@burdenoff/bigconsole-cli 2026.802.1

package/dist/cli.js

@@ -0,0 +1,126 @@
+#!/usr/bin/env node
+/**
+ * BigConsole CLI — dashboard, widget, parser, and workflow management from the terminal.
+ */
+import { Command } from 'commander';
+import chalk from 'chalk';
+import boxen from 'boxen';
+import updateNotifier from 'update-notifier';
+import { readFileSync } from 'fs';
+import { join, dirname } from 'path';
+import { fileURLToPath } from 'url';
+import { registerAuthCommands, registerCLIConfigCommands, registerWorkspaceCommands, registerDashboardCommands, registerWidgetCommands, registerDataSinkCommands, registerParserCommands, registerPipelineCommands, registerWorkflowCommands, registerDrilldownCommands, registerShareCommands, registerTemplateCommands, registerPromptCommands, } from './commands/index.js';
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+let pkg = {
+    name: '@burdenoff/bigconsole-cli',
+    version: '0.0.0-dev',
+};
+try {
+    const packagePath = join(__dirname, '../package.json');
+    pkg = JSON.parse(readFileSync(packagePath, 'utf8'));
+}
+catch {
+    // package.json not found in dev mode — use defaults
+}
+try {
+    const notifier = updateNotifier({
+        pkg,
+        updateCheckInterval: 1000 * 60 * 60 * 24,
+    });
+    // Suppress the update banner when the caller asked for machine-readable
+    // output (`--format json|yaml`) or when stdout isn't a TTY. Printing a
+    // human-readable box on stdout corrupts JSON/YAML piped to jq, yq,
+    // shell vars, etc. Also send the banner to stderr (not stdout) so
+    // it still doesn't mingle with data even in formats we miss.
+    const argv = process.argv.slice(2);
+    const fmtIndex = argv.findIndex((a) => a === '-f' || a === '--format');
+    const fmt = fmtIndex !== -1 ? argv[fmtIndex + 1]?.toLowerCase() : undefined;
+    const isMachineOutput = fmt === 'json' || fmt === 'yaml' || fmt === 'yml';
+    const isTty = Boolean(process.stdout.isTTY);
+    if (notifier.update && !isMachineOutput && isTty) {
+        const message = `Update available: ${chalk.dim(notifier.update.current)} → ${chalk.green(notifier.update.latest)}\nRun ${chalk.cyan(`bun add -g ${pkg.name}`)} to update`;
+        process.stderr.write(boxen(message, {
+            padding: 1,
+            margin: 1,
+            align: 'center',
+            borderColor: 'yellow',
+            borderStyle: 'round',
+        }) + '\n');
+    }
+}
+catch {
+    // Update check is best-effort; never block CLI startup on a network failure.
+}
+const program = new Command();
+program
+    .name('bigconsole')
+    .description('BigConsole CLI — dashboards, widgets, parsers, and workflows from the terminal')
+    .version(pkg.version, '-v, --version')
+    .option('-f, --format <format>', 'Output format (json, table, yaml)')
+    .option('--verbose', 'Enable verbose logging')
+    .option('--no-color', 'Disable colored output');
+registerAuthCommands(program);
+registerCLIConfigCommands(program);
+registerWorkspaceCommands(program);
+registerDashboardCommands(program);
+registerWidgetCommands(program);
+registerDataSinkCommands(program);
+registerParserCommands(program);
+registerPipelineCommands(program);
+registerWorkflowCommands(program);
+registerDrilldownCommands(program);
+registerShareCommands(program);
+registerTemplateCommands(program);
+registerPromptCommands(program);
+program.addHelpText('after', `
+${chalk.bold('Examples:')}
+  ${chalk.dim('# Authentication')}
+  $ bigconsole auth login                                      ${chalk.dim('# OAuth2 Device Code login')}
+  $ bigconsole auth status                                     ${chalk.dim('# Show auth state')}
+
+  ${chalk.dim('# Workspace selection')}
+  $ bigconsole workspace list                                  ${chalk.dim('# List accessible workspaces')}
+  $ bigconsole workspace set <id>                              ${chalk.dim('# Switch active workspace')}
+
+  ${chalk.dim('# Core domain')}
+  $ bigconsole dashboard list --search sales                   ${chalk.dim('# List dashboards')}
+  $ bigconsole dashboard get <id>                              ${chalk.dim('# Inspect a dashboard')}
+  $ bigconsole widget list --page <pageId>                     ${chalk.dim('# Widgets on a page')}
+  $ bigconsole datasink list                                   ${chalk.dim('# List data sinks')}
+  $ bigconsole datasink data --key orders --force-refresh      ${chalk.dim('# Fetch live payload')}
+  $ bigconsole parser list                                     ${chalk.dim('# List parsers')}
+  $ bigconsole pipeline list                                   ${chalk.dim('# List pipelines')}
