@bctrl/cli 0.1.5 → 0.1.7

package/dist/config/config.d.ts

@@ -1,4 +1,4 @@
-import { type StoredAuth } from './auth-store.js';
+import { type StoredCredential } from './auth-store.js';
 export type TokenSource = 'BCTRL_API_KEY' | 'stored' | 'none';
 export type ActiveToken = {
     token: string;
@@ -7,6 +7,6 @@ export type ActiveToken = {
 export type BctrlConfig = {
     apiBaseUrl: string;
     activeToken: ActiveToken | null;
-    storedAuth: StoredAuth | null;
+    storedAuth: StoredCredential | null;
 };
 export declare function loadConfig(env?: NodeJS.ProcessEnv): Promise<BctrlConfig>;

package/dist/config/config.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { readStoredAuth } from './auth-store.js';
+import { loadCredential, normalizeApiBaseUrl } from './auth-store.js';
 const DEFAULT_API_BASE_URL = 'https://api.bctrl.ai/v1';
 const EnvSchema = z.object({
     BCTRL_API_KEY: z.string().optional(),
@@ -8,6 +8,7 @@ const EnvSchema = z.object({
 export async function loadConfig(env = process.env) {
     const parsed = EnvSchema.parse(env);
     const apiBaseUrl = normalizeApiBaseUrl(parsed.BCTRL_API_URL ?? DEFAULT_API_BASE_URL);
+    // Layer 1: ambient env override (CI/agents). Skips any keychain/file read.
     const apiKey = parsed.BCTRL_API_KEY?.trim();
     if (apiKey) {
         return {
@@ -16,20 +17,11 @@ export async function loadConfig(env = process.env) {
             storedAuth: null,
         };
     }
-    const storedAuth = await readStoredAuth(env);
-    const activeToken = resolveStoredToken(apiBaseUrl, storedAuth);
-    return {
-        apiBaseUrl,
-        activeToken,
-        storedAuth,
-    };
-}
-function resolveStoredToken(apiBaseUrl, storedAuth) {
-    if (storedAuth && normalizeApiBaseUrl(storedAuth.apiBaseUrl) === apiBaseUrl) {
-        return { token: storedAuth.token, source: 'stored' };
-    }
-    return null;
-}
-function normalizeApiBaseUrl(url) {
-    return url.replace(/\/+$/, '');
+    // Layer 2: stored credential — metadata (file) + secret (keychain/file),
+    // scoped to the active API base URL.
+    const storedAuth = await loadCredential(env, apiBaseUrl);
+    const activeToken = storedAuth
+        ? { token: storedAuth.token, source: 'stored' }
+        : null;
+    return { apiBaseUrl, activeToken, storedAuth };
 }

package/dist/config/paths.d.ts

@@ -0,0 +1,16 @@
+/**
+ * OS-native config directory for the CLI. Resolution precedence:
+ *   1. `BCTRL_CONFIG_DIR` — explicit override (tests/dev).
+ *   2. `XDG_CONFIG_HOME/bctrl` — honored on every platform for parity with the
+ *      previous behavior and POSIX expectations.
+ *   3. env-paths default (`%APPDATA%\bctrl` / `~/Library/Application Support/bctrl`
+ *      / `~/.config/bctrl`). `suffix: ''` drops the `-nodejs` suffix.
+ */
+export declare function getConfigDir(env?: NodeJS.ProcessEnv): string;
+/**
+ * Path to the non-secret credential metadata file. `BCTRL_AUTH_FILE` overrides
+ * the exact location (tests/dev escape hatch).
+ */
+export declare function getMetadataFilePath(env?: NodeJS.ProcessEnv): string;
+/** Directory for the plaintext-fallback secret files (alongside the metadata file). */
+export declare function getSecretsDir(env?: NodeJS.ProcessEnv): string;

