@heossi/qnsi 0.3.2

package/dist/browser/sign.js

@@ -0,0 +1,124 @@
+/**
+ * PQC digital signature helpers for browser-side operations.
+ *
+ * Supports:
+ * - ML-DSA (FIPS 204): dilithium-2, dilithium-3, dilithium-5
+ * - SLH-DSA (FIPS 205): all 12 parameter sets (SHA-2 and SHAKE variants)
+ *
+ * No node: imports. Works in browsers, Deno, Bun, and Node.js 20+.
+ *
+ * @module
+ */
+import { getActiveProvider } from "./provider-setup.js";
+/** Signature algorithms supported by the noble provider. */
+const SIG_ALGORITHMS = new Set([
+    "dilithium-2",
+    "dilithium-3",
+    "dilithium-5",
+    "sphincs-sha2-128f-simple",
+    "sphincs-sha2-128s-simple",
+    "sphincs-sha2-192f-simple",
+    "sphincs-sha2-192s-simple",
+    "sphincs-sha2-256f-simple",
+    "sphincs-sha2-256s-simple",
+    "sphincs-shake-128f-simple",
+    "sphincs-shake-128s-simple",
+    "sphincs-shake-192f-simple",
+    "sphincs-shake-192s-simple",
+    "sphincs-shake-256f-simple",
+    "sphincs-shake-256s-simple",
+]);
+/**
+ * Sign data using a PQC signature algorithm.
+ *
+ * @param data - Data to sign
+ * @param privateKey - Signer's PQC private key
+ * @param algorithm - Signature algorithm (ML-DSA or SLH-DSA)
+ * @returns Signed envelope containing signature + original data
+ */
+export async function signData(data, privateKey, algorithm) {
+    if (!SIG_ALGORITHMS.has(algorithm)) {
+        throw new Error(`Algorithm '${algorithm}' is not a supported signature algorithm. ` +
+            `Supported: ${[...SIG_ALGORITHMS].join(", ")}`);
+    }
+    if (data.length === 0) {
+        throw new Error("Data must not be empty");
+    }
+    if (privateKey.length === 0) {
+        throw new Error("Private key must not be empty");
+    }
+    const provider = getActiveProvider();
+    const { signature } = await provider.sign({
+        algorithm,
+        data,
+        privateKey,
+    });
+    return {
+        algorithm,
+        signature: new Uint8Array(signature),
+        data: new Uint8Array(data),
+    };
+}
+/**
+ * Verify a PQC digital signature.
+ *
+ * @param data - Original data that was signed
+ * @param signature - The signature to verify
+ * @param publicKey - Signer's PQC public key
+ * @param algorithm - Signature algorithm used
+ * @returns true if the signature is valid, false otherwise
+ */
+export async function verifySignature(data, signature, publicKey, algorithm) {
+    if (!SIG_ALGORITHMS.has(algorithm)) {
+        throw new Error(`Algorithm '${algorithm}' is not a supported signature algorithm. ` +
+            `Supported: ${[...SIG_ALGORITHMS].join(", ")}`);
+    }
+    if (data.length === 0) {
+        throw new Error("Data must not be empty");
+    }
+    if (signature.length === 0) {
+        throw new Error("Signature must not be empty");
+    }
+    if (publicKey.length === 0) {
+        throw new Error("Public key must not be empty");
+    }
+    const provider = getActiveProvider();
+    return provider.verify({
+        algorithm,
+        data,
+        signature,
+        publicKey,
+    });
+}
+/**
+ * Generate a PQC key pair for signing operations.
+ *
+ * @param algorithm - Signature algorithm (ML-DSA or SLH-DSA)
+ * @returns Key pair with public and private keys
+ */
+export async function generateSigningKeyPair(algorithm) {
+    if (!SIG_ALGORITHMS.has(algorithm)) {
+        throw new Error(`Algorithm '${algorithm}' is not a supported signature algorithm. ` +
+            `Supported: ${[...SIG_ALGORITHMS].join(", ")}`);
+    }
+    const provider = getActiveProvider();
+    const { keyPair } = await provider.generateKeyPair({ algorithm });
+    return keyPair;
+}
+/**
+ * Generate a PQC key pair for KEM (encryption) operations.
+ *
+ * @param algorithm - KEM algorithm (kyber-512, kyber-768, kyber-1024)
+ * @returns Key pair with public and private keys
+ */
+export async function generateEncryptionKeyPair(algorithm) {
+    const KEM_ALGORITHMS = new Set(["kyber-512", "kyber-768", "kyber-1024"]);
+    if (!KEM_ALGORITHMS.has(algorithm)) {
+        throw new Error(`Algorithm '${algorithm}' is not a supported KEM algorithm. ` +
+            `Supported: ${[...KEM_ALGORITHMS].join(", ")}`);
+    }
+    const provider = getActiveProvider();
+    const { keyPair } = await provider.generateKeyPair({ algorithm });
+    return keyPair;
+}
+//# sourceMappingURL=sign.js.map

