@burdenoff/cli-sdk 2026.504.1

package/dist/module-Bv5zhYt2.d.ts

@@ -0,0 +1,166 @@
+import { Command } from 'commander';
+import { RequestDocument, Variables } from 'graphql-request';
+
+interface StoredAuth {
+    accessToken: string;
+    refreshToken: string;
+    expiresAt?: number;
+    workspaceToken?: string;
+    workspaceTokenExpiresAt?: number;
+    workspaceId?: string;
+    organizationId?: string;
+    authMethod?: 'device_code' | 'client_credentials';
+    clientId?: string;
+    clientSecret?: string;
+}
+interface AuthStore {
+    read(): StoredAuth | null;
+    write(auth: StoredAuth): void;
+    clear(): void;
+    isTokenExpired(): boolean;
+    isTokenExpiringSoon(): boolean;
+    isWorkspaceTokenExpired(): boolean;
+    isWorkspaceTokenExpiringSoon(): boolean;
+    isAuthenticated(): boolean;
+}
+declare function createAuthStore(configDir: string): AuthStore;
+
+interface CLIConfig {
+    workspaceEndpoint: string;
+    globalEndpoint: string;
+    oidcIssuer?: string;
+    clientId?: string;
+    defaultFormat?: string;
+    verbose?: boolean;
+    authServiceEndpoint?: string;
+}
+interface ProductDefaults {
+    configDirName: string;
+    oidcClientId: string;
+    oidcIssuerProd?: string;
+    workspaceEndpointDefault: string;
+    globalEndpointDefault: string;
+}
+interface ConfigStore {
+    read(): CLIConfig;
+    write(config: CLIConfig): void;
+    get(key: string): string | undefined;
+    set(key: string, value: string): void;
+    path(): string;
+    dir(): string;
+    resolveOIDC(): {
+        oidcIssuer: string;
+        clientId: string;
+    };
+}
+declare const KNOWN_CONFIG_KEYS: readonly ["workspaceEndpoint", "globalEndpoint", "oidcIssuer", "clientId", "defaultFormat", "verbose", "authServiceEndpoint"];
+declare function createConfigStore(defaults: ProductDefaults): ConfigStore;
+
+interface GqlClient {
+    request<T>(document: RequestDocument, variables?: Variables): Promise<T>;
+}
+interface GqlClients {
+    workspace: GqlClient;
+    global: GqlClient;
+    workspaceAuthOnly: GqlClient;
+    reset(): void;
+}
+declare function extractGqlErrorMessage(error: unknown): string;
+declare function createGqlClients(config: ConfigStore, authStore: AuthStore): GqlClients;
+
+type OutputFormat = 'json' | 'table' | 'yaml';
+interface TableConfig {
+    headers: string[];
+    rows: string[][];
+}
+interface OutputAdapter {
+    isInteractive(): boolean;
+    getFormat(options: {
+        format?: string;
+    }): OutputFormat;
+    formatAndOutput(options: {
+        format?: string;
+    }, data: unknown, table?: TableConfig): void;
+    printJson(data: unknown): void;
+    printTable(headers: string[], rows: string[][]): void;
+    printYaml(data: unknown): void;
+    printSuccess(message: string): void;
+    printError(message: string): void;
+    printWarning(message: string): void;
+    printInfo(message: string): void;
+    formatDate(date: string | null | undefined): string;
+    formatStatus(status: string | null | undefined): string;
+    truncate(str: string | null | undefined, maxLen: number): string;
+    confirm(message: string, force?: boolean): Promise<boolean>;
+}
+declare const defaultOutputAdapter: OutputAdapter;
+
+interface Logger {
+    debug(message: string, ...args: unknown[]): void;
+    info(message: string, ...args: unknown[]): void;
+    warn(message: string, ...args: unknown[]): void;
+    error(message: string, ...args: unknown[]): void;
+}
+interface LoggerOptions {
+    verbose?: boolean;
+    quiet?: boolean;
+}
+declare function createLogger(opts?: LoggerOptions): Logger;
+
+type Environment = 'prod' | 'staging' | 'dev' | 'local';
+interface CLIContext {
+    productName: string;
+    productVersion: string;
+    defaults: ProductDefaults;
+    config: ConfigStore;
+    auth: AuthStore;
+    gql: GqlClients;
+    output: OutputAdapter;
+    logger: Logger;
+    env: Environment;
+}
+interface BuildContextOptions {
+    productName: string;
+    productVersion: string;
+    defaults: ProductDefaults;
+    output?: OutputAdapter;
+    logger?: LoggerOptions | Logger;
+    env?: Environment;
+}
+declare function buildContext(opts: BuildContextOptions): CLIContext;
+
+declare class CliUserError extends Error {
+    readonly exitCode: number;
+    readonly hint: string | undefined;
+    constructor(message: string, opts?: {
+        exitCode?: number;
+        hint?: string;
+    });
+}
+declare class CliAuthError extends CliUserError {
+    constructor(message: string, opts?: {
+        hint?: string;
+    });
+}
+declare class CliInternalError extends Error {
+    readonly cause: unknown;
+    constructor(message: string, cause?: unknown);
+}
+
+interface CliModule {
+    readonly id: string;
+    readonly version: string;
+    readonly displayName: string;
+    readonly dependsOn?: readonly string[];
+    register(program: Command, ctx: CLIContext): void;
+    api?: (ctx: CLIContext) => unknown;
+}
+declare class MissingDependencyError extends CliInternalError {
+    constructor(moduleId: string, missingDep: string);
+}
+declare class CircularDependencyError extends CliInternalError {
+    constructor(cycle: readonly string[]);
+}
+declare function sortModules(modules: readonly CliModule[]): CliModule[];
+
+export { type AuthStore as A, type BuildContextOptions as B, type CliModule as C, type Environment as E, type GqlClient as G, KNOWN_CONFIG_KEYS as K, type Logger as L, MissingDependencyError as M, type OutputAdapter as O, type ProductDefaults as P, type StoredAuth as S, type TableConfig as T, type CLIContext as a, type CLIConfig as b, CircularDependencyError as c, CliAuthError as d, CliInternalError as e, CliUserError as f, type ConfigStore as g, type GqlClients as h, type LoggerOptions as i, type OutputFormat as j, buildContext as k, createAuthStore as l, createConfigStore as m, createGqlClients as n, createLogger as o, defaultOutputAdapter as p, extractGqlErrorMessage as q, sortModules as s };

package/dist/modules/auth/index.cjs

@@ -0,0 +1,183 @@
+'use strict';require('graphql-request');var W=require('cross-fetch');require('commander');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}var W__default=/*#__PURE__*/_interopDefault(W);async function Z(n){let s=`${n.oidcIssuer}/oidc/device/code`,i=new URLSearchParams({client_id:n.clientId,scope:"openid profile email offline_access"}),r=await W__default.default(s,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i.toString()});if(!r.ok){let p=await r.text().catch(()=>"Unknown error");throw new Error(`Device code request failed (${r.status}): ${p}`)}let a=await r.json();return {deviceCode:a.device_code,userCode:a.user_code,verificationUri:a.verification_uri,verificationUriComplete:a.verification_uri_complete??null,expiresIn:a.expires_in,interval:a.interval??5}}async function ee(n,s,i){let r=`${i.oidcIssuer}/oauth/device/token`,a=s;for(;;){await new Promise(I=>setTimeout(I,a*1e3));let p=await W__default.default(r,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"urn:ietf:params:oauth:grant-type:device_code",device_code:n,client_id:i.clientId}).toString()}),c=await p.json();if(p.ok&&c.access_token)return {accessToken:c.access_token,refreshToken:c.refresh_token??"",expiresIn:c.expires_in??3600};let d=c.error;switch(d){case "authorization_pending":continue;case "slow_down":a+=5;continue;case "expired_token":throw new Error("Device code has expired. Please try again.");case "access_denied":throw new Error("Authorization was denied by the user.");default:throw new Error(`Device code polling failed: ${c.error_description??d??"Unknown error"}`)}}}async function V(n,s,i,r){let p=await W__default.default(n,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({query:`
