@burdenoff/cli-sdk 2026.525.1 → 2026.525.2

package/dist/modules/auth/index.cjs

@@ -1,103 +1,103 @@
-'use strict';require('graphql-request');var W=require('cross-fetch');require('commander');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}var W__default=/*#__PURE__*/_interopDefault(W);async function Z(n){let s=`${n.oidcIssuer}/oidc/device/code`,i=new URLSearchParams({client_id:n.clientId,scope:"openid profile email offline_access"}),r=await W__default.default(s,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i.toString()});if(!r.ok){let p=await r.text().catch(()=>"Unknown error");throw new Error(`Device code request failed (${r.status}): ${p}`)}let a=await r.json();return {deviceCode:a.device_code,userCode:a.user_code,verificationUri:a.verification_uri,verificationUriComplete:a.verification_uri_complete??null,expiresIn:a.expires_in,interval:a.interval??5}}async function ee(n,s,i){let r=`${i.oidcIssuer}/oauth/device/token`,a=s;for(;;){await new Promise(I=>setTimeout(I,a*1e3));let p=await W__default.default(r,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"urn:ietf:params:oauth:grant-type:device_code",device_code:n,client_id:i.clientId}).toString()}),c=await p.json();if(p.ok&&c.access_token)return {accessToken:c.access_token,refreshToken:c.refresh_token??"",expiresIn:c.expires_in??3600};let d=c.error;switch(d){case "authorization_pending":continue;case "slow_down":a+=5;continue;case "expired_token":throw new Error("Device code has expired. Please try again.");case "access_denied":throw new Error("Authorization was denied by the user.");default:throw new Error(`Device code polling failed: ${c.error_description??d??"Unknown error"}`)}}}async function V(n,s,i,r){let p=await W__default.default(n,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({query:`
+'use strict';require('graphql-request');var Y=require('cross-fetch');require('commander');function _interopDefault(e){return e&&e.__esModule?e:{default:e}}var Y__default=/*#__PURE__*/_interopDefault(Y);async function ot(n){let s=`${n.oidcIssuer}/oidc/device/code`,i=new URLSearchParams({client_id:n.clientId,scope:"openid profile email offline_access"}),r=await Y__default.default(s,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:i.toString()});if(!r.ok){let p=await r.text().catch(()=>"Unknown error");throw new Error(`Device code request failed (${r.status}): ${p}`)}let a=await r.json();return {deviceCode:a.device_code,userCode:a.user_code,verificationUri:a.verification_uri,verificationUriComplete:a.verification_uri_complete??null,expiresIn:a.expires_in,interval:a.interval??5}}async function it(n,s,i){let r=`${i.oidcIssuer}/oauth/device/token`,a=s;for(;;){await new Promise(m=>setTimeout(m,a*1e3));let p=await Y__default.default(r,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"urn:ietf:params:oauth:grant-type:device_code",device_code:n,client_id:i.clientId}).toString()}),c=await p.json();if(p.ok&&c.access_token)return {accessToken:c.access_token,refreshToken:c.refresh_token??"",expiresIn:c.expires_in??3600};let u=c.error;switch(u){case "authorization_pending":continue;case "slow_down":a+=5;continue;case "expired_token":throw new Error("Device code has expired. Please try again.");case "access_denied":throw new Error("Authorization was denied by the user.");default:throw new Error(`Device code polling failed: ${c.error_description??u??"Unknown error"}`)}}}async function G(n,s,i,r){let p=await Y__default.default(n,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({query:`
     mutation AuthenticateApp($input: AuthenticateAppInput!) {
       authenticateApp(input: $input) {
         accessToken tokenType expiresIn scopes
       }
     }
-  `,variables:{input:{clientId:s,clientSecret:i,scopes:r}}})});if(!p.ok){let d=await p.text().catch(()=>"Unknown error");throw new Error(`App authentication failed (${p.status}): ${d}`)}let c=await p.json();if(c.errors?.length)throw new Error(`App authentication failed: ${c.errors[0]?.message??"unknown error"}`);if(!c.data?.authenticateApp?.accessToken)throw new Error("App authentication failed: no access token returned");return c.data.authenticateApp}async function v(n,s,i,r){let p=await W__default.default(n,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${s}`},body:JSON.stringify({query:`
+  `,variables:{input:{clientId:s,clientSecret:i,scopes:r}}})});if(!p.ok){let u=await p.text().catch(()=>"Unknown error");throw new Error(`App authentication failed (${p.status}): ${u}`)}let c=await p.json();if(c.errors?.length)throw new Error(`App authentication failed: ${c.errors[0]?.message??"unknown error"}`);if(!c.data?.authenticateApp?.accessToken)throw new Error("App authentication failed: no access token returned");return c.data.authenticateApp}async function R(n,s,i,r){let p=await Y__default.default(n,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${s}`},body:JSON.stringify({query:`
     mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {
       issueWorkspaceToken(input: $input) {
         success token expiresAt scopes
         error { code message }
       }
     }
-  `,variables:{input:{workspaceId:i,organizationId:r}}})});if(!p.ok){let I=await p.text().catch(()=>"Unknown error");throw new Error(`Workspace token request failed (${p.status}): ${I}`)}let c=await p.json();if(c.errors?.length)throw new Error(`Workspace token failed: ${c.errors[0]?.message??"unknown error"}`);let d=c.data?.issueWorkspaceToken;if(!d?.success||!d.token){let I=d?.error?.message??"Unknown error";throw new Error(`Workspace token failed: ${I}`)}return {token:d.token,expiresAt:d.expiresAt??"",scopes:d.scopes??[]}}async function H(n,s){let r=await W__default.default(n,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${s}`},body:JSON.stringify({query:`
+  `,variables:{input:{workspaceId:i,organizationId:r}}})});if(!p.ok){let m=await p.text().catch(()=>"Unknown error");throw new Error(`Workspace token request failed (${p.status}): ${m}`)}let c=await p.json();if(c.errors?.length)throw new Error(`Workspace token failed: ${c.errors[0]?.message??"unknown error"}`);let u=c.data?.issueWorkspaceToken;if(!u?.success||!u.token){let m=u?.error?.message??"Unknown error";throw new Error(`Workspace token failed: ${m}`)}return {token:u.token,expiresAt:u.expiresAt??"",scopes:u.scopes??[]}}async function z(n,s){let r=await Y__default.default(n,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${s}`},body:JSON.stringify({query:`
     query MyWorkspaces($limit: Int) {
       myWorkspaces(limit: $limit) {
         items { id name slug tenantId organizationId }
       }
     }
-  `,variables:{limit:50}})});if(!r.ok){let p=await r.text().catch(()=>"Unknown error");throw new Error(`Failed to fetch workspaces (${r.status}): ${p}`)}let a=await r.json();if(a.errors?.length)throw new Error(`Failed to fetch workspaces: ${a.errors[0]?.message??"unknown error"}`);return a.data?.myWorkspaces?.items??[]}function Ze(n){try{let s=new URL(n);return s.protocol==="http:"||s.protocol==="https:"}catch{return  false}}async function te(n){try{if(!Ze(n))return !1;let{execFile:s}=await import('child_process'),i=process.platform,r,a;return i==="darwin"?(r="open",a=[n]):i==="win32"?(r="cmd",a=["/c","start","",n]):(r="xdg-open",a=[n]),new Promise(p=>{s(r,a,c=>{p(!c);});})}catch{return  false}}var S=class extends Error{exitCode;hint;constructor(s,i){super(s),this.name="CliUserError",this.exitCode=i?.exitCode??1,this.hint=i?.hint;}};var x=class extends Error{cause;constructor(s,i){super(s),this.name="CliInternalError",this.cause=i;}};var pe=null;function me(n){pe=n;}function E(){if(!pe)throw new x("vibecontrols module helpers used before setHelpersContext was called");return pe}async function l(n,s){return E().gql.global.request(n,s)}async function ue(n,s){return E().gql.global.request(n,s)}function C(){E().gql.reset();}function u(n){let s=n instanceof Error?n.message:String(n);throw new S(s)}function m(n,s,i){E().output.formatAndOutput(n,s,i);}function g(n){E().output.printSuccess(n);}function k(n){E().output.printInfo(n);}function R(n){E().output.printWarning(n);}function z(n){E().output.printJson(n);}function j(n){return E().output.formatStatus(n)}function _(n){return E().output.formatDate(n)}function q(n,s){return E().output.truncate(n,s)}function G(){return E().auth.read()}function O(n){E().auth.write(n);}function Ie(){E().auth.clear();}function F(){return E().config.read()}function fe(){return E().config.resolveOIDC()}function $e(n){return n?n.expiresAt?Date.now()>=n.expiresAt:false:E().auth.isTokenExpired()}var ke="mutation { signOut }",ye=`
+  `,variables:{limit:50}})});if(!r.ok){let p=await r.text().catch(()=>"Unknown error");throw new Error(`Failed to fetch workspaces (${r.status}): ${p}`)}let a=await r.json();if(a.errors?.length)throw new Error(`Failed to fetch workspaces: ${a.errors[0]?.message??"unknown error"}`);return a.data?.myWorkspaces?.items??[]}function fe(n){try{let s=new URL(n);return s.protocol==="http:"||s.protocol==="https:"}catch{return  false}}async function rt(n){try{if(!fe(n))return !1;let{execFile:s}=await import('child_process'),i=process.platform,r,a;return i==="darwin"?(r="open",a=[n]):i==="win32"?(r="cmd",a=["/c","start","",n]):(r="xdg-open",a=[n]),new Promise(p=>{s(r,a,c=>{p(!c);});})}catch{return  false}}var E=class extends Error{exitCode;hint;constructor(s,i){super(s),this.name="CliUserError",this.exitCode=i?.exitCode??1,this.hint=i?.hint;}};var k=class extends Error{cause;constructor(s,i){super(s),this.name="CliInternalError",this.cause=i;}};var St=null;function Ct(n){St=n;}function T(){if(!St)throw new k("vibecontrols module helpers used before setHelpersContext was called");return St}async function l(n,s){return T().gql.global.request(n,s)}async function Et(n,s){return T().gql.global.request(n,s)}function b(){T().gql.reset();}function d(n){let s=n instanceof Error?n.message:String(n);throw new E(s)}function g(n,s,i){T().output.formatAndOutput(n,s,i);}function I(n){T().output.printSuccess(n);}function x(n){T().output.printInfo(n);}function v(n){T().output.printWarning(n);}function j(n){T().output.printJson(n);}function X(n){return T().output.formatStatus(n)}function h(n){return T().output.formatDate(n)}function q(n,s){return T().output.truncate(n,s)}function F(){return T().auth.read()}function N(n){T().auth.write(n);}function _t(){T().auth.clear();}function M(){return T().config.read()}function kt(){return T().config.resolveOIDC()}function bt(n){return n?n.expiresAt?Date.now()>=n.expiresAt:false:T().auth.isTokenExpired()}var vt="mutation { signOut }",Pt=`
