@burdenoff/bigconsole-cli 2026.802.1 → 2026.1110.1

package/dist/utils/output.d.ts

@@ -1,6 +1,12 @@
 /**
  * Output utilities for CLI display.
  * Provides consistent formatting for both interactive and non-interactive modes.
+ *
+ * stdout carries only command data (JSON, YAML, tables); status lines
+ * (success, info, warning, error) go to stderr so piping stays clean. Remote
+ * strings are made inert before they reach the terminal: tables and status
+ * lines pass through `sanitizeForTerminal`, while JSON and YAML stay exact
+ * data and only use escape forms their own syntax defines.
  */
 export type OutputFormat = 'json' | 'table' | 'yaml';
 /**
@@ -13,32 +19,47 @@ export declare function isInteractive(): boolean;
 export declare function getFormat(options: {
     format?: string;
 }): OutputFormat;
+/**
+ * Serialize data as pretty-printed JSON. Characters in
+ * {@link JSON_DISPLAY_ESCAPES} can only occur inside JSON strings, so writing
+ * them as `\uXXXX` escapes leaves the parsed value unchanged.
+ */
+export declare function toJson(data: unknown): string;
 /**
  * Print data as formatted JSON.
  */
 export declare function printJson(data: unknown): void;
 /**
- * Print data as a simple ASCII table.
+ * Print data as a simple ASCII table. Headers and cells are sanitized for the
+ * terminal (single line, no control sequences) before widths are measured;
+ * columns are padded to at most {@link MAX_COLUMN_WIDTH} characters.
  */
 export declare function printTable(headers: string[], rows: string[][]): void;
 /**
- * Print data as YAML-like output (simple key-value).
+ * Serialize data as YAML with js-yaml, restricted to the JSON schema (no
+ * custom tags) and without anchors/aliases. Control characters are escaped by
+ * the dumper; bidirectional controls, which YAML treats as printable, are
+ * written as `\uXXXX` inside double-quoted scalars.
+ */
+export declare function toYaml(data: unknown): string;
+/**
+ * Print data as YAML.
  */
 export declare function printYaml(data: unknown): void;
 /**
- * Print a success message.
+ * Print a success message (stderr).
  */
 export declare function printSuccess(message: string): void;
 /**
- * Print an error message to stderr.
+ * Print an error message to stderr. Credential-shaped values are masked.
  */
 export declare function printError(message: string): void;
 /**
- * Print a warning message.
+ * Print a warning message to stderr. Credential-shaped values are masked.
  */
 export declare function printWarning(message: string): void;
 /**
- * Print an info message.
+ * Print an info message (stderr).
  */
 export declare function printInfo(message: string): void;
 /**
@@ -57,6 +78,7 @@ export declare function outputData(format: OutputFormat, data: unknown, tableCon
     rows: string[][];
 }): void;
 /**
- * Truncate a string to a maximum length, appending ellipsis if needed.
+ * Sanitize a string for the terminal, then truncate it to a maximum length,
+ * appending an ellipsis if needed.
  */
 export declare function truncate(str: string | null | undefined, maxLen: number): string;

package/dist/utils/parse.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Parse an optimistic-lock `--version` value. Accepts whole numbers only:
+ * `parseInt` would silently turn "7junk" or "7.5" into 7 and send the wrong version.
+ */
+export declare function parseVersion(raw: string): number;

package/dist/utils/sanitize.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Text hygiene for everything the CLI prints.
+ *
+ * Remote data (resource names, server error messages, HTTP response bodies)
+ * ends up in terminals, CI logs and support captures. The helpers here:
+ *  - keep terminal output inert: escape sequences and control characters are
+ *    removed, and bidirectional formatting characters are made visible;
+ *  - mask credential-shaped values (bearer tokens, JWTs, URL credentials and
+ *    values stored under secret-like keys);
+ *  - turn any thrown value into a short, single-line message that is built
+ *    from an allowlist of fields and never includes request variables,
+ *    request headers or raw response bodies.
