@blinkhost/cli 2.0.0

package/dist/cli.js

@@ -0,0 +1,443 @@
+#!/usr/bin/env node
+import { spawn } from 'node:child_process';
+import { realpathSync } from 'node:fs';
+import { access } from 'node:fs/promises';
+import { pathToFileURL } from 'node:url';
+import { CliError, EXIT } from './errors.js';
+import { SUPPORTED_FRONTENDS, SUPPORTED_MANAGERS, SUPPORTED_MODULES, } from './manifest.js';
+import { detectManifest } from './detect.js';
+import { readProjectManifest, resolveLocalPath, validateProject, writeManifest, writeScaffoldAtomically } from './project.js';
+import { createScaffold } from './templates.js';
+import { ApiClient } from './api.js';
+import { login, logout } from './auth.js';
+import { activeProfile, readConfig, validateProfileName, writeConfig } from './config.js';
+import { openPreview, projectStatus, rawApi, readProjectLink, runRemote, runSecrets, syncProject, unlinkProject, uploadAsset, waitForRemote, writeProjectLink } from './remote.js';
+import { checkForUpdate, ciCheck, completion, observability, runDev, runPlugins, supportBundle, testProject } from './workflows.js';
+const VERSION = '2.0.0';
+const HELP = `BlinkHost CLI ${VERSION}
+
+Usage:
+  blinkhost create <project-name> [--template react] [--package-manager npm]
+                 [--module name:python] [--database APP_DB] [--no-install]
+  blinkhost init [path] [--force]
+  blinkhost validate [path]
+  blinkhost manifest [path]
+  blinkhost doctor [path]
+  blinkhost test [path]
+  blinkhost auth login|logout|status|sessions|revoke
+  blinkhost projects list|get|create|update|delete|action|link|current
+  blinkhost repositories|connections|previews|builds|deployments <action>
+  blinkhost modules|databases|bindings|assets|secrets <action>
+  blinkhost organizations|templates|approvals|handoffs|policies|workloads <action>
+  blinkhost dev [path] [--host HOST] [--port PORT]
+  blinkhost logs|metrics|analytics --project PROJECT_ID
+  blinkhost support bundle [--output PATH]
+  blinkhost completion bash|zsh|fish
+  blinkhost update check
+  blinkhost ci check
+  blinkhost plugins list|add|remove|verify|run
+  blinkhost api METHOD /api/customer/path/ [--data JSON_OR_@FILE]
+
+Global options:
+  --json       Return machine-readable output
+  --profile    Use a named account and API profile
+  --quiet      Suppress successful human-readable output
+  --verbose    Include safe diagnostic detail in errors
+  --no-color   Disable terminal colour (accepted for portable scripts)
+  --non-interactive  Never open a browser or prompt
+  --help       Show command help
+  --version    Show the CLI version
+
+Refresh credentials are stored only by the operating-system credential service.
+BlinkHost remains authoritative for roles, plan limits, approvals, builds, releases,
+deployments, and audit records. Secret values are accepted only through standard input.
+`;
+let quietOutput = false;
+let verboseOutput = false;
+function terminalText(value) {
+    return value.replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f]/g, '');
+}
+function emit(output, json) {
+    if (json)
+        process.stdout.write(`${JSON.stringify(output)}\n`);
+    else {
+        if (quietOutput)
+            return;
+        process.stdout.write(`${terminalText(output.message)}\n`);
+        if (output.data !== undefined && output.data !== null) {
+            process.stdout.write(`${terminalText(JSON.stringify(output.data, null, 2))}\n`);
+        }
+        for (const warning of output.warnings ?? [])
+            process.stderr.write(`Warning: ${terminalText(warning)}\n`);
+    }
+}
+function takeOption(args, name) {
+    const index = args.indexOf(name);
+    if (index < 0)
+        return undefined;
+    const value = args[index + 1];
+    if (!value || value.startsWith('--'))
+        throw new CliError(`${name} requires a value.`, EXIT.usage, 'missing_option_value');
+    args.splice(index, 2);
+    return value;
+}
+function takeRepeatedOption(args, name) {
+    const values = [];
+    let index = args.indexOf(name);
+    while (index >= 0) {
+        const value = args[index + 1];
+        if (!value || value.startsWith('--'))
+            throw new CliError(`${name} requires a value.`, EXIT.usage, 'missing_option_value');
+        values.push(value);
+        args.splice(index, 2);
+        index = args.indexOf(name);
+    }
+    return values;
+}
+function takeFlag(args, name) {
+    const index = args.indexOf(name);
+    if (index < 0)
+        return false;
+    args.splice(index, 1);
+    return true;
+}
+function assertNoUnknown(args) {
+    if (args.length)