   mutation RefreshToken($token: String!) {
     refreshToken(token: $token) { accessToken refreshToken expiresIn }
   }
-`;function De(n){let s=n.command("auth").description("Authentication commands");s.command("login").description("Authenticate with VibeControls").option("--client-credentials","Authenticate as an app with client ID and secret").option("--workspace-id <id>","Workspace ID (for app auth)").action(async i=>{try{i.clientCredentials?await pt(i.workspaceId):await ct();}catch(r){u(r);}}),s.command("logout").description("Revoke tokens and clear stored auth").action(async()=>{try{if(G()?.accessToken)try{await ue(ke);}catch{R("Server-side logout failed, clearing local tokens");}Ie(),C(),g("Logged out successfully");}catch(i){u(i);}}),s.command("status").description("Show current auth state").option("-f, --format <format>","Output format (json, table)").action(i=>{let r=G(),a=F(),p=!!r?.accessToken,c=r?.accessToken?$e(r):false,d=r?.expiresAt?_(new Date(r.expiresAt).toISOString()):"-",I=r?.authMethod==="client_credentials"?"Client Credentials":"OAuth2 Device Code",e=r?.workspaceTokenExpiresAt?_(new Date(r.workspaceTokenExpiresAt).toISOString()):"-";m(i,{authenticated:p,method:I,expired:c,expiresAt:d,workspaceId:r?.workspaceId??"-",organizationId:r?.organizationId??"-",workspaceTokenExpiresAt:e,workspaceEndpoint:a.workspaceEndpoint,globalEndpoint:a.globalEndpoint},{headers:["Key","Value"],rows:[["Authenticated",String(p)],["Method",I],["Expired",String(c)],["Expires At",d],["Workspace ID",r?.workspaceId??"-"],["Organization ID",r?.organizationId??"-"],["Workspace Token Expires",e],["Workspace Endpoint",a.workspaceEndpoint],["Global Endpoint",a.globalEndpoint]]});}),s.command("token").description("Print access token to stdout").option("--workspace","Print workspace token instead").action(i=>{let r=G();if(i.workspace){if(!r?.workspaceToken)throw new S("No workspace token. Set a workspace: vibecontrols workspace set <id>");process.stdout.write(r.workspaceToken);return}if(!r?.accessToken)throw new S("Not authenticated. Run: vibecontrols auth login");process.stdout.write(r.accessToken);}),s.command("refresh").description("Force token refresh").action(async()=>{try{let i=G();if(!i?.refreshToken&&i?.authMethod!=="client_credentials")throw new S("No refresh token available. Run: vibecontrols auth login");if(i?.authMethod==="client_credentials"&&i.clientId&&i.clientSecret){let p=F(),c=await V(p.globalEndpoint,i.clientId,i.clientSecret);O({...i,accessToken:c.accessToken,expiresAt:Date.now()+c.expiresIn*1e3}),C(),g("App token refreshed successfully"),i.workspaceId&&i.organizationId&&await he();return}let a=(await ue(ye,{token:i.refreshToken})).refreshToken;O({...i,accessToken:a.accessToken,refreshToken:a.refreshToken,expiresAt:Date.now()+a.expiresIn*1e3}),C(),g("Token refreshed successfully"),i.workspaceId&&i.organizationId&&await he();}catch(i){u(i);}});}async function he(){let n=G();if(!n?.accessToken||!n.workspaceId||!n.organizationId)return;let s=F();try{let i=await v(s.workspaceEndpoint,n.accessToken,n.workspaceId,n.organizationId);O({...n,workspaceToken:i.token,workspaceTokenExpiresAt:new Date(i.expiresAt).getTime()}),C(),g("Workspace token refreshed");}catch{R("Workspace token refresh failed \u2014 workspace operations may require re-login");}}async function ct(){let n=F(),{oidcIssuer:s,clientId:i}=fe(),r={...n,oidcIssuer:s,clientId:i};k("Starting device code authentication...");let a=await Z(r);console.log(""),console.log(`  Open: ${a.verificationUri}`),console.log(`  Code: ${a.userCode}`),console.log(""),await te(a.verificationUriComplete??a.verificationUri)?k("Browser opened"):R("Could not open browser \u2014 open the URL manually"),k("Waiting for authorization...");let c=await ee(a.deviceCode,a.interval,r),d=c.accessToken,I=Date.now()+c.expiresIn*1e3;k("Fetching workspaces...");try{let e=await H(n.globalEndpoint,d);if(e.length===0){O({accessToken:d,refreshToken:c.refreshToken,expiresAt:I,authMethod:"device_code"}),C(),g("Authentication successful (no workspaces found)");return}let t=e[0];if(e.length>1){console.log(`
-Available workspaces:`),e.forEach((Q,ce)=>console.log(`  ${ce+1}. ${Q.name} (${Q.slug})`));let A=(await import('readline')).createInterface({input:process.stdin,output:process.stdout}),$=await new Promise(Q=>{A.question(`
-Select workspace [1-${e.length}]: `,ce=>{A.close(),Q(ce.trim());});}),w=parseInt($,10)-1;w>=0&&w<e.length&&(t=e[w]);}k(`Using workspace: ${t.name} (${t.id})`);let o=await v(n.workspaceEndpoint,d,t.id,t.organizationId);O({accessToken:d,refreshToken:c.refreshToken,expiresAt:I,workspaceToken:o.token,workspaceTokenExpiresAt:new Date(o.expiresAt).getTime(),workspaceId:t.id,organizationId:t.organizationId,authMethod:"device_code"}),C(),g("Authentication successful");}catch(e){O({accessToken:d,refreshToken:c.refreshToken,expiresAt:I,authMethod:"device_code"}),C(),g("Authentication successful"),R(`Workspace token not obtained: ${e instanceof Error?e.message:String(e)}`),k("Set workspace manually: vibecontrols workspace set <id>");}}async function pt(n){let s=F(),r=(await import('readline')).createInterface({input:process.stdin,output:process.stdout}),a=await new Promise(A=>{r.question("Client ID: ",$=>A($.trim()));}),p=await new Promise(A=>{r.question("Client Secret: ",$=>{r.close(),A($.trim());});});if(!a||!p)throw new S("Client ID and secret cannot be empty");k("Authenticating app...");let c=await V(s.globalEndpoint,a,p),d=c.accessToken,I=Date.now()+c.expiresIn*1e3,e,t,o=n,f;if(o)try{let $=(await H(s.globalEndpoint,d)).find(w=>w.id===o);if($){f=$.organizationId;let w=await v(s.workspaceEndpoint,d,o,f);e=w.token,t=new Date(w.expiresAt).getTime(),k(`Workspace token issued for: ${$.name}`);}else R(`Workspace ${o} not found \u2014 skipping workspace token`),o=void 0;}catch(A){R(`Workspace token failed: ${A instanceof Error?A.message:String(A)}`);}O({accessToken:d,refreshToken:"",expiresAt:I,workspaceToken:e,workspaceTokenExpiresAt:t,workspaceId:o,organizationId:f,authMethod:"client_credentials",clientId:a,clientSecret:p}),C(),g("App authentication successful");}var xe=`
+`;function Wt(n){let s=n.command("auth").description("Authentication commands");s.command("login").description("Authenticate with VibeControls").option("--client-credentials","Authenticate as an app with client ID and secret").option("--workspace-id <id>","Workspace ID (for app auth)").action(async i=>{try{i.clientCredentials?await Oe(i.workspaceId):await he();}catch(r){d(r);}}),s.command("logout").description("Revoke tokens and clear stored auth").action(async()=>{try{if(F()?.accessToken)try{await Et(vt);}catch{v("Server-side logout failed, clearing local tokens");}_t(),b(),I("Logged out successfully");}catch(i){d(i);}}),s.command("status").description("Show current auth state").option("-f, --format <format>","Output format (json, table)").action(i=>{let r=F(),a=M(),p=!!r?.accessToken,c=r?.accessToken?bt(r):false,u=r?.expiresAt?h(new Date(r.expiresAt).toISOString()):"-",m=r?.authMethod==="client_credentials"?"Client Credentials":"OAuth2 Device Code",t=r?.workspaceTokenExpiresAt?h(new Date(r.workspaceTokenExpiresAt).toISOString()):"-";g(i,{authenticated:p,method:m,expired:c,expiresAt:u,workspaceId:r?.workspaceId??"-",organizationId:r?.organizationId??"-",workspaceTokenExpiresAt:t,workspaceEndpoint:a.workspaceEndpoint,globalEndpoint:a.globalEndpoint},{headers:["Key","Value"],rows:[["Authenticated",String(p)],["Method",m],["Expired",String(c)],["Expires At",u],["Workspace ID",r?.workspaceId??"-"],["Organization ID",r?.organizationId??"-"],["Workspace Token Expires",t],["Workspace Endpoint",a.workspaceEndpoint],["Global Endpoint",a.globalEndpoint]]});}),s.command("token").description("Print access token to stdout").option("--workspace","Print workspace token instead").action(i=>{let r=F();if(i.workspace){if(!r?.workspaceToken)throw new E("No workspace token. Set a workspace: vibecontrols workspace set <id>");process.stdout.write(r.workspaceToken);return}if(!r?.accessToken)throw new E("Not authenticated. Run: vibecontrols auth login");process.stdout.write(r.accessToken);}),s.command("refresh").description("Force token refresh").action(async()=>{try{let i=F();if(!i?.refreshToken&&i?.authMethod!=="client_credentials")throw new E("No refresh token available. Run: vibecontrols auth login");if(i?.authMethod==="client_credentials"&&i.clientId&&i.clientSecret){let p=M(),c=await G(p.globalEndpoint,i.clientId,i.clientSecret);N({...i,accessToken:c.accessToken,expiresAt:Date.now()+c.expiresIn*1e3}),b(),I("App token refreshed successfully"),i.workspaceId&&i.organizationId&&await Ht();return}let a=(await Et(Pt,{token:i.refreshToken})).refreshToken;N({...i,accessToken:a.accessToken,refreshToken:a.refreshToken,expiresAt:Date.now()+a.expiresIn*1e3}),b(),I("Token refreshed successfully"),i.workspaceId&&i.organizationId&&await Ht();}catch(i){d(i);}});}async function Ht(){let n=F();if(!n?.accessToken||!n.workspaceId||!n.organizationId)return;let s=M();try{let i=await R(s.workspaceEndpoint,n.accessToken,n.workspaceId,n.organizationId);N({...n,workspaceToken:i.token,workspaceTokenExpiresAt:new Date(i.expiresAt).getTime()}),b(),I("Workspace token refreshed");}catch{v("Workspace token refresh failed \u2014 workspace operations may require re-login");}}async function he(){let n=M(),{oidcIssuer:s,clientId:i}=kt(),r={...n,oidcIssuer:s,clientId:i};x("Starting device code authentication...");let a=await ot(r);console.log(""),console.log(`  Open: ${a.verificationUri}`),console.log(`  Code: ${a.userCode}`),console.log(""),await rt(a.verificationUriComplete??a.verificationUri)?x("Browser opened"):v("Could not open browser \u2014 open the URL manually"),x("Waiting for authorization...");let c=await it(a.deviceCode,a.interval,r),u=c.accessToken,m=Date.now()+c.expiresIn*1e3;x("Fetching workspaces...");try{let t=await z(n.globalEndpoint,u);if(t.length===0){N({accessToken:u,refreshToken:c.refreshToken,expiresAt:m,authMethod:"device_code"}),b(),I("Authentication successful (no workspaces found)");return}let e=t[0];if(t.length>1){console.log(`