+  $ bigconsole workflow list                                   ${chalk.dim('# List workflows')}
+
+  ${chalk.dim('# CLI config')}
+  $ bigconsole cli-config show
+  $ bigconsole cli-config set workspaceEndpoint https://graphqlworkspaces.burdenoff.com/workspaces/graphql
+
+${chalk.bold('Command groups:')}
+  ${chalk.cyan('auth')}        login, logout, status, token, refresh
+  ${chalk.cyan('workspace')}   list, current, set
+  ${chalk.cyan('dashboard')}   list, get, create, update, archive, delete, import, export
+  ${chalk.cyan('widget')}      list, get, create, update, delete
+  ${chalk.cyan('datasink')}    list, get, data, create, update, delete
+  ${chalk.cyan('parser')}      list, get, create, update, delete
+  ${chalk.cyan('pipeline')}    list, get, create, update, delete
+  ${chalk.cyan('workflow')}    list, get
+  ${chalk.cyan('drilldown')}   list, delete
+  ${chalk.cyan('share')}       list
+  ${chalk.cyan('template')}    list, get
+  ${chalk.cyan('prompt')}      generate, list, get, cancel
+  ${chalk.cyan('cli-config')}  show, get, set, path, reset
+
+${chalk.bold('Configuration:')} ${chalk.dim('~/.config/bigconsole-cli/')}
+${chalk.bold('Docs:')} ${chalk.blue('https://docs.bigconsole.com/cli')}
+`);
+program.on('command:*', () => {
+    console.error(chalk.red(`Invalid command: ${program.args.join(' ')}`));
+    console.log(chalk.dim('See --help for a list of available commands.'));
+    process.exit(1);
+});
+program.parse();
+if (!process.argv.slice(2).length) {
+    program.outputHelp();
+}

package/dist/commands/auth.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Auth commands: login, logout, status, token, refresh.
+ */
+import { Command } from 'commander';
+export declare function registerAuthCommands(program: Command): void;

package/dist/commands/auth.js

@@ -0,0 +1,352 @@
+/**
+ * Auth commands: login, logout, status, token, refresh.
+ */
+import { readConfig, resolveOIDCConfig } from '../config/index.js';
+import { readAuth, writeAuth, clearAuth, isTokenExpired } from '../auth/store.js';
+import { startDeviceCodeFlow, pollForToken, openBrowser, clientCredentialsFlow, issueWorkspaceToken, fetchWorkspaces, } from '../auth/device-code.js';
+import { globalRequest, resetClients } from '../graphql/client.js';
+import { SIGN_OUT, REFRESH_TOKEN } from '../graphql/operations.js';
+import { printSuccess, printError, printInfo, printWarning, formatDate } from '../utils/output.js';
+import { handleCommandError, formatAndOutput } from './base.js';
+export function registerAuthCommands(program) {
+    const auth = program.command('auth').description('Authentication commands');
+    auth
+        .command('login')
+        .description('Authenticate with BigConsole')
+        .option('--client-credentials', 'Authenticate as an app with client ID and secret')
+        .option('--workspace-id <id>', 'Workspace ID (for app auth)')
+        .action(async (options) => {
+        try {
+            if (options.clientCredentials) {
+                await loginWithClientCredentials(options.workspaceId);
+            }
+            else {
+                await loginWithDeviceCode();
+            }
+        }
+        catch (error) {
+            handleCommandError(error);
+        }
+    });
+    auth
+        .command('logout')
+        .description('Revoke tokens and clear stored auth')
+        .action(async () => {
+        try {
+            const authData = readAuth();
+            if (authData?.accessToken) {
+                try {
+                    await globalRequest(SIGN_OUT);
+                }
+                catch {
+                    printWarning('Server-side logout failed, clearing local tokens');
+                }
+            }
+            clearAuth();
+            resetClients();
+            printSuccess('Logged out successfully');
+        }
+        catch (error) {
+            handleCommandError(error);
+        }
+    });
+    auth
+        .command('status')
+        .description('Show current auth state')
+        .option('-f, --format <format>', 'Output format (json, table)')
+        .action((options) => {
+        const authData = readAuth();
+        const config = readConfig();
+        const authenticated = Boolean(authData?.accessToken);
+        const expired = authData?.accessToken ? isTokenExpired(authData) : false;
+        const expiresAt = authData?.expiresAt
+            ? formatDate(new Date(authData.expiresAt).toISOString())
+            : '-';
+        const method = authData?.authMethod === 'client_credentials' ? 'Client Credentials' : 'OAuth2 Device Code';
+        const wsTokenExpires = authData?.workspaceTokenExpiresAt