+    mutation AuthenticateApp($input: AuthenticateAppInput!) {
+      authenticateApp(input: $input) {
+        accessToken tokenType expiresIn scopes
+      }
+    }
+  `,variables:{input:{clientId:s,clientSecret:i,scopes:r}}})});if(!p.ok){let d=await p.text().catch(()=>"Unknown error");throw new Error(`App authentication failed (${p.status}): ${d}`)}let c=await p.json();if(c.errors?.length)throw new Error(`App authentication failed: ${c.errors[0]?.message??"unknown error"}`);if(!c.data?.authenticateApp?.accessToken)throw new Error("App authentication failed: no access token returned");return c.data.authenticateApp}async function v(n,s,i,r){let p=await W__default.default(n,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${s}`},body:JSON.stringify({query:`
+    mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {
+      issueWorkspaceToken(input: $input) {
+        success token expiresAt scopes
+        error { code message }
+      }
+    }
+  `,variables:{input:{workspaceId:i,organizationId:r}}})});if(!p.ok){let I=await p.text().catch(()=>"Unknown error");throw new Error(`Workspace token request failed (${p.status}): ${I}`)}let c=await p.json();if(c.errors?.length)throw new Error(`Workspace token failed: ${c.errors[0]?.message??"unknown error"}`);let d=c.data?.issueWorkspaceToken;if(!d?.success||!d.token){let I=d?.error?.message??"Unknown error";throw new Error(`Workspace token failed: ${I}`)}return {token:d.token,expiresAt:d.expiresAt??"",scopes:d.scopes??[]}}async function H(n,s){let r=await W__default.default(n,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${s}`},body:JSON.stringify({query:`
+    query MyWorkspaces($limit: Int) {
+      myWorkspaces(limit: $limit) {
+        items { id name slug tenantId organizationId }
+      }
+    }
+  `,variables:{limit:50}})});if(!r.ok){let p=await r.text().catch(()=>"Unknown error");throw new Error(`Failed to fetch workspaces (${r.status}): ${p}`)}let a=await r.json();if(a.errors?.length)throw new Error(`Failed to fetch workspaces: ${a.errors[0]?.message??"unknown error"}`);return a.data?.myWorkspaces?.items??[]}function Ze(n){try{let s=new URL(n);return s.protocol==="http:"||s.protocol==="https:"}catch{return  false}}async function te(n){try{if(!Ze(n))return !1;let{execFile:s}=await import('child_process'),i=process.platform,r,a;return i==="darwin"?(r="open",a=[n]):i==="win32"?(r="cmd",a=["/c","start","",n]):(r="xdg-open",a=[n]),new Promise(p=>{s(r,a,c=>{p(!c);});})}catch{return  false}}var S=class extends Error{exitCode;hint;constructor(s,i){super(s),this.name="CliUserError",this.exitCode=i?.exitCode??1,this.hint=i?.hint;}};var x=class extends Error{cause;constructor(s,i){super(s),this.name="CliInternalError",this.cause=i;}};var pe=null;function me(n){pe=n;}function E(){if(!pe)throw new x("vibecontrols module helpers used before setHelpersContext was called");return pe}async function l(n,s){return E().gql.global.request(n,s)}async function ue(n,s){return E().gql.global.request(n,s)}function C(){E().gql.reset();}function u(n){let s=n instanceof Error?n.message:String(n);throw new S(s)}function m(n,s,i){E().output.formatAndOutput(n,s,i);}function g(n){E().output.printSuccess(n);}function k(n){E().output.printInfo(n);}function R(n){E().output.printWarning(n);}function z(n){E().output.printJson(n);}function j(n){return E().output.formatStatus(n)}function _(n){return E().output.formatDate(n)}function q(n,s){return E().output.truncate(n,s)}function G(){return E().auth.read()}function O(n){E().auth.write(n);}function Ie(){E().auth.clear();}function F(){return E().config.read()}function fe(){return E().config.resolveOIDC()}function $e(n){return n?n.expiresAt?Date.now()>=n.expiresAt:false:E().auth.isTokenExpired()}var ke="mutation { signOut }",ye=`
+  mutation RefreshToken($token: String!) {
+    refreshToken(token: $token) { accessToken refreshToken expiresIn }
+  }
+`;function De(n){let s=n.command("auth").description("Authentication commands");s.command("login").description("Authenticate with VibeControls").option("--client-credentials","Authenticate as an app with client ID and secret").option("--workspace-id <id>","Workspace ID (for app auth)").action(async i=>{try{i.clientCredentials?await pt(i.workspaceId):await ct();}catch(r){u(r);}}),s.command("logout").description("Revoke tokens and clear stored auth").action(async()=>{try{if(G()?.accessToken)try{await ue(ke);}catch{R("Server-side logout failed, clearing local tokens");}Ie(),C(),g("Logged out successfully");}catch(i){u(i);}}),s.command("status").description("Show current auth state").option("-f, --format <format>","Output format (json, table)").action(i=>{let r=G(),a=F(),p=!!r?.accessToken,c=r?.accessToken?$e(r):false,d=r?.expiresAt?_(new Date(r.expiresAt).toISOString()):"-",I=r?.authMethod==="client_credentials"?"Client Credentials":"OAuth2 Device Code",e=r?.workspaceTokenExpiresAt?_(new Date(r.workspaceTokenExpiresAt).toISOString()):"-";m(i,{authenticated:p,method:I,expired:c,expiresAt:d,workspaceId:r?.workspaceId??"-",organizationId:r?.organizationId??"-",workspaceTokenExpiresAt:e,workspaceEndpoint:a.workspaceEndpoint,globalEndpoint:a.globalEndpoint},{headers:["Key","Value"],rows:[["Authenticated",String(p)],["Method",I],["Expired",String(c)],["Expires At",d],["Workspace ID",r?.workspaceId??"-"],["Organization ID",r?.organizationId??"-"],["Workspace Token Expires",e],["Workspace Endpoint",a.workspaceEndpoint],["Global Endpoint",a.globalEndpoint]]});}),s.command("token").description("Print access token to stdout").option("--workspace","Print workspace token instead").action(i=>{let r=G();if(i.workspace){if(!r?.workspaceToken)throw new S("No workspace token. Set a workspace: vibecontrols workspace set <id>");process.stdout.write(r.workspaceToken);return}if(!r?.accessToken)throw new S("Not authenticated. Run: vibecontrols auth login");process.stdout.write(r.accessToken);}),s.command("refresh").description("Force token refresh").action(async()=>{try{let i=G();if(!i?.refreshToken&&i?.authMethod!