+        throw new CliError(`Unexpected argument: ${args[0]}`, EXIT.usage, 'unexpected_argument');
+}
+function parseModule(value) {
+    const [name, language, extra] = value.split(':');
+    if (extra || !name || !language || !/^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/.test(name) || !SUPPORTED_MODULES.includes(language)) {
+        throw new CliError('Use --module name:language with a safe name and python, go or rust.', EXIT.usage, 'invalid_module');
+    }
+    return { name, language: language };
+}
+async function runProcess(command, args, cwd) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, args, { cwd, shell: false, stdio: 'inherit', env: { ...process.env, npm_config_ignore_scripts: 'true' } });
+        child.once('error', () => reject(new CliError(`The ${command} executable is not available.`, EXIT.filesystem, 'package_manager_unavailable')));
+        child.once('exit', (code) => resolve(code ?? 1));
+    });
+}
+async function commandAvailable(command, args) {
+    return new Promise((resolve) => {
+        const child = spawn(command, args, { shell: false, stdio: 'ignore' });
+        child.once('error', () => resolve(false));
+        child.once('exit', (code) => resolve(code === 0));
+    });
+}
+async function commandCreate(args, json) {
+    const name = args.shift();
+    if (!name || !/^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/.test(name))
+        throw new CliError('Project name must use lowercase letters, numbers and internal hyphens.', EXIT.usage, 'invalid_project_name');
+    const framework = (takeOption(args, '--template') ?? 'react');
+    const packageManager = (takeOption(args, '--package-manager') ?? 'npm');
+    const moduleValues = takeRepeatedOption(args, '--module');
+    const database = takeOption(args, '--database');
+    const noInstall = takeFlag(args, '--no-install');
+    const explicitInstall = takeFlag(args, '--install');
+    if (noInstall && explicitInstall)
+        throw new CliError('Choose either --install or --no-install.', EXIT.usage, 'conflicting_options');
+    const install = !noInstall;
+    assertNoUnknown(args);
+    if (!SUPPORTED_FRONTENDS.includes(framework))
+        throw new CliError(`Unsupported template: ${framework}.`, EXIT.usage, 'invalid_template');
+    if (!SUPPORTED_MANAGERS.includes(packageManager))
+        throw new CliError(`Unsupported package manager: ${packageManager}.`, EXIT.usage, 'invalid_package_manager');
+    if (database && !/^[A-Z][A-Z0-9_]{0,127}$/.test(database))
+        throw new CliError('Database bindings use uppercase letters, numbers and underscores.', EXIT.usage, 'invalid_database');
+    const modules = moduleValues.map(parseModule);
+    if (new Set(modules.map((item) => item.name)).size !== modules.length)
+        throw new CliError('Backend module names must be unique.', EXIT.usage, 'duplicate_module');
+    const target = resolveLocalPath(name);
+    const scaffold = createScaffold({ name, framework, packageManager, modules, ...(database ? { database } : {}) });
+    await writeScaffoldAtomically(target, scaffold.files, scaffold.manifest);
+    if (install && framework !== 'html') {
+        const installArgs = {
+            npm: ['install', '--ignore-scripts', '--no-audit', '--no-fund', '--prefer-offline', '--no-progress'],
+            pnpm: ['install', '--ignore-scripts', '--prefer-offline'],
+            yarn: ['install', '--mode=skip-build'],
+            bun: ['install', '--ignore-scripts', '--no-progress'],
+        };
+        const code = await runProcess(packageManager, installArgs[packageManager], target);
+        if (code !== 0)
+            throw new CliError(`Dependency installation exited with code ${code}. The project files were kept.`, EXIT.filesystem, 'install_failed');
+    }
+    emit({ ok: true, command: 'create', message: `Created ${name} at ${target}.`, data: { path: target, framework, modules: modules.length, installed: install && framework !== 'html' } }, json);
+}
+async function commandInit(args, json) {
+    const force = takeFlag(args, '--force');
+    const path = args.shift();
+    assertNoUnknown(args);
+    const root = resolveLocalPath(path);
+    const manifest = await detectManifest(root);
+    await writeManifest(root, manifest, force);
+    emit({ ok: true, command: 'init', message: `Created blinkhost.yaml in ${root}.`, data: { path: root, framework: manifest.frontend.framework } }, json);
+}
+async function commandValidate(args, json) {
+    const path = args.shift();
+    assertNoUnknown(args);
+    const root = resolveLocalPath(path);
+    const result = await validateProject(root);
