@doist/comms-cli 0.0.1 → 1.0.0

package/CHANGELOG.md

@@ -0,0 +1,8 @@
+## 1.0.0 (2026-05-25)
+
+### Features
+
+- add channel create and update commands ([#4](https://github.com/Doist/comms-cli/issues/4)) ([f097378](https://github.com/Doist/comms-cli/commit/f097378ed4dfa3c743ec33b31665d30bb4eae60c))
+- adopt cli-core DCR provider + account command attachers ([#5](https://github.com/Doist/comms-cli/issues/5)) ([4749a07](https://github.com/Doist/comms-cli/commit/4749a0707a798a5bd6c1ff2f6194553d9454ffef))
+- bootstrap Comms CLI from twist-cli ([ea28735](https://github.com/Doist/comms-cli/commit/ea28735784af503e9275b2ff14b6a31d1f5f19d7))
+- upgrade to @doist/comms-sdk@0.2.0 ([#2](https://github.com/Doist/comms-cli/issues/2)) ([ae4d6e1](https://github.com/Doist/comms-cli/commit/ae4d6e1de901d027dcbf8ed441597f1e36a25139))

package/README.md

@@ -1,45 +1,181 @@
-# @doist/comms-cli
+<p align="center">
+  <img src="icons/comms-cli.png" alt="Comms CLI" width="150" height="150" />
+</p>
 
-## ⚠️ IMPORTANT NOTICE ⚠️
+# Comms CLI
 
-**This package is created solely for the purpose of setting up OIDC (OpenID Connect) trusted publishing with npm.**
+A command-line interface for Comms.
 
-This is **NOT** a functional package and contains **NO** code or functionality beyond the OIDC setup configuration.
+## Installation
 
-## Purpose
+> ```bash
+> npm install -g @doist/comms-cli
+> ```
 
-This package exists to:
-1. Configure OIDC trusted publishing for the package name `@doist/comms-cli`
-2. Enable secure, token-less publishing from CI/CD workflows
-3. Establish provenance for packages published under this name
+### Agent Skills
 
-## What is OIDC Trusted Publishing?
+Install skills for your coding agent:
 
-OIDC trusted publishing allows package maintainers to publish packages directly from their CI/CD workflows without needing to manage npm access tokens. Instead, it uses OpenID Connect to establish trust between the CI/CD provider (like GitHub Actions) and npm.
+```bash
+tdc skill install claude-code
+tdc skill install codex
+tdc skill install cursor
+tdc skill install gemini
+tdc skill install pi
+tdc skill install universal
+```
 
-## Setup Instructions
+Skills are installed to `~/<agent-dir>/skills/comms-cli/SKILL.md` (e.g. `~/.claude/` for claude-code, `~/.agents/` for universal, etc.). When updating the CLI, installed skills are updated automatically. The `universal` agent is compatible with Amp, OpenCode, and other agents that read from `~/.agents/`.
 
-To properly configure OIDC trusted publishing for this package:
+```bash
+tdc skill list
+tdc skill uninstall <agent>
+```
 
-1. Go to [npmjs.com](https://www.npmjs.com/) and navigate to your package settings
-2. Configure the trusted publisher (e.g., GitHub Actions)
-3. Specify the repository and workflow that should be allowed to publish
-4. Use the configured workflow to publish your actual package
+## Uninstallation
 
-## DO NOT USE THIS PACKAGE
+First, remove any installed agent skills:
 
-This package is a placeholder for OIDC configuration only. It:
-- Contains no executable code
-- Provides no functionality
-- Should not be installed as a dependency
-- Exists only for administrative purposes
+```bash
+tdc skill uninstall <agent>
+```
 
-## More Information
+Then uninstall the CLI:
 
-For more details about npm's trusted publishing feature, see:
-- [npm Trusted Publishing Documentation](https://docs.npmjs.com/generating-provenance-statements)
-- [GitHub Actions OIDC Documentation](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect)
+```bash
+npm uninstall -g @doist/comms-cli
+```
 