+Available workspaces:`),t.forEach((nt,$t)=>console.log(`  ${$t+1}. ${nt.name} (${nt.slug})`));let A=(await import('readline')).createInterface({input:process.stdin,output:process.stdout}),S=await new Promise(nt=>{A.question(`
+Select workspace [1-${t.length}]: `,$t=>{A.close(),nt($t.trim());});}),O=parseInt(S,10)-1;O>=0&&O<t.length&&(e=t[O]);}x(`Using workspace: ${e.name} (${e.id})`);let o=await R(n.workspaceEndpoint,u,e.id,e.organizationId);N({accessToken:u,refreshToken:c.refreshToken,expiresAt:m,workspaceToken:o.token,workspaceTokenExpiresAt:new Date(o.expiresAt).getTime(),workspaceId:e.id,organizationId:e.organizationId,authMethod:"device_code"}),b(),I("Authentication successful");}catch(t){N({accessToken:u,refreshToken:c.refreshToken,expiresAt:m,authMethod:"device_code"}),b(),I("Authentication successful"),v(`Workspace token not obtained: ${t instanceof Error?t.message:String(t)}`),x("Set workspace manually: vibecontrols workspace set <id>");}}async function Oe(n){let s=M(),r=(await import('readline')).createInterface({input:process.stdin,output:process.stdout}),a=await new Promise(A=>{r.question("Client ID: ",S=>A(S.trim()));}),p=await new Promise(A=>{r.question("Client Secret: ",S=>{r.close(),A(S.trim());});});if(!a||!p)throw new E("Client ID and secret cannot be empty");x("Authenticating app...");let c=await G(s.globalEndpoint,a,p),u=c.accessToken,m=Date.now()+c.expiresIn*1e3,t,e,o=n,$;if(o)try{let S=(await z(s.globalEndpoint,u)).find(O=>O.id===o);if(S){$=S.organizationId;let O=await R(s.workspaceEndpoint,u,o,$);t=O.token,e=new Date(O.expiresAt).getTime(),x(`Workspace token issued for: ${S.name}`);}else v(`Workspace ${o} not found \u2014 skipping workspace token`),o=void 0;}catch(A){v(`Workspace token failed: ${A instanceof Error?A.message:String(A)}`);}N({accessToken:u,refreshToken:"",expiresAt:m,workspaceToken:t,workspaceTokenExpiresAt:e,workspaceId:o,organizationId:$,authMethod:"client_credentials",clientId:a,clientSecret:p}),b(),I("App authentication successful");}var Yt=`
   query currentUser {
     currentUser {
       id email firstName lastName username phoneNumber name
       emailVerified mfaEnabled isAdmin role status createdAt lastLoginAt
     }
   }
-`,Ce=`
+`,zt=`
   mutation updateCurrentUserProfile($input: UpdateUserInput!) {
     updateCurrentUserProfile(input: $input) {
       id name firstName lastName username phoneNumber timezone language
     }
   }
-`,le=`
+`,Dt=`
   query authAuditLogs($pagination: PaginationInput) {
     authAuditLogs(pagination: $pagination) {
       id action resource resourceType resourceId description
       ipAddress userAgent metadata createdAt
     }
   }
-`,_e=`
+`,jt=`
   query activeSessions($pagination: PaginationInput) {
     activeSessions(pagination: $pagination) {
       id status ipAddress userAgent location lastActivityAt expiresAt createdAt isCurrent
     }
   }
-`,be=`
+`,Xt=`
   query currentUserMFAMethods($pagination: PaginationInput) {
     currentUserMFAMethods(pagination: $pagination) {
       id method status createdAt updatedAt
     }
   }
-`,we=`
+`,Jt=`
   mutation setupMFA($method: MFAMethod!) {
     setupMFA(method: $method) {
       method backupCodes qrCode secret
     }
   }
-`;var Oe=`
+`;var Qt=`
   mutation enableMFA($code: String!) {
     enableMFA(code: $code)
   }
-`,Ne=`
+`,Zt=`
   mutation disableMFA {
     disableMFA
   }
-`,ve=`
+`,te=`
   query myApiKeys($pagination: PaginationInput) {
     myApiKeys(pagination: $pagination) {
       id name prefix appId appName scopes expiresAt lastUsedAt createdAt
     }
   }
-`,Re=`
+`,ee=`
   query appApiKeys($appId: ID!, $pagination: PaginationInput) {
     appApiKeys(appId: $appId, pagination: $pagination) {
       id name prefix appId appName scopes expiresAt lastUsedAt createdAt
     }
   }
-`,Ue=`
+`,ne=`
   mutation generateAPIKey($input: GenerateAPIKeyInput!) {
     generateAPIKey(input: $input) {
       keyId apiKey apiSecret
     }
   }
-`;var Le=`
+`;var oe=`
   mutation revokeAPIKey($keyId: String!) {
     revokeAPIKey(keyId: $keyId)
   }
-`,Pe=`
+`,ie=`
   mutation rotateAPIKey($keyId: String!) {
     rotateAPIKey(keyId: $keyId) {
       apiSecret
     }
   }
-`,Ve=`
+`,re=`
   query currentUserDelegations($pagination: PaginationInput) {
     currentUserDelegations(pagination: $pagination) {
       id appId userId grantedBy grantedAt expiresAt scopes workspaceIds
@@ -105,79 +105,79 @@ Select workspace [1-${e.length}]: `,ce=>{A.close(),Q(ce.trim());});}),w=parseInt
       app { id name }
     }
   }
-`,qe=`
+`,se=`
   mutation grantDelegation($input: GrantDelegationInput!) {
     grantDelegation(input: $input) {
       id appId userId grantedBy grantedAt expiresAt scopes workspaceIds status
     }
   }
-`,Ge=`
+`,ae=`
   mutation revokeDelegation($id: ID!, $reason: String) {
     revokeDelegation(id: $id, reason: $reason)
   }
-`,Fe=`
+`,ce=`
   query currentUserApps($pagination: PaginationInput) {
     currentUserApps(pagination: $pagination) {
       id clientId name description type actorType status ownerUserId
       redirectUris scopes createdAt updatedAt
     }
   }
-`,Be=`
+`,pe=`
   query app($id: ID!) {
     app(id: $id) {
       id clientId name description type actorType status ownerUserId redirectUris scopes
     }
   }
-`,Me=`
+`,de=`
   mutation createApp($input: CreateAppInput!) {
     createApp(input: $input) {
       app { id clientId name type status }
       clientSecret
     }
   }
-`,Ke=`
+`,ue=`
   mutation updateApp($id: ID!, $input: UpdateAppInput!) {
     updateApp(id: $id, input: $input) {
       id name description redirectUris scopes status
     }
   }
-`,We=`
+`,le=`
   mutation deactivateApp($id: ID!) {
     deactivateApp(id: $id)
   }
-`,He=`
+`,Ie=`
   query getSSOConfig($tenantId: String!) {
     getSSOConfig(tenantId: $tenantId) {
       id identifier tenantId entityId ssoUrl sloUrl certificate enabled metadata
     }
   }
-`,ze=`
+`,ge=`
   mutation saveSSOConfig($tenantId: String!, $input: SSOConfigInput!) {
     saveSSOConfig(tenantId: $tenantId, input: $input) {
       id identifier entityId ssoUrl sloUrl certificate enabled
     }
   }
-`,je=`
+`,me=`
   mutation deleteSSOConfig($tenantId: String!) {
     deleteSSOConfig(tenantId: $tenantId)
   }
-`,Ye=`
+`,$e=`
   query users($filter: UserFilterInput, $pagination: PaginationInput) {
     users(filter: $filter, pagination: $pagination) {
       users { id email firstName lastName username role status createdAt }
       totalCount hasMore
     }
   }
-`,Je=`
+`,Se=`
   query user($id: ID!) {
     user(id: $id) {
       id email firstName lastName username role status emailVerified lastLoginAt
     }
   }
-`,Xe=`
+`,Ee=`
   mutation updateUser($id: ID!, $input: AdminUpdateUserInput!) {
     updateUser(id: $id, input: $input) {
       id email firstName lastName username role status
     }
   }
-`;function Qe(n){let s=n.command("profile").description("Current user profile");s.command("show").description("Show current user").option("-f, --format <format>").action(async e=>{try{let t=await l(xe);m(e,t.currentUser);}catch(t){u(t);}}),s.command("update").description("Update current user profile").option("--first-name <s>").option("--last-name <s>").option("--name <s>").option("--username <s>").option("--phone <s>").option("--timezone <s>").option("--language <s>").option("-f, --format <format>").action(async e=>{try{let t={};if(e.firstName&&(t.firstName=e.firstName),e.lastName&&(t.lastName=e.lastName),e.name&&(t.name=e.name),e.username&&(t.username=e.username),e.phone&&(t.phoneNumber=e.phone),e.timezone&&(t.timezone=e.timezone),e.language&&(t.language=e.language),!Object.keys(t).length)throw new S("No updates specified");let o=await l(Ce,{input:t});g("Profile updated"),m(e,o.updateCurrentUserProfile);}catch(t){u(t);}});let i=n.command("security").description("Account security overview");i.command("audit-log").description("Recent auth audit events for the current user").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await l(le,{pagination:{limit:e.limit,offset:0}});m(e,t.authAuditLogs,{headers:["When","Action","Resource","IP"],rows:t.authAuditLogs.map(o=>[_(o.createdAt),o.action,o.resource??"-",o.ipAddress??"-"])});}catch(t){u(t);}}),i.command("sessions").description("Active sessions for the current user").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await l(_e,{pagination:{limit:e.limit,offset:0}});m(e,t.activeSessions,{headers:["ID","Status","IP","LastActivity","Current"],rows:t.activeSessions.map(o=>[q(o.id,12),j(o.status),o.ipAddress??"-",_(o.lastActivityAt),String(!!o.isCurrent)])});}catch(t){u(t);}});let r=n.command("mfa").description("Multi-factor authentication");r.command("list").description("List MFA methods enrolled for the current user").