+    if (result.errors.length)
+        throw new CliError('Project validation failed.', EXIT.validation, 'project_invalid', result.errors);
+    emit({ ok: true, command: 'validate', message: `Project is compatible with ${result.manifest.schema}.`, data: { framework: result.manifest.frontend.framework, modules: result.manifest.modules.length, databases: result.manifest.resources.databases.length }, warnings: result.warnings }, json);
+}
+async function commandManifest(args, json) {
+    const path = args.shift();
+    assertNoUnknown(args);
+    const manifest = await readProjectManifest(resolveLocalPath(path));
+    if (json)
+        emit({ ok: true, command: 'manifest', message: 'Manifest parsed.', data: manifest }, true);
+    else
+        process.stdout.write(`${JSON.stringify(manifest, null, 2)}\n`);
+}
+async function commandDoctor(args, json) {
+    const path = args.shift();
+    assertNoUnknown(args);
+    const checks = [];
+    const [nodeMajor, nodeMinor] = process.versions.node.split('.').map(Number);
+    const supportedNode = (nodeMajor ?? 0) > 22 || nodeMajor === 22 && (nodeMinor ?? 0) >= 12;
+    checks.push({ name: 'node', ok: supportedNode, detail: process.versions.node });
+    let gitOk = false;
+    try {
+        gitOk = await commandAvailable('git', ['--version']);
+    }
+    catch { }
+    checks.push({ name: 'git', ok: gitOk, detail: gitOk ? 'available' : 'not found' });
+    const root = resolveLocalPath(path);
+    try {
+        const validation = await validateProject(root);
+        checks.push({ name: 'project', ok: validation.errors.length === 0, detail: validation.errors.join('; ') || 'manifest and declared paths are valid' });
+    }
+    catch (error) {
+        checks.push({ name: 'project', ok: false, detail: error instanceof Error ? error.message : String(error) });
+    }
+    try {
+        await access(root);
+        checks.push({ name: 'directory', ok: true, detail: root });
+    }
+    catch {
+        checks.push({ name: 'directory', ok: false, detail: 'not accessible' });
+    }
+    const failed = checks.filter((check) => !check.ok);
+    if (failed.length)
+        throw new CliError('One or more environment checks failed.', EXIT.validation, 'doctor_failed', failed.map((check) => `${check.name}: ${check.detail}`));
+    emit({ ok: true, command: 'doctor', message: 'BlinkHost project environment is ready.', data: { checks } }, json);
+}
+export async function main(argv = process.argv.slice(2)) {
+    const args = [...argv];
+    const json = takeFlag(args, '--json');
+    quietOutput = takeFlag(args, '--quiet');
+    verboseOutput = takeFlag(args, '--verbose');
+    takeFlag(args, '--no-color');
+    const nonInteractive = takeFlag(args, '--non-interactive');
+    const profile = takeOption(args, '--profile');
+    const command = args.shift();
+    try {
+        if (!command || command === '--help' || command === 'help') {
+            process.stdout.write(HELP);
+            return EXIT.success;
+        }
+        if (command === '--version' || command === 'version') {
+            process.stdout.write(`${VERSION}\n`);
+            return EXIT.success;
+        }
+        if (takeFlag(args, '--help')) {
+            process.stdout.write(HELP);
+            return EXIT.success;
+        }
+        if (profile)
+            validateProfileName(profile);
+        if (command === 'create')
+            await commandCreate(args, json);
+        else if (command === 'init')
+            await commandInit(args, json);
+        else if (command === 'validate')
+            await commandValidate(args, json);
+        else if (command === 'manifest')
+            await commandManifest(args, json);
+        else if (command === 'doctor')
+            await commandDoctor(args, json);
+        else if (command === 'test') {
+            const data = await testProject(args);
+            emit({ ok: true, command, message: 'Project checks passed.', data }, json);
+        }
+        else if (command === 'auth') {
+            const action = args.shift() || 'status';
+            if (action === 'login') {
+                const apiOrigin = takeOption(args, '--api-origin');
+                const noBrowser = takeFlag(args, '--no-browser');
+                assertNoUnknown(args);
+                if (nonInteractive)
+                    throw new CliError('Interactive account authorization is disabled. Use an approved workload identity in automation.', EXIT.auth, 'interaction_required');
