@burdenoff/bigconsole-cli 2026.1029.1 → 2026.1110.1

package/dist/utils/parse.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Parse an optimistic-lock `--version` value. Accepts whole numbers only:
+ * `parseInt` would silently turn "7junk" or "7.5" into 7 and send the wrong version.
+ */
+export declare function parseVersion(raw: string): number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burdenoff/bigconsole-cli",
-  "version": "2026.1029.1",
+  "version": "2026.1110.1",
   "description": "Command-line interface for BigConsole platform operations and management",
   "type": "module",
   "main": "dist/index.js",
@@ -14,27 +14,23 @@
     "README.md"
   ],
   "scripts": {
-    "build": "tsc && tsc-alias",
-    "build:watch": "tsc -w",
-    "dev": "tsx watch src/cli.ts",
+    "build": "bun build src/cli.ts src/index.ts --outdir dist --target node --packages external --root src && tsc -p tsconfig.build.json",
+    "dev": "bun --watch src/cli.ts",
     "pretest": "bun run build",
-    "test": "bash scripts/build-limits.sh vitest run",
-    "test:coverage": "vitest --coverage",
-    "test:ui": "vitest --ui",
-    "lint": "eslint src --fix",
-    "lint:sanity": "if [ \"${CI:-}\" = \"true\" ]; then bun run lint; else bun run lint -- --cache --cache-location .eslintcache; fi",
-    "lint:check": "eslint src",
-    "format": "prettier --write \"src/**/*.{ts,js,json,md}\"",
-    "format:check": "prettier --check \"src/**/*.{ts,js,json,md}\"",
-    "type-check": "bash scripts/build-limits.sh tsc --noEmit",
-    "sanity": "bash scripts/build-limits.sh --gate bash -c 'bun run format && bun run lint:sanity && bun run type-check && bun run test && bun run build'",
-    "clean": "rimraf dist",
+    "test": "bun test --isolate",
+    "test:coverage": "bun test --coverage",
+    "lint": "eslint .",
+    "format": "bun fmt",
+    "format:check": "bun fmt --check",
+    "sanity": "boff sanity",
+    "clean": "rm -rf dist coverage junit.xml",
     "prepublishOnly": "bun run clean && bun run build",
-    "audit": "bunx better-npm-audit audit",
+    "audit": "bun audit --audit-level=high",
     "start": "bun dist/cli.js",
-    "publish:alpha": "bun run build && bunx npm@latest publish --tag alpha",
-    "publish:prod": "bun run build && bunx npm@latest publish",
-    "schema:pull": "bash scripts/schema-pull.sh"
+    "schema:pull": "bash scripts/schema-pull.sh",
+    "type:check": "boff gate -- bun check --no-pretty",
+    "sanity:force": "boff sanity --force",
+    "lint:fix": "eslint . --fix"
   },
   "keywords": [
     "algoshred",
@@ -66,37 +62,22 @@
     "cross-fetch": "^4.1.0",
     "graphql": "^17.0.2",
     "graphql-request": "^7.4.0",
-    "inquirer": "^14.1.0",
     "js-yaml": "^5.4.1",
-    "ora": "^9.4.1",
-    "table": "^6.9.0",
     "update-notifier": "^7.3.1"
   },
   "devDependencies": {
-    "@eslint/js": "^10.0.1",
+    "@burdenoff/toolchain": "2026.1107.14",
     "@playwright/test": "^1.62.1",
-    "@types/inquirer": "^9.0.10",
-    "@types/node": "^26.3.0",
+    "@types/bun": "^1.4.4",
     "@types/update-notifier": "^6.0.8",
-    "@typescript-eslint/eslint-plugin": "^8.68.0",
-    "@typescript-eslint/parser": "^8.68.0",
-    "@vitest/coverage-v8": "^4.1.11",
-    "@vitest/ui": "^4.1.11",
-    "eslint": "^10.9.1",
-    "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-prettier": "^5.5.6",
-    "globals": "^17.11.0",
-    "prettier": "^3.9.6",
-    "rimraf": "^6.1.3",
-    "tsc-alias": "^1.9.2",
-    "tsx": "^4.23.12",
-    "typescript": "^5.9.3",
-    "vitest": "^4.1.11",
+    "eslint": "^9.39.4",
+    "knip": "^6.44.1",
+    "typescript": "6.0.3",
