@bpmnkit/profiles 0.0.5

package/README.md

@@ -0,0 +1,139 @@
+<div align="center">
+  <img src="https://raw.githubusercontent.com/bpmn-sdk/monorepo/main/doc/logos/logo-2-gateway.svg" width="72" height="72" alt="BPMN Kit logo">
+  <h1>@bpmnkit/profiles</h1>
+  <p>Shared auth, profile storage, and client factories for the BPMN Kit CLI and proxy server</p>
+
+  [![npm](https://img.shields.io/npm/v/@bpmnkit/profiles?style=flat-square&color=6244d7)](https://www.npmjs.com/package/@bpmnkit/profiles)
+  [![license](https://img.shields.io/npm/l/@bpmnkit/profiles?style=flat-square)](https://github.com/bpmnkit/monorepo/blob/main/LICENSE)
+  [![typescript](https://img.shields.io/badge/TypeScript-strict-6244d7?style=flat-square&logo=typescript&logoColor=white)](https://github.com/bpmnkit/monorepo)
+
+  [Documentation](https://bpmn-sdk-docs.pages.dev) · [GitHub](https://github.com/bpmnkit/monorepo) · [Changelog](https://github.com/bpmnkit/monorepo/blob/main/packages/profiles/CHANGELOG.md)
+</div>
+
+---
+
+## Overview
+
+`@bpmnkit/profiles` is the shared layer that connects the `casen` CLI with the local proxy server. It handles profile CRUD (read/write to `~/.config/casen/config.json`), creates typed `CamundaClient` instances from stored profiles, and resolves Authorization headers for any supported auth type.
+
+You do not need this package if you are connecting directly to Camunda using `@bpmnkit/api`. It is intended for tooling that needs to share authentication state with the CLI.
+
+## Features
+
+- **Profile CRUD** — list, get, save, delete, and activate named profiles stored in `~/.config/casen/config.json`
+- **Client factory** — `createClientFromProfile(name?)` creates a ready-to-use `CamundaClient` from the active or named profile
+- **Auth header resolution** — `getAuthHeader(config)` returns the correct `Authorization` header string for Bearer, Basic, and OAuth2 auth types
+- **OAuth2 token caching** — tokens are cached in memory and refreshed 60 seconds before expiry; no extra files written
+- **XDG-aware** — profile file path resolves to the correct platform directory (Linux XDG, macOS, Windows AppData)
+- **Zero UI dependencies** — no TUI or CLI dependencies; plain Node.js
+
+## Installation
+
+```sh
+npm install @bpmnkit/profiles
+```
+
+## Quick Start
+
+### Create a `CamundaClient` from the active profile
+
+```typescript
+import { createClientFromProfile } from "@bpmnkit/profiles"
+
+// Uses the currently active profile from ~/.config/casen/config.json
+const client = createClientFromProfile()
+
+const instances = await client.processInstance.searchProcessInstances({})
+console.log(instances.page.totalItems)
+```
+
+### Use a named profile
+
+```typescript
+const client = createClientFromProfile("production")
+```
+
+### Resolve an auth header directly
+
+```typescript
+import { getActiveProfile, getAuthHeader } from "@bpmnkit/profiles"
+
+const profile = getActiveProfile()
+if (profile) {
+  const header = await getAuthHeader(profile.config)
+  // "Bearer eyJ..." or "Basic dXNlcjpwYXNz" or ""
+}
+```
+
+### Manage profiles programmatically
+
+```typescript
+import { listProfiles, saveProfile, useProfile, deleteProfile } from "@bpmnkit/profiles"
+
+// List all profiles
+const profiles = listProfiles()
+
+// Save a new profile
+saveProfile({
+  name: "local",
+  apiType: "self-managed",
+  config: {
+    baseUrl: "http://localhost:8080/v2",
+    auth: { type: "basic", username: "admin", password: "admin" },
+  },
+})
+
+// Activate a profile
+useProfile("local")
+
+// Delete a profile
+deleteProfile("old-profile")
+```
+
+## API Reference
+
+### Profile Management
+
+| Export | Description |
+|--------|-------------|
+| `listProfiles()` | Returns all stored profiles |
+| `getProfile(name)` | Returns a profile by name, or `undefined` |
+| `getActiveProfile()` | Returns the currently active profile |
+| `getActiveName()` | Returns the active profile name |
+| `saveProfile(profile)` | Create or update a profile |
+| `deleteProfile(name)` | Remove a profile |
+| `useProfile(name)` | Set the active profile |
+| `getConfigFilePath()` | Returns the full path to the config file |
+
+### Client Factories
+
+| Export | Description |
+|--------|-------------|
+| `createClientFromProfile(name?)` | `CamundaClient` from the active or named profile |
+| `createAdminClientFromProfile(name?)` | `AdminApiClient` from the active or named profile |
+
+### Auth
+
+| Export | Description |
+|--------|-------------|
+| `getAuthHeader(config)` | Resolves an `Authorization` header string for any auth type |
+
+---
+
+## Related Packages
+
+| Package | Description |
+|---------|-------------|
+| [`@bpmnkit/core`](https://www.npmjs.com/package/@bpmnkit/core) | BPMN/DMN/Form parser, builder, layout engine |
+| [`@bpmnkit/canvas`](https://www.npmjs.com/package/@bpmnkit/canvas) | Zero-dependency SVG BPMN viewer |
+| [`@bpmnkit/editor`](https://www.npmjs.com/package/@bpmnkit/editor) | Full-featured interactive BPMN editor |
+| [`@bpmnkit/engine`](https://www.npmjs.com/package/@bpmnkit/engine) | Lightweight BPMN process execution engine |
+| [`@bpmnkit/feel`](https://www.npmjs.com/package/@bpmnkit/feel) | FEEL expression language parser & evaluator |
+| [`@bpmnkit/plugins`](https://www.npmjs.com/package/@bpmnkit/plugins) | 22 composable canvas plugins |
+| [`@bpmnkit/api`](https://www.npmjs.com/package/@bpmnkit/api) | Camunda 8 REST API TypeScript client |
+| [`@bpmnkit/ascii`](https://www.npmjs.com/package/@bpmnkit/ascii) | Render BPMN diagrams as Unicode ASCII art |
+| [`@bpmnkit/operate`](https://www.npmjs.com/package/@bpmnkit/operate) | Monitoring & operations frontend for Camunda clusters |
+
+## License
+
+[MIT](https://github.com/bpmnkit/monorepo/blob/main/LICENSE) © bpmn-sdk