+ *
+ * The module is side-effect free and imports nothing from the rest of the CLI,
+ * so every layer can use it (and unit-test module mocks never replace it).
+ */
+/** Longest error message shown to the user. */
+export declare const MAX_ERROR_MESSAGE_LENGTH = 500;
+/** Longest excerpt of an HTTP response body or server message kept in an error. */
+export declare const MAX_HTTP_BODY_EXCERPT_LENGTH = 200;
+export interface TerminalSanitizeOptions {
+    /**
+     * Keep line structure: CRLF and CR become LF, LF and TAB are kept, and
+     * NEL/LS/PS are shown as `\uXXXX`. By default (single-line mode) every line
+     * break and TAB becomes a single space.
+     */
+    preserveNewlines?: boolean;
+}
+/** `\uXXXX` spelling of a single UTF-16 code unit (valid in JSON and YAML). */
+export declare function toUnicodeEscape(char: string): string;
+/** Make bidirectional formatting controls visible as `\uXXXX` text. */
+export declare function escapeBidiControls(text: string): string;
+/**
+ * Make a value safe to print on a terminal.
+ *
+ * - ANSI/VT escape sequences (CSI, OSC, DCS, SOS, PM, APC and two-character
+ *   ESC sequences, in 7-bit and 8-bit form) are removed entirely.
+ * - Other C0 controls, DEL and C1 controls are removed.
+ * - Line breaks and TAB become a space (see {@link TerminalSanitizeOptions}).
+ * - Bidirectional formatting controls are shown as `\uXXXX` text so the
+ *   printed text reads in its stored order.
+ *
+ * `null`/`undefined` become an empty string. The function is idempotent.
+ */
+export declare function sanitizeForTerminal(value: unknown, options?: TerminalSanitizeOptions): string;
+/**
+ * Mask credential-shaped values in free text: values under secret-like keys
+ * (`password`, `token`, `refreshToken`, `clientSecret`, `Authorization`, ...),
+ * `Bearer` credentials, JWT-shaped strings and credentials embedded in URLs.
+ */
+export declare function redactSecrets(text: string): string;
+/**
+ * Reduce untrusted text to one printable, credential-masked line of at most
+ * `maxLength` characters. Returns an empty string when nothing is left.
+ */
+export declare function toDisplayLine(value: unknown, maxLength?: number): string;
+/** Short, printable excerpt of an HTTP response body for an error message. */
+export declare function summarizeHttpBody(body: unknown): string;
+/** Safe, user-facing description of a failed request. */
+export interface SafeErrorDescription {
+    message: string;
+    /** HTTP status of the response, when there was one. */
+    status?: number;
+    /** Stable GraphQL error code (`extensions.code`), when the server sent one. */
+    code?: string;
+}
+/**
+ * Describe a failure of a GraphQL request for display. Network-level
+ * `TypeError`s (fetch failures) are reported as network errors; aborted
+ * requests as timeouts.
+ */
+export declare function describeRequestError(error: unknown): SafeErrorDescription;
+/**
+ * Convert any thrown value into a message that is safe to print: a single
+ * line, at most {@link MAX_ERROR_MESSAGE_LENGTH} characters, free of terminal
+ * control sequences and with credential-shaped values masked. Response-bearing
+ * errors are described from an allowlist of fields only.