package/dist/browser/sign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.js","sourceRoot":"","sources":["../../src/browser/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,4DAA4D;AAC5D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IACtC,aAAa;IACb,aAAa;IACb,aAAa;IACb,0BAA0B;IAC1B,0BAA0B;IAC1B,0BAA0B;IAC1B,0BAA0B;IAC1B,0BAA0B;IAC1B,0BAA0B;IAC1B,2BAA2B;IAC3B,2BAA2B;IAC3B,2BAA2B;IAC3B,2BAA2B;IAC3B,2BAA2B;IAC3B,2BAA2B;CAC3B,CAAC,CAAC;AAcH;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC7B,IAAgB,EAChB,UAAsB,EACtB,SAAuB;IAEvB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACd,cAAc,SAAS,4CAA4C;YAClE,cAAc,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/C,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IAErC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC;QACzC,SAAS;QACT,IAAI;QACJ,UAAU;KACV,CAAC,CAAC;IAEH,OAAO;QACN,SAAS;QACT,SAAS,EAAE,IAAI,UAAU,CAAC,SAAS,CAAC;QACpC,IAAI,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC;KAC1B,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,IAAgB,EAChB,SAAqB,EACrB,SAAqB,EACrB,SAAuB;IAEvB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACd,cAAc,SAAS,4CAA4C;YAClE,cAAc,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/C,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IAErC,OAAO,QAAQ,CAAC,MAAM,CAAC;QACtB,SAAS;QACT,IAAI;QACJ,SAAS;QACT,SAAS;KACT,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,SAAuB;IAKnE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACd,cAAc,SAAS,4CAA4C;YAClE,cAAc,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/C,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IAClE,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,SAAuB;IAKtE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;IACjF,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACd,cAAc,SAAS,sCAAsC;YAC5D,cAAc,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/C,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IAClE,OAAO,OAAO,CAAC;AAChB,CAAC"}

