@burdenoff/bigconsole-cli 2026.802.1 → 2026.1110.1

package/dist/commands/auth.js

@@ -1,352 +0,0 @@
-/**
- * Auth commands: login, logout, status, token, refresh.
- */
-import { readConfig, resolveOIDCConfig } from '../config/index.js';
-import { readAuth, writeAuth, clearAuth, isTokenExpired } from '../auth/store.js';
-import { startDeviceCodeFlow, pollForToken, openBrowser, clientCredentialsFlow, issueWorkspaceToken, fetchWorkspaces, } from '../auth/device-code.js';
-import { globalRequest, resetClients } from '../graphql/client.js';
-import { SIGN_OUT, REFRESH_TOKEN } from '../graphql/operations.js';
-import { printSuccess, printError, printInfo, printWarning, formatDate } from '../utils/output.js';
-import { handleCommandError, formatAndOutput } from './base.js';
-export function registerAuthCommands(program) {
-    const auth = program.command('auth').description('Authentication commands');
-    auth
-        .command('login')
-        .description('Authenticate with BigConsole')
-        .option('--client-credentials', 'Authenticate as an app with client ID and secret')
-        .option('--workspace-id <id>', 'Workspace ID (for app auth)')
-        .action(async (options) => {
-        try {
-            if (options.clientCredentials) {
-                await loginWithClientCredentials(options.workspaceId);
-            }
-            else {
-                await loginWithDeviceCode();
-            }
-        }
-        catch (error) {
-            handleCommandError(error);
-        }
-    });
-    auth
-        .command('logout')
-        .description('Revoke tokens and clear stored auth')
-        .action(async () => {
-        try {
-            const authData = readAuth();
-            if (authData?.accessToken) {
-                try {
-                    await globalRequest(SIGN_OUT);
-                }
-                catch {
-                    printWarning('Server-side logout failed, clearing local tokens');
-                }
-            }
-            clearAuth();
-            resetClients();
-            printSuccess('Logged out successfully');
-        }
-        catch (error) {
-            handleCommandError(error);
-        }
-    });
-    auth
-        .command('status')
-        .description('Show current auth state')
-        .option('-f, --format <format>', 'Output format (json, table)')
-        .action((options) => {
-        const authData = readAuth();
-        const config = readConfig();
-        const authenticated = Boolean(authData?.accessToken);
-        const expired = authData?.accessToken ? isTokenExpired(authData) : false;
-        const expiresAt = authData?.expiresAt
-            ? formatDate(new Date(authData.expiresAt).toISOString())
-            : '-';
-        const method = authData?.authMethod === 'client_credentials' ? 'Client Credentials' : 'OAuth2 Device Code';
-        const wsTokenExpires = authData?.workspaceTokenExpiresAt
-            ? formatDate(new Date(authData.workspaceTokenExpiresAt).toISOString())
-            : '-';
-        formatAndOutput(options, {
-            authenticated,
-            method,
-            expired,
-            expiresAt,
-            workspaceId: authData?.workspaceId ?? '-',
-            organizationId: authData?.organizationId ?? '-',
-            workspaceTokenExpiresAt: wsTokenExpires,
-            workspaceEndpoint: config.workspaceEndpoint,
-            globalEndpoint: config.globalEndpoint,
-        }, {
-            headers: ['Key', 'Value'],
-            rows: [
-                ['Authenticated', String(authenticated)],
-                ['Method', method],
-                ['Expired', String(expired)],
-                ['Expires At', expiresAt],
-                ['Workspace ID', authData?.workspaceId ?? '-'],
-                ['Organization ID', authData?.organizationId ?? '-'],
-                ['Workspace Token Expires', wsTokenExpires],
-                ['Workspace Endpoint', config.workspaceEndpoint],
-                ['Global Endpoint', config.globalEndpoint],
-            ],
-        });
-    });
-    auth
-        .command('token')
-        .description('Print access token to stdout')
-        .option('--workspace', 'Print workspace token instead')
-        .action((options) => {
-        const authData = readAuth();
-        if (options.workspace) {
-            if (!authData?.workspaceToken) {
-                printError('No workspace token. Log in and select a workspace: bigconsole auth login');
-                process.exit(1);
-            }
-            process.stdout.write(authData.workspaceToken);
-            return;
-        }
-        if (!authData?.accessToken) {
-            printError('Not authenticated. Run: bigconsole auth login');