package/dist/client.d.ts

@@ -0,0 +1,4 @@
+import { AdminApiClient, CamundaClient } from "@bpmnkit/api";
+export declare function createClientFromProfile(profileName?: string): CamundaClient;
+export declare function createAdminClientFromProfile(profileName?: string): AdminApiClient;
+//# sourceMappingURL=client.d.ts.map

package/dist/client.js

@@ -0,0 +1,19 @@
+import { AdminApiClient, CamundaClient } from "@bpmnkit/api";
+import { getActiveProfile, getProfile } from "./profile.js";
+function requireProfile(profileName) {
+    const profile = profileName ? getProfile(profileName) : getActiveProfile();
+    if (!profile) {
+        if (profileName) {
+            throw new Error(`Profile "${profileName}" not found. Run \`casen profile list\` to see available profiles.`);
+        }
+        throw new Error("No active profile. Create one with:\n\n  casen profile create <name> --base-url <url> --auth-type bearer --token <token>\n");
+    }
+    return profile;
+}
+export function createClientFromProfile(profileName) {
+    return new CamundaClient(requireProfile(profileName).config);
+}
+export function createAdminClientFromProfile(profileName) {
+    return new AdminApiClient(requireProfile(profileName).config);
+}
+//# sourceMappingURL=client.js.map

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export type { ApiType, AuditEntry, Profile, Settings } from "./profile.js";
+export { listModelerProfiles } from "./modeler.js";
+export { appendAuditEntry, clearAuditLog, deleteProfile, getActiveProfile, getActiveName, getAuditLog, getConfigFilePath, getProfile, getSettings, listProfiles, saveProfile, saveSettings, useProfile, } from "./profile.js";
+export { createAdminClientFromProfile, createClientFromProfile } from "./client.js";
+export { getAuthHeader } from "./token.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -0,0 +1,5 @@
+export { listModelerProfiles } from "./modeler.js";
+export { appendAuditEntry, clearAuditLog, deleteProfile, getActiveProfile, getActiveName, getAuditLog, getConfigFilePath, getProfile, getSettings, listProfiles, saveProfile, saveSettings, useProfile, } from "./profile.js";
+export { createAdminClientFromProfile, createClientFromProfile } from "./client.js";
+export { getAuthHeader } from "./token.js";
+//# sourceMappingURL=index.js.map

package/dist/modeler.d.ts

@@ -0,0 +1,3 @@
+import type { Profile } from "./profile.js";
+export declare function listModelerProfiles(): Profile[];
+//# sourceMappingURL=modeler.d.ts.map

