@burdenoff/bigconsole-cli 2026.1029.1 → 2026.1110.1

package/dist/config/index.js

@@ -1,151 +0,0 @@
-/**
- * CLI configuration management.
- * Persists CLI-level settings to ~/.config/bigconsole-cli/config.json
- */
-import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync } from 'fs';
-import { join } from 'path';
-import { homedir } from 'os';
-const CONFIG_DIR = join(homedir(), '.config', 'bigconsole-cli');
-const CONFIG_FILE = join(CONFIG_DIR, 'config.json');
-/**
- * Well-known client ID for the BigConsole CLI.
- * This is a system app auto-created by global-auth-svc on startup.
- * Same pattern as GitHub CLI (gh), Claude Code, Stripe CLI.
- */
-export const DEFAULT_CLIENT_ID = 'burdenoff_cli_bigconsole';
-/** Production OIDC issuer (global gateway) */
-const PROD_OIDC_ISSUER = 'https://graphql.burdenoff.com/global';
-/** Production workspace gateway endpoint */
-export const PROD_WORKSPACE_ENDPOINT = 'https://graphqlworkspaces.burdenoff.com/workspaces/graphql';
-/** Production global gateway endpoint */
-export const PROD_GLOBAL_ENDPOINT = 'https://graphql.burdenoff.com/global/graphql';
-export const DEFAULT_CONFIG = {
-    workspaceEndpoint: PROD_WORKSPACE_ENDPOINT,
-    globalEndpoint: PROD_GLOBAL_ENDPOINT,
-};
-function ensureConfigDir() {
-    if (!existsSync(CONFIG_DIR)) {
-        mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
-    }
-}
-function getEnvOverrides() {
-    const overrides = {};
-    if (process.env.BIGCONSOLE_WORKSPACE_ENDPOINT) {
-        overrides.workspaceEndpoint = process.env.BIGCONSOLE_WORKSPACE_ENDPOINT;
-    }
-    if (process.env.BIGCONSOLE_GLOBAL_ENDPOINT) {
-        overrides.globalEndpoint = process.env.BIGCONSOLE_GLOBAL_ENDPOINT;
-    }
-    if (process.env.BIGCONSOLE_OIDC_ISSUER) {
-        overrides.oidcIssuer = process.env.BIGCONSOLE_OIDC_ISSUER;
-    }
-    if (process.env.BIGCONSOLE_CLIENT_ID) {
-        overrides.clientId = process.env.BIGCONSOLE_CLIENT_ID;
-    }
-    return overrides;
-}
-/**
- * Read the CLI configuration, merging with defaults.
- *
- * Resolution order (later wins):
- *   1. Built-in production defaults
- *   2. Environment variables BIGCONSOLE_WORKSPACE_ENDPOINT, BIGCONSOLE_GLOBAL_ENDPOINT,
- *      BIGCONSOLE_OIDC_ISSUER, BIGCONSOLE_CLIENT_ID
- *   3. Values stored in ~/.config/bigconsole-cli/config.json
- */
-export function readConfig() {
-    try {
-        const envOverrides = getEnvOverrides();
-        if (!existsSync(CONFIG_FILE))
-            return { ...DEFAULT_CONFIG, ...envOverrides };
-        const raw = readFileSync(CONFIG_FILE, 'utf8');
-        const stored = JSON.parse(raw);
-        return { ...DEFAULT_CONFIG, ...envOverrides, ...stored };
-    }
-    catch {
-        return { ...DEFAULT_CONFIG };
-    }
-}
-/**
- * Write the CLI configuration to disk.
- */
-export function writeConfig(config) {
-    ensureConfigDir();
-    writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), { encoding: 'utf8' });
-    try {
-        chmodSync(CONFIG_FILE, 0o600);
-    }
-    catch {
-        // chmodSync may fail on Windows, non-critical
-    }
-}
-/**
- * Get a single config value by key.
