@go-labs-sg/rsvp 0.13.1 → 0.14.0

package/README.md

@@ -41,6 +41,16 @@ bun add --global @go-labs-sg/rsvp
 rsvp version
 ```
 
+## Secure credential storage
+
+`GO_LABS_CLI_CREDENTIAL_ACCOUNT` selects the native credential-store account for this CLI. The default is `default`, preserving existing production logins. The downloadable staging launcher sets it to `staging` so a staging login does not replace the production login; keep the same account value for login and subsequent commands. The launcher also sets `GO_LABS_CLI_SKIP_DOTENV=1`; this is harmless for RSVP, which does not explicitly load the current-directory `.env` file.
+
+Browser sessions use `Bun.secrets`: macOS Keychain, Windows Credential Manager, or Linux Secret Service. Linux requires libsecret, a reachable user D-Bus session, and an unlocked Secret Service collection. SSH and containers must provide those native prerequisites themselves; `--no-browser` only lets approval happen on another device. Denied D-Bus access is a host permissions/session issue, not something the CLI bypasses.
+
+Before requesting approval, login verifies write/read/delete capability with a unique non-secret probe. Native operations have a 10-second process deadline and sanitized errors. Issued credentials are read back and verified; failed persistence attempts remote revocation and reports local and remote cleanup separately. There is no plaintext fallback or external credential-helper configuration.
+
+See the [shared authentication contract](../../cli-auth/README.md) for recovery and verification limits.
+
 ## Authentication
 
 ```sh
@@ -53,7 +63,7 @@ rsvp auth whoami
 
 Registration CLI access is limited to global administrators. The server rechecks the account's current global role and ban state when issuing, refreshing, and authenticating CLI credentials, so removing the admin role immediately blocks further CLI access.
 
-The CLI polls automatically and stores only Registration-issued credentials through `Bun.secrets`. It does not store browser or email-OTP credentials and has no API-key or environment-variable fallback. Use `rsvp auth logout` to revoke the remote session and remove its local credential. For SSH or containers, pass `--no-browser` and open the printed URL on another device.
+The CLI polls automatically and stores only Registration-issued credentials through `Bun.secrets`. It does not store browser or email-OTP credentials and has no raw API-key or token-environment fallback. Use `rsvp auth logout` to revoke the remote session and remove its local credential. For SSH or containers, pass `--no-browser` and open the printed URL on another device.
 
 The default API is `https://rsvp.getout.events`. Override it with `RSVP_API_URL` or `--api-url`; non-local overrides must use HTTPS.
 

package/dist/index.js

@@ -1017,6 +1017,8 @@ function datetime(args) {
 }
 var anyString = /^[\s\S]{0,}$/;
 var number = /^-?\d+(?:\.\d+)?$/;
+var boolean = /^(?:true|false)$/i;
+var _null = /^null$/i;
 var lowercase = /^[^A-Z]*$/;
 var uppercase = /^[^a-z]*$/;
 
@@ -1898,6 +1900,43 @@ var $ZodNumberFormat = /* @__PURE__ */ $constructor("$ZodNumberFormat", (inst, d
   $ZodCheckNumberFormat.init(inst, def);
   $ZodNumber.init(inst, def);
 });
+var $ZodBoolean = /* @__PURE__ */ $constructor("$ZodBoolean", (inst, def) => {
+  $ZodType.init(inst, def);
+  inst._zod.pattern = boolean;
+  inst._zod.parse = (payload, _ctx) => {
+    if (def.coerce)
+      try {
+        payload.value = Boolean(payload.value);
+      } catch (_) {}
+    const input = payload.value;
+    if (typeof input === "boolean")
+      return payload;
+    payload.issues.push({
+      expected: "boolean",
+      code: "invalid_type",
+      input,
+      inst
+    });
+    return payload;
+  };
+});
+var $ZodNull = /* @__PURE__ */ $constructor("$ZodNull", (inst, def) => {
+  $ZodType.init(inst, def);
+  inst._zod.pattern = _null;
+  inst._zod.values = new Set([null]);
+  inst._zod.parse = (payload, _ctx) => {
+    const input = payload.value;
+    if (input === null)
+      return payload;
+    payload.issues.push({
+      expected: "null",
+      code: "invalid_type",
+      input,
+      inst
+    });
+    return payload;
+  };
+});
 var $ZodUnknown = /* @__PURE__ */ $constructor("$ZodUnknown", (inst, def) => {
   $ZodType.init(inst, def);
   inst._zod.parse = (payload) => payload;