package/dist/modeler.js

@@ -0,0 +1,95 @@
+import { readFileSync } from "node:fs";
+import { homedir, platform } from "node:os";
+import { join } from "node:path";
+// ─── Modeler config directory ─────────────────────────────────────────────────
+function modelerConfigDir() {
+    const p = platform();
+    if (p === "win32")
+        return join(process.env.APPDATA ?? homedir(), "camunda-modeler");
+    if (p === "darwin")
+        return join(homedir(), "Library", "Application Support", "camunda-modeler");
+    return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "camunda-modeler");
+}
+// ─── Auth mapping ─────────────────────────────────────────────────────────────
+function toAuth(conn) {
+    const targetType = typeof conn.targetType === "string" ? conn.targetType : "";
+    const authType = typeof conn.authType === "string" ? conn.authType : "";
+    // Camunda Cloud (SaaS): use OAuth2 with cloud token endpoint when credentials present
+    if (targetType === "camundaCloud" &&
+        typeof conn.camundaCloudClientId === "string" &&
+        conn.camundaCloudClientId &&
+        typeof conn.camundaCloudClientSecret === "string" &&
+        conn.camundaCloudClientSecret) {
+        return {
+            type: "oauth2",
+            clientId: conn.camundaCloudClientId,
+            clientSecret: conn.camundaCloudClientSecret,
+            tokenUrl: "https://login.cloud.camunda.io/oauth/token",
+            audience: "zeebe.camunda.io",
+        };
+    }
+    // Self-managed OAuth2
+    if ((authType === "clientCredentials" || authType === "oauth2") &&
+        typeof conn.clientId === "string" &&
+        conn.clientId &&
+        typeof conn.clientSecret === "string" &&
+        conn.clientSecret) {
+        return {
+            type: "oauth2",
+            clientId: conn.clientId,
+            clientSecret: conn.clientSecret,
+            tokenUrl: typeof conn.tokenUrl === "string" ? conn.tokenUrl : "",
+            audience: typeof conn.audience === "string" ? conn.audience : undefined,
+        };
+    }
+    // Bearer token
+    if (authType === "bearer" && typeof conn.bearerToken === "string" && conn.bearerToken) {
+        return { type: "bearer", token: conn.bearerToken };
+    }
+    // Basic auth
+    if (authType === "basic" &&
+        typeof conn.username === "string" &&
+        conn.username &&
+        typeof conn.password === "string") {
+        return { type: "basic", username: conn.username, password: conn.password };
+    }
+    return { type: "none" };
+}
+function toProfile(conn) {
+    const name = typeof conn.name === "string" && conn.name ? conn.name : null;
+    if (!name)
+        return null;
+    const baseUrl = typeof conn.contactPoint === "string" && conn.contactPoint ? conn.contactPoint : undefined;
+    return {
+        name,
+        apiType: "c8",
+        config: { baseUrl, auth: toAuth(conn) },
+        createdAt: null,
+        source: "modeler",
+    };
+}
+// ─── Public ───────────────────────────────────────────────────────────────────
+export function listModelerProfiles() {
+    try {
+        const raw = readFileSync(join(modelerConfigDir(), "settings.json"), "utf8");
+        const settings = JSON.parse(raw);
+        if (!settings || typeof settings !== "object")
+            return [];
+        const connections = settings["connectionManagerPlugin.c8connections"];
+        if (!Array.isArray(connections))
+            return [];
+        const profiles = [];
+        for (const conn of connections) {
+            if (!conn || typeof conn !== "object")
+                continue;
+            const profile = toProfile(conn);
+            if (profile)
+                profiles.push(profile);
+        }
+        return profiles;
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=modeler.js.map

package/dist/profile.d.ts

@@ -0,0 +1,35 @@
+import type { CamundaClientInput } from "@bpmnkit/api";
+export type ApiType = "c8" | "admin";
+export interface Profile {
+    name: string;
+    apiType: ApiType;
+    config: CamundaClientInput;
+    createdAt: string | null;
+    source?: "modeler";
+}
+export interface AuditEntry {
+    timestamp: string;
+    group: string;
+    command: string;
+    positional: string[];
+    flags: Record<string, string | boolean | number>;
+    status: "ok" | "error";
+    error?: string;
+}
+export interface Settings {
+    auditLogSize: number;
+}
+export declare function listProfiles(): Profile[];
+export declare function getProfile(name: string): Profile | undefined;
+export declare function getActiveProfile(): Profile | undefined;
+export declare function getActiveName(): string | null;
+export declare function saveProfile(name: string, config: CamundaClientInput, apiType?: ApiType): void;
+export declare function deleteProfile(name: string): boolean;
+export declare function useProfile(name: string): boolean;
+export declare function getConfigFilePath(): string;
+export declare function getSettings(): Settings;
+export declare function saveSettings(settings: Partial<Settings>): void;
+export declare function appendAuditEntry(profile: string, entry: Omit<AuditEntry, "timestamp">): void;
+export declare function getAuditLog(profile?: string): AuditEntry[];
+export declare function clearAuditLog(profile?: string): void;
+//# sourceMappingURL=profile.d.ts.map

