@heossi/qnsi 0.3.2

package/dist/cli/commands/test-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-utils.js","sourceRoot":"","sources":["../../../src/cli/commands/test-utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAa5B,uDAAuD;AACvD,MAAM,UAAU,kBAAkB,CACjC,IAAa,EACb,MAAM,GAAG,GAAG,EACZ,EAAE,GAAG,IAAI,EACT,UAAkC,EAAE;IAEpC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,eAAe,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7C,8DAA8D;IAC9D,2CAA2C;IAC3C,OAAO;QACN,EAAE;QACF,MAAM;QACN,OAAO,EAAE,eAAe;QACxB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QAClC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;QACtB,KAAK;YACJ,OAAO,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QACtD,CAAC;KACsB,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAc;IACpC,cAAc,EAAE,IAAI;IACpB,cAAc,EAAE,+BAA+B;IAC/C,cAAc,EAAE,uBAAuB;IACvC,SAAS,EAAE,iBAAiB;IAC5B,aAAa,EAAE,aAAa;IAC5B,QAAQ,EAAE,aAAa;IACvB,aAAa,EAAE,uBAAuB;IACtC,eAAe,EAAE,uBAAuB;IACxC,eAAe,EAAE,uBAAuB;IACxC,gBAAgB,EAAE,uBAAuB;IACzC,iBAAiB,EAAE,+BAA+B;IAClD,uBAAuB,EAAE,uBAAuB;IAChD,4BAA4B,EAAE,uBAAuB;IACrD,iBAAiB,EAAE,uBAAuB;IAC1C,gBAAgB,EAAE,uBAAuB;IACzC,uBAAuB,EAAE,uBAAuB;IAChD,YAAY,EAAE,MAAM;IACpB,OAAO,EAAE,KAAK;CACd,CAAC;AAEF,MAAM,UAAU,oBAAoB;IACnC,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,SAAkB,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAE1E,yBAAyB;IACzB,MAAM,CAAC,KAAK,GAAG,SAAoC,CAAC;IAEpD,+BAA+B;IAC/B,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE;QAC7C,KAAK,EAAE,KAAK;QACZ,YAAY,EAAE,IAAI;KAClB,CAAC,CAAC;IAEH,+DAA+D;IAC/D,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,aAAa,CAAC;IAExC,OAAO;QACN,SAAS;QACT,QAAQ;QACR,OAAO;QACP,SAAS;QACT,SAAS;QACT,OAAO,EAAE,GAAG,EAAE;YACb,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;gBACnC,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,eAAe,CAAC;YAC3C,CAAC;YACD,EAAE,CAAC,eAAe,EAAE,CAAC;QACtB,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/cli/commands/vault.d.ts

@@ -0,0 +1,4 @@
+import type { Command } from "commander";
+import type { CliConfig } from "../config.js";
+export declare function registerVaultCommands(program: Command, config: CliConfig): void;
+//# sourceMappingURL=vault.d.ts.map

package/dist/cli/commands/vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/vault.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAO9C,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI,CAoH/E"}