@@ -3435,6 +3474,18 @@ function _int(Class, params) {
     ...normalizeParams(params)
   });
 }
+function _boolean(Class, params) {
+  return new Class({
+    type: "boolean",
+    ...normalizeParams(params)
+  });
+}
+function _null2(Class, params) {
+  return new Class({
+    type: "null",
+    ...normalizeParams(params)
+  });
+}
 function _unknown(Class) {
   return new Class({
     type: "unknown"
@@ -4317,6 +4368,18 @@ var numberProcessor = (schema, ctx, _json, params) => {
       json.allOf = [...json.allOf ?? [], ...rest.map((m) => ({ multipleOf: m }))];
   }
 };
+var booleanProcessor = (_schema, _ctx, json, _params) => {
+  json.type = "boolean";
+};
+var nullProcessor = (_schema, ctx, json, _params) => {
+  if (ctx.target === "openapi-3.0") {
+    json.type = "string";
+    json.nullable = true;
+    json.enum = [null];
+  } else {
+    json.type = "null";
+  }
+};
 var neverProcessor = (_schema, _ctx, json, _params) => {
   json.not = {};
 };
@@ -5111,6 +5174,22 @@ var ZodNumberFormat = /* @__PURE__ */ $constructor("ZodNumberFormat", (inst, def
 function int(params) {
   return _int(ZodNumberFormat, params);
 }
+var ZodBoolean = /* @__PURE__ */ $constructor("ZodBoolean", (inst, def) => {
+  $ZodBoolean.init(inst, def);
+  ZodType.init(inst, def);
+  inst._zod.processJSONSchema = (ctx, json, params) => booleanProcessor(inst, ctx, json, params);
+});
+function boolean2(params) {
+  return _boolean(ZodBoolean, params);
+}
+var ZodNull = /* @__PURE__ */ $constructor("ZodNull", (inst, def) => {
+  $ZodNull.init(inst, def);
+  ZodType.init(inst, def);
+  inst._zod.processJSONSchema = (ctx, json, params) => nullProcessor(inst, ctx, json, params);
+});
+function _null3(params) {
+  return _null2(ZodNull, params);
+}
 var ZodUnknown = /* @__PURE__ */ $constructor("ZodUnknown", (inst, def) => {
   $ZodUnknown.init(inst, def);
   ZodType.init(inst, def);
@@ -5529,6 +5608,9 @@ var storedCliCredentialsSchema = object({
   session: cliSessionIdentitySchema
 }).strict();
 var cliProductSchema = _enum(cliProducts);
+// ../../cli-auth/src/client/secret-backend.ts
+import { execFile } from "child_process";
+
 // ../../cli-auth/src/client/runtime.ts
 var MINIMUM_BUN_VERSION = [1, 4, 0];
 var parseBunVersion = (version) => {
@@ -5554,27 +5636,145 @@ var assertBunRuntime = (runtime = globalThis.Bun) => {
   }
 };
 
-// ../../cli-auth/src/client/credential-store.ts
+// ../../cli-auth/src/client/storage-error.ts
+var guidance = {
+  "missing-library": "Install the runtime's native credential-store library and ensure your own native keyring/session is accessible and unlocked; Linux desktop storage requires libsecret AND an accessible, unlocked Secret Service.",
+  "bus-unavailable": "The Linux user D-Bus session is absent or unreachable. --no-browser does not provide storage. Start or repair your own user session and native keyring before retrying.",
+  "bus-denied": "Access to the Linux user bus was denied. Fix your own native keyring/session permissions or host policy; do not change bus/socket permissions or borrow another user's bus.",
+  "service-unavailable": "The user bus is reachable but your own Secret Service is unavailable. Start or repair your own native keyring session; do not expose another user's store.",
+  locked: "Unlock your own native credential collection/session before retrying. The CLI will not wait indefinitely for an unlock prompt.",
+  timeout: "The native credential backend did not finish within 10 seconds and its process was terminated. Fix or unlock your own native keyring/session outside the CLI; the CLI will not bypass host permissions.",
+  "invalid-response": "The native credential backend returned an invalid response. Check your own keyring/session and configuration; no credential output was disclosed.",
+  "read-failed": "The native credential backend could not read credentials. Check your own keyring/session availability and permissions; this is not evidence that you are logged out.",
+  "write-failed": "The native credential backend could not persist credentials. Check your own keyring/session write permissions and availability; no plaintext fallback is used.",
+  "delete-failed": "The native credential backend could not delete its entry. Check your own keyring/session permissions and remove any non-secret preflight probe through that backend if necessary."