package/dist/profile.js

@@ -0,0 +1,153 @@
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir, platform } from "node:os";
+import { join } from "node:path";
+import { listModelerProfiles } from "./modeler.js";
+const DEFAULT_AUDIT_LOG_SIZE = 15;
+// ─── Config directory ─────────────────────────────────────────────────────────
+function configDir() {
+    const p = platform();
+    if (p === "win32")
+        return join(process.env.APPDATA ?? homedir(), "casen");
+    if (p === "darwin")
+        return join(homedir(), "Library", "Application Support", "casen");
+    return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "casen");
+}
+function configFilePath() {
+    return join(configDir(), "config.json");
+}
+// ─── Read / write ─────────────────────────────────────────────────────────────
+function readStore() {
+    try {
+        const raw = readFileSync(configFilePath(), "utf8");
+        const store = JSON.parse(raw);
+        if (!store.meta)
+            store.meta = {};
+        return store;
+    }
+    catch {
+        return { profiles: {}, active: null, meta: {} };
+    }
+}
+function writeStore(store) {
+    const dir = configDir();
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(configFilePath(), JSON.stringify(store, null, 2), "utf8");
+}
+// ─── Public API ───────────────────────────────────────────────────────────────
+export function listProfiles() {
+    const store = readStore();
+    const own = Object.entries(store.profiles).map(([name, config]) => ({
+        name,
+        apiType: store.meta[name]?.apiType ?? "c8",
+        config,
+        createdAt: store.meta[name]?.createdAt ?? null,
+    }));
+    // Merge Camunda Modeler connections; own profiles take precedence by name
+    const ownNames = new Set(own.map((p) => p.name));
+    const modeler = listModelerProfiles().filter((p) => !ownNames.has(p.name));
+    return [...own, ...modeler];
+}
+export function getProfile(name) {
+    const store = readStore();
+    const config = store.profiles[name];
+    if (!config)
+        return undefined;
+    return {
+        name,
+        apiType: store.meta[name]?.apiType ?? "c8",
+        config,
+        createdAt: store.meta[name]?.createdAt ?? null,
+    };
+}
+export function getActiveProfile() {
+    const store = readStore();
+    if (!store.active)
+        return undefined;
+    return getProfile(store.active);
+}
+export function getActiveName() {
+    return readStore().active;
+}
+export function saveProfile(name, config, apiType = "c8") {
+    const store = readStore();
+    store.profiles[name] = config;
+    if (!store.meta[name]) {
+        store.meta[name] = { createdAt: new Date().toISOString(), apiType };
+    }
+    else {
+        store.meta[name].apiType = apiType;
+    }
+    // Auto-activate if this is the first profile
+    if (store.active === null)
+        store.active = name;
+    writeStore(store);
+}
+export function deleteProfile(name) {
+    const store = readStore();
+    if (!(name in store.profiles))
+        return false;
+    const { [name]: _removed, ...rest } = store.profiles;
+    store.profiles = rest;
+    if (store.active === name) {
+        const remaining = Object.keys(store.profiles);
+        store.active = remaining.length > 0 ? (remaining[0] ?? null) : null;
+    }
+    writeStore(store);
+    return true;
+}
+export function useProfile(name) {
+    const store = readStore();
+    if (!(name in store.profiles))
+        return false;
+    store.active = name;
+    writeStore(store);
+    return true;
+}
+export function getConfigFilePath() {
+    return configFilePath();
+}
+// ─── Settings ─────────────────────────────────────────────────────────────────
+export function getSettings() {
+    const store = readStore();
+    return { auditLogSize: store.settings?.auditLogSize ?? DEFAULT_AUDIT_LOG_SIZE };
+}
+export function saveSettings(settings) {
+    const store = readStore();
+    store.settings = { ...store.settings, ...settings };
+    writeStore(store);
+}
+// ─── Audit log ────────────────────────────────────────────────────────────────
+export function appendAuditEntry(profile, entry) {
+    const store = readStore();
+    const size = store.settings?.auditLogSize ?? DEFAULT_AUDIT_LOG_SIZE;
+    const log = store.auditLog ?? {};
+    const existing = log[profile] ?? [];
+    const updated = [...existing, { ...entry, timestamp: new Date().toISOString() }];
+    log[profile] = updated.slice(-size);
+    store.auditLog = log;
+    writeStore(store);
+}
+export function getAuditLog(profile) {
+    const store = readStore();
+    if (!store.auditLog)
+        return [];
+    if (profile)
+        return store.auditLog[profile] ?? [];
+    return Object.values(store.auditLog)
+        .flat()
+        .sort((a, b) => a.timestamp.localeCompare(b.timestamp));
+}
+export function clearAuditLog(profile) {
+    const store = readStore();
+    if (!store.auditLog)
+        return;
+    if (profile) {
+        const { [profile]: _removed, ...rest } = store.auditLog;
+        store.auditLog = rest;
+    }
+    else {
+        store.auditLog = {};
+    }
+    writeStore(store);
+}
+//# sourceMappingURL=profile.js.map

