@burdenoff/bigconsole-cli 2026.802.1

package/dist/commands/widget.js

@@ -0,0 +1,164 @@
+/**
+ * widget commands — list by page, get, delete.
+ */
+import * as ops from '../graphql/operations.js';
+import { execWorkspace, formatAndOutput, handleCommandError, loadJsonInput } from './base.js';
+import { printSuccess, printError, formatDate, truncate } from '../utils/output.js';
+export function registerWidgetCommands(program) {
+    const w = program.command('widget').description('Widget operations');
+    w.command('list')
+        .description('List widgets on a dashboard page')
+        .requiredOption('--page <pageId>', 'Dashboard page ID')
+        .option('--type <t>', 'Filter by widget type (METRIC_CARD, CHART, TABLE, ...)')
+        .option('--first <n>', 'Page size', (v) => parseInt(v, 10), 50)
+        .option('--after <cursor>', 'Cursor for next page')
+        .option('-f, --format <format>', 'Output format')
+        .action(async (o) => {
+        try {
+            const d = await execWorkspace(ops.LIST_WIDGETS, {
+                pageId: o.page,
+                first: o.first ?? 50,
+                after: o.after,
+                type: o.type ? o.type.toUpperCase() : undefined,
+            });
+            const items = d.listWidgets.edges.map((e) => e.node);
+            formatAndOutput(o, items, {
+                headers: ['ID', 'Title', 'Type', 'DataSink', 'Last Refreshed', 'Updated'],
+                rows: items.map((x) => [
+                    truncate(x.id, 14),
+                    truncate(x.title ?? '-', 24),
+                    x.type,
+                    x.dataSinkId ? truncate(x.dataSinkId, 14) : '-',
+                    formatDate(x.lastRefreshedAt),
+                    formatDate(x.updatedAt),
+                ]),
+            });
+        }
+        catch (e) {
+            handleCommandError(e);
+        }
+    });
+    w.command('get')
+        .description('Get a widget by ID (includes full config JSON)')
+        .argument('<id>')
+        .option('-f, --format <format>', 'Output format')
+        .action(async (id, o) => {
+        try {
+            const d = await execWorkspace(ops.GET_WIDGET, { id });
+            if (!d.getWidget) {
+                printError('Widget not found');
+                process.exit(1);
+            }
+            formatAndOutput(o, d.getWidget);
+        }
+        catch (e) {
+            handleCommandError(e);
+        }
+    });
+    w.command('delete')
+        .description('Delete a widget')
+        .argument('<id>')
+        .action(async (id) => {
+        try {
+            await execWorkspace(ops.DELETE_WIDGET, { id });
+            printSuccess(`Deleted widget ${id}`);
+        }
+        catch (e) {
+            handleCommandError(e);
+        }
+    });
+    w.command('create')
+        .description('Create a widget (config is JSON — use --config-file for complex layouts)')
+        .requiredOption('--page <id>', 'Parent page ID')
+        .requiredOption('--type <t>', 'Widget type (METRIC_CARD, CHART, TABLE, ...)')
+        .option('--title <t>', 'Widget title')
+        .option('--config-file <path>', 'JSON file with widget config')
+        .option('--config-json <json>', 'Inline JSON config')
+        .option('--position-file <path>', 'JSON file with position {x,y,w,h}')
+        .option('--position-json <json>', 'Inline JSON position')
+        .option('--datasink <id>', 'Bound DataSink ID')
+        .option('--parser <id>', 'Bound Parser ID')
+        .option('--dataset <id>', 'Dataset ID within DataSink')
+        .option('--cache-ttl <seconds>', 'Cache TTL override', (v) => parseInt(v, 10))
+        .option('-f, --format <format>', 'Output format')
+        .action(async (o) => {
+        try {
+            const config = loadJsonInput(o.configFile, o.configJson);
+            const position = loadJsonInput(o.positionFile, o.positionJson);
+            if (!config) {
+                printError('Widget config is required — provide --config-file or --config-json');
+                process.exit(1);
+            }
+            if (!position) {
+                printError('Position is required — provide --position-file or --position-json');
+                process.exit(1);
+            }
+            // `type` and `title` are top-level required fields on
+            // BigConsoleCreateWidgetInput. Previously we stuffed title into
+            // config and dropped type entirely — the mutation would have
+            // failed with a schema validation error on the first real call.
+            const input = {
+                pageId: o.page,
+                type: o.type.toUpperCase(),
+                title: o.title ?? '',
+                config,
+                position,
+            };
+            if (o.datasink)
+                input.dataSinkId = o.datasink;
+            if (o.parser)
+                input.parserId = o.parser;
+            if (o.dataset)
+                input.datasetId = o.dataset;
+            if (o.cacheTtl !== undefined)
+                input.cacheTTL = o.cacheTtl;
+            const d = await execWorkspace(ops.CREATE_WIDGET, {
+                input,
+            });
+            printSuccess(`Created widget ${d.createBigConsoleWidget.id}`);
+            formatAndOutput(o, d.createBigConsoleWidget);
+        }
+        catch (e) {
+            handleCommandError(e);
+        }
+    });
+    w.command('update')
+        .description('Update a widget')
+        .argument('<id>')
+        .option('--config-file <path>', 'Replace widget config from JSON file')
+        .option('--config-json <json>', 'Replace widget config inline')
+        .option('--position-file <path>')
+        .option('--position-json <json>')
+        .option('--datasink <id>')
+        .option('--parser <id>')
+        .option('--dataset <id>')
+        .option('--cache-ttl <seconds>', '', (v) => parseInt(v, 10))
+        .option('-f, --format <format>', 'Output format')
+        .action(async (id, o) => {
+        try {
+            const config = loadJsonInput(o.configFile, o.configJson);
+            const position = loadJsonInput(o.positionFile, o.positionJson);
+            const input = { id };
+            if (config !== undefined)
+                input.config = config;
+            if (position !== undefined)
+                input.position = position;
+            if (o.datasink)
+                input.dataSinkId = o.datasink;
+            if (o.parser)
+                input.parserId = o.parser;
+            if (o.dataset)
+                input.datasetId = o.dataset;
+            if (o.cacheTtl !== undefined)
+                input.cacheTTL = o.cacheTtl;
+            const d = await execWorkspace(ops.UPDATE_WIDGET, {
+                input,
+            });
+            printSuccess(`Updated widget ${id}`);
+            formatAndOutput(o, d.updateBigConsoleWidget);
+        }
+        catch (e) {
+            handleCommandError(e);
+        }
+    });
+}

