@ggui-ai/cli 0.1.0-rc.1

package/dist/auth-keys.js

@@ -0,0 +1,382 @@
+/**
+ * `ggui keys <list|create|revoke|register>` — manage CLI keys.
+ *
+ * - `list` / `create` / `revoke` operate on `ggui_user_*` connector
+ *   keys (MCP transport bearers). One-time reveal model on `create`.
+ * - `register` registers a per-scope Ed25519 PUBLISHER key with the
+ *   marketplace registry's `POST /author-keys` endpoint. Distinct
+ *   from connector keys: the
+ *   publisher key is auto-generated locally by `ggui gadget publish`
+ *   / `ggui blueprint publish`; `register` ships its public half to
+ *   the registry so future signed publishes validate.
+ */
+import process from 'node:process';
+import { ApiError, createKey, listKeys, revokeKey } from './api-client.js';
+import { formatLocalKeyTable, loadLocalKeys, mintLocalKey, revokeLocalKey, saveLocalKeys, } from './local-keys.js';
+import { runRegisterAuthorKey } from './internal/register-author-key.js';
+export const KEYS_HELP = `ggui keys — manage CLI keys
+
+Usage:
+  ggui keys list                          [--keys-file <path>]
+  ggui keys create  [--name <label>] [--expires-at <iso8601>] [--keys-file <path>]
+  ggui keys revoke  <id>                  [--keys-file <path>]
+  ggui keys register --scope <@scope>    [--registry <url>]
+
+list      Print the caller's keys (id, prefix, name, status, dates).
+create    Mint a new connector key. The full secret is printed ONCE — copy it.
+revoke    Soft-revoke a connector key by id (the row stays for audit).
+register  Register a per-scope Ed25519 PUBLISHER key with the marketplace
+          registry so future \`ggui gadget publish\` / \`ggui blueprint publish\`
+          signed by the matching private key validate. The keypair is
+          auto-generated on first publish under
+          ~/.ggui/keys/<scope>/{private,public}.key — this verb ships
+          the public half to the registry's POST /author-keys.
+
+Pass --keys-file <path> to operate on the LOCAL JSON file instead of
+the cloud (api.ggui.ai). The file format is the one written by
+\`ggui serve --keys-file\` — the two commands share the same store, so
+you can mint a bearer here and have \`ggui serve\` accept it on next
+boot. Use this for self-host / personal-mode workflows. --keys-file
+applies to list/create/revoke only; \`register\` always talks to the
+marketplace registry.
+`;
+export async function runKeysCommand(args) {
+    const [sub, ...rest] = args;
+    if (!sub || sub === '--help' || sub === '-h') {
+        process.stdout.write(KEYS_HELP);
+        return sub ? 0 : 2;
+    }
+    switch (sub) {
+        case 'list':
+            return runKeysList(rest);
+        case 'create':
+            return runKeysCreate(rest);
+        case 'revoke':
+            return runKeysRevoke(rest);
+        case 'register':
+            return runKeysRegister(rest);
+        default:
+            process.stderr.write(`ggui keys: unknown subcommand "${sub}"\n\n`);
+            process.stderr.write(KEYS_HELP);
+            return 2;
+    }
+}
+/**
+ * Pull `--keys-file <path>` out of an arg list. Returns the path
+ * (when present) and the residual args for downstream parsers.
+ * `--keys-file=<path>` long-form is also accepted because operators
+ * sometimes type it that way.
+ */
+function takeKeysFile(args) {
+    const rest = [];
+    let keysFile;
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === '--keys-file') {
+            const value = args[i + 1];
+            if (typeof value === 'string' && value.length > 0) {
+                keysFile = value;
+                i += 1;
+                continue;
+            }
+        }
+        else if (arg.startsWith('--keys-file=')) {
+            keysFile = arg.slice('--keys-file='.length);
+            continue;
+        }
+        rest.push(arg);
+    }
+    return keysFile === undefined ? { rest } : { keysFile, rest };
+}
+async function runKeysList(args) {
+    const { keysFile, rest } = takeKeysFile(args);
+    if (keysFile) {
+        if (rest.length > 0) {
+            process.stderr.write(`ggui keys list: unexpected extra args ${rest.join(' ')}\n`);
+            return 2;
+        }
+        try {
+            const state = loadLocalKeys(keysFile);
+            process.stdout.write(formatLocalKeyTable(state));
+            return 0;
+        }
+        catch (err) {
+            process.stderr.write(`ggui keys list: ${err instanceof Error ? err.message : String(err)}\n`);
+            return 1;
+        }
+    }
+    if (rest.length > 0) {
+        process.stderr.write(`ggui keys list: takes no arguments\n`);
+        return 2;
+    }
+    try {
+        const { keys } = await listKeys();
+        if (keys.length === 0) {
+            process.stdout.write(`No keys. Run \`ggui keys create\` to mint one.\n`);
+            return 0;
+        }
+        // Compact aligned table. Columns are sized by content width with a