package/dist/config/paths.js

@@ -0,0 +1,34 @@
+import envPaths from 'env-paths';
+import { dirname, join } from 'node:path';
+const DEFAULT_AUTH_FILE_NAME = 'auth.json';
+/**
+ * OS-native config directory for the CLI. Resolution precedence:
+ *   1. `BCTRL_CONFIG_DIR` — explicit override (tests/dev).
+ *   2. `XDG_CONFIG_HOME/bctrl` — honored on every platform for parity with the
+ *      previous behavior and POSIX expectations.
+ *   3. env-paths default (`%APPDATA%\bctrl` / `~/Library/Application Support/bctrl`
+ *      / `~/.config/bctrl`). `suffix: ''` drops the `-nodejs` suffix.
+ */
+export function getConfigDir(env = process.env) {
+    const explicit = env.BCTRL_CONFIG_DIR?.trim();
+    if (explicit)
+        return explicit;
+    const xdg = env.XDG_CONFIG_HOME?.trim();
+    if (xdg)
+        return join(xdg, 'bctrl');
+    return envPaths('bctrl', { suffix: '' }).config;
+}
+/**
+ * Path to the non-secret credential metadata file. `BCTRL_AUTH_FILE` overrides
+ * the exact location (tests/dev escape hatch).
+ */
+export function getMetadataFilePath(env = process.env) {
+    const explicit = env.BCTRL_AUTH_FILE?.trim();
+    if (explicit)
+        return explicit;
+    return join(getConfigDir(env), DEFAULT_AUTH_FILE_NAME);
+}
+/** Directory for the plaintext-fallback secret files (alongside the metadata file). */
+export function getSecretsDir(env = process.env) {
+    return dirname(getMetadataFilePath(env));
+}

package/dist/config/pending-auth.d.ts

@@ -0,0 +1,19 @@
+import { z } from 'zod';
+import type { DeviceStartResponse } from '../api/device-auth.js';
+export declare const PendingDeviceAuthSchema: z.ZodObject<{
+    apiBaseUrl: z.ZodString;
+    deviceCode: z.ZodString;
+    userCode: z.ZodString;
+    verificationUri: z.ZodString;
+    verificationUriComplete: z.ZodString;
+    interval: z.ZodNumber;
+    expiresAt: z.ZodString;
+    createdAt: z.ZodString;
+}, z.core.$strict>;
+export type PendingDeviceAuth = z.infer<typeof PendingDeviceAuthSchema>;
+export declare function getPendingAuthFilePath(env?: NodeJS.ProcessEnv): string;
+export declare function savePendingDeviceAuth(apiBaseUrl: string, session: DeviceStartResponse, env?: NodeJS.ProcessEnv, now?: () => number): Promise<PendingDeviceAuth>;
+export declare function readPendingDeviceAuth(env?: NodeJS.ProcessEnv): Promise<PendingDeviceAuth | null>;
+export declare function clearPendingDeviceAuth(env?: NodeJS.ProcessEnv): Promise<void>;
+export declare function pendingMatchesApiBaseUrl(pending: PendingDeviceAuth, apiBaseUrl: string): boolean;
+export declare function pendingExpired(pending: PendingDeviceAuth, now?: () => number): boolean;