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await l(be,{pagination:{limit:e.limit,offset:0}});m(e,t.currentUserMFAMethods,{headers:["Method","Status","Created"],rows:t.currentUserMFAMethods.map(o=>[o.method,j(o.status),_(o.createdAt)])});}catch(t){u(t);}}),r.command("enroll").description("Begin MFA enrollment (TOTP/SMS/EMAIL)").requiredOption("--method <m>","TOTP|SMS|EMAIL").option("-f, --format <format>").action(async e=>{try{let t=await l(we,{method:e.method.toUpperCase()});e.format?m(e,t.setupMFA):(g("MFA enrollment started"),z(t.setupMFA),k("Save your backup codes; verify with `auth mfa verify --code <CODE>`."));}catch(t){u(t);}}),r.command("verify").description("Verify MFA enrollment code").requiredOption("--code <code>").action(async e=>{try{await l(Oe,{code:e.code}),g("MFA enabled");}catch(t){u(t);}}),r.command("disable").description("Disable MFA for the current user").action(async()=>{try{await l(Ne),g("MFA disabled");}catch(e){u(e);}});let a=n.command("api-keys").description("API key management");a.command("list").description("List your API keys").option("--app <id>","Restrict to keys for an app id").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=e.app?Re:ve,o=e.app?{appId:e.app,pagination:{limit:e.limit,offset:0}}:{pagination:{limit:e.limit,offset:0}},f=await l(t,o),A=f.myApiKeys??f.appApiKeys??[];m(e,A,{headers:["ID","Name","Prefix","App","Scopes","LastUsed"],rows:A.map($=>[q($.id,12),$.name??"-",$.prefix??"-",$.appName??"-",Array.isArray($.scopes)?$.scopes.join(","):"-",_($.lastUsedAt)])});}catch(t){u(t);}}),a.command("create").description("Generate a new API key").requiredOption("--name <name>").requiredOption("--app <appId>","Owning app id").option("--scope <scope>","Comma-separated scopes").option("--expires <iso>","ISO expiry").option("-f, --format <format>").action(async e=>{try{let t={name:e.name,appId:e.app,scope:e.scope?e.scope.split(","):void 0,expiresAt:e.expires},o=await l(Ue,{input:t});g("API key generated. Store the secret \u2014 it is only shown once."),z(o.generateAPIKey);}catch(t){u(t);}}),a.command("revoke").description("Revoke an API key").argument("<keyId>").action(async e=>{try{await l(Le,{keyId:e}),g("API key revoked");}catch(t){u(t);}}),a.command("rotate").description("Rotate an API key (returns new secret)").argument("<keyId>").action(async e=>{try{let t=await l(Pe,{keyId:e});g("API key rotated"),z(t.rotateAPIKey);}catch(t){u(t);}}),n.command("audit-log").description("Auth audit log").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await l(le,{pagination:{limit:e.limit,offset:0}});m(e,t.authAuditLogs);}catch(t){u(t);}});let p=n.command("delegations").description("Delegation management");p.command("list").description("Delegations granted to the current user").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await l(Ve,{pagination:{limit:e.limit,offset:0}});m(e,t.currentUserDelegations);}catch(t){u(t);}}),p.command("grant").description("Grant a delegation to an app").requiredOption("--app <appId>").requiredOption("--user <userId>","User to delegate as").option("--scope <s>","Comma-separated scopes").option("--workspace <ids>","Comma-separated workspace ids").option("--expires <iso>").option("-f, --format <format>").action(async e=>{try{let t={appId:e.app,userId:e.user,scopes:e.scope?e.scope.split(","):void 0,workspaceIds:e.workspace?e.workspace.split(","):void 0,expiresAt:e.expires},o=await l(qe,{input:t});g("Delegation granted"),m(e,o.grantDelegation);}catch(t){u(t);}}),p.command("revoke").description("Revoke a delegation").argument("<id>").option("--reason <text>").action(async(e,t)=>{try{await l(Ge,{id:e,reason:t.reason}),g("Delegation revoked");}catch(o){u(o);}});let c=n.command("apps").description("OAuth/system app management");c.command("list").description("Apps owned by the current user").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t=await l(Fe,{pagination:{limit:e.limit,offset:0}});m(e,t.currentUserApps,{headers:["ID","ClientID","Name","Type","Status"],rows:t.currentUserApps.map(o=>[q(o.id,12),q(o.clientId,24),o.name??"-",o.type??"-",j(o.status)])});}catch(t){u(t);}}),c.command("get").description("Get an app by id").argument("<id>").option("-f, --format <format>").action(async(e,t)=>{try{let o=await l(Be,{id:e});if(!o.app)throw new S(`App ${e} not found`);m(t,o.app);}catch(o){u(o);}}),c.command("create").description("Create an OAuth app").requiredOption("--name <s>").option("--description <s>").option("--type <t>","OAUTH|SYSTEM","OAUTH").option("--actor-type <t>","USER|APP|SERVICE","APP").option("--redirect <urls>","Comma-separated redirect URIs").option("--scopes <s>","Comma-separated scopes").option("-f, --format <format>").action(async e=>{try{let t={name:e.name,description:e.description,type:(e.type??"OAUTH").toUpperCase(),actorType:(e.actorType??"APP").toUpperCase(),redirectUris:e.redirect?e.redirect.split(","):void 0,scopes:e.scopes?e.scopes.split(","):void 0},o=await l(Me,{input:t});g("App created. Client secret only shown once."),z(o.createApp);}catch(t){u(t);}}),c.command("update").description("Update an app").argument("<id>").option("--name <s>").option("--description <s>").option("--redirect <urls>","Comma-separated redirect URIs").option("--scopes <s>","Comma-separated scopes").option("--status <s>").option("-f, --format <format>").action(async(e,t)=>{try{let o={};if(t.name&&(o.name=t.name),t.description!==void 0&&(o.description=t.description),t.redirect&&(o.redirectUris=t.redirect.split(",")),t.scopes&&(o.scopes=t.scopes.split(",")),t.status&&(o.status=t.status.toUpperCase()),!Object.keys(o).length)throw new S("No updates specified");let f=await l(Ke,{id:e,input:o});g("App updated"),m(t,f.updateApp);}catch(o){u(o);}}),c.command("deactivate").description("Deactivate an app").argument("<id>").action(async e=>{try{await l(We,{id:e}),g("App deactivated");}catch(t){u(t);}});let d=n.command("sso").description("SSO (SAML/OIDC) configuration");d.command("get").description("Get SSO config for a tenant").requiredOption("--tenant <id>").option("-f, --format <format>").action(async e=>{try{let t=await l(He,{tenantId:e.tenant});m(e,t.getSSOConfig);}catch(t){u(t);}}),d.command("save").description("Save (upsert) SSO config for a tenant").requiredOption("--tenant <id>").requiredOption("--entity <s>","EntityID / Issuer").requiredOption("--sso-url <url>").option("--slo-url <url>").option("--certificate <pem>","X.509 certificate PEM").option("--enabled","Enable after save",false).option("-f, --format <format>").action(async e=>{try{let t={entityId:e.entity,ssoUrl:e.ssoUrl,sloUrl:e.sloUrl,certificate:e.certificate,enabled:!!e.enabled},o=await l(ze,{tenantId:e.tenant,input:t});g("SSO config saved"),m(e,o.saveSSOConfig);}catch(t){u(t);}}),d.command("delete").description("Delete SSO config for a tenant").requiredOption("--tenant <id>").action(async e=>{try{await l(je,{tenantId:e.tenant}),g("SSO config deleted");}catch(t){u(t);}});let I=n.command("users").description("User admin (requires admin permissions)");I.command("list").description("List users (admin)").option("--email <s>").option("--username <s>").option("--role <s>").option("--status <s>").option("--search <s>").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let t={};e.email&&(t.email=e.email),e.username&&(t.username=e.username),e.role&&(t.role=e.role.toUpperCase()),e.status&&(t.status=e.status.toUpperCase()),e.search&&(t.search=e.search);let o=await l(Ye,{filter:Object.keys(t).length?t:void 0,pagination:{limit:e.limit,offset:0}});m(e,o.users.users,{headers:["ID","Email","Username","Role","Status","Created"],rows:o.users.users.map(f=>[q(f.id,12),f.email,f.username??"-",f.role??"-",j(f.status),_(f.createdAt)])});}catch(t){u(t);}}),I.command("get").description("Get user by id (admin)").argument("<id>").option("-f, --format <format>").action(async(e,t)=>{try{let o=await l(Je,{id:e});if(!o.user)throw new S(`User ${e} not found`);m(t,o.user);}catch(o){u(o);}}),I.command("update").description("Update a user (admin)").argument("<id>").option("--first-name <s>").option("--last-name <s>").option("--username <s>").option("--phone <s>").option("--role <s>").option("--status <s>").option("--email-verified <bool>").option("-f, --format <format>").action(async(e,t)=>{try{let o={};if(t.firstName&&(o.firstName=t.firstName),t.lastName&&(o.lastName=t.lastName),t.username&&(o.username=t.username),t.phone&&(o.phoneNumber=t.phone),t.role&&(o.role=t.role.toUpperCase()),t.status&&(o.status=t.status.toUpperCase()),t.emailVerified!==void 0&&(o.emailVerified=t.emailVerified==="true"),!Object.keys(o).length)throw new S("No updates specified");let f=await l(Xe,{id:e,input:o});g("User updated"),m(t,f.updateUser);}catch(o){u(o);}});}var dt={id:"auth",version:"1.0.0",displayName:"Authentication",register(n,s){me(s),De(n);let i=n.commands.find(r=>r.name()==="auth");if(!i)throw new x("auth command group missing after registerAuthCommands");Qe(i);}},ur=dt;module.exports=ur;