+        // sane minimum so empty rows still render readably.
+        const rows = keys.map((k) => [
+            k.id,
+            `ggui_user_${k.apiKeyPrefix}…`,
+            k.name ?? '',
+            k.status,
+            k.lastUsedAt ?? '—',
+        ]);
+        const headers = ['ID', 'PREFIX', 'NAME', 'STATUS', 'LAST USED'];
+        const widths = headers.map((h, i) => Math.max(h.length, ...rows.map((r) => (r[i] ?? '').length)));
+        const fmt = (cells) => cells.map((c, i) => c.padEnd(widths[i] ?? 0)).join('  ');
+        process.stdout.write(`${fmt(headers)}\n`);
+        for (const row of rows) {
+            process.stdout.write(`${fmt(row)}\n`);
+        }
+        return 0;
+    }
+    catch (err) {
+        return printApiError('keys list', err);
+    }
+}
+function parseCreateFlags(args) {
+    let name;
+    let expiresAt;
+    let help = false;
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === '--help' || arg === '-h') {
+            help = true;
+            continue;
+        }
+        if (arg === '--name') {
+            const value = args[i + 1];
+            if (typeof value !== 'string' || value.length === 0) {
+                return { help, error: '--name requires a value' };
+            }
+            name = value;
+            i += 1;
+            continue;
+        }
+        if (arg === '--expires-at') {
+            const value = args[i + 1];
+            if (typeof value !== 'string' || value.length === 0) {
+                return { help, error: '--expires-at requires an ISO 8601 value' };
+            }
+            expiresAt = value;
+            i += 1;
+            continue;
+        }
+        return { help, error: `unknown flag: ${arg}` };
+    }
+    return { name, expiresAt, help };
+}
+async function runKeysCreate(args) {
+    const { keysFile, rest: afterKeysFile } = takeKeysFile(args);
+    if (keysFile) {
+        const flags = parseCreateFlags(afterKeysFile);
+        if (flags.help) {
+            process.stdout.write(KEYS_HELP);
+            return 0;
+        }
+        if (flags.error) {
+            process.stderr.write(`ggui keys create: ${flags.error}\n`);
+            return 2;
+        }
+        if (flags.expiresAt) {
+            process.stderr.write(`ggui keys create: --expires-at is not supported with --keys-file (local store has no TTL).\n`);
+            return 2;
+        }
+        try {
+            const state = loadLocalKeys(keysFile);
+            const row = mintLocalKey(state, {
+                deviceName: flags.name ?? `cli-${new Date().toISOString().slice(0, 10)}`,
+            });
+            saveLocalKeys(keysFile, state);
+            process.stdout.write(`\n`);
+            process.stdout.write(`API key:    ${row.token}\n`);
+            process.stdout.write(`ID:         ${row.pairingId}\n`);
+            process.stdout.write(`Name:       ${row.deviceName}\n`);
+            process.stdout.write(`Created:    ${new Date(row.createdAt).toISOString()}\n`);
+            process.stdout.write(`File:       ${keysFile}\n`);
+            process.stdout.write(`\n`);
+            process.stdout.write(`IMPORTANT: copy the API key now — it will NEVER be shown again.\n`);
+            process.stdout.write(`Use it as the bearer token for any client that hits this server's /mcp.\n`);
+            return 0;
+        }
+        catch (err) {
+            process.stderr.write(`ggui keys create: ${err instanceof Error ? err.message : String(err)}\n`);
+            return 1;
+        }
+    }
+    const flags = parseCreateFlags(afterKeysFile);
+    if (flags.help) {
+        process.stdout.write(KEYS_HELP);
+        return 0;
+    }
+    if (flags.error) {
+        process.stderr.write(`ggui keys create: ${flags.error}\n`);
+        return 2;
+    }
+    try {
+        const result = await createKey({
+            name: flags.name,
+            expiresAt: flags.expiresAt,
+        });
+        process.stdout.write(`\n`);
+        process.stdout.write(`API key:    ${result.apiKey}\n`);
+        process.stdout.write(`ID:         ${result.id}\n`);
+        process.stdout.write(`Prefix:     ${result.prefix}\n`);
+        process.stdout.write(`Created:    ${result.createdAt}\n`);
+        process.stdout.write(`\n`);
+        process.stdout.write(`IMPORTANT: copy the API key now — it will NEVER be shown again.\n`);
+        process.stdout.write(`Use it as the bearer token for the ggui-protocol-user MCP server.\n`);
+        return 0;
+    }
+    catch (err) {
+        return printApiError('keys create', err);
+    }
+}
+async function runKeysRevoke(args) {
+    const { keysFile, rest } = takeKeysFile(args);
+    if (rest.length === 0 || rest[0] === '--help' || rest[0] === '-h') {
+        process.stdout.write(KEYS_HELP);
+        return rest.length === 0 ? 2 : 0;
+    }
+    if (rest.length !== 1) {
+        process.stderr.write(`ggui keys revoke: takes exactly one <id> argument\n`);