package/dist/config/pending-auth.js

@@ -0,0 +1,72 @@
+import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { z } from 'zod';
+import { normalizeApiBaseUrl } from './auth-store.js';
+import { getMetadataFilePath } from './paths.js';
+const PENDING_AUTH_FILE_NAME = 'pending-auth.json';
+export const PendingDeviceAuthSchema = z
+    .object({
+    apiBaseUrl: z.string().url(),
+    deviceCode: z.string().min(1),
+    userCode: z.string().min(1),
+    verificationUri: z.string().min(1),
+    verificationUriComplete: z.string().min(1),
+    interval: z.number().int().positive(),
+    expiresAt: z.string().datetime(),
+    createdAt: z.string().datetime(),
+})
+    .strict();
+export function getPendingAuthFilePath(env = process.env) {
+    return join(dirname(getMetadataFilePath(env)), PENDING_AUTH_FILE_NAME);
+}
+export async function savePendingDeviceAuth(apiBaseUrl, session, env = process.env, now = Date.now) {
+    const createdAtMs = now();
+    const pending = {
+        apiBaseUrl: normalizeApiBaseUrl(apiBaseUrl),
+        deviceCode: session.deviceCode,
+        userCode: session.userCode,
+        verificationUri: session.verificationUri,
+        verificationUriComplete: session.verificationUriComplete,
+        interval: session.interval,
+        createdAt: new Date(createdAtMs).toISOString(),
+        expiresAt: new Date(createdAtMs + session.expiresIn * 1000).toISOString(),
+    };
+    const path = getPendingAuthFilePath(env);
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await writeFile(path, `${JSON.stringify(pending, null, 2)}\n`, { mode: 0o600 });
+    return pending;
+}
+export async function readPendingDeviceAuth(env = process.env) {
+    const path = getPendingAuthFilePath(env);
+    try {
+        const parsed = PendingDeviceAuthSchema.safeParse(JSON.parse(await readFile(path, 'utf8')));
+        return parsed.success ? parsed.data : null;
+    }
+    catch (error) {
+        if (isFileNotFound(error) || error instanceof SyntaxError)
+            return null;
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new Error(`Failed to read pending BCTRL login at ${path}: ${reason}`);
+    }
+}
+export async function clearPendingDeviceAuth(env = process.env) {
+    try {
+        await rm(getPendingAuthFilePath(env));
+    }
+    catch (error) {
+        if (!isFileNotFound(error))
+            throw error;
+    }
+}
+export function pendingMatchesApiBaseUrl(pending, apiBaseUrl) {
+    return normalizeApiBaseUrl(pending.apiBaseUrl) === normalizeApiBaseUrl(apiBaseUrl);
+}
+export function pendingExpired(pending, now = Date.now) {
+    return Date.parse(pending.expiresAt) <= now();
+}
+function isFileNotFound(error) {
+    return (typeof error === 'object' &&
+        error !== null &&
+        'code' in error &&
+        error.code === 'ENOENT');
+}

package/dist/config/secret-store.d.ts

@@ -0,0 +1,24 @@
+export type SecretBackend = 'keychain' | 'file';
+export interface SecretStore {
+    readonly backend: SecretBackend;
+    get(account: string): Promise<string | null>;
+    set(account: string, secret: string): Promise<void>;
+    delete(account: string): Promise<boolean>;
+}
+export type ResolvedSecretStore = {
+    store: SecretStore;
+    /** True when the OS keychain was wanted but is unavailable, so a 0600 file is used. */
+    keychainFallback: boolean;
+};
+/**
+ * Pick the secret backend. `BCTRL_SECRET_STORE=file` forces the file store
+ * (tests/dev/CI). Otherwise the OS keychain is used when available, falling back
+ * — loudly, at the call site — to a 0600 file when it is not.
+ */
+export declare function resolveSecretStore(env?: NodeJS.ProcessEnv): ResolvedSecretStore;
+/**
+ * Delete a secret from BOTH backends, best-effort, so logout cannot orphan a
+ * secret regardless of which backend stored it (or whether the metadata file
+ * still exists). Skips the OS keychain entirely when `BCTRL_SECRET_STORE=file`.
+ */
+export declare function deleteSecretAllBackends(account: string, env?: NodeJS.ProcessEnv): Promise<boolean>;