package/dist/token.d.ts

@@ -0,0 +1,9 @@
+import type { CamundaClientInput } from "@bpmnkit/api";
+/**
+ * Returns an Authorization header value for the given client config.
+ * Returns an empty string for `auth.type === "none"` or if auth is unset.
+ *
+ * For OAuth2, tokens are cached in memory and refreshed 60 seconds before expiry.
+ */
+export declare function getAuthHeader(config: CamundaClientInput): Promise<string>;
+//# sourceMappingURL=token.d.ts.map

package/dist/token.js

@@ -0,0 +1,51 @@
+// Simple in-memory token cache keyed by clientId
+const tokenCache = new Map();
+/**
+ * Returns an Authorization header value for the given client config.
+ * Returns an empty string for `auth.type === "none"` or if auth is unset.
+ *
+ * For OAuth2, tokens are cached in memory and refreshed 60 seconds before expiry.
+ */
+export async function getAuthHeader(config) {
+    const auth = config.auth;
+    if (!auth || auth.type === "none")
+        return "";
+    if (auth.type === "bearer")
+        return `Bearer ${auth.token}`;
+    if (auth.type === "basic") {
+        const encoded = Buffer.from(`${auth.username}:${auth.password}`).toString("base64");
+        return `Basic ${encoded}`;
+    }
+    if (auth.type === "oauth2") {
+        const token = await fetchOAuth2Token(auth.clientId, auth.clientSecret, auth.tokenUrl, auth.audience, auth.scope);
+        return `Bearer ${token}`;
+    }
+    return "";
+}
+async function fetchOAuth2Token(clientId, clientSecret, tokenUrl, audience, scope) {
+    const cached = tokenCache.get(clientId);
+    if (cached && cached.expiresAt > Date.now() + 60_000)
+        return cached.token;
+    const body = new URLSearchParams({
+        grant_type: "client_credentials",
+        client_id: clientId,
+        client_secret: clientSecret,
+    });
+    if (audience)
+        body.set("audience", audience);
+    if (scope)
+        body.set("scope", scope);
+    const res = await fetch(tokenUrl, {
+        method: "POST",
+        body,
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    });
+    if (!res.ok) {
+        throw new Error(`OAuth2 token request failed: ${res.status} ${res.statusText}`);
+    }
+    const json = (await res.json());
+    const expiresIn = json.expires_in ?? 3600;
+    tokenCache.set(clientId, { token: json.access_token, expiresAt: Date.now() + expiresIn * 1000 });
+    return json.access_token;
+}
+//# sourceMappingURL=token.js.map

package/package.json

@@ -0,0 +1,34 @@
+{
+	"name": "@bpmnkit/profiles",
+	"version": "0.0.5",
+	"description": "Shared profile storage and auth client factory for @bpmn-sdk CLI and proxy server",
+	"type": "module",
+	"main": "./dist/index.js",
+	"types": "./dist/index.d.ts",
+	"exports": {
+		".": {
+			"import": "./dist/index.js",
+			"types": "./dist/index.d.ts"
+		}
+	},
+	"files": ["dist/**/*.js", "dist/**/*.d.ts"],
+	"engines": {
+		"node": ">=20"
+	},
+	"scripts": {
+		"build": "tsc",
+		"typecheck": "tsc --noEmit",
+		"check": "biome check ."
+	},
+	"dependencies": {
+		"@bpmnkit/api": "workspace:*"
+	},
+	"keywords": ["bpmn", "camunda", "profiles", "authentication", "oauth2", "cli", "typescript"],
+	"publishConfig": {
+		"access": "public"
+	},
+	"repository": {
+		"type": "git",
+		"url": "https://github.com/bpmnkit/monorepo"
+	}
+}