package/dist/browser/telemetry.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Browser SDK Telemetry
+ *
+ * Lightweight, privacy-respecting telemetry for the @heossi/qnsi-browser.
+ * Tracks usage patterns (algorithm choices, operation counts, errors) without
+ * collecting PII or cryptographic material.
+ *
+ * Telemetry is opt-in: callers must explicitly configure a handler via
+ * `configureTelemetry()`. No data is sent anywhere by default.
+ *
+ * @module
+ */
+/**
+ * A single telemetry event emitted by the browser-sdk.
+ */
+export interface BrowserSdkTelemetryEvent {
+    /** Operation type: "encrypt", "decrypt", "sign", "verify", "keygen", "init" */
+    readonly operation: string;
+    /** PQC algorithm used (e.g., "kyber-768", "dilithium-3") */
+    readonly algorithm: string;
+    /** Duration of the operation in milliseconds */
+    readonly durationMs: number;
+    /** Whether the operation succeeded */
+    readonly success: boolean;
+    /** Error message if the operation failed (no stack traces) */
+    readonly error?: string;
+    /** Runtime environment: "browser", "node", "edge" */
+    readonly runtime: string;
+    /** ISO 8601 timestamp */
+    readonly timestamp: string;
+    /** SDK version */
+    readonly sdkVersion: string;
+}
+/**
+ * Configuration for browser-sdk telemetry.
+ */
+export interface BrowserSdkTelemetryConfig {
+    /**
+     * Whether telemetry is enabled. Defaults to false.
+     * When false, no events are recorded or emitted.
+     */
+    readonly enabled: boolean;
+    /**
+     * Custom handler invoked for each telemetry event.
+     * Use this to send events to your analytics backend, log them, or batch them.
+     *
+     * The handler receives a single event and should not throw.
+     * If the handler throws, the error is silently ignored to avoid
+     * disrupting cryptographic operations.
+     */
+    readonly onEvent: (event: BrowserSdkTelemetryEvent) => void;
+    /**
+     * Optional flush handler invoked when `flushTelemetry()` is called.
+     * Use this to send any batched events to your backend.
+     */
+    readonly onFlush?: () => void | Promise<void>;
+}
+/**
+ * Configure telemetry for the browser-sdk.
+ *
+ * @example
+ * ```ts
+ * configureTelemetry({
+ *   enabled: true,
+ *   onEvent: (event) => {
+ *     // Send to your analytics endpoint
+ *     navigator.sendBeacon("/analytics", JSON.stringify(event));
+ *   },
+ * });
+ * ```
+ */
+export declare function configureTelemetry(config: BrowserSdkTelemetryConfig): void;
+/**
+ * Get the current telemetry configuration.
+ * Returns null if telemetry has not been configured.
+ */
+export declare function getTelemetryConfig(): BrowserSdkTelemetryConfig | null;
+/**
+ * Check if telemetry is currently enabled.
+ */
+export declare function isTelemetryEnabled(): boolean;
+/**
+ * Record a telemetry event. No-op if telemetry is not configured or disabled.
+ *
+ * This function never throws — errors in the telemetry handler are silently
+ * swallowed to avoid disrupting cryptographic operations.
+ */
+export declare function recordTelemetryEvent(operation: string, algorithm: string, durationMs: number, success: boolean, runtime: string, error?: string): void;
+/**
+ * Flush any batched telemetry events. No-op if telemetry is not configured,
+ * disabled, or no flush handler is set.
+ */
+export declare function flushTelemetry(): Promise<void>;
+/**
+ * Reset telemetry configuration. Primarily for testing.
+ */
+export declare function resetTelemetry(): void;
+//# sourceMappingURL=telemetry.d.ts.map

package/dist/browser/telemetry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../../src/browser/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACxC,+EAA+E;IAC/E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,gDAAgD;IAChD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,sCAAsC;IACtC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,qDAAqD;IACrD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yBAAyB;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kBAAkB;IAClB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACzC;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,wBAAwB,KAAK,IAAI,CAAC;IAE5D;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9C;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,yBAAyB,GAAG,IAAI,CAE1E;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,yBAAyB,GAAG,IAAI,CAErE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CACnC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,MAAM,GACZ,IAAI,CAqBN;AAED;;;GAGG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAUpD;AAED;;GAEG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAErC"}