+ */
+export declare function toSafeErrorMessage(error: unknown): string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burdenoff/bigconsole-cli",
-  "version": "2026.802.1",
+  "version": "2026.1110.1",
   "description": "Command-line interface for BigConsole platform operations and management",
   "type": "module",
   "main": "dist/index.js",
@@ -14,26 +14,23 @@
     "README.md"
   ],
   "scripts": {
-    "build": "tsc && tsc-alias",
-    "build:watch": "tsc -w",
-    "dev": "tsx watch src/cli.ts",
+    "build": "bun build src/cli.ts src/index.ts --outdir dist --target node --packages external --root src && tsc -p tsconfig.build.json",
+    "dev": "bun --watch src/cli.ts",
     "pretest": "bun run build",
-    "test": "bash scripts/build-limits.sh vitest run",
-    "test:coverage": "vitest --coverage",
-    "test:ui": "vitest --ui",
-    "lint": "eslint src --fix",
-    "lint:sanity": "if [ \"${CI:-}\" = \"true\" ]; then bun run lint; else bun run lint -- --cache --cache-location .eslintcache; fi",
-    "lint:check": "eslint src",
-    "format": "prettier --write \"src/**/*.{ts,js,json,md}\"",
-    "format:check": "prettier --check \"src/**/*.{ts,js,json,md}\"",
-    "type-check": "bash scripts/build-limits.sh tsc --noEmit",
-    "sanity": "bash scripts/build-limits.sh --gate bash -c 'bun run format && bun run lint:sanity && bun run type-check && bun run test && bun run build'",
-    "clean": "rimraf dist",
+    "test": "bun test --isolate",
+    "test:coverage": "bun test --coverage",
+    "lint": "eslint .",
+    "format": "bun fmt",
+    "format:check": "bun fmt --check",
+    "sanity": "boff sanity",
+    "clean": "rm -rf dist coverage junit.xml",
     "prepublishOnly": "bun run clean && bun run build",
-    "audit": "bunx better-npm-audit audit",
+    "audit": "bun audit --audit-level=high",
     "start": "bun dist/cli.js",
-    "publish:alpha": "bun run build && bunx npm@latest publish --tag alpha",
-    "publish:prod": "bun run build && bunx npm@latest publish"
+    "schema:pull": "bash scripts/schema-pull.sh",
+    "type:check": "boff gate -- bun check --no-pretty",
+    "sanity:force": "boff sanity --force",
+    "lint:fix": "eslint . --fix"
   },
   "keywords": [
     "algoshred",
@@ -56,45 +53,31 @@
   },
   "homepage": "https://github.com/Algoshred/bigconsole-cli#readme",
   "publishConfig": {
-    "access": "restricted"
+    "access": "public"
   },
   "dependencies": {
     "boxen": "^8.0.1",
-    "chalk": "^5.5.0",
-    "commander": "^14.0.0",
+    "chalk": "^6.0.0",
+    "commander": "^15.0.0",
     "cross-fetch": "^4.1.0",
-    "graphql": "^16.11.0",
-    "graphql-request": "^7.2.0",
-    "inquirer": "^12.9.2",
-    "js-yaml": "^4.1.0",
-    "ora": "^8.2.0",
-    "table": "^6.9.0",
+    "graphql": "^17.0.2",
+    "graphql-request": "^7.4.0",
+    "js-yaml": "^5.4.1",
     "update-notifier": "^7.3.1"
   },
   "devDependencies": {
-    "@playwright/test": "^1.59.1",
-    "@types/inquirer": "^9.0.9",
-    "@types/js-yaml": "^4.0.9",
-    "@types/node": "^24.3.0",
+    "@burdenoff/toolchain": "2026.1107.14",
+    "@playwright/test": "^1.62.1",
+    "@types/bun": "^1.4.4",
     "@types/update-notifier": "^6.0.8",
-    "@typescript-eslint/eslint-plugin": "^8.39.1",
-    "@typescript-eslint/parser": "^8.39.1",
-    "@vitest/coverage-v8": "^3.2.4",
-    "@vitest/ui": "^3.2.4",
-    "eslint": "^9.33.0",
-    "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-prettier": "^5.5.4",
-    "globals": "^16.3.0",
-    "prettier": "^3.6.2",
-    "rimraf": "^6.0.1",
-    "tsc-alias": "^1.8.16",
-    "tsx": "^4.20.4",
-    "typescript": "^5.9.2",
-    "vitest": "^3.2.4"
+    "eslint": "^9.39.4",
+    "knip": "^6.44.1",