+            ? formatDate(new Date(authData.workspaceTokenExpiresAt).toISOString())
+            : '-';
+        formatAndOutput(options, {
+            authenticated,
+            method,
+            expired,
+            expiresAt,
+            workspaceId: authData?.workspaceId ?? '-',
+            organizationId: authData?.organizationId ?? '-',
+            workspaceTokenExpiresAt: wsTokenExpires,
+            workspaceEndpoint: config.workspaceEndpoint,
+            globalEndpoint: config.globalEndpoint,
+        }, {
+            headers: ['Key', 'Value'],
+            rows: [
+                ['Authenticated', String(authenticated)],
+                ['Method', method],
+                ['Expired', String(expired)],
+                ['Expires At', expiresAt],
+                ['Workspace ID', authData?.workspaceId ?? '-'],
+                ['Organization ID', authData?.organizationId ?? '-'],
+                ['Workspace Token Expires', wsTokenExpires],
+                ['Workspace Endpoint', config.workspaceEndpoint],
+                ['Global Endpoint', config.globalEndpoint],
+            ],
+        });
+    });
+    auth
+        .command('token')
+        .description('Print access token to stdout')
+        .option('--workspace', 'Print workspace token instead')
+        .action((options) => {
+        const authData = readAuth();
+        if (options.workspace) {
+            if (!authData?.workspaceToken) {
+                printError('No workspace token. Log in and select a workspace: bigconsole auth login');
+                process.exit(1);
+            }
+            process.stdout.write(authData.workspaceToken);
+            return;
+        }
+        if (!authData?.accessToken) {
+            printError('Not authenticated. Run: bigconsole auth login');
+            process.exit(1);
+        }
+        process.stdout.write(authData.accessToken);
+    });
+    auth
+        .command('refresh')
+        .description('Force token refresh')
+        .action(async () => {
+        try {
+            const authData = readAuth();
+            if (!authData?.refreshToken && authData?.authMethod !== 'client_credentials') {
+                printError('No refresh token available. Run: bigconsole auth login');
+                process.exit(1);
+            }
+            if (authData?.authMethod === 'client_credentials' &&
+                authData.clientId &&
+                authData.clientSecret) {
+                const config = readConfig();
+                const result = await clientCredentialsFlow(config.globalEndpoint, authData.clientId, authData.clientSecret);
+                writeAuth({
+                    ...authData,
+                    accessToken: result.accessToken,
+                    expiresAt: Date.now() + result.expiresIn * 1000,
+                });
+                resetClients();
+                printSuccess('App token refreshed successfully');
+                if (authData.workspaceId && authData.organizationId) {
+                    await refreshWorkspaceTokenForAuth();
+                }
+                return;
+            }
+            const data = await globalRequest(REFRESH_TOKEN, {
+                token: authData.refreshToken,
+            });
+            const r = data.refreshToken;
+            writeAuth({
+                ...authData,
+                accessToken: r.accessToken,
+                refreshToken: r.refreshToken,
+                expiresAt: Date.now() + r.expiresIn * 1000,
+            });
+            resetClients();
+            printSuccess('Token refreshed successfully');
+            if (authData.workspaceId && authData.organizationId) {
+                await refreshWorkspaceTokenForAuth();
+            }
+        }
+        catch (error) {
+            handleCommandError(error);
+        }
+    });
+}
+async function refreshWorkspaceTokenForAuth() {
+    const authData = readAuth();
+    if (!authData?.accessToken || !authData.workspaceId || !authData.organizationId)
+        return;
+    const config = readConfig();
+    try {
+        const wsResult = await issueWorkspaceToken(config.workspaceEndpoint, authData.accessToken, authData.workspaceId, authData.organizationId);
+        writeAuth({
+            ...authData,
+            workspaceToken: wsResult.token,
+            workspaceTokenExpiresAt: new Date(wsResult.expiresAt).getTime(),
+        });
+        resetClients();
+        printSuccess('Workspace token refreshed');
+    }
+    catch {
+        printWarning('Workspace token refresh failed — workspace operations may require re-login');
+    }
+}
+async function loginWithDeviceCode() {
+    const config = readConfig();
+    const { oidcIssuer, clientId } = resolveOIDCConfig();
