@burdenoff/cli-sdk 2026.1021.2 → 2026.1031.2

package/dist/modules/auth/index.cjs

@@ -1,29 +1,29 @@
-'use strict';require('graphql-request');var z=require('cross-fetch');require('commander');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}var z__default=/*#__PURE__*/_interopDefault(z);async function it(n){let s=`${n.oidcIssuer}/oidc/device/code`,i=new URLSearchParams({client_id:n.clientId,scope:"openid profile email offline_access"}),r=await z__default.default(s,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i.toString()});if(!r.ok){let p=await r.text().catch(()=>"Unknown error");throw new Error(`Device code request failed (${r.status}): ${p}`)}let a=await r.json();return {deviceCode:a.device_code,userCode:a.user_code,verificationUri:a.verification_uri,verificationUriComplete:a.verification_uri_complete??null,expiresIn:a.expires_in,interval:a.interval??5}}async function rt(n,s,i){let r=`${i.oidcIssuer}/oauth/device/token`,a=s;for(;;){await new Promise(m=>setTimeout(m,a*1e3));let p=await z__default.default(r,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"urn:ietf:params:oauth:grant-type:device_code",device_code:n,client_id:i.clientId}).toString()}),c=await p.json();if(p.ok&&c.access_token)return {accessToken:c.access_token,refreshToken:c.refresh_token??"",expiresIn:c.expires_in??3600};let u=c.error;switch(u){case "authorization_pending":continue;case "slow_down":a+=5;continue;case "expired_token":throw new Error("Device code has expired. Please try again.");case "access_denied":throw new Error("Authorization was denied by the user.");default:throw new Error(`Device code polling failed: ${c.error_description??u??"Unknown error"}`)}}}async function G(n,s,i,r){let p=await z__default.default(n,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({query:`
+'use strict';require('graphql-request');var z=require('cross-fetch');require('commander');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}var z__default=/*#__PURE__*/_interopDefault(z);async function ot(n){let s=`${n.oidcIssuer}/oidc/device/code`,i=new URLSearchParams({client_id:n.clientId,scope:"openid profile email offline_access"}),r=await z__default.default(s,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i.toString()});if(!r.ok){let c=await r.text().catch(()=>"Unknown error");throw new Error(`Device code request failed (${r.status}): ${c}`)}let a=await r.json();return {deviceCode:a.device_code,userCode:a.user_code,verificationUri:a.verification_uri,verificationUriComplete:a.verification_uri_complete??null,expiresIn:a.expires_in,interval:a.interval??5}}async function it(n,s,i){let r=`${i.oidcIssuer}/oauth/device/token`,a=s;for(;;){await new Promise($=>setTimeout($,a*1e3));let c=await z__default.default(r,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"urn:ietf:params:oauth:grant-type:device_code",device_code:n,client_id:i.clientId}).toString()}),p=await c.json();if(c.ok&&p.access_token)return {accessToken:p.access_token,refreshToken:p.refresh_token??"",expiresIn:p.expires_in??3600};let u=p.error;switch(u){case "authorization_pending":continue;case "slow_down":a+=5;continue;case "expired_token":throw new Error("Device code has expired. Please try again.");case "access_denied":throw new Error("Authorization was denied by the user.");default:throw new Error(`Device code polling failed: ${p.error_description??u??"Unknown error"}`)}}}async function M(n,s,i,r){let c=await z__default.default(n,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({query:`
     mutation AuthenticateApp($input: AuthenticateAppInput!) {
       authenticateApp(input: $input) {
         accessToken tokenType expiresIn scopes
       }
     }
-  `,variables:{input:{clientId:s,clientSecret:i,scopes:r}}})});if(!p.ok){let u=await p.text().catch(()=>"Unknown error");throw new Error(`App authentication failed (${p.status}): ${u}`)}let c=await p.json();if(c.errors?.length)throw new Error(`App authentication failed: ${c.errors[0]?.message??"unknown error"}`);if(!c.data?.authenticateApp?.accessToken)throw new Error("App authentication failed: no access token returned");return c.data.authenticateApp}async function v(n,s,i,r){let p=await z__default.default(n,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${s}`},body:JSON.stringify({query:`
+  `,variables:{input:{clientId:s,clientSecret:i,scopes:r}}})});if(!c.ok){let u=await c.text().catch(()=>"Unknown error");throw new Error(`App authentication failed (${c.status}): ${u}`)}let p=await c.json();if(p.errors?.length)throw new Error(`App authentication failed: ${p.errors[0]?.message??"unknown error"}`);if(!p.data?.authenticateApp?.accessToken)throw new Error("App authentication failed: no access token returned");return p.data.authenticateApp}async function w(n,s,i,r){let c=await z__default.default(n,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${s}`},body:JSON.stringify({query:`
     mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {
       issueWorkspaceToken(input: $input) {
         success token expiresAt scopes
         error { code message }
       }
     }
-  `,variables:{input:{workspaceId:i,organizationId:r}}})});if(!p.ok){let m=await p.text().catch(()=>"Unknown error");throw new Error(`Workspace token request failed (${p.status}): ${m}`)}let c=await p.json();if(c.errors?.length)throw new Error(`Workspace token failed: ${c.errors[0]?.message??"unknown error"}`);let u=c.data?.issueWorkspaceToken;if(!u?.success||!u.token){let m=u?.error?.message??"Unknown error";throw new Error(`Workspace token failed: ${m}`)}return {token:u.token,expiresAt:u.expiresAt??"",scopes:u.scopes??[]}}async function j(n,s){let r=await z__default.default(n,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${s}`},body:JSON.stringify({query:`
+  `,variables:{input:{workspaceId:i,organizationId:r}}})});if(!c.ok){let $=await c.text().catch(()=>"Unknown error");throw new Error(`Workspace token request failed (${c.status}): ${$}`)}let p=await c.json();if(p.errors?.length)throw new Error(`Workspace token failed: ${p.errors[0]?.message??"unknown error"}`);let u=p.data?.issueWorkspaceToken;if(!u?.success||!u.token){let $=u?.error?.message??"Unknown error";throw new Error(`Workspace token failed: ${$}`)}return {token:u.token,expiresAt:u.expiresAt??"",scopes:u.scopes??[]}}async function j(n,s){let r=await z__default.default(n,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${s}`},body:JSON.stringify({query:`
     query MyWorkspaces($limit: Int) {
       myWorkspaces(limit: $limit) {
         items { id name slug tenantId organizationId }
       }
     }
-  `,variables:{limit:50}})});if(!r.ok){let p=await r.text().catch(()=>"Unknown error");throw new Error(`Failed to fetch workspaces (${r.status}): ${p}`)}let a=await r.json();if(a.errors?.length)throw new Error(`Failed to fetch workspaces: ${a.errors[0]?.message??"unknown error"}`);return a.data?.myWorkspaces?.items??[]}function Ae(n){try{let s=new URL(n);return s.protocol==="http:"||s.protocol==="https:"}catch{return  false}}async function st(n){try{if(!Ae(n))return !1;let{execFile:s}=await import('child_process'),i=process.platform,r,a;return i==="darwin"?(r="open",a=[n]):i==="win32"?(r="cmd",a=["/c","start","",n]):(r="xdg-open",a=[n]),new Promise(p=>{s(r,a,c=>{p(!c);});})}catch{return  false}}var f=class extends Error{exitCode;hint;constructor(s,i){super(s),this.name="CliUserError",this.exitCode=i?.exitCode??1,this.hint=i?.hint;}};var k=class extends Error{cause;constructor(s,i){super(s),this.name="CliInternalError",this.cause=i;}};var Et=null;function _t(n){Et=n;}function S(){if(!Et)throw new k("vibecontrols module helpers used before setHelpersContext was called");return Et}async function l(n,s){return S().gql.global.request(n,s)}async function ft(n,s){return S().gql.global.request(n,s)}function b(){S().gql.reset();}function d(n){let s=n instanceof Error?n.message:String(n);throw new f(s)}function g(n,s,i){S().output.formatAndOutput(n,s,i);}function I(n){S().output.printSuccess(n);}function x(n){S().output.printInfo(n);}function R(n){S().output.printWarning(n);}function X(n){S().output.printJson(n);}function J(n){return S().output.formatStatus(n)}function h(n){return S().output.formatDate(n)}function q(n,s){return S().output.truncate(n,s)}function F(){return S()}function M(){return S().auth.read()}function N(n){S().auth.write(n);}function kt(){S().auth.clear();}function B(){return S().config.read()}function bt(){return S().config.resolveOIDC()}function ht(n){return n?n.expiresAt?Date.now()>=n.expiresAt:false:S().auth.isTokenExpired()}var Pt="mutation { signOut }",Lt=`
+  `,variables:{limit:50}})});if(!r.ok){let c=await r.text().catch(()=>"Unknown error");throw new Error(`Failed to fetch workspaces (${r.status}): ${c}`)}let a=await r.json();if(a.errors?.length)throw new Error(`Failed to fetch workspaces: ${a.errors[0]?.message??"unknown error"}`);return a.data?.myWorkspaces?.items??[]}function Ae(n){try{let s=new URL(n);return s.protocol==="http:"||s.protocol==="https:"}catch{return  false}}async function rt(n){try{if(!Ae(n))return !1;let{execFile:s}=await import('child_process'),i=process.platform,r,a;return i==="darwin"?(r="open",a=[n]):i==="win32"?(r="cmd",a=["/c","start","",n]):(r="xdg-open",a=[n]),new Promise(c=>{s(r,a,p=>{c(!p);});})}catch{return  false}}var S=class extends Error{exitCode;hint;constructor(s,i){super(s),this.name="CliUserError",this.exitCode=i?.exitCode??1,this.hint=i?.hint;}};var k=class extends Error{cause;constructor(s,i){super(s),this.name="CliInternalError",this.cause=i;}};var $t=null;function yt(n){$t=n;}function f(){if(!$t)throw new k("vibecontrols module helpers used before setHelpersContext was called");return $t}async function l(n,s){return f().gql.global.request(n,s)}async function St(n,s){return f().gql.global.request(n,s)}function b(){f().gql.reset();}function d(n){let s=n instanceof Error?n.message:String(n);throw new S(s)}function m(n,s,i){f().output.formatAndOutput(n,s,i);}function I(n){f().output.printSuccess(n);}function x(n){f().output.printInfo(n);}function v(n){f().output.printWarning(n);}function X(n){f().output.printJson(n);}function J(n){return f().output.formatStatus(n)}function h(n){return f().output.formatDate(n)}function q(n,s){return f().output.truncate(n,s)}function R(){return f()}function F(){return f().auth.read()}function O(n){f().auth.write(n);}function Ct(){f().auth.clear();}function B(){return f().config.read()}function _t(){return f().config.resolveOIDC()}function kt(n){return n?n.expiresAt?Date.now()>=n.expiresAt:false:f().auth.isTokenExpired()}var vt="mutation { signOut }",Rt=`
   mutation RefreshToken($token: String!) {
     refreshToken(token: $token) { accessToken refreshToken expiresIn }
   }