+    "typescript": "6.0.3",
+    "yaml": "^2.8.3"
   },
   "engines": {
     "node": ">=24.11.0",
-    "bun": ">=1.3.10"
+    "bun": ">=1.4.4"
   },
   "overrides": {
     "lodash": ">=4.17.21",
@@ -103,14 +86,39 @@
     "fast-xml-parser": ">=4.5.5",
     "@xmldom/xmldom": ">=0.8.12",
     "swiper": ">=12.1.2",
-    "brace-expansion": ">=1.1.13",
+    "brace-expansion": "5.0.12",
     "follow-redirects": ">=1.15.12",
     "smol-toml": ">=1.6.1",
     "axios": ">=1.15.0",
-    "flatted": ">=3.4.1",
-    "yaml": ">=2.8.3",
-    "picomatch": ">=2.3.2",
+    "flatted": "3.4.4",
+    "yaml": "$yaml",
+    "picomatch": "4.0.7",
     "immutable": ">=3.8.3",
-    "minimatch": ">=3.1.3"
+    "minimatch": ">=3.1.3",
+    "nanoid": "6.0.1",
+    "postcss": "8.5.26",
+    "vite": "8.2.2",
+    "fast-uri": "4.1.3",
+    "esbuild": "0.28.2"
+  },
+  "packageManager": "bun@1.4.4",
+  "trustedDependencies": [],
+  "boff": {
+    "type": "cli",
+    "sanity": {
+      "steps": [
+        "format",
+        "lint",
+        "typecheck",
+        "build",
+        "test",
+        "knip"
+      ]
+    },
+    "scripts": {
+      "unmanaged": [
+        "test"
+      ]
+    }
   }
 }

package/dist/auth/device-code.js

@@ -1,239 +0,0 @@
-/**
- * OAuth2 Device Code flow implementation.
- * Used for CLI authentication (similar to `gh auth login`).
- */
-import fetch from 'cross-fetch';
-/**
- * Start the device code flow by requesting a device code from the OIDC issuer.
- */
-export async function startDeviceCodeFlow(config) {
-    const url = `${config.oidcIssuer}/oidc/device/code`;
-    const body = new URLSearchParams({
-        client_id: config.clientId,
-        scope: 'openid profile email offline_access',
-    });
-    const response = await fetch(url, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-        body: body.toString(),
-    });
-    if (!response.ok) {
-        const text = await response.text().catch(() => 'Unknown error');
-        throw new Error(`Device code request failed (${response.status}): ${text}`);
-    }
-    const data = (await response.json());
-    return {
-        deviceCode: data['device_code'],
-        userCode: data['user_code'],
-        verificationUri: data['verification_uri'],
-        verificationUriComplete: data['verification_uri_complete'] ?? null,
-        expiresIn: data['expires_in'],
-        interval: data['interval'] ?? 5,
-    };
-}
-/**
- * Poll the token endpoint until the user approves or the code expires.
- */
-export async function pollForToken(deviceCode, interval, config) {
-    const url = `${config.oidcIssuer}/oauth/device/token`;
-    let pollInterval = interval;
-    while (true) {
-        await new Promise((resolve) => setTimeout(resolve, pollInterval * 1000));
-        const response = await fetch(url, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body: new URLSearchParams({
-                grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
-                device_code: deviceCode,
-                client_id: config.clientId,
-            }).toString(),
-        });
-        // Guard against non-JSON responses (e.g. a 502 HTML error page from a
-        // gateway during a restart). Parsing those as JSON throws SyntaxError,
-        // aborts the whole poll loop, and forces the user to re-run
-        // `bigconsole auth login` from scratch even though the transient error
-        // would have cleared on the next tick.
-        const raw = await response.text();
-        let data;
-        try {
-            data = JSON.parse(raw);
-        }
-        catch {
-            if (response.status >= 500) {
-                // Treat it like authorization_pending — keep polling.
