@ciphrix/cli 0.1.0

package/dist/commands/control.js

@@ -0,0 +1,189 @@
+import { applyTool } from '../actions.js';
+import { writeLine, writeNextHint, writePageFooter, writeTable } from '../io.js';
+import { asRecord, asText, callTool, errorMessage, resolveToolContext } from '../toolSurface.js';
+const text = (value, fallback = '-') => typeof value === 'string' ? value : typeof value === 'number' ? String(value) : fallback;
+export const controlListCommand = async ({ io, apiUrl, json = false, credentialStore, search, domain, status, applicability, page, limit, }) => {
+    const ctx = await resolveToolContext(apiUrl, credentialStore);
+    const input = {};
+    if (search)
+        input.search = search;
+    if (domain)
+        input.domain = [domain];
+    if (status)
+        input.status = status
+            .split(',')
+            .map((value) => value.trim())
+            .filter(Boolean);
+    if (applicability)
+        input.applicability = [applicability];
+    if (page)
+        input.page = page;
+    if (limit)
+        input.limit = limit;
+    const envelope = await callTool(ctx, 'list_controls', input);
+    if (envelope.status !== 'ok')
+        throw new Error(errorMessage(envelope, 'Could not list controls.'));
+    if (json) {
+        writeLine(io.stdout, JSON.stringify(envelope.data, null, 2));
+        return;
+    }
+    const data = asRecord(envelope.data);
+    const controls = Array.isArray(data.controls) ? data.controls : [];
+    writeLine(io.stdout, `${io.theme.bold('Controls')} ${io.theme.dim(`(${text(data.total, String(controls.length))} total)`)}`);
+    if (controls.length === 0) {
+        writeLine(io.stdout, 'No controls found.');
+        return;
+    }
+    writeTable(io, ['CODE', 'NAME', 'DOMAIN', 'STATUS', 'APPLICABILITY', 'OWNER'], controls.map((control) => {
+        const record = asRecord(control);
+        const owner = asRecord(record.owner);
+        return [
+            text(record.code, '-'),
+            text(record.name),
+            text(record.domain),
+            text(record.status),
+            text(record.applicability),
+            text(owner.email ?? record.owner, '-'),
+        ];
+    }));
+    writePageFooter(io, {
+        shown: controls.length,
+        total: typeof data.total === 'number' ? data.total : controls.length,
+        page: typeof data.page === 'number' ? data.page : 1,
+        limit: typeof data.limit === 'number' ? data.limit : 25,
+        hasMore: data.hasMore === true,
+    });
+    const next = asText(asRecord(controls[0]).code);
+    if (next)
+        writeNextHint(io, `ciphrix control get ${next}`);
+};
+export const controlGetCommand = async ({ io, name, apiUrl, json = false, credentialStore, }) => {
+    const ctx = await resolveToolContext(apiUrl, credentialStore);
+    const envelope = await callTool(ctx, 'get_control', { name });
+    if (envelope.status !== 'ok')
+        throw new Error(errorMessage(envelope, 'Control not found.'));
+    const control = asRecord(asRecord(envelope.data).control);
+    if (json) {
+        writeLine(io.stdout, JSON.stringify(control, null, 2));
+        return;
+    }
+    writeLine(io.stdout, `${io.theme.bold(asText(control.name, 'Control'))} ${io.theme.dim(`· ${asText(control.code, '-')}`)}`);
+    const owner = asRecord(control.owner);
+    const fields = [
+        ['Domain', control.domain],
+        ['Status', control.status],
+        ['Applicability', control.applicability],
+        ['Owner', owner.email ?? control.owner],
+        ['Design requirements', control.designRequirements],
+    ];
+    for (const [label, value] of fields) {
+        if (value === undefined || value === null || value === '')
+            continue;
+        writeLine(io.stdout, `  ${io.theme.dim(`${label}:`)} ${text(value)}`);
+    }
+    if (typeof control.notes === 'string' && control.notes.trim() !== '') {
+        writeLine(io.stdout);
+        writeLine(io.stdout, control.notes);
+    }
+};
+export const controlItemsCommand = async ({ io, name, apiUrl, json = false, credentialStore, search, page, limit, }) => {