-`;function Yt(n){let s=n.command("auth").description("Authentication commands");s.command("login").description(`Authenticate with ${F().productName}`).option("--client-credentials","Authenticate as an app with client ID and secret").option("--workspace-id <id>","Workspace ID (for app auth)").action(async i=>{try{i.clientCredentials?await Ne(i.workspaceId):await Oe();}catch(r){d(r);}}),s.command("logout").description("Revoke tokens and clear stored auth").action(async()=>{try{if(M()?.accessToken)try{await ft(Pt);}catch{R("Server-side logout failed, clearing local tokens");}kt(),b(),I("Logged out successfully");}catch(i){d(i);}}),s.command("status").description("Show current auth state").option("-f, --format <format>","Output format (json, table)").action(i=>{let r=M(),a=B(),p=!!r?.accessToken,c=r?.accessToken?ht(r):false,u=r?.expiresAt?h(new Date(r.expiresAt).toISOString()):"-",m=r?.authMethod==="client_credentials"?"Client Credentials":"OAuth2 Device Code",t=r?.workspaceTokenExpiresAt?h(new Date(r.workspaceTokenExpiresAt).toISOString()):"-";g(i,{authenticated:p,method:m,expired:c,expiresAt:u,workspaceId:r?.workspaceId??"-",organizationId:r?.organizationId??"-",workspaceTokenExpiresAt:t,workspaceEndpoint:a.workspaceEndpoint,globalEndpoint:a.globalEndpoint},{headers:["Key","Value"],rows:[["Authenticated",String(p)],["Method",m],["Expired",String(c)],["Expires At",u],["Workspace ID",r?.workspaceId??"-"],["Organization ID",r?.organizationId??"-"],["Workspace Token Expires",t],["Workspace Endpoint",a.workspaceEndpoint],["Global Endpoint",a.globalEndpoint]]});}),s.command("token").description("Print access token to stdout").option("--workspace","Print workspace token instead").action(i=>{let r=M();if(i.workspace){if(!r?.workspaceToken)throw new f(`No workspace token. Set a workspace: ${F().productName} workspace set <id>`);process.stdout.write(r.workspaceToken);return}if(!r?.accessToken)throw new f(`Not authenticated. Run: ${F().productName} auth login`);process.stdout.write(r.accessToken);}),s.command("refresh").description("Force token refresh").action(async()=>{try{let i=M();if(!i?.refreshToken&&i?.authMethod!=="client_credentials")throw new f(`No refresh token available. Run: ${F().productName} auth login`);if(i?.authMethod==="client_credentials"&&i.clientId&&i.clientSecret){let p=B(),c=await G(p.globalEndpoint,i.clientId,i.clientSecret);N({...i,accessToken:c.accessToken,expiresAt:Date.now()+c.expiresIn*1e3}),b(),I("App token refreshed successfully"),i.workspaceId&&i.organizationId&&await Wt();return}let a=(await ft(Lt,{token:i.refreshToken})).refreshToken;N({...i,accessToken:a.accessToken,refreshToken:a.refreshToken,expiresAt:Date.now()+a.expiresIn*1e3}),b(),I("Token refreshed successfully"),i.workspaceId&&i.organizationId&&await Wt();}catch(i){d(i);}});}async function Wt(){let n=M();if(!n?.accessToken||!n.workspaceId||!n.organizationId)return;let s=B();try{let i=await v(s.workspaceEndpoint,n.accessToken,n.workspaceId,n.organizationId);N({...n,workspaceToken:i.token,workspaceTokenExpiresAt:new Date(i.expiresAt).getTime()}),b(),I("Workspace token refreshed");}catch{R("Workspace token refresh failed \u2014 workspace operations may require re-login");}}async function Oe(){let n=B(),{oidcIssuer:s,clientId:i}=bt(),r={...n,oidcIssuer:s,clientId:i};x("Starting device code authentication...");let a=await it(r);console.log(""),console.log(`  Open: ${a.verificationUri}`),console.log(`  Code: ${a.userCode}`),console.log(""),await st(a.verificationUriComplete??a.verificationUri)?x("Browser opened"):R("Could not open browser \u2014 open the URL manually"),x("Waiting for authorization...");let c=await rt(a.deviceCode,a.interval,r),u=c.accessToken,m=Date.now()+c.expiresIn*1e3;x("Fetching workspaces...");try{let t=await j(n.globalEndpoint,u);if(t.length===0){N({accessToken:u,refreshToken:c.refreshToken,expiresAt:m,authMethod:"device_code"}),b(),I("Authentication successful (no workspaces found)");return}let e=t[0];if(t.length>1){console.log(`
-Available workspaces:`),t.forEach((ot,St)=>console.log(`  ${St+1}. ${ot.name} (${ot.slug})`));let A=(await import('readline')).createInterface({input:process.stdin,output:process.stdout}),E=await new Promise(ot=>{A.question(`
-Select workspace [1-${t.length}]: `,St=>{A.close(),ot(St.trim());});}),O=parseInt(E,10)-1;O>=0&&O<t.length&&(e=t[O]);}x(`Using workspace: ${e.name} (${e.id})`);let o=await v(n.workspaceEndpoint,u,e.id,e.organizationId);N({accessToken:u,refreshToken:c.refreshToken,expiresAt:m,workspaceToken:o.token,workspaceTokenExpiresAt:new Date(o.expiresAt).getTime(),workspaceId:e.id,organizationId:e.organizationId,authMethod:"device_code"}),b(),I("Authentication successful");}catch(t){N({accessToken:u,refreshToken:c.refreshToken,expiresAt:m,authMethod:"device_code"}),b(),I("Authentication successful"),R(`Workspace token not obtained: ${t instanceof Error?t.message:String(t)}`),x(`Set workspace manually: ${F().productName} workspace set <id>`);}}async function Ne(n){let s=B(),r=(await import('readline')).createInterface({input:process.stdin,output:process.stdout}),a=await new Promise(A=>{r.question("Client ID: ",E=>A(E.trim()));}),p=await new Promise(A=>{r.question("Client Secret: ",E=>{r.close(),A(E.trim());});});if(!a||!p)throw new f("Client ID and secret cannot be empty");x("Authenticating app...");let c=await G(s.globalEndpoint,a,p),u=c.accessToken,m=Date.now()+c.expiresIn*1e3,t,e,o=n,$;if(o)try{let E=(await j(s.globalEndpoint,u)).find(O=>O.id===o);if(E){$=E.organizationId;let O=await v(s.workspaceEndpoint,u,o,$);t=O.token,e=new Date(O.expiresAt).getTime(),x(`Workspace token issued for: ${E.name}`);}else R(`Workspace ${o} not found \u2014 skipping workspace token`),o=void 0;}catch(A){R(`Workspace token failed: ${A instanceof Error?A.message:String(A)}`);}N({accessToken:u,refreshToken:"",expiresAt:m,workspaceToken:t,workspaceTokenExpiresAt:e,workspaceId:o,organizationId:$,authMethod:"client_credentials",clientId:a,clientSecret:p}),b(),I("App authentication successful");}var zt=`
+`;async function Kt(n,s){if(n.length===0)throw new S("No workspaces to choose from");if(s.preferredId){let p=n.find(u=>u.id===s.preferredId);if(!p)throw new S(`Workspace ${s.preferredId} is not one of your workspaces`);return {workspace:p,prompted:false}}let[i]=n;if(n.length===1||!s.interactive)return {workspace:i,prompted:false};let r=await s.ask(`
+Select workspace [1-${n.length}]: `),a=r===null?-1:parseInt(r.trim(),10)-1;return {workspace:(a>=0&&a<n.length?n[a]:void 0)??i,prompted:true}}async function Ht(n){let i=(await import('readline')).createInterface({input:process.stdin,output:process.stdout});return new Promise(r=>{let a=false;i.on("close",()=>{a||r(null);}),i.question(n,c=>{a=true,i.close(),r(c);});})}function Yt(n){let s=n.command("auth").description("Authentication commands");s.command("login").description(`Authenticate with ${R().productName}`).option("--client-credentials","Authenticate as an app with client ID and secret").option("--workspace-id <id>","Workspace to bind the session to").action(async i=>{try{i.clientCredentials?await Ne(i.workspaceId):await Oe(i.workspaceId);}catch(r){d(r);}}),s.command("logout").description("Revoke tokens and clear stored auth").action(async()=>{try{if(F()?.accessToken)try{await St(vt);}catch{v("Server-side logout failed, clearing local tokens");}Ct(),b(),I("Logged out successfully");}catch(i){d(i);}}),s.command("status").description("Show current auth state").option("-f, --format <format>","Output format (json, table)").action(i=>{let r=F(),a=B(),c=!!r?.accessToken,p=r?.accessToken?kt(r):false,u=r?.expiresAt?h(new Date(r.expiresAt).toISOString()):"-",$=r?.authMethod==="client_credentials"?"Client Credentials":"OAuth2 Device Code",t=r?.workspaceTokenExpiresAt?h(new Date(r.workspaceTokenExpiresAt).toISOString()):"-";m(i,{authenticated:c,method:$,expired:p,expiresAt:u,workspaceId:r?.workspaceId??"-",organizationId:r?.organizationId??"-",workspaceTokenExpiresAt:t,workspaceEndpoint:a.workspaceEndpoint,globalEndpoint:a.globalEndpoint},{headers:["Key","Value"],rows:[["Authenticated",String(c)],["Method",$],["Expired",String(p)],["Expires At",u],["Workspace ID",r?.workspaceId??"-"],["Organization ID",r?.organizationId??"-"],["Workspace Token Expires",t],["Workspace Endpoint",a.workspaceEndpoint],["Global Endpoint",a.globalEndpoint]]});}),s.command("token").description("Print access token to stdout").option("--workspace","Print workspace token instead").action(i=>{let r=F();if(i.workspace){if(!r?.workspaceToken)throw new S(`No workspace token. Set a workspace: ${R().productName} workspace set <id>`);process.stdout.write(r.workspaceToken);return}if(!r?.accessToken)throw new S(`Not authenticated. Run: ${R().productName} auth login`);process.stdout.write(r.accessToken);}),s.command("refresh").description("Force token refresh").action(async()=>{try{let i=F();if(!i?.refreshToken&&i?.authMethod!=="client_credentials")throw new S(`No refresh token available. Run: ${R().productName} auth login`);if(i?.authMethod==="client_credentials"&&i.clientId&&i.clientSecret){let c=B(),p=await M(c.globalEndpoint,i.clientId,i.clientSecret);O({...i,accessToken:p.accessToken,expiresAt:Date.now()+p.expiresIn*1e3}),b(),I("App token refreshed successfully"),i.workspaceId&&i.organizationId&&await Wt();return}let a=(await St(Rt,{token:i.refreshToken})).refreshToken;O({...i,accessToken:a.accessToken,refreshToken:a.refreshToken,expiresAt:Date.now()+a.expiresIn*1e3}),b(),I("Token refreshed successfully"),i.workspaceId&&i.organizationId&&await Wt();}catch(i){d(i);}});}async function Wt(){let n=F();if(!n?.accessToken||!n.workspaceId||!n.organizationId)return;let s=B();try{let i=await w(s.workspaceEndpoint,n.accessToken,n.workspaceId,n.organizationId);O({...n,workspaceToken:i.token,workspaceTokenExpiresAt:new Date(i.expiresAt).getTime()}),b(),I("Workspace token refreshed");}catch{v("Workspace token refresh failed \u2014 workspace operations may require re-login");}}async function Oe(n){let s=B(),{oidcIssuer:i,clientId:r}=_t(),a={...s,oidcIssuer:i,clientId:r};x("Starting device code authentication...");let c=await ot(a);console.log(""),console.log(`  Open: ${c.verificationUri}`),console.log(`  Code: ${c.userCode}`),console.log(""),await rt(c.verificationUriComplete??c.verificationUri)?x("Browser opened"):v("Could not open browser \u2014 open the URL manually"),x("Waiting for authorization...");let u=await it(c.deviceCode,c.interval,a),$=u.accessToken,t=Date.now()+u.expiresIn*1e3;O({accessToken:$,refreshToken:u.refreshToken,expiresAt:t,authMethod:"device_code"}),b(),x("Fetching workspaces...");try{let e=await j(s.globalEndpoint,$);if(e.length===0){I("Authentication successful (no workspaces found)");return}let o=!!process.stdin.isTTY;e.length>1&&o&&!n&&(console.log(`
