@bulkgrid/cli 0.1.0 → 0.2.0

package/dist/auth-C7pTl5XB.js

@@ -0,0 +1,723 @@
+import { spawn, spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { checkbox, confirm, input, password, select } from "@inquirer/prompts";
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { z } from "zod";
+import { chmod, mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { createServer } from "node:http";
+//#region src/init.ts
+const DEFAULT_SERVER_NAME = "bulkgrid";
+const API_KEY_ENV_VAR = "BULKGRID_API_KEY";
+const MCP_URL_ENV_VAR = "BULKGRID_MCP_URL";
+const DASHBOARD_API_KEYS_URL = "https://bulkgrid.com/dashboard/settings/api-keys";
+const AGENT_CHOICES = [
+	{
+		label: "Cursor",
+		value: "cursor"
+	},
+	{
+		label: "VS Code",
+		value: "vscode"
+	},
+	{
+		label: "Claude Code",
+		value: "claude"
+	},
+	{
+		label: "Codex",
+		value: "codex"
+	}
+];
+function isJsonObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseJsonObject(filePath) {
+	if (!existsSync(filePath)) return {};
+	const parsed = JSON.parse(readFileSync(filePath, "utf8"));
+	if (!isJsonObject(parsed)) throw new Error(`${filePath} must contain a JSON object`);
+	return parsed;
+}
+function writeJsonFile(filePath, data) {
+	mkdirSync(dirname(filePath), { recursive: true });
+	writeFileSync(filePath, `${JSON.stringify(data, null, 2)}\n`);
+}
+function getObjectProperty(parent, key) {
+	const current = parent[key];
+	if (isJsonObject(current)) return current;
+	const next = {};
+	parent[key] = next;
+	return next;
+}
+function buildAuthorizationHeader(context, inputExpression) {
+	if (context.writeApiKey && context.apiKey) return `Bearer ${context.apiKey}`;
+	return `Bearer ${inputExpression}`;
+}
+function buildCursorServer(context) {
+	return {
+		url: context.mcpUrl,
+		headers: { Authorization: buildAuthorizationHeader(context, `\${env:${API_KEY_ENV_VAR}}`) }
+	};
+}
+function mergeCursorConfig(existing, context) {
+	const next = { ...existing };
+	const servers = getObjectProperty(next, "mcpServers");
+	servers[DEFAULT_SERVER_NAME] = buildCursorServer(context);
+	return next;
+}
+function buildVsCodeConfig(context) {
+	return {
+		inputs: [{
+			type: "promptString",
+			id: "bulkgrid-api-key",
+			description: "Bulkgrid API Key",
+			password: true
+		}],
+		servers: { [DEFAULT_SERVER_NAME]: {
+			type: "http",
+			url: context.mcpUrl,
+			headers: { Authorization: buildAuthorizationHeader(context, "${input:bulkgrid-api-key}") }
+		} }
+	};
+}
+function mergeVsCodeConfig(existing, context) {
+	const next = { ...existing };
+	const config = buildVsCodeConfig(context);
+	const existingServers = getObjectProperty(next, "servers");
+	const configServers = getObjectProperty(config, "servers");
+	existingServers[DEFAULT_SERVER_NAME] = configServers[DEFAULT_SERVER_NAME] ?? {};
+	if (!Array.isArray(next.inputs)) {
+		next.inputs = config.inputs ?? [];
+		return next;
+	}
+	if (!next.inputs.some((item) => isJsonObject(item) && item.id === "bulkgrid-api-key") && Array.isArray(config.inputs)) next.inputs = [...next.inputs, ...config.inputs];
+	return next;
+}
+function resolveCursorPath(scope) {
+	if (scope === "global") return join(homedir(), ".cursor", "mcp.json");
+	return join(process.cwd(), ".cursor", "mcp.json");
+}
+function resolveVsCodePath(scope) {
+	if (scope === "global") {
+		if (process.platform === "darwin") return join(homedir(), "Library", "Application Support", "Code", "User", "mcp.json");
+		if (process.platform === "win32") return join(homedir(), "AppData", "Roaming", "Code", "User", "mcp.json");