=="client_credentials")throw new S("No refresh token available. Run: vibecontrols auth login");if(i?.authMethod==="client_credentials"&&i.clientId&&i.clientSecret){let p=F(),c=await V(p.globalEndpoint,i.clientId,i.clientSecret);O({...i,accessToken:c.accessToken,expiresAt:Date.now()+c.expiresIn*1e3}),C(),g("App token refreshed successfully"),i.workspaceId&&i.organizationId&&await he();return}let a=(await ue(ye,{token:i.refreshToken})).refreshToken;O({...i,accessToken:a.accessToken,refreshToken:a.refreshToken,expiresAt:Date.now()+a.expiresIn*1e3}),C(),g("Token refreshed successfully"),i.workspaceId&&i.organizationId&&await he();}catch(i){u(i);}});}async function he(){let n=G();if(!n?.accessToken||!n.workspaceId||!n.organizationId)return;let s=F();try{let i=await v(s.workspaceEndpoint,n.accessToken,n.workspaceId,n.organizationId);O({...n,workspaceToken:i.token,workspaceTokenExpiresAt:new Date(i.expiresAt).getTime()}),C(),g("Workspace token refreshed");}catch{R("Workspace token refresh failed \u2014 workspace operations may require re-login");}}async function ct(){let n=F(),{oidcIssuer:s,clientId:i}=fe(),r={...n,oidcIssuer:s,clientId:i};k("Starting device code authentication...");let a=await Z(r);console.log(""),console.log(`  Open: ${a.verificationUri}`),console.log(`  Code: ${a.userCode}`),console.log(""),await te(a.verificationUriComplete??a.verificationUri)?k("Browser opened"):R("Could not open browser \u2014 open the URL manually"),k("Waiting for authorization...");let c=await ee(a.deviceCode,a.interval,r),d=c.accessToken,I=Date.now()+c.expiresIn*1e3;k("Fetching workspaces...");try{let e=await H(n.globalEndpoint,d);if(e.length===0){O({accessToken:d,refreshToken:c.refreshToken,expiresAt:I,authMethod:"device_code"}),C(),g("Authentication successful (no workspaces found)");return}let t=e[0];if(e.length>1){console.log(`
+Available workspaces:`),e.forEach((Q,ce)=>console.log(`  ${ce+1}. ${Q.name} (${Q.slug})`));let A=(await import('readline')).createInterface({input:process.stdin,output:process.stdout}),$=await new Promise(Q=>{A.question(`
+Select workspace [1-${e.length}]: `,ce=>{A.close(),Q(ce.trim());});}),w=parseInt($,10)-1;w>=0&&w<e.length&&(t=e[w]);}k(`Using workspace: ${t.name} (${t.id})`);let o=await v(n.workspaceEndpoint,d,t.id,t.organizationId);O({accessToken:d,refreshToken:c.refreshToken,expiresAt:I,workspaceToken:o.token,workspaceTokenExpiresAt:new Date(o.expiresAt).getTime(),workspaceId:t.id,organizationId:t.organizationId,authMethod:"device_code"}),C(),g("Authentication successful");}catch(e){O({accessToken:d,refreshToken:c.refreshToken,expiresAt:I,authMethod:"device_code"}),C(),g("Authentication successful"),R(`Workspace token not obtained: ${e instanceof Error?e.message:String(e)}`),k("Set workspace manually: vibecontrols workspace set <id>");}}async function pt(n){let s=F(),r=(await import('readline')).createInterface({input:process.stdin,output:process.stdout}),a=await new Promise(A=>{r.question("Client ID: ",$=>A($.trim()));}),p=await new Promise(A=>{r.question("Client Secret: ",$=>{r.close(),A($.trim());});});if(!a||!p)throw new S("Client ID and secret cannot be empty");k("Authenticating app...");let c=await V(s.globalEndpoint,a,p),d=c.accessToken,I=Date.now()+c.expiresIn*1e3,e,t,o=n,f;if(o)try{let $=(await H(s.globalEndpoint,d)).find(w=>w.id===o);if($){f=$.organizationId;let w=await v(s.workspaceEndpoint,d,o,f);e=w.token,t=new Date(w.expiresAt).getTime(),k(`Workspace token issued for: ${$.name}`);}else R(`Workspace ${o} not found \u2014 skipping workspace token`),o=void 0;}catch(A){R(`Workspace token failed: ${A instanceof Error?A.message:String(A)}`);}O({accessToken:d,refreshToken:"",expiresAt:I,workspaceToken:e,workspaceTokenExpiresAt:t,workspaceId:o,organizationId:f,authMethod:"client_credentials",clientId:a,clientSecret:p}),C(),g("App authentication successful");}var xe=`
+  query currentUser {
+    currentUser {
+      id email firstName lastName username phoneNumber name
+      emailVerified mfaEnabled isAdmin role status createdAt lastLoginAt
+    }
+  }
+`,Ce=`
+  mutation updateCurrentUserProfile($input: UpdateUserInput!) {
+    updateCurrentUserProfile(input: $input) {
+      id name firstName lastName username phoneNumber timezone language
+    }
+  }
+`,le=`
+  query authAuditLogs($pagination: PaginationInput) {
+    authAuditLogs(pagination: $pagination) {
+      id action resource resourceType resourceId description
+      ipAddress userAgent metadata createdAt
+    }
+  }
+`,_e=`
+  query activeSessions($pagination: PaginationInput) {
+    activeSessions(pagination: $pagination) {
+      id status ipAddress userAgent location lastActivityAt expiresAt createdAt isCurrent
+    }
+  }
+`,be=`
+  query currentUserMFAMethods($pagination: PaginationInput) {
+    currentUserMFAMethods(pagination: $pagination) {
+      id method status createdAt updatedAt
+    }
+  }
+`,we=`
+  mutation setupMFA($method: MFAMethod!) {
+    setupMFA(method: $method) {
+      method backupCodes qrCode secret
+    }
+  }
+`;var Oe=`
+  mutation enableMFA($code: String!) {
+    enableMFA(code: $code)
+  }
+`,Ne=`
+  mutation disableMFA {
+    disableMFA
+  }
+`,ve=`
+  query myApiKeys($pagination: PaginationInput) {
+    myApiKeys(pagination: $pagination) {
+      id name prefix appId appName scopes expiresAt lastUsedAt createdAt
+    }
+  }
+`,Re=`
+  query appApiKeys($appId: ID!, $pagination: PaginationInput) {
+    appApiKeys(appId: $appId, pagination: $pagination) {
+      id name prefix appId appName scopes expiresAt lastUsedAt createdAt
+    }
+  }
+`,Ue=`
+  mutation generateAPIKey($input: GenerateAPIKeyInput!) {
+    generateAPIKey(input: $input) {
+      keyId apiKey apiSecret
+    }
+  }
+`;var Le=`
+  mutation revokeAPIKey($keyId: String!) {
+    revokeAPIKey(keyId: $keyId)
+  }
+`,Pe=`
+  mutation rotateAPIKey($keyId: String!) {
+    rotateAPIKey(keyId: $keyId) {
+      apiSecret
+    }
+  }
+`,Ve=`
+  query currentUserDelegations($pagination: PaginationInput) {
+    currentUserDelegations(pagination: $pagination) {
+      id appId userId grantedBy grantedAt expiresAt scopes workspaceIds
+      status revokedAt revokedBy
+      app { id name }
+    }
+  }
+`,qe=`
+  mutation grantDelegation($input: GrantDelegationInput!) {
+    grantDelegation(input: $input) {
+      id appId userId grantedBy grantedAt expiresAt scopes workspaceIds status
+    }
+  }
+`,Ge=`
+  mutation revokeDelegation($id: ID!, $reason: String) {
+    revokeDelegation(id: $id, reason: $reason)
+  }
+`,Fe=`
+  query currentUserApps($pagination: PaginationInput) {
+    currentUserApps(pagination: $pagination) {
+      id clientId name description type actorType status ownerUserId
+      redirectUris scopes createdAt updatedAt
+    }
+  }
+`,Be=`
+  query app($id: ID!) {
+    app(id: $id) {
+      id clientId name description type actorType status ownerUserId redirectUris scopes
+    }
+  }
+`,Me=`
+  mutation createApp($input: CreateAppInput!) {
+    createApp(input: $input) {