+    const ctx = await resolveToolContext(apiUrl, credentialStore);
+    const input = { name };
+    if (search)
+        input.search = search;
+    if (page)
+        input.page = page;
+    if (limit)
+        input.limit = limit;
+    const envelope = await callTool(ctx, 'list_control_items', input);
+    if (envelope.status !== 'ok')
+        throw new Error(errorMessage(envelope, 'Could not read control items.'));
+    if (json) {
+        writeLine(io.stdout, JSON.stringify(envelope.data, null, 2));
+        return;
+    }
+    const data = asRecord(envelope.data);
+    const items = Array.isArray(data.items) ? data.items : [];
+    writeLine(io.stdout, `${io.theme.bold('Control items')} ${io.theme.dim(`(${items.length})`)}`);
+    if (items.length === 0) {
+        writeLine(io.stdout, 'No items linked.');
+        return;
+    }
+    writeTable(io, ['ITEM', 'TYPE', 'STATUS'], items.map((item) => {
+        const record = asRecord(item);
+        return [
+            text(record.name, text(record.id)),
+            text(record.itemType ?? record.type),
+            text(record.status),
+        ];
+    }));
+};
+export const controlAvailableItemsCommand = async ({ io, name, itemType, apiUrl, json = false, credentialStore, search, page, limit, }) => {
+    const ctx = await resolveToolContext(apiUrl, credentialStore);
+    const input = { name, itemType };
+    if (search)
+        input.search = search;
+    if (page)
+        input.page = page;
+    if (limit)
+        input.limit = limit;
+    const envelope = await callTool(ctx, 'list_control_items_available', input);
+    if (envelope.status !== 'ok')
+        throw new Error(errorMessage(envelope, 'Could not read available items.'));
+    if (json) {
+        writeLine(io.stdout, JSON.stringify(envelope.data, null, 2));
+        return;
+    }
+    const data = asRecord(envelope.data);
+    const items = Array.isArray(data.items) ? data.items : [];
+    writeLine(io.stdout, `${io.theme.bold(`Available ${itemType}s`)} ${io.theme.dim(`(${items.length})`)}`);
+    if (items.length === 0) {
+        writeLine(io.stdout, 'Nothing available to link.');
+        return;
+    }
+    writeTable(io, ['ITEM', 'STATUS'], items.map((item) => {
+        const record = asRecord(item);
+        return [text(record.name, text(record.id)), text(record.status)];
+    }));
+};
+export const controlUpdateCommand = async ({ io, name, apiUrl, json = false, yes = false, confirm, credentialStore, changes, }) => {
+    if (Object.keys(changes).length === 0) {
+        throw new Error('Provide at least one field, for example --applicability out_of_scope');
+    }
+    const ctx = await resolveToolContext(apiUrl, credentialStore);
+    const result = await applyTool({
+        ctx,
+        io,
+        toolName: 'update_control',
+        input: { name, changes },
+        fallback: 'Could not update the control.',
+        yes,
+        confirm,
+    });
+    if (!result)
+        return;
+    if (json)
+        writeLine(io.stdout, JSON.stringify(result.data, null, 2));
+    else {
+        const applied = asRecord(result.data).applied;
+        writeLine(io.stdout, `${io.theme.green('✓')} updated ${name}: ${Array.isArray(applied) ? applied.join(', ') : ''}`);
+    }
+};
+export const controlLinkCommand = async ({ io, name, action, itemType, itemId, apiUrl, json = false, yes = false, confirm, credentialStore, }) => {
+    const ctx = await resolveToolContext(apiUrl, credentialStore);
+    const result = await applyTool({
+        ctx,
+        io,
+        toolName: 'link_control_item',
+        input: { name, action, itemType, itemId },
+        fallback: 'Could not change the control item.',
+        yes,
+        confirm,
+    });
+    if (!result)
+        return;
+    if (json)
+        writeLine(io.stdout, JSON.stringify(result.data, null, 2));
+    else
+        writeLine(io.stdout, `${io.theme.green('✓')} ${action === 'unlink' ? 'unlinked' : 'linked'} ${itemType} on ${name}`);
+};