+`;function Te(n){let s=n.command("profile").description("Current user profile");s.command("show").description("Show current user").option("-f, --format <format>").action(async t=>{try{let e=await l(Yt);g(t,e.currentUser);}catch(e){d(e);}}),s.command("update").description("Update current user profile").option("--first-name <s>").option("--last-name <s>").option("--name <s>").option("--username <s>").option("--phone <s>").option("--timezone <s>").option("--language <s>").option("-f, --format <format>").action(async t=>{try{let e={};if(t.firstName&&(e.firstName=t.firstName),t.lastName&&(e.lastName=t.lastName),t.name&&(e.name=t.name),t.username&&(e.username=t.username),t.phone&&(e.phoneNumber=t.phone),t.timezone&&(e.timezone=t.timezone),t.language&&(e.language=t.language),!Object.keys(e).length)throw new E("No updates specified");let o=await l(zt,{input:e});I("Profile updated"),g(t,o.updateCurrentUserProfile);}catch(e){d(e);}});let i=n.command("security").description("Account security overview");i.command("audit-log").description("Recent auth audit events for the current user").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let e=await l(Dt,{pagination:{limit:t.limit,offset:0}});g(t,e.authAuditLogs,{headers:["When","Action","Resource","IP"],rows:e.authAuditLogs.map(o=>[h(o.createdAt),o.action,o.resource??"-",o.ipAddress??"-"])});}catch(e){d(e);}}),i.command("sessions").description("Active sessions for the current user").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let e=await l(jt,{pagination:{limit:t.limit,offset:0}});g(t,e.activeSessions,{headers:["ID","Status","IP","LastActivity","Current"],rows:e.activeSessions.map(o=>[q(o.id,12),X(o.status),o.ipAddress??"-",h(o.lastActivityAt),String(!!o.isCurrent)])});}catch(e){d(e);}});let r=n.command("mfa").description("Multi-factor authentication");r.command("list").description("List MFA methods enrolled for the current user").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let e=await l(Xt,{pagination:{limit:t.limit,offset:0}});g(t,e.currentUserMFAMethods,{headers:["Method","Status","Created"],rows:e.currentUserMFAMethods.map(o=>[o.method,X(o.status),h(o.createdAt)])});}catch(e){d(e);}}),r.command("enroll").description("Begin MFA enrollment (TOTP/SMS/EMAIL)").requiredOption("--method <m>","TOTP|SMS|EMAIL").option("-f, --format <format>").action(async t=>{try{let e=await l(Jt,{method:t.method.toUpperCase()});t.format?g(t,e.setupMFA):(I("MFA enrollment started"),j(e.setupMFA),x("Save your backup codes; verify with `auth mfa verify --code <CODE>`."));}catch(e){d(e);}}),r.command("verify").description("Verify MFA enrollment code").requiredOption("--code <code>").action(async t=>{try{await l(Qt,{code:t.code}),I("MFA enabled");}catch(e){d(e);}}),r.command("disable").description("Disable MFA for the current user").action(async()=>{try{await l(Zt),I("MFA disabled");}catch(t){d(t);}});let a=n.command("api-keys").description("API key management");a.command("list").description("List your API keys").option("--app <id>","Restrict to keys for an app id").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let e=t.app?ee:te,o=t.app?{appId:t.app,pagination:{limit:t.limit,offset:0}}:{pagination:{limit:t.limit,offset:0}},$=await l(e,o),A=$.myApiKeys??$.appApiKeys??[];g(t,A,{headers:["ID","Name","Prefix","App","Scopes","LastUsed"],rows:A.map(S=>[q(S.id,12),S.name??"-",S.prefix??"-",S.appName??"-",Array.isArray(S.scopes)?S.scopes.join(","):"-",h(S.lastUsedAt)])});}catch(e){d(e);}}),a.command("create").description("Generate a new API key").requiredOption("--name <name>").requiredOption("--app <appId>","Owning app id").option("--scope <scope>","Comma-separated scopes").option("--expires <iso>","ISO expiry").option("-f, --format <format>").action(async t=>{try{let e={name:t.name,appId:t.app,scope:t.scope?t.scope.split(","):void 0,expiresAt:t.expires},o=await l(ne,{input:e});I("API key generated. Store the secret \u2014 it is only shown once."),j(o.generateAPIKey);}catch(e){d(e);}}),a.command("revoke").description("Revoke an API key").argument("<keyId>").action(async t=>{try{await l(oe,{keyId:t}),I("API key revoked");}catch(e){d(e);}}),a.command("rotate").description("Rotate an API key (returns new secret)").argument("<keyId>").action(async t=>{try{let e=await l(ie,{keyId:t});I("API key rotated"),j(e.rotateAPIKey);}catch(e){d(e);}}),n.command("audit-log").description("Auth audit log").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let e=await l(Dt,{pagination:{limit:t.limit,offset:0}});g(t,e.authAuditLogs);}catch(e){d(e);}});let p=n.command("delegations").description("Delegation management");p.command("list").description("Delegations granted to the current user").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let e=await l(re,{pagination:{limit:t.limit,offset:0}});g(t,e.currentUserDelegations);}catch(e){d(e);}}),p.command("grant").description("Grant a delegation to an app").requiredOption("--app <appId>").requiredOption("--user <userId>","User to delegate as").option("--scope <s>","Comma-separated scopes").option("--workspace <ids>","Comma-separated workspace ids").option("--expires <iso>").option("-f, --format <format>").action(async t=>{try{let e={appId:t.app,userId:t.user,scopes:t.scope?t.scope.split(","):void 0,workspaceIds:t.workspace?t.workspace.split(","):void 0,expiresAt:t.expires},o=await l(se,{input:e});I("Delegation granted"),g(t,o.grantDelegation);}catch(e){d(e);}}),p.command("revoke").description("Revoke a delegation").argument("<id>").option("--reason <text>").action(async(t,e)=>{try{await l(ae,{id:t,reason:e.reason}),I("Delegation revoked");}catch(o){d(o);}});let c=n.command("apps").description("OAuth/system app management");c.command("list").description("Apps owned by the current user").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let e=await l(ce,{pagination:{limit:t.limit,offset:0}});g(t,e.currentUserApps,{headers:["ID","ClientID","Name","Type","Status"],rows:e.currentUserApps.map(o=>[q(o.id,12),q(o.clientId,24),o.name??"-",o.type??"-",X(o.status)])});}catch(e){d(e);}}),c.command("get").description("Get an app by id").argument("<id>").option("-f, --format <format>").action(async(t,e)=>{try{let o=await l(pe,{id:t});if(!o.app)throw new E(`App ${t} not found`);g(e,o.app);}catch(o){d(o);}}),c.command("create").description("Create an OAuth app").requiredOption("--name <s>").option("--description <s>").option("--type <t>","OAUTH|SYSTEM","OAUTH").option("--actor-type <t>","USER|APP|SERVICE","APP").option("--redirect <urls>","Comma-separated redirect URIs").option("--scopes <s>","Comma-separated scopes").option("-f, --format <format>").action(async t=>{try{let e={name:t.name,description:t.description,type:(t.type??"OAUTH").toUpperCase(),actorType:(t.actorType??"APP").toUpperCase(),redirectUris:t.redirect?t.redirect.split(","):void 0,scopes:t.scopes?t.scopes.split(","):void 0},o=await l(de,{input:e});I("App created. Client secret only shown once."),j(o.createApp);}catch(e){d(e);}}),c.command("update").description("Update an app").argument("<id>").option("--name <s>").option("--description <s>").option("--redirect <urls>","Comma-separated redirect URIs").option("--scopes <s>","Comma-separated scopes").option("--status <s>").option("-f, --format <format>").action(async(t,e)=>{try{let o={};if(e.name&&(o.name=e.name),e.description!==void 0&&(o.description=e.description),e.redirect&&(o.redirectUris=e.redirect.split(",")),e.scopes&&(o.scopes=e.scopes.split(",")),e.status&&(o.status=e.status.toUpperCase()),!Object.keys(o).length)throw new E("No updates specified");let $=await l(ue,{id:t,input:o});I("App updated"),g(e,$.updateApp);}catch(o){d(o);}}),c.command("deactivate").description("Deactivate an app").argument("<id>").action(async t=>{try{await l(le,{id:t}),I("App deactivated");}catch(e){d(e);}});let u=n.command("sso").description("SSO (SAML/OIDC) configuration");u.command("get").description("Get SSO config for a tenant").requiredOption("--tenant <id>").option("-f, --format <format>").action(async t=>{try{let e=await l(Ie,{tenantId:t.tenant});g(t,e.getSSOConfig);}catch(e){d(e);}}),u.command("save").description("Save (upsert) SSO config for a tenant").requiredOption("--tenant <id>").requiredOption("--entity <s>","EntityID / Issuer").requiredOption("--sso-url <url>").option("--slo-url <url>").option("--certificate <pem>","X.509 certificate PEM").option("--enabled","Enable after save",false).option("-f, --format <format>").action(async t=>{try{let e={entityId:t.entity,ssoUrl:t.ssoUrl,sloUrl:t.sloUrl,certificate:t.certificate,enabled:!!t.enabled},o=await l(ge,{tenantId:t.tenant,input:e});I("SSO config saved"),g(t,o.saveSSOConfig);}catch(e){d(e);}}),u.command("delete").description("Delete SSO config for a tenant").requiredOption("--tenant <id>").action(async t=>{try{await l(me,{tenantId:t.tenant}),I("SSO config deleted");}catch(e){d(e);}});let m=n.command("users").description("User admin (requires admin permissions)");m.command("list").description("List users (admin)").option("--email <s>").option("--username <s>").option("--role <s>").option("--status <s>").option("--search <s>").option("--limit <n>","Page size",t=>parseInt(t,10),50).option("-f, --format <format>").action(async t=>{try{let e={};t.email&&(e.email=t.email),t.username&&(e.username=t.username),t.role&&(e.role=t.role.toUpperCase()),t.status&&(e.status=t.status.toUpperCase()),t.search&&(e.search=t.search);let o=await l($e,{filter:Object.keys(e).length?e:void 0,pagination:{limit:t.limit,offset:0}});g(t,o.users.users,{headers:["ID","Email","Username","Role","Status","Created"],rows:o.users.users.map($=>[q($.id,12),$.email,$.username??"-",$.role??"-",X($.status),h($.createdAt)])});}catch(e){d(e);}}),m.command("get").description("Get user by id (admin)").argument("<id>").option("-f, --format <format>").action(async(t,e)=>{try{let o=await l(Se,{id:t});if(!o.user)throw new E(`User ${t} not found`);g(e,o.user);}catch(o){d(o);}}),m.command("update").description("Update a user (admin)").argument("<id>").option("--first-name <s>").option("--last-name <s>").option("--username <s>").option("--phone <s>").option("--role <s>").option("--status <s>").option("--email-verified <bool>").option("-f, --format <format>").action(async(t,e)=>{try{let o={};if(e.firstName&&(o.firstName=e.firstName),e.lastName&&(o.lastName=e.lastName),e.username&&(o.username=e.username),e.phone&&(o.phoneNumber=e.phone),e.role&&(o.role=e.role.toUpperCase()),e.status&&(o.status=e.status.toUpperCase()),e.emailVerified!==void 0&&(o.emailVerified=e.emailVerified==="true"),!Object.keys(o).length)throw new E("No updates specified");let $=await l(Ee,{id:t,input:o});I("User updated"),g(e,$.updateUser);}catch(o){d(o);}});}var we={id:"auth",version:"1.0.0",displayName:"Authentication",register(n,s){Ct(s),Wt(n);let i=n.commands.find(r=>r.name()==="auth");if(!i)throw new k("auth command group missing after registerAuthCommands");Te(i);}},Fs=we;module.exports=Fs;

package/dist/modules/auth/index.js

@@ -1,4 +1,4 @@