+        return 2;
+    }
+    const id = rest[0];
+    if (keysFile) {
+        try {
+            const state = loadLocalKeys(keysFile);
+            const removed = revokeLocalKey(state, id);
+            if (!removed) {
+                process.stderr.write(`ggui keys revoke: no key with id "${id}" in ${keysFile}\n`);
+                return 1;
+            }
+            saveLocalKeys(keysFile, state);
+            process.stdout.write(`Revoked ${id} from ${keysFile}.\n`);
+            return 0;
+        }
+        catch (err) {
+            process.stderr.write(`ggui keys revoke: ${err instanceof Error ? err.message : String(err)}\n`);
+            return 1;
+        }
+    }
+    try {
+        await revokeKey(id);
+        process.stdout.write(`Revoked key ${id}.\n`);
+        return 0;
+    }
+    catch (err) {
+        return printApiError('keys revoke', err);
+    }
+}
+function printApiError(label, err) {
+    if (err instanceof ApiError) {
+        process.stderr.write(`ggui ${label}: ${err.code}: ${err.message}\n`);
+    }
+    else if (err instanceof Error) {
+        process.stderr.write(`ggui ${label}: ${err.message}\n`);
+    }
+    else {
+        process.stderr.write(`ggui ${label}: unknown error\n`);
+    }
+    return 1;
+}
+export function parseRegisterFlags(args) {
+    let scope;
+    let registry;
+    let help = false;
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === '--help' || arg === '-h') {
+            help = true;
+            continue;
+        }
+        if (arg === '--scope') {
+            const value = args[i + 1];
+            if (typeof value !== 'string' || value.length === 0) {
+                return { help, error: '--scope requires a value (e.g. `@my-scope`)' };
+            }
+            scope = value;
+            i += 1;
+            continue;
+        }
+        if (arg && arg.startsWith('--scope=')) {
+            scope = arg.slice('--scope='.length);
+            continue;
+        }
+        if (arg === '--registry') {
+            const value = args[i + 1];
+            if (typeof value !== 'string' || value.length === 0) {
+                return { help, error: '--registry requires a URL' };
+            }
+            registry = value;
+            i += 1;
+            continue;
+        }
+        if (arg && arg.startsWith('--registry=')) {
+            registry = arg.slice('--registry='.length);
+            continue;
+        }
+        return { help, error: `unknown flag: ${arg}` };
+    }
+    return {
+        help,
+        ...(scope !== undefined ? { scope } : {}),
+        ...(registry !== undefined ? { registry } : {}),
+    };
+}
+async function runKeysRegister(args) {
+    const flags = parseRegisterFlags(args);
+    if (flags.help) {
+        process.stdout.write(KEYS_HELP);
+        return 0;
+    }
+    if (flags.error) {
+        process.stderr.write(`ggui keys register: ${flags.error}\n`);
+        return 2;
+    }
+    if (!flags.scope) {
+        process.stderr.write('ggui keys register: --scope is required (e.g. `--scope @my-scope`)\n');
+        return 2;
+    }
+    if (!flags.scope.startsWith('@')) {
+        process.stderr.write(`ggui keys register: --scope must start with \`@\` (got "${flags.scope}")\n`);
+        return 2;
+    }
+    const outcome = await runRegisterAuthorKey({
+        scope: flags.scope,
+        ...(flags.registry !== undefined ? { registry: flags.registry } : {}),
+    }, {
+        cwd: process.cwd(),
+        env: process.env,
+        fetch,
+        // Unix-epoch SECONDS (matches the convention publish.ts uses for
+        // `expiresAt` in the registry-token cache — see auth-cache.ts:31).
+        // `Date.now()` returns milliseconds; passing it raw caused
+        // `isTokenFresh` to always return false against a real Cognito
+        // exp claim (also in seconds), forcing a re-auth on every run.
+        now: () => Math.floor(Date.now() / 1000),
+    });
+    if (outcome.ok) {
+        const verb = outcome.status === 201 ? 'Registered' : 'Already registered';
+        process.stdout.write(`${verb} publisher key for ${flags.scope}.\n` +
+            `  registry: ${outcome.registryUrl}\n` +
+            `  subject:  ${outcome.subject}\n` +
+            `  keyId:    ${outcome.keyId}\n`);
+        return 0;
+    }
+    process.stderr.write(`ggui keys register: ${outcome.code}: ${outcome.message}\n`);
+    // Exit-code policy: `key_conflict` is a distinct, scriptable state
+    // (the registry already holds a different publicKey for this
+    // subject+keyId — vanishingly rare hash collision OR a stale row).
+    // Scripts that wrap `ggui keys register` should be able to detect
+    // it without parsing the message. Exit 2 is reserved for usage
+    // errors (handled above before this point), exit 1 covers
+    // everything else.
+    if (outcome.code === 'key_conflict')
+        return 3;
+    return 1;
+}