- */
-export function getConfigValue(key) {
-    const config = readConfig();
-    return config[key];
-}
-/**
- * Set a single config value by key.
- */
-export function setConfigValue(key, value) {
-    const config = readConfig();
-    config[key] = value;
-    writeConfig(config);
-}
-/**
- * Get the path to the config file.
- */
-export function getConfigPath() {
-    return CONFIG_FILE;
-}
-/**
- * Get the config directory path.
- */
-export function getConfigDir() {
-    return CONFIG_DIR;
-}
-/**
- * Resolve OIDC configuration with smart defaults.
- * - clientId defaults to the built-in BigConsole CLI system app
- * - oidcIssuer derives from the configured globalEndpoint
- * Users can override both via cli-config if they have a custom OIDC provider.
- */
-export function resolveOIDCConfig() {
-    const config = readConfig();
-    // Client ID: user override > built-in default
-    const clientId = config.clientId || DEFAULT_CLIENT_ID;
-    // OIDC issuer: user override > derive from any non-prod endpoint > prod default.
-    //
-    // Strip the trailing `/graphql` from the endpoint so OIDC routes (device-code,
-    // token, etc.) are mounted at the parent path. The second `.replace()` that
-    // used to target `/global/graphql$` was dead code — the first replace always
-    // strips the trailing `/graphql` first.
-    //
-    // Deriving from the endpoint also covers staging / self-hosted global
-    // gateways, not just localhost: if the user has explicitly pointed
-    // `globalEndpoint` somewhere non-prod the issuer should follow, and only the
-    // implicit prod endpoint falls back to `PROD_OIDC_ISSUER`.
-    let oidcIssuer = config.oidcIssuer;
-    if (!oidcIssuer) {
-        const globalEndpoint = config.globalEndpoint;
-        const isProdEndpoint = globalEndpoint.includes('graphql.burdenoff.com');
-        if (isProdEndpoint) {
-            oidcIssuer = PROD_OIDC_ISSUER;
-        }
-        else {
-            oidcIssuer = globalEndpoint.replace(/\/graphql$/, '');
-        }
-    }
-    return { oidcIssuer, clientId };
-}
-export const KNOWN_CONFIG_KEYS = [
-    'workspaceEndpoint',
-    'globalEndpoint',
-    'oidcIssuer',
-    'clientId',
-    'defaultFormat',
-    'verbose',
-    'authServiceEndpoint',
-];

package/dist/graphql/client.js

@@ -1,254 +0,0 @@
-/**
- * GraphQL client for CLI operations.
- * Dual-endpoint: workspace gateway (bigconsole ops) + global gateway (auth ops).
- * Auto-injects auth headers, auto-refreshes both platform and workspace tokens.
- */
-import { GraphQLClient } from 'graphql-request';
-import { readConfig } from '../config/index.js';
-import { readAuth, writeAuth, isTokenExpiringSoon, isWorkspaceTokenExpiringSoon, } from '../auth/store.js';
-import { issueWorkspaceToken, clientCredentialsFlow } from '../auth/device-code.js';
-import { printError } from '../utils/output.js';
-import { describeRequestError, toSafeErrorMessage, } from '../utils/sanitize.js';
-const DEFAULT_TIMEOUT = 30000;
-const MAX_RETRIES = 3;
-const INITIAL_RETRY_DELAY_MS = 1000;
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}
-function isNetworkOrServerError(error) {
-    if (error instanceof TypeError)
-        return true;
-    if (error && typeof error === 'object' && 'response' in error) {
-        const resp = error.response;
-        if (resp && typeof resp.status === 'number' && resp.status >= 500)
-            return true;
-    }
-    return false;
-}
-/**
- * Error thrown for a failed GraphQL request. Its message is built only from
- * the HTTP status, the server's first GraphQL error and its error code, so it
- * is safe to print. The underlying client error is deliberately not attached
- * (no `cause`): it carries the request variables and the raw response body.