+		return join(homedir(), ".config", "Code", "User", "mcp.json");
+	}
+	return join(process.cwd(), ".vscode", "mcp.json");
+}
+function setupCursor(context) {
+	const filePath = resolveCursorPath(context.scope);
+	writeJsonFile(filePath, mergeCursorConfig(parseJsonObject(filePath), context));
+	return {
+		agent: "cursor",
+		status: "configured",
+		message: `Wrote ${filePath}`
+	};
+}
+function setupVsCode(context) {
+	const filePath = resolveVsCodePath(context.scope);
+	writeJsonFile(filePath, mergeVsCodeConfig(parseJsonObject(filePath), context));
+	return {
+		agent: "vscode",
+		status: "configured",
+		message: `Wrote ${filePath}`
+	};
+}
+function commandExists(command) {
+	return spawnSync(command, ["--version"], {
+		encoding: "utf8",
+		stdio: "ignore"
+	}).status === 0;
+}
+function runCommand(command, args) {
+	const result = spawnSync(command, args, {
+		encoding: "utf8",
+		stdio: "inherit"
+	});
+	if (result.error) throw result.error;
+	if (result.status !== 0) throw new Error(`${command} ${args.join(" ")} failed with exit code ${result.status ?? "unknown"}`);
+}
+function printInitBanner() {
+	console.log("");
+	console.log("  ▦ Bulkgrid init");
+	console.log("");
+}
+async function promptForConfirmation(message, defaultValue) {
+	return confirm({
+		message,
+		default: defaultValue
+	});
+}
+async function promptForSelect(message, choices) {
+	return select({
+		message,
+		choices: choices.map((choice) => ({
+			name: choice.label,
+			value: choice.value
+		}))
+	});
+}
+async function promptForMultiSelect(message, choices) {
+	return checkbox({
+		message,
+		choices: choices.map((choice) => ({
+			name: choice.label,
+			value: choice.value,
+			checked: true
+		})),
+		required: true,
+		pageSize: choices.length
+	});
+}
+async function maybeInstallGlobally(options) {
+	if (options.installGlobal) {
+		runCommand("npm", [
+			"install",
+			"-g",
+			"@bulkgrid/cli"
+		]);
+		return;
+	}
+	if (options.yes) return;
+	if (await promptForConfirmation("Install @bulkgrid/cli globally?", false)) runCommand("npm", [
+		"install",
+		"-g",
+		"@bulkgrid/cli"
+	]);
+}
+function openBrowser(url) {
+	let command;
+	let args;
+	if (process.platform === "darwin") {
+		command = "open";
+		args = [url];
+	} else if (process.platform === "win32") {
+		command = "cmd";
+		args = [
+			"/c",
+			"start",
+			"",
+			url
+		];
+	} else {
+		command = "xdg-open";
+		args = [url];
+	}
+	if (spawnSync(command, args, {
+		encoding: "utf8",
+		stdio: "ignore"
+	}).status !== 0) console.log(`Open ${url} to create a Bulkgrid API key.`);
+}
+async function resolveApiKey(options) {
+	const configuredApiKey = options.apiKey ?? process.env[API_KEY_ENV_VAR];
+	if (configuredApiKey || options.yes) return configuredApiKey;
+	const authMode = options.auth ?? await promptForSelect("Authenticate to Bulkgrid", [
+		{
+			label: "Open the dashboard and paste a new API key",
+			value: "browser"
+		},
+		{
+			label: "Enter an existing API key",
+			value: "manual"
+		},
+		{
+			label: "Skip this step",
+			value: "skip"
+		}
+	]);
+	if (authMode === "skip") {
+		console.log(`Skipped. Set ${API_KEY_ENV_VAR} later or use client-side prompts.`);
+		return;
+	}
+	if (authMode === "browser") {
+		openBrowser(DASHBOARD_API_KEYS_URL);
+		console.log("Create an API key with mcp:use and search:query scopes.");
+	}
+	return await password({
+		message: "Bulkgrid API key",
+		mask: "*",
+		validate: (value) => value.trim().length > 0 || "Enter a Bulkgrid API key."