-import {Bc,Cc}from'../../chunk-MRONTCXQ.js';import {a,f,s,d,k,u,e,h,v,B,n,g,t,c,o as o$1,m,l,j,A}from'../../chunk-KTKHJORN.js';import {q,o,f as f$1,h as h$1,g as g$1,d as d$1,i,e as e$1}from'../../chunk-RNWXATAC.js';function X(s$1){let u$1=s$1.command("auth").description("Authentication commands");u$1.command("login").description("Authenticate with VibeControls").option("--client-credentials","Authenticate as an app with client ID and secret").option("--workspace-id <id>","Workspace ID (for app auth)").action(async i=>{try{i.clientCredentials?await Ce(i.workspaceId):await Ue();}catch(r){f(r);}}),u$1.command("logout").description("Revoke tokens and clear stored auth").action(async()=>{try{if(s()?.accessToken)try{await d(Bc);}catch{k("Server-side logout failed, clearing local tokens");}u(),e(),h("Logged out successfully");}catch(i){f(i);}}),u$1.command("status").description("Show current auth state").option("-f, --format <format>","Output format (json, table)").action(i=>{let r=s(),p=v(),I=!!r?.accessToken,m=r?.accessToken?B(r):false,f=r?.expiresAt?n(new Date(r.expiresAt).toISOString()):"-",h=r?.authMethod==="client_credentials"?"Client Credentials":"OAuth2 Device Code",e=r?.workspaceTokenExpiresAt?n(new Date(r.workspaceTokenExpiresAt).toISOString()):"-";g(i,{authenticated:I,method:h,expired:m,expiresAt:f,workspaceId:r?.workspaceId??"-",organizationId:r?.organizationId??"-",workspaceTokenExpiresAt:e,workspaceEndpoint:p.workspaceEndpoint,globalEndpoint:p.globalEndpoint},{headers:["Key","Value"],rows:[["Authenticated",String(I)],["Method",h],["Expired",String(m)],["Expires At",f],["Workspace ID",r?.workspaceId??"-"],["Organization ID",r?.organizationId??"-"],["Workspace Token Expires",e],["Workspace Endpoint",p.workspaceEndpoint],["Global Endpoint",p.globalEndpoint]]});}),u$1.command("token").description("Print access token to stdout").option("--workspace","Print workspace token instead").action(i=>{let r=s();if(i.workspace){if(!r?.workspaceToken)throw new o("No workspace token. Set a workspace: vibecontrols workspace set <id>");process.stdout.write(r.workspaceToken);return}if(!r?.accessToken)throw new o("Not authenticated. Run: vibecontrols auth login");process.stdout.write(r.accessToken);}),u$1.command("refresh").description("Force token refresh").action(async()=>{try{let i=s();if(!i?.refreshToken&&i?.authMethod!=="client_credentials")throw new o("No refresh token available. Run: vibecontrols auth login");if(i?.authMethod==="client_credentials"&&i.clientId&&i.clientSecret){let I=v(),m=await f$1(I.globalEndpoint,i.clientId,i.clientSecret);t({...i,accessToken:m.accessToken,expiresAt:Date.now()+m.expiresIn*1e3}),e(),h("App token refreshed successfully"),i.workspaceId&&i.organizationId&&await J();return}let p=(await d(Cc,{token:i.refreshToken})).refreshToken;t({...i,accessToken:p.accessToken,refreshToken:p.refreshToken,expiresAt:Date.now()+p.expiresIn*1e3}),e(),h("Token refreshed successfully"),i.workspaceId&&i.organizationId&&await J();}catch(i){f(i);}});}async function J(){let s$1=s();if(!s$1?.accessToken||!s$1.workspaceId||!s$1.organizationId)return;let u=v();try{let i=await g$1(u.workspaceEndpoint,s$1.accessToken,s$1.workspaceId,s$1.organizationId);t({...s$1,workspaceToken:i.token,workspaceTokenExpiresAt:new Date(i.expiresAt).getTime()}),e(),h("Workspace token refreshed");}catch{k("Workspace token refresh failed \u2014 workspace operations may require re-login");}}async function Ue(){let s=v(),{oidcIssuer:u,clientId:i$1}=A(),r={...s,oidcIssuer:u,clientId:i$1};j("Starting device code authentication...");let p=await d$1(r);console.log(""),console.log(`  Open: ${p.verificationUri}`),console.log(`  Code: ${p.userCode}`),console.log(""),await i(p.verificationUriComplete??p.verificationUri)?j("Browser opened"):k("Could not open browser \u2014 open the URL manually"),j("Waiting for authorization...");let m=await e$1(p.deviceCode,p.interval,r),f=m.accessToken,h$2=Date.now()+m.expiresIn*1e3;j("Fetching workspaces...");try{let e$1=await h$1(s.globalEndpoint,f);if(e$1.length===0){t({accessToken:f,refreshToken:m.refreshToken,expiresAt:h$2,authMethod:"device_code"}),e(),h("Authentication successful (no workspaces found)");return}let t$1=e$1[0];if(e$1.length>1){console.log(`
+import {Lc,Mc}from'../../chunk-REBBLQFS.js';import {a,f,s,d,k,u,e,h,v,B,n,g,t,c,o as o$1,m,l,j,A}from'../../chunk-KTKHJORN.js';import {q,o,f as f$1,h as h$1,g as g$1,d as d$1,i,e as e$1}from'../../chunk-RNWXATAC.js';function X(s$1){let u$1=s$1.command("auth").description("Authentication commands");u$1.command("login").description("Authenticate with VibeControls").option("--client-credentials","Authenticate as an app with client ID and secret").option("--workspace-id <id>","Workspace ID (for app auth)").action(async i=>{try{i.clientCredentials?await Ce(i.workspaceId):await Ue();}catch(r){f(r);}}),u$1.command("logout").description("Revoke tokens and clear stored auth").action(async()=>{try{if(s()?.accessToken)try{await d(Lc);}catch{k("Server-side logout failed, clearing local tokens");}u(),e(),h("Logged out successfully");}catch(i){f(i);}}),u$1.command("status").description("Show current auth state").option("-f, --format <format>","Output format (json, table)").action(i=>{let r=s(),p=v(),I=!!r?.accessToken,m=r?.accessToken?B(r):false,f=r?.expiresAt?n(new Date(r.expiresAt).toISOString()):"-",h=r?.authMethod==="client_credentials"?"Client Credentials":"OAuth2 Device Code",e=r?.workspaceTokenExpiresAt?n(new Date(r.workspaceTokenExpiresAt).toISOString()):"-";g(i,{authenticated:I,method:h,expired:m,expiresAt:f,workspaceId:r?.workspaceId??"-",organizationId:r?.organizationId??"-",workspaceTokenExpiresAt:e,workspaceEndpoint:p.workspaceEndpoint,globalEndpoint:p.globalEndpoint},{headers:["Key","Value"],rows:[["Authenticated",String(I)],["Method",h],["Expired",String(m)],["Expires At",f],["Workspace ID",r?.workspaceId??"-"],["Organization ID",r?.organizationId??"-"],["Workspace Token Expires",e],["Workspace Endpoint",p.workspaceEndpoint],["Global Endpoint",p.globalEndpoint]]});}),u$1.command("token").description("Print access token to stdout").option("--workspace","Print workspace token instead").action(i=>{let r=s();if(i.workspace){if(!r?.workspaceToken)throw new o("No workspace token. Set a workspace: vibecontrols workspace set <id>");process.stdout.write(r.workspaceToken);return}if(!r?.accessToken)throw new o("Not authenticated. Run: vibecontrols auth login");process.stdout.write(r.accessToken);}),u$1.command("refresh").description("Force token refresh").action(async()=>{try{let i=s();if(!i?.refreshToken&&i?.authMethod!=="client_credentials")throw new o("No refresh token available. Run: vibecontrols auth login");if(i?.authMethod==="client_credentials"&&i.clientId&&i.clientSecret){let I=v(),m=await f$1(I.globalEndpoint,i.clientId,i.clientSecret);t({...i,accessToken:m.accessToken,expiresAt:Date.now()+m.expiresIn*1e3}),e(),h("App token refreshed successfully"),i.workspaceId&&i.organizationId&&await J();return}let p=(await d(Mc,{token:i.refreshToken})).refreshToken;t({...i,accessToken:p.accessToken,refreshToken:p.refreshToken,expiresAt:Date.now()+p.expiresIn*1e3}),e(),h("Token refreshed successfully"),i.workspaceId&&i.organizationId&&await J();}catch(i){f(i);}});}async function J(){let s$1=s();if(!s$1?.accessToken||!s$1.workspaceId||!s$1.organizationId)return;let u=v();try{let i=await g$1(u.workspaceEndpoint,s$1.accessToken,s$1.workspaceId,s$1.organizationId);t({...s$1,workspaceToken:i.token,workspaceTokenExpiresAt:new Date(i.expiresAt).getTime()}),e(),h("Workspace token refreshed");}catch{k("Workspace token refresh failed \u2014 workspace operations may require re-login");}}async function Ue(){let s=v(),{oidcIssuer:u,clientId:i$1}=A(),r={...s,oidcIssuer:u,clientId:i$1};j("Starting device code authentication...");let p=await d$1(r);console.log(""),console.log(`  Open: ${p.verificationUri}`),console.log(`  Code: ${p.userCode}`),console.log(""),await i(p.verificationUriComplete??p.verificationUri)?j("Browser opened"):k("Could not open browser \u2014 open the URL manually"),j("Waiting for authorization...");let m=await e$1(p.deviceCode,p.interval,r),f=m.accessToken,h$2=Date.now()+m.expiresIn*1e3;j("Fetching workspaces...");try{let e$1=await h$1(s.globalEndpoint,f);if(e$1.length===0){t({accessToken:f,refreshToken:m.refreshToken,expiresAt:h$2,authMethod:"device_code"}),e(),h("Authentication successful (no workspaces found)");return}let t$1=e$1[0];if(e$1.length>1){console.log(`
 Available workspaces:`),e$1.forEach((O,$)=>console.log(`  ${$+1}. ${O.name} (${O.slug})`));let A=(await import('readline')).createInterface({input:process.stdin,output:process.stdout}),g=await new Promise(O=>{A.question(`
 Select workspace [1-${e$1.length}]: `,$=>{A.close(),O($.trim());});}),S=parseInt(g,10)-1;S>=0&&S<e$1.length&&(t$1=e$1[S]);}j(`Using workspace: ${t$1.name} (${t$1.id})`);let n=await g$1(s.workspaceEndpoint,f,t$1.id,t$1.organizationId);t({accessToken:f,refreshToken:m.refreshToken,expiresAt:h$2,workspaceToken:n.token,workspaceTokenExpiresAt:new Date(n.expiresAt).getTime(),workspaceId:t$1.id,organizationId:t$1.organizationId,authMethod:"device_code"}),e(),h("Authentication successful");}catch(e$1){t({accessToken:f,refreshToken:m.refreshToken,expiresAt:h$2,authMethod:"device_code"}),e(),h("Authentication successful"),k(`Workspace token not obtained: ${e$1 instanceof Error?e$1.message:String(e$1)}`),j("Set workspace manually: vibecontrols workspace set <id>");}}async function Ce(s){let u=v(),r=(await import('readline')).createInterface({input:process.stdin,output:process.stdout}),p=await new Promise(A=>{r.question("Client ID: ",g=>A(g.trim()));}),I=await new Promise(A=>{r.question("Client Secret: ",g=>{r.close(),A(g.trim());});});if(!p||!I)throw new o("Client ID and secret cannot be empty");j("Authenticating app...");let m=await f$1(u.globalEndpoint,p,I),f=m.accessToken,h$2=Date.now()+m.expiresIn*1e3,e$1,t$1,n=s,l;if(n)try{let g=(await h$1(u.globalEndpoint,f)).find(S=>S.id===n);if(g){l=g.organizationId;let S=await g$1(u.workspaceEndpoint,f,n,l);e$1=S.token,t$1=new Date(S.expiresAt).getTime(),j(`Workspace token issued for: ${g.name}`);}else k(`Workspace ${n} not found \u2014 skipping workspace token`),n=void 0;}catch(A){k(`Workspace token failed: ${A instanceof Error?A.message:String(A)}`);}t({accessToken:f,refreshToken:"",expiresAt:h$2,workspaceToken:e$1,workspaceTokenExpiresAt:t$1,workspaceId:n,organizationId:l,authMethod:"client_credentials",clientId:p,clientSecret:I}),e(),h("App authentication successful");}var Q=`