package/dist/commands/framework.d.ts

@@ -0,0 +1,40 @@
+import { type CliIO } from '../io.js';
+import type { CredentialStore } from '../credentials.js';
+export interface FrameworkListOptions {
+    io: CliIO;
+    apiUrl?: string | undefined;
+    json?: boolean | undefined;
+    credentialStore?: CredentialStore | undefined;
+}
+export declare const frameworkListCommand: ({ io, apiUrl, json, credentialStore, }: FrameworkListOptions) => Promise<void>;
+export interface ClauseTargetOptions {
+    io: CliIO;
+    framework: string;
+    clause: string;
+    apiUrl?: string | undefined;
+    json?: boolean | undefined;
+    credentialStore?: CredentialStore | undefined;
+}
+export declare const frameworkClausesCommand: ({ io, framework, apiUrl, json, credentialStore, search, applicability, page, limit, }: FrameworkListOptions & {
+    framework: string;
+    search?: string | undefined;
+    applicability?: string | undefined;
+    page?: number | undefined;
+    limit?: number | undefined;
+}) => Promise<void>;
+export declare const clauseGetCommand: ({ io, framework, clause, apiUrl, json, credentialStore, }: ClauseTargetOptions) => Promise<void>;
+export declare const clauseItemsCommand: ({ io, framework, clause, apiUrl, json, credentialStore, }: ClauseTargetOptions) => Promise<void>;
+export declare const clauseAvailableItemsCommand: ({ io, framework, clause, itemType, apiUrl, json, credentialStore, search, }: ClauseTargetOptions & {
+    itemType: string;
+    search?: string | undefined;
+}) => Promise<void>;
+export declare const clauseUpdateCommand: ({ io, framework, clause, changes, apiUrl, json, yes, credentialStore, }: ClauseTargetOptions & {
+    changes: Record<string, unknown>;
+    yes?: boolean | undefined;
+}) => Promise<void>;
+export declare const clauseLinkCommand: ({ io, framework, clause, action, itemType, itemId, apiUrl, json, yes, credentialStore, }: ClauseTargetOptions & {
+    action: string;
+    itemType: string;
+    itemId: string;
+    yes?: boolean | undefined;
+}) => Promise<void>;