-            process.exit(1);
-        }
-        process.stdout.write(authData.accessToken);
-    });
-    auth
-        .command('refresh')
-        .description('Force token refresh')
-        .action(async () => {
-        try {
-            const authData = readAuth();
-            if (!authData?.refreshToken && authData?.authMethod !== 'client_credentials') {
-                printError('No refresh token available. Run: bigconsole auth login');
-                process.exit(1);
-            }
-            if (authData?.authMethod === 'client_credentials' &&
-                authData.clientId &&
-                authData.clientSecret) {
-                const config = readConfig();
-                const result = await clientCredentialsFlow(config.globalEndpoint, authData.clientId, authData.clientSecret);
-                writeAuth({
-                    ...authData,
-                    accessToken: result.accessToken,
-                    expiresAt: Date.now() + result.expiresIn * 1000,
-                });
-                resetClients();
-                printSuccess('App token refreshed successfully');
-                if (authData.workspaceId && authData.organizationId) {
-                    await refreshWorkspaceTokenForAuth();
-                }
-                return;
-            }
-            const data = await globalRequest(REFRESH_TOKEN, {
-                token: authData.refreshToken,
-            });
-            const r = data.refreshToken;
-            writeAuth({
-                ...authData,
-                accessToken: r.accessToken,
-                refreshToken: r.refreshToken,
-                expiresAt: Date.now() + r.expiresIn * 1000,
-            });
-            resetClients();
-            printSuccess('Token refreshed successfully');
-            if (authData.workspaceId && authData.organizationId) {
-                await refreshWorkspaceTokenForAuth();
-            }
-        }
-        catch (error) {
-            handleCommandError(error);
-        }
-    });
-}
-async function refreshWorkspaceTokenForAuth() {
-    const authData = readAuth();
-    if (!authData?.accessToken || !authData.workspaceId || !authData.organizationId)
-        return;
-    const config = readConfig();
-    try {
-        const wsResult = await issueWorkspaceToken(config.workspaceEndpoint, authData.accessToken, authData.workspaceId, authData.organizationId);
-        writeAuth({
-            ...authData,
-            workspaceToken: wsResult.token,
-            workspaceTokenExpiresAt: new Date(wsResult.expiresAt).getTime(),
-        });
-        resetClients();
-        printSuccess('Workspace token refreshed');
-    }
-    catch {
-        printWarning('Workspace token refresh failed — workspace operations may require re-login');
-    }
-}
-async function loginWithDeviceCode() {
-    const config = readConfig();
-    const { oidcIssuer, clientId } = resolveOIDCConfig();
-    const oidcConfig = { ...config, oidcIssuer, clientId };
-    printInfo('Starting device code authentication...');
-    const dc = await startDeviceCodeFlow(oidcConfig);
-    console.log('');
-    console.log(`  Open: ${dc.verificationUri}`);
-    console.log(`  Code: ${dc.userCode}`);
-    console.log('');
-    const opened = await openBrowser(dc.verificationUriComplete ?? dc.verificationUri);
-    if (opened)
-        printInfo('Browser opened');
-    else
-        printWarning('Could not open browser — open the URL manually');
-    printInfo('Waiting for authorization...');
-    const result = await pollForToken(dc.deviceCode, dc.interval, oidcConfig);
-    const accessToken = result.accessToken;
-    const expiresAt = Date.now() + result.expiresIn * 1000;
-    printInfo('Fetching workspaces...');
-    try {
-        const workspaces = await fetchWorkspaces(config.globalEndpoint, accessToken);
-        if (workspaces.length === 0) {
-            writeAuth({
-                accessToken,
-                refreshToken: result.refreshToken,
-                expiresAt,
-                authMethod: 'device_code',
-            });
-            resetClients();
-            printSuccess('Authentication successful (no workspaces found)');
-            return;
-        }
-        let selected = workspaces[0];
-        if (workspaces.length > 1) {
-            console.log('\nAvailable workspaces:');
-            workspaces.forEach((ws, i) => console.log(`  ${i + 1}. ${ws.name} (${ws.slug})`));
-            const readline = await import('readline');
-            // Re-prompt up to 3 times on invalid input rather than silently
-            // defaulting to workspaces[0] — users who mistype expect to see
-            // an error, not end up in the wrong workspace.