     "yaml": "^2.8.3"
   },
   "engines": {
     "node": ">=24.11.0",
-    "bun": ">=1.3.10"
+    "bun": ">=1.4.4"
   },
   "overrides": {
     "lodash": ">=4.17.21",
@@ -105,7 +86,7 @@
     "fast-xml-parser": ">=4.5.5",
     "@xmldom/xmldom": ">=0.8.12",
     "swiper": ">=12.1.2",
-    "brace-expansion": "5.0.9",
+    "brace-expansion": "5.0.12",
     "follow-redirects": ">=1.15.12",
     "smol-toml": ">=1.6.1",
     "axios": ">=1.15.0",
@@ -119,5 +100,25 @@
     "vite": "8.2.2",
     "fast-uri": "4.1.3",
     "esbuild": "0.28.2"
+  },
+  "packageManager": "bun@1.4.4",
+  "trustedDependencies": [],
+  "boff": {
+    "type": "cli",
+    "sanity": {
+      "steps": [
+        "format",
+        "lint",
+        "typecheck",
+        "build",
+        "test",
+        "knip"
+      ]
+    },
+    "scripts": {
+      "unmanaged": [
+        "test"
+      ]
+    }
   }
 }

package/dist/auth/device-code.js

@@ -1,244 +0,0 @@
-/**
- * OAuth2 Device Code flow implementation.
- * Used for CLI authentication (similar to `gh auth login`).
- */
-import fetch from 'cross-fetch';
-import { MAX_HTTP_BODY_EXCERPT_LENGTH, summarizeHttpBody, toDisplayLine, } from '../utils/sanitize.js';
-/** Bounded, printable form of a server-supplied error message. */
-function serverMessage(message) {
-    return toDisplayLine(message, MAX_HTTP_BODY_EXCERPT_LENGTH) || 'Unknown error';
-}
-/** Error for a non-2xx response; only a short, sanitized body excerpt is kept. */
-async function httpFailure(prefix, response) {
-    const body = await response.text().catch(() => '');
-    return new Error(`${prefix} (${response.status}): ${summarizeHttpBody(body)}`);
-}
-/**
- * Start the device code flow by requesting a device code from the OIDC issuer.
- */
-export async function startDeviceCodeFlow(config) {
-    const url = `${config.oidcIssuer}/oidc/device/code`;
-    const body = new URLSearchParams({
-        client_id: config.clientId,
-        scope: 'openid profile email offline_access',
-    });
-    const response = await fetch(url, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-        body: body.toString(),
-    });
-    if (!response.ok) {
-        throw await httpFailure('Device code request failed', response);
-    }
-    const data = (await response.json());
-    return {
-        deviceCode: data['device_code'],
-        userCode: data['user_code'],
-        verificationUri: data['verification_uri'],
-        verificationUriComplete: data['verification_uri_complete'] ?? null,
-        expiresIn: data['expires_in'],
-        interval: data['interval'] ?? 5,
-    };
-}
-/**
- * Poll the token endpoint until the user approves or the code expires.
- */
-export async function pollForToken(deviceCode, interval, config) {
-    const url = `${config.oidcIssuer}/oauth/device/token`;
-    let pollInterval = interval;
-    while (true) {
-        await new Promise((resolve) => setTimeout(resolve, pollInterval * 1000));
-        const response = await fetch(url, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body: new URLSearchParams({
-                grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
-                device_code: deviceCode,
-                client_id: config.clientId,
-            }).toString(),
-        });
-        // Guard against non-JSON responses (e.g. a 502 HTML error page from a
-        // gateway during a restart). Parsing those as JSON throws SyntaxError,
-        // aborts the whole poll loop, and forces the user to re-run
-        // `bigconsole auth login` from scratch even though the transient error
-        // would have cleared on the next tick.