package/dist/commands/framework.js

@@ -0,0 +1,181 @@
+import { writeLine, writeNextHint, writeTable } from '../io.js';
+import { asRecord, callTool, errorMessage, resolveToolContext, asText } from '../toolSurface.js';
+const text = (value, fallback = '-') => typeof value === 'string' ? value : typeof value === 'number' ? String(value) : fallback;
+export const frameworkListCommand = async ({ io, apiUrl, json = false, credentialStore, }) => {
+    const ctx = await resolveToolContext(apiUrl, credentialStore);
+    const envelope = await callTool(ctx, 'list_frameworks', {});
+    if (envelope.status !== 'ok')
+        throw new Error(errorMessage(envelope, 'Could not list frameworks.'));
+    if (json) {
+        writeLine(io.stdout, JSON.stringify(envelope.data, null, 2));
+        return;
+    }
+    const data = asRecord(envelope.data);
+    const active = Array.isArray(data.active) ? data.active : [];
+    const available = Array.isArray(data.available) ? data.available : [];
+    writeLine(io.stdout, `${io.theme.bold('Frameworks')} ${io.theme.dim(`(${active.length} applied)`)}`);
+    if (active.length > 0) {
+        writeTable(io, ['CODE', 'NAME', 'STATUS', 'READINESS'], active.map((framework) => {
+            const record = asRecord(framework);
+            const readiness = record.readinessScore ?? record.complianceScore;
+            return [
+                text(record.frameworkCode, '-'),
+                text(record.frameworkName ?? record.name),
+                text(record.status),
+                readiness === undefined || readiness === null ? '-' : `${text(readiness)}%`,
+            ];
+        }));
+    }
+    const firstFramework = asText(asRecord(active[0]).frameworkCode);
+    if (firstFramework)
+        writeNextHint(io, `ciphrix framework clauses ${firstFramework}`);
+    if (available.length > 0) {
+        writeLine(io.stdout);
+        writeLine(io.stdout, `${io.theme.dim(`Available to add (${available.length}):`)}`);
+        for (const framework of available) {
+            const record = asRecord(framework);
+            writeLine(io.stdout, `  ${text(record.frameworkName ?? record.name)}`);
+        }
+    }
+};
+export const frameworkClausesCommand = async ({ io, framework, apiUrl, json = false, credentialStore, search, applicability, page, limit, }) => {
+    const ctx = await resolveToolContext(apiUrl, credentialStore);
+    const input = { framework };
+    if (search)
+        input.search = search;
+    if (applicability)
+        input.applicability = [applicability];
+    if (page)
+        input.page = page;
+    if (limit)
+        input.limit = limit;
+    const envelope = await callTool(ctx, 'list_framework_clauses', input);
+    if (envelope.status !== 'ok')
+        throw new Error(errorMessage(envelope, 'Could not list clauses.'));
+    if (json) {
+        writeLine(io.stdout, JSON.stringify(envelope.data, null, 2));
+        return;
+    }
+    const data = asRecord(envelope.data);
+    const clauses = Array.isArray(data.clauses) ? data.clauses : [];
+    writeLine(io.stdout, `${io.theme.bold('Clauses')} ${io.theme.dim(`(${text(data.total, String(clauses.length))})`)}`);
+    if (clauses.length === 0) {
+        writeLine(io.stdout, 'No clauses found.');
+        return;
+    }
+    const firstClause = asText(asRecord(clauses[0]).code);
+    if (firstClause)
+        writeNextHint(io, `ciphrix framework clause ${framework} ${firstClause}`);
+    writeTable(io, ['CODE', 'NAME', 'APPLICABILITY', 'DESIGN REQ'], clauses.map((clause) => {
+        const record = asRecord(clause);
+        return [
+            text(record.code),
+            text(record.name),
+            text(record.applicability),
+            text(record.designRequirements),
+        ];
+    }));
+};
+export const clauseGetCommand = async ({ io, framework, clause, apiUrl, json = false, credentialStore, }) => {
+    const ctx = await resolveToolContext(apiUrl, credentialStore);
+    const envelope = await callTool(ctx, 'get_clause', { framework, clause });
+    if (envelope.status !== 'ok')
+        throw new Error(errorMessage(envelope, 'Clause not found.'));
+    const record = asRecord(asRecord(envelope.data).clause);
+    if (json) {
+        writeLine(io.stdout, JSON.stringify(record, null, 2));