----
+## Local Setup
 
-**Maintained for OIDC setup purposes only**
+```bash
+git clone https://github.com/Doist/comms-cli.git
+cd comms-cli
+npm install
+npm run build
+npm link
+```
+
+This makes the `tdc` command available globally.
+
+## Setup
+
+```bash
+tdc auth login
+```
+
+This opens your browser to authenticate with Comms. Once approved, the token is stored in your OS credential manager:
+
+- macOS: Keychain
+- Windows: Credential Manager
+- Linux: Secret Service/libsecret
+
+If secure storage is unavailable, the CLI warns and falls back to `~/.config/comms-cli/config.json`. Non-secret settings such as the current workspace remain in the config file.
+
+### Alternative methods
+
+**Manual token:**
+
+```bash
+tdc auth token
+```
+
+The CLI prompts for the token without echoing it. Do **not** pass the token as a positional argument — it would be visible in `ps` / shell history.
+
+**Environment variable:**
+
+```bash
+export COMMS_API_TOKEN="your-token"
+```
+
+`COMMS_API_TOKEN` always takes priority over the stored token.
+
+### Staging / alternate hosts
+
+Point the CLI at a non-production Comms instance with `COMMS_BASE_URL`:
+
+```bash
+export COMMS_BASE_URL=https://comms.staging.todoist.com
+export COMMS_API_TOKEN=<staging-token>
+tdc user
+```
+
+The base URL is threaded through both the SDK and the search endpoint. You need a token issued by that environment — production tokens are rejected.
+
+### Auth commands
+
+```bash
+tdc auth status   # check if authenticated
+tdc auth logout   # remove saved token
+```
+
+## Usage
+
+```bash
+tdc inbox                           # inbox threads
+tdc inbox --unread                  # unread threads only
+tdc mentions                        # content mentioning you
+tdc mentions --since 2026-04-01 --all --json
+tdc thread view <ref>               # view thread with comments
+tdc thread view <ref> --comment 123 # view a specific comment
+tdc thread reply <ref>              # reply to a thread
+tdc thread rename <ref> "New title" # rename a thread
+tdc thread update <ref> "New body"  # edit a thread's body (first post)
+tdc conversation unread             # list unread conversations
+tdc conversation view <ref>         # view conversation messages
+tdc msg view <ref>                  # view a conversation message
+tdc search "keyword"                # search across workspace
+tdc search "keyword" --all          # fetch all result pages
+tdc react thread <ref> 👍          # add reaction
+tdc away                            # show away status
+tdc away set vacation 2026-03-20    # set away until date
+tdc away clear                      # clear away status
+tdc groups                          # list groups in a workspace
+tdc groups view <ref>               # show a group with members
+tdc groups create "Frontend"        # create a group
+tdc groups create "FE" --users alice@doist.com,bob@doist.com
+tdc groups rename <ref> "New name"  # rename a group
+tdc groups delete <ref> --yes       # delete a group
+tdc groups add-user <ref> alice@doist.com bob@doist.com
+tdc groups remove-user <ref> id:123,id:456
+```
+
+References accept IDs (`123` or `id:123`), Comms URLs, or fuzzy names (for workspaces/users).
+
+Run `tdc --help` or `tdc <command> --help` for more options.
+
+## Shell Completions
+
+Tab completion is available for bash, zsh, and fish:
+
+```bash
+tdc completion install        # prompts for shell
+tdc completion install bash   # or: zsh, fish
+```
+
+Restart your shell or source your config file to activate. To remove:
+
+```bash
+tdc completion uninstall
+```
+
+## Machine-readable output
+
+All list/view commands support `--json` and `--ndjson` flags for scripting:
+
+```bash
+tdc inbox --json                    # JSON array
+tdc inbox --ndjson                  # newline-delimited JSON
+tdc inbox --json --full             # include all fields
+```
+
+## Development
+
+```bash
+npm install
+npm run build       # compile
+npm run dev         # watch mode
+npm run type-check  # type check
+npm run format      # format code
+npm test            # run tests
+```

package/dist/commands/account/index.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function registerAccountCommand(program: Command): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/commands/account/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/account/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AA0BnC,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA2F7D"}