+      app { id clientId name type status }
+      clientSecret
+    }
+  }
+`,Ke=`
+  mutation updateApp($id: ID!, $input: UpdateAppInput!) {
+    updateApp(id: $id, input: $input) {
+      id name description redirectUris scopes status
+    }
+  }
+`,We=`
+  mutation deactivateApp($id: ID!) {
+    deactivateApp(id: $id)
+  }
+`,He=`
+  query getSSOConfig($tenantId: String!) {
+    getSSOConfig(tenantId: $tenantId) {
+      id identifier tenantId entityId ssoUrl sloUrl certificate enabled metadata
+    }
+  }
+`,ze=`
+  mutation saveSSOConfig($tenantId: String!, $input: SSOConfigInput!) {
+    saveSSOConfig(tenantId: $tenantId, input: $input) {
+      id identifier entityId ssoUrl sloUrl certificate enabled
+    }
+  }
+`,je=`
+  mutation deleteSSOConfig($tenantId: String!) {
+    deleteSSOConfig(tenantId: $tenantId)
+  }
+`,Ye=`
+  query users($filter: UserFilterInput, $pagination: PaginationInput) {
+    users(filter: $filter, pagination: $pagination) {
+      users { id email firstName lastName username role status createdAt }
+      totalCount hasMore
+    }
+  }
+`,Je=`
+  query user($id: ID!) {
+    user(id: $id) {
+      id email firstName lastName username role status emailVerified lastLoginAt
+    }
+  }
+`,Xe=`
+  mutation updateUser($id: ID!, $input: AdminUpdateUserInput!) {
+    updateUser(id: $id, input: $input) {
+      id email firstName lastName username role status
+    }
+  }
+`;function Qe(n){let s=n.command("profile").description("Current user profile");s.command("show").description("Show current user").option("-f, --format <format>").action(async e=>{try{let t=await l(xe);m(e,t.currentUser);}catch(t){u(t);}}),s.command("update").description("Update current user profile").option("--first-name <s>").option("--last-name <s>").option("--name <s>").option("--username <s>").option("--phone <s>").option("--timezone <s>").option("--language <s>").option("-f, --format <format>").action(async e=>{try{let t={};if(e.firstName&&(t.firstName=e.firstName),e.lastName&&(t.lastName=e.lastName),e.name&&(t.name=e.name),e.username&&(t.username=e.username),e.phone&&(t.phoneNumber=e.phone),e.timezone&&(t.timezone=e.timezone),e.language&&(t.language=e.language),!Object.keys(t).length)throw new S("No updates specified");let o=await l(Ce,{input:t});g("Profile updated"),m(e,o.updateCurrentUserProfile);}catch(t){u(t);}});let i=n.command("security").description("Account security overview");i.command("audit-log").description("Recent auth audit events for the current user").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await l(le,{pagination:{limit:e.limit,offset:0}});m(e,t.authAuditLogs,{headers:["When","Action","Resource","IP"],rows:t.authAuditLogs.map(o=>[_(o.createdAt),o.action,o.resource??"-",o.ipAddress??"-"])});}catch(t){u(t);}}),i.command("sessions").description("Active sessions for the current user").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await l(_e,{pagination:{limit:e.limit,offset:0}});m(e,t.activeSessions,{headers:["ID","Status","IP","LastActivity","Current"],rows:t.activeSessions.map(o=>[q(o.id,12),j(o.status),o.ipAddress??"-",_(o.lastActivityAt),String(!!o.isCurrent)])});}catch(t){u(t);}});let r=n.command("mfa").description("Multi-factor authentication");r.command("list").description("List MFA methods enrolled for the current user").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await l(be,{pagination:{limit:e.limit,offset:0}});m(e,t.currentUserMFAMethods,{headers:["Method","Status","Created"],rows:t.currentUserMFAMethods.map(o=>[o.method,j(o.status),_(o.createdAt)])});}catch(t){u(t);}}),r.command("enroll").description("Begin MFA enrollment (TOTP/SMS/EMAIL)").requiredOption("--method <m>","TOTP|SMS|EMAIL").option("-f, --format <format>").action(async e=>{try{let t=await l(we,{method:e.method.toUpperCase()});e.format?m(e,t.setupMFA):(g("MFA enrollment started"),z(t.setupMFA),k("Save your backup codes; verify with `auth mfa verify --code <CODE>`."));}catch(t){u(t);}}),r.command("verify").description("Verify MFA enrollment code").requiredOption("--code <code>").action(async e=>{try{await l(Oe,{code:e.code}),g("MFA enabled");}catch(t){u(t);}}),r.command("disable").description("Disable MFA for the current user").action(async()=>{try{await l(Ne),g("MFA disabled");}catch(e){u(e);}});let a=n.command("api-keys").description("API key management");a.command("list").description("List your API keys").option("--app <id>","Restrict to keys for an app id").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=e.app?Re:ve,o=e.app?{appId:e.app,pagination:{limit:e.limit,offset:0}}:{pagination:{limit:e.limit,offset:0}},f=await l(t,o),A=f.myApiKeys??f.appApiKeys??[];m(e,A,{headers:["ID","Name","Prefix","App","Scopes","LastUsed"],rows:A.map($=>[q($.id,12),$.name??"-",$.prefix??"-",$.appName??"-",Array.isArray($.scopes)?$.scopes.join(","):"-",_($.lastUsedAt)])});}catch(t){u(t);}}),a.command("create").description("Generate a new API key").requiredOption("--name <name>").requiredOption("--app <appId>","Owning app id").option("--scope <scope>","Comma-separated scopes").option("--expires <iso>","ISO expiry").option("-f, --format <format>").action(async e=>{try{let t={name:e.name,appId:e.app,scope:e.scope?e.scope.split(","):void 0,expiresAt:e.expires},o=await l(Ue,{input:t});g("API key generated. Store the secret \u2014 it is only shown once."),z(o.generateAPIKey);}catch(t){u(t);}}),a.command("revoke").description("Revoke an API key").argument("<keyId>").action(async e=>{try{await l(Le,{keyId:e}),g("API key revoked");}catch(t){u(t);}}),a.command("rotate").description("Rotate an API key (returns new secret)").argument("<keyId>").action(async e=>{try{let t=await l(Pe,{keyId:e});g("API key rotated"),z(t.rotateAPIKey);}catch(t){u(t);}}),n.command("audit-log").description("Auth audit log").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await l(le,{pagination:{limit:e.limit,offset:0}});m(e,t.authAuditLogs);}catch(t){u(t);}});let p=n.command("delegations").description("Delegation management");p.command("list").description("Delegations granted to the current user").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await l(Ve,{pagination:{limit:e.limit,offset:0}});m(e,t.currentUserDelegations);}catch(t){u(t);}}),p.command("grant").description("Grant a delegation to an app").requiredOption("--app <appId>").requiredOption("--user <userId>","User to delegate as").option("--scope <s>","Comma-separated scopes").option("--workspace <ids>","Comma-separated workspace ids").option("--expires <iso>").option("-f, --format <format>").action(async e=>{try{let t={appId:e.app,userId:e.user,scopes:e.scope?e.scope.split(","):void 0,workspaceIds:e.workspace?e.workspace.split(","):void 0,expiresAt:e.expires},o=await l(qe,{input:t});g("Delegation granted"),m(e,o.grantDelegation);}catch(t){u(t);}}),p.command("revoke").description("Revoke a delegation").argument("<id>").option("--reason <text>").action(async(e,t)=>{try{await l(Ge,{id:e,reason:t.reason}),g("Delegation revoked");}catch(o){u(o);}});let c=n.command("apps").description("OAuth/system app management");c.command("list").description("Apps owned by the current user").