+Available workspaces:`),e.forEach((E,G)=>console.log(`  ${G+1}. ${E.name} (${E.slug})`)));let{workspace:g}=await Kt(e,{preferredId:n,interactive:o,ask:Ht});e.length>1&&!o&&!n&&x(`${e.length} workspaces available; pass --workspace-id or run \`${R().productName} workspace set <id>\` to switch`),x(`Using workspace: ${g.name} (${g.id})`);let A=await w(s.workspaceEndpoint,$,g.id,g.organizationId);O({accessToken:$,refreshToken:u.refreshToken,expiresAt:t,workspaceToken:A.token,workspaceTokenExpiresAt:new Date(A.expiresAt).getTime(),workspaceId:g.id,organizationId:g.organizationId,authMethod:"device_code"}),b(),I("Authentication successful");}catch(e){O({accessToken:$,refreshToken:u.refreshToken,expiresAt:t,authMethod:"device_code"}),b(),I("Authentication successful"),v(`Workspace token not obtained: ${e instanceof Error?e.message:String(e)}`),x(`Set workspace manually: ${R().productName} workspace set <id>`);}}async function Ne(n){let s=B(),r=(await import('readline')).createInterface({input:process.stdin,output:process.stdout}),a=await new Promise(A=>{r.question("Client ID: ",E=>A(E.trim()));}),c=await new Promise(A=>{r.question("Client Secret: ",E=>{r.close(),A(E.trim());});});if(!a||!c)throw new S("Client ID and secret cannot be empty");x("Authenticating app...");let p=await M(s.globalEndpoint,a,c),u=p.accessToken,$=Date.now()+p.expiresIn*1e3,t,e,o=n,g;if(o)try{let E=(await j(s.globalEndpoint,u)).find(G=>G.id===o);if(E){g=E.organizationId;let G=await w(s.workspaceEndpoint,u,o,g);t=G.token,e=new Date(G.expiresAt).getTime(),x(`Workspace token issued for: ${E.name}`);}else v(`Workspace ${o} not found \u2014 skipping workspace token`),o=void 0;}catch(A){v(`Workspace token failed: ${A instanceof Error?A.message:String(A)}`);}O({accessToken:u,refreshToken:"",expiresAt:$,workspaceToken:t,workspaceTokenExpiresAt:e,workspaceId:o,organizationId:g,authMethod:"client_credentials",clientId:a,clientSecret:c}),b(),I("App authentication successful");}var zt=`
   query currentUser {
     currentUser {
       id email firstName lastName username phoneNumber name
@@ -33,26 +33,36 @@ Select workspace [1-${t.length}]: `,St=>{A.close(),ot(St.trim());});}),O=parseIn
 `,jt=`
   mutation updateCurrentUserProfile($input: UpdateUserInput!) {
     updateCurrentUserProfile(input: $input) {
-      id name firstName lastName username phoneNumber timezone language
+      id name firstName lastName username phoneNumber
     }
   }
-`,yt=`
+`,xt=`
   query authAuditLogs($pagination: PaginationInput) {
     authAuditLogs(pagination: $pagination) {
-      id action resource resourceType resourceId description
-      ipAddress userAgent metadata createdAt
+      auditLogs {
+        id action resource resourceType resourceId description
+        ipAddress userAgent metadata createdAt
+      }
+      totalCount
+      hasMore
     }
   }
 `,Xt=`
   query activeSessions($pagination: PaginationInput) {
     activeSessions(pagination: $pagination) {
-      id status ipAddress userAgent location lastActivityAt expiresAt createdAt isCurrent
+      sessions {
+        id status ipAddress userAgent location lastActivityAt expiresAt createdAt isCurrent
+      }
+      totalCount
+      hasMore
     }
   }
 `,Jt=`
   query currentUserMFAMethods($pagination: PaginationInput) {
     currentUserMFAMethods(pagination: $pagination) {
-      id method status createdAt updatedAt
+      methods { id method status createdAt updatedAt }
+      totalCount
+      hasMore
     }
   }
 `,Qt=`
@@ -72,13 +82,17 @@ Select workspace [1-${t.length}]: `,St=>{A.close(),ot(St.trim());});}),O=parseIn
 `,ee=`
   query myApiKeys($pagination: PaginationInput) {
     myApiKeys(pagination: $pagination) {
-      id name prefix appId appName scopes expiresAt lastUsedAt createdAt
+      apiKeys { id name prefix appId appName scopes expiresAt lastUsedAt createdAt }
+      totalCount
+      hasMore
     }
   }
 `,ne=`
   query appApiKeys($appId: ID!, $pagination: PaginationInput) {
     appApiKeys(appId: $appId, pagination: $pagination) {
-      id name prefix appId appName scopes expiresAt lastUsedAt createdAt
+      apiKeys { id name prefix appId appName scopes expiresAt lastUsedAt createdAt }
+      totalCount
+      hasMore
     }
   }
 `,oe=`
@@ -100,9 +114,13 @@ Select workspace [1-${t.length}]: `,St=>{A.close(),ot(St.trim());});}),O=parseIn
 `,se=`
   query currentUserDelegations($pagination: PaginationInput) {
     currentUserDelegations(pagination: $pagination) {
-      id appId userId grantedBy grantedAt expiresAt scopes workspaceIds
-      status revokedAt revokedBy
-      app { id name }
+      delegations {
+        id appId userId grantedBy grantedAt expiresAt scopes workspaceIds
+        status revokedAt revokedBy
+        app { id name }
+      }
+      totalCount
+      hasMore
     }
   }
 `,ae=`
@@ -118,8 +136,12 @@ Select workspace [1-${t.length}]: `,St=>{A.close(),ot(St.trim());});}),O=parseIn
 `,pe=`
   query currentUserApps($pagination: PaginationInput) {
     currentUserApps(pagination: $pagination) {
-      id clientId name description type actorType status ownerUserId
-      redirectUris scopes createdAt updatedAt
+      apps {
+        id clientId name description type actorType status ownerUserId
+        redirectUris scopes createdAt updatedAt
+      }
+      totalCount
+      hasMore
     }
   }
 `,de=`
@@ -180,4 +202,4 @@ Select workspace [1-${t.length}]: `,St=>{A.close(),ot(St.trim());});}),O=parseIn
       id email firstName lastName username role status
     }
   }
-`;function Te(n){let s=n.command("profile").description("Current user profile");s.command("show").description("Show current user").option("-f, --format <format>").action(async t=>{try{let e=await l(zt);g(t,e.currentUser);}catch(e){d(e);}}),s.command("update").description("Update current user profile").option("--first-name <s>").option("--last-name <s>").option("--name <s>").option("--username <s>").option("--phone <s>").option("--timezone <s>").option("--language <s>").option("-f, --format <format>").action(async t=>{try{let e={};if(t.firstName&&(e.firstName=t.firstName),t.lastName&&(e.lastName=t.lastName),t.name&&(e.name=t.name),t.username&&(e.username=t.username),t.phone&&(e.phoneNumber=t.phone),t.timezone&&(e.timezone=t.timezone),t.language&&(e.language=t.language),!Object.keys(e).length)throw new f("No updates specified");let o=await l(jt,{input:e});I("Profile updated"),g(t,o.updateCurrentUserProfile);}catch(e){d(e);}});let i=n.command("security").description("Account security overview");i.command("audit-log").description("Recent auth audit events for the current user").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let e=await l(yt,{pagination:{limit:t.limit,offset:0}});g(t,e.authAuditLogs,{headers:["When","Action","Resource","IP"],rows:e.authAuditLogs.map(o=>[h(o.createdAt),o.action,o.resource??"-",o.ipAddress??"-"])});}catch(e){d(e);}}),i.command("sessions").description("Active sessions for the current user").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let e=await l(Xt,{pagination:{limit:t.limit,offset:0}});g(t,e.activeSessions,{headers:["ID","Status","IP","LastActivity","Current"],rows:e.activeSessions.map(o=>[q(o.id,12),J(o.status),o.ipAddress??"-",h(o.lastActivityAt),String(!!o.isCurrent)])});}catch(e){d(e);}});let r=n.command("mfa").description("Multi-factor authentication");r.command("list").description("List MFA methods enrolled for the current user").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let e=await l(Jt,{pagination:{limit:t.limit,offset:0}});g(t,e.currentUserMFAMethods,{headers:["Method","Status","Created"],rows:e.currentUserMFAMethods.map(o=>[o.method,J(o.status),h(o.createdAt)])});}catch(e){d(e);}}),r.command("enroll").description("Begin MFA enrollment (TOTP/SMS/EMAIL)").requiredOption("--method <m>","TOTP|SMS|EMAIL").option("-f, --format <format>").action(async t=>{try{let e=await l(Qt,{method:t.method.toUpperCase()});t.format?g(t,e.setupMFA):(I("MFA enrollment started"),X(e.setupMFA),x("Save your backup codes; verify with `auth mfa verify --code <CODE>`."));}catch(e){d(e);}}),r.command("verify").description("Verify MFA enrollment code").requiredOption("--code <code>").action(async t=>{try{await l(Zt,{code:t.code}),I("MFA enabled");}catch(e){d(e);}}),r.command("disable").description("Disable MFA for the current user").action(async()=>{try{await l(te),I("MFA disabled");}catch(t){d(t);}});let a=n.command("api-keys").description("API key management");a.command("list").description("List your API keys").option("--app <id>","Restrict to keys for an app id").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let e=t.app?ne:ee,o=t.app?{appId:t.app,pagination:{limit:t.limit,offset:0}}:{pagination:{limit:t.limit,offset:0}},$=await l(e,o),A=$.myApiKeys??$.appApiKeys??[];g(t,A,{headers:["ID","Name","Prefix","App","Scopes","LastUsed"],rows:A.map(E=>[q(E.id,12),E.name??"-",E.prefix??"-",E.appName??"-",Array.isArray(E.scopes)?E.scopes.join(","):"-",h(E.lastUsedAt)])});}catch(e){d(e);}}),a.command("create").description("Generate a new API key").requiredOption("--name <name>").requiredOption("--app <appId>","Owning app id").option("--scope <scope>","Comma-separated scopes").option("--expires <iso>","ISO expiry").option("-f, --format <format>").action(async t=>{try{let e={name:t.name,appId:t.app,scope:t.scope?t.scope.split(","):void 0,expiresAt:t.expires},o=await l(oe,{input:e});I("API key generated. Store the secret \u2014 it is only shown once."),X(o.generateAPIKey);}catch(e){d(e);}}),a.command("revoke").description("Revoke an API key").argument("<keyId>").action(async t=>{try{await l(ie,{keyId:t}),I("API key revoked");}catch(e){d(e);}}),a.command("rotate").description("Rotate an API key (returns new secret)").argument("<keyId>").action(async t=>{try{let e=await l(re,{keyId:t});I("API key rotated"),X(e.rotateAPIKey);}catch(e){d(e);}}),n.command("audit-log").description("Auth audit log").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let e=await l(yt,{pagination:{limit:t.limit,offset:0}});g(t,e.authAuditLogs);}catch(e){d(e);}});let p=n.command("delegations").description("Delegation management");p.command("list").description("Delegations granted to the current user").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let e=await l(se,{pagination:{limit:t.limit,offset:0}});g(t,e.currentUserDelegations);}catch(e){d(e);}}),p.command("grant").description("Grant a delegation to an app").requiredOption("--app <appId>").requiredOption("--user <userId>","User to delegate as").option("--scope <s>","Comma-separated scopes").option("--workspace <ids>","Comma-separated workspace ids").option("--expires <iso>").option("-f, --format <format>").action(async t=>{try{let e={appId:t.app,userId:t.user,scopes:t.scope?t.scope.split(","):void 0,workspaceIds:t.workspace?t.workspace.split(","):void 0,expiresAt:t.expires},o=await l(ae,{input:e});I("Delegation granted"),g(t,o.grantDelegation);}catch(e){d(e);}}),p.command("revoke").description("Revoke a delegation").argument("<id>").option("--reason <text>").action(async(t,e)=>{try{await l(ce,{id:t,reason:e.reason}),I("Delegation revoked");}catch(o){d(o);}});let c=n.command("apps").description("OAuth/system app management");c.command("list").description("Apps owned by the current user").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let e=await l(pe,{pagination:{limit:t.limit,offset:0}});g(t,e.currentUserApps,{headers:["ID","ClientID","Name","Type","Status"],rows:e.currentUserApps.map(o=>[q(o.id,12),q(o.clientId,24),o.name??"-",o.type??"