package/dist/commands/account/index.js

@@ -0,0 +1,104 @@
+import { emitView } from '@doist/cli-core';
+import { attachAccountCurrentCommand, attachAccountListCommand, attachAccountRemoveCommand, attachAccountUseCommand, } from '@doist/cli-core/auth';
+import chalk from 'chalk';
+import { createCommsTokenStore, isManualTokenAccount, } from '../../lib/auth-provider.js';
+import { TOKEN_ENV_VAR } from '../../lib/auth.js';
+import { CliError } from '../../lib/errors.js';
+import { logStoredTokenRemoval } from '../auth/helpers.js';
+/**
+ * Hide identity-less manual-token snapshots (from `tdc auth token`) from `list`:
+ * they can't be the target of `use` / `remove` and would render as blank
+ * id/label rows. `account current` surfaces the active manual-token state
+ * separately via its renderers. cli-core's list attacher reads the roster
+ * through the store, so the filter lives in a store wrapper.
+ */
+function hideManualTokens(store) {
+    return Object.assign(Object.create(store), {
+        async list() {
+            const records = await store.list();
+            return records.filter(({ account }) => !isManualTokenAccount(account));
+        },
+    });
+}
+export function registerAccountCommand(program) {
+    const account = program.command('account').description('Manage stored CLI accounts');
+    const store = createCommsTokenStore();
+    attachAccountListCommand(account, {
+        store: hideManualTokens(store),
+        description: 'List stored CLI accounts',
+        renderText: (ctx) => {
+            if (ctx.accounts.length === 0) {
+                return 'No stored accounts. Run `tdc auth login` to add one.';
+            }
+            const lines = [`Stored accounts (${ctx.accounts.length}):`];
+            for (const { account: acc, isDefault } of ctx.accounts) {
+                const marker = isDefault ? chalk.green('*') : ' ';
+                lines.push(`  ${marker} ${chalk.dim(`id:${acc.id}`)}  ${acc.label}`);
+            }
+            const def = ctx.accounts.find((entry) => entry.isDefault);
+            if (def) {
+                lines.push(`Default: ${chalk.dim(`id:${def.account.id}`)}  ${def.account.label}`);
+            }
+            return lines;
+        },
+    });
+    attachAccountUseCommand(account, {
+        store,
+        description: 'Set the default stored account (id, id:<n>, or display name)',
+    });
+    attachAccountRemoveCommand(account, {
+        store,
+        description: 'Remove a stored account (clears keyring + config entry)',
+        onRemoved: (ctx) => logStoredTokenRemoval(store, ctx.view),
+    });
+    // env-token sessions resolve as `null` from `store.activeAccount()` (see
+    // auth-provider.ts), so the env notice lives in `onNotAuthenticated` — the
+    // one async hook. A manual-token snapshot stays a resolved account and is
+    // special-cased in the renderers; a real account renders as `config`.
+    attachAccountCurrentCommand(account, {
+        store,
+        description: 'Show the currently active account (honours COMMS_API_TOKEN)',
+        renderText: ({ account: acc }) => {
+            if (isManualTokenAccount(acc)) {
+                return [
+                    'Active token saved via `tdc auth token` (no associated identity).',
+                    chalk.dim('Run `tdc auth login` to attach an account to the token.'),
+                ];
+            }
+            const lines = [
+                `Active account: ${chalk.dim(`id:${acc.id}`)}  ${acc.label}`,
+                `  Mode:  ${acc.authMode}`,
+            ];
+            if (acc.authScope)
+                lines.push(`  Scope: ${acc.authScope}`);
+            return lines;
+        },
+        renderJson: ({ account: acc }) => isManualTokenAccount(acc)
+            ? { source: 'token-only' }
+            : {
+                id: acc.id,
+                label: acc.label,
+                authMode: acc.authMode,
+                authScope: acc.authScope || undefined,
+                source: 'config',
+            },
+        async onNotAuthenticated({ view }) {
+            if (process.env[TOKEN_ENV_VAR]) {
+                emitView(view, { source: 'env' }, () => [
+                    `Active token sourced from environment variable ${TOKEN_ENV_VAR} (no stored account).`,
+                ]);
+                return;
+            }
+            throw new CliError('NO_TOKEN', 'No stored account is currently active.', [
+                'Run: tdc auth login',
+            ]);
+        },
+    });
+    account._defaultCommandName = 'list';
+    account.addHelpText('after', `
+Examples:
+  tdc account                       # list stored accounts (default subcommand)
+  tdc account use "Alan Grant"      # pin Alan as the default account (id, id:N, or name)
+  tdc account remove id:42          # forget id:42 (clears keyring + config entry)`);
+}
+//# sourceMappingURL=index.js.map