   query currentUser {

package/dist/modules/conversations/index.cjs

@@ -1,37 +1,155 @@
-'use strict';require('graphql-request'),require('cross-fetch'),require('commander');var s=class extends Error{exitCode;hint;constructor(r,e){super(r),this.name="CliUserError",this.exitCode=e?.exitCode??1,this.hint=e?.hint;}},g=class extends s{constructor(r,e){super(r,{exitCode:2,hint:e?.hint??"Run `<product> auth login` to authenticate."}),this.name="CliAuthError";}},u=class extends Error{cause;constructor(r,e){super(r),this.name="CliInternalError",this.cause=e;}};var C=null;function k(t){C=t;}function p(){if(!C)throw new u("vibecontrols module helpers used before setHelpersContext was called");return C}function j(){let t=p();if(!t.auth.isAuthenticated())throw new g(`Authentication required. Run \`${t.productName} auth login\`.`)}async function l(t,r){return j(),p().gql.workspace.request(t,r)}function d(t){let r=t instanceof Error?t.message:String(t);throw new s(r)}function f(t,r,e){p().output.formatAndOutput(t,r,e);}function m(t){p().output.printSuccess(t);}function x(t){return p().output.formatDate(t)}function y(t,r){return p().output.truncate(t,r)}function v(){return p()}var T=`
+'use strict';require('graphql-request'),require('cross-fetch'),require('commander');var g=class extends Error{exitCode;hint;constructor(o,n){super(o),this.name="CliUserError",this.exitCode=n?.exitCode??1,this.hint=n?.hint;}},f=class extends g{constructor(o,n){super(o,{exitCode:2,hint:n?.hint??"Run `<product> auth login` to authenticate."}),this.name="CliAuthError";}},l=class extends Error{cause;constructor(o,n){super(o),this.name="CliInternalError",this.cause=n;}};var h=null;function x(r){h=r;}function m(){if(!h)throw new l("vibecontrols module helpers used before setHelpersContext was called");return h}function me(){let r=m();if(!r.auth.isAuthenticated())throw new f(`Authentication required. Run \`${r.productName} auth login\`.`)}async function s(r,o){return me(),m().gql.workspace.request(r,o)}function a(r){let o=r instanceof Error?r.message:String(r);throw new g(o)}function d(r,o,n){m().output.formatAndOutput(r,o,n);}function c(r){m().output.printSuccess(r);}function w(r){return m().output.formatDate(r)}function I(r,o){return m().output.truncate(r,o)}function k(){return m()}var A=`
   query ListConversations($filter: ConversationFilter, $first: Int, $after: String) {
     conversations(filter: $filter, first: $first, after: $after) {
       edges { node { id title type description createdAt updatedAt unreadCount } }
       pageInfo { hasNextPage endCursor }
     }
   }
-`,b=`
+`,T=`
   query GetConversation($id: ID!) {
     conversation(id: $id) {
       id title type description avatarUrl settings
       createdAt updatedAt
     }
   }
-`,E=`
+`,S=`
   mutation CreateConversation($input: CreateConversationInput!) {
     createConversation(input: $input) {
       conversation { id title type }
     }
   }
-`,I=`
+`,R=`
   mutation DeleteConversation($id: ID!) {
     deleteConversation(id: $id) { success }
   }
-`,A=`
+`,b=`
   mutation UpdateConversation($input: UpdateConversationInput!) {
     updateConversation(input: $input) {
       conversation { id title description }
     }
   }
-`,S=`
+`,O=`
   mutation SendMessage($input: SendMessageInput!) {
     sendMessage(input: $input) {
       message { id content type createdAt }
     }
   }
-`;function O(t){let r=t.command("conversations").description("Conversation management");r.command("list").description("List conversations").option("--type <t>","Filter by type (DIRECT|GROUP|CHANNEL)").option("--limit <n>","Page size",e=>parseInt(e,10),50).option("-f, --format <format>").action(async e=>{try{let n={};e.type&&(n.type=e.type.toUpperCase());let a=(await l(T,{filter:Object.keys(n).length?n:void 0,first:e.limit})).conversations.edges.map(c=>c.node);f(e,a,{headers:["ID","Title","Type","Unread","Created"],rows:a.map(c=>[y(c.id,12),c.title??"-",c.type??"-",String(c.unreadCount??0),x(c.createdAt)])});}catch(n){d(n);}}),r.command("get").description("Get a conversation").argument("<id>").option("-f, --format <format>").action(async(e,n)=>{try{let o=await l(b,{id:e});if(!o.conversation)throw new s(`Conversation ${e} not found`);f(n,o.conversation);}catch(o){d(o);}}),r.command("create").description("Create a conversation").requiredOption("--title <s>").requiredOption("--participants <ids>","Comma-separated participant userIds (required by schema)").option("--description <s>").option("--type <t>","DIRECT|GROUP|CHANNEL","GROUP").option("-f, --format <format>").action(async e=>{try{let n=v().auth.read();if(!n?.workspaceId)throw new s("No workspace set. Run: vibecontrols workspace set <id>");let o={title:e.title,description:e.description,type:(e.type??"GROUP").toUpperCase(),participantIds:e.participants.split(","),workspaceId:n.workspaceId},a=await l(E,{input:o});m("Conversation created"),f(e,a.createConversation.conversation);}catch(n){d(n);}}),r.command("update").description("Update a conversation").argument("<id>").option("--title <s>").option("--description <s>").option("-f, --format <format>").action(async(e,n)=>{try{let o={id:e};if(n.title&&(o.title=n.title),n.description!==void 0&&(o.description=n.description),Object.keys(o).length===1)throw new s("No updates specified");let a=await l(A,{input:o});m("Conversation updated"),f(n,a.updateConversation.conversation);}catch(o){d(o);}}),r.command("delete").description("Delete a conversation").argument("<id>").action(async e=>{try{await l(I,{id:e}),m("Conversation deleted");}catch(n){d(n);}}),r.command("send").description("Send a message to a conversation").argument("<conversationId>").requiredOption("--content <text>").option("--parent <messageId>","Reply parent").option("-f, --format <format>").action(async(e,n)=>{try{let o={conversationId:e,content:{text:n.content},type:"TEXT",parentMessageId:n.parent},a=await l(S,{input:o});m("Message sent"),f(n,a.sendMessage.message);}catch(o){d(o);}});}var U={id:"conversations",version:"1.0.0",displayName:"Conversations",dependsOn:["auth","workspaces"],register(t,r){k(r),O(t);}},Ze=U;module.exports=Ze;
+`;var N=`
+  mutation EditMessage($input: EditMessageInput!) {
+    editMessage(input: $input) { id content isEdited editedAt }
+  }
+`,D=`
+  mutation DeleteMessage($id: ID!, $hard: Boolean) {
+    deleteMessage(id: $id, hard: $hard) { success messageId }
+  }
+`,$=`
+  mutation ForwardMessage($messageId: ID!, $targetConversationId: ID!) {
+    forwardMessage(messageId: $messageId, targetConversationId: $targetConversationId) {
+      success message { id conversationId content createdAt }
+    }
+  }
+`,_=`
+  mutation PinMessage($messageId: ID!) {
+    pinMessage(messageId: $messageId) { id isPinned pinnedAt }
+  }
+`,P=`
+  mutation UnpinMessage($messageId: ID!) {
+    unpinMessage(messageId: $messageId) { id isPinned }
+  }
+`,M=`
+  query SearchMessages($query: String!, $conversationId: ID, $first: Int) {
+    searchMessages(query: $query, conversationId: $conversationId, first: $first) {
+      edges { node { id conversationId authorId content type createdAt } }
+      totalCount
+    }
+  }
+`,L=`
+  query Draft($conversationId: ID!) {
+    draft(conversationId: $conversationId) {
+      id conversationId content parentMessageId createdAt updatedAt
+    }
+  }
+`,q=`
+  mutation SaveDraft($input: SaveDraftInput!) {
+    saveDraft(input: $input) { id conversationId content updatedAt }
+  }
+`,U=`
+  mutation DeleteDraft($conversationId: ID!) {
+    deleteDraft(conversationId: $conversationId) { success conversationId }
+  }
+`,V=`
+  mutation AddReaction($messageId: ID!, $emoji: String!) {
+    addReaction(messageId: $messageId, emoji: $emoji) {
+      id messageId userId emoji createdAt
+    }
+  }
+`,G=`
+  mutation RemoveReaction($messageId: ID!, $emoji: String!) {
+    removeReaction(messageId: $messageId, emoji: $emoji) { success messageId emoji }
+  }
+`,j=`
+  mutation AddParticipant($input: AddParticipantInput!) {
+    addParticipant(input: $input) { id conversationId userId createdAt }
+  }
+`,F=`
+  mutation RemoveParticipant($input: RemoveParticipantInput!) {
+    removeParticipant(input: $input) { success conversationId userId }
+  }
+`,W=`
+  mutation UpdateParticipantRole($input: UpdateParticipantRoleInput!) {
+    updateParticipantRole(input: $input) { id conversationId userId }
+  }
+`,H=`
+  mutation LeaveConversation($conversationId: ID!) {
+    leaveConversation(conversationId: $conversationId) { success conversationId }
+  }
+`,z=`
+  mutation ArchiveConversation($id: ID!) {
+    archiveConversation(id: $id) { id state }
+  }
+`,K=`
+  mutation UnarchiveConversation($id: ID!) {
+    unarchiveConversation(id: $id) { id state }
+  }
+`,B=`
+  mutation MuteConversation($conversationId: ID!, $until: DateTime) {
+    muteConversation(conversationId: $conversationId, until: $until) {
+      id conversationId userId
+    }
+  }
+`,J=`
+  mutation UnmuteConversation($conversationId: ID!) {
+    unmuteConversation(conversationId: $conversationId) { id conversationId userId }
+  }
+`,Y=`
+  mutation PinConversation($conversationId: ID!) {
+    pinConversation(conversationId: $conversationId) { id conversationId userId }
+  }
+`,Q=`
+  mutation UnpinConversation($conversationId: ID!) {
+    unpinConversation(conversationId: $conversationId) { id conversationId userId }
+  }
+`,X=`
+  mutation MarkConversationAsRead($conversationId: ID!, $messageId: ID) {
+    markConversationAsRead(conversationId: $conversationId, messageId: $messageId) {