+                const data = await login({ ...(profile ? { profile } : {}), ...(apiOrigin ? { apiOrigin } : {}), openBrowser: !noBrowser, ...(!json && !quietOutput ? { progress: (line) => { process.stderr.write(`${terminalText(line)}\n`); } } : {}) });
+                emit({ ok: true, command: 'auth login', message: 'This device is connected to BlinkHost.', data }, json);
+            }
+            else if (action === 'logout') {
+                assertNoUnknown(args);
+                const data = await logout(profile);
+                emit({ ok: true, command: 'auth logout', message: `Signed out CLI profile ${data.profile}.`, data }, json);
+            }
+            else if (action === 'status') {
+                assertNoUnknown(args);
+                const client = await ApiClient.create(profile);
+                const data = await client.request('/api/cli/v2/capabilities/');
+                emit({ ok: true, command: 'auth status', message: 'The CLI session is active.', data }, json);
+            }
+            else if (action === 'sessions') {
+                assertNoUnknown(args);
+                const client = await ApiClient.create(profile);
+                const data = await client.request('/api/cli/v2/sessions/');
+                emit({ ok: true, command: 'auth sessions', message: 'CLI sessions loaded.', data }, json);
+            }
+            else if (action === 'revoke') {
+                const id = args.shift();
+                assertNoUnknown(args);
+                if (!id || !/^[0-9a-f-]{36}$/i.test(id))
+                    throw new CliError('Provide a valid CLI session ID.', EXIT.usage, 'invalid_session_id');
+                const client = await ApiClient.create(profile);
+                await client.request(`/api/cli/v2/sessions/${id}/`, { method: 'DELETE' });
+                emit({ ok: true, command: 'auth revoke', message: 'CLI session revoked.', data: { id } }, json);
+            }
+            else
+                throw new CliError(`Unknown auth action: ${action}.`, EXIT.usage, 'unknown_action');
+        }
+        else if (command === 'profile') {
+            const action = args.shift() || 'list';
+            const config = await readConfig();
+            if (action === 'list') {
+                assertNoUnknown(args);
+                emit({ ok: true, command: 'profile list', message: `Active profile: ${config.activeProfile}.`, data: { active: config.activeProfile, profiles: config.profiles } }, json);
+            }
+            else if (action === 'use') {
+                const name = validateProfileName(args.shift() || '');
+                assertNoUnknown(args);
+                if (!config.profiles[name])
+                    throw new CliError('Profile not found. Sign in with that profile first.', EXIT.usage, 'profile_not_found');
+                config.activeProfile = name;
+                await writeConfig(config);
+                emit({ ok: true, command: 'profile use', message: `Using profile ${name}.`, data: { active: name } }, json);
+            }
+            else
+                throw new CliError(`Unknown profile action: ${action}.`, EXIT.usage, 'unknown_action');
+        }
+        else if (command === 'projects' && args[0] === 'link') {
+            args.shift();
+            const projectId = args.shift();
+            const root = args.shift();
+            assertNoUnknown(args);
+            if (!projectId)
+                throw new CliError('Provide a project ID.', EXIT.usage, 'project_required');
+            const selected = await activeProfile(profile);
+            const data = await writeProjectLink(projectId, selected.name, root);
+            emit({ ok: true, command: 'projects link', message: 'This directory is linked to the BlinkHost project.', data }, json);
+        }
+        else if (command === 'projects' && args[0] === 'current') {
+            args.shift();
+            const root = args.shift();
+            assertNoUnknown(args);
+            const data = await readProjectLink(root);
+            emit({ ok: true, command: 'projects current', message: `Linked project: ${data.project_id}.`, data }, json);
+        }
+        else if (command === 'projects' && args[0] === 'unlink') {
+            args.shift();
+            const root = args.shift();
+            assertNoUnknown(args);
+            const data = await unlinkProject(root);
+            emit({ ok: true, command: 'projects unlink', message: 'Removed the local BlinkHost project link. The remote project was not changed.', data }, json);
+        }
+        else if (command === 'projects' && args[0] === 'status') {
+            args.shift();
+            assertNoUnknown(args);