package/dist/commands/account/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/account/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC1C,OAAO,EACH,2BAA2B,EAC3B,wBAAwB,EACxB,0BAA0B,EAC1B,uBAAuB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAEH,qBAAqB,EACrB,oBAAoB,GACvB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAE1D;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,KAAsB;IAC5C,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAoB,EAAE;QAC1D,KAAK,CAAC,IAAI;YACN,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;YAClC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAA;QAC1E,CAAC;KACJ,CAAC,CAAA;AACN,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,4BAA4B,CAAC,CAAA;IACpF,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAA;IAErC,wBAAwB,CAAC,OAAO,EAAE;QAC9B,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC;QAC9B,WAAW,EAAE,0BAA0B;QACvC,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE;YAChB,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAO,sDAAsD,CAAA;YACjE,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,oBAAoB,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;YAC3D,KAAK,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACrD,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;gBACjD,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC,CAAA;YACxE,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;YACzD,IAAI,GAAG,EAAE,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;YACrF,CAAC;YACD,OAAO,KAAK,CAAA;QAChB,CAAC;KACJ,CAAC,CAAA;IAEF,uBAAuB,CAAC,OAAO,EAAE;QAC7B,KAAK;QACL,WAAW,EAAE,8DAA8D;KAC9E,CAAC,CAAA;IAEF,0BAA0B,CAAC,OAAO,EAAE;QAChC,KAAK;QACL,WAAW,EAAE,yDAAyD;QACtE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,qBAAqB,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC;KAC7D,CAAC,CAAA;IAEF,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,sEAAsE;IACtE,2BAA2B,CAAC,OAAO,EAAE;QACjC,KAAK;QACL,WAAW,EAAE,6DAA6D;QAC1E,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE;YAC7B,IAAI,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,OAAO;oBACH,mEAAmE;oBACnE,KAAK,CAAC,GAAG,CAAC,yDAAyD,CAAC;iBACvE,CAAA;YACL,CAAC;YACD,MAAM,KAAK,GAAG;gBACV,mBAAmB,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE;gBAC5D,YAAY,GAAG,CAAC,QAAQ,EAAE;aAC7B,CAAA;YACD,IAAI,GAAG,CAAC,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,SAAS,EAAE,CAAC,CAAA;YAC1D,OAAO,KAAK,CAAA;QAChB,CAAC;QACD,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAC7B,oBAAoB,CAAC,GAAG,CAAC;YACrB,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE;YAC1B,CAAC,CAAC;gBACI,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;gBACrC,MAAM,EAAE,QAAQ;aACnB;QACX,KAAK,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE;YAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC7B,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC;oBACpC,kDAAkD,aAAa,uBAAuB;iBACzF,CAAC,CAAA;gBACF,OAAM;YACV,CAAC;YACD,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,wCAAwC,EAAE;gBACrE,qBAAqB;aACxB,CAAC,CAAA;QACN,CAAC;KACJ,CAAC,CAID;IAAC,OAAsD,CAAC,mBAAmB,GAAG,MAAM,CAAA;IAErF,OAAO,CAAC,WAAW,CACf,OAAO,EACP;;;;mFAI2E,CAC9E,CAAA;AACL,CAAC"}