package/dist/cli/commands/vault.js

@@ -0,0 +1,111 @@
+import { EXIT_CODES } from "../config.js";
+import { getAuthHeaders } from "../utils/auth.js";
+import { getEffectiveConfig } from "../utils/command-config.js";
+import { fetchWithBackendHandling } from "../utils/fetcher.js";
+import { printError, printJson, printTable } from "../utils/output.js";
+export function registerVaultCommands(program, config) {
+    const vault = program.command("vault").description("Vault secret management commands");
+    const secrets = vault.command("secrets").description("Secret operations");
+    secrets
+        .command("list")
+        .description("List vault secrets")
+        .option("--limit <number>", "Number of secrets to return", "100")
+        .action(async (options, command) => {
+        if (!config.tenantId) {
+            printError("QNSP_TENANT_ID must be set");
+            process.exit(EXIT_CODES.INVALID_ARGUMENTS);
+            return;
+        }
+        try {
+            const effectiveConfig = getEffectiveConfig(config, command);
+            if (!effectiveConfig.tenantId) {
+                printError("QNSP_TENANT_ID must be set");
+                process.exit(EXIT_CODES.INVALID_ARGUMENTS);
+                return;
+            }
+            const headers = await getAuthHeaders(effectiveConfig);
+            const url = new URL(`${effectiveConfig.vaultServiceUrl}/vault/v1/secrets`);
+            url.searchParams.set("tenantId", effectiveConfig.tenantId);
+            url.searchParams.set("limit", options.limit);
+            const response = await fetchWithBackendHandling(effectiveConfig, url.toString(), {
+                headers,
+            });
+            if (!response.ok && [429, 402, 403, 507].includes(response.status)) {
+                return;
+            }
+            if (!response.ok) {
+                const errorText = await response.text();
+                printError(`Failed to list secrets: ${response.status} ${errorText}`);
+                process.exit(EXIT_CODES.GENERAL_ERROR);
+                return;
+            }
+            const data = (await response.json());
+            if (effectiveConfig.outputFormat === "json") {
+                printJson(data);
+            }
+            else {
+                printTable((data.secrets ?? []));
+            }
+            process.exit(EXIT_CODES.SUCCESS);
+            return;
+        }
+        catch (error) {
+            printError(error instanceof Error ? error.message : "Failed to list secrets");
+            process.exit(EXIT_CODES.NETWORK_ERROR);
+            return;
+        }
+    });
+    secrets
+        .command("get")
+        .description("Get secret value")
+        .argument("<secretId>", "Secret identifier (UUID)")
+        .action(async (secretId, _options, command) => {
+        if (!config.tenantId) {
+            printError("QNSP_TENANT_ID must be set");
+            process.exit(EXIT_CODES.INVALID_ARGUMENTS);
+            return;
+        }
+        try {
+            const effectiveConfig = getEffectiveConfig(config, command);
+            if (!effectiveConfig.tenantId) {
+                printError("QNSP_TENANT_ID must be set");
+                process.exit(EXIT_CODES.INVALID_ARGUMENTS);
+                return;
+            }
+            const headers = await getAuthHeaders(effectiveConfig);
+            const url = new URL(`${effectiveConfig.vaultServiceUrl}/vault/v1/secrets/${encodeURIComponent(secretId)}/value`);
+            const response = await fetchWithBackendHandling(effectiveConfig, url.toString(), {
+                headers,
+            });
+            if (!response.ok && [429, 402, 403, 507].includes(response.status)) {
+                return;
+            }
+            if (response.status === 404) {
+                printError(`Secret not found: ${secretId}`);
+                process.exit(EXIT_CODES.NOT_FOUND);
+                return;
+            }
+            if (!response.ok) {
+                const errorText = await response.text();
+                printError(`Failed to get secret: ${response.status} ${errorText}`);
+                process.exit(EXIT_CODES.GENERAL_ERROR);
+                return;
+            }
+            const data = await response.json();
+            if (effectiveConfig.outputFormat === "json") {
+                printJson(data);
+            }
+            else {
+                printTable(data);
+            }
+            process.exit(EXIT_CODES.SUCCESS);
+            return;
+        }
+        catch (error) {
+            printError(error instanceof Error ? error.message : "Failed to get secret");
+            process.exit(EXIT_CODES.NETWORK_ERROR);
+            return;
+        }
+    });
+}
+//# sourceMappingURL=vault.js.map

