ? { dispatcher } : {}),
+            });
+            clearTimeout(timer);
+            if (RETRYABLE.has(res.status) && attempt < maxRetries) {
+                const retryAfter = Number(res.headers.get('retry-after'));
+                const backoff = Number.isFinite(retryAfter) && retryAfter > 0
+                    ? retryAfter * 1000
+                    : Math.min(8000, 2 ** attempt * 500) + Math.random() * 250;
+                if (debug)
+                    console.error(`[http] ${res.status}; retrying in ${Math.round(backoff)}ms`);
+                await sleep(backoff);
+                continue;
+            }
+            const text = await res.text();
+            const data = text ? safeJson(text) : undefined;
+            if (!res.ok) {
+                throw toApiError(method, pathname, res.status, res.statusText, data);
+            }
+            return data;
+        }
+        catch (err) {
+            clearTimeout(timer);
+            if (err instanceof ApiError)
+                throw err; // Non-retryable HTTP error.
+            lastErr = err;
+            // Abort (timeout) or network failure — retry with backoff if we can.
+            if (attempt < maxRetries) {
+                await sleep(Math.min(8000, 2 ** attempt * 500) + Math.random() * 250);
+                continue;
+            }
+        }
+    }
+    throw translateNetworkError(lastErr, url, timeoutMs);
+}
+function toApiError(method, pathname, status, statusText, data) {
+    const body = data;
+    let msg = body?.error || body?.message || `${status} ${statusText}`;
+    const details = body?.details ?? body?.errors;
+    if (details) {
+        try {
+            msg += ` — ${typeof details === 'string' ? details : JSON.stringify(details)}`;
+        }
+        catch {
+            // ignore stringify failure
+        }
+    }
+    if (status === 401) {
+        return new AuthError(`Authentication failed (${msg}). Your session may have expired — run \`orm-cli auth login\` again.`);
+    }
+    const full = `API ${method} ${pathname} failed: ${msg}`;
+    return new ApiError(full, status, details);
+}
+function translateNetworkError(err, url, timeoutMs) {
+    const e = err;
+    if (e?.name === 'AbortError') {
+        return new NetworkError(`Request to ${url.host} timed out after ${Math.round(timeoutMs / 1000)}s.`);
+    }
+    const code = e?.code || e?.cause?.code;
+    if (code === 'ENOTFOUND' || code === 'EAI_AGAIN') {
+        return new NetworkError(`Cannot reach ${url.host} — you appear to be offline or the host is wrong.`);
+    }
+    if (code === 'ECONNREFUSED') {
+        return new NetworkError(`Connection to ${url.host} was refused. Is the API URL correct?`);
+    }
+    const msg = err instanceof Error ? err.message : String(err);
+    return new NetworkError(`Network request to ${url.host} failed: ${msg}`);
+}
+function safeJson(s) {
+    try {
+        return JSON.parse(s);
+    }
+    catch {
+        return s;
+    }
+}

package/dist/cli/commands/auth.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from '../framework';
+export declare const commands: Command[];

package/dist/cli/commands/auth.js

@@ -0,0 +1,345 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.commands = void 0;
+// Auth command module for the prorm CLI. Authenticates the CLI against the
+// dashboard API using a pasted access token or the browser OAuth device flow,
+// and manages the stored session. Tokens are kept in the OS keychain when one
+// is available (see ../keychain), otherwise in the 0600 config file.
+const child_process_1 = require("child_process");
+const framework_1 = require("../framework");
+const cloud_1 = require("../cloud");
+const prompt_1 = require("../prompt");
+const io_1 = require("../io");
+const keychain = __importStar(require("../keychain"));
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** Best-effort open a URL in the user's browser; failures are ignored. */
+function openBrowser(url) {
+    try {
+        const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'cmd' : 'xdg-open';
+        const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
+        const child = (0, child_process_1.spawn)(cmd, args, { detached: true, stdio: 'ignore' });
+        child.unref();
+    }
+    catch {
+        // Ignore — the user can open the URL manually.