package/dist/commands/workflow.d.ts

@@ -0,0 +1,9 @@
+/**
+ * workflow commands — list, get.
+ *
+ * Workflows are FluidGrids-backed; CRUD mutations live on the FluidGrids
+ * gateway rather than bigconsole-svc. Create/update/delete are not exposed
+ * here in Phase 1B to avoid a misleading surface.
+ */
+import { Command } from 'commander';
+export declare function registerWorkflowCommands(program: Command): void;

package/dist/commands/workflow.js

@@ -0,0 +1,54 @@
+/**
+ * workflow commands — list, get.
+ *
+ * Workflows are FluidGrids-backed; CRUD mutations live on the FluidGrids
+ * gateway rather than bigconsole-svc. Create/update/delete are not exposed
+ * here in Phase 1B to avoid a misleading surface.
+ */
+import * as ops from '../graphql/operations.js';
+import { execWorkspace, formatAndOutput, handleCommandError } from './base.js';
+import { printError, formatDate, formatStatus, truncate } from '../utils/output.js';
+export function registerWorkflowCommands(program) {
+    const wf = program.command('workflow').description('Workflow operations');
+    wf.command('list')
+        .description('List workflows linked to BigConsole')
+        .option('-f, --format <format>', 'Output format')
+        .action(async (o) => {
+        try {
+            const d = await execWorkspace(ops.LIST_WORKFLOWS, {});
+            const items = d.workflows;
+            formatAndOutput(o, items, {
+                headers: ['ID', 'Name', 'Key', 'Status', 'Execs', 'Sinks', 'Last Run'],
+                rows: items.map((x) => [
+                    truncate(x.id, 14),
+                    truncate(x.name, 24),
+                    truncate(x.key, 18),
+                    formatStatus(x.status),
+                    String(x.executionCount),
+                    String(x.linkedDataSinkCount),
+                    formatDate(x.lastExecutedAt),
+                ]),
+            });
+        }
+        catch (e) {
+            handleCommandError(e);
+        }
+    });
+    wf.command('get')
+        .description('Get a workflow by ID')
+        .argument('<id>')
+        .option('-f, --format <format>', 'Output format')
+        .action(async (id, o) => {
+        try {
+            const d = await execWorkspace(ops.GET_WORKFLOW, { id });
+            if (!d.workflow) {
+                printError('Workflow not found');
+                process.exit(1);
+            }
+            formatAndOutput(o, d.workflow);
+        }
+        catch (e) {
+            handleCommandError(e);
+        }
+    });
+}