+            const data = await projectStatus(profile);
+            emit({ ok: true, command: 'projects status', message: 'Project and source connection status loaded.', data }, json);
+        }
+        else if (command === 'projects' && (args[0] === 'pull' || args[0] === 'push')) {
+            const action = args.shift();
+            const data = await syncProject(action, args, profile);
+            emit({ ok: true, command: `projects ${action}`, message: `${action === 'pull' ? 'Pulled repository changes into BlinkHost.' : 'Pushed BlinkHost changes to the connected repository.'}`, data }, json);
+        }
+        else if (command === 'previews' && args[0] === 'open') {
+            args.shift();
+            const data = await openPreview(args, profile);
+            emit({ ok: true, command: 'previews open', message: 'Opened the preview in your browser.', data }, json);
+        }
+        else if ((command === 'builds' || command === 'deployments' || command === 'previews') && args[0] === 'wait') {
+            args.shift();
+            const data = await waitForRemote(command, args, profile);
+            emit({ ok: true, command: `${command} wait`, message: `${command.slice(0, -1)} is ready.`, data }, json);
+        }
+        else if (command === 'assets' && args[0] === 'upload') {
+            args.shift();
+            const data = await uploadAsset(args, profile);
+            emit({ ok: true, command: 'assets upload', message: 'Asset uploaded and verified.', data }, json);
+        }
+        else if (['projects', 'repositories', 'connections', 'previews', 'builds', 'deployments', 'modules', 'databases', 'bindings', 'assets', 'organizations', 'templates', 'approvals', 'handoffs', 'policies', 'workloads'].includes(command)) {
+            const data = await runRemote(command, args, profile);
+            emit({ ok: true, command, message: `${command[0]?.toUpperCase()}${command.slice(1)} request completed.`, data }, json);
+        }
+        else if (command === 'secrets') {
+            const data = await runSecrets(args, profile);
+            emit({ ok: true, command, message: 'Secret operation completed.', data }, json);
+        }
+        else if (command === 'dev') {
+            const data = await runDev(args);
+            emit({ ok: true, command, message: 'Local development process finished.', data }, json);
+        }
+        else if (command === 'logs' || command === 'metrics' || command === 'analytics') {
+            const data = await observability(command, args, profile);
+            emit({ ok: true, command, message: `${command} loaded.`, data }, json);
+        }
+        else if (command === 'support' && args.shift() === 'bundle') {
+            const data = await supportBundle(args, profile);
+            emit({ ok: true, command: 'support bundle', message: `Created redacted support bundle at ${data.output}.`, data }, json);
+        }
+        else if (command === 'completion') {
+            const output = completion(args.shift());
+            assertNoUnknown(args);
+            if (json)
+                emit({ ok: true, command, message: 'Shell completion generated.', data: { script: output } }, true);
+            else
+                process.stdout.write(output);
+        }
+        else if (command === 'update' && args.shift() === 'check') {
+            assertNoUnknown(args);
+            const data = await checkForUpdate();
+            emit({ ok: true, command: 'update check', message: 'Release check completed.', data }, json);
+        }
+        else if (command === 'ci' && args.shift() === 'check') {
+            assertNoUnknown(args);
+            const data = await ciCheck(profile);
+            emit({ ok: true, command: 'ci check', message: 'CI identity and API capabilities are ready.', data }, json);
+        }
+        else if (command === 'plugins') {
+            const data = await runPlugins(args);
+            emit({ ok: true, command, message: 'Plugin operation completed.', data }, json);
+        }
+        else if (command === 'api') {
+            const data = await rawApi(args, profile);
+            emit({ ok: true, command, message: 'API request completed.', data }, json);
+        }
+        else
+            throw new CliError(`Unknown command: ${command}.`, EXIT.usage, 'unknown_command');
+        return EXIT.success;
+    }
+    catch (error) {
+        const failure = error instanceof CliError ? error : new CliError(error instanceof Error ? error.message : String(error), EXIT.internal, 'internal_error');
+        if (json)