+	}) || void 0;
+}
+function setupCodex(context) {
+	if (!commandExists("codex")) return {
+		agent: "codex",
+		status: "skipped",
+		message: "codex command was not found"
+	};
+	runCommand("codex", [
+		"mcp",
+		"add",
+		DEFAULT_SERVER_NAME,
+		"--url",
+		context.mcpUrl,
+		"--bearer-token-env-var",
+		API_KEY_ENV_VAR
+	]);
+	return {
+		agent: "codex",
+		status: "configured",
+		message: `Registered ${DEFAULT_SERVER_NAME} with codex mcp add`
+	};
+}
+function setupClaude(context) {
+	if (!commandExists("claude")) return {
+		agent: "claude",
+		status: "skipped",
+		message: "claude command was not found"
+	};
+	if (!context.apiKey) return {
+		agent: "claude",
+		status: "skipped",
+		message: `Set ${API_KEY_ENV_VAR} or pass --api-key to configure Claude Code`
+	};
+	const args = [
+		"mcp",
+		"add",
+		"--transport",
+		"http"
+	];
+	if (context.scope === "global") args.push("--scope", "user");
+	args.push(DEFAULT_SERVER_NAME, context.mcpUrl, "--header", `Authorization: Bearer ${context.apiKey}`);
+	runCommand("claude", args);
+	return {
+		agent: "claude",
+		status: "configured",
+		message: `Registered ${DEFAULT_SERVER_NAME} with claude mcp add`
+	};
+}
+async function resolveAgents(options) {
+	if (options.all || !options.cursor && !options.vscode && !options.claude && !options.codex) {
+		if (!options.all && !options.yes) {
+			if (!await promptForConfirmation("Configure the Bulkgrid MCP server for clients?", true)) return [];
+			return promptForMultiSelect("Choose MCP clients to configure:", AGENT_CHOICES);
+		}
+		return [
+			"cursor",
+			"vscode",
+			"claude",
+			"codex"
+		];
+	}
+	const agents = [];
+	if (options.cursor) agents.push("cursor");
+	if (options.vscode) agents.push("vscode");
+	if (options.claude) agents.push("claude");
+	if (options.codex) agents.push("codex");
+	return agents;
+}
+async function promptForValue(message) {
+	return input({
+		message,
+		validate: (value) => value.trim().length > 0 || "Enter a value."
+	});
+}
+async function buildContext(options) {
+	const mcpUrl = options.mcpUrl ?? process.env[MCP_URL_ENV_VAR] ?? (options.yes ? void 0 : await promptForValue("Bulkgrid MCP URL: "));
+	if (!mcpUrl) throw new Error(`Missing MCP URL. Pass --mcp-url or set ${MCP_URL_ENV_VAR}.`);
+	const apiKey = await resolveApiKey(options);
+	return {
+		agents: await resolveAgents(options),
+		mcpUrl,
+		apiKey,
+		scope: options.global ? "global" : "project",
+		writeApiKey: options.writeApiKey ?? false
+	};
+}
+async function runInitCommand(options) {
+	printInitBanner();
+	await maybeInstallGlobally(options);
+	const context = await buildContext(options);
+	const results = [];
+	for (const agent of context.agents) if (agent === "cursor") results.push(setupCursor(context));
+	else if (agent === "vscode") results.push(setupVsCode(context));
+	else if (agent === "claude") results.push(setupClaude(context));
+	else if (agent === "codex") results.push(setupCodex(context));
+	return results;
+}
+//#endregion
+//#region src/authStorage.ts
+const credentialsSchema = z.object({
+	origin: z.string().url(),
+	issuer: z.string().url(),
+	tokenEndpoint: z.string().url(),
+	clientId: z.string().min(1),
+	accessToken: z.string().min(1),
+	refreshToken: z.string().min(1),
+	expiresAt: z.number().finite()
+});
+function hasCode(error, code) {
+	return error instanceof Error && "code" in error && error.code === code;
+}
+var AuthStorage = class {
+	directory;
+	constructor(directory = join(homedir(), ".config", "bulkgrid")) {
+		this.directory = directory;
+	}
+	path(origin) {
+		return join(this.directory, `${createHash("sha256").update(origin).digest("hex")}.json`);
+	}
+	async read(origin) {
+		try {
+			const result = credentialsSchema.safeParse(JSON.parse(await readFile(this.path(origin), "utf8")));
+			if (!result.success || result.data.origin !== origin) throw new Error("Invalid saved CLI credentials. Run bulkgrid logout --local to clear them.");
+			return result.data;
+		} catch (error) {
+			if (hasCode(error, "ENOENT")) return;
+			if (error instanceof SyntaxError) throw new Error("Invalid saved CLI credentials. Run bulkgrid logout --local to clear them.");
+			throw error;
+		}
+	}
+	async save(credentials) {
+		await mkdir(this.directory, {
+			recursive: true,
+			mode: 448
+		});
+		await chmod(this.directory, 448);