+        return;
+    }
+    writeLine(io.stdout, `${io.theme.bold(text(record.name, 'Clause'))} ${io.theme.dim(`· ${text(record.code)}`)}`);
+    const fields = [
+        ['Applicability', record.applicability],
+        ['Design requirements', record.designRequirements],
+    ];
+    for (const [label, value] of fields) {
+        if (value === undefined || value === null || value === '')
+            continue;
+        writeLine(io.stdout, `  ${io.theme.dim(`${label}:`)} ${text(value)}`);
+    }
+};
+export const clauseItemsCommand = async ({ io, framework, clause, apiUrl, json = false, credentialStore, }) => {
+    const ctx = await resolveToolContext(apiUrl, credentialStore);
+    const envelope = await callTool(ctx, 'list_clause_items', { framework, clause });
+    if (envelope.status !== 'ok')
+        throw new Error(errorMessage(envelope, 'Could not read clause items.'));
+    if (json) {
+        writeLine(io.stdout, JSON.stringify(envelope.data, null, 2));
+        return;
+    }
+    const items = asRecord(envelope.data).items;
+    const list = Array.isArray(items) ? items : [];
+    writeLine(io.stdout, `${io.theme.bold('Clause items')} ${io.theme.dim(`(${list.length})`)}`);
+    if (list.length === 0) {
+        writeLine(io.stdout, 'No items mapped.');
+        return;
+    }
+    writeTable(io, ['ITEM', 'TYPE'], list.map((item) => {
+        const record = asRecord(item);
+        return [text(record.name, text(record.id)), text(record.itemType ?? record.type)];
+    }));
+};
+export const clauseAvailableItemsCommand = async ({ io, framework, clause, itemType, apiUrl, json = false, credentialStore, search, }) => {
+    const ctx = await resolveToolContext(apiUrl, credentialStore);
+    const input = { framework, clause, itemType };
+    if (search)
+        input.search = search;
+    const envelope = await callTool(ctx, 'list_clause_items_available', input);
+    if (envelope.status !== 'ok')
+        throw new Error(errorMessage(envelope, 'Could not read available items.'));
+    if (json) {
+        writeLine(io.stdout, JSON.stringify(envelope.data, null, 2));
+        return;
+    }
+    const items = asRecord(envelope.data).items;
+    const list = Array.isArray(items) ? items : [];
+    writeLine(io.stdout, `${io.theme.bold(`Available ${itemType}s`)} ${io.theme.dim(`(${list.length})`)}`);
+    for (const item of list) {
+        const record = asRecord(item);
+        writeLine(io.stdout, `  ${text(record.name, text(record.id))}`);
+    }
+};
+export const clauseUpdateCommand = async ({ io, framework, clause, changes, apiUrl, json = false, yes = false, credentialStore, }) => {
+    const { applyTool } = await import('../actions.js');
+    if (Object.keys(changes).length === 0) {
+        throw new Error('Provide at least one field, for example --applicability out_of_scope');
+    }
+    const ctx = await resolveToolContext(apiUrl, credentialStore);
+    const result = await applyTool({
+        ctx,
+        io,
+        toolName: 'update_clause',
+        input: { framework, clause, changes },
+        fallback: 'Could not update the clause.',
+        yes,
+    });
+    if (!result)
+        return;
+    if (json)
+        writeLine(io.stdout, JSON.stringify(result.data, null, 2));
+    else {
+        const applied = asRecord(result.data).applied;
+        writeLine(io.stdout, `${io.theme.green('✓')} updated ${clause}: ${Array.isArray(applied) ? applied.join(', ') : ''}`);
+    }
+};
+export const clauseLinkCommand = async ({ io, framework, clause, action, itemType, itemId, apiUrl, json = false, yes = false, credentialStore, }) => {
+    const { applyTool } = await import('../actions.js');
+    const ctx = await resolveToolContext(apiUrl, credentialStore);
+    const result = await applyTool({
+        ctx,
+        io,
+        toolName: 'link_clause_item',
+        input: { framework, clause, action, itemType, itemId },
+        fallback: 'Could not change the clause item.',
+        yes,
+    });
+    if (!result)
+        return;
+    if (json)
+        writeLine(io.stdout, JSON.stringify(result.data, null, 2));
+    else
+        writeLine(io.stdout, `${io.theme.green('✓')} ${action === 'unlink' ? 'unlinked' : 'linked'} ${itemType} on ${clause}`);
+};