package/dist/commands/auth/helpers.d.ts

@@ -0,0 +1,22 @@
+import type { TokenStorageResult } from '@doist/cli-core/auth';
+/**
+ * Surface a `TokenStorageResult` from a save/clear operation: the
+ * human-readable confirmation goes to stdout, any keyring-fallback warning
+ * goes to stderr. Pass `isMachineOutput: true` when the command is in
+ * `--json` / `--ndjson` mode so the stdout confirmation is suppressed and
+ * the warning still reaches the operator on stderr.
+ */
+export declare function logTokenStorageResult(result: TokenStorageResult, secureStoreMessage: string, isMachineOutput?: boolean): void;
+/**
+ * Surface the result of a token-store `clear()` (stashed on the adapter via
+ * `getLastClearResult`, since cli-core's `clear` can't return it directly).
+ * Shared by `auth logout`'s `onCleared` and `account remove`'s `onRemoved` so
+ * the confirmation/warning UX can't drift between the two.
+ */
+export declare function logStoredTokenRemoval(store: {
+    getLastClearResult(): TokenStorageResult | undefined;
+}, view: {
+    json?: boolean;
+    ndjson?: boolean;
+}): void;
+//# sourceMappingURL=helpers.d.ts.map

package/dist/commands/auth/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAG9D;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACjC,MAAM,EAAE,kBAAkB,EAC1B,kBAAkB,EAAE,MAAM,EAC1B,eAAe,UAAQ,GACxB,IAAI,CAON;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACjC,KAAK,EAAE;IAAE,kBAAkB,IAAI,kBAAkB,GAAG,SAAS,CAAA;CAAE,EAC/D,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3C,IAAI,CAQN"}

package/dist/commands/auth/helpers.js

@@ -0,0 +1,29 @@
+import chalk from 'chalk';
+/**
+ * Surface a `TokenStorageResult` from a save/clear operation: the
+ * human-readable confirmation goes to stdout, any keyring-fallback warning
+ * goes to stderr. Pass `isMachineOutput: true` when the command is in
+ * `--json` / `--ndjson` mode so the stdout confirmation is suppressed and
+ * the warning still reaches the operator on stderr.
+ */
+export function logTokenStorageResult(result, secureStoreMessage, isMachineOutput = false) {
+    if (!isMachineOutput && result.storage === 'secure-store') {
+        console.log(chalk.dim(secureStoreMessage));
+    }
+    if (result.warning) {
+        console.error(chalk.yellow('Warning:'), result.warning);
+    }
+}
+/**
+ * Surface the result of a token-store `clear()` (stashed on the adapter via
+ * `getLastClearResult`, since cli-core's `clear` can't return it directly).
+ * Shared by `auth logout`'s `onCleared` and `account remove`'s `onRemoved` so
+ * the confirmation/warning UX can't drift between the two.
+ */
+export function logStoredTokenRemoval(store, view) {
+    const result = store.getLastClearResult();
+    if (!result)
+        return;
+    logTokenStorageResult(result, 'Stored token removed from the system credential manager', view.json || view.ndjson);
+}
+//# sourceMappingURL=helpers.js.map

package/dist/commands/auth/helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../../../src/commands/auth/helpers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACjC,MAA0B,EAC1B,kBAA0B,EAC1B,eAAe,GAAG,KAAK;IAEvB,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAA;IAC9C,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;IAC3D,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACjC,KAA+D,EAC/D,IAA0C;IAE1C,MAAM,MAAM,GAAG,KAAK,CAAC,kBAAkB,EAAE,CAAA;IACzC,IAAI,CAAC,MAAM;QAAE,OAAM;IACnB,qBAAqB,CACjB,MAAM,EACN,yDAAyD,EACzD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAC3B,CAAA;AACL,CAAC"}

package/dist/commands/auth/index.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function registerAuthCommand(program: Command): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/commands/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAUnC,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA0B1D"}