package/dist/config/secret-store.js

@@ -0,0 +1,123 @@
+import { Entry } from '@napi-rs/keyring';
+import { createHash } from 'node:crypto';
+import { chmod, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { getSecretsDir } from './paths.js';
+// One keychain "service"; the per-credential "account" is the normalized API
+// base URL (see normalizeApiBaseUrl in auth-store), so credentials for prod and
+// a local/dev stack coexist and never collide.
+const KEYRING_SERVICE = 'bctrl';
+class KeychainSecretStore {
+    backend = 'keychain';
+    entry(account) {
+        return new Entry(KEYRING_SERVICE, account);
+    }
+    async get(account) {
+        // Sync getPassword returns null when there is no entry (it does not throw).
+        return this.entry(account).getPassword() ?? null;
+    }
+    async set(account, secret) {
+        this.entry(account).setPassword(secret);
+    }
+    async delete(account) {
+        try {
+            this.entry(account).deletePassword();
+            return true;
+        }
+        catch {
+            return false; // NoEntry — nothing to delete
+        }
+    }
+}
+class FileSecretStore {
+    dir;
+    backend = 'file';
+    constructor(dir) {
+        this.dir = dir;
+    }
+    fileFor(account) {
+        const hash = createHash('sha256').update(account).digest('hex').slice(0, 24);
+        return join(this.dir, `bctrl-${hash}.secret`);
+    }
+    async get(account) {
+        try {
+            const text = (await readFile(this.fileFor(account), 'utf8')).trim();
+            return text.length > 0 ? text : null;
+        }
+        catch (error) {
+            if (isFileNotFound(error))
+                return null;
+            throw error;
+        }
+    }
+    async set(account, secret) {
+        await mkdir(this.dir, { recursive: true, mode: 0o700 });
+        const file = this.fileFor(account);
+        await writeFile(file, `${secret}\n`, { mode: 0o600 });
+        await chmod(file, 0o600).catch(() => { });
+    }
+    async delete(account) {
+        try {
+            await rm(this.fileFor(account));
+            return true;
+        }
+        catch (error) {
+            if (isFileNotFound(error))
+                return false;
+            throw error;
+        }
+    }
+}
+function isFileNotFound(error) {
+    return (typeof error === 'object' &&
+        error !== null &&
+        'code' in error &&
+        error.code === 'ENOENT');
+}
+let keychainProbe;
+function keychainAvailable() {
+    if (keychainProbe !== undefined)
+        return keychainProbe;
+    try {
+        // A read against a probe account succeeds (returns null) when a keychain
+        // backend exists, and throws when none is available (headless Linux/CI).
+        new Entry(KEYRING_SERVICE, 'bctrl-availability-probe').getPassword();
+        keychainProbe = true;
+    }
+    catch {
+        keychainProbe = false;
+    }
+    return keychainProbe;
+}
+/**
+ * Pick the secret backend. `BCTRL_SECRET_STORE=file` forces the file store
+ * (tests/dev/CI). Otherwise the OS keychain is used when available, falling back
+ * — loudly, at the call site — to a 0600 file when it is not.
+ */
+export function resolveSecretStore(env = process.env) {
+    const forced = env.BCTRL_SECRET_STORE?.trim();
+    if (forced === 'file') {
+        return { store: new FileSecretStore(getSecretsDir(env)), keychainFallback: false };
+    }
+    if (keychainAvailable()) {
+        return { store: new KeychainSecretStore(), keychainFallback: false };
+    }
+    return { store: new FileSecretStore(getSecretsDir(env)), keychainFallback: true };
+}
+/**
+ * Delete a secret from BOTH backends, best-effort, so logout cannot orphan a
+ * secret regardless of which backend stored it (or whether the metadata file
+ * still exists). Skips the OS keychain entirely when `BCTRL_SECRET_STORE=file`.
+ */
+export async function deleteSecretAllBackends(account, env = process.env) {
+    let removed = false;
+    if (await new FileSecretStore(getSecretsDir(env)).delete(account)) {
+        removed = true;
+    }
+    if (env.BCTRL_SECRET_STORE?.trim() !== 'file' && keychainAvailable()) {
+        if (await new KeychainSecretStore().delete(account)) {
+            removed = true;
+        }
+    }
+    return removed;
+}

package/dist/factory.js

@@ -1,5 +1,6 @@
 import { createBctrlApiClient } from './api/client.js';
 import { loadConfig } from './config/config.js';
+import { CLI_VERSION } from './version.js';
 export function createFactory(options) {
     let configPromise;
     const config = () => {
@@ -7,7 +8,7 @@ export function createFactory(options) {
         return configPromise;
     };
     return {
-        version: options.version ?? '0.1.3',
+        version: options.version ?? CLI_VERSION,
         io: options.io,
         config,
         apiClient: async () => createBctrlApiClient(await config()),