package/dist/commands/job.d.ts

@@ -0,0 +1,16 @@
+import type { CredentialStore } from '../credentials.js';
+import { type CliIO } from '../io.js';
+export interface JobStatusOptions {
+    io: CliIO;
+    jobId: string;
+    apiUrl?: string | undefined;
+    json?: boolean | undefined;
+    credentialStore?: CredentialStore | undefined;
+}
+/**
+ * Check a background job started by another command (an evidence attachment, a generation job).
+ *
+ * Deliberately named "job": the product's "tasks" are user work items, and the interface never uses that
+ * word for background machinery.
+ */
+export declare const jobStatusCommand: ({ io, jobId, apiUrl, json, credentialStore, }: JobStatusOptions) => Promise<void>;

package/dist/commands/job.js

@@ -0,0 +1,30 @@
+import { writeLine } from '../io.js';
+import { asRecord, asText, callTool, errorMessage, resolveToolContext } from '../toolSurface.js';
+/**
+ * Check a background job started by another command (an evidence attachment, a generation job).
+ *
+ * Deliberately named "job": the product's "tasks" are user work items, and the interface never uses that
+ * word for background machinery.
+ */
+export const jobStatusCommand = async ({ io, jobId, apiUrl, json = false, credentialStore, }) => {
+    const ctx = await resolveToolContext(apiUrl, credentialStore);
+    const envelope = await callTool(ctx, 'get_job_status', { jobId });
+    if (envelope.status !== 'ok')
+        throw new Error(errorMessage(envelope, 'Job not found.'));
+    const data = asRecord(envelope.data);
+    if (json) {
+        writeLine(io.stdout, JSON.stringify(data, null, 2));
+        return;
+    }
+    const status = asText(data.status, 'unknown');
+    const marker = status === 'completed'
+        ? io.theme.green('✓')
+        : status === 'failed'
+            ? io.theme.red('✗')
+            : io.theme.dim('…');
+    writeLine(io.stdout, `${marker} ${asText(data.type, 'job')} · ${status}`);
+    const result = data.result;
+    if (result !== null && result !== undefined) {
+        writeLine(io.stdout, JSON.stringify(result, null, 2));
+    }
+};

package/dist/commands/login.d.ts

@@ -0,0 +1,12 @@
+import { type CredentialStore } from '../credentials.js';
+import { type CliIO } from '../io.js';
+export interface LoginOptions {
+    io: CliIO;
+    apiUrl?: string | undefined;
+    clientId?: string | undefined;
+    deviceName?: string | undefined;
+    noOpen?: boolean | undefined;
+    store?: CredentialStore | undefined;
+    openBrowser?: ((url: string) => Promise<boolean>) | undefined;
+}
+export declare const loginCommand: ({ io, apiUrl, clientId, deviceName, noOpen, store: injectedStore, openBrowser, }: LoginOptions) => Promise<void>;

package/dist/commands/login.js

@@ -0,0 +1,54 @@
+import { createApiClient } from '../api.js';
+import { openInBrowser } from '../browser.js';
+import { CLI_CLIENT_ID, resolveApiBaseUrl } from '../config.js';
+import { createCredentialStore } from '../credentials.js';
+import { resolveDeviceIdentity } from '../deviceInfo.js';
+import { pollForToken, requestDeviceCode } from '../deviceFlow.js';
+import { writeLine } from '../io.js';
+export const loginCommand = async ({ io, apiUrl, clientId = CLI_CLIENT_ID, deviceName, noOpen = false, store: injectedStore, openBrowser = openInBrowser, }) => {
+    const baseUrl = resolveApiBaseUrl({ flag: apiUrl });
+    const client = createApiClient(baseUrl);
+    const store = injectedStore ?? (await createCredentialStore());
+    const identity = resolveDeviceIdentity(deviceName);
+    const code = await requestDeviceCode(client, clientId, identity);
+    const link = code.verificationUriComplete ?? code.verificationUri;
+    writeLine(io.stdout, io.theme.bold('Authorize the Ciphrix CLI'));
+    writeLine(io.stdout);
+    writeLine(io.stdout, `  ${io.theme.cyan(link)}`);
+    writeLine(io.stdout);
+    writeLine(io.stdout, io.theme.dim(`Device: ${identity.deviceName} (${identity.devicePlatform})`));
+    if (code.verificationUriComplete) {
+        writeLine(io.stdout, io.theme.dim(`Or enter the code ${code.userCode} at ${code.verificationUri}`));
+    }
+    else {
+        writeLine(io.stdout, io.theme.dim(`Enter the code ${code.userCode}`));
+    }
+    writeLine(io.stdout, io.theme.dim('Waiting for approval…'));
+    if (!noOpen) {
+        const opened = await openBrowser(link);
+        if (!opened) {
+            writeLine(io.stdout, io.theme.dim('Could not open a browser automatically. Open the link above.'));
+        }
+    }
+    const token = await pollForToken({
+        client,
+        deviceCode: code.deviceCode,
+        intervalSeconds: code.intervalSeconds,
+        expiresInSeconds: code.expiresInSeconds,
+        clientId,
+    });
+    await store.set({ apiUrl: baseUrl, token });
+    // Label this session so the user can recognise it in their device list. Best-effort: a failure here
+    // must not fail the login.
+    try {
+        await client.request('/user/profile/sessions/label', {
+            method: 'POST',
+            token,
+            body: { deviceName: identity.deviceName, devicePlatform: identity.devicePlatform },
+        });
+    }
+    catch {
+        // ignore
+    }
+    writeLine(io.stdout, `${io.theme.green('✓')} Signed in to ${baseUrl}`);
+};