+    }
+}
+/** Persist the token (keychain-preferred) plus optional refresh token + team. */
+async function finishLogin(accessToken, refreshToken, team) {
+    const inKeychain = (0, cloud_1.storeToken)(accessToken, refreshToken ? { refreshToken } : {});
+    const user = await (0, cloud_1.api)('/api/cli/auth/whoami', { token: accessToken });
+    (0, cloud_1.updateConfig)({ user });
+    framework_1.out.success(`Logged in as ${user.email}`);
+    if (inKeychain)
+        framework_1.out.dim('Token stored in the OS keychain.');
+    if (team) {
+        (0, cloud_1.updateConfig)({ teamSlug: team });
+        framework_1.out.info(`Default team set to ${team}`);
+    }
+}
+const login = (0, framework_1.defineCommand)({
+    name: 'auth login',
+    description: 'Authenticate the CLI with a dashboard access token.',
+    group: 'Auth',
+    flags: [
+        { name: 'token', alias: 't', type: 'string', description: 'Paste a dashboard access token (omit the value to be prompted).' },
+        { name: 'api-url', type: 'string', description: 'Override the API base URL.' },
+        { name: 'team', type: 'string', description: 'Default team slug.' },
+        { name: 'browser', type: 'boolean', default: true, description: 'Auto-open the browser (use --no-browser to skip).' },
+    ],
+    examples: [
+        'orm-cli auth login',
+        'orm-cli auth login --no-browser',
+        'orm-cli auth login --token <token>',
+        'orm-cli auth login -t <token> --team acme',
+        'orm-cli auth login --api-url https://app.prorm.dev -t <token>',
+    ],
+    run: async (ctx) => {
+        const apiUrl = ctx.flags['api-url'];
+        if (typeof apiUrl === 'string' && apiUrl) {
+            (0, cloud_1.updateConfig)({ apiUrl });
+        }
+        const team = typeof ctx.flags.team === 'string' && ctx.flags.team ? ctx.flags.team : undefined;
+        // Token flow: either a value was passed, or --token was given without one
+        // (or PRORM env) so we prompt for it hidden rather than take it on argv.
+        let token = typeof ctx.flags.token === 'string' ? ctx.flags.token : undefined;
+        if (ctx.flags.token !== undefined && !token) {
+            token = await (0, prompt_1.promptHidden)('Access token: ');
+        }
+        if (token) {
+            await finishLogin(token, undefined, team);
+            return 0;
+        }
+        // Browser OAuth device flow.
+        const device = await (0, cloud_1.api)('/api/cli/auth/device', { method: 'POST', auth: false });
+        framework_1.out.info(`To sign in, visit ${device.verification_uri} and enter code: ${device.user_code}`);
+        framework_1.out.dim(device.verification_uri_complete);
+        if (ctx.flags.browser !== false) {
+            openBrowser(device.verification_uri_complete);
+        }
+        let intervalMs = (device.interval && device.interval > 0 ? device.interval : 5) * 1000;
+        const deadline = Date.now() + (device.expires_in && device.expires_in > 0 ? device.expires_in : 300) * 1000;
+        const spin = (0, io_1.spinner)('Waiting for you to authorize in the browser…');
+        let accessToken;
+        let refreshToken;
+        try {
+            while (Date.now() < deadline) {
+                await sleep(intervalMs);
+                try {
+                    const res = await (0, cloud_1.api)('/api/cli/auth/token', {
+                        method: 'POST',
+                        auth: false,
+                        body: { device_code: device.device_code },
+                    });
+                    if (res && res.access_token) {
+                        accessToken = res.access_token;
+                        refreshToken = res.refresh_token;
+                        break;
+                    }
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    if (msg.includes('slow_down')) {
+                        // OAuth back-pressure: lengthen the poll interval and keep going.
+                        intervalMs += 5000;
+                        continue;
+                    }
+                    if (msg.includes('authorization_pending')) {
+                        continue; // Keep polling — the user hasn't approved yet.