+};
+
 class CliCredentialStoreUnavailableError extends Error {
   code = "CLI_CREDENTIAL_STORE_UNAVAILABLE";
-  constructor(product, options) {
-    super(`Secure credential storage is unavailable for the ${product} CLI. Bun.secrets requires the operating system credential store, including Secret Service on Linux. Browser authentication cannot continue without a supported secure store.`, options);
+  reason;
+  constructor(product, reason = "read-failed") {
+    super(`Secure credential storage is unavailable for the ${product} CLI [CLI_CREDENTIAL_STORE_UNAVAILABLE:${reason}]. ${guidance[reason]}`);
     this.name = "CliCredentialStoreUnavailableError";
-  }
-}
-var useSecrets = async (product, operation) => {
+    this.reason = reason;
+  }
+}
+var classifyCredentialStoreFailure = (message, fallback) => {
+  if (/libsecret.*(not found|not available|cannot open|load)|dlopen|shared (object|library).*not found/i.test(message))
+    return "missing-library";
+  if (/(d-?bus|user bus|session bus).*(denied|not permitted)|(?:denied|not permitted).*(d-?bus|user bus|session bus)/i.test(message))
+    return "bus-denied";
+  if (/locked|interaction.*not allowed|user.*cancel/i.test(message))
+    return "locked";
+  if (/ServiceUnknown|org\.freedesktop\.secrets.*(not provided|no owner|not available)|secret.?service.*(unavailable|not running)/i.test(message))
+    return "service-unavailable";
+  if (/d-?bus|user bus|session bus|autolaunch/i.test(message))
+    return "bus-unavailable";
+  return fallback;
+};
+
+class CliCredentialPersistenceError extends Error {
+  remoteRevoked;
+  localRestored;
+  phase;
+  code = "CLI_CREDENTIAL_PERSISTENCE_FAILED";
+  constructor(remoteRevoked, localRestored, phase) {
+    super(`CLI credentials could not be saved after ${phase} [CLI_CREDENTIAL_PERSISTENCE_FAILED]. ${remoteRevoked ? "The newly issued session was revoked." : "Remote revocation could not be confirmed; revoke the session in the product's session management before retrying."} ${localRestored ? phase === "login" ? "The previous local credentials were preserved." : "The unusable rotated local credentials were removed; sign in again." : "Local cleanup could not be confirmed. Inspect your own native credential backend before retrying."}`);
+    this.remoteRevoked = remoteRevoked;
+    this.localRestored = localRestored;
+    this.phase = phase;
+    this.name = "CliCredentialPersistenceError";
+  }
+}
+var getCliStorageError = (error) => {
+  if (error instanceof CliCredentialStoreUnavailableError)
+    return {
+      code: error.code,
+      message: error.message,
+      details: { reason: error.reason }
+    };
+  if (error instanceof CliCredentialPersistenceError)
+    return {
+      code: error.code,
+      message: error.message,
+      details: {
+        remoteRevoked: error.remoteRevoked,
+        localRestored: error.localRestored,
+        phase: error.phase
+      }
+    };
+  return;
+};
+
+// ../../cli-auth/src/client/secret-backend.ts
+var timeoutMs = 1e4;
+var maxBuffer = 64 * 1024;
+var runBackend = (product, executable, args, input, failure) => new Promise((resolve, reject) => {
+  const child = execFile(executable, args, {
+    timeout: timeoutMs,
+    killSignal: "SIGKILL",
+    maxBuffer,
+    windowsHide: true
+  }, (error, stdout, stderr) => {
+    if (error) {
+      const reason = error.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER" ? "invalid-response" : error.killed ? "timeout" : classifyCredentialStoreFailure(`${stdout}
+${stderr}`, failure);
+      reject(new CliCredentialStoreUnavailableError(product, reason));
+      return;
+    }
+    resolve(stdout);
+  });
+  child.stdin?.on("error", () => {});
+  child.stdin?.end(input);
+});
+var nativeWorker = `
+try {
+ const { operation, input } = JSON.parse(await Bun.stdin.text());
+ const value = await Bun.secrets[operation](input);
+ process.stdout.write(JSON.stringify({ value: value ?? null }));
+} catch (error) {
+ const message = error instanceof Error ? error.message : "Credential backend failed";
+ // libsecret's bus transport errors can omit the D-Bus context.