-",J(o.status)])});}catch(e){d(e);}}),c.command("get").description("Get an app by id").argument("<id>").option("-f, --format <format>").action(async(t,e)=>{try{let o=await l(de,{id:t});if(!o.app)throw new f(`App ${t} not found`);g(e,o.app);}catch(o){d(o);}}),c.command("create").description("Create an OAuth app").requiredOption("--name <s>").option("--description <s>").option("--type <t>","OAUTH|SYSTEM","OAUTH").option("--actor-type <t>","USER|APP|SERVICE","APP").option("--redirect <urls>","Comma-separated redirect URIs").option("--scopes <s>","Comma-separated scopes").option("-f, --format <format>").action(async t=>{try{let e={name:t.name,description:t.description,type:(t.type??"OAUTH").toUpperCase(),actorType:(t.actorType??"APP").toUpperCase(),redirectUris:t.redirect?t.redirect.split(","):void 0,scopes:t.scopes?t.scopes.split(","):void 0},o=await l(ue,{input:e});I("App created. Client secret only shown once."),X(o.createApp);}catch(e){d(e);}}),c.command("update").description("Update an app").argument("<id>").option("--name <s>").option("--description <s>").option("--redirect <urls>","Comma-separated redirect URIs").option("--scopes <s>","Comma-separated scopes").option("--status <s>").option("-f, --format <format>").action(async(t,e)=>{try{let o={};if(e.name&&(o.name=e.name),e.description!==void 0&&(o.description=e.description),e.redirect&&(o.redirectUris=e.redirect.split(",")),e.scopes&&(o.scopes=e.scopes.split(",")),e.status&&(o.status=e.status.toUpperCase()),!Object.keys(o).length)throw new f("No updates specified");let $=await l(le,{id:t,input:o});I("App updated"),g(e,$.updateApp);}catch(o){d(o);}}),c.command("deactivate").description("Deactivate an app").argument("<id>").action(async t=>{try{await l(Ie,{id:t}),I("App deactivated");}catch(e){d(e);}});let u=n.command("sso").description("SSO (SAML/OIDC) configuration");u.command("get").description("Get SSO config for a tenant").requiredOption("--tenant <id>").option("-f, --format <format>").action(async t=>{try{let e=await l(ge,{tenantId:t.tenant});g(t,e.getSSOConfig);}catch(e){d(e);}}),u.command("save").description("Save (upsert) SSO config for a tenant").requiredOption("--tenant <id>").requiredOption("--entity <s>","EntityID / Issuer").requiredOption("--sso-url <url>").option("--slo-url <url>").option("--certificate <pem>","X.509 certificate PEM").option("--enabled","Enable after save",false).option("-f, --format <format>").action(async t=>{try{let e={entityId:t.entity,ssoUrl:t.ssoUrl,sloUrl:t.sloUrl,certificate:t.certificate,enabled:!!t.enabled},o=await l(me,{tenantId:t.tenant,input:e});I("SSO config saved"),g(t,o.saveSSOConfig);}catch(e){d(e);}}),u.command("delete").description("Delete SSO config for a tenant").requiredOption("--tenant <id>").action(async t=>{try{await l($e,{tenantId:t.tenant}),I("SSO config deleted");}catch(e){d(e);}});let m=n.command("users").description("User admin (requires admin permissions)");m.command("list").description("List users (admin)").option("--email <s>").option("--username <s>").option("--role <s>").option("--status <s>").option("--search <s>").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let e={};t.email&&(e.email=t.email),t.username&&(e.username=t.username),t.role&&(e.role=t.role.toUpperCase()),t.status&&(e.status=t.status.toUpperCase()),t.search&&(e.search=t.search);let o=await l(Se,{filter:Object.keys(e).length?e:void 0,pagination:{limit:t.limit,offset:0}});g(t,o.users.users,{headers:["ID","Email","Username","Role","Status","Created"],rows:o.users.users.map($=>[q($.id,12),$.email,$.username??"-",$.role??"-",J($.status),h($.createdAt)])});}catch(e){d(e);}}),m.command("get").description("Get user by id (admin)").argument("<id>").option("-f, --format <format>").action(async(t,e)=>{try{let o=await l(Ee,{id:t});if(!o.user)throw new f(`User ${t} not found`);g(e,o.user);}catch(o){d(o);}}),m.command("update").description("Update a user (admin)").argument("<id>").option("--first-name <s>").option("--last-name <s>").option("--username <s>").option("--phone <s>").option("--role <s>").option("--status <s>").option("--email-verified <bool>").option("-f, --format <format>").action(async(t,e)=>{try{let o={};if(e.firstName&&(o.firstName=e.firstName),e.lastName&&(o.lastName=e.lastName),e.username&&(o.username=e.username),e.phone&&(o.phoneNumber=e.phone),e.role&&(o.role=e.role.toUpperCase()),e.status&&(o.status=e.status.toUpperCase()),e.emailVerified!==void 0&&(o.emailVerified=e.emailVerified==="true"),!Object.keys(o).length)throw new f("No updates specified");let $=await l(fe,{id:t,input:o});I("User updated"),g(e,$.updateUser);}catch(o){d(o);}});}var ve={id:"auth",version:"1.0.0",displayName:"Authentication",register(n,s){_t(s),Yt(n);let i=n.commands.find(r=>r.name()==="auth");if(!i)throw new k("auth command group missing after registerAuthCommands");Te(i);}},Bs=ve;module.exports=Bs;
+`;function Te(n){let s=n.command("profile").description("Current user profile");s.command("show").description("Show current user").option("-f, --format <format>").action(async t=>{try{let e=await l(zt);m(t,e.currentUser);}catch(e){d(e);}}),s.command("update").description("Update current user profile").option("--first-name <s>").option("--last-name <s>").option("--name <s>").option("--username <s>").option("--phone <s>").option("--timezone <s>").option("--language <s>").option("-f, --format <format>").action(async t=>{try{let e={};if(t.firstName&&(e.firstName=t.firstName),t.lastName&&(e.lastName=t.lastName),t.name&&(e.name=t.name),t.username&&(e.username=t.username),t.phone&&(e.phoneNumber=t.phone),t.timezone&&(e.timezone=t.timezone),t.language&&(e.language=t.language),!Object.keys(e).length)throw new S("No updates specified");let o=await l(jt,{input:e});I("Profile updated"),m(t,o.updateCurrentUserProfile);}catch(e){d(e);}});let i=n.command("security").description("Account security overview");i.command("audit-log").description("Recent auth audit events for the current user").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let e=await l(xt,{pagination:{limit:t.limit,offset:0}});m(t,e.authAuditLogs.auditLogs,{headers:["When","Action","Resource","IP"],rows:e.authAuditLogs.auditLogs.map(o=>[h(o.createdAt),o.action,o.resource??"-",o.ipAddress??"-"])});}catch(e){d(e);}}),i.command("sessions").description("Active sessions for the current user").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let e=await l(Xt,{pagination:{limit:t.limit,offset:0}});m(t,e.activeSessions.sessions,{headers:["ID","Status","IP","LastActivity","Current"],rows:e.activeSessions.sessions.map(o=>[q(o.id,12),J(o.status),o.ipAddress??"-",h(o.lastActivityAt),String(!!o.isCurrent)])});}catch(e){d(e);}});let r=n.command("mfa").description("Multi-factor authentication");r.command("list").description("List MFA methods enrolled for the current user").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let e=await l(Jt,{pagination:{limit:t.limit,offset:0}});m(t,e.currentUserMFAMethods.methods,{headers:["Method","Status","Created"],rows:e.currentUserMFAMethods.methods.map(o=>[o.method,J(o.status),h(o.createdAt)])});}catch(e){d(e);}}),r.command("enroll").description("Begin MFA enrollment (TOTP/SMS/EMAIL)").requiredOption("--method <m>","TOTP|SMS|EMAIL").option("-f, --format <format>").action(async t=>{try{let e=await l(Qt,{method:t.method.toUpperCase()});t.format?m(t,e.setupMFA):(I("MFA enrollment started"),X(e.setupMFA),x("Save your backup codes; verify with `auth mfa verify --code <CODE>`."));}catch(e){d(e);}}),r.command("verify").description("Verify MFA enrollment code").requiredOption("--code <code>").action(async t=>{try{await l(Zt,{code:t.code}),I("MFA enabled");}catch(e){d(e);}}),r.command("disable").description("Disable MFA for the current user").action(async()=>{try{await l(te),I("MFA disabled");}catch(t){d(t);}});let a=n.command("api-keys").description("API key management");a.command("list").description("List your API keys").option("--app <id>","Restrict to keys for an app id").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let e=t.app?ne:ee,o=t.app?{appId:t.app,pagination:{limit:t.limit,offset:0}}:{pagination:{limit:t.limit,offset:0}},g=await l(e,o),A=(g.myApiKeys??g.appApiKeys)?.apiKeys??[];m(t,A,{headers:["ID","Name","Prefix","App","Scopes","LastUsed"],rows:A.map(E=>[q(E.id,12),E.name??"-",E.prefix??"-",E.appName??"-",Array.isArray(E.scopes)?E.scopes.join(","):"-",h(E.lastUsedAt)])});}catch(e){d(e);}}),a.command("create").description("Generate a new API key").requiredOption("--name <name>").requiredOption("--app <appId>","Owning app id").option("--scope <scope>","Comma-separated scopes").option("--expires <iso>","ISO expiry").option("-f, --format <format>").action(async t=>{try{let e={name:t.name,appId:t.app,scope:t.scope?t.scope.split(","):void 0,expiresAt:t.expires},o=await l(oe,{input:e});I("API key generated. Store the secret \u2014 it is only shown once."),X(o.generateAPIKey);}catch(e){d(e);}}),a.command("revoke").description("Revoke an API key").argument("<keyId>").action(async t=>{try{await l(ie,{keyId:t}),I("API key revoked");}catch(e){d(e);}}),a.command("rotate").description("Rotate an API key (returns new secret)").argument("<keyId>").action(async t=>{try{let e=await l(re,{keyId:t});I("API key rotated"),X(e.rotateAPIKey);}catch(e){d(e);}}),n.command("audit-log").description("Auth audit log").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let e=await l(xt,{pagination:{limit:t.limit,offset:0}});m(t,e.authAuditLogs.auditLogs);}catch(e){d(e);}});let c=n.command("delegations").description("Delegation management");c.command("list").description("Delegations granted to the current user").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let e=await l(se,{pagination:{limit:t.limit,offset:0}});m(t,e.currentUserDelegations.delegations);}catch(e){d(e);}}),c.command("grant").description("Grant a delegation to an app").requiredOption("--app <appId>").requiredOption("--user <userId>","User to delegate as").option("--scope <s>","Comma-separated scopes").option("--workspace <ids>","Comma-separated workspace ids").option("--expires <iso>").option("-f, --format <format>").action(async t=>{try{let e={appId:t.app,userId:t.user,scopes:t.scope?t.scope.split(","):void 0,workspaceIds:t.workspace?t.workspace.split(","):void 0,expiresAt:t.expires},o=await l(ae,{input:e});I("Delegation granted"),m(t,o.grantDelegation);}catch(e){d(e);}}),c.command("revoke").description("Revoke a delegation").argument("<id>").option("--reason <text>").action(async(t,e)=>{try{await l(ce,{id:t,reason:e.reason}),I("Delegation revoked");}catch(o){d(o);}});let p=n.command("apps").description("OAuth/system app management");p.command("list").description("Apps owned by the current user").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let e=await l(pe,{pagination:{limit:t.limit,offset:0}});m(t,e.currentUserApps.apps,{headers:["ID","ClientID","Name","Type","Status"],rows:e.currentUserApps.apps.map(o=>[q(o.id,12),q(o.clientId,24),o.name??"-",o.type??"