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await l(Fe,{pagination:{limit:e.limit,offset:0}});m(e,t.currentUserApps,{headers:["ID","ClientID","Name","Type","Status"],rows:t.currentUserApps.map(o=>[q(o.id,12),q(o.clientId,24),o.name??"-",o.type??"-",j(o.status)])});}catch(t){u(t);}}),c.command("get").description("Get an app by id").argument("<id>").option("-f, --format <format>").action(async(e,t)=>{try{let o=await l(Be,{id:e});if(!o.app)throw new S(`App ${e} not found`);m(t,o.app);}catch(o){u(o);}}),c.command("create").description("Create an OAuth app").requiredOption("--name <s>").option("--description <s>").option("--type <t>","OAUTH|SYSTEM","OAUTH").option("--actor-type <t>","USER|APP|SERVICE","APP").option("--redirect <urls>","Comma-separated redirect URIs").option("--scopes <s>","Comma-separated scopes").option("-f, --format <format>").action(async e=>{try{let t={name:e.name,description:e.description,type:(e.type??"OAUTH").toUpperCase(),actorType:(e.actorType??"APP").toUpperCase(),redirectUris:e.redirect?e.redirect.split(","):void 0,scopes:e.scopes?e.scopes.split(","):void 0},o=await l(Me,{input:t});g("App created. Client secret only shown once."),z(o.createApp);}catch(t){u(t);}}),c.command("update").description("Update an app").argument("<id>").option("--name <s>").option("--description <s>").option("--redirect <urls>","Comma-separated redirect URIs").option("--scopes <s>","Comma-separated scopes").option("--status <s>").option("-f, --format <format>").action(async(e,t)=>{try{let o={};if(t.name&&(o.name=t.name),t.description!==void 0&&(o.description=t.description),t.redirect&&(o.redirectUris=t.redirect.split(",")),t.scopes&&(o.scopes=t.scopes.split(",")),t.status&&(o.status=t.status.toUpperCase()),!Object.keys(o).length)throw new S("No updates specified");let f=await l(Ke,{id:e,input:o});g("App updated"),m(t,f.updateApp);}catch(o){u(o);}}),c.command("deactivate").description("Deactivate an app").argument("<id>").action(async e=>{try{await l(We,{id:e}),g("App deactivated");}catch(t){u(t);}});let d=n.command("sso").description("SSO (SAML/OIDC) configuration");d.command("get").description("Get SSO config for a tenant").requiredOption("--tenant <id>").option("-f, --format <format>").action(async e=>{try{let t=await l(He,{tenantId:e.tenant});m(e,t.getSSOConfig);}catch(t){u(t);}}),d.command("save").description("Save (upsert) SSO config for a tenant").requiredOption("--tenant <id>").requiredOption("--entity <s>","EntityID / Issuer").requiredOption("--sso-url <url>").option("--slo-url <url>").option("--certificate <pem>","X.509 certificate PEM").option("--enabled","Enable after save",false).option("-f, --format <format>").action(async e=>{try{let t={entityId:e.entity,ssoUrl:e.ssoUrl,sloUrl:e.sloUrl,certificate:e.certificate,enabled:!!e.enabled},o=await l(ze,{tenantId:e.tenant,input:t});g("SSO config saved"),m(e,o.saveSSOConfig);}catch(t){u(t);}}),d.command("delete").description("Delete SSO config for a tenant").requiredOption("--tenant <id>").action(async e=>{try{await l(je,{tenantId:e.tenant}),g("SSO config deleted");}catch(t){u(t);}});let I=n.command("users").description("User admin (requires admin permissions)");I.command("list").description("List users (admin)").option("--email <s>").option("--username <s>").option("--role <s>").option("--status <s>").option("--search <s>").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t={};e.email&&(t.email=e.email),e.username&&(t.username=e.username),e.role&&(t.role=e.role.toUpperCase()),e.status&&(t.status=e.status.toUpperCase()),e.search&&(t.search=e.search);let o=await l(Ye,{filter:Object.keys(t).length?t:void 0,pagination:{limit:e.limit,offset:0}});m(e,o.users.users,{headers:["ID","Email","Username","Role","Status","Created"],rows:o.users.users.map(f=>[q(f.id,12),f.email,f.username??"-",f.role??"-",j(f.status),_(f.createdAt)])});}catch(t){u(t);}}),I.command("get").description("Get user by id (admin)").argument("<id>").option("-f, --format <format>").action(async(e,t)=>{try{let o=await l(Je,{id:e});if(!o.user)throw new S(`User ${e} not found`);m(t,o.user);}catch(o){u(o);}}),I.command("update").description("Update a user (admin)").argument("<id>").option("--first-name <s>").option("--last-name <s>").option("--username <s>").option("--phone <s>").option("--role <s>").option("--status <s>").option("--email-verified <bool>").option("-f, --format <format>").action(async(e,t)=>{try{let o={};if(t.firstName&&(o.firstName=t.firstName),t.lastName&&(o.lastName=t.lastName),t.username&&(o.username=t.username),t.phone&&(o.phoneNumber=t.phone),t.role&&(o.role=t.role.toUpperCase()),t.status&&(o.status=t.status.toUpperCase()),t.emailVerified!==void 0&&(o.emailVerified=t.emailVerified==="true"),!Object.keys(o).length)throw new S("No updates specified");let f=await l(Xe,{id:e,input:o});g("User updated"),m(t,f.updateUser);}catch(o){u(o);}});}var dt={id:"auth",version:"1.0.0",displayName:"Authentication",register(n,s){me(s),De(n);let i=n.commands.find(r=>r.name()==="auth");if(!i)throw new x("auth command group missing after registerAuthCommands");Qe(i);}},ur=dt;module.exports=ur;

package/dist/modules/auth/index.d.cts

@@ -0,0 +1,7 @@
+import { C as CliModule } from '../../module-Bv5zhYt2.cjs';
+import 'commander';
+import 'graphql-request';
+
+declare const authModule: CliModule;
+
+export { authModule as default };

package/dist/modules/auth/index.d.ts

@@ -0,0 +1,7 @@
+import { C as CliModule } from '../../module-Bv5zhYt2.js';
+import 'commander';
+import 'graphql-request';
+
+declare const authModule: CliModule;
+
+export { authModule as default };

package/dist/modules/auth/index.js

@@ -0,0 +1,160 @@