package/dist/auth-login.d.ts

@@ -0,0 +1,11 @@
+export declare const LOGIN_HELP = "ggui login \u2014 sign into ggui.ai for hosted-key management\n\nUsage:\n  ggui login [--name <label>] [--no-open]\n\nOptions:\n  --name <label>   Device label to show in the console (default:\n                   \"ggui CLI on <hostname>\").\n  --no-open        Don't auto-open the browser (also implied by\n                   non-TTY stdout / BROWSER=none).\n\nEndpoint resolution:\n  1. GGUI_API_URL env override.\n  2. https://api.ggui.ai (default; Route53 swap pending S6).\n\nAfter success, tokens are written to ~/.ggui/auth.json with mode 0600.\n";
+interface LoginFlags {
+    readonly name: string;
+    readonly autoOpen: boolean;
+    readonly help: boolean;
+    readonly error?: string;
+}
+export declare function parseLoginFlags(args: readonly string[]): LoginFlags;
+export declare function runLoginCommand(args: readonly string[]): Promise<number>;
+export {};
+//# sourceMappingURL=auth-login.d.ts.map

package/dist/auth-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-login.d.ts","sourceRoot":"","sources":["../src/auth-login.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,UAAU,8iBAgBtB,CAAC;AAEF,UAAU,UAAU;IAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CAwCnE;AAuFD,wBAAsB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA0E9E"}