package/dist/commands/auth/index.js

@@ -0,0 +1,32 @@
+import { attachTokenViewCommand } from '@doist/cli-core/auth';
+import { createCommsTokenStore } from '../../lib/auth-provider.js';
+import { TOKEN_ENV_VAR } from '../../lib/auth.js';
+import { getRequestedUserRef } from '../../lib/global-args.js';
+import { attachCommsLoginCommand } from './login.js';
+import { attachCommsLogoutCommand } from './logout.js';
+import { attachCommsStatusCommand } from './status.js';
+import { withUserRefAware } from './store-wrap.js';
+import { loginWithToken } from './token.js';
+export function registerAuthCommand(program) {
+    const auth = program.command('auth').description('Manage authentication');
+    const store = createCommsTokenStore();
+    const refAware = withUserRefAware(store, getRequestedUserRef());
+    attachCommsLoginCommand(auth, store);
+    attachCommsLogoutCommand(auth, refAware);
+    attachCommsStatusCommand(auth, refAware);
+    // `token` is a hybrid: bare `tdc auth token` prompts interactively to save
+    // a token, and the `view` subcommand prints it. Tokens are never accepted
+    // as positional/CLI arguments — that would leak them via process lists
+    // and shell history (Doist Secrets Management Standard).
+    const tokenCmd = auth
+        .command('token')
+        .description('Save API token for CLI authentication (or use a subcommand: `view`)')
+        .action(() => loginWithToken());
+    attachTokenViewCommand(tokenCmd, {
+        name: 'view',
+        store: refAware,
+        envVarName: TOKEN_ENV_VAR,
+        description: 'Print the stored API token for the active user (or --user <ref>) to stdout for use in scripts',
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/commands/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAE7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE3C,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAA;IAEzE,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAA;IACrC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAE/D,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACpC,wBAAwB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACxC,wBAAwB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAExC,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,yDAAyD;IACzD,MAAM,QAAQ,GAAG,IAAI;SAChB,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,qEAAqE,CAAC;SAClF,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,CAAA;IAEnC,sBAAsB,CAAC,QAAQ,EAAE;QAC7B,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,QAAQ;QACf,UAAU,EAAE,aAAa;QACzB,WAAW,EACP,+FAA+F;KACtG,CAAC,CAAA;AACN,CAAC"}

package/dist/commands/auth/login.d.ts

@@ -0,0 +1,4 @@
+import type { Command } from 'commander';
+import { type CommsTokenStore } from '../../lib/auth-provider.js';
+export declare function attachCommsLoginCommand(parent: Command, store: CommsTokenStore): Command;
+//# sourceMappingURL=login.d.ts.map

package/dist/commands/auth/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/login.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAExC,OAAO,EAGH,KAAK,eAAe,EACvB,MAAM,4BAA4B,CAAA;AAKnC,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CA0BxF"}

package/dist/commands/auth/login.js

@@ -0,0 +1,29 @@
+import { attachLoginCommand } from '@doist/cli-core/auth';
+import chalk from 'chalk';
+import { renderError, renderSuccess } from '../../lib/auth-pages.js';
+import { createCommsAuthProvider, getScopes, } from '../../lib/auth-provider.js';
+import { logTokenStorageResult } from './helpers.js';
+const PREFERRED_CALLBACK_PORT = 8766;
+export function attachCommsLoginCommand(parent, store) {
+    const provider = createCommsAuthProvider();
+    return attachLoginCommand(parent, {
+        provider,
+        store,
+        preferredPort: PREFERRED_CALLBACK_PORT,
+        resolveScopes: ({ readOnly }) => getScopes(readOnly),
+        renderSuccess,
+        renderError,
+        onSuccess({ view, account }) {
+            const isMachineOutput = view.json || view.ndjson;
+            if (!isMachineOutput) {
+                console.log(chalk.green('✓'), 'OAuth authentication successful!');
+                console.log(chalk.dim(`Logged in as ${account.label}`));
+            }
+            const result = store.getLastStorageResult();
+            if (result) {
+                logTokenStorageResult(result, 'Token stored securely in the system credential manager', isMachineOutput);
+            }
+        },
+    }).description('Authenticate using OAuth (opens browser)');
+}
+//# sourceMappingURL=login.js.map