+    const oidcConfig = { ...config, oidcIssuer, clientId };
+    printInfo('Starting device code authentication...');
+    const dc = await startDeviceCodeFlow(oidcConfig);
+    console.log('');
+    console.log(`  Open: ${dc.verificationUri}`);
+    console.log(`  Code: ${dc.userCode}`);
+    console.log('');
+    const opened = await openBrowser(dc.verificationUriComplete ?? dc.verificationUri);
+    if (opened)
+        printInfo('Browser opened');
+    else
+        printWarning('Could not open browser — open the URL manually');
+    printInfo('Waiting for authorization...');
+    const result = await pollForToken(dc.deviceCode, dc.interval, oidcConfig);
+    const accessToken = result.accessToken;
+    const expiresAt = Date.now() + result.expiresIn * 1000;
+    printInfo('Fetching workspaces...');
+    try {
+        const workspaces = await fetchWorkspaces(config.globalEndpoint, accessToken);
+        if (workspaces.length === 0) {
+            writeAuth({
+                accessToken,
+                refreshToken: result.refreshToken,
+                expiresAt,
+                authMethod: 'device_code',
+            });
+            resetClients();
+            printSuccess('Authentication successful (no workspaces found)');
+            return;
+        }
+        let selected = workspaces[0];
+        if (workspaces.length > 1) {
+            console.log('\nAvailable workspaces:');
+            workspaces.forEach((ws, i) => console.log(`  ${i + 1}. ${ws.name} (${ws.slug})`));
+            const readline = await import('readline');
+            // Re-prompt up to 3 times on invalid input rather than silently
+            // defaulting to workspaces[0] — users who mistype expect to see
+            // an error, not end up in the wrong workspace.
+            for (let attempt = 0; attempt < 3; attempt++) {
+                const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+                const answer = await new Promise((resolve) => {
+                    rl.question(`\nSelect workspace [1-${workspaces.length}]: `, (a) => {
+                        rl.close();
+                        resolve(a.trim());
+                    });
+                });
+                const idx = parseInt(answer, 10) - 1;
+                if (!Number.isNaN(idx) && idx >= 0 && idx < workspaces.length) {
+                    selected = workspaces[idx];
+                    break;
+                }
+                if (attempt < 2) {
+                    printError(`Invalid selection. Enter a number between 1 and ${workspaces.length}.`);
+                }
+                else {
+                    printError('Too many invalid attempts — aborting login.');
+                    process.exit(1);
+                }
+            }
+        }
+        printInfo(`Using workspace: ${selected.name} (${selected.id})`);
+        const wsResult = await issueWorkspaceToken(config.workspaceEndpoint, accessToken, selected.id, selected.organizationId);
+        writeAuth({
+            accessToken,
+            refreshToken: result.refreshToken,
+            expiresAt,
+            workspaceToken: wsResult.token,
+            workspaceTokenExpiresAt: new Date(wsResult.expiresAt).getTime(),
+            workspaceId: selected.id,
+            organizationId: selected.organizationId,
+            authMethod: 'device_code',
+        });
+        resetClients();
+        printSuccess('Authentication successful');
+    }
+    catch (wsError) {
+        writeAuth({
+            accessToken,
+            refreshToken: result.refreshToken,
+            expiresAt,
+            authMethod: 'device_code',
+        });
+        resetClients();
+        printSuccess('Authentication successful');
+        printWarning(`Workspace token not obtained: ${wsError instanceof Error ? wsError.message : String(wsError)}`);
+        printInfo('Run `bigconsole auth login` again once a workspace is available.');
+    }
+}
+async function loginWithClientCredentials(workspaceId) {
+    const config = readConfig();
+    const readline = await import('readline');
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const clientId = await new Promise((resolve) => {
+        rl.question('Client ID: ', (a) => resolve(a.trim()));
+    });
+    // Mask the client-secret input so the value doesn't echo into the terminal,
+    // get captured by screen recordings, or land in shell scroll-back. We
+    // temporarily intercept stdout writes that readline emits for each keystroke
+    // and suppress them — readline still sees the real chars because
+    // input.on('data') runs before output, so the resulting string is unchanged.