package/dist/auth-login.js

@@ -0,0 +1,231 @@
+/**
+ * `ggui login` — RFC 8628 device-flow client.
+ *
+ * Steps:
+ *   1. POST /v1/auth/device → device_code + user_code + verification_uri.
+ *   2. Print the verification URL + user_code, attempt to open the
+ *      browser (best-effort — non-TTY / `BROWSER=none` skips).
+ *   3. Poll /v1/auth/poll at the server-recommended interval until
+ *      we get tokens, an error, or expiry.
+ *   4. Persist tokens to `~/.ggui/auth.json` via `saveAuthSession`.
+ */
+import { hostname } from 'node:os';
+import { spawn } from 'node:child_process';
+import { ApiError, postAuthDevice, postAuthPoll, } from './api-client.js';
+import { resolveEndpoint, saveAuthSession } from './auth-store.js';
+export const LOGIN_HELP = `ggui login — sign into ggui.ai for hosted-key management
+
+Usage:
+  ggui login [--name <label>] [--no-open]
+
+Options:
+  --name <label>   Device label to show in the console (default:
+                   "ggui CLI on <hostname>").
+  --no-open        Don't auto-open the browser (also implied by
+                   non-TTY stdout / BROWSER=none).
+
+Endpoint resolution:
+  1. GGUI_API_URL env override.
+  2. https://api.ggui.ai (default; Route53 swap pending S6).
+
+After success, tokens are written to ~/.ggui/auth.json with mode 0600.
+`;
+export function parseLoginFlags(args) {
+    let name;
+    let autoOpen = shouldAutoOpenDefault();
+    let help = false;
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === '--help' || arg === '-h') {
+            help = true;
+            continue;
+        }
+        if (arg === '--no-open') {
+            autoOpen = false;
+            continue;
+        }
+        if (arg === '--name') {
+            const value = args[i + 1];
+            if (typeof value !== 'string' || value.length === 0) {
+                return {
+                    name: '',
+                    autoOpen,
+                    help,
+                    error: '--name requires a value',
+                };
+            }
+            name = value;
+            i += 1;
+            continue;
+        }
+        return {
+            name: '',
+            autoOpen,
+            help,
+            error: `unknown flag: ${arg}`,
+        };
+    }
+    return {
+        name: name ?? defaultClientName(),
+        autoOpen,
+        help,
+    };
+}
+function defaultClientName() {
+    let host = 'unknown-host';
+    try {
+        host = hostname();
+    }
+    catch {
+        // best-effort
+    }
+    return `ggui CLI on ${host}`;
+}
+function shouldAutoOpenDefault() {
+    if (process.env['BROWSER'] === 'none')
+        return false;
+    if (process.env['CI'] === '1' || process.env['CI'] === 'true')
+        return false;
+    if (!process.stdout.isTTY)
+        return false;
+    return true;
+}
+function tryOpenBrowser(url) {
+    // Best-effort cross-platform browser open. macOS `open`, Linux
+    // `xdg-open`, Windows `cmd /c start ""`. Never throws — failure is
+    // non-fatal because the URL is also printed for the user.
+    const platform = process.platform;
+    let command;
+    let args;
+    if (platform === 'darwin') {
+        command = 'open';
+        args = [url];
+    }
+    else if (platform === 'win32') {
+        command = 'cmd';
+        args = ['/c', 'start', '""', url];
+    }
+    else {
+        command = 'xdg-open';
+        args = [url];
+    }
+    try {
+        const child = spawn(command, args, {
+            stdio: 'ignore',
+            detached: true,
+        });
+        child.unref();
+        child.on('error', () => {
+            // platform may lack the opener — silently swallow
+        });
+    }
+    catch {
+        // ignore
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function pollForTokens(endpoint, device) {
+    const startMs = Date.now();
+    const expiryMs = startMs + device.expires_in * 1000;
+    let interval = device.interval * 1000;
+    while (Date.now() < expiryMs) {
+        await sleep(interval);
+        try {
+            return await postAuthPoll(endpoint, device.device_code);
+        }
+        catch (err) {
+            if (!(err instanceof ApiError))
+                throw err;
+            if (err.code === 'authorization_pending') {
+                // Keep polling at the same interval.
+                continue;
+            }
+            if (err.code === 'slow_down') {
+                // RFC 8628 §3.5 — server asks us to back off. Add 5s per spec.
+                interval += 5000;
+                continue;
+            }
+            // expired_token | invalid_grant | server_error → terminal.
+            throw err;
+        }
+    }
+    throw new ApiError(400, 'expired_token', 'Login window expired before approval. Run `ggui login` again.');
+}
+export async function runLoginCommand(args) {
+    const flags = parseLoginFlags(args);
+    if (flags.help) {
+        process.stdout.write(LOGIN_HELP);
+        return 0;
+    }
+    if (flags.error) {
+        process.stderr.write(`ggui login: ${flags.error}\n`);
+        return 2;
+    }
+    const endpoint = resolveEndpoint();
+    process.stdout.write(`Endpoint: ${endpoint.url} (${endpoint.source})\n`);
+    let device;
+    try {
+        device = await postAuthDevice(endpoint.url, flags.name);
+    }
+    catch (err) {
+        process.stderr.write(`ggui login: failed to start device flow: ${describeError(err)}\n`);
+        return 1;
+    }
+    process.stdout.write(`\n`);
+    process.stdout.write(`Open this URL in your browser to approve:\n`);
+    process.stdout.write(`  ${device.verification_uri_complete}\n`);
+    process.stdout.write(`\n`);
+    process.stdout.write(`Verification code: ${device.user_code}\n`);
+    process.stdout.write(`(Confirm this matches what the browser shows.)\n`);
+    process.stdout.write(`\n`);
+    if (flags.autoOpen) {
+        tryOpenBrowser(device.verification_uri_complete);
+    }
+    process.stdout.write(`Waiting for approval…\n`);
+    let tokens;
+    try {
+        tokens = await pollForTokens(endpoint.url, device);
+    }
+    catch (err) {
+        process.stderr.write(`ggui login: ${describeError(err)}\n`);
+        return 1;
+    }
+    // Get user info to populate auth.json.userId. The /v1/me endpoint
+    // returns userId from the freshly-minted access token. If this 401s
+    // there's a server bug, but we still have valid tokens — fall back to
+    // empty userId so we can persist what we have.
+    const now = Math.floor(Date.now() / 1000);
+    const accessExpiresAt = now + tokens.expires_in;
+    // Refresh tokens have ~30d TTL on the server — see backend
+    // `REFRESH_TOKEN_TTL_SECONDS`. Mirror that so the CLI doesn't need
+    // to call /v1/me just to find out.
+    const refreshExpiresAt = now + 30 * 24 * 60 * 60;
+    // Persist with a placeholder userId; the next /v1/me call (whoami)
+    // will fetch the real value. Alternatively we could call /v1/me here
+    // — but that adds a round-trip on the hot login path. Defer.
+    saveAuthSession({
+        version: 1,
+        endpoint: endpoint.url,
+        userId: '',
+        sessionId: tokens.session_id,
+        accessToken: tokens.access_token,
+        accessExpiresAt,
+        refreshToken: tokens.refresh_token,
+        refreshExpiresAt,
+        clientName: flags.name,
+        writtenAt: new Date().toISOString(),
+    });
+    process.stdout.write(`\nSigned in. Tokens saved to ~/.ggui/auth.json.\n`);
+    process.stdout.write(`Try \`ggui whoami\` or \`ggui keys list\`.\n`);
+    return 0;
+}
+function describeError(err) {
+    if (err instanceof ApiError) {
+        return `${err.code}: ${err.message}`;
+    }
+    if (err instanceof Error)
+        return err.message;
+    return String(err);
+}