package/dist/commands/auth/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/commands/auth/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AACpE,OAAO,EACH,uBAAuB,EACvB,SAAS,GAEZ,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAEpD,MAAM,uBAAuB,GAAG,IAAI,CAAA;AAEpC,MAAM,UAAU,uBAAuB,CAAC,MAAe,EAAE,KAAsB;IAC3E,MAAM,QAAQ,GAAG,uBAAuB,EAAE,CAAA;IAE1C,OAAO,kBAAkB,CAAC,MAAM,EAAE;QAC9B,QAAQ;QACR,KAAK;QACL,aAAa,EAAE,uBAAuB;QACtC,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC;QACpD,aAAa;QACb,WAAW;QACX,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;YACvB,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAA;YAChD,IAAI,CAAC,eAAe,EAAE,CAAC;gBACnB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,kCAAkC,CAAC,CAAA;gBACjE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;YAC3D,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,oBAAoB,EAAE,CAAA;YAC3C,IAAI,MAAM,EAAE,CAAC;gBACT,qBAAqB,CACjB,MAAM,EACN,wDAAwD,EACxD,eAAe,CAClB,CAAA;YACL,CAAC;QACL,CAAC;KACJ,CAAC,CAAC,WAAW,CAAC,0CAA0C,CAAC,CAAA;AAC9D,CAAC"}

package/dist/commands/auth/logout.d.ts

@@ -0,0 +1,11 @@
+import type { Command } from 'commander';
+import type { CommsTokenStore } from '../../lib/auth-provider.js';
+/**
+ * Attach `tdc auth logout` via cli-core's generic `attachLogoutCommand`. The
+ * registrar emits the success line (`✓ Logged out` / `{ok:true}` / silent
+ * ndjson); `onCleared` only surfaces the keyring-fallback warning carried by
+ * `TokenStorageResult` — cli-core's `TokenStore.clear: void` contract can't
+ * expose it directly, so we stash it on the adapter (`getLastClearResult`).
+ */
+export declare function attachCommsLogoutCommand(auth: Command, store: CommsTokenStore): Command;
+//# sourceMappingURL=logout.d.ts.map

package/dist/commands/auth/logout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/logout.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,KAAK,EAAgB,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAG/E;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAKvF"}

package/dist/commands/auth/logout.js

@@ -0,0 +1,16 @@
+import { attachLogoutCommand } from '@doist/cli-core/auth';
+import { logStoredTokenRemoval } from './helpers.js';
+/**
+ * Attach `tdc auth logout` via cli-core's generic `attachLogoutCommand`. The
+ * registrar emits the success line (`✓ Logged out` / `{ok:true}` / silent
+ * ndjson); `onCleared` only surfaces the keyring-fallback warning carried by
+ * `TokenStorageResult` — cli-core's `TokenStore.clear: void` contract can't
+ * expose it directly, so we stash it on the adapter (`getLastClearResult`).
+ */
+export function attachCommsLogoutCommand(auth, store) {
+    return attachLogoutCommand(auth, {
+        store,
+        onCleared: ({ view }) => logStoredTokenRemoval(store, view),
+    });
+}
+//# sourceMappingURL=logout.js.map

package/dist/commands/auth/logout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../../src/commands/auth/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAG1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAEpD;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAa,EAAE,KAAsB;IAC1E,OAAO,mBAAmB,CAAe,IAAI,EAAE;QAC3C,KAAK;QACL,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC;KAC9D,CAAC,CAAA;AACN,CAAC"}

package/dist/commands/auth/status.d.ts

@@ -0,0 +1,16 @@
+import type { Command } from 'commander';
+import type { CommsTokenStore } from '../../lib/auth-provider.js';
+/**
+ * Attach `tdc auth status` via cli-core's generic `attachStatusCommand`.
+ *
+ * `CommsTokenStore.active()` returns a snapshot whenever a token resolves
+ * (per the adapter's documented contract — see `auth-provider.ts`), so
+ * `fetchLive` covers every token-present path: secure-store, plaintext
+ * config fallback, env-token mode, and manual `tdc auth token`. The
+ * snapshot's token is reused inside `gatherStatusData` so credentials are
+ * read once per invocation. `onNotAuthenticated` only fires when nothing
+ * is stored — it throws `NoTokenError` so the standard CliError envelope
+ * reaches the operator unchanged.
+ */
+export declare function attachCommsStatusCommand(auth: Command, store: CommsTokenStore): Command;
+//# sourceMappingURL=status.d.ts.map

package/dist/commands/auth/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/status.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAExC,OAAO,KAAK,EAAgB,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAiE/E;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CA+BvF"}