-",J(o.status)])});}catch(e){d(e);}}),p.command("get").description("Get an app by id").argument("<id>").option("-f, --format <format>").action(async(t,e)=>{try{let o=await l(de,{id:t});if(!o.app)throw new S(`App ${t} not found`);m(e,o.app);}catch(o){d(o);}}),p.command("create").description("Create an OAuth app").requiredOption("--name <s>").option("--description <s>").option("--type <t>","OAUTH|SYSTEM","OAUTH").option("--actor-type <t>","USER|APP|SERVICE","APP").option("--redirect <urls>","Comma-separated redirect URIs").option("--scopes <s>","Comma-separated scopes").option("-f, --format <format>").action(async t=>{try{let e={name:t.name,description:t.description,type:(t.type??"OAUTH").toUpperCase(),actorType:(t.actorType??"APP").toUpperCase(),redirectUris:t.redirect?t.redirect.split(","):void 0,scopes:t.scopes?t.scopes.split(","):void 0},o=await l(ue,{input:e});I("App created. Client secret only shown once."),X(o.createApp);}catch(e){d(e);}}),p.command("update").description("Update an app").argument("<id>").option("--name <s>").option("--description <s>").option("--redirect <urls>","Comma-separated redirect URIs").option("--scopes <s>","Comma-separated scopes").option("--status <s>").option("-f, --format <format>").action(async(t,e)=>{try{let o={};if(e.name&&(o.name=e.name),e.description!==void 0&&(o.description=e.description),e.redirect&&(o.redirectUris=e.redirect.split(",")),e.scopes&&(o.scopes=e.scopes.split(",")),e.status&&(o.status=e.status.toUpperCase()),!Object.keys(o).length)throw new S("No updates specified");let g=await l(le,{id:t,input:o});I("App updated"),m(e,g.updateApp);}catch(o){d(o);}}),p.command("deactivate").description("Deactivate an app").argument("<id>").action(async t=>{try{await l(Ie,{id:t}),I("App deactivated");}catch(e){d(e);}});let u=n.command("sso").description("SSO (SAML/OIDC) configuration");u.command("get").description("Get SSO config for a tenant").requiredOption("--tenant <id>").option("-f, --format <format>").action(async t=>{try{let e=await l(ge,{tenantId:t.tenant});m(t,e.getSSOConfig);}catch(e){d(e);}}),u.command("save").description("Save (upsert) SSO config for a tenant").requiredOption("--tenant <id>").requiredOption("--entity <s>","EntityID / Issuer").requiredOption("--sso-url <url>").option("--slo-url <url>").option("--certificate <pem>","X.509 certificate PEM").option("--enabled","Enable after save",false).option("-f, --format <format>").action(async t=>{try{let e={entityId:t.entity,ssoUrl:t.ssoUrl,sloUrl:t.sloUrl,certificate:t.certificate,enabled:!!t.enabled},o=await l(me,{tenantId:t.tenant,input:e});I("SSO config saved"),m(t,o.saveSSOConfig);}catch(e){d(e);}}),u.command("delete").description("Delete SSO config for a tenant").requiredOption("--tenant <id>").action(async t=>{try{await l($e,{tenantId:t.tenant}),I("SSO config deleted");}catch(e){d(e);}});let $=n.command("users").description("User admin (requires admin permissions)");$.command("list").description("List users (admin)").option("--email <s>").option("--username <s>").option("--role <s>").option("--status <s>").option("--search <s>").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let e={};t.email&&(e.email=t.email),t.username&&(e.username=t.username),t.role&&(e.role=t.role.toUpperCase()),t.status&&(e.status=t.status.toUpperCase()),t.search&&(e.search=t.search);let o=await l(Se,{filter:Object.keys(e).length?e:void 0,pagination:{limit:t.limit,offset:0}});m(t,o.users.users,{headers:["ID","Email","Username","Role","Status","Created"],rows:o.users.users.map(g=>[q(g.id,12),g.email,g.username??"-",g.role??"-",J(g.status),h(g.createdAt)])});}catch(e){d(e);}}),$.command("get").description("Get user by id (admin)").argument("<id>").option("-f, --format <format>").action(async(t,e)=>{try{let o=await l(Ee,{id:t});if(!o.user)throw new S(`User ${t} not found`);m(e,o.user);}catch(o){d(o);}}),$.command("update").description("Update a user (admin)").argument("<id>").option("--first-name <s>").option("--last-name <s>").option("--username <s>").option("--phone <s>").option("--role <s>").option("--status <s>").option("--email-verified <bool>").option("-f, --format <format>").action(async(t,e)=>{try{let o={};if(e.firstName&&(o.firstName=e.firstName),e.lastName&&(o.lastName=e.lastName),e.username&&(o.username=e.username),e.phone&&(o.phoneNumber=e.phone),e.role&&(o.role=e.role.toUpperCase()),e.status&&(o.status=e.status.toUpperCase()),e.emailVerified!==void 0&&(o.emailVerified=e.emailVerified==="true"),!Object.keys(o).length)throw new S("No updates specified");let g=await l(fe,{id:t,input:o});I("User updated"),m(e,g.updateUser);}catch(o){d(o);}});}var ve={id:"auth",version:"1.0.0",displayName:"Authentication",register(n,s){yt(s),Yt(n);let i=n.commands.find(r=>r.name()==="auth");if(!i)throw new k("auth command group missing after registerAuthCommands");Te(i);}},Ys=ve;module.exports=Ys;

package/dist/modules/auth/index.js

@@ -1,6 +1,6 @@
-import {Lc,Mc}from'../../chunk-REBBLQFS.js';import {a,s,g,t,e,l,v,f,i,w,C,o,h,u,c,p,n,m,k,B}from'../../chunk-SQSFZFQZ.js';import {q,o as o$1,f as f$1,h as h$1,g as g$1,d,i as i$1,e as e$1}from'../../chunk-UAFYTYK6.js';function Q(s$1){let u$1=s$1.command("auth").description("Authentication commands");u$1.command("login").description(`Authenticate with ${s().productName}`).option("--client-credentials","Authenticate as an app with client ID and secret").option("--workspace-id <id>","Workspace ID (for app auth)").action(async i=>{try{i.clientCredentials?await Pe(i.workspaceId):await Ce();}catch(r){g(r);}}),u$1.command("logout").description("Revoke tokens and clear stored auth").action(async()=>{try{if(t()?.accessToken)try{await e(Lc);}catch{l("Server-side logout failed, clearing local tokens");}v(),f(),i("Logged out successfully");}catch(i){g(i);}}),u$1.command("status").description("Show current auth state").option("-f, --format <format>","Output format (json, table)").action(i=>{let r=t(),p=w(),I=!!r?.accessToken,m=r?.accessToken?C(r):false,f=r?.expiresAt?o(new Date(r.expiresAt).toISOString()):"-",h$1=r?.authMethod==="client_credentials"?"Client Credentials":"OAuth2 Device Code",e=r?.workspaceTokenExpiresAt?o(new Date(r.workspaceTokenExpiresAt).toISOString()):"-";h(i,{authenticated:I,method:h$1,expired:m,expiresAt:f,workspaceId:r?.workspaceId??"-",organizationId:r?.organizationId??"-",workspaceTokenExpiresAt:e,workspaceEndpoint:p.workspaceEndpoint,globalEndpoint:p.globalEndpoint},{headers:["Key","Value"],rows:[["Authenticated",String(I)],["Method",h$1],["Expired",String(m)],["Expires At",f],["Workspace ID",r?.workspaceId??"-"],["Organization ID",r?.organizationId??"-"],["Workspace Token Expires",e],["Workspace Endpoint",p.workspaceEndpoint],["Global Endpoint",p.globalEndpoint]]});}),u$1.command("token").description("Print access token to stdout").option("--workspace","Print workspace token instead").action(i=>{let r=t();if(i.workspace){if(!r?.workspaceToken)throw new o$1(`No workspace token. Set a workspace: ${s().productName} workspace set <id>`);process.stdout.write(r.workspaceToken);return}if(!r?.accessToken)throw new o$1(`Not authenticated. Run: ${s().productName} auth login`);process.stdout.write(r.accessToken);}),u$1.command("refresh").description("Force token refresh").action(async()=>{try{let i$1=t();if(!i$1?.refreshToken&&i$1?.authMethod!=="client_credentials")throw new o$1(`No refresh token available. Run: ${s().productName} auth login`);if(i$1?.authMethod==="client_credentials"&&i$1.clientId&&i$1.clientSecret){let I=w(),m=await f$1(I.globalEndpoint,i$1.clientId,i$1.clientSecret);u({...i$1,accessToken:m.accessToken,expiresAt:Date.now()+m.expiresIn*1e3}),f(),i("App token refreshed successfully"),i$1.workspaceId&&i$1.organizationId&&await X();return}let p=(await e(Mc,{token:i$1.refreshToken})).refreshToken;u({...i$1,accessToken:p.accessToken,refreshToken:p.refreshToken,expiresAt:Date.now()+p.expiresIn*1e3}),f(),i("Token refreshed successfully"),i$1.workspaceId&&i$1.organizationId&&await X();}catch(i){g(i);}});}async function X(){let s=t();if(!s?.accessToken||!s.workspaceId||!s.organizationId)return;let u$1=w();try{let i$1=await g$1(u$1.workspaceEndpoint,s.accessToken,s.workspaceId,s.organizationId);u({...s,workspaceToken:i$1.token,workspaceTokenExpiresAt:new Date(i$1.expiresAt).getTime()}),f(),i("Workspace token refreshed");}catch{l("Workspace token refresh failed \u2014 workspace operations may require re-login");}}async function Ce(){let s$1=w(),{oidcIssuer:u$1,clientId:i$2}=B(),r={...s$1,oidcIssuer:u$1,clientId:i$2};k("Starting device code authentication...");let p=await d(r);console.log(""),console.log(`  Open: ${p.verificationUri}`),console.log(`  Code: ${p.userCode}`),console.log(""),await i$1(p.verificationUriComplete??p.verificationUri)?k("Browser opened"):l("Could not open browser \u2014 open the URL manually"),k("Waiting for authorization...");let m=await e$1(p.deviceCode,p.interval,r),f$1=m.accessToken,h=Date.now()+m.expiresIn*1e3;k("Fetching workspaces...");try{let e=await h$1(s$1.globalEndpoint,f$1);if(e.length===0){u({accessToken:f$1,refreshToken:m.refreshToken,expiresAt:h,authMethod:"device_code"}),f(),i("Authentication successful (no workspaces found)");return}let t=e[0];if(e.length>1){console.log(`
-Available workspaces:`),e.forEach(($,N)=>console.log(`  ${N+1}. ${$.name} (${$.slug})`));let A=(await import('readline')).createInterface({input:process.stdin,output:process.stdout}),g=await new Promise($=>{A.question(`
-Select workspace [1-${e.length}]: `,N=>{A.close(),$(N.trim());});}),S=parseInt(g,10)-1;S>=0&&S<e.length&&(t=e[S]);}k(`Using workspace: ${t.name} (${t.id})`);let n=await g$1(s$1.workspaceEndpoint,f$1,t.id,t.organizationId);u({accessToken:f$1,refreshToken:m.refreshToken,expiresAt:h,workspaceToken:n.token,workspaceTokenExpiresAt:new Date(n.expiresAt).getTime(),workspaceId:t.id,organizationId:t.organizationId,authMethod:"device_code"}),f(),i("Authentication successful");}catch(e){u({accessToken:f$1,refreshToken:m.refreshToken,expiresAt:h,authMethod:"device_code"}),f(),i("Authentication successful"),l(`Workspace token not obtained: ${e instanceof Error?e.message:String(e)}`),k(`Set workspace manually: ${s().productName} workspace set <id>`);}}async function Pe(s){let u$1=w(),r=(await import('readline')).createInterface({input:process.stdin,output:process.stdout}),p=await new Promise(A=>{r.question("Client ID: ",g=>A(g.trim()));}),I=await new Promise(A=>{r.question("Client Secret: ",g=>{r.close(),A(g.trim());});});if(!p||!I)throw new o$1("Client ID and secret cannot be empty");k("Authenticating app...");let m=await f$1(u$1.globalEndpoint,p,I),f$2=m.accessToken,h=Date.now()+m.expiresIn*1e3,e,t,n=s,l$1;if(n)try{let g=(await h$1(u$1.globalEndpoint,f$2)).find(S=>S.id===n);if(g){l$1=g.organizationId;let S=await g$1(u$1.workspaceEndpoint,f$2,n,l$1);e=S.token,t=new Date(S.expiresAt).getTime(),k(`Workspace token issued for: ${g.name}`);}else l(`Workspace ${n} not found \u2014 skipping workspace token`),n=void 0;}catch(A){l(`Workspace token failed: ${A instanceof Error?A.message:String(A)}`);}u({accessToken:f$2,refreshToken:"",expiresAt:h,workspaceToken:e,workspaceTokenExpiresAt:t,workspaceId:n,organizationId:l$1,authMethod:"client_credentials",clientId:p,clientSecret:I}),f(),i("App authentication successful");}var Z=`
+import {Lc,Mc}from'../../chunk-REBBLQFS.js';import {a,s,g,t,e,l,v,f,i,w,C,o,h,u,c,p,n,m,k,B}from'../../chunk-SQSFZFQZ.js';import {q,o as o$1,f as f$1,h as h$1,g as g$1,d,i as i$1,e as e$1}from'../../chunk-UAFYTYK6.js';async function j(s,p){if(s.length===0)throw new o$1("No workspaces to choose from");if(p.preferredId){let g=s.find(f=>f.id===p.preferredId);if(!g)throw new o$1(`Workspace ${p.preferredId} is not one of your workspaces`);return {workspace:g,prompted:false}}let[i]=s;if(s.length===1||!p.interactive)return {workspace:i,prompted:false};let o=await p.ask(`