package/dist/commands/workspace.d.ts

@@ -0,0 +1,9 @@
+/**
+ * workspace commands — list workspaces, switch current, show current.
+ *
+ * Workspace selection in this CLI is done at `auth login` time (we call
+ * IssueWorkspaceToken then). These commands let a logged-in user switch to
+ * a different workspace without re-running the full device-code flow.
+ */
+import { Command } from 'commander';
+export declare function registerWorkspaceCommands(program: Command): void;

package/dist/commands/workspace.js

@@ -0,0 +1,95 @@
+/**
+ * workspace commands — list workspaces, switch current, show current.
+ *
+ * Workspace selection in this CLI is done at `auth login` time (we call
+ * IssueWorkspaceToken then). These commands let a logged-in user switch to
+ * a different workspace without re-running the full device-code flow.
+ */
+import { readConfig } from '../config/index.js';
+import { readAuth, writeAuth } from '../auth/store.js';
+import { fetchWorkspaces, issueWorkspaceToken } from '../auth/device-code.js';
+import { ensureFreshTokens, resetClients } from '../graphql/client.js';
+import { printSuccess, printError, truncate } from '../utils/output.js';
+import { formatAndOutput, handleCommandError, requireAuth } from './base.js';
+export function registerWorkspaceCommands(program) {
+    const ws = program.command('workspace').description('Workspace selection and info');
+    ws.command('list')
+        .description('List workspaces the current user can access')
+        .option('-f, --format <format>', 'Output format (json, table, yaml)')
+        .action(async (o) => {
+        try {
+            requireAuth();
+            // Refresh platform token before hitting the global endpoint —
+            // `fetchWorkspaces` does a raw fetch() and doesn't go through
+            // `workspaceRequest`/`globalRequest`, so it otherwise bypasses
+            // the auto-refresh path in the GraphQL client.
+            await ensureFreshTokens();
+            const auth = readAuth();
+            const config = readConfig();
+            const workspaces = await fetchWorkspaces(config.globalEndpoint, auth.accessToken);
+            formatAndOutput(o, workspaces, {
+                headers: ['ID', 'Name', 'Slug', 'Org ID', 'Tenant ID', 'Current'],
+                rows: workspaces.map((w) => [
+                    truncate(w.id, 14),
+                    w.name,
+                    w.slug,
+                    truncate(w.organizationId, 14),
+                    truncate(w.tenantId, 14),
+                    auth.workspaceId === w.id ? '*' : '',
+                ]),
+            });
+        }
+        catch (e) {
+            handleCommandError(e);
+        }
+    });
+    ws.command('current')
+        .description('Show the currently-selected workspace')
+        .option('-f, --format <format>', 'Output format')
+        .action((o) => {
+        const auth = readAuth();
+        if (!auth?.workspaceId) {
+            printError('No workspace selected. Run `bigconsole workspace set <id>` or re-login.');
+            process.exit(1);
+        }
+        formatAndOutput(o, {
+            workspaceId: auth.workspaceId,
+            organizationId: auth.organizationId ?? '-',
+            workspaceTokenExpiresAt: auth.workspaceTokenExpiresAt
+                ? new Date(auth.workspaceTokenExpiresAt).toISOString()
+                : '-',
+        });
+    });
+    ws.command('set')
+        .description('Select a workspace and issue a workspace token')
+        .argument('<id>', 'Workspace ID')
+        .action(async (id) => {
+        try {
+            requireAuth();
+            // Same reasoning as `workspace list`: refresh before the raw
+            // `fetchWorkspaces` call so we don't send a near-expiry token.
+            await ensureFreshTokens();
+            const auth = readAuth();
+            const config = readConfig();
+            const workspaces = await fetchWorkspaces(config.globalEndpoint, auth.accessToken);
+            const ws = workspaces.find((w) => w.id === id);
+            if (!ws) {
+                printError(`Workspace ${id} not found or not accessible. Run \`bigconsole workspace list\`.`);
+                process.exit(1);
+            }
+            const result = await issueWorkspaceToken(config.workspaceEndpoint, auth.accessToken, ws.id, ws.organizationId);
+            writeAuth({
+                ...auth,
+                workspaceId: ws.id,
+                organizationId: ws.organizationId,
+                workspaceToken: result.token,
+                workspaceTokenExpiresAt: new Date(result.expiresAt).getTime(),
+            });
+            resetClients();
+            printSuccess(`Switched to workspace: ${ws.name} (${ws.id})`);
+        }
+        catch (e) {
+            handleCommandError(e);
+        }
+    });
+}