-        const raw = await response.text();
-        let data;
-        try {
-            data = JSON.parse(raw);
-        }
-        catch {
-            if (response.status >= 500) {
-                // Treat it like authorization_pending — keep polling.
-                continue;
-            }
-            throw new Error(`Token endpoint returned non-JSON response (status ${response.status}): ${summarizeHttpBody(raw)}`);
-        }
-        if (response.ok && data['access_token']) {
-            return {
-                accessToken: data['access_token'],
-                refreshToken: data['refresh_token'] ?? '',
-                expiresIn: data['expires_in'] ?? 3600,
-            };
-        }
-        const errorCode = data['error'];
-        switch (errorCode) {
-            case 'authorization_pending':
-                continue;
-            case 'slow_down':
-                pollInterval += 5;
-                continue;
-            case 'expired_token':
-                throw new Error('Device code has expired. Please try again.');
-            case 'access_denied':
-                throw new Error('Authorization was denied by the user.');
-            default:
-                throw new Error(`Device code polling failed: ${serverMessage(data['error_description'] ?? errorCode)}`);
-        }
-    }
-}
-/**
- * Authenticate using client credentials (app authentication).
- * Calls the AuthenticateApp mutation on the global gateway.
- */
-export async function clientCredentialsFlow(globalEndpoint, clientId, clientSecret, scopes) {
-    const query = `
-    mutation AuthenticateApp($input: AuthenticateAppInput!) {
-      authenticateApp(input: $input) {
-        accessToken tokenType expiresIn scopes
-      }
-    }
-  `;
-    const response = await fetch(globalEndpoint, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-            query,
-            variables: { input: { clientId, clientSecret, scopes } },
-        }),
-    });
-    if (!response.ok) {
-        throw await httpFailure('App authentication failed', response);
-    }
-    const data = (await response.json());
-    if (data.errors?.length) {
-        throw new Error(`App authentication failed: ${serverMessage(data.errors[0]?.message)}`);
-    }
-    if (!data.data?.authenticateApp?.accessToken) {
-        throw new Error('App authentication failed: no access token returned');
-    }
-    return data.data.authenticateApp;
-}
-/**
- * Issue a workspace token by calling the workspace gateway with an auth token.
- * Only sends Authorization header (no X-Workspace-Authorization).
- */
-export async function issueWorkspaceToken(workspaceEndpoint, authToken, workspaceId, organizationId) {
-    const query = `
-    mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {
-      issueWorkspaceToken(input: $input) {
-        success token expiresAt scopes
-        error { code message }
-      }
-    }
-  `;
-    const response = await fetch(workspaceEndpoint, {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/json',
-            Authorization: `Bearer ${authToken}`,
-        },
-        body: JSON.stringify({
-            query,
-            variables: { input: { workspaceId, organizationId } },
-        }),
-    });
-    if (!response.ok) {
-        throw await httpFailure('Workspace token request failed', response);
-    }
-    const data = (await response.json());
-    if (data.errors?.length) {
-        throw new Error(`Workspace token failed: ${serverMessage(data.errors[0]?.message)}`);
-    }
-    const result = data.data?.issueWorkspaceToken;
-    if (!result?.success || !result.token) {
-        throw new Error(`Workspace token failed: ${serverMessage(result?.error?.message)}`);
-    }
-    return { token: result.token, expiresAt: result.expiresAt, scopes: result.scopes ?? [] };
-}
-/**
- * Fetch user's workspaces from the global gateway.
- */
-export async function fetchWorkspaces(globalEndpoint, authToken) {
-    const query = `
-    query MyWorkspaces($limit: Int) {
-      myWorkspaces(limit: $limit) {
-        items { id name slug tenantId organizationId }
-      }
-    }
-  `;
-    const response = await fetch(globalEndpoint, {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/json',
-            Authorization: `Bearer ${authToken}`,
-        },
-        body: JSON.stringify({ query, variables: { limit: 50 } }),
-    });
-    if (!response.ok) {
-        throw await httpFailure('Failed to fetch workspaces', response);
-    }
-    const data = (await response.json());
-    if (data.errors?.length) {
-        throw new Error(`Failed to fetch workspaces: ${serverMessage(data.errors[0]?.message)}`);
-    }
-    return data.data?.myWorkspaces?.items ?? [];
-}
-/**
- * Validate that a string is a well-formed HTTP(S) URL.