+      id conversationId userId
+    }
+  }
+`,Z=`
+  mutation CreateInviteLink($input: CreateInviteLinkInput!) {
+    createInviteLink(input: $input) {
+      code url currentUses maxUses expiresAt createdAt
+    }
+  }
+`,ee=`
+  mutation JoinViaInviteLink($code: String!) {
+    joinViaInviteLink(code: $code) { id conversationId userId createdAt }
+  }
+`,te=`
+  query ValidateInviteLink($code: String!) {
+    validateInviteLink(code: $code) {
+      valid usesRemaining expiresAt
+      conversation { id title type }
+    }
+  }
+`;function ne(r){let o=r.command("conversations").description("Conversation management");o.command("list").description("List conversations").option("--type <t>","Filter by type (DIRECT|GROUP|CHANNEL)").option("--limit <n>","Page size",n=>parseInt(n,10),50).option("-f, --format <format>").action(async n=>{try{let e={};n.type&&(e.type=n.type.toUpperCase());let i=(await s(A,{filter:Object.keys(e).length?e:void 0,first:n.limit})).conversations.edges.map(p=>p.node);d(n,i,{headers:["ID","Title","Type","Unread","Created"],rows:i.map(p=>[I(p.id,12),p.title??"-",p.type??"-",String(p.unreadCount??0),w(p.createdAt)])});}catch(e){a(e);}}),o.command("get").description("Get a conversation").argument("<id>").option("-f, --format <format>").action(async(n,e)=>{try{let t=await s(T,{id:n});if(!t.conversation)throw new g(`Conversation ${n} not found`);d(e,t.conversation);}catch(t){a(t);}}),o.command("create").description("Create a conversation").requiredOption("--title <s>").requiredOption("--participants <ids>","Comma-separated participant userIds (required by schema)").option("--description <s>").option("--type <t>","DIRECT|GROUP|CHANNEL","GROUP").option("-f, --format <format>").action(async n=>{try{let e=k().auth.read();if(!e?.workspaceId)throw new g("No workspace set. Run: vibecontrols workspace set <id>");let t={title:n.title,description:n.description,type:(n.type??"GROUP").toUpperCase(),participantIds:n.participants.split(","),workspaceId:e.workspaceId},i=await s(S,{input:t});c("Conversation created"),d(n,i.createConversation.conversation);}catch(e){a(e);}}),o.command("update").description("Update a conversation").argument("<id>").option("--title <s>").option("--description <s>").option("-f, --format <format>").action(async(n,e)=>{try{let t={id:n};if(e.title&&(t.title=e.title),e.description!==void 0&&(t.description=e.description),Object.keys(t).length===1)throw new g("No updates specified");let i=await s(b,{input:t});c("Conversation updated"),d(e,i.updateConversation.conversation);}catch(t){a(t);}}),o.command("delete").description("Delete a conversation").argument("<id>").action(async n=>{try{await s(R,{id:n}),c("Conversation deleted");}catch(e){a(e);}}),o.command("send").description("Send a message to a conversation").argument("<conversationId>").requiredOption("--content <text>").option("--parent <messageId>","Reply parent").option("-f, --format <format>").action(async(n,e)=>{try{let t={conversationId:n,content:{text:e.content},type:"TEXT",parentMessageId:e.parent},i=await s(O,{input:t});c("Message sent"),d(e,i.sendMessage.message);}catch(t){a(t);}}),Ie(o),ve(o),Ce(o),he(o),we(o),ye(o);}function Ie(r){let o=r.command("messages").description("Message operations");o.command("edit").description("Edit a message").argument("<id>").requiredOption("--content <text>").option("--reason <s>").option("-f, --format <format>").action(async(n,e)=>{try{let t={id:n,content:{text:e.content}};e.reason&&(t.reason=e.reason);let i=await s(N,{input:t});c("Message edited"),d(e,i.editMessage);}catch(t){a(t);}}),o.command("delete").description("Delete a message").argument("<id>").option("--hard","Hard delete (default: soft)").action(async(n,e)=>{try{await s(D,{id:n,hard:e.hard??!1}),c("Message deleted");}catch(t){a(t);}}),o.command("forward").description("Forward a message to another conversation").argument("<messageId>").requiredOption("--to <targetConversationId>").option("-f, --format <format>").action(async(n,e)=>{try{let t=await s($,{messageId:n,targetConversationId:e.to});c("Message forwarded"),d(e,t.forwardMessage.message);}catch(t){a(t);}}),o.command("pin").description("Pin a message").argument("<messageId>").action(async n=>{try{await s(_,{messageId:n}),c("Message pinned");}catch(e){a(e);}}),o.command("unpin").description("Unpin a message").argument("<messageId>").action(async n=>{try{await s(P,{messageId:n}),c("Message unpinned");}catch(e){a(e);}}),o.command("search").description("Search messages").requiredOption("--query <s>").option("--conversation <id>","Restrict to a conversation").option("--limit <n>","Page size",n=>parseInt(n,10),50).option("-f, --format <format>").action(async n=>{try{let t=(await s(M,{query:n.query,conversationId:n.conversation,first:n.limit})).searchMessages.edges.map(i=>i.node);d(n,t,{headers:["ID","Conversation","Author","Created"],rows:t.map(i=>[I(i.id,12),I(i.conversationId??"-",12),I(i.authorId??"-",12),w(i.createdAt)])});}catch(e){a(e);}});}function ve(r){let o=r.command("drafts").description("Draft message operations");o.command("get").description("Get the actor\u2019s draft for a conversation").argument("<conversationId>").option("-f, --format <format>").action(async(n,e)=>{try{let t=await s(L,{conversationId:n});if(!t.draft){c("No draft saved");return}d(e,t.draft);}catch(t){a(t);}}),o.command("save").description("Save (upsert) a draft for a conversation").argument("<conversationId>").requiredOption("--content <text>").option("--parent <messageId>").option("-f, --format <format>").action(async(n,e)=>{try{let t={conversationId:n,content:{text:e.content}};e.parent&&(t.parentMessageId=e.parent);let i=await s(q,{input:t});c("Draft saved"),d(e,i.saveDraft);}catch(t){a(t);}}),o.command("delete").description("Delete the actor\u2019s draft for a conversation").argument("<conversationId>").action(async n=>{try{await s(U,{conversationId:n}),c("Draft deleted");}catch(e){a(e);}});}function Ce(r){let o=r.command("reactions").description("Reaction operations");o.command("add").description("Add an emoji reaction to a message").argument("<messageId>").requiredOption("--emoji <e>").option("-f, --format <format>").action(async(n,e)=>{try{let t=await s(V,{messageId:n,emoji:e.emoji});c("Reaction added"),d(e,t.addReaction);}catch(t){a(t);}}),o.command("remove").description("Remove an emoji reaction from a message").argument("<messageId>").requiredOption("--emoji <e>").action(async(n,e)=>{try{await s(G,{messageId:n,emoji:e.emoji}),c("Reaction removed");}catch(t){a(t);}});}function he(r){let o=r.command("participants").description("Participant operations");o.command("add").description("Add a participant to a conversation").argument("<conversationId>").requiredOption("--user <userId>").option("--role <role>","ADMIN | MODERATOR | MEMBER | GUEST").option("-f, --format <format>").action(async(n,e)=>{try{let t={conversationId:n,userId:e.user};e.role&&(t.role=e.role.toUpperCase());let i=await s(j,{input:t});c("Participant added"),d(e,i.addParticipant);}catch(t){a(t);}}),o.command("remove").description("Remove a participant from a conversation").argument("<conversationId>").requiredOption("--user <userId>").option("--reason <s>").action(async(n,e)=>{try{let t={conversationId:n,userId:e.user};e.reason&&(t.reason=e.reason),await s(F,{input:t}),c("Participant removed");}catch(t){a(t);}}),o.command("role").description("Update a participant\u2019s role").argument("<conversationId>").requiredOption("--user <userId>").requiredOption("--role <role>","ADMIN | MODERATOR | MEMBER | GUEST").action(async(n,e)=>{try{await s(W,{input:{conversationId:n,userId:e.user,role:e.role.toUpperCase()}}),c("Participant role updated");}catch(t){a(t);}});}function we(r){let o=(e,t,i,p)=>{r.command(e).description(t).argument("<id>").action(async v=>{try{await s(i,{id:v}),c(p);}catch(C){a(C);}});},n=(e,t,i,p)=>{r.command(e).description(t).argument("<conversationId>").action(async v=>{try{await s(i,{conversationId:v}),c(p);}catch(C){a(C);}});};o("archive","Archive a conversation",z,"Archived"),o("unarchive","Unarchive a conversation",K,"Unarchived"),r.command("mute").description("Mute a conversation").argument("<conversationId>").option("--until <iso>","ISO timestamp; omit for indefinite").action(async(e,t)=>{try{await s(B,{conversationId:e,until:t.until}),c("Muted");}catch(i){a(i);}}),n("unmute","Unmute a conversation",J,"Unmuted"),n("pin","Pin a conversation",Y,"Pinned"),n("unpin","Unpin a conversation",Q,"Unpinned"),r.command("read").description("Mark a conversation as read").argument("<conversationId>").option("--message <messageId>","Mark read up to this message (defaults to latest)").action(async(e,t)=>{try{await s(X,{conversationId:e,messageId:t.message}),c("Marked as read");}catch(i){a(i);}}),n("leave","Leave a conversation",H,"Left conversation");}function ye(r){let o=r.command("invites").description("Invite link operations");o.command("create").description("Create an invite link for a conversation").argument("<conversationId>").option("--max-uses <n>","Maximum number of uses",n=>parseInt(n,10)).option("--expires-at <iso>","ISO expiry timestamp").option("-f, --format <format>").action(async(n,e)=>{try{let t={conversationId:n};e.maxUses!==void 0&&(t.maxUses=e.maxUses),e.expiresAt&&(t.expiresAt=e.expiresAt);let i=await s(Z,{input:t});c("Invite link created"),d(e,i.createInviteLink);}catch(t){a(t);}}),o.command("join").description("Join a conversation via invite code").argument("<code>").action(async n=>{try{await s(ee,{code:n}),c("Joined via invite link");}catch(e){a(e);}}),o.command("validate").description("Validate an invite code").argument("<code>").option("-f, --format <format>").action(async(n,e)=>{try{let t=await s(te,{code:n});d(e,t.validateInviteLink);}catch(t){a(t);}});}var Ee={id:"conversations",version:"1.0.0",displayName:"Conversations",dependsOn:["auth","workspaces"],register(r,o){x(o),ne(r);}},Dt=Ee;module.exports=Dt;