package/dist/cli/commands/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../../src/cli/commands/vault.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEvE,MAAM,UAAU,qBAAqB,CAAC,OAAgB,EAAE,MAAiB;IACxE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,kCAAkC,CAAC,CAAC;IAEvF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;IAE1E,OAAO;SACL,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,oBAAoB,CAAC;SACjC,MAAM,CAAC,kBAAkB,EAAE,6BAA6B,EAAE,KAAK,CAAC;SAChE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;QAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtB,UAAU,CAAC,4BAA4B,CAAC,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;YAC3C,OAAO;QACR,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,eAAe,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC5D,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC;gBAC/B,UAAU,CAAC,4BAA4B,CAAC,CAAC;gBACzC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;gBAC3C,OAAO;YACR,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,eAAe,CAAC,eAAe,mBAAmB,CAAC,CAAC;YAC3E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAE7C,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,eAAe,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE;gBAChF,OAAO;aACP,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpE,OAAO;YACR,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAClB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxC,UAAU,CAAC,2BAA2B,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;gBACtE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;gBACvC,OAAO;YACR,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;YAEhE,IAAI,eAAe,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;gBAC7C,SAAS,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACP,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAA8B,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACjC,OAAO;QACR,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,UAAU,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;YAC9E,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YACvC,OAAO;QACR,CAAC;IACF,CAAC,CAAC,CAAC;IAEJ,OAAO;SACL,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,kBAAkB,CAAC;SAC/B,QAAQ,CAAC,YAAY,EAAE,0BAA0B,CAAC;SAClD,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;QACrD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtB,UAAU,CAAC,4BAA4B,CAAC,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;YAC3C,OAAO;QACR,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,eAAe,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC5D,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC;gBAC/B,UAAU,CAAC,4BAA4B,CAAC,CAAC;gBACzC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;gBAC3C,OAAO;YACR,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,IAAI,GAAG,CAClB,GAAG,eAAe,CAAC,eAAe,qBAAqB,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAC3F,CAAC;YAEF,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,eAAe,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE;gBAChF,OAAO;aACP,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpE,OAAO;YACR,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7B,UAAU,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC;gBAC5C,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;gBACnC,OAAO;YACR,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAClB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxC,UAAU,CAAC,yBAAyB,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;gBACpE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;gBACvC,OAAO;YACR,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAEnC,IAAI,eAAe,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;gBAC7C,SAAS,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACP,UAAU,CAAC,IAA+B,CAAC,CAAC;YAC7C,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACjC,OAAO;QACR,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,UAAU,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;YAC5E,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YACvC,OAAO;QACR,CAAC;IACF,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/config.d.ts

@@ -0,0 +1,32 @@
+export interface CliConfig {
+    readonly edgeGatewayUrl: string | null;
+    readonly cloudPortalUrl: string;
+    readonly authServiceUrl: string;
+    readonly serviceId: string | null;
+    readonly serviceSecret: string | null;
+    readonly tenantId: string | null;
+    readonly kmsServiceUrl: string;
+    readonly vaultServiceUrl: string;
+    readonly auditServiceUrl: string;
+    readonly tenantServiceUrl: string;
+    readonly billingServiceUrl: string;
+    readonly accessControlServiceUrl: string;
+    readonly securityMonitoringServiceUrl: string;
+    readonly storageServiceUrl: string;
+    readonly searchServiceUrl: string;
+    readonly observabilityServiceUrl: string;
+    readonly outputFormat: "json" | "table" | "yaml";
+    readonly verbose: boolean;
+}
+export declare function loadConfig(overrides?: Partial<CliConfig>): CliConfig;
+export declare const EXIT_CODES: {
+    readonly SUCCESS: 0;
+    readonly GENERAL_ERROR: 1;
+    readonly INVALID_ARGUMENTS: 2;
+    readonly AUTH_ERROR: 3;
+    readonly AUTHORIZATION_ERROR: 4;
+    readonly NOT_FOUND: 5;
+    readonly RATE_LIMITED: 6;
+    readonly NETWORK_ERROR: 7;
+};
+//# sourceMappingURL=config.d.ts.map

package/dist/cli/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/cli/config.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,SAAS;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,4BAA4B,EAAE,MAAM,CAAC;IAC9C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;IACjD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC1B;AAkBD,wBAAgB,UAAU,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,SAAS,CAgFpE;AAED,eAAO,MAAM,UAAU;;;;;;;;;CASb,CAAC"}