+            process.stderr.write(`${JSON.stringify({ ok: false, command: command ?? '', error: { code: failure.code, message: failure.message, details: failure.details } })}\n`);
+        else {
+            process.stderr.write(`Error: ${terminalText(failure.message)}\n`);
+            for (const detail of failure.details)
+                process.stderr.write(`  - ${terminalText(detail)}\n`);
+            if (verboseOutput)
+                process.stderr.write(`Code: ${failure.code}; exit: ${failure.exitCode}\n`);
+        }
+        return failure.exitCode;
+    }
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) {
+    process.exitCode = await main();
+}
+//# sourceMappingURL=cli.js.map

package/dist/config.d.ts

@@ -0,0 +1,28 @@
+export declare const DEFAULT_API_ORIGIN = "https://api.blinkhost.me";
+export interface Profile {
+    apiOrigin: string;
+    username?: string;
+    userId?: number;
+}
+export interface PluginRecord {
+    executable: string;
+    sha256: string;
+    addedAt: string;
+}
+export interface CliConfig {
+    activeProfile: string;
+    profiles: Record<string, Profile>;
+    plugins?: Record<string, PluginRecord>;
+    updateCheckedAt?: string;
+    latestVersion?: string;
+}
+export declare function configPath(): string;
+export declare function validateProfileName(value: string): string;
+export declare function validateApiOrigin(value: string): string;
+export declare function readConfig(): Promise<CliConfig>;
+export declare function writeConfig(config: CliConfig): Promise<void>;
+export declare function activeProfile(explicit?: string): Promise<{
+    name: string;
+    profile: Profile;
+    config: CliConfig;
+}>;

package/dist/config.js

@@ -0,0 +1,67 @@
+import { chmod, mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { CliError, EXIT } from './errors.js';
+export const DEFAULT_API_ORIGIN = 'https://api.blinkhost.me';
+function configRoot() {
+    const override = process.env.BLINKHOST_CONFIG_HOME;
+    if (override)
+        return override;
+    if (process.platform === 'win32' && process.env.APPDATA)
+        return join(process.env.APPDATA, 'BlinkHost');
+    return join(process.env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'blinkhost');
+}
+export function configPath() { return join(configRoot(), 'config.json'); }
+export function validateProfileName(value) {
+    if (!/^[a-z0-9][a-z0-9_-]{0,31}$/.test(value))
+        throw new CliError('Profile names use lowercase letters, numbers, hyphens, and underscores.', EXIT.usage, 'invalid_profile');
+    return value;
+}
+export function validateApiOrigin(value) {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        throw new CliError('The API origin is not a valid URL.', EXIT.usage, 'invalid_api_origin');
+    }
+    const local = ['localhost', '127.0.0.1', '::1'].includes(parsed.hostname);
+    if ((parsed.protocol !== 'https:' && !(local && parsed.protocol === 'http:')) || parsed.username || parsed.password || parsed.search || parsed.hash || !['', '/'].includes(parsed.pathname)) {
+        throw new CliError('Use an HTTPS API origin without credentials, paths, queries, or fragments.', EXIT.usage, 'invalid_api_origin');
+    }
+    return parsed.origin;
+}
+export async function readConfig() {
+    try {
+        const parsed = JSON.parse(await readFile(configPath(), 'utf8'));
+        const profiles = {};
+        for (const [name, profile] of Object.entries(parsed.profiles || {})) {
+            validateProfileName(name);
+            if (!profile || typeof profile !== 'object')
+                continue;
+            profiles[name] = { ...profile, apiOrigin: validateApiOrigin(profile.apiOrigin) };
+        }
+        return { activeProfile: validateProfileName(parsed.activeProfile || 'default'), profiles, plugins: parsed.plugins || {} };
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { activeProfile: 'default', profiles: {} };
+        if (error instanceof CliError)
+            throw error;
+        throw new CliError('BlinkHost CLI configuration could not be read.', EXIT.filesystem, 'config_invalid');
+    }
+}
+export async function writeConfig(config) {
+    const path = configPath();
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    const temporary = `${path}.${process.pid}.tmp`;
+    await writeFile(temporary, `${JSON.stringify(config, null, 2)}\n`, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+    await chmod(temporary, 0o600);
+    await rename(temporary, path);
+}
+export async function activeProfile(explicit) {
+    const config = await readConfig();