package/dist/browser/telemetry.js

@@ -0,0 +1,93 @@
+/**
+ * Browser SDK Telemetry
+ *
+ * Lightweight, privacy-respecting telemetry for the @heossi/qnsi-browser.
+ * Tracks usage patterns (algorithm choices, operation counts, errors) without
+ * collecting PII or cryptographic material.
+ *
+ * Telemetry is opt-in: callers must explicitly configure a handler via
+ * `configureTelemetry()`. No data is sent anywhere by default.
+ *
+ * @module
+ */
+import { SDK_PACKAGE_VERSION } from "./sdk-package-version.js";
+let telemetryConfig = null;
+/**
+ * Configure telemetry for the browser-sdk.
+ *
+ * @example
+ * ```ts
+ * configureTelemetry({
+ *   enabled: true,
+ *   onEvent: (event) => {
+ *     // Send to your analytics endpoint
+ *     navigator.sendBeacon("/analytics", JSON.stringify(event));
+ *   },
+ * });
+ * ```
+ */
+export function configureTelemetry(config) {
+    telemetryConfig = config;
+}
+/**
+ * Get the current telemetry configuration.
+ * Returns null if telemetry has not been configured.
+ */
+export function getTelemetryConfig() {
+    return telemetryConfig;
+}
+/**
+ * Check if telemetry is currently enabled.
+ */
+export function isTelemetryEnabled() {
+    return telemetryConfig?.enabled ?? false;
+}
+/**
+ * Record a telemetry event. No-op if telemetry is not configured or disabled.
+ *
+ * This function never throws — errors in the telemetry handler are silently
+ * swallowed to avoid disrupting cryptographic operations.
+ */
+export function recordTelemetryEvent(operation, algorithm, durationMs, success, runtime, error) {
+    if (!telemetryConfig?.enabled) {
+        return;
+    }
+    const event = {
+        operation,
+        algorithm,
+        durationMs,
+        success,
+        runtime,
+        timestamp: new Date().toISOString(),
+        sdkVersion: SDK_PACKAGE_VERSION,
+        ...(error !== undefined ? { error } : {}),
+    };
+    try {
+        telemetryConfig.onEvent(event);
+    }
+    catch {
+        // Silently ignore telemetry handler errors
+    }
+}
+/**
+ * Flush any batched telemetry events. No-op if telemetry is not configured,
+ * disabled, or no flush handler is set.
+ */
+export async function flushTelemetry() {
+    if (!telemetryConfig?.enabled || !telemetryConfig.onFlush) {
+        return;
+    }
+    try {
+        await telemetryConfig.onFlush();
+    }
+    catch {
+        // Silently ignore flush errors
+    }
+}
+/**
+ * Reset telemetry configuration. Primarily for testing.
+ */
+export function resetTelemetry() {
+    telemetryConfig = null;
+}
+//# sourceMappingURL=telemetry.js.map

package/dist/browser/telemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../../src/browser/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAmD/D,IAAI,eAAe,GAAqC,IAAI,CAAC;AAE7D;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAiC;IACnE,eAAe,GAAG,MAAM,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IACjC,OAAO,eAAe,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IACjC,OAAO,eAAe,EAAE,OAAO,IAAI,KAAK,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CACnC,SAAiB,EACjB,SAAiB,EACjB,UAAkB,EAClB,OAAgB,EAChB,OAAe,EACf,KAAc;IAEd,IAAI,CAAC,eAAe,EAAE,OAAO,EAAE,CAAC;QAC/B,OAAO;IACR,CAAC;IAED,MAAM,KAAK,GAA6B;QACvC,SAAS;QACT,SAAS;QACT,UAAU;QACV,OAAO;QACP,OAAO;QACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,UAAU,EAAE,mBAAmB;QAC/B,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzC,CAAC;IAEF,IAAI,CAAC;QACJ,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACR,2CAA2C;IAC5C,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IACnC,IAAI,CAAC,eAAe,EAAE,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;QAC3D,OAAO;IACR,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,eAAe,CAAC,OAAO,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACR,+BAA+B;IAChC,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC7B,eAAe,GAAG,IAAI,CAAC;AACxB,CAAC"}

package/dist/cli/commands/access-control.d.ts

@@ -0,0 +1,4 @@
+import type { Command } from "commander";
+import type { CliConfig } from "../config.js";
+export declare function registerAccessControlCommands(program: Command, config: CliConfig): void;
+//# sourceMappingURL=access-control.d.ts.map

package/dist/cli/commands/access-control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-control.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/access-control.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAO9C,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI,CAkMvF"}