+ const context = process.platform === "linux" && /^Could not connect:/i.test(message) ? "D-Bus: " : "";
+ process.stderr.write(context + message);
+ process.exitCode = 1;
+}
+`;
+var nativeResponse = object({ value: union([string2(), boolean2(), _null3()]) }).strict();
+var createIsolatedBunSecrets = (product) => {
+  const run = async (operation, input) => {
+    assertBunRuntime();
+    const output = await runBackend(product, process.execPath, ["--no-env-file", "--eval", nativeWorker], JSON.stringify({ operation, input }), operation === "set" ? "write-failed" : operation === "delete" ? "delete-failed" : "read-failed");
+    try {
+      return nativeResponse.parse(JSON.parse(output)).value;
+    } catch {
+      throw new CliCredentialStoreUnavailableError(product, "invalid-response");
+    }
+  };
+  return {
+    get: async (input) => {
+      const value = await run("get", input);
+      if (value === null || typeof value === "string")
+        return value;
+      throw new CliCredentialStoreUnavailableError(product, "invalid-response");
+    },
+    set: async (input) => {
+      await run("set", input);
+    },
+    delete: async (input) => await run("delete", input) === true
+  };
+};
+
+// ../../cli-auth/src/client/credential-store.ts
+var runSecretOperation = async (product, operation, fallback = "read-failed") => {
   try {
     return await operation();
   } catch (cause) {
     if (cause instanceof CliCredentialStoreUnavailableError)
       throw cause;
-    throw new CliCredentialStoreUnavailableError(product, { cause });
+    throw new CliCredentialStoreUnavailableError(product, classifyCredentialStoreFailure(cause instanceof Error ? cause.message : "", fallback));
   }
 };
-var defaultSecrets = () => {
-  assertBunRuntime();
-  return Bun.secrets;
-};
 var refreshLockTimeoutMs = 5 * 60 * 1000;
 var refreshLockRetryMs = 50;
 var getCredentialLockDirectoryPath = () => {
@@ -5646,18 +5846,38 @@ var acquireRefreshLock = async (path) => {
   }
   throw new Error("Timed out waiting for another CLI process to refresh credentials. Retry the command.");
 };
+var resolveCliCredentialAccount = (environment = process.env) => environment.GO_LABS_CLI_CREDENTIAL_ACCOUNT?.trim() || "default";
 var createBunCredentialStore = ({
-  account = "default",
+  account = resolveCliCredentialAccount(),
   product,
-  secrets = defaultSecrets()
+  secrets = createIsolatedBunSecrets(product)
 }) => {
   const service = `go-labs-cli:${product}`;
   return {
+    preflight: async () => {
+      const input = { name: `probe-${randomUUID()}`, service };
+      const value = `go-labs-non-secret-probe:${randomUUID()}`;
+      try {
+        await runSecretOperation(product, () => secrets.set({ ...input, value }), "write-failed");
+        if (await runSecretOperation(product, () => secrets.get(input)) !== value) {
+          throw new CliCredentialStoreUnavailableError(product, "write-failed");
+        }
+      } catch (error) {
+        await secrets.delete(input).catch(() => {
+          return;
+        });
+        throw error;
+      }
+      await runSecretOperation(product, () => secrets.delete(input), "delete-failed");
+      if (await runSecretOperation(product, () => secrets.get(input)) !== null) {
+        throw new CliCredentialStoreUnavailableError(product, "delete-failed");
+      }
+    },
     delete: async () => {
-      await useSecrets(product, () => secrets.delete({ name: account, service }));
+      await runSecretOperation(product, () => secrets.delete({ name: account, service }), "delete-failed");
     },
     get: async () => {
-      const value = await useSecrets(product, () => secrets.get({ name: account, service }));
+      const value = await runSecretOperation(product, () => secrets.get({ name: account, service }));
       if (value === null)
         return null;
       try {
@@ -5668,11 +5888,11 @@ var createBunCredentialStore = ({
     },
     set: async (credentials) => {
       const parsed = storedCliCredentialsSchema.parse(credentials);
-      await useSecrets(product, () => secrets.set({