+Select workspace [1-${s.length}]: `),c=o===null?-1:parseInt(o.trim(),10)-1;return {workspace:(c>=0&&c<s.length?s[c]:void 0)??i,prompted:true}}async function J(s){let i=(await import('readline')).createInterface({input:process.stdin,output:process.stdout});return new Promise(o=>{let c=false;i.on("close",()=>{c||o(null);}),i.question(s,u=>{c=true,i.close(),o(u);});})}function Q(s$1){let p=s$1.command("auth").description("Authentication commands");p.command("login").description(`Authenticate with ${s().productName}`).option("--client-credentials","Authenticate as an app with client ID and secret").option("--workspace-id <id>","Workspace to bind the session to").action(async i=>{try{i.clientCredentials?await Pe(i.workspaceId):await Ce(i.workspaceId);}catch(o){g(o);}}),p.command("logout").description("Revoke tokens and clear stored auth").action(async()=>{try{if(t()?.accessToken)try{await e(Lc);}catch{l("Server-side logout failed, clearing local tokens");}v(),f(),i("Logged out successfully");}catch(i){g(i);}}),p.command("status").description("Show current auth state").option("-f, --format <format>","Output format (json, table)").action(i=>{let o$1=t(),c=w(),u=!!o$1?.accessToken,g=o$1?.accessToken?C(o$1):false,f=o$1?.expiresAt?o(new Date(o$1.expiresAt).toISOString()):"-",h$1=o$1?.authMethod==="client_credentials"?"Client Credentials":"OAuth2 Device Code",e=o$1?.workspaceTokenExpiresAt?o(new Date(o$1.workspaceTokenExpiresAt).toISOString()):"-";h(i,{authenticated:u,method:h$1,expired:g,expiresAt:f,workspaceId:o$1?.workspaceId??"-",organizationId:o$1?.organizationId??"-",workspaceTokenExpiresAt:e,workspaceEndpoint:c.workspaceEndpoint,globalEndpoint:c.globalEndpoint},{headers:["Key","Value"],rows:[["Authenticated",String(u)],["Method",h$1],["Expired",String(g)],["Expires At",f],["Workspace ID",o$1?.workspaceId??"-"],["Organization ID",o$1?.organizationId??"-"],["Workspace Token Expires",e],["Workspace Endpoint",c.workspaceEndpoint],["Global Endpoint",c.globalEndpoint]]});}),p.command("token").description("Print access token to stdout").option("--workspace","Print workspace token instead").action(i=>{let o=t();if(i.workspace){if(!o?.workspaceToken)throw new o$1(`No workspace token. Set a workspace: ${s().productName} workspace set <id>`);process.stdout.write(o.workspaceToken);return}if(!o?.accessToken)throw new o$1(`Not authenticated. Run: ${s().productName} auth login`);process.stdout.write(o.accessToken);}),p.command("refresh").description("Force token refresh").action(async()=>{try{let i$1=t();if(!i$1?.refreshToken&&i$1?.authMethod!=="client_credentials")throw new o$1(`No refresh token available. Run: ${s().productName} auth login`);if(i$1?.authMethod==="client_credentials"&&i$1.clientId&&i$1.clientSecret){let u$1=w(),g=await f$1(u$1.globalEndpoint,i$1.clientId,i$1.clientSecret);u({...i$1,accessToken:g.accessToken,expiresAt:Date.now()+g.expiresIn*1e3}),f(),i("App token refreshed successfully"),i$1.workspaceId&&i$1.organizationId&&await X();return}let c=(await e(Mc,{token:i$1.refreshToken})).refreshToken;u({...i$1,accessToken:c.accessToken,refreshToken:c.refreshToken,expiresAt:Date.now()+c.expiresIn*1e3}),f(),i("Token refreshed successfully"),i$1.workspaceId&&i$1.organizationId&&await X();}catch(i){g(i);}});}async function X(){let s=t();if(!s?.accessToken||!s.workspaceId||!s.organizationId)return;let p=w();try{let i$1=await g$1(p.workspaceEndpoint,s.accessToken,s.workspaceId,s.organizationId);u({...s,workspaceToken:i$1.token,workspaceTokenExpiresAt:new Date(i$1.expiresAt).getTime()}),f(),i("Workspace token refreshed");}catch{l("Workspace token refresh failed \u2014 workspace operations may require re-login");}}async function Ce(s$1){let p=w(),{oidcIssuer:i$2,clientId:o}=B(),c={...p,oidcIssuer:i$2,clientId:o};k("Starting device code authentication...");let u$1=await d(c);console.log(""),console.log(`  Open: ${u$1.verificationUri}`),console.log(`  Code: ${u$1.userCode}`),console.log(""),await i$1(u$1.verificationUriComplete??u$1.verificationUri)?k("Browser opened"):l("Could not open browser \u2014 open the URL manually"),k("Waiting for authorization...");let f$1=await e$1(u$1.deviceCode,u$1.interval,c),h=f$1.accessToken,e=Date.now()+f$1.expiresIn*1e3;u({accessToken:h,refreshToken:f$1.refreshToken,expiresAt:e,authMethod:"device_code"}),f(),k("Fetching workspaces...");try{let t=await h$1(p.globalEndpoint,h);if(t.length===0){i("Authentication successful (no workspaces found)");return}let n=!!process.stdin.isTTY;t.length>1&&n&&!s$1&&(console.log(`
+Available workspaces:`),t.forEach((A,C)=>console.log(`  ${C+1}. ${A.name} (${A.slug})`)));let{workspace:m}=await j(t,{preferredId:s$1,interactive:n,ask:J});t.length>1&&!n&&!s$1&&k(`${t.length} workspaces available; pass --workspace-id or run \`${s().productName} workspace set <id>\` to switch`),k(`Using workspace: ${m.name} (${m.id})`);let I=await g$1(p.workspaceEndpoint,h,m.id,m.organizationId);u({accessToken:h,refreshToken:f$1.refreshToken,expiresAt:e,workspaceToken:I.token,workspaceTokenExpiresAt:new Date(I.expiresAt).getTime(),workspaceId:m.id,organizationId:m.organizationId,authMethod:"device_code"}),f(),i("Authentication successful");}catch(t){u({accessToken:h,refreshToken:f$1.refreshToken,expiresAt:e,authMethod:"device_code"}),f(),i("Authentication successful"),l(`Workspace token not obtained: ${t instanceof Error?t.message:String(t)}`),k(`Set workspace manually: ${s().productName} workspace set <id>`);}}async function Pe(s){let p=w(),o=(await import('readline')).createInterface({input:process.stdin,output:process.stdout}),c=await new Promise(I=>{o.question("Client ID: ",A=>I(A.trim()));}),u$1=await new Promise(I=>{o.question("Client Secret: ",A=>{o.close(),I(A.trim());});});if(!c||!u$1)throw new o$1("Client ID and secret cannot be empty");k("Authenticating app...");let g=await f$1(p.globalEndpoint,c,u$1),f$2=g.accessToken,h=Date.now()+g.expiresIn*1e3,e,t,n=s,m;if(n)try{let A=(await h$1(p.globalEndpoint,f$2)).find(C=>C.id===n);if(A){m=A.organizationId;let C=await g$1(p.workspaceEndpoint,f$2,n,m);e=C.token,t=new Date(C.expiresAt).getTime(),k(`Workspace token issued for: ${A.name}`);}else l(`Workspace ${n} not found \u2014 skipping workspace token`),n=void 0;}catch(I){l(`Workspace token failed: ${I instanceof Error?I.message:String(I)}`);}u({accessToken:f$2,refreshToken:"",expiresAt:h,workspaceToken:e,workspaceTokenExpiresAt:t,workspaceId:n,organizationId:m,authMethod:"client_credentials",clientId:c,clientSecret:u$1}),f(),i("App authentication successful");}var Z=`
   query currentUser {
     currentUser {
       id email firstName lastName username phoneNumber name
@@ -10,26 +10,36 @@ Select workspace [1-${e.length}]: `,N=>{A.close(),$(N.trim());});}),S=parseInt(g
 `,ee=`
   mutation updateCurrentUserProfile($input: UpdateUserInput!) {
     updateCurrentUserProfile(input: $input) {
-      id name firstName lastName username phoneNumber timezone language
+      id name firstName lastName username phoneNumber
     }
   }
-`,L=`
+`,F=`
   query authAuditLogs($pagination: PaginationInput) {
     authAuditLogs(pagination: $pagination) {
-      id action resource resourceType resourceId description
-      ipAddress userAgent metadata createdAt
+      auditLogs {
+        id action resource resourceType resourceId description
+        ipAddress userAgent metadata createdAt
+      }
+      totalCount
+      hasMore
     }
   }
 `,te=`
   query activeSessions($pagination: PaginationInput) {
     activeSessions(pagination: $pagination) {
-      id status ipAddress userAgent location lastActivityAt expiresAt createdAt isCurrent
+      sessions {
+        id status ipAddress userAgent location lastActivityAt expiresAt createdAt isCurrent
+      }
+      totalCount
+      hasMore
     }
   }
 `,ne=`
   query currentUserMFAMethods($pagination: PaginationInput) {
     currentUserMFAMethods(pagination: $pagination) {
-      id method status createdAt updatedAt
+      methods { id method status createdAt updatedAt }
+      totalCount
+      hasMore
     }
   }
 `,ie=`
@@ -38,33 +48,37 @@ Select workspace [1-${e.length}]: `,N=>{A.close(),$(N.trim());});}),S=parseInt(g
       method backupCodes qrCode secret
     }
   }
-`;var re=`
+`;var oe=`
   mutation enableMFA($code: String!) {
     enableMFA(code: $code)
   }
-`,oe=`
+`,se=`
   mutation disableMFA {
     disableMFA
   }
-`,se=`
+`,re=`
   query myApiKeys($pagination: PaginationInput) {
     myApiKeys(pagination: $pagination) {
-      id name prefix appId appName scopes expiresAt lastUsedAt createdAt
+      apiKeys { id name prefix appId appName scopes expiresAt lastUsedAt createdAt }
+      totalCount
+      hasMore
     }
   }
 `,ae=`
   query appApiKeys($appId: ID!, $pagination: PaginationInput) {
     appApiKeys(appId: $appId, pagination: $pagination) {
-      id name prefix appId appName scopes expiresAt lastUsedAt createdAt
+      apiKeys { id name prefix appId appName scopes expiresAt lastUsedAt createdAt }
+      totalCount
+      hasMore
     }
   }
-`,ce=`
+`,pe=`
   mutation generateAPIKey($input: GenerateAPIKeyInput!) {
     generateAPIKey(input: $input) {
       keyId apiKey apiSecret
     }
   }
-`;var pe=`
+`;var ce=`
   mutation revokeAPIKey($keyId: String!) {
     revokeAPIKey(keyId: $keyId)
   }
@@ -77,9 +91,13 @@ Select workspace [1-${e.length}]: `,N=>{A.close(),$(N.trim());});}),S=parseInt(g
 `,me=`
   query currentUserDelegations($pagination: PaginationInput) {
     currentUserDelegations(pagination: $pagination) {
-      id appId userId grantedBy grantedAt expiresAt scopes workspaceIds
-      status revokedAt revokedBy
-      app { id name }
+      delegations {
+        id appId userId grantedBy grantedAt expiresAt scopes workspaceIds
+        status revokedAt revokedBy
+        app { id name }
+      }
+      totalCount
+      hasMore
     }
   }
 `,ue=`
@@ -95,8 +113,12 @@ Select workspace [1-${e.length}]: `,N=>{A.close(),$(N.trim());});}),S=parseInt(g
 `,ge=`
   query currentUserApps($pagination: PaginationInput) {
     currentUserApps(pagination: $pagination) {
-      id clientId name description type actorType status ownerUserId
-      redirectUris scopes createdAt updatedAt
+      apps {
+        id clientId name description type actorType status ownerUserId
+        redirectUris scopes createdAt updatedAt
+      }
+      totalCount
+      hasMore
     }
   }
 `,fe=`
@@ -112,17 +134,17 @@ Select workspace [1-${e.length}]: `,N=>{A.close(),$(N.trim());});}),S=parseInt(g
       clientSecret
     }
   }
-`,Ie=`
+`,he=`
   mutation updateApp($id: ID!, $input: UpdateAppInput!) {
     updateApp(id: $id, input: $input) {
       id name description redirectUris scopes status
     }
   }
-`,he=`
+`,Ie=`
   mutation deactivateApp($id: ID!) {
     deactivateApp(id: $id)
   }
-`,ye=`
+`,ke=`
   query getSSOConfig($tenantId: String!) {
     getSSOConfig(tenantId: $tenantId) {
       id identifier tenantId entityId ssoUrl sloUrl certificate enabled metadata
@@ -134,7 +156,7 @@ Select workspace [1-${e.length}]: `,N=>{A.close(),$(N.trim());});}),S=parseInt(g