package/dist/cli/commands/access-control.js

@@ -0,0 +1,183 @@
+import { EXIT_CODES } from "../config.js";
+import { getAuthHeaders } from "../utils/auth.js";
+import { getEffectiveConfig } from "../utils/command-config.js";
+import { fetchWithBackendHandling } from "../utils/fetcher.js";
+import { printError, printJson, printSuccess, printTable } from "../utils/output.js";
+export function registerAccessControlCommands(program, config) {
+    const access = program.command("access").description("Access control service commands");
+    const policies = access.command("policies").description("Policy management");
+    policies
+        .command("list")
+        .description("List access policies")
+        .option("--limit <number>", "Number of policies to return", "100")
+        .option("--cursor <cursor>", "Pagination cursor")
+        .action(async (options, command) => {
+        if (!config.tenantId) {
+            printError("QNSP_TENANT_ID must be set");
+            process.exit(EXIT_CODES.INVALID_ARGUMENTS);
+            return;
+        }
+        try {
+            const effectiveConfig = getEffectiveConfig(config, command);
+            if (!effectiveConfig.tenantId) {
+                printError("QNSP_TENANT_ID must be set");
+                process.exit(EXIT_CODES.INVALID_ARGUMENTS);
+                return;
+            }
+            const headers = await getAuthHeaders(effectiveConfig);
+            const accessUrl = effectiveConfig.accessControlServiceUrl;
+            const url = new URL(`${accessUrl}/access/v1/tenants/${effectiveConfig.tenantId}/policies`);
+            url.searchParams.set("limit", options.limit);
+            if (options.cursor) {
+                url.searchParams.set("cursor", options.cursor);
+            }
+            const response = await fetchWithBackendHandling(effectiveConfig, url.toString(), {
+                headers,
+            });
+            if (!response.ok && [429, 402, 403, 507].includes(response.status)) {
+                return;
+            }
+            if (!response.ok) {
+                const errorText = await response.text();
+                printError(`Failed to list policies: ${response.status} ${errorText}`);
+                process.exit(EXIT_CODES.GENERAL_ERROR);
+                return;
+            }
+            const data = (await response.json());
+            if (effectiveConfig.outputFormat === "json") {
+                printJson(data);
+            }
+            else {
+                printTable((data.items ?? []));
+            }
+            process.exit(EXIT_CODES.SUCCESS);
+            return;
+        }
+        catch (error) {
+            printError(error instanceof Error ? error.message : "Failed to list policies");
+            process.exit(EXIT_CODES.NETWORK_ERROR);
+            return;
+        }
+    });
+    policies
+        .command("get")
+        .description("Get policy details")
+        .argument("<policyId>", "Policy identifier")
+        .action(async (policyId, _options, command) => {
+        if (!config.tenantId) {
+            printError("QNSP_TENANT_ID must be set");
+            process.exit(EXIT_CODES.INVALID_ARGUMENTS);
+            return;
+        }
+        try {
+            const effectiveConfig = getEffectiveConfig(config, command);
+            if (!effectiveConfig.tenantId) {
+                printError("QNSP_TENANT_ID must be set");
+                process.exit(EXIT_CODES.INVALID_ARGUMENTS);
+                return;
+            }
+            const headers = await getAuthHeaders(effectiveConfig);
+            const accessUrl = effectiveConfig.accessControlServiceUrl;
+            const url = new URL(`${accessUrl}/access/v1/policies/${policyId}`);
+            const response = await fetchWithBackendHandling(effectiveConfig, url.toString(), {
+                headers,
+            });
+            if (!response.ok && [429, 402, 403, 507].includes(response.status)) {