- */
-export class BigConsoleRequestError extends Error {
-    constructor(description) {
-        super(description.message);
-        this.name = 'BigConsoleRequestError';
-        this.status = description.status;
-        this.code = description.code;
-    }
-}
-let workspaceClient = null;
-let globalClient = null;
-function getHeaders(auth) {
-    const headers = {};
-    if (auth?.accessToken) {
-        headers['Authorization'] = `Bearer ${auth.accessToken}`;
-    }
-    return headers;
-}
-function getWorkspaceHeaders(auth) {
-    const headers = getHeaders(auth);
-    if (auth?.workspaceToken) {
-        headers['X-Workspace-Authorization'] = `Bearer ${auth.workspaceToken}`;
-    }
-    if (auth?.organizationId) {
-        headers['x-org-id'] = auth.organizationId;
-    }
-    return headers;
-}
-function initClients() {
-    const config = readConfig();
-    const auth = readAuth();
-    workspaceClient = new GraphQLClient(config.workspaceEndpoint);
-    workspaceClient.setHeaders(getWorkspaceHeaders(auth));
-    globalClient = new GraphQLClient(config.globalEndpoint);
-    globalClient.setHeaders(getHeaders(auth));
-    return { workspace: workspaceClient, global: globalClient };
-}
-/**
- * Refresh the platform access token.
- * For client_credentials: re-authenticate with stored credentials.
- * For device_code/api_key: use the stored refresh token.
- */
-async function refreshPlatformToken() {
-    const auth = readAuth();
-    if (!auth)
-        return;
-    if (auth.authMethod === 'client_credentials' && auth.clientId && auth.clientSecret) {
-        const config = readConfig();
-        try {
-            const result = await clientCredentialsFlow(config.globalEndpoint, auth.clientId, auth.clientSecret);
-            writeAuth({
-                ...auth,
-                accessToken: result.accessToken,
-                expiresAt: Date.now() + result.expiresIn * 1000,
-            });
-            workspaceClient = null;
-            globalClient = null;
-        }
-        catch (error) {
-            printError(`App token refresh failed: ${toSafeErrorMessage(error)}`);
-        }
-        return;
-    }
-    if (!auth.refreshToken)
-        return;
-    const config = readConfig();
-    const client = new GraphQLClient(config.globalEndpoint);
-    client.setHeaders({ Authorization: `Bearer ${auth.accessToken}` });
-    const REFRESH_MUTATION = `
-    mutation RefreshToken($token: String!) {
-      refreshToken(token: $token) {
-        accessToken
-        refreshToken
-        expiresIn
-      }
-    }
-  `;
-    try {
-        const data = await client.request(REFRESH_MUTATION, {
-            token: auth.refreshToken,
-        });
-        const result = data.refreshToken;
-        const expiresAt = Date.now() + result.expiresIn * 1000;
-        writeAuth({
-            ...auth,
-            accessToken: result.accessToken,
-            refreshToken: result.refreshToken,
-            expiresAt,
-        });
-        workspaceClient = null;
-        globalClient = null;
-    }
-    catch (error) {
-        printError(`Token refresh failed: ${toSafeErrorMessage(error)}`);
-    }
-}
-/**
- * Refresh the workspace token using the current platform token.