-            for (let attempt = 0; attempt < 3; attempt++) {
-                const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-                const answer = await new Promise((resolve) => {
-                    rl.question(`\nSelect workspace [1-${workspaces.length}]: `, (a) => {
-                        rl.close();
-                        resolve(a.trim());
-                    });
-                });
-                const idx = parseInt(answer, 10) - 1;
-                if (!Number.isNaN(idx) && idx >= 0 && idx < workspaces.length) {
-                    selected = workspaces[idx];
-                    break;
-                }
-                if (attempt < 2) {
-                    printError(`Invalid selection. Enter a number between 1 and ${workspaces.length}.`);
-                }
-                else {
-                    printError('Too many invalid attempts — aborting login.');
-                    process.exit(1);
-                }
-            }
-        }
-        printInfo(`Using workspace: ${selected.name} (${selected.id})`);
-        const wsResult = await issueWorkspaceToken(config.workspaceEndpoint, accessToken, selected.id, selected.organizationId);
-        writeAuth({
-            accessToken,
-            refreshToken: result.refreshToken,
-            expiresAt,
-            workspaceToken: wsResult.token,
-            workspaceTokenExpiresAt: new Date(wsResult.expiresAt).getTime(),
-            workspaceId: selected.id,
-            organizationId: selected.organizationId,
-            authMethod: 'device_code',
-        });
-        resetClients();
-        printSuccess('Authentication successful');
-    }
-    catch (wsError) {
-        writeAuth({
-            accessToken,
-            refreshToken: result.refreshToken,
-            expiresAt,
-            authMethod: 'device_code',
-        });
-        resetClients();
-        printSuccess('Authentication successful');
-        printWarning(`Workspace token not obtained: ${wsError instanceof Error ? wsError.message : String(wsError)}`);
-        printInfo('Run `bigconsole auth login` again once a workspace is available.');
-    }
-}
-async function loginWithClientCredentials(workspaceId) {
-    const config = readConfig();
-    const readline = await import('readline');
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-    const clientId = await new Promise((resolve) => {
-        rl.question('Client ID: ', (a) => resolve(a.trim()));
-    });
-    // Mask the client-secret input so the value doesn't echo into the terminal,
-    // get captured by screen recordings, or land in shell scroll-back. We
-    // temporarily intercept stdout writes that readline emits for each keystroke
-    // and suppress them — readline still sees the real chars because
-    // input.on('data') runs before output, so the resulting string is unchanged.
-    const out = rl;
-    out._writeToOutput = function maskedWrite(stringToWrite) {
-        if (stringToWrite === '\r\n' || stringToWrite === '\n') {
-            out.output.write(stringToWrite);
-            return;
-        }
-        // readline sends the raw user char here — replace with a mask.
-        out.output.write('*');
-    };
-    const clientSecret = await new Promise((resolve) => {
-        rl.question('Client Secret: ', (a) => {
-            rl.close();
-            resolve(a.trim());
-        });
-    });
-    // Newline after the masked line — otherwise the prompt runs into the next
-    // line of output.
