PER-16377: retire the eu region in the CLI

[EliMoshkovich]

Permit's EU region was torn down on 2026-09-28 (PER-16073 / PER-16377). All customers are on the US region, and every EU host (api.eu, app.eu, cloudpdp and pdp-statistics under eu-central-1) is gone. This removes eu from the CLI.

What changed

• source/config.ts: PermitRegion is now just 'us' and the EU URL mappings are removed. The URL getters return the same US URLs as before. Each getter checks the configured region first and throws RetiredRegionError if it is eu (case-insensitive), so no URL, and so no request, can be built for it.
• The unused CLOUD_PDP_URL / PERMIT_API_URL / ... constants computed at import time are removed. Their three callers (facts API, pdp run config fetch, pdp stats) now use the getters. The values are the same.
• login: --region only documents us. --region eu prints the retirement message and exits 1 before the login flow starts.
• AuthProvider: it used to swallow every loadRegion() failure and continue as US. Keychain read errors are still ignored, as before. A stored eu now stops with the error instead of going to the login flow or to US. This covers both the stored-token path and the --api-key path.
• cli.tsx: PERMIT_REGION=eu is rejected at startup, before any command runs.
• README: the EU examples are removed, and there is a short note on how to recover.
• Terraform generators: they already get api_url from getPermitApiUrl() and had no EU values of their own, so they need no code change. They now always emit https://api.permit.io, or fail for eu.

What users with eu saved will see

The Permit EU region was retired on 2026-09-28 and its endpoints no longer exist. All Permit accounts are now served from the US region. Unset PERMIT_REGION if it is set to "eu", then run `permit logout` and `permit login` (without --region, or with --region us) to log in again.

The CLI then exits with code 1. permit logout clears the stored region, as before. It is only blocked if PERMIT_REGION=eu is still set in the environment, and the message covers that case.

Testing

• npm run build, npm run lint (0 errors; the 8 warnings are all in files and lines this PR doesn't touch), npm run test:ts, and npm run test all pass: 117 files, 690 tests.
• The tests that asserted EU URLs (tests/lib/config.test.ts, client-region.test.ts, auth-oauth-region.test.ts, auth.test.ts) are replaced. They now check that every getter returns the US URL, that eu throws in every getter, that useClient and browserAuth fail without calling createClient or opening the browser, and that a stored eu is rejected by loadRegion.
• New tests/components/AuthProviderRetiredRegion.test.tsx: with eu in the keychain, both the stored-token and --api-key paths show the error, never call fetch and exit 1, and a stored us still reaches https://api.permit.io. I checked that these tests fail against the old AuthProvider.
• New tests/loginRetiredRegion.test.tsx: login --region eu shows the error, makes no request and writes nothing to the keychain.
• I also ran the built CLI by hand. PERMIT_REGION=eu permit env export terraform, PERMIT_REGION=eu permit logout and permit login --region eu all print the message and exit 1.

🤖 Generated with Claude Code

[linear-code]

PER-16377

PER-16483

PER-16485

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.