+    const out = rl;
+    out._writeToOutput = function maskedWrite(stringToWrite) {
+        if (stringToWrite === '\r\n' || stringToWrite === '\n') {
+            out.output.write(stringToWrite);
+            return;
+        }
+        // readline sends the raw user char here — replace with a mask.
+        out.output.write('*');
+    };
+    const clientSecret = await new Promise((resolve) => {
+        rl.question('Client Secret: ', (a) => {
+            rl.close();
+            resolve(a.trim());
+        });
+    });
+    // Newline after the masked line — otherwise the prompt runs into the next
+    // line of output.
+    process.stdout.write('\n');
+    if (!clientId || !clientSecret) {
+        printError('Client ID and secret cannot be empty');
+        process.exit(1);
+    }
+    printInfo('Authenticating app...');
+    const result = await clientCredentialsFlow(config.globalEndpoint, clientId, clientSecret);
+    const accessToken = result.accessToken;
+    const expiresAt = Date.now() + result.expiresIn * 1000;
+    let wsToken;
+    let wsTokenExpiresAt;
+    let wsId = workspaceId;
+    let orgId;
+    if (wsId) {
+        // When the user passed --workspace-id they explicitly asked for a
+        // workspace-scoped session — fail the login (not just warn) if we
+        // can't produce a workspace token, otherwise the CLI would persist
+        // a platform-only session and every subsequent workspace call would
+        // 401 with a confusing "not authenticated for this workspace" error.
+        try {
+            const workspaces = await fetchWorkspaces(config.globalEndpoint, accessToken);
+            const ws = workspaces.find((w) => w.id === wsId);
+            if (!ws) {
+                printError(`Workspace ${wsId} not found or not accessible to this app.`);
+                process.exit(1);
+            }
+            orgId = ws.organizationId;
+            const wsResult = await issueWorkspaceToken(config.workspaceEndpoint, accessToken, wsId, orgId);
+            wsToken = wsResult.token;
+            wsTokenExpiresAt = new Date(wsResult.expiresAt).getTime();
+            printInfo(`Workspace token issued for: ${ws.name}`);
+        }
+        catch (err) {
+            printError(`Workspace token issuance failed: ${err instanceof Error ? err.message : String(err)}`);
+            process.exit(1);
+        }
+    }
+    writeAuth({
+        accessToken,
+        refreshToken: '',
+        expiresAt,
+        workspaceToken: wsToken,
+        workspaceTokenExpiresAt: wsTokenExpiresAt,
+        workspaceId: wsId,
+        organizationId: orgId,
+        authMethod: 'client_credentials',
+        clientId,
+        clientSecret,
+    });
+    resetClients();
+    printSuccess('App authentication successful');
+}

package/dist/commands/base.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Shared command utilities.
+ * Provides auth wrappers, format helpers, and error handling for all commands.
+ */
+import type { RequestDocument, Variables } from 'graphql-request';
+/**
+ * Load a JSON-valued command input from either --file or --json, mutually
+ * exclusive. Returns undefined if neither is provided. Exits with a clear
+ * error if the JSON is malformed or both flags are set.
+ *
+ * Used for complex inputs (widget.config, parser.expression, pipeline.stages,
+ * dashboard.definition) where a single flag value would be unwieldy.
+ */
+export declare function loadJsonInput<T = unknown>(file?: string, inline?: string): T | undefined;
+/**
+ * Read a raw string payload — used for parser expressions and other text
+ * bodies where `--body-file foo.jq` reads the file and `--body 'raw'` takes
+ * the literal string. Mutually exclusive.
+ */
+export declare function loadTextInput(file?: string, inline?: string): string | undefined;
+/**
+ * Ensure the user is authenticated before running a command.
+ * Exits with code 1 if not authenticated.
+ */
+export declare function requireAuth(): void;
+/**
+ * Execute a workspace GraphQL request with error handling.