-                continue;
-            }
-            throw new Error(`Token endpoint returned non-JSON response (status ${response.status}): ${raw.slice(0, 200)}`);
-        }
-        if (response.ok && data['access_token']) {
-            return {
-                accessToken: data['access_token'],
-                refreshToken: data['refresh_token'] ?? '',
-                expiresIn: data['expires_in'] ?? 3600,
-            };
-        }
-        const errorCode = data['error'];
-        switch (errorCode) {
-            case 'authorization_pending':
-                continue;
-            case 'slow_down':
-                pollInterval += 5;
-                continue;
-            case 'expired_token':
-                throw new Error('Device code has expired. Please try again.');
-            case 'access_denied':
-                throw new Error('Authorization was denied by the user.');
-            default:
-                throw new Error(`Device code polling failed: ${data['error_description'] ?? errorCode ?? 'Unknown error'}`);
-        }
-    }
-}
-/**
- * Authenticate using client credentials (app authentication).
- * Calls the AuthenticateApp mutation on the global gateway.
- */
-export async function clientCredentialsFlow(globalEndpoint, clientId, clientSecret, scopes) {
-    const query = `
-    mutation AuthenticateApp($input: AuthenticateAppInput!) {
-      authenticateApp(input: $input) {
-        accessToken tokenType expiresIn scopes
-      }
-    }
-  `;
-    const response = await fetch(globalEndpoint, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-            query,
-            variables: { input: { clientId, clientSecret, scopes } },
-        }),
-    });
-    if (!response.ok) {
-        const text = await response.text().catch(() => 'Unknown error');
-        throw new Error(`App authentication failed (${response.status}): ${text}`);
-    }
-    const data = (await response.json());
-    if (data.errors?.length) {
-        throw new Error(`App authentication failed: ${data.errors[0].message}`);
-    }
-    if (!data.data?.authenticateApp?.accessToken) {
-        throw new Error('App authentication failed: no access token returned');
-    }
-    return data.data.authenticateApp;
-}
-/**
- * Issue a workspace token by calling the workspace gateway with an auth token.
- * Only sends Authorization header (no X-Workspace-Authorization).
- */
-export async function issueWorkspaceToken(workspaceEndpoint, authToken, workspaceId, organizationId) {
-    const query = `
-    mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {
-      issueWorkspaceToken(input: $input) {
-        success token expiresAt scopes
-        error { code message }
-      }
-    }
-  `;
-    const response = await fetch(workspaceEndpoint, {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/json',
-            Authorization: `Bearer ${authToken}`,
-        },
-        body: JSON.stringify({
-            query,
-            variables: { input: { workspaceId, organizationId } },
-        }),
-    });
-    if (!response.ok) {
-        const text = await response.text().catch(() => 'Unknown error');
-        throw new Error(`Workspace token request failed (${response.status}): ${text}`);
-    }
-    const data = (await response.json());
-    if (data.errors?.length) {
-        throw new Error(`Workspace token failed: ${data.errors[0].message}`);
-    }
-    const result = data.data?.issueWorkspaceToken;
-    if (!result?.success || !result.token) {
-        const errMsg = result?.error?.message ?? 'Unknown error';
-        throw new Error(`Workspace token failed: ${errMsg}`);
-    }
-    return { token: result.token, expiresAt: result.expiresAt, scopes: result.scopes ?? [] };
-}
-/**
- * Fetch user's workspaces from the global gateway.
- */
-export async function fetchWorkspaces(globalEndpoint, authToken) {
-    const query = `
-    query MyWorkspaces($limit: Int) {
-      myWorkspaces(limit: $limit) {
-        items { id name slug tenantId organizationId }
-      }
-    }
-  `;
-    const response = await fetch(globalEndpoint, {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/json',
-            Authorization: `Bearer ${authToken}`,
-        },
-        body: JSON.stringify({ query, variables: { limit: 50 } }),
-    });
-    if (!response.ok) {
-        const text = await response.text().catch(() => 'Unknown error');
-        throw new Error(`Failed to fetch workspaces (${response.status}): ${text}`);
-    }
-    const data = (await response.json());
-    if (data.errors?.length) {
-        throw new Error(`Failed to fetch workspaces: ${data.errors[0].message}`);
-    }
-    return data.data?.myWorkspaces?.items ?? [];
-}
-/**
- * Validate that a string is a well-formed HTTP(S) URL.