- */
-async function refreshWorkspaceToken() {
-    const auth = readAuth();
-    if (!auth?.accessToken || !auth.workspaceId || !auth.organizationId)
-        return;
-    const config = readConfig();
-    try {
-        const result = await issueWorkspaceToken(config.workspaceEndpoint, auth.accessToken, auth.workspaceId, auth.organizationId);
-        writeAuth({
-            ...auth,
-            workspaceToken: result.token,
-            workspaceTokenExpiresAt: new Date(result.expiresAt).getTime(),
-        });
-        workspaceClient = null;
-    }
-    catch (error) {
-        printError(`Workspace token refresh failed: ${toSafeErrorMessage(error)}`);
-    }
-}
-export async function ensureFreshTokens() {
-    const auth = readAuth();
-    if (!auth)
-        return;
-    if (isTokenExpiringSoon(auth)) {
-        await refreshPlatformToken();
-    }
-    const freshAuth = readAuth();
-    if (freshAuth && freshAuth.workspaceToken && isWorkspaceTokenExpiringSoon(freshAuth)) {
-        await refreshWorkspaceToken();
-    }
-}
-/**
- * Inspect a GraphQL document to decide whether it is safe to retry.
- * Mutations are NOT retried — a transient error may land the write
- * server-side even if the client observed a timeout, so blindly
- * retrying create/update/delete could create duplicates. Queries are
- * always retryable.
- */
-function isRetryableDocument(document) {
-    const text = typeof document === 'string'
-        ? document
-        : typeof document?.loc?.source?.body ===
-            'string'
-            ? document.loc.source.body
-            : '';
-    const m = text.match(/\b(query|mutation|subscription)\b/i);
-    return !m || m[1].toLowerCase() === 'query';
-}
-async function executeWithRetry(client, document, variables) {
-    const retryable = isRetryableDocument(document);
-    const maxAttempts = retryable ? MAX_RETRIES : 1;
-    let lastError;
-    for (let attempt = 0; attempt < maxAttempts; attempt++) {
-        try {
-            const controller = new AbortController();
-            const timer = setTimeout(() => controller.abort(), DEFAULT_TIMEOUT);
-            try {
-                return await client.request({
-                    document,
-                    variables,
-                    signal: controller.signal,
-                });
-            }
-            finally {
-                clearTimeout(timer);
-            }
-        }
-        catch (error) {
-            lastError = error;
-            if (error && typeof error === 'object' && 'response' in error) {
-                const resp = error.response;
-                if (resp && typeof resp.status === 'number' && resp.status >= 400 && resp.status < 500) {
-                    break;
-                }
-            }
-            if (retryable && isNetworkOrServerError(error) && attempt < maxAttempts - 1) {
-                const delay = INITIAL_RETRY_DELAY_MS * Math.pow(2, attempt);
-                await sleep(delay);
-                continue;
-            }
-            break;
-        }
-    }
-    throw new BigConsoleRequestError(describeRequestError(lastError));
-}
-/**
- * Execute a GraphQL request against the workspace gateway.
- * Auto-refreshes both platform and workspace tokens when they are about to expire.
- */
-export async function workspaceRequest(document, variables) {
-    await ensureFreshTokens();
-    const { workspace } = workspaceClient ? { workspace: workspaceClient } : initClients();
-    const auth = readAuth();
-    workspace.setHeaders(getWorkspaceHeaders(auth));
-    return executeWithRetry(workspace, document, variables);
-}
-/**
- * Execute a GraphQL request against the global gateway (auth operations).
- * Does NOT auto-refresh tokens (to prevent loops during refresh itself).
- */
-export async function globalRequest(document, variables) {
-    const { global: client } = globalClient ? { global: globalClient } : initClients();
-    const auth = readAuth();
-    client.setHeaders(getHeaders(auth));
-    return executeWithRetry(client, document, variables);
-}
-/**
- * Execute a request against the workspace gateway with ONLY the platform auth token.
- * Used for IssueWorkspaceToken which does not require an existing workspace token.
- */
-export async function workspaceAuthOnlyRequest(document, variables) {
-    const config = readConfig();
-    const auth = readAuth();
-    const client = new GraphQLClient(config.workspaceEndpoint);
-    client.setHeaders(getHeaders(auth));
-    return executeWithRetry(client, document, variables);
-}
-/**
- * Reset cached clients (useful after auth changes).
- */
-export function resetClients() {
-    workspaceClient = null;
-    globalClient = null;
-}