+import {Bc,Cc}from'../../chunk-MRONTCXQ.js';import {a,f,s,d,k,u,e,h,v,B,n,g,t,c,o as o$1,m,l,j,A}from'../../chunk-KTKHJORN.js';import {q,o,f as f$1,h as h$1,g as g$1,d as d$1,i,e as e$1}from'../../chunk-RNWXATAC.js';function X(s$1){let u$1=s$1.command("auth").description("Authentication commands");u$1.command("login").description("Authenticate with VibeControls").option("--client-credentials","Authenticate as an app with client ID and secret").option("--workspace-id <id>","Workspace ID (for app auth)").action(async i=>{try{i.clientCredentials?await Ce(i.workspaceId):await Ue();}catch(r){f(r);}}),u$1.command("logout").description("Revoke tokens and clear stored auth").action(async()=>{try{if(s()?.accessToken)try{await d(Bc);}catch{k("Server-side logout failed, clearing local tokens");}u(),e(),h("Logged out successfully");}catch(i){f(i);}}),u$1.command("status").description("Show current auth state").option("-f, --format <format>","Output format (json, table)").action(i=>{let r=s(),p=v(),I=!!r?.accessToken,m=r?.accessToken?B(r):false,f=r?.expiresAt?n(new Date(r.expiresAt).toISOString()):"-",h=r?.authMethod==="client_credentials"?"Client Credentials":"OAuth2 Device Code",e=r?.workspaceTokenExpiresAt?n(new Date(r.workspaceTokenExpiresAt).toISOString()):"-";g(i,{authenticated:I,method:h,expired:m,expiresAt:f,workspaceId:r?.workspaceId??"-",organizationId:r?.organizationId??"-",workspaceTokenExpiresAt:e,workspaceEndpoint:p.workspaceEndpoint,globalEndpoint:p.globalEndpoint},{headers:["Key","Value"],rows:[["Authenticated",String(I)],["Method",h],["Expired",String(m)],["Expires At",f],["Workspace ID",r?.workspaceId??"-"],["Organization ID",r?.organizationId??"-"],["Workspace Token Expires",e],["Workspace Endpoint",p.workspaceEndpoint],["Global Endpoint",p.globalEndpoint]]});}),u$1.command("token").description("Print access token to stdout").option("--workspace","Print workspace token instead").action(i=>{let r=s();if(i.workspace){if(!r?.workspaceToken)throw new o("No workspace token. Set a workspace: vibecontrols workspace set <id>");process.stdout.write(r.workspaceToken);return}if(!r?.accessToken)throw new o("Not authenticated. Run: vibecontrols auth login");process.stdout.write(r.accessToken);}),u$1.command("refresh").description("Force token refresh").action(async()=>{try{let i=s();if(!i?.refreshToken&&i?.authMethod!=="client_credentials")throw new o("No refresh token available. Run: vibecontrols auth login");if(i?.authMethod==="client_credentials"&&i.clientId&&i.clientSecret){let I=v(),m=await f$1(I.globalEndpoint,i.clientId,i.clientSecret);t({...i,accessToken:m.accessToken,expiresAt:Date.now()+m.expiresIn*1e3}),e(),h("App token refreshed successfully"),i.workspaceId&&i.organizationId&&await J();return}let p=(await d(Cc,{token:i.refreshToken})).refreshToken;t({...i,accessToken:p.accessToken,refreshToken:p.refreshToken,expiresAt:Date.now()+p.expiresIn*1e3}),e(),h("Token refreshed successfully"),i.workspaceId&&i.organizationId&&await J();}catch(i){f(i);}});}async function J(){let s$1=s();if(!s$1?.accessToken||!s$1.workspaceId||!s$1.organizationId)return;let u=v();try{let i=await g$1(u.workspaceEndpoint,s$1.accessToken,s$1.workspaceId,s$1.organizationId);t({...s$1,workspaceToken:i.token,workspaceTokenExpiresAt:new Date(i.expiresAt).getTime()}),e(),h("Workspace token refreshed");}catch{k("Workspace token refresh failed \u2014 workspace operations may require re-login");}}async function Ue(){let s=v(),{oidcIssuer:u,clientId:i$1}=A(),r={...s,oidcIssuer:u,clientId:i$1};j("Starting device code authentication...");let p=await d$1(r);console.log(""),console.log(`  Open: ${p.verificationUri}`),console.log(`  Code: ${p.userCode}`),console.log(""),await i(p.verificationUriComplete??p.verificationUri)?j("Browser opened"):k("Could not open browser \u2014 open the URL manually"),j("Waiting for authorization...");let m=await e$1(p.deviceCode,p.interval,r),f=m.accessToken,h$2=Date.now()+m.expiresIn*1e3;j("Fetching workspaces...");try{let e$1=await h$1(s.globalEndpoint,f);if(e$1.length===0){t({accessToken:f,refreshToken:m.refreshToken,expiresAt:h$2,authMethod:"device_code"}),e(),h("Authentication successful (no workspaces found)");return}let t$1=e$1[0];if(e$1.length>1){console.log(`
+Available workspaces:`),e$1.forEach((O,$)=>console.log(`  ${$+1}. ${O.name} (${O.slug})`));let A=(await import('readline')).createInterface({input:process.stdin,output:process.stdout}),g=await new Promise(O=>{A.question(`
+Select workspace [1-${e$1.length}]: `,$=>{A.close(),O($.trim());});}),S=parseInt(g,10)-1;S>=0&&S<e$1.length&&(t$1=e$1[S]);}j(`Using workspace: ${t$1.name} (${t$1.id})`);let n=await g$1(s.workspaceEndpoint,f,t$1.id,t$1.organizationId);t({accessToken:f,refreshToken:m.refreshToken,expiresAt:h$2,workspaceToken:n.token,workspaceTokenExpiresAt:new Date(n.expiresAt).getTime(),workspaceId:t$1.id,organizationId:t$1.organizationId,authMethod:"device_code"}),e(),h("Authentication successful");}catch(e$1){t({accessToken:f,refreshToken:m.refreshToken,expiresAt:h$2,authMethod:"device_code"}),e(),h("Authentication successful"),k(`Workspace token not obtained: ${e$1 instanceof Error?e$1.message:String(e$1)}`),j("Set workspace manually: vibecontrols workspace set <id>");}}async function Ce(s){let u=v(),r=(await import('readline')).createInterface({input:process.stdin,output:process.stdout}),p=await new Promise(A=>{r.question("Client ID: ",g=>A(g.trim()));}),I=await new Promise(A=>{r.question("Client Secret: ",g=>{r.close(),A(g.trim());});});if(!p||!I)throw new o("Client ID and secret cannot be empty");j("Authenticating app...");let m=await f$1(u.globalEndpoint,p,I),f=m.accessToken,h$2=Date.now()+m.expiresIn*1e3,e$1,t$1,n=s,l;if(n)try{let g=(await h$1(u.globalEndpoint,f)).find(S=>S.id===n);if(g){l=g.organizationId;let S=await g$1(u.workspaceEndpoint,f,n,l);e$1=S.token,t$1=new Date(S.expiresAt).getTime(),j(`Workspace token issued for: ${g.name}`);}else k(`Workspace ${n} not found \u2014 skipping workspace token`),n=void 0;}catch(A){k(`Workspace token failed: ${A instanceof Error?A.message:String(A)}`);}t({accessToken:f,refreshToken:"",expiresAt:h$2,workspaceToken:e$1,workspaceTokenExpiresAt:t$1,workspaceId:n,organizationId:l,authMethod:"client_credentials",clientId:p,clientSecret:I}),e(),h("App authentication successful");}var Q=`
+  query currentUser {
+    currentUser {
+      id email firstName lastName username phoneNumber name
+      emailVerified mfaEnabled isAdmin role status createdAt lastLoginAt
+    }
+  }
+`,Z=`
+  mutation updateCurrentUserProfile($input: UpdateUserInput!) {
+    updateCurrentUserProfile(input: $input) {
+      id name firstName lastName username phoneNumber timezone language
+    }
+  }
+`,K=`
+  query authAuditLogs($pagination: PaginationInput) {
+    authAuditLogs(pagination: $pagination) {
+      id action resource resourceType resourceId description
+      ipAddress userAgent metadata createdAt
+    }
+  }
+`,ee=`
+  query activeSessions($pagination: PaginationInput) {
+    activeSessions(pagination: $pagination) {
+      id status ipAddress userAgent location lastActivityAt expiresAt createdAt isCurrent
+    }
+  }
+`,te=`
+  query currentUserMFAMethods($pagination: PaginationInput) {
+    currentUserMFAMethods(pagination: $pagination) {
+      id method status createdAt updatedAt
+    }
+  }
+`,ne=`
+  mutation setupMFA($method: MFAMethod!) {
+    setupMFA(method: $method) {
+      method backupCodes qrCode secret
+    }
+  }
+`;var ie=`
+  mutation enableMFA($code: String!) {
+    enableMFA(code: $code)
+  }
+`,re=`
+  mutation disableMFA {
+    disableMFA
+  }
+`,oe=`
+  query myApiKeys($pagination: PaginationInput) {
+    myApiKeys(pagination: $pagination) {
+      id name prefix appId appName scopes expiresAt lastUsedAt createdAt
+    }
+  }
+`,se=`
+  query appApiKeys($appId: ID!, $pagination: PaginationInput) {
+    appApiKeys(appId: $appId, pagination: $pagination) {