- * Prevents command injection by rejecting anything that isn't a valid URL.
- */
-function isValidHttpUrl(urlString) {
-    try {
-        const parsed = new URL(urlString);
-        return parsed.protocol === 'http:' || parsed.protocol === 'https:';
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Attempt to open a URL in the user's default browser.
- * Uses execFile instead of exec to avoid shell interpretation and command injection.
- */
-export async function openBrowser(url) {
-    try {
-        if (!isValidHttpUrl(url)) {
-            return false;
-        }
-        const { execFile } = await import('child_process');
-        const platform = process.platform;
-        let command;
-        let args;
-        if (platform === 'darwin') {
-            command = 'open';
-            args = [url];
-        }
-        else if (platform === 'win32') {
-            command = 'cmd';
-            args = ['/c', 'start', '', url];
-        }
-        else {
-            command = 'xdg-open';
-            args = [url];
-        }
-        return new Promise((resolve) => {
-            execFile(command, args, (error) => {
-                resolve(!error);
-            });
-        });
-    }
-    catch {
-        return false;
-    }
-}

package/dist/auth/store.js

@@ -1,90 +0,0 @@
-/**
- * Auth token persistence.
- * Stores tokens in ~/.config/bigconsole-cli/auth.json with restrictive permissions.
- */
-import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, unlinkSync } from 'fs';
-import { join } from 'path';
-import { homedir } from 'os';
-const CONFIG_DIR = join(homedir(), '.config', 'bigconsole-cli');
-const AUTH_FILE = join(CONFIG_DIR, 'auth.json');
-function ensureConfigDir() {
-    if (!existsSync(CONFIG_DIR)) {
-        mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
-    }
-}
-/**
- * Read stored authentication data.
- * Returns null if no auth data exists.
- */
-export function readAuth() {
-    try {
-        if (!existsSync(AUTH_FILE))
-            return null;
-        const raw = readFileSync(AUTH_FILE, 'utf8');
-        return JSON.parse(raw);
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Write authentication data to the store.
- * File permissions are set to 0o600 (owner read/write only).
- */
-export function writeAuth(auth) {
-    ensureConfigDir();
-    writeFileSync(AUTH_FILE, JSON.stringify(auth, null, 2), { encoding: 'utf8', mode: 0o600 });
-    try {
-        chmodSync(AUTH_FILE, 0o600);
-    }
-    catch {
-        // chmod may fail on some platforms (Windows), that's acceptable
-    }
-}
-/**
- * Clear stored authentication data.
- */
-export function clearAuth() {
-    try {
-        if (existsSync(AUTH_FILE)) {
-            unlinkSync(AUTH_FILE);
-        }
-    }
-    catch {
-        // Ignore errors on cleanup
-    }
-}
-/**
- * Check if the stored token has expired.
- */
-export function isTokenExpired(auth) {
-    if (!auth.expiresAt)
-        return false;
-    return Date.now() >= auth.expiresAt;
-}
-/**
- * Check if the stored token is expiring within the next 5 minutes.
- */
-export function isTokenExpiringSoon(auth) {
-    if (!auth.expiresAt)
-        return false;
-    const BUFFER_MS = 5 * 60 * 1000;
-    return Date.now() + BUFFER_MS >= auth.expiresAt;
-}
-/**
- * Check if the workspace token has expired.
- */
-export function isWorkspaceTokenExpired(auth) {
-    if (!auth.workspaceTokenExpiresAt)
-        return false;
-    return Date.now() >= auth.workspaceTokenExpiresAt;
-}
-/**
- * Check if the workspace token is expiring within the next 5 minutes.
- */
-export function isWorkspaceTokenExpiringSoon(auth) {
-    if (!auth.workspaceTokenExpiresAt)
-        return false;
-    const BUFFER_MS = 5 * 60 * 1000;
-    return Date.now() + BUFFER_MS >= auth.workspaceTokenExpiresAt;
-}