package/dist/config/index.d.ts

@@ -0,0 +1,72 @@
+/**
+ * CLI configuration management.
+ * Persists CLI-level settings to ~/.config/bigconsole-cli/config.json
+ */
+export interface CLIConfig {
+    /** Workspace gateway GraphQL endpoint */
+    workspaceEndpoint: string;
+    /** Global gateway GraphQL endpoint */
+    globalEndpoint: string;
+    /** OIDC issuer URL for OAuth2 flows */
+    oidcIssuer?: string;
+    /** OAuth2 client ID */
+    clientId?: string;
+    /** Default output format */
+    defaultFormat?: string;
+    /** Enable verbose logging */
+    verbose?: boolean;
+    /** Auth service endpoint for workspace token exchange */
+    authServiceEndpoint?: string;
+}
+/**
+ * Well-known client ID for the BigConsole CLI.
+ * This is a system app auto-created by global-auth-svc on startup.
+ * Same pattern as GitHub CLI (gh), Claude Code, Stripe CLI.
+ */
+export declare const DEFAULT_CLIENT_ID = "burdenoff_cli_bigconsole";
+/** Production workspace gateway endpoint */
+export declare const PROD_WORKSPACE_ENDPOINT = "https://graphqlworkspaces.burdenoff.com/workspaces/graphql";
+/** Production global gateway endpoint */
+export declare const PROD_GLOBAL_ENDPOINT = "https://graphql.burdenoff.com/global/graphql";
+export declare const DEFAULT_CONFIG: CLIConfig;
+/**
+ * Read the CLI configuration, merging with defaults.
+ *
+ * Resolution order (later wins):
+ *   1. Built-in production defaults
+ *   2. Environment variables BIGCONSOLE_WORKSPACE_ENDPOINT, BIGCONSOLE_GLOBAL_ENDPOINT,
+ *      BIGCONSOLE_OIDC_ISSUER, BIGCONSOLE_CLIENT_ID
+ *   3. Values stored in ~/.config/bigconsole-cli/config.json
+ */
+export declare function readConfig(): CLIConfig;
+/**
+ * Write the CLI configuration to disk.
+ */
+export declare function writeConfig(config: CLIConfig): void;
+/**
+ * Get a single config value by key.
+ */
+export declare function getConfigValue(key: string): string | undefined;
+/**
+ * Set a single config value by key.
+ */
+export declare function setConfigValue(key: string, value: string): void;
+/**
+ * Get the path to the config file.
+ */
+export declare function getConfigPath(): string;
+/**
+ * Get the config directory path.
+ */
+export declare function getConfigDir(): string;
+/**
+ * Resolve OIDC configuration with smart defaults.
+ * - clientId defaults to the built-in BigConsole CLI system app
+ * - oidcIssuer derives from the configured globalEndpoint
+ * Users can override both via cli-config if they have a custom OIDC provider.
+ */
+export declare function resolveOIDCConfig(): {
+    oidcIssuer: string;
+    clientId: string;
+};
+export declare const KNOWN_CONFIG_KEYS: readonly ["workspaceEndpoint", "globalEndpoint", "oidcIssuer", "clientId", "defaultFormat", "verbose", "authServiceEndpoint"];