+		const target = this.path(credentials.origin);
+		const temporary = `${target}.${randomUUID()}.tmp`;
+		try {
+			await writeFile(temporary, JSON.stringify(credentials), {
+				mode: 384,
+				flag: "wx"
+			});
+			await rename(temporary, target);
+		} finally {
+			await unlink(temporary).catch((error) => {
+				if (!hasCode(error, "ENOENT")) throw error;
+			});
+		}
+	}
+	async clear(origin) {
+		await unlink(this.path(origin)).catch((error) => {
+			if (!hasCode(error, "ENOENT")) throw error;
+		});
+	}
+	async exclusive(origin, operation) {
+		await mkdir(this.directory, {
+			recursive: true,
+			mode: 448
+		});
+		const lock = `${this.path(origin)}.lock`;
+		try {
+			await writeFile(lock, String(process.pid), {
+				flag: "wx",
+				mode: 384
+			});
+		} catch (error) {
+			if (hasCode(error, "EEXIST")) throw new Error(`Another CLI authentication operation is running. If it has stopped, remove ${lock} and retry.`);
+			throw error;
+		}
+		try {
+			return await operation();
+		} finally {
+			await unlink(lock);
+		}
+	}
+};
+//#endregion
+//#region src/oauthCallback.ts
+const CLI_CALLBACK_PATH = "/bulkgrid/cli/callback";
+async function listenForOAuthCallback(state, issuer, timeoutMs = 3e5) {
+	let resolveCode;
+	let rejectCode;
+	const code = new Promise((resolve, reject) => {
+		resolveCode = resolve;
+		rejectCode = reject;
+	});
+	code.catch(() => void 0);
+	let redirectUri = "";
+	const server = createServer((request, response) => {
+		response.setHeader("Content-Type", "text/plain; charset=utf-8");
+		response.setHeader("Cache-Control", "no-store");
+		response.setHeader("Referrer-Policy", "no-referrer");
+		let url;
+		try {
+			url = new URL(request.url ?? "/", redirectUri);
+		} catch {
+			response.writeHead(400).end("Invalid callback URL.");
+			return;
+		}
+		if (request.method !== "GET" || url.pathname !== "/bulkgrid/cli/callback" || request.headers.host !== new URL(redirectUri).host) {
+			response.writeHead(404).end("Not found");
+			return;
+		}
+		const receivedState = url.searchParams.get("state") ?? "";
+		if (Buffer.byteLength(receivedState) !== Buffer.byteLength(state) || !timingSafeEqual(Buffer.from(receivedState), Buffer.from(state))) {
+			response.writeHead(400).end("Invalid login state. Return to the original login tab.");
+			return;
+		}
+		if (url.searchParams.has("iss") && url.searchParams.get("iss") !== issuer) {
+			response.writeHead(400).end("Invalid authorization server.");
+			rejectCode(/* @__PURE__ */ new Error("OAuth callback issuer did not match."));
+			return;
+		}
+		if (url.searchParams.has("error")) {
+			response.writeHead(400).end("Login was declined. Return to your terminal.");
+			rejectCode(/* @__PURE__ */ new Error("Authorization was declined. Run bulkgrid login to try again."));
+			return;
+		}
+		const authorizationCode = url.searchParams.get("code");
+		if (!authorizationCode) {
+			response.writeHead(400).end("Missing authorization code.");
+			return;
+		}
+		response.end("Authorization received. Return to your terminal to check login completed.");
+		resolveCode(authorizationCode);
+	});
+	await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(0, "127.0.0.1", () => {
+			server.removeListener("error", reject);
+			resolve();
+		});
+	});
+	const address = server.address();
+	if (!address || typeof address === "string") {
+		server.close();
+		throw new Error("Unable to start the CLI login callback.");
+	}
+	redirectUri = `http://127.0.0.1:${address.port}${CLI_CALLBACK_PATH}`;
+	const timer = setTimeout(() => rejectCode(/* @__PURE__ */ new Error("Login timed out. Run bulkgrid login to try again.")), timeoutMs);
+	const cancel = () => rejectCode(/* @__PURE__ */ new Error("Login cancelled."));
+	process.once("SIGINT", cancel);
+	process.once("SIGTERM", cancel);
+	return {
+		redirectUri,
+		code,
+		close: () => {
+			clearTimeout(timer);
+			process.removeListener("SIGINT", cancel);
+			process.removeListener("SIGTERM", cancel);
+			server.closeAllConnections();
+			server.close();
+		}
+	};
+}
+//#endregion
+//#region src/auth.ts
+const DEFAULT_ORIGIN = "https://bulkgrid.com";
+const identityScopes = "openid email profile";
+const metadataSchema = z.object({
+	issuer: z.string().url(),
+	authorization_endpoint: z.string().url(),
+	token_endpoint: z.string().url(),