+                    }
+                    if (msg.includes('expired_token')) {
+                        spin.stop();
+                        framework_1.out.error('The login request expired. Please run `orm-cli auth login` again.');
+                        return 1;
+                    }
+                    if (msg.includes('access_denied')) {
+                        spin.stop();
+                        framework_1.out.error('Login was denied.');
+                        return 1;
+                    }
+                    throw err;
+                }
+            }
+        }
+        finally {
+            spin.stop();
+        }
+        if (!accessToken) {
+            framework_1.out.error('The login request timed out. Please run `orm-cli auth login` again.');
+            return 1;
+        }
+        await finishLogin(accessToken, refreshToken, team);
+        return 0;
+    },
+});
+const logout = (0, framework_1.defineCommand)({
+    name: 'auth logout',
+    description: 'Clear the stored CLI credentials and revoke the session server-side.',
+    group: 'Auth',
+    flags: [{ name: 'local', type: 'boolean', description: 'Only clear locally; do not revoke server-side.' }],
+    examples: ['orm-cli auth logout', 'orm-cli auth logout --local'],
+    run: async (ctx) => {
+        const cfg = (0, cloud_1.loadConfig)();
+        if (ctx.flags.local !== true && cfg.token) {
+            try {
+                await (0, cloud_1.api)('/api/cli/auth/revoke', { method: 'POST', body: { token: cfg.token } });
+                framework_1.out.dim('Session revoked server-side.');
+            }
+            catch {
+                framework_1.out.warn('Could not revoke the session server-side (continuing to clear it locally).');
+            }
+        }
+        (0, cloud_1.clearAuth)();
+        framework_1.out.success('Logged out.');
+        return 0;
+    },
+});
+const whoami = (0, framework_1.defineCommand)({
+    name: 'auth whoami',
+    description: 'Show the authenticated user, verified against the API.',
+    group: 'Auth',
+    flags: [
+        { name: 'json', type: 'boolean', description: 'Output raw JSON.' },
+        { name: 'offline', type: 'boolean', description: 'Print the cached user without calling the API.' },
+    ],
+    examples: ['orm-cli auth whoami', 'orm-cli auth whoami --offline', 'orm-cli auth whoami --json'],
+    run: async (ctx) => {
+        const cfg = (0, cloud_1.loadConfig)();
+        if (ctx.flags.offline) {
+            if (!cfg.user) {
+                framework_1.out.warn('No cached user. Run `orm-cli auth whoami` online first.');
+                return 1;
+            }
+            if (ctx.flags.json) {
+                framework_1.out.json(cfg.user);
+                return 0;
+            }
+            framework_1.out.info(`Email: ${cfg.user.email}`);
+            if (cfg.user.name)
+                framework_1.out.info(`Name:  ${cfg.user.name}`);
+            framework_1.out.info(`ID:    ${cfg.user.id}`);
+            return 0;
+        }
+        const user = await (0, cloud_1.api)('/api/cli/auth/whoami');
+        if (ctx.flags.json) {
+            framework_1.out.json(user);
+            return 0;
+        }
+        framework_1.out.info(`Email: ${user.email}`);
+        if (user.name)
+            framework_1.out.info(`Name:  ${user.name}`);
+        framework_1.out.info(`ID:    ${user.id}`);
+        framework_1.out.info(`Team:  ${cfg.teamSlug ?? '(none)'}`);
+        return 0;
+    },
+});
+const status = (0, framework_1.defineCommand)({
+    name: 'auth status',
+    description: 'Show the local CLI configuration and verify the session.',
+    group: 'Auth',
+    flags: [
+        { name: 'json', type: 'boolean', description: 'Output raw JSON.' },
+        { name: 'no-verify', type: 'boolean', description: 'Skip the live token-validity check.' },
+    ],
+    examples: ['orm-cli auth status', 'orm-cli auth status --no-verify', 'orm-cli auth status --json'],
+    run: async (ctx) => {
+        const cfg = (0, cloud_1.loadConfig)();
+        // Verify the token against the API unless asked not to, so a revoked/expired
+        // token is reported as invalid rather than "present".