package/dist/config/index.js

@@ -0,0 +1,151 @@
+/**
+ * CLI configuration management.
+ * Persists CLI-level settings to ~/.config/bigconsole-cli/config.json
+ */
+import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+const CONFIG_DIR = join(homedir(), '.config', 'bigconsole-cli');
+const CONFIG_FILE = join(CONFIG_DIR, 'config.json');
+/**
+ * Well-known client ID for the BigConsole CLI.
+ * This is a system app auto-created by global-auth-svc on startup.
+ * Same pattern as GitHub CLI (gh), Claude Code, Stripe CLI.
+ */
+export const DEFAULT_CLIENT_ID = 'burdenoff_cli_bigconsole';
+/** Production OIDC issuer (global gateway) */
+const PROD_OIDC_ISSUER = 'https://graphql.burdenoff.com/global';
+/** Production workspace gateway endpoint */
+export const PROD_WORKSPACE_ENDPOINT = 'https://graphqlworkspaces.burdenoff.com/workspaces/graphql';
+/** Production global gateway endpoint */
+export const PROD_GLOBAL_ENDPOINT = 'https://graphql.burdenoff.com/global/graphql';
+export const DEFAULT_CONFIG = {
+    workspaceEndpoint: PROD_WORKSPACE_ENDPOINT,
+    globalEndpoint: PROD_GLOBAL_ENDPOINT,
+};
+function ensureConfigDir() {
+    if (!existsSync(CONFIG_DIR)) {
+        mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    }
+}
+function getEnvOverrides() {
+    const overrides = {};
+    if (process.env.BIGCONSOLE_WORKSPACE_ENDPOINT) {
+        overrides.workspaceEndpoint = process.env.BIGCONSOLE_WORKSPACE_ENDPOINT;
+    }
+    if (process.env.BIGCONSOLE_GLOBAL_ENDPOINT) {
+        overrides.globalEndpoint = process.env.BIGCONSOLE_GLOBAL_ENDPOINT;
+    }
+    if (process.env.BIGCONSOLE_OIDC_ISSUER) {
+        overrides.oidcIssuer = process.env.BIGCONSOLE_OIDC_ISSUER;
+    }
+    if (process.env.BIGCONSOLE_CLIENT_ID) {
+        overrides.clientId = process.env.BIGCONSOLE_CLIENT_ID;
+    }
+    return overrides;
+}
+/**
+ * Read the CLI configuration, merging with defaults.
+ *
+ * Resolution order (later wins):
+ *   1. Built-in production defaults
+ *   2. Environment variables BIGCONSOLE_WORKSPACE_ENDPOINT, BIGCONSOLE_GLOBAL_ENDPOINT,
+ *      BIGCONSOLE_OIDC_ISSUER, BIGCONSOLE_CLIENT_ID
+ *   3. Values stored in ~/.config/bigconsole-cli/config.json
+ */
+export function readConfig() {
+    try {
+        const envOverrides = getEnvOverrides();
+        if (!existsSync(CONFIG_FILE))
+            return { ...DEFAULT_CONFIG, ...envOverrides };
+        const raw = readFileSync(CONFIG_FILE, 'utf8');
+        const stored = JSON.parse(raw);
+        return { ...DEFAULT_CONFIG, ...envOverrides, ...stored };
+    }
+    catch {
+        return { ...DEFAULT_CONFIG };
+    }
+}
+/**
+ * Write the CLI configuration to disk.
+ */
+export function writeConfig(config) {
+    ensureConfigDir();
+    writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), { encoding: 'utf8' });
+    try {
+        chmodSync(CONFIG_FILE, 0o600);
+    }
+    catch {
+        // chmodSync may fail on Windows, non-critical
+    }
+}
+/**
+ * Get a single config value by key.
+ */
+export function getConfigValue(key) {
+    const config = readConfig();
+    return config[key];
+}
+/**
+ * Set a single config value by key.
+ */
+export function setConfigValue(key, value) {
+    const config = readConfig();
+    config[key] = value;
+    writeConfig(config);
+}
+/**
+ * Get the path to the config file.
+ */
+export function getConfigPath() {
+    return CONFIG_FILE;
+}
+/**
+ * Get the config directory path.
+ */
+export function getConfigDir() {
+    return CONFIG_DIR;
+}
+/**
+ * Resolve OIDC configuration with smart defaults.
+ * - clientId defaults to the built-in BigConsole CLI system app
+ * - oidcIssuer derives from the configured globalEndpoint
+ * Users can override both via cli-config if they have a custom OIDC provider.
+ */
+export function resolveOIDCConfig() {
+    const config = readConfig();
+    // Client ID: user override > built-in default
+    const clientId = config.clientId || DEFAULT_CLIENT_ID;
+    // OIDC issuer: user override > derive from any non-prod endpoint > prod default.
+    //
+    // Strip the trailing `/graphql` from the endpoint so OIDC routes (device-code,
+    // token, etc.) are mounted at the parent path. The second `.replace()` that
+    // used to target `/global/graphql$` was dead code — the first replace always
+    // strips the trailing `/graphql` first.
+    //
+    // Deriving from the endpoint also covers staging / self-hosted global
+    // gateways, not just localhost: if the user has explicitly pointed
+    // `globalEndpoint` somewhere non-prod the issuer should follow, and only the
+    // implicit prod endpoint falls back to `PROD_OIDC_ISSUER`.
+    let oidcIssuer = config.oidcIssuer;
+    if (!oidcIssuer) {
+        const globalEndpoint = config.globalEndpoint;
+        const isProdEndpoint = globalEndpoint.includes('graphql.burdenoff.com');
+        if (isProdEndpoint) {
+            oidcIssuer = PROD_OIDC_ISSUER;
+        }
+        else {
+            oidcIssuer = globalEndpoint.replace(/\/graphql$/, '');
+        }
+    }
+    return { oidcIssuer, clientId };
+}
+export const KNOWN_CONFIG_KEYS = [
+    'workspaceEndpoint',
+    'globalEndpoint',
+    'oidcIssuer',
+    'clientId',
+    'defaultFormat',
+    'verbose',
+    'authServiceEndpoint',
+];