-    process.stdout.write('\n');
-    if (!clientId || !clientSecret) {
-        printError('Client ID and secret cannot be empty');
-        process.exit(1);
-    }
-    printInfo('Authenticating app...');
-    const result = await clientCredentialsFlow(config.globalEndpoint, clientId, clientSecret);
-    const accessToken = result.accessToken;
-    const expiresAt = Date.now() + result.expiresIn * 1000;
-    let wsToken;
-    let wsTokenExpiresAt;
-    let wsId = workspaceId;
-    let orgId;
-    if (wsId) {
-        // When the user passed --workspace-id they explicitly asked for a
-        // workspace-scoped session — fail the login (not just warn) if we
-        // can't produce a workspace token, otherwise the CLI would persist
-        // a platform-only session and every subsequent workspace call would
-        // 401 with a confusing "not authenticated for this workspace" error.
-        try {
-            const workspaces = await fetchWorkspaces(config.globalEndpoint, accessToken);
-            const ws = workspaces.find((w) => w.id === wsId);
-            if (!ws) {
-                printError(`Workspace ${wsId} not found or not accessible to this app.`);
-                process.exit(1);
-            }
-            orgId = ws.organizationId;
-            const wsResult = await issueWorkspaceToken(config.workspaceEndpoint, accessToken, wsId, orgId);
-            wsToken = wsResult.token;
-            wsTokenExpiresAt = new Date(wsResult.expiresAt).getTime();
-            printInfo(`Workspace token issued for: ${ws.name}`);
-        }
-        catch (err) {
-            printError(`Workspace token issuance failed: ${err instanceof Error ? err.message : String(err)}`);
-            process.exit(1);
-        }
-    }
-    writeAuth({
-        accessToken,
-        refreshToken: '',
-        expiresAt,
-        workspaceToken: wsToken,
-        workspaceTokenExpiresAt: wsTokenExpiresAt,
-        workspaceId: wsId,
-        organizationId: orgId,
-        authMethod: 'client_credentials',
-        clientId,
-        clientSecret,
-    });
-    resetClients();
-    printSuccess('App authentication successful');
-}

package/dist/commands/base.js

@@ -1,100 +0,0 @@
-/**
- * Shared command utilities.
- * Provides auth wrappers, format helpers, and error handling for all commands.
- */
-import { readFileSync } from 'fs';
-import { readAuth } from '../auth/store.js';
-import { workspaceRequest, globalRequest } from '../graphql/client.js';
-import { printError, getFormat, outputData } from '../utils/output.js';
-/**
- * Load a JSON-valued command input from either --file or --json, mutually
- * exclusive. Returns undefined if neither is provided. Exits with a clear
- * error if the JSON is malformed or both flags are set.
- *
- * Used for complex inputs (widget.config, parser.expression, pipeline.stages,
- * dashboard.definition) where a single flag value would be unwieldy.
- */
-export function loadJsonInput(file, inline) {
-    if (!file && !inline)
-        return undefined;
-    if (file && inline) {
-        printError('Provide --file OR --json, not both');
-        process.exit(1);
-    }
-    try {
-        const raw = file ? readFileSync(file, 'utf8') : inline;
-        return JSON.parse(raw);
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        printError(`Failed to parse JSON input: ${msg}`);
-        process.exit(1);
-    }
-}
-/**
- * Read a raw string payload — used for parser expressions and other text
- * bodies where `--body-file foo.jq` reads the file and `--body 'raw'` takes
- * the literal string. Mutually exclusive.
- */
-export function loadTextInput(file, inline) {
-    if (!file && !inline)
-        return undefined;
-    if (file && inline) {
-        printError('Provide --file OR inline value, not both');
-        process.exit(1);
-    }
-    try {
-        return file ? readFileSync(file, 'utf8') : inline;
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        printError(`Failed to read file: ${msg}`);
-        process.exit(1);
-    }
-}
-/**
- * Ensure the user is authenticated before running a command.
- * Exits with code 1 if not authenticated.