+      id name prefix appId appName scopes expiresAt lastUsedAt createdAt
+    }
+  }
+`,ae=`
+  mutation generateAPIKey($input: GenerateAPIKeyInput!) {
+    generateAPIKey(input: $input) {
+      keyId apiKey apiSecret
+    }
+  }
+`;var ce=`
+  mutation revokeAPIKey($keyId: String!) {
+    revokeAPIKey(keyId: $keyId)
+  }
+`,pe=`
+  mutation rotateAPIKey($keyId: String!) {
+    rotateAPIKey(keyId: $keyId) {
+      apiSecret
+    }
+  }
+`,de=`
+  query currentUserDelegations($pagination: PaginationInput) {
+    currentUserDelegations(pagination: $pagination) {
+      id appId userId grantedBy grantedAt expiresAt scopes workspaceIds
+      status revokedAt revokedBy
+      app { id name }
+    }
+  }
+`,me=`
+  mutation grantDelegation($input: GrantDelegationInput!) {
+    grantDelegation(input: $input) {
+      id appId userId grantedBy grantedAt expiresAt scopes workspaceIds status
+    }
+  }
+`,ue=`
+  mutation revokeDelegation($id: ID!, $reason: String) {
+    revokeDelegation(id: $id, reason: $reason)
+  }
+`,le=`
+  query currentUserApps($pagination: PaginationInput) {
+    currentUserApps(pagination: $pagination) {
+      id clientId name description type actorType status ownerUserId
+      redirectUris scopes createdAt updatedAt
+    }
+  }
+`,ge=`
+  query app($id: ID!) {
+    app(id: $id) {
+      id clientId name description type actorType status ownerUserId redirectUris scopes
+    }
+  }
+`,fe=`
+  mutation createApp($input: CreateAppInput!) {
+    createApp(input: $input) {
+      app { id clientId name type status }
+      clientSecret
+    }
+  }
+`,Ae=`
+  mutation updateApp($id: ID!, $input: UpdateAppInput!) {
+    updateApp(id: $id, input: $input) {
+      id name description redirectUris scopes status
+    }
+  }
+`,Ie=`
+  mutation deactivateApp($id: ID!) {
+    deactivateApp(id: $id)
+  }
+`,he=`
+  query getSSOConfig($tenantId: String!) {
+    getSSOConfig(tenantId: $tenantId) {
+      id identifier tenantId entityId ssoUrl sloUrl certificate enabled metadata
+    }
+  }
+`,ye=`
+  mutation saveSSOConfig($tenantId: String!, $input: SSOConfigInput!) {
+    saveSSOConfig(tenantId: $tenantId, input: $input) {
+      id identifier entityId ssoUrl sloUrl certificate enabled
+    }
+  }
+`,we=`
+  mutation deleteSSOConfig($tenantId: String!) {
+    deleteSSOConfig(tenantId: $tenantId)
+  }
+`,ke=`
+  query users($filter: UserFilterInput, $pagination: PaginationInput) {
+    users(filter: $filter, pagination: $pagination) {
+      users { id email firstName lastName username role status createdAt }
+      totalCount hasMore
+    }
+  }
+`,Ee=`
+  query user($id: ID!) {
+    user(id: $id) {
+      id email firstName lastName username role status emailVerified lastLoginAt
+    }
+  }
+`,Se=`
+  mutation updateUser($id: ID!, $input: AdminUpdateUserInput!) {
+    updateUser(id: $id, input: $input) {
+      id email firstName lastName username role status
+    }
+  }
+`;function Te(s){let u=s.command("profile").description("Current user profile");u.command("show").description("Show current user").option("-f, --format <format>").action(async e=>{try{let t=await c(Q);g(e,t.currentUser);}catch(t){f(t);}}),u.command("update").description("Update current user profile").option("--first-name <s>").option("--last-name <s>").option("--name <s>").option("--username <s>").option("--phone <s>").option("--timezone <s>").option("--language <s>").option("-f, --format <format>").action(async e=>{try{let t={};if(e.firstName&&(t.firstName=e.firstName),e.lastName&&(t.lastName=e.lastName),e.name&&(t.name=e.name),e.username&&(t.username=e.username),e.phone&&(t.phoneNumber=e.phone),e.timezone&&(t.timezone=e.timezone),e.language&&(t.language=e.language),!Object.keys(t).length)throw new o("No updates specified");let n=await c(Z,{input:t});h("Profile updated"),g(e,n.updateCurrentUserProfile);}catch(t){f(t);}});let i=s.command("security").description("Account security overview");i.command("audit-log").description("Recent auth audit events for the current user").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await c(K,{pagination:{limit:e.limit,offset:0}});g(e,t.authAuditLogs,{headers:["When","Action","Resource","IP"],rows:t.authAuditLogs.map(n$1=>[n(n$1.createdAt),n$1.action,n$1.resource??"-",n$1.ipAddress??"-"])});}catch(t){f(t);}}),i.command("sessions").description("Active sessions for the current user").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await c(ee,{pagination:{limit:e.limit,offset:0}});g(e,t.activeSessions,{headers:["ID","Status","IP","LastActivity","Current"],rows:t.activeSessions.map(n$1=>[o$1(n$1.id,12),m(n$1.status),n$1.ipAddress??"-",n(n$1.lastActivityAt),String(!!n$1.isCurrent)])});}catch(t){f(t);}});let r=s.command("mfa").description("Multi-factor authentication");r.command("list").description("List MFA methods enrolled for the current user").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await c(te,{pagination:{limit:e.limit,offset:0}});g(e,t.currentUserMFAMethods,{headers:["Method","Status","Created"],rows:t.currentUserMFAMethods.map(n$1=>[n$1.method,m(n$1.status),n(n$1.createdAt)])});}catch(t){f(t);}}),r.command("enroll").description("Begin MFA enrollment (TOTP/SMS/EMAIL)").requiredOption("--method <m>","TOTP|SMS|EMAIL").option("-f, --format <format>").action(async e=>{try{let t=await c(ne,{method:e.method.toUpperCase()});e.format?g(e,t.setupMFA):(h("MFA enrollment started"),l(t.setupMFA),j("Save your backup codes; verify with `auth mfa verify --code <CODE>`."));}catch(t){f(t);}}),r.command("verify").description("Verify MFA enrollment code").requiredOption("--code <code>").action(async e=>{try{await c(ie,{code:e.code}),h("MFA enabled");}catch(t){f(t);}}),r.command("disable").description("Disable MFA for the current user").action(async()=>{try{await c(re),h("MFA disabled");}catch(e){f(e);}});let p=s.command("api-keys").description("API key management");p.command("list").description("List your API keys").option("--app <id>","Restrict to keys for an app id").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=e.app?se:oe,n$1=e.app?{appId:e.app,pagination:{limit:e.limit,offset:0}}:{pagination:{limit:e.limit,offset:0}},l=await c(t,n$1),A=l.myApiKeys??l.appApiKeys??[];g(e,A,{headers:["ID","Name","Prefix","App","Scopes","LastUsed"],rows:A.map(g=>[o$1(g.id,12),g.name??"-",g.prefix??"-",g.appName??"-",Array.isArray(g.scopes)?g.scopes.join(","):"-",n(g.lastUsedAt)])});}catch(t){f(t);}}),p.command("create").description("Generate a new API key").requiredOption("--name <name>").requiredOption("--app <appId>","Owning app id").option("--scope <scope>","Comma-separated scopes").option("--expires <iso>","ISO expiry").option("-f, --format <format>").action(async e=>{try{let t={name:e.name,appId:e.app,scope:e.scope?e.scope.split(","):void 0,expiresAt:e.expires},n=await c(ae,{input:t});h("API key generated. Store the secret \u2014 it is only shown once."),l(n.generateAPIKey);}catch(t){f(t);}}),p.command("revoke").description("Revoke an API key").argument("<keyId>").action(async e=>{try{await c(ce,{keyId:e}),h("API key revoked");}catch(t){f(t);}}),p.command("rotate").description("Rotate an API key (returns new secret)").argument("<keyId>").action(async e=>{try{let t=await c(pe,{keyId:e});h("API key rotated"),l(t.rotateAPIKey);}catch(t){f(t);}}),s.command("audit-log").description("Auth audit log").