+                return;
+            }
+            if (response.status === 404) {
+                printError(`Policy not found: ${policyId}`);
+                process.exit(EXIT_CODES.NOT_FOUND);
+                return;
+            }
+            if (!response.ok) {
+                const errorText = await response.text();
+                printError(`Failed to get policy: ${response.status} ${errorText}`);
+                process.exit(EXIT_CODES.GENERAL_ERROR);
+                return;
+            }
+            const data = await response.json();
+            if (effectiveConfig.outputFormat === "json") {
+                printJson(data);
+            }
+            else {
+                printTable(data);
+            }
+            process.exit(EXIT_CODES.SUCCESS);
+            return;
+        }
+        catch (error) {
+            printError(error instanceof Error ? error.message : "Failed to get policy");
+            process.exit(EXIT_CODES.NETWORK_ERROR);
+            return;
+        }
+    });
+    policies
+        .command("create")
+        .description("Create access policy")
+        .requiredOption("--name <name>", "Policy name")
+        .requiredOption("--effect <effect>", "Policy effect (allow/deny)")
+        .requiredOption("--actions <actions>", "Comma-separated actions")
+        .requiredOption("--resources <resources>", "Comma-separated resources")
+        .action(async (options, command) => {
+        if (!config.tenantId) {
+            printError("QNSP_TENANT_ID must be set");
+            process.exit(EXIT_CODES.INVALID_ARGUMENTS);
+            return;
+        }
+        try {
+            const effectiveConfig = getEffectiveConfig(config, command);
+            if (!effectiveConfig.tenantId) {
+                printError("QNSP_TENANT_ID must be set");
+                process.exit(EXIT_CODES.INVALID_ARGUMENTS);
+                return;
+            }
+            const headers = await getAuthHeaders(effectiveConfig);
+            const accessUrl = effectiveConfig.accessControlServiceUrl;
+            const response = await fetchWithBackendHandling(effectiveConfig, `${accessUrl}/access/v1/policies`, {
+                method: "POST",
+                headers,
+                body: JSON.stringify({
+                    tenantId: effectiveConfig.tenantId,
+                    name: options.name,
+                    statement: {
+                        effect: options.effect,
+                        actions: options.actions
+                            .split(",")
+                            .map((v) => v.trim())
+                            .filter(Boolean),
+                        resources: options.resources
+                            .split(",")
+                            .map((v) => v.trim())
+                            .filter(Boolean),
+                    },
+                }),
+            });
+            if (!response.ok && [429, 402, 403, 507].includes(response.status)) {
+                return;
+            }
+            if (!response.ok) {
+                const errorText = await response.text();
+                printError(`Failed to create policy: ${response.status} ${errorText}`);
+                process.exit(EXIT_CODES.GENERAL_ERROR);
+                return;
+            }
+            const data = await response.json();
+            if (effectiveConfig.outputFormat === "json") {
+                printJson(data);
+            }
+            else {
+                printSuccess(`Policy created: ${data.id}`);
+                printTable(data);
+            }
+            process.exit(EXIT_CODES.SUCCESS);
+            return;
+        }
+        catch (error) {
+            printError(error instanceof Error ? error.message : "Failed to create policy");
+            process.exit(EXIT_CODES.NETWORK_ERROR);
+            return;
+        }
+    });
+}
+//# sourceMappingURL=access-control.js.map