+      await runSecretOperation(product, () => secrets.set({
         name: account,
         service,
         value: JSON.stringify(parsed)
-      }));
+      }), "write-failed");
     },
     withCredentialLock: async (operation) => {
       const refreshLockPath = await getCredentialLockPath(product, account);
@@ -5693,6 +5913,7 @@ var createBunCredentialStore = ({
 };
 // ../../cli-auth/src/client/login.ts
 import { hostname } from "os";
+import { isDeepStrictEqual } from "util";
 var normalizeCliAuthIssuer = (value) => {
   const url = new URL(value);
   url.hash = "";
@@ -5755,12 +5976,15 @@ var openSystemBrowser = async (url) => {
     "-NoProfile",
     "-NonInteractive",
     "-Command",
-    "Start-Process -FilePath $args[0]",
-    url
+    "Start-Process -FilePath $env:GO_LABS_CLI_VERIFICATION_URI -ErrorAction Stop"
   ] : ["xdg-open", url];
   try {
-    const process2 = Bun.spawn(command, { stderr: "ignore", stdout: "ignore" });
-    return await process2.exited === 0;
+    const browserProcess = Bun.spawn(command, {
+      env: process.platform === "win32" ? { ...process.env, GO_LABS_CLI_VERIFICATION_URI: url } : process.env,
+      stderr: "ignore",
+      stdout: "ignore"
+    });
+    return await browserProcess.exited === 0;
   } catch {
     return false;
   }
@@ -5778,6 +6002,8 @@ var loginWithBrowser = async ({
   store
 }) => {
   const baseUrl = normalizeCliAuthIssuer(apiBaseUrl);
+  if (store.preflight)
+    await withCredentialLock(store, () => store.preflight?.() ?? Promise.resolve());
   const pkce = createPkcePair();
   const beginResponse = await postJson(fetchImplementation, `${baseUrl}/api/cli-auth/device`, {
     clientName,
@@ -5805,7 +6031,19 @@ var loginWithBrowser = async ({
     if (response.ok) {
       const issued = tokenResponseSchema.parse(payload);
       const credentials = toStoredCredentials(issued, baseUrl, now());
-      await withCredentialLock(store, () => store.set(credentials));
+      try {
+        await withCredentialLock(store, () => persistIssuedCredentials({
+          store,
+          credentials,
+          apiBaseUrl: baseUrl,
+          fetch: fetchImplementation,
+          phase: "login"
+        }));
+      } catch (error) {
+        if (error instanceof CliCredentialPersistenceError)
+          throw error;
+        throw new CliCredentialPersistenceError(await revokeIssuedCredentials(fetchImplementation, baseUrl, credentials), false, "login");
+      }
       return credentials;
     }
     const error = deviceTokenErrorSchema.safeParse(payload);
@@ -5825,6 +6063,55 @@ var loginWithBrowser = async ({
   }
   throw new Error("CLI authentication expired. Run auth login again.");
 };
+var revokeIssuedCredentials = async (fetchImplementation, apiBaseUrl, credentials) => {
+  try {
+    const response = await postJson(fetchImplementation, `${normalizeCliAuthIssuer(apiBaseUrl)}/api/cli-auth/revoke`, { refreshToken: credentials.refreshToken }, { signal: AbortSignal.timeout(refreshRequestTimeoutMs) });
+    return response.ok;
+  } catch {
+    return false;
+  }
+};
+var persistIssuedCredentials = async ({
+  store,
+  credentials,
+  previous,
+  apiBaseUrl,
+  fetch: fetchImplementation,
+  phase
+}) => {
+  let prior = previous;
+  try {
+    if (phase === "login")
+      prior = await store.get();
+    await store.set(credentials);
+    const saved = await store.get();
+    if (!isDeepStrictEqual(saved, credentials))
+      throw new Error("Credential write could not be verified");
+    return;
+  } catch {
+    const remoteRevoked = await revokeIssuedCredentials(fetchImplementation, apiBaseUrl, credentials);
+    let localRestored = false;
+    try {
+      const current = await store.get();
+      if (phase === "login" && prior !== undefined) {
+        if (isDeepStrictEqual(current, prior))
+          localRestored = true;
+        else if (current === null || current.refreshToken === credentials.refreshToken) {
+          if (prior)
+            await store.set(prior);
+          else
+            await store.delete();