+ */
+export declare function execWorkspace<T>(document: RequestDocument, variables?: Variables): Promise<T>;
+/**
+ * Execute a global GraphQL request with error handling.
+ */
+export declare function execGlobal<T>(document: RequestDocument, variables?: Variables): Promise<T>;
+/**
+ * Handle command errors consistently, printing user-friendly messages.
+ */
+export declare function handleCommandError(error: unknown): never;
+/**
+ * Get format and output data for a command.
+ * Standard pattern used by all list/get commands.
+ */
+export declare function formatAndOutput(options: {
+    format?: string;
+}, data: unknown, tableConfig?: {
+    headers: string[];
+    rows: string[][];
+}): void;

package/dist/commands/base.js

@@ -0,0 +1,100 @@
+/**
+ * Shared command utilities.
+ * Provides auth wrappers, format helpers, and error handling for all commands.
+ */
+import { readFileSync } from 'fs';
+import { readAuth } from '../auth/store.js';
+import { workspaceRequest, globalRequest } from '../graphql/client.js';
+import { printError, getFormat, outputData } from '../utils/output.js';
+/**
+ * Load a JSON-valued command input from either --file or --json, mutually
+ * exclusive. Returns undefined if neither is provided. Exits with a clear
+ * error if the JSON is malformed or both flags are set.
+ *
+ * Used for complex inputs (widget.config, parser.expression, pipeline.stages,
+ * dashboard.definition) where a single flag value would be unwieldy.
+ */
+export function loadJsonInput(file, inline) {
+    if (!file && !inline)
+        return undefined;
+    if (file && inline) {
+        printError('Provide --file OR --json, not both');
+        process.exit(1);
+    }
+    try {
+        const raw = file ? readFileSync(file, 'utf8') : inline;
+        return JSON.parse(raw);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        printError(`Failed to parse JSON input: ${msg}`);
+        process.exit(1);
+    }
+}
+/**
+ * Read a raw string payload — used for parser expressions and other text
+ * bodies where `--body-file foo.jq` reads the file and `--body 'raw'` takes
+ * the literal string. Mutually exclusive.
+ */
+export function loadTextInput(file, inline) {
+    if (!file && !inline)
+        return undefined;
+    if (file && inline) {
+        printError('Provide --file OR inline value, not both');
+        process.exit(1);
+    }
+    try {
+        return file ? readFileSync(file, 'utf8') : inline;
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        printError(`Failed to read file: ${msg}`);
+        process.exit(1);
+    }
+}
+/**
+ * Ensure the user is authenticated before running a command.
+ * Exits with code 1 if not authenticated.
+ */
+export function requireAuth() {
+    const auth = readAuth();
+    if (!auth?.accessToken) {
+        printError('Authentication required. Run: bigconsole auth login');
+        process.exit(1);
+    }
+    // We intentionally DO NOT hard-fail on expired access tokens here —
+    // `workspaceRequest`/`globalRequest` both call `ensureFreshTokens()`,
+    // which transparently refreshes near-expiry tokens. Bailing at this
+    // point would short-circuit that refresh and force users to run
+    // `bigconsole auth refresh` manually for every command after expiry.
+    // We only fail when there are no credentials at all.
+}
+/**
+ * Execute a workspace GraphQL request with error handling.
+ */
+export async function execWorkspace(document, variables) {
+    requireAuth();
+    return workspaceRequest(document, variables);
+}
+/**
+ * Execute a global GraphQL request with error handling.
+ */
+export async function execGlobal(document, variables) {
+    return globalRequest(document, variables);
+}
+/**
+ * Handle command errors consistently, printing user-friendly messages.
+ */
+export function handleCommandError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    printError(message);
+    process.exit(1);
+}
+/**
+ * Get format and output data for a command.
+ * Standard pattern used by all list/get commands.
+ */
+export function formatAndOutput(options, data, tableConfig) {
+    const format = getFormat(options);
+    outputData(format, data, tableConfig);
+}

package/dist/commands/cli-config.d.ts

@@ -0,0 +1,6 @@
+/**
+ * cli-config commands — manage CLI-level endpoint + auth configuration.
+ * Separate from `config` (which will later manage platform-level BigConsole config).
+ */
+import { Command } from 'commander';
+export declare function registerCLIConfigCommands(program: Command): void;