package/dist/commands/logout.d.ts

@@ -0,0 +1,9 @@
+import { type CredentialStore } from '../credentials.js';
+import { type CliIO } from '../io.js';
+export interface LogoutOptions {
+    io: CliIO;
+    apiUrl?: string | undefined;
+    store?: CredentialStore | undefined;
+    localOnly?: boolean | undefined;
+}
+export declare const logoutCommand: ({ io, apiUrl, store: injectedStore, localOnly, }: LogoutOptions) => Promise<void>;

package/dist/commands/logout.js

@@ -0,0 +1,56 @@
+import { ApiError, createApiClient } from '../api.js';
+import { resolveApiBaseUrl } from '../config.js';
+import { createCredentialStore } from '../credentials.js';
+import { writeLine } from '../io.js';
+const isInvalidCredential = (error) => {
+    if (!(error instanceof ApiError))
+        return false;
+    if (error.status === 401)
+        return true;
+    if (error.status !== 404)
+        return false;
+    return ['invalid_token', 'session_not_found', 'token_not_found', 'not_found'].includes(error.code?.toLowerCase() ?? '');
+};
+export const logoutCommand = async ({ io, apiUrl, store: injectedStore, localOnly = false, }) => {
+    const baseUrl = resolveApiBaseUrl({ flag: apiUrl });
+    const store = injectedStore ?? (await createCredentialStore());
+    const credential = await store.get(baseUrl);
+    if (!credential) {
+        writeLine(io.stdout, 'Not signed in.');
+        return;
+    }
+    if (localOnly) {
+        await store.clear(baseUrl);
+        writeLine(io.stdout, `${io.theme.yellow('!')} Removed the local credential for ${baseUrl}.`);
+        writeLine(io.stdout, 'The remote session is still active. Revoke it from the account session settings.');
+        return;
+    }
+    let alreadyInvalid = false;
+    try {
+        await createApiClient(baseUrl).request('/auth/sign-out', {
+            method: 'POST',
+            token: credential.token,
+        });
+    }
+    catch (error) {
+        if (!isInvalidCredential(error)) {
+            throw new Error(`Could not confirm remote session revocation. The credential was kept so you can retry. ` +
+                `Retry later, or use --local-only to remove it from this device without revoking the session.`, { cause: error });
+        }
+        alreadyInvalid = true;
+    }
+    try {
+        await store.clear(baseUrl);
+    }
+    catch {
+        if (alreadyInvalid) {
+            throw new Error('The remote session is no longer valid, but the local credential could not be removed. ' +
+                'Check the credential store and remove it manually if needed.');
+        }
+        throw new Error('The remote session was revoked, but the local credential could not be removed. ' +
+            'Check the credential store and remove it manually if needed.');
+    }
+    writeLine(io.stdout, alreadyInvalid
+        ? `${io.theme.green('✓')} The remote session was already invalid; removed the local credential for ${baseUrl}.`
+        : `${io.theme.green('✓')} Revoked the remote session and removed the local credential for ${baseUrl}.`);
+};

package/dist/commands/policy.d.ts

@@ -0,0 +1,23 @@
+import type { CredentialStore } from '../credentials.js';
+import { type CliIO } from '../io.js';
+export interface PolicyListOptions {
+    io: CliIO;
+    apiUrl?: string | undefined;
+    json?: boolean | undefined;
+    name?: string | undefined;
+    status?: string | undefined;
+    page?: number | undefined;
+    limit?: number | undefined;
+    store?: CredentialStore | undefined;
+}
+export interface PolicyGetOptions {
+    io: CliIO;
+    apiUrl?: string | undefined;
+    json?: boolean | undefined;
+    policy: string;
+    version?: number | undefined;
+    minor?: number | undefined;
+    store?: CredentialStore | undefined;
+}
+export declare const policyListCommand: ({ io, apiUrl, json, name, status, page, limit, store, }: PolicyListOptions) => Promise<void>;
+export declare const policyGetCommand: ({ io, apiUrl, json, policy, version, minor, store, }: PolicyGetOptions) => Promise<void>;