- */
-export function requireAuth() {
-    const auth = readAuth();
-    if (!auth?.accessToken) {
-        printError('Authentication required. Run: bigconsole auth login');
-        process.exit(1);
-    }
-    // We intentionally DO NOT hard-fail on expired access tokens here —
-    // `workspaceRequest`/`globalRequest` both call `ensureFreshTokens()`,
-    // which transparently refreshes near-expiry tokens. Bailing at this
-    // point would short-circuit that refresh and force users to run
-    // `bigconsole auth refresh` manually for every command after expiry.
-    // We only fail when there are no credentials at all.
-}
-/**
- * Execute a workspace GraphQL request with error handling.
- */
-export async function execWorkspace(document, variables) {
-    requireAuth();
-    return workspaceRequest(document, variables);
-}
-/**
- * Execute a global GraphQL request with error handling.
- */
-export async function execGlobal(document, variables) {
-    return globalRequest(document, variables);
-}
-/**
- * Handle command errors consistently, printing user-friendly messages.
- */
-export function handleCommandError(error) {
-    const message = error instanceof Error ? error.message : String(error);
-    printError(message);
-    process.exit(1);
-}
-/**
- * Get format and output data for a command.
- * Standard pattern used by all list/get commands.
- */
-export function formatAndOutput(options, data, tableConfig) {
-    const format = getFormat(options);
-    outputData(format, data, tableConfig);
-}

package/dist/commands/cli-config.js

@@ -1,79 +0,0 @@
-/**
- * cli-config commands — manage CLI-level endpoint + auth configuration.
- * Separate from `config` (which will later manage platform-level BigConsole config).
- */
-import { readConfig, writeConfig, getConfigPath, DEFAULT_CONFIG, KNOWN_CONFIG_KEYS, } from '../config/index.js';
-import { printSuccess, printError, formatDate } from '../utils/output.js';
-import { formatAndOutput, handleCommandError } from './base.js';
-export function registerCLIConfigCommands(program) {
-    const cli = program.command('cli-config').description('CLI configuration (endpoints, client ID)');
-    cli
-        .command('show')
-        .description('Show current CLI configuration')
-        .option('-f, --format <format>', 'Output format (json, table, yaml)')
-        .action((options) => {
-        const config = readConfig();
-        formatAndOutput(options, config, {
-            headers: ['Key', 'Value'],
-            rows: Object.entries(config).map(([k, v]) => [k, v == null ? '-' : String(v)]),
-        });
-    });
-    cli
-        .command('path')
-        .description('Show CLI config file path')
-        .action(() => {
-        console.log(getConfigPath());
-    });
-    cli
-        .command('get <key>')
-        .description('Get a single config value')
-        .action((key) => {
-        try {
-            if (!KNOWN_CONFIG_KEYS.includes(key)) {
-                printError(`Unknown config key: ${key}. Known keys: ${KNOWN_CONFIG_KEYS.join(', ')}`);
-                process.exit(1);
-            }
-            const config = readConfig();
-            const value = config[key];
-            if (value === undefined || value === null) {
-                console.log('-');
-            }
-            else {
-                console.log(String(value));
-            }
-        }
-        catch (error) {
-            handleCommandError(error);
-        }
-    });
-    cli
-        .command('set <key> <value>')
-        .description('Set a config value')
-        .action((key, value) => {
-        try {
-            if (!KNOWN_CONFIG_KEYS.includes(key)) {
-                printError(`Unknown config key: ${key}. Known keys: ${KNOWN_CONFIG_KEYS.join(', ')}`);
-                process.exit(1);
-            }
-            const config = readConfig();
-            config[key] = value;
-            writeConfig(config);
-            printSuccess(`Set ${key} = ${value} (last updated ${formatDate(new Date().toISOString())})`);
-        }
-        catch (error) {
-            handleCommandError(error);
-        }
-    });
-    cli
-        .command('reset')
-        .description('Reset to default CLI configuration')
-        .action(() => {
-        try {
-            writeConfig({ ...DEFAULT_CONFIG });
-            printSuccess('CLI configuration reset to defaults');
-        }
-        catch (error) {
-            handleCommandError(error);
-        }
-    });
-}