- * Prevents command injection by rejecting anything that isn't a valid URL.
- */
-function isValidHttpUrl(urlString) {
-    try {
-        const parsed = new URL(urlString);
-        return parsed.protocol === 'http:' || parsed.protocol === 'https:';
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Attempt to open a URL in the user's default browser.
- * Uses execFile instead of exec to avoid shell interpretation and command injection.
- */
-export async function openBrowser(url) {
-    try {
-        if (!isValidHttpUrl(url)) {
-            return false;
-        }
-        const { execFile } = await import('child_process');
-        const platform = process.platform;
-        let command;
-        let args;
-        if (platform === 'darwin') {
-            command = 'open';
-            args = [url];
-        }
-        else if (platform === 'win32') {
-            command = 'cmd';
-            args = ['/c', 'start', '', url];
-        }
-        else {
-            command = 'xdg-open';
-            args = [url];
-        }
-        return new Promise((resolve) => {
-            execFile(command, args, (error) => {
-                resolve(!error);
-            });
-        });
-    }
-    catch {
-        return false;
-    }
-}

package/dist/auth/store.js

@@ -1,90 +0,0 @@
-/**
- * Auth token persistence.
- * Stores tokens in ~/.config/bigconsole-cli/auth.json with restrictive permissions.
- */
-import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, unlinkSync } from 'fs';
-import { join } from 'path';
-import { homedir } from 'os';
-const CONFIG_DIR = join(homedir(), '.config', 'bigconsole-cli');
-const AUTH_FILE = join(CONFIG_DIR, 'auth.json');
-function ensureConfigDir() {
-    if (!existsSync(CONFIG_DIR)) {
-        mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
-    }
-}
-/**
- * Read stored authentication data.
- * Returns null if no auth data exists.
- */
-export function readAuth() {
-    try {
-        if (!existsSync(AUTH_FILE))
-            return null;
-        const raw = readFileSync(AUTH_FILE, 'utf8');
-        return JSON.parse(raw);
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Write authentication data to the store.
- * File permissions are set to 0o600 (owner read/write only).
- */
-export function writeAuth(auth) {
-    ensureConfigDir();
-    writeFileSync(AUTH_FILE, JSON.stringify(auth, null, 2), { encoding: 'utf8', mode: 0o600 });
-    try {
-        chmodSync(AUTH_FILE, 0o600);
-    }
-    catch {
-        // chmod may fail on some platforms (Windows), that's acceptable
-    }
-}
-/**
- * Clear stored authentication data.
- */
-export function clearAuth() {
-    try {
-        if (existsSync(AUTH_FILE)) {
-            unlinkSync(AUTH_FILE);
-        }
-    }
-    catch {
-        // Ignore errors on cleanup
-    }
-}
-/**
- * Check if the stored token has expired.
- */
-export function isTokenExpired(auth) {
-    if (!auth.expiresAt)
-        return false;
-    return Date.now() >= auth.expiresAt;
-}
-/**
- * Check if the stored token is expiring within the next 5 minutes.
- */
-export function isTokenExpiringSoon(auth) {
-    if (!auth.expiresAt)
-        return false;
-    const BUFFER_MS = 5 * 60 * 1000;
-    return Date.now() + BUFFER_MS >= auth.expiresAt;
-}
-/**
- * Check if the workspace token has expired.
- */
-export function isWorkspaceTokenExpired(auth) {
-    if (!auth.workspaceTokenExpiresAt)
-        return false;
-    return Date.now() >= auth.workspaceTokenExpiresAt;
-}
-/**
- * Check if the workspace token is expiring within the next 5 minutes.
- */
-export function isWorkspaceTokenExpiringSoon(auth) {
-    if (!auth.workspaceTokenExpiresAt)
-        return false;
-    const BUFFER_MS = 5 * 60 * 1000;
-    return Date.now() + BUFFER_MS >= auth.workspaceTokenExpiresAt;
-}