package/dist/cli/commands/access-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-control.js","sourceRoot":"","sources":["../../../src/cli/commands/access-control.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErF,MAAM,UAAU,6BAA6B,CAAC,OAAgB,EAAE,MAAiB;IAChF,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,iCAAiC,CAAC,CAAC;IAExF,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;IAE7E,QAAQ;SACN,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,sBAAsB,CAAC;SACnC,MAAM,CAAC,kBAAkB,EAAE,8BAA8B,EAAE,KAAK,CAAC;SACjE,MAAM,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;SAChD,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;QAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtB,UAAU,CAAC,4BAA4B,CAAC,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;YAC3C,OAAO;QACR,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,eAAe,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC5D,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC;gBAC/B,UAAU,CAAC,4BAA4B,CAAC,CAAC;gBACzC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;gBAC3C,OAAO;YACR,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,CAAC;YACtD,MAAM,SAAS,GAAG,eAAe,CAAC,uBAAuB,CAAC;YAC1D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,SAAS,sBAAsB,eAAe,CAAC,QAAQ,WAAW,CAAC,CAAC;YAC3F,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAChD,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,eAAe,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE;gBAChF,OAAO;aACP,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpE,OAAO;YACR,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAClB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxC,UAAU,CAAC,4BAA4B,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;gBACvE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;gBACvC,OAAO;YACR,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAsD,CAAC;YAE1F,IAAI,eAAe,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;gBAC7C,SAAS,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACP,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAA8B,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACjC,OAAO;QACR,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,UAAU,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC;YAC/E,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YACvC,OAAO;QACR,CAAC;IACF,CAAC,CAAC,CAAC;IAEJ,QAAQ;SACN,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,oBAAoB,CAAC;SACjC,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;SAC3C,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;QACrD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtB,UAAU,CAAC,4BAA4B,CAAC,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;YAC3C,OAAO;QACR,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,eAAe,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC5D,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC;gBAC/B,UAAU,CAAC,4BAA4B,CAAC,CAAC;gBACzC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;gBAC3C,OAAO;YACR,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,CAAC;YACtD,MAAM,SAAS,GAAG,eAAe,CAAC,uBAAuB,CAAC;YAC1D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,SAAS,uBAAuB,QAAQ,EAAE,CAAC,CAAC;YAEnE,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,eAAe,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE;gBAChF,OAAO;aACP,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpE,OAAO;YACR,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7B,UAAU,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC;gBAC5C,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;gBACnC,OAAO;YACR,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAClB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxC,UAAU,CAAC,yBAAyB,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;gBACpE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;gBACvC,OAAO;YACR,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAEnC,IAAI,eAAe,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;gBAC7C,SAAS,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACP,UAAU,CAAC,IAA+B,CAAC,CAAC;YAC7C,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACjC,OAAO;QACR,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,UAAU,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;YAC5E,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YACvC,OAAO;QACR,CAAC;IACF,CAAC,CAAC,CAAC;IAEJ,QAAQ;SACN,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,sBAAsB,CAAC;SACnC,cAAc,CAAC,eAAe,EAAE,aAAa,CAAC;SAC9C,cAAc,CAAC,mBAAmB,EAAE,4BAA4B,CAAC;SACjE,cAAc,CAAC,qBAAqB,EAAE,yBAAyB,CAAC;SAChE,cAAc,CAAC,yBAAyB,EAAE,2BAA2B,CAAC;SACtE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;QAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtB,UAAU,CAAC,4BAA4B,CAAC,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;YAC3C,OAAO;QACR,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,eAAe,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC5D,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC;gBAC/B,UAAU,CAAC,4BAA4B,CAAC,CAAC;gBACzC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;gBAC3C,OAAO;YACR,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,CAAC;YACtD,MAAM,SAAS,GAAG,eAAe,CAAC,uBAAuB,CAAC;YAE1D,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAC9C,eAAe,EACf,GAAG,SAAS,qBAAqB,EACjC;gBACC,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACpB,QAAQ,EAAE,eAAe,CAAC,QAAQ;oBAClC,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,SAAS,EAAE;wBACV,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,OAAO,EAAE,OAAO,CAAC,OAAO;6BACtB,KAAK,CAAC,GAAG,CAAC;6BACV,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;6BAC5B,MAAM,CAAC,OAAO,CAAC;wBACjB,SAAS,EAAE,OAAO,CAAC,SAAS;6BAC1B,KAAK,CAAC,GAAG,CAAC;6BACV,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;6BAC5B,MAAM,CAAC,OAAO,CAAC;qBACjB;iBACD,CAAC;aACF,CACD,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpE,OAAO;YACR,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAClB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxC,UAAU,CAAC,4BAA4B,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;gBACvE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;gBACvC,OAAO;YACR,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAEnC,IAAI,eAAe,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;gBAC7C,SAAS,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACP,YAAY,CAAC,mBAAoB,IAAwB,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChE,UAAU,CAAC,IAA+B,CAAC,CAAC;YAC7C,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACjC,OAAO;QACR,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,UAAU,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC;YAC/E,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YACvC,OAAO;QACR,CAAC;IACF,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/commands/audit.d.ts