package/dist/graphql/client.d.ts

@@ -0,0 +1,26 @@
+/**
+ * GraphQL client for CLI operations.
+ * Dual-endpoint: workspace gateway (bigconsole ops) + global gateway (auth ops).
+ * Auto-injects auth headers, auto-refreshes both platform and workspace tokens.
+ */
+import { type RequestDocument, type Variables } from 'graphql-request';
+export declare function ensureFreshTokens(): Promise<void>;
+/**
+ * Execute a GraphQL request against the workspace gateway.
+ * Auto-refreshes both platform and workspace tokens when they are about to expire.
+ */
+export declare function workspaceRequest<T>(document: RequestDocument, variables?: Variables): Promise<T>;
+/**
+ * Execute a GraphQL request against the global gateway (auth operations).
+ * Does NOT auto-refresh tokens (to prevent loops during refresh itself).
+ */
+export declare function globalRequest<T>(document: RequestDocument, variables?: Variables): Promise<T>;
+/**
+ * Execute a request against the workspace gateway with ONLY the platform auth token.
+ * Used for IssueWorkspaceToken which does not require an existing workspace token.
+ */
+export declare function workspaceAuthOnlyRequest<T>(document: RequestDocument, variables?: Variables): Promise<T>;
+/**
+ * Reset cached clients (useful after auth changes).
+ */
+export declare function resetClients(): void;