package/dist/auth-logout.d.ts

@@ -0,0 +1,3 @@
+export declare const LOGOUT_HELP = "ggui logout \u2014 clear the local CLI session\n\nUsage:\n  ggui logout\n\nDeletes ~/.ggui/auth.json. Server-side tokens stay valid until their\nTTL expires (~1h access, ~30d refresh).\n";
+export declare function runLogoutCommand(args: readonly string[]): number;
+//# sourceMappingURL=auth-logout.d.ts.map

package/dist/auth-logout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-logout.d.ts","sourceRoot":"","sources":["../src/auth-logout.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,WAAW,+LAOvB,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAYhE"}

package/dist/auth-logout.js

@@ -0,0 +1,32 @@
+/**
+ * `ggui logout` — discard the local `~/.ggui/auth.json` session.
+ *
+ * Does NOT call a server-side revoke (no `/v1/auth/logout` endpoint
+ * at v1). The local-only delete means the access token stays valid on
+ * the server until its TTL expires (~1h). For sensitive scenarios,
+ * follow with `ggui keys revoke <id>` for any keys that were
+ * provisioned during the session.
+ */
+import { deleteAuthSession } from './auth-store.js';
+export const LOGOUT_HELP = `ggui logout — clear the local CLI session
+
+Usage:
+  ggui logout
+
+Deletes ~/.ggui/auth.json. Server-side tokens stay valid until their
+TTL expires (~1h access, ~30d refresh).
+`;
+export function runLogoutCommand(args) {
+    if (args.includes('--help') || args.includes('-h')) {
+        process.stdout.write(LOGOUT_HELP);
+        return 0;
+    }
+    const { deleted } = deleteAuthSession();
+    if (deleted) {
+        process.stdout.write(`Signed out. ~/.ggui/auth.json removed.\n`);
+    }
+    else {
+        process.stdout.write(`No active session found.\n`);
+    }
+    return 0;
+}