@@ -0,0 +1,4 @@
+import type { Command } from "commander";
+import type { CliConfig } from "../config.js";
+export declare function registerAuditCommands(program: Command, config: CliConfig): void;
+//# sourceMappingURL=audit.d.ts.map

package/dist/cli/commands/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAO9C,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI,CAoE/E"}

package/dist/cli/commands/audit.js

@@ -0,0 +1,70 @@
+import { EXIT_CODES } from "../config.js";
+import { getAuthHeaders } from "../utils/auth.js";
+import { getEffectiveConfig } from "../utils/command-config.js";
+import { fetchWithBackendHandling } from "../utils/fetcher.js";
+import { printError, printJson, printTable } from "../utils/output.js";
+export function registerAuditCommands(program, config) {
+    const audit = program.command("audit").description("Audit event commands");
+    const events = audit.command("events").description("Event operations");
+    events
+        .command("list")
+        .description("List audit events")
+        .option("--limit <number>", "Number of events to return (1-200)", "50")
+        .option("--cursor <cursor>", "Pagination cursor")
+        .option("--source-service <service>", "Filter by source service")
+        .option("--topic <topic>", "Filter by topic")
+        .option("--since <timestamp>", "Filter events since timestamp")
+        .action(async (options, command) => {
+        if (!config.tenantId) {
+            printError("QNSP_TENANT_ID must be set");
+            process.exit(EXIT_CODES.INVALID_ARGUMENTS);
+            return;
+        }
+        try {
+            const effectiveConfig = getEffectiveConfig(config, command);
+            const headers = await getAuthHeaders(effectiveConfig);
+            const url = new URL(`${effectiveConfig.auditServiceUrl}/audit/v1/events`);
+            url.searchParams.set("tenantId", effectiveConfig.tenantId ?? "");
+            url.searchParams.set("limit", options.limit);
+            if (options.cursor) {
+                url.searchParams.set("cursor", options.cursor);
+            }
+            if (options.sourceService) {
+                url.searchParams.set("sourceService", options.sourceService);
+            }
+            if (options.topic) {
+                url.searchParams.set("topic", options.topic);
+            }
+            if (options.since) {
+                url.searchParams.set("since", options.since);
+            }
+            const response = await fetchWithBackendHandling(effectiveConfig, url.toString(), {
+                headers,
+            });
+            if (!response.ok && [429, 402, 403, 507].includes(response.status)) {
+                return;
+            }
+            if (!response.ok) {
+                const errorText = await response.text();
+                printError(`Failed to list events: ${response.status} ${errorText}`);
+                process.exit(EXIT_CODES.GENERAL_ERROR);
+                return;
+            }
+            const data = (await response.json());
+            if (effectiveConfig.outputFormat === "json") {
+                printJson(data);
+            }
+            else {
+                printTable((data.items ?? []));
+            }
+            process.exit(EXIT_CODES.SUCCESS);
+            return;
+        }
+        catch (error) {
+            printError(error instanceof Error ? error.message : "Failed to list events");
+            process.exit(EXIT_CODES.NETWORK_ERROR);
+            return;
+        }
+    });
+}
+//# sourceMappingURL=audit.js.map

package/dist/cli/commands/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/cli/commands/audit.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEvE,MAAM,UAAU,qBAAqB,CAAC,OAAgB,EAAE,MAAiB;IACxE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC;IAE3E,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAEvE,MAAM;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,mBAAmB,CAAC;SAChC,MAAM,CAAC,kBAAkB,EAAE,oCAAoC,EAAE,IAAI,CAAC;SACtE,MAAM,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;SAChD,MAAM,CAAC,4BAA4B,EAAE,0BAA0B,CAAC;SAChE,MAAM,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;SAC5C,MAAM,CAAC,qBAAqB,EAAE,+BAA+B,CAAC;SAC9D,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;QAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtB,UAAU,CAAC,4BAA4B,CAAC,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;YAC3C,OAAO;QACR,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,eAAe,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,eAAe,CAAC,eAAe,kBAAkB,CAAC,CAAC;YAC1E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,eAAe,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;YACjE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC3B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;YAC9D,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC9C,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,eAAe,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE;gBAChF,OAAO;aACP,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpE,OAAO;YACR,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAClB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxC,UAAU,CAAC,0BAA0B,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;gBACrE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;gBACvC,OAAO;YACR,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAC;YAE9D,IAAI,eAAe,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;gBAC7C,SAAS,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACP,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAA8B,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACjC,OAAO;QACR,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,UAAU,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAC7E,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YACvC,OAAO;QACR,CAAC;IACF,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/commands/auth.d.ts

@@ -0,0 +1,4 @@
+import type { Command } from "commander";
+import type { CliConfig } from "../config.js";
+export declare function registerAuthCommands(program: Command, config: CliConfig): void;
+//# sourceMappingURL=auth.d.ts.map

package/dist/cli/commands/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAK9C,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI,CA2C9E"}