@cimplify/cli 0.3.0 → 0.4.0

package/dist/{add-ZJNXWN2B.mjs → add-KKIYBATR.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { REGISTRY_INDEX, REGISTRY } from './chunk-MHK4WVNF.mjs';
-import { promptYesNo } from './chunk-RZQTHTXX.mjs';
+import { REGISTRY_INDEX, REGISTRY } from './chunk-42PFJBC6.mjs';
+import { promptYesNo } from './chunk-ITAFAORS.mjs';
 import { parseArgs, flagString, flagBool } from './chunk-C4M3DXKC.mjs';
-import { CliError, CLI_ERROR_CODE, info, bold, dim, success, result, yellow } from './chunk-I3XQSSOT.mjs';
+import { CliError, CLI_ERROR_CODE, info, bold, dim, success, result, yellow } from './chunk-E2T2SBP5.mjs';
 import { mkdirSync, existsSync, writeFileSync } from 'fs';
 import { resolve, join, dirname } from 'path';
 

package/dist/{assets-DMK2QOPD.mjs → assets-EBEMMENZ.mjs}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { parseArgs, flagString, flagBool } from './chunk-C4M3DXKC.mjs';
-import { ApiClient } from './chunk-D7WMSGKK.mjs';
-import { readAuth } from './chunk-LS2VTSMQ.mjs';
-import { CliError, CLI_ERROR_CODE, step, yellow, dim, success, info, result, bold, green } from './chunk-I3XQSSOT.mjs';
+import { ApiClient } from './chunk-MAOO6ZZ5.mjs';
+import { readAuth } from './chunk-UBAI443T.mjs';
+import { CliError, CLI_ERROR_CODE, step, yellow, dim, success, info, result, bold, green } from './chunk-E2T2SBP5.mjs';
 import { createHash } from 'crypto';
 import { promises } from 'fs';
 import path from 'path';

package/dist/auth-step-up-BIUYQJP6.mjs

@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+import { startLoopbackServer, generateState, openBrowser } from './chunk-GLXONXS3.mjs';
+import { parseArgs, flagString, flagBool } from './chunk-C4M3DXKC.mjs';
+import { resolveBaseUrl } from './chunk-MAOO6ZZ5.mjs';
+import { readAuth, writeStepUp } from './chunk-UBAI443T.mjs';
+import { isJsonMode, CliError, CLI_ERROR_CODE, step, info, dim, success, result } from './chunk-E2T2SBP5.mjs';
+
+// src/commands/auth-step-up.ts
+var FLAG_NO_BROWSER = "no-browser";
+var FLAG_BASE_URL = "base-url";
+var STEP_UP_PATH = "/cli/step-up";
+var STEP_UP_JWT_TTL_MS = 5 * 6e4;
+var CALLBACK_TIMEOUT_MS = 10 * 6e4;
+async function run(argv) {
+  if (isJsonMode()) {
+    throw new CliError(
+      CLI_ERROR_CODE.INTERACTIVE_REQUIRED,
+      "step-up needs an interactive browser; --json mode is unsupported.",
+      { remediation: "Run from a terminal with a browser available." }
+    );
+  }
+  const args = parseArgs(argv);
+  const baseUrl = resolveBaseUrl(flagString(args, FLAG_BASE_URL));
+  const auth = await readAuth();
+  const dashboardUrl = deriveDashboardUrl(baseUrl);
+  const loopback = await startLoopbackServer(baseUrl);
+  const state = generateState();
+  const requestId = generateState();
+  const url = new URL(`${dashboardUrl}${STEP_UP_PATH}`);
+  url.searchParams.set("request_id", requestId);
+  url.searchParams.set("redirect_uri", loopback.redirectUri);
+  url.searchParams.set("state", state);
+  step("Opening browser for fresh-auth...");
+  info(dim(url.toString()));
+  if (!flagBool(args, FLAG_NO_BROWSER)) {
+    openBrowser(url.toString());
+  } else {
+    info("");
+    info(dim("Open the URL above in any browser to continue."));
+  }
+  let callback;
+  try {
+    callback = await loopback.awaitCallback(CALLBACK_TIMEOUT_MS);
+  } catch (err) {
+    loopback.close();
+    throw err;
+  }
+  if (callback.state !== state) {
+    throw new CliError(
+      CLI_ERROR_CODE.UNAUTHORIZED,
+      "Step-up state mismatch. Possible CSRF attempt \u2014 try again."
+    );
+  }
+  if (!callback.step_up_token) {
+    throw new CliError(
+      CLI_ERROR_CODE.UNAUTHORIZED,
+      "Step-up callback missing step_up_token."
+    );
+  }
+  const token = {
+    token: callback.step_up_token,
+    expiresAt: Date.now() + STEP_UP_JWT_TTL_MS,
+    savedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await writeStepUp(token);
+  success(
+    `Step-up complete. Re-run your destructive command within ${Math.round(STEP_UP_JWT_TTL_MS / 6e4)} minutes.`
+  );
+  result({
+    step_up_active: true,
+    expires_at: new Date(token.expiresAt).toISOString(),
+    account: { id: auth.accountId }
+  });
+}
+function deriveDashboardUrl(apiBaseUrl) {
+  return apiBaseUrl.replace(
+    /^https?:\/\/api\./,
+    (m) => m.replace("api.", "app.")
+  );
+}
+
+export { run as default };