+          localRestored = isDeepStrictEqual(await store.get(), prior);
+        }
+      } else if (phase === "refresh" && (!current || current.refreshToken === credentials.refreshToken || current.refreshToken === prior?.refreshToken)) {
+        if (current)
+          await store.delete();
+        localRestored = await store.get() === null;
+      }
+    } catch {}
+    throw new CliCredentialPersistenceError(remoteRevoked, localRestored, phase);
+  }
+};
 var refreshes = new WeakMap;
 var refreshRequestTimeoutMs = 30000;
 var isInvalidGrantResponse = (payload) => {
@@ -5879,7 +6166,14 @@ var refreshAccessToken = async ({
     throw new Error("Unable to refresh the CLI session because the API returned invalid credentials. Credentials were kept; retry the command.");
   }
   const stored = toStoredCredentials(issued, normalizeCliAuthIssuer(apiBaseUrl), now());
-  await store.set(stored);
+  await persistIssuedCredentials({
+    store,
+    credentials: stored,
+    previous: credentials,
+    apiBaseUrl,
+    fetch: fetchImplementation,
+    phase: "refresh"
+  });
   return stored.accessToken;
 };
 var refreshWithCurrentCredentials = async ({
@@ -6332,6 +6626,8 @@ Object.assign(commands, {
   "admission identity-exception resolve": payloadCommand((api, input) => api.admission.resolveIdentityException.mutate(input), "Resolve an identity exception (--payload JSON).", ["sensitive-data", "state-change"]),
   "audit list": payloadCommand((api, input) => api.audit.listEventActivity.query(input), "List event audit activity (--payload JSON).", ["sensitive-data"]),
   "event check-in qr": payloadCommand((api, input) => api.event.checkInByQr.mutate(input), "Check in using a QR token (--payload JSON).", ["state-change"]),
+  "event logo upload create": payloadCommand((api, input) => api.event.createLogoUpload.mutate(input), "Create an event-logo upload URL (--payload JSON).", ["external-write", "state-change"], "eventId"),
+  "event logo update": payloadCommand((api, input) => api.event.updateLogo.mutate(input), "Set or clear the event logo (--payload JSON).", ["state-change"], "eventId"),
   "event banner upload create": payloadCommand((api, input) => api.event.createBannerUpload.mutate(input), "Create a banner-image upload URL (--payload JSON).", ["external-write", "state-change"], "eventId"),
   "event banner update": payloadCommand((api, input) => api.event.updateBanner.mutate(input), "Set or clear the event banner image (--payload JSON).", ["state-change"], "eventId"),
   "event background upload create": payloadCommand((api, input) => api.event.createBackgroundUpload.mutate(input), "Create a background-image upload URL (--payload JSON).", ["external-write", "state-change"]),
@@ -6453,7 +6749,6 @@ var getCommandManifest = () => ({
 // src/runtime/index.ts
 import { stdin } from "process";
 import { createInterface } from "readline/promises";
-
 class CliUsageError extends Error {
 }
 var output = (io, command, data, meta = {}) => {
@@ -6463,7 +6758,7 @@ var output = (io, command, data, meta = {}) => {
 var errorOutput = (io, command, error) => {
   const rawMessage = error instanceof Error ? error.message : String(error);
   const message = rawMessage.replace(/\bBearer\s+\S+/giu, "Bearer [redacted]");
-  io.writeStderr(`${JSON.stringify({ command, error: message, ok: false })}
+  io.writeStderr(`${JSON.stringify({ command, error: message, ok: false, ...getCliStorageError(error) ? { storageError: getCliStorageError(error) } : {} })}
 `);
 };
 var processIo = {
@@ -6793,6 +7088,8 @@ Waiting for approval\u2026
         });
         return 0;
       } catch (cause) {
+        if (getCliStorageError(cause))
+          throw cause;
         output(dependencies.io, command, {
           authenticated: false,
           accessTokenExpiresAt: credentials.accessTokenExpiresAt,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@go-labs-sg/rsvp",
-  "version": "0.13.1",
+  "version": "0.14.0",
   "description": "RSVP CLI for authorized event operations.",
   "type": "module",
   "main": "./dist/index.js",