       id identifier entityId ssoUrl sloUrl certificate enabled
     }
   }
-`,ke=`
+`,ye=`
   mutation deleteSSOConfig($tenantId: String!) {
     deleteSSOConfig(tenantId: $tenantId)
   }
@@ -157,4 +179,4 @@ Select workspace [1-${e.length}]: `,N=>{A.close(),$(N.trim());});}),S=parseInt(g
       id email firstName lastName username role status
     }
   }
-`;function Ue(s){let u=s.command("profile").description("Current user profile");u.command("show").description("Show current user").option("-f, --format <format>").action(async e=>{try{let t=await c(Z);h(e,t.currentUser);}catch(t){g(t);}}),u.command("update").description("Update current user profile").option("--first-name <s>").option("--last-name <s>").option("--name <s>").option("--username <s>").option("--phone <s>").option("--timezone <s>").option("--language <s>").option("-f, --format <format>").action(async e=>{try{let t={};if(e.firstName&&(t.firstName=e.firstName),e.lastName&&(t.lastName=e.lastName),e.name&&(t.name=e.name),e.username&&(t.username=e.username),e.phone&&(t.phoneNumber=e.phone),e.timezone&&(t.timezone=e.timezone),e.language&&(t.language=e.language),!Object.keys(t).length)throw new o$1("No updates specified");let n=await c(ee,{input:t});i("Profile updated"),h(e,n.updateCurrentUserProfile);}catch(t){g(t);}});let i$1=s.command("security").description("Account security overview");i$1.command("audit-log").description("Recent auth audit events for the current user").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await c(L,{pagination:{limit:e.limit,offset:0}});h(e,t.authAuditLogs,{headers:["When","Action","Resource","IP"],rows:t.authAuditLogs.map(n=>[o(n.createdAt),n.action,n.resource??"-",n.ipAddress??"-"])});}catch(t){g(t);}}),i$1.command("sessions").description("Active sessions for the current user").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await c(te,{pagination:{limit:e.limit,offset:0}});h(e,t.activeSessions,{headers:["ID","Status","IP","LastActivity","Current"],rows:t.activeSessions.map(n$1=>[p(n$1.id,12),n(n$1.status),n$1.ipAddress??"-",o(n$1.lastActivityAt),String(!!n$1.isCurrent)])});}catch(t){g(t);}});let r=s.command("mfa").description("Multi-factor authentication");r.command("list").description("List MFA methods enrolled for the current user").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await c(ne,{pagination:{limit:e.limit,offset:0}});h(e,t.currentUserMFAMethods,{headers:["Method","Status","Created"],rows:t.currentUserMFAMethods.map(n$1=>[n$1.method,n(n$1.status),o(n$1.createdAt)])});}catch(t){g(t);}}),r.command("enroll").description("Begin MFA enrollment (TOTP/SMS/EMAIL)").requiredOption("--method <m>","TOTP|SMS|EMAIL").option("-f, --format <format>").action(async e=>{try{let t=await c(ie,{method:e.method.toUpperCase()});e.format?h(e,t.setupMFA):(i("MFA enrollment started"),m(t.setupMFA),k("Save your backup codes; verify with `auth mfa verify --code <CODE>`."));}catch(t){g(t);}}),r.command("verify").description("Verify MFA enrollment code").requiredOption("--code <code>").action(async e=>{try{await c(re,{code:e.code}),i("MFA enabled");}catch(t){g(t);}}),r.command("disable").description("Disable MFA for the current user").action(async()=>{try{await c(oe),i("MFA disabled");}catch(e){g(e);}});let p$1=s.command("api-keys").description("API key management");p$1.command("list").description("List your API keys").option("--app <id>","Restrict to keys for an app id").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=e.app?ae:se,n=e.app?{appId:e.app,pagination:{limit:e.limit,offset:0}}:{pagination:{limit:e.limit,offset:0}},l=await c(t,n),A=l.myApiKeys??l.appApiKeys??[];h(e,A,{headers:["ID","Name","Prefix","App","Scopes","LastUsed"],rows:A.map(g=>[p(g.id,12),g.name??"-",g.prefix??"-",g.appName??"-",Array.isArray(g.scopes)?g.scopes.join(","):"-",o(g.lastUsedAt)])});}catch(t){g(t);}}),p$1.command("create").description("Generate a new API key").requiredOption("--name <name>").requiredOption("--app <appId>","Owning app id").option("--scope <scope>","Comma-separated scopes").option("--expires <iso>","ISO expiry").option("-f, --format <format>").action(async e=>{try{let t={name:e.name,appId:e.app,scope:e.scope?e.scope.split(","):void 0,expiresAt:e.expires},n=await c(ce,{input:t});i("API key generated. Store the secret \u2014 it is only shown once."),m(n.generateAPIKey);}catch(t){g(t);}}),p$1.command("revoke").description("Revoke an API key").argument("<keyId>").action(async e=>{try{await c(pe,{keyId:e}),i("API key revoked");}catch(t){g(t);}}),p$1.command("rotate").description("Rotate an API key (returns new secret)").argument("<keyId>").action(async e=>{try{let t=await c(de,{keyId:e});i("API key rotated"),m(t.rotateAPIKey);}catch(t){g(t);}}),s.command("audit-log").description("Auth audit log").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await c(L,{pagination:{limit:e.limit,offset:0}});h(e,t.authAuditLogs);}catch(t){g(t);}});let I=s.command("delegations").description("Delegation management");I.command("list").description("Delegations granted to the current user").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await c(me,{pagination:{limit:e.limit,offset:0}});h(e,t.currentUserDelegations);}catch(t){g(t);}}),I.command("grant").description("Grant a delegation to an app").requiredOption("--app <appId>").requiredOption("--user <userId>","User to delegate as").option("--scope <s>","Comma-separated scopes").option("--workspace <ids>","Comma-separated workspace ids").option("--expires <iso>").option("-f, --format <format>").action(async e=>{try{let t={appId:e.app,userId:e.user,scopes:e.scope?e.scope.split(","):void 0,workspaceIds:e.workspace?e.workspace.split(","):void 0,expiresAt:e.expires},n=await c(ue,{input:t});i("Delegation granted"),h(e,n.grantDelegation);}catch(t){g(t);}}),I.command("revoke").description("Revoke a delegation").argument("<id>").option("--reason <text>").action(async(e,t)=>{try{await c(le,{id:e,reason:t.reason}),i("Delegation revoked");}catch(n){g(n);}});let m$1=s.command("apps").description("OAuth/system app management");m$1.command("list").description("Apps owned by the current user").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await c(ge,{pagination:{limit:e.limit,offset:0}});h(e,t.currentUserApps,{headers:["ID","ClientID","Name","Type","Status"],rows:t.currentUserApps.map(n$1=>[p(n$1.id,12),p(n$1.clientId,24),n$1.name??"-",n$1.type??"-",n(n$1.status)])});}catch(t){g(t);}}),m$1.command("get").description("Get an app by id").argument("<id>").option("-f, --format <format>").action(async(e,t)=>{try{let n=await c(fe,{id:e});if(!n.app)throw new o$1(`App ${e} not found`);h(t,n.app);}catch(n){g(n);}}),m$1.command("create").description("Create an OAuth app").requiredOption("--name <s>").option("--description <s>").option("--type <t>","OAUTH|SYSTEM","OAUTH").option("--actor-type <t>","USER|APP|SERVICE","APP").option("--redirect <urls>","Comma-separated redirect URIs").option("--scopes <s>","Comma-separated scopes").option("-f, --format <format>").action(async e=>{try{let t={name:e.name,description:e.description,type:(e.type??"OAUTH").toUpperCase(),actorType:(e.actorType??"APP").toUpperCase(),redirectUris:e.redirect?e.redirect.split(","):void 0,scopes:e.scopes?e.scopes.split(","):void 0},n=await c(Ae,{input:t});i("App created. Client secret only shown once."),m(n.createApp);}catch(t){g(t);}}),m$1.command("update").description("Update an app").argument("<id>").option("--name <s>").option("--description <s>").option("--redirect <urls>","Comma-separated redirect URIs").option("--scopes <s>","Comma-separated scopes").option("--status <s>").option("-f, --format <format>").action(async(e,t)=>{try{let n={};if(t.name&&(n.name=t.name),t.description!==void 0&&(n.description=t.description),t.redirect&&(n.redirectUris=t.redirect.split(",")),t.scopes&&(n.scopes=t.scopes.split(",")),t.status&&(n.status=t.status.toUpperCase()),!Object.keys(n).length)throw new o$1("No updates specified");let l=await c(Ie,{id:e,input:n});i("App updated"),h(t,l.updateApp);}catch(n){g(n);}}),m$1.command("deactivate").description("Deactivate an app").argument("<id>").action(async e=>{try{await c(he,{id:e}),i("App deactivated");}catch(t){g(t);}});let f=s.command("sso").description("SSO (SAML/OIDC) configuration");f.command("get").description("Get SSO config for a tenant").requiredOption("--tenant <id>").option("-f, --format <format>").action(async e=>{try{let t=await c(ye,{tenantId:e.tenant});h(e,t.getSSOConfig);}catch(t){g(t);}}),f.command("save").description("Save (upsert) SSO config for a tenant").requiredOption("--tenant <id>").requiredOption("--entity <s>","EntityID / Issuer").requiredOption("--sso-url <url>").option("--slo-url <url>").option("--certificate <pem>","X.509 certificate PEM").option("--enabled","Enable after save",false).option("-f, --format <format>").action(async e=>{try{let t={entityId:e.entity,ssoUrl:e.ssoUrl,sloUrl:e.sloUrl,certificate:e.certificate,enabled:!!e.enabled},n=await c(we,{tenantId:e.tenant,input:t});i("SSO config saved"),h(e,n.saveSSOConfig);}catch(t){g(t);}}),f.command("delete").description("Delete SSO config for a tenant").requiredOption("--tenant <id>").action(async e=>{try{await c(ke,{tenantId:e.tenant}),i("SSO config deleted");}catch(t){g(t);}});let h$1=s.command("users").description("User admin (requires admin permissions)");h$1.command("list").description("List users (admin)").option("--email <s>").option("--username <s>").option("--role <s>").option("--status <s>").option("--search <s>").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t={};e.email&&(t.email=e.email),e.username&&(t.username=e.username),e.role&&(t.role=e.role.toUpperCase()),e.status&&(t.status=e.status.toUpperCase()),e.search&&(t.search=e.search);let n$1=await c(Ee,{filter:Object.keys(t).length?t:void 0,pagination:{limit:e.limit,offset:0}});h(e,n$1.users.users,{headers:["ID","Email","Username","Role","Status","Created"],rows:n$1.users.users.map(l=>[p(l.id,12),l.email,l.username??"-",l.role??"-",n(l.status),o(l.createdAt)])});}catch(t){g(t);}}),h$1.command("get").description("Get user by id (admin)").argument("<id>").option("-f, --format <format>").action(async(e,t)=>{try{let n=await c(Se,{id:e});if(!n.user)throw new o$1(`User ${e} not found`);h(t,n.user);}catch(n){g(n);}}),h$1.command("update").description("Update a user (admin)").argument("<id>").option("--first-name <s>").option("--last-name <s>").option("--username <s>").option("--phone <s>").option("--role <s>").option("--status <s>").option("--email-verified <bool>").option("-f, --format <format>").action(async(e,t)=>{try{let n={};if(t.firstName&&(n.firstName=t.firstName),t.lastName&&(n.lastName=t.lastName),t.username&&(n.username=t.username),t.phone&&(n.phoneNumber=t.phone),t.role&&(n.role=t.role.toUpperCase()),t.status&&(n.status=t.status.toUpperCase()),t.emailVerified!==void 0&&(n.emailVerified=t.emailVerified==="true"),!Object.keys(n).length)throw new o$1("No updates specified");let l=await c(Te,{id:e,input:n});i("User updated"),h(t,l.updateUser);}catch(n){g(n);}});}var _e={id:"auth",version:"1.0.0",displayName:"Authentication",register(s,u){a(u),Q(s);let i=s.commands.find(r=>r.name()==="auth");if(!i)throw new q("auth command group missing after registerAuthCommands");Ue(i);}},He=_e;export{He as default};