+	registration_endpoint: z.string().url(),
+	code_challenge_methods_supported: z.array(z.string())
+});
+const tokensSchema = z.object({
+	access_token: z.string().min(1),
+	refresh_token: z.string().min(1),
+	token_type: z.string().refine((value) => value.toLowerCase() === "bearer"),
+	expires_in: z.number().positive().finite()
+});
+const sessionSchema = z.object({
+	userId: z.string(),
+	workspaceId: z.string(),
+	clientName: z.string().nullable(),
+	scopes: z.array(z.string()),
+	collectionScope: z.enum(["all", "selected"])
+});
+var HttpError = class extends Error {
+	status;
+	constructor(status) {
+		super(`Authentication request failed (HTTP ${status}). Check the server configuration or run bulkgrid login again.`);
+		this.status = status;
+	}
+};
+function secureUrl(value) {
+	const url = new URL(value);
+	const local = [
+		"localhost",
+		"127.0.0.1",
+		"[::1]"
+	].includes(url.hostname);
+	if (url.protocol !== "https:" && !(url.protocol === "http:" && local) || url.username || url.password || url.hash) throw new Error("Authentication URLs must use HTTPS (HTTP is allowed only for local development).");
+	return url;
+}
+function resolveOrigin(value = process.env.BULKGRID_URL ?? DEFAULT_ORIGIN) {
+	const url = secureUrl(value);
+	if (url.pathname !== "/" || url.search) throw new Error("Use the Bulkgrid base URL, such as https://bulkgrid.com, without a path or query.");
+	return url.origin;
+}
+function openLoginBrowser(url) {
+	const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "rundll32" : "xdg-open";
+	const args = process.platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
+	const child = spawn(command, args, {
+		stdio: "ignore",
+		detached: true
+	});
+	child.on("error", () => console.log("Could not open a browser. Open the login URL above manually."));
+	child.unref();
+}
+var CliAuth = class {
+	storage;
+	fetcher;
+	constructor(storage = new AuthStorage(), fetcher = fetch) {
+		this.storage = storage;
+		this.fetcher = fetcher;
+	}
+	async request(url, init) {
+		secureUrl(url);
+		const response = await this.fetcher(url, {
+			...init,
+			redirect: "error",
+			signal: AbortSignal.timeout(15e3)
+		});
+		if (!response.ok) throw new HttpError(response.status);
+		return response;
+	}
+	async requestJson(url, init) {
+		const response = await this.request(url, init);
+		try {
+			return await response.json();
+		} catch {
+			throw new Error("The authentication server returned invalid JSON.");
+		}
+	}
+	async discover(origin) {
+		const resource = `${origin}/api/v1/mcp`;
+		const response = await this.requestJson(`${origin}/.well-known/oauth-protected-resource/api/v1/mcp`);
+		const protectedResource = z.object({
+			resource: z.literal(resource),
+			authorization_servers: z.array(z.string().url()).length(1)
+		}).parse(response);
+		const issuer = secureUrl(protectedResource.authorization_servers[0]);
+		if (issuer.search) throw new Error("Invalid authorization server issuer.");
+		const discoveryUrl = `${issuer.origin}/.well-known/oauth-authorization-server${issuer.pathname === "/" ? "" : issuer.pathname}`;
+		const metadata = metadataSchema.parse(await this.requestJson(discoveryUrl));
+		if (metadata.issuer !== protectedResource.authorization_servers[0] || !metadata.code_challenge_methods_supported.includes("S256")) throw new Error("Authorization server discovery must match its issuer and support PKCE S256.");
+		for (const endpoint of [
+			metadata.authorization_endpoint,
+			metadata.token_endpoint,
+			metadata.registration_endpoint
+		]) if (secureUrl(endpoint).origin !== issuer.origin) throw new Error("OAuth endpoints must belong to the discovered authorization server.");
+		return metadata;
+	}
+	async login(options = {}, openBrowser = openLoginBrowser) {
+		const origin = resolveOrigin(options.url);
+		return this.storage.exclusive(origin, async () => {
+			if (await this.storage.read(origin)) throw new Error("A CLI login is already saved for this server. Use bulkgrid status or bulkgrid logout first.");
+			const metadata = await this.discover(origin);
+			const verifier = randomBytes(32).toString("base64url");
+			const state = randomBytes(32).toString("base64url");
+			const callback = await listenForOAuthCallback(state, metadata.issuer);
+			try {