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await c(K,{pagination:{limit:e.limit,offset:0}});g(e,t.authAuditLogs);}catch(t){f(t);}});let I=s.command("delegations").description("Delegation management");I.command("list").description("Delegations granted to the current user").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await c(de,{pagination:{limit:e.limit,offset:0}});g(e,t.currentUserDelegations);}catch(t){f(t);}}),I.command("grant").description("Grant a delegation to an app").requiredOption("--app <appId>").requiredOption("--user <userId>","User to delegate as").option("--scope <s>","Comma-separated scopes").option("--workspace <ids>","Comma-separated workspace ids").option("--expires <iso>").option("-f, --format <format>").action(async e=>{try{let t={appId:e.app,userId:e.user,scopes:e.scope?e.scope.split(","):void 0,workspaceIds:e.workspace?e.workspace.split(","):void 0,expiresAt:e.expires},n=await c(me,{input:t});h("Delegation granted"),g(e,n.grantDelegation);}catch(t){f(t);}}),I.command("revoke").description("Revoke a delegation").argument("<id>").option("--reason <text>").action(async(e,t)=>{try{await c(ue,{id:e,reason:t.reason}),h("Delegation revoked");}catch(n){f(n);}});let m$1=s.command("apps").description("OAuth/system app management");m$1.command("list").description("Apps owned by the current user").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await c(le,{pagination:{limit:e.limit,offset:0}});g(e,t.currentUserApps,{headers:["ID","ClientID","Name","Type","Status"],rows:t.currentUserApps.map(n=>[o$1(n.id,12),o$1(n.clientId,24),n.name??"-",n.type??"-",m(n.status)])});}catch(t){f(t);}}),m$1.command("get").description("Get an app by id").argument("<id>").option("-f, --format <format>").action(async(e,t)=>{try{let n=await c(ge,{id:e});if(!n.app)throw new o(`App ${e} not found`);g(t,n.app);}catch(n){f(n);}}),m$1.command("create").description("Create an OAuth app").requiredOption("--name <s>").option("--description <s>").option("--type <t>","OAUTH|SYSTEM","OAUTH").option("--actor-type <t>","USER|APP|SERVICE","APP").option("--redirect <urls>","Comma-separated redirect URIs").option("--scopes <s>","Comma-separated scopes").option("-f, --format <format>").action(async e=>{try{let t={name:e.name,description:e.description,type:(e.type??"OAUTH").toUpperCase(),actorType:(e.actorType??"APP").toUpperCase(),redirectUris:e.redirect?e.redirect.split(","):void 0,scopes:e.scopes?e.scopes.split(","):void 0},n=await c(fe,{input:t});h("App created. Client secret only shown once."),l(n.createApp);}catch(t){f(t);}}),m$1.command("update").description("Update an app").argument("<id>").option("--name <s>").option("--description <s>").option("--redirect <urls>","Comma-separated redirect URIs").option("--scopes <s>","Comma-separated scopes").option("--status <s>").option("-f, --format <format>").action(async(e,t)=>{try{let n={};if(t.name&&(n.name=t.name),t.description!==void 0&&(n.description=t.description),t.redirect&&(n.redirectUris=t.redirect.split(",")),t.scopes&&(n.scopes=t.scopes.split(",")),t.status&&(n.status=t.status.toUpperCase()),!Object.keys(n).length)throw new o("No updates specified");let l=await c(Ae,{id:e,input:n});h("App updated"),g(t,l.updateApp);}catch(n){f(n);}}),m$1.command("deactivate").description("Deactivate an app").argument("<id>").action(async e=>{try{await c(Ie,{id:e}),h("App deactivated");}catch(t){f(t);}});let f$1=s.command("sso").description("SSO (SAML/OIDC) configuration");f$1.command("get").description("Get SSO config for a tenant").requiredOption("--tenant <id>").option("-f, --format <format>").action(async e=>{try{let t=await c(he,{tenantId:e.tenant});g(e,t.getSSOConfig);}catch(t){f(t);}}),f$1.command("save").description("Save (upsert) SSO config for a tenant").requiredOption("--tenant <id>").requiredOption("--entity <s>","EntityID / Issuer").requiredOption("--sso-url <url>").option("--slo-url <url>").option("--certificate <pem>","X.509 certificate PEM").option("--enabled","Enable after save",false).option("-f, --format <format>").action(async e=>{try{let t={entityId:e.entity,ssoUrl:e.ssoUrl,sloUrl:e.sloUrl,certificate:e.certificate,enabled:!!e.enabled},n=await c(ye,{tenantId:e.tenant,input:t});h("SSO config saved"),g(e,n.saveSSOConfig);}catch(t){f(t);}}),f$1.command("delete").description("Delete SSO config for a tenant").requiredOption("--tenant <id>").action(async e=>{try{await c(we,{tenantId:e.tenant}),h("SSO config deleted");}catch(t){f(t);}});let h$1=s.command("users").description("User admin (requires admin permissions)");h$1.command("list").description("List users (admin)").option("--email <s>").option("--username <s>").option("--role <s>").option("--status <s>").option("--search <s>").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t={};e.email&&(t.email=e.email),e.username&&(t.username=e.username),e.role&&(t.role=e.role.toUpperCase()),e.status&&(t.status=e.status.toUpperCase()),e.search&&(t.search=e.search);let n$1=await c(ke,{filter:Object.keys(t).length?t:void 0,pagination:{limit:e.limit,offset:0}});g(e,n$1.users.users,{headers:["ID","Email","Username","Role","Status","Created"],rows:n$1.users.users.map(l=>[o$1(l.id,12),l.email,l.username??"-",l.role??"-",m(l.status),n(l.createdAt)])});}catch(t){f(t);}}),h$1.command("get").description("Get user by id (admin)").argument("<id>").option("-f, --format <format>").action(async(e,t)=>{try{let n=await c(Ee,{id:e});if(!n.user)throw new o(`User ${e} not found`);g(t,n.user);}catch(n){f(n);}}),h$1.command("update").description("Update a user (admin)").argument("<id>").option("--first-name <s>").option("--last-name <s>").option("--username <s>").option("--phone <s>").option("--role <s>").option("--status <s>").option("--email-verified <bool>").option("-f, --format <format>").action(async(e,t)=>{try{let n={};if(t.firstName&&(n.firstName=t.firstName),t.lastName&&(n.lastName=t.lastName),t.username&&(n.username=t.username),t.phone&&(n.phoneNumber=t.phone),t.role&&(n.role=t.role.toUpperCase()),t.status&&(n.status=t.status.toUpperCase()),t.emailVerified!==void 0&&(n.emailVerified=t.emailVerified==="true"),!Object.keys(n).length)throw new o("No updates specified");let l=await c(Se,{id:e,input:n});h("User updated"),g(t,l.updateUser);}catch(n){f(n);}});}var Re={id:"auth",version:"1.0.0",displayName:"Authentication",register(s,u){a(u),X(s);let i=s.commands.find(r=>r.name()==="auth");if(!i)throw new q("auth command group missing after registerAuthCommands");Te(i);}},Ye=Re;export{Ye as default};