+`;function Ue(s){let p$1=s.command("profile").description("Current user profile");p$1.command("show").description("Show current user").option("-f, --format <format>").action(async e=>{try{let t=await c(Z);h(e,t.currentUser);}catch(t){g(t);}}),p$1.command("update").description("Update current user profile").option("--first-name <s>").option("--last-name <s>").option("--name <s>").option("--username <s>").option("--phone <s>").option("--timezone <s>").option("--language <s>").option("-f, --format <format>").action(async e=>{try{let t={};if(e.firstName&&(t.firstName=e.firstName),e.lastName&&(t.lastName=e.lastName),e.name&&(t.name=e.name),e.username&&(t.username=e.username),e.phone&&(t.phoneNumber=e.phone),e.timezone&&(t.timezone=e.timezone),e.language&&(t.language=e.language),!Object.keys(t).length)throw new o$1("No updates specified");let n=await c(ee,{input:t});i("Profile updated"),h(e,n.updateCurrentUserProfile);}catch(t){g(t);}});let i$1=s.command("security").description("Account security overview");i$1.command("audit-log").description("Recent auth audit events for the current user").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await c(F,{pagination:{limit:e.limit,offset:0}});h(e,t.authAuditLogs.auditLogs,{headers:["When","Action","Resource","IP"],rows:t.authAuditLogs.auditLogs.map(n=>[o(n.createdAt),n.action,n.resource??"-",n.ipAddress??"-"])});}catch(t){g(t);}}),i$1.command("sessions").description("Active sessions for the current user").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await c(te,{pagination:{limit:e.limit,offset:0}});h(e,t.activeSessions.sessions,{headers:["ID","Status","IP","LastActivity","Current"],rows:t.activeSessions.sessions.map(n$1=>[p(n$1.id,12),n(n$1.status),n$1.ipAddress??"-",o(n$1.lastActivityAt),String(!!n$1.isCurrent)])});}catch(t){g(t);}});let o$2=s.command("mfa").description("Multi-factor authentication");o$2.command("list").description("List MFA methods enrolled for the current user").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await c(ne,{pagination:{limit:e.limit,offset:0}});h(e,t.currentUserMFAMethods.methods,{headers:["Method","Status","Created"],rows:t.currentUserMFAMethods.methods.map(n$1=>[n$1.method,n(n$1.status),o(n$1.createdAt)])});}catch(t){g(t);}}),o$2.command("enroll").description("Begin MFA enrollment (TOTP/SMS/EMAIL)").requiredOption("--method <m>","TOTP|SMS|EMAIL").option("-f, --format <format>").action(async e=>{try{let t=await c(ie,{method:e.method.toUpperCase()});e.format?h(e,t.setupMFA):(i("MFA enrollment started"),m(t.setupMFA),k("Save your backup codes; verify with `auth mfa verify --code <CODE>`."));}catch(t){g(t);}}),o$2.command("verify").description("Verify MFA enrollment code").requiredOption("--code <code>").action(async e=>{try{await c(oe,{code:e.code}),i("MFA enabled");}catch(t){g(t);}}),o$2.command("disable").description("Disable MFA for the current user").action(async()=>{try{await c(se),i("MFA disabled");}catch(e){g(e);}});let c$1=s.command("api-keys").description("API key management");c$1.command("list").description("List your API keys").option("--app <id>","Restrict to keys for an app id").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=e.app?ae:re,n=e.app?{appId:e.app,pagination:{limit:e.limit,offset:0}}:{pagination:{limit:e.limit,offset:0}},m=await c(t,n),I=(m.myApiKeys??m.appApiKeys)?.apiKeys??[];h(e,I,{headers:["ID","Name","Prefix","App","Scopes","LastUsed"],rows:I.map(A=>[p(A.id,12),A.name??"-",A.prefix??"-",A.appName??"-",Array.isArray(A.scopes)?A.scopes.join(","):"-",o(A.lastUsedAt)])});}catch(t){g(t);}}),c$1.command("create").description("Generate a new API key").requiredOption("--name <name>").requiredOption("--app <appId>","Owning app id").option("--scope <scope>","Comma-separated scopes").option("--expires <iso>","ISO expiry").option("-f, --format <format>").action(async e=>{try{let t={name:e.name,appId:e.app,scope:e.scope?e.scope.split(","):void 0,expiresAt:e.expires},n=await c(pe,{input:t});i("API key generated. Store the secret \u2014 it is only shown once."),m(n.generateAPIKey);}catch(t){g(t);}}),c$1.command("revoke").description("Revoke an API key").argument("<keyId>").action(async e=>{try{await c(ce,{keyId:e}),i("API key revoked");}catch(t){g(t);}}),c$1.command("rotate").description("Rotate an API key (returns new secret)").argument("<keyId>").action(async e=>{try{let t=await c(de,{keyId:e});i("API key rotated"),m(t.rotateAPIKey);}catch(t){g(t);}}),s.command("audit-log").description("Auth audit log").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await c(F,{pagination:{limit:e.limit,offset:0}});h(e,t.authAuditLogs.auditLogs);}catch(t){g(t);}});let u=s.command("delegations").description("Delegation management");u.command("list").description("Delegations granted to the current user").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await c(me,{pagination:{limit:e.limit,offset:0}});h(e,t.currentUserDelegations.delegations);}catch(t){g(t);}}),u.command("grant").description("Grant a delegation to an app").requiredOption("--app <appId>").requiredOption("--user <userId>","User to delegate as").option("--scope <s>","Comma-separated scopes").option("--workspace <ids>","Comma-separated workspace ids").option("--expires <iso>").option("-f, --format <format>").action(async e=>{try{let t={appId:e.app,userId:e.user,scopes:e.scope?e.scope.split(","):void 0,workspaceIds:e.workspace?e.workspace.split(","):void 0,expiresAt:e.expires},n=await c(ue,{input:t});i("Delegation granted"),h(e,n.grantDelegation);}catch(t){g(t);}}),u.command("revoke").description("Revoke a delegation").argument("<id>").option("--reason <text>").action(async(e,t)=>{try{await c(le,{id:e,reason:t.reason}),i("Delegation revoked");}catch(n){g(n);}});let g$1=s.command("apps").description("OAuth/system app management");g$1.command("list").description("Apps owned by the current user").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await c(ge,{pagination:{limit:e.limit,offset:0}});h(e,t.currentUserApps.apps,{headers:["ID","ClientID","Name","Type","Status"],rows:t.currentUserApps.apps.map(n$1=>[p(n$1.id,12),p(n$1.clientId,24),n$1.name??"-",n$1.type??"-",n(n$1.status)])});}catch(t){g(t);}}),g$1.command("get").description("Get an app by id").argument("<id>").option("-f, --format <format>").action(async(e,t)=>{try{let n=await c(fe,{id:e});if(!n.app)throw new o$1(`App ${e} not found`);h(t,n.app);}catch(n){g(n);}}),g$1.command("create").description("Create an OAuth app").requiredOption("--name <s>").option("--description <s>").option("--type <t>","OAUTH|SYSTEM","OAUTH").option("--actor-type <t>","USER|APP|SERVICE","APP").option("--redirect <urls>","Comma-separated redirect URIs").option("--scopes <s>","Comma-separated scopes").option("-f, --format <format>").action(async e=>{try{let t={name:e.name,description:e.description,type:(e.type??"OAUTH").toUpperCase(),actorType:(e.actorType??"APP").toUpperCase(),redirectUris:e.redirect?e.redirect.split(","):void 0,scopes:e.scopes?e.scopes.split(","):void 0},n=await c(Ae,{input:t});i("App created. Client secret only shown once."),m(n.createApp);}catch(t){g(t);}}),g$1.command("update").description("Update an app").argument("<id>").option("--name <s>").option("--description <s>").option("--redirect <urls>","Comma-separated redirect URIs").option("--scopes <s>","Comma-separated scopes").option("--status <s>").option("-f, --format <format>").action(async(e,t)=>{try{let n={};if(t.name&&(n.name=t.name),t.description!==void 0&&(n.description=t.description),t.redirect&&(n.redirectUris=t.redirect.split(",")),t.scopes&&(n.scopes=t.scopes.split(",")),t.status&&(n.status=t.status.toUpperCase()),!Object.keys(n).length)throw new o$1("No updates specified");let m=await c(he,{id:e,input:n});i("App updated"),h(t,m.updateApp);}catch(n){g(n);}}),g$1.command("deactivate").description("Deactivate an app").argument("<id>").action(async e=>{try{await c(Ie,{id:e}),i("App deactivated");}catch(t){g(t);}});let f=s.command("sso").description("SSO (SAML/OIDC) configuration");f.command("get").description("Get SSO config for a tenant").requiredOption("--tenant <id>").option("-f, --format <format>").action(async e=>{try{let t=await c(ke,{tenantId:e.tenant});h(e,t.getSSOConfig);}catch(t){g(t);}}),f.command("save").description("Save (upsert) SSO config for a tenant").requiredOption("--tenant <id>").requiredOption("--entity <s>","EntityID / Issuer").requiredOption("--sso-url <url>").option("--slo-url <url>").option("--certificate <pem>","X.509 certificate PEM").option("--enabled","Enable after save",false).option("-f, --format <format>").action(async e=>{try{let t={entityId:e.entity,ssoUrl:e.ssoUrl,sloUrl:e.sloUrl,certificate:e.certificate,enabled:!!e.enabled},n=await c(we,{tenantId:e.tenant,input:t});i("SSO config saved"),h(e,n.saveSSOConfig);}catch(t){g(t);}}),f.command("delete").description("Delete SSO config for a tenant").requiredOption("--tenant <id>").action(async e=>{try{await c(ye,{tenantId:e.tenant}),i("SSO config deleted");}catch(t){g(t);}});let h$1=s.command("users").description("User admin (requires admin permissions)");h$1.command("list").description("List users (admin)").option("--email <s>").option("--username <s>").option("--role <s>").option("--status <s>").option("--search <s>").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t={};e.email&&(t.email=e.email),e.username&&(t.username=e.username),e.role&&(t.role=e.role.toUpperCase()),e.status&&(t.status=e.status.toUpperCase()),e.search&&(t.search=e.search);let n$1=await c(Ee,{filter:Object.keys(t).length?t:void 0,pagination:{limit:e.limit,offset:0}});h(e,n$1.users.users,{headers:["ID","Email","Username","Role","Status","Created"],rows:n$1.users.users.map(m=>[p(m.id,12),m.email,m.username??"-",m.role??"-",n(m.status),o(m.createdAt)])});}catch(t){g(t);}}),h$1.command("get").description("Get user by id (admin)").argument("<id>").option("-f, --format <format>").action(async(e,t)=>{try{let n=await c(Se,{id:e});if(!n.user)throw new o$1(`User ${e} not found`);h(t,n.user);}catch(n){g(n);}}),h$1.command("update").description("Update a user (admin)").argument("<id>").option("--first-name <s>").option("--last-name <s>").option("--username <s>").option("--phone <s>").option("--role <s>").option("--status <s>").option("--email-verified <bool>").option("-f, --format <format>").action(async(e,t)=>{try{let n={};if(t.firstName&&(n.firstName=t.firstName),t.lastName&&(n.lastName=t.lastName),t.username&&(n.username=t.username),t.phone&&(n.phoneNumber=t.phone),t.role&&(n.role=t.role.toUpperCase()),t.status&&(n.status=t.status.toUpperCase()),t.emailVerified!==void 0&&(n.emailVerified=t.emailVerified==="true"),!Object.keys(n).length)throw new o$1("No updates specified");let m=await c(Te,{id:e,input:n});i("User updated"),h(t,m.updateUser);}catch(n){g(n);}});}var _e={id:"auth",version:"1.0.0",displayName:"Authentication",register(s,p){a(p),Q(s);let i=s.commands.find(o=>o.name()==="auth");if(!i)throw new q("auth command group missing after registerAuthCommands");Ue(i);}},Qe=_e;export{Qe as default};