+				const registration = z.object({ client_id: z.string().min(1) }).parse(await this.requestJson(metadata.registration_endpoint, {
+					method: "POST",
+					headers: { "Content-Type": "application/json" },
+					body: JSON.stringify({
+						client_name: "Bulkgrid CLI",
+						client_uri: origin,
+						redirect_uris: [callback.redirectUri],
+						grant_types: ["authorization_code", "refresh_token"],
+						response_types: ["code"],
+						token_endpoint_auth_method: "none",
+						scope: identityScopes
+					})
+				}));
+				const authorizationUrl = new URL(metadata.authorization_endpoint);
+				authorizationUrl.search = new URLSearchParams({
+					response_type: "code",
+					client_id: registration.client_id,
+					redirect_uri: callback.redirectUri,
+					scope: identityScopes,
+					state,
+					code_challenge: createHash("sha256").update(verifier).digest("base64url"),
+					code_challenge_method: "S256",
+					prompt: "consent"
+				}).toString();
+				console.log(`Sign in and approve access:\n${authorizationUrl.href}`);
+				if (options.browser !== false) openBrowser(authorizationUrl.href);
+				const code = await callback.code;
+				const tokens = await this.exchange(metadata.token_endpoint, {
+					grant_type: "authorization_code",
+					client_id: registration.client_id,
+					code,
+					redirect_uri: callback.redirectUri,
+					code_verifier: verifier
+				});
+				const credentials = {
+					origin,
+					issuer: metadata.issuer,
+					tokenEndpoint: metadata.token_endpoint,
+					clientId: registration.client_id,
+					accessToken: tokens.access_token,
+					refreshToken: tokens.refresh_token,
+					expiresAt: Date.now() + tokens.expires_in * 1e3
+				};
+				await this.storage.save(credentials);
+				return await this.session(credentials);
+			} finally {
+				callback.close();
+			}
+		});
+	}
+	async exchange(endpoint, body) {
+		return tokensSchema.parse(await this.requestJson(endpoint, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams(body)
+		}));
+	}
+	async credentials(origin) {
+		const saved = await this.storage.read(origin);
+		if (!saved) throw new Error("Not logged in. Run bulkgrid login.");
+		if (secureUrl(saved.tokenEndpoint).origin !== secureUrl(saved.issuer).origin) throw new Error("Saved token endpoint does not match the authorization server. Log out locally and sign in again.");
+		if (saved.expiresAt > Date.now() + 6e4) return saved;
+		const tokens = await this.exchange(saved.tokenEndpoint, {
+			grant_type: "refresh_token",
+			client_id: saved.clientId,
+			refresh_token: saved.refreshToken
+		});
+		const refreshed = {
+			...saved,
+			accessToken: tokens.access_token,
+			refreshToken: tokens.refresh_token,
+			expiresAt: Date.now() + tokens.expires_in * 1e3
+		};
+		await this.storage.save(refreshed);
+		return refreshed;
+	}
+	async session(credentials) {
+		return sessionSchema.parse(await this.requestJson(`${credentials.origin}/api/v1/cli/session`, { headers: { Authorization: `Bearer ${credentials.accessToken}` } }));
+	}
+	async status(url) {
+		const origin = resolveOrigin(url);
+		return this.storage.exclusive(origin, async () => this.session(await this.credentials(origin)));
+	}
+	/** For CLI API consumers; tokens are never copied into agent/project configuration. */
+	async getAccessToken(url) {
+		const origin = resolveOrigin(url);
+		return this.storage.exclusive(origin, async () => {
+			const credentials = await this.credentials(origin);
+			await this.session(credentials);
+			return credentials.accessToken;
+		});
+	}
+	async logout(options = {}) {
+		const origin = resolveOrigin(options.url);
+		await this.storage.exclusive(origin, async () => {
+			if (options.local) {
+				await this.storage.clear(origin);
+				return;
+			}
+			if (!await this.storage.read(origin)) return;
+			try {
+				const credentials = await this.credentials(origin);
+				await this.request(`${origin}/api/v1/cli/session`, {
+					method: "DELETE",
+					headers: { Authorization: `Bearer ${credentials.accessToken}` }
+				});
+			} catch {
+				throw new Error("Could not revoke the CLI connection. Retry, or revoke it in Connected Apps and use bulkgrid logout --local.");
+			}
+			await this.storage.clear(origin);
+		});
+	}
+};
+//#endregion
+export { resolveOrigin as n, runInitCommand as r, CliAuth as t };
+
+//# sourceMappingURL=auth-C7pTl5XB.js.map