+    const name = validateProfileName(explicit || process.env.BLINKHOST_PROFILE || config.activeProfile || 'default');
+    return { name, profile: config.profiles[name] || { apiOrigin: DEFAULT_API_ORIGIN }, config };
+}
+//# sourceMappingURL=config.js.map

package/dist/credentials.d.ts

@@ -0,0 +1,3 @@
+export declare function getRefreshCredential(profile: string): Promise<string | null>;
+export declare function setRefreshCredential(profile: string, token: string): Promise<void>;
+export declare function deleteRefreshCredential(profile: string): Promise<void>;

package/dist/credentials.js

@@ -0,0 +1,66 @@
+import { spawn } from 'node:child_process';
+import { CliError, EXIT } from './errors.js';
+const SERVICE = 'blinkhost-cli';
+async function run(command, args, input, acceptMissing = false) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, args, { shell: false, stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true });
+        let stdout = '';
+        let stderr = '';
+        child.stdout.setEncoding('utf8').on('data', (chunk) => { stdout += chunk; });
+        child.stderr.setEncoding('utf8').on('data', (chunk) => { stderr += chunk; });
+        child.on('error', () => reject(new CliError('No supported operating-system credential service is available.', EXIT.auth, 'credential_store_unavailable')));
+        child.on('close', (code) => {
+            if (code === 0)
+                resolve(stdout.trim());
+            else if (acceptMissing)
+                resolve('');
+            else
+                reject(new CliError(`The operating-system credential service rejected the request${stderr.trim() ? `: ${stderr.trim()}` : '.'}`, EXIT.auth, 'credential_store_failed'));
+        });
+        if (input !== undefined)
+            child.stdin.end(input);
+        else
+            child.stdin.end();
+    });
+}
+function windowsScript(action, profile) {
+    const safeProfile = profile.replace(/'/g, "''");
+    const prefix = `$r='${SERVICE}';$u='${safeProfile}';$v=[Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime];`;
+    if (action === 'get')
+        return `${prefix}try{$c=(New-Object Windows.Security.Credentials.PasswordVault).Retrieve($r,$u);$c.RetrievePassword();[Console]::Out.Write($c.Password)}catch{exit 2}`;
+    if (action === 'delete')
+        return `${prefix}try{$p=New-Object Windows.Security.Credentials.PasswordVault;$c=$p.Retrieve($r,$u);$p.Remove($c)}catch{};`;
+    return `${prefix}$s=[Console]::In.ReadToEnd();$p=New-Object Windows.Security.Credentials.PasswordVault;try{$c=$p.Retrieve($r,$u);$p.Remove($c)}catch{};$p.Add((New-Object Windows.Security.Credentials.PasswordCredential($r,$u,$s)));`;
+}
+export async function getRefreshCredential(profile) {
+    if (process.platform === 'darwin')
+        return (await run('security', ['find-generic-password', '-s', SERVICE, '-a', profile, '-w'], undefined, true)) || null;
+    if (process.platform === 'win32')
+        return (await run('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', windowsScript('get', profile)], undefined, true)) || null;
+    return (await run('secret-tool', ['lookup', 'service', SERVICE, 'profile', profile], undefined, true)) || null;
+}
+export async function setRefreshCredential(profile, token) {
+    if (!token.startsWith('bhr_'))
+        throw new CliError('The server returned an invalid refresh credential.', EXIT.auth, 'invalid_refresh_credential');
+    if (process.platform === 'darwin') {
+        await run('security', ['add-generic-password', '-U', '-s', SERVICE, '-a', profile, '-w', token]);
+        return;
+    }
+    if (process.platform === 'win32') {
+        await run('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', windowsScript('set', profile)], token);
+        return;
+    }
+    await run('secret-tool', ['store', '--label=BlinkHost CLI', 'service', SERVICE, 'profile', profile], token);
+}
+export async function deleteRefreshCredential(profile) {
+    if (process.platform === 'darwin') {
+        await run('security', ['delete-generic-password', '-s', SERVICE, '-a', profile], undefined, true);
+        return;
+    }
+    if (process.platform === 'win32') {
+        await run('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', windowsScript('delete', profile)], undefined, true);
+        return;
+    }
+    await run('secret-tool', ['clear', 'service', SERVICE, 'profile', profile], undefined, true);
+}
+//# sourceMappingURL=credentials.js.map

package/dist/detect.d.ts

@@ -0,0 +1,2 @@
+import type { BlinkHostManifest } from './manifest.js';
+export declare function detectManifest(root: string): Promise<BlinkHostManifest>;