+        let valid;
+        if (cfg.token && ctx.flags['no-verify'] !== true) {
+            try {
+                await (0, cloud_1.api)('/api/cli/auth/whoami');
+                valid = true;
+            }
+            catch {
+                valid = false;
+            }
+        }
+        if (ctx.flags.json) {
+            framework_1.out.json({
+                apiUrl: cfg.apiUrl,
+                authenticated: Boolean(cfg.token),
+                tokenValid: valid,
+                tokenStorage: cfg.tokenInKeychain ? 'keychain' : cfg.token ? 'file' : null,
+                user: cfg.user?.email,
+                team: cfg.teamSlug,
+            });
+            return valid === false ? 3 : 0;
+        }
+        framework_1.out.info(`API URL:       ${cfg.apiUrl}`);
+        framework_1.out.info(`Token present: ${cfg.token ? 'yes' : 'no'}`);
+        if (cfg.token)
+            framework_1.out.info(`Token storage: ${cfg.tokenInKeychain ? 'OS keychain' : 'config file'}`);
+        if (valid !== undefined)
+            framework_1.out.info(`Token valid:   ${valid ? 'yes' : 'no (expired or revoked)'}`);
+        framework_1.out.info(`User:          ${cfg.user?.email ?? '(none)'}`);
+        framework_1.out.info(`Team:          ${cfg.teamSlug ?? '(none)'}`);
+        return valid === false ? 3 : 0;
+    },
+});
+const refresh = (0, framework_1.defineCommand)({
+    name: 'auth refresh',
+    description: 'Refresh the access token using the stored refresh token.',
+    group: 'Auth',
+    examples: ['orm-cli auth refresh'],
+    run: async () => {
+        const cfg = (0, cloud_1.loadConfig)();
+        if (!cfg.refreshToken) {
+            framework_1.out.error('No refresh token stored. Run `orm-cli auth login` to re-authenticate.');
+            return 1;
+        }
+        const res = await (0, cloud_1.api)('/api/cli/auth/token', {
+            method: 'POST',
+            auth: false,
+            body: { grant_type: 'refresh_token', refresh_token: cfg.refreshToken },
+        });
+        if (!res.access_token) {
+            framework_1.out.error('Refresh failed. Run `orm-cli auth login` to re-authenticate.');
+            return 1;
+        }
+        (0, cloud_1.storeToken)(res.access_token, res.refresh_token ? { refreshToken: res.refresh_token } : {});
+        framework_1.out.success('Access token refreshed.');
+        return 0;
+    },
+});
+const token = (0, framework_1.defineCommand)({
+    name: 'auth token',
+    description: 'Print or set the stored access token.',
+    group: 'Auth',
+    flags: [
+        { name: 'set', type: 'string', description: 'Store a new access token (omit the value to be prompted).' },
+        { name: 'reveal', type: 'boolean', description: 'Print the full token (otherwise it is confirmed/masked).' },
+    ],
+    examples: ['orm-cli auth token --reveal', 'orm-cli auth token --set <token>'],
+    run: async (ctx) => {
+        if (ctx.flags.set !== undefined) {
+            let value = typeof ctx.flags.set === 'string' ? ctx.flags.set : '';
+            if (!value)
+                value = await (0, prompt_1.promptHidden)('Access token: ');
+            if (!value) {
+                framework_1.out.error('No token provided.');
+                return 1;
+            }
+            const inKeychain = (0, cloud_1.storeToken)(value);
+            framework_1.out.success(inKeychain ? 'Token stored in the OS keychain.' : 'Token stored.');
+            return 0;
+        }
+        const cfg = (0, cloud_1.loadConfig)();
+        if (!cfg.token) {
+            framework_1.out.warn('No token stored. Run `orm-cli auth login` first.');
+            return 1;
+        }
+        // Printing the full secret leaks into scrollback — guard it behind --reveal
+        // plus an interactive confirmation (or --yes).
+        if (ctx.flags.reveal) {
+            const g = (0, framework_1.getGlobalOptions)();
+            const ok = await (0, prompt_1.confirm)('Print the full access token to stdout?', { assumeYes: g.assumeYes, default: false });
+            if (!ok) {
+                framework_1.out.warn('Aborted.');
+                return 1;
+            }
+            framework_1.out.info(cfg.token);
+            return 0;
+        }
+        const t = cfg.token;
+        const masked = t.length <= 8 ? '*'.repeat(t.length) : `${t.slice(0, 4)}…${t.slice(-4)}`;
+        framework_1.out.info(masked);
+        framework_1.out.dim(`Stored in ${keychain.isAvailable() && cfg.tokenInKeychain ? 'the OS keychain' : 'the config file'}. Use --reveal to print the full token.`);
+        return 0;
+    },
+});
+exports.commands = [login, logout, whoami, status, refresh, token];

package/dist/cli/commands/billing.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from '../framework';
+export declare const commands: Command[];