package/dist/cli/config.js

@@ -0,0 +1,105 @@
+import { config as loadDotenv } from "dotenv";
+const shouldLoadDotenv = (process.env["NODE_ENV"] ?? "development") !== "production" ||
+    process.env["QNSP_LOAD_ENV_FILE_IN_PROD"] === "true";
+if (shouldLoadDotenv) {
+    loadDotenv();
+}
+function deriveViaEdgeGateway(options) {
+    const explicit = process.env[options.envVar];
+    if (explicit && explicit.length > 0) {
+        return explicit;
+    }
+    if (options.edgeGatewayUrl) {
+        return `${options.edgeGatewayUrl.replace(/\/$/, "")}/proxy${options.proxyPath}`;
+    }
+    return options.localDefault;
+}
+export function loadConfig(overrides) {
+    const edgeGatewayUrl = process.env["QNSP_EDGE_GATEWAY_URL"] ?? null;
+    const cloudPortalUrl = process.env["QNSP_CLOUD_PORTAL_URL"] ?? "https://cloud.qnsp.cuilabs.io";
+    const defaults = {
+        edgeGatewayUrl,
+        cloudPortalUrl,
+        authServiceUrl: process.env["QNSP_AUTH_SERVICE_URL"] ?? edgeGatewayUrl ?? "http://localhost:8081",
+        serviceId: process.env["QNSP_SERVICE_ID"] ?? null,
+        serviceSecret: process.env["QNSP_SERVICE_SECRET"] ?? null,
+        tenantId: process.env["QNSP_TENANT_ID"] ?? null,
+        kmsServiceUrl: deriveViaEdgeGateway({
+            edgeGatewayUrl,
+            envVar: "QNSP_KMS_SERVICE_URL",
+            proxyPath: "/kms",
+            localDefault: "http://localhost:8095",
+        }),
+        vaultServiceUrl: deriveViaEdgeGateway({
+            edgeGatewayUrl,
+            envVar: "QNSP_VAULT_SERVICE_URL",
+            proxyPath: "/vault",
+            localDefault: "http://localhost:8090",
+        }),
+        auditServiceUrl: deriveViaEdgeGateway({
+            edgeGatewayUrl,
+            envVar: "QNSP_AUDIT_SERVICE_URL",
+            proxyPath: "/audit",
+            localDefault: "http://localhost:8103",
+        }),
+        tenantServiceUrl: deriveViaEdgeGateway({
+            edgeGatewayUrl,
+            envVar: "QNSP_TENANT_SERVICE_URL",
+            proxyPath: "/tenant",
+            localDefault: "http://localhost:8108",
+        }),
+        billingServiceUrl: deriveViaEdgeGateway({
+            edgeGatewayUrl,
+            envVar: "QNSP_BILLING_SERVICE_URL",
+            proxyPath: "/billing",
+            // Include the /billing root so local-dev (no edge gateway) appends the same
+            // post-/billing paths the commands use (/addons, /v1/usage). Without it,
+            // localhost:8106/addons missed the backend's /billing/addons route.
+            localDefault: "http://localhost:8106/billing",
+        }),
+        accessControlServiceUrl: deriveViaEdgeGateway({
+            edgeGatewayUrl,
+            envVar: "QNSP_ACCESS_CONTROL_SERVICE_URL",
+            proxyPath: "/access",
+            localDefault: "http://localhost:8102",
+        }),
+        securityMonitoringServiceUrl: deriveViaEdgeGateway({
+            edgeGatewayUrl,
+            envVar: "QNSP_SECURITY_MONITORING_SERVICE_URL",
+            proxyPath: "/security",
+            localDefault: "http://localhost:8104",
+        }),
+        storageServiceUrl: deriveViaEdgeGateway({
+            edgeGatewayUrl,
+            envVar: "QNSP_STORAGE_SERVICE_URL",
+            proxyPath: "/storage",
+            localDefault: "http://localhost:8092",
+        }),
+        searchServiceUrl: deriveViaEdgeGateway({
+            edgeGatewayUrl,
+            envVar: "QNSP_SEARCH_SERVICE_URL",
+            proxyPath: "/search",
+            localDefault: "http://localhost:8101",
+        }),
+        observabilityServiceUrl: deriveViaEdgeGateway({
+            edgeGatewayUrl,
+            envVar: "QNSP_OBSERVABILITY_SERVICE_URL",
+            proxyPath: "/observability",
+            localDefault: "http://localhost:8105",
+        }),
+        outputFormat: process.env["QNSP_OUTPUT_FORMAT"] ?? "table",
+        verbose: process.env["QNSP_VERBOSE"] === "true",
+    };
+    return { ...defaults, ...overrides };
+}
+export const EXIT_CODES = {
+    SUCCESS: 0,
+    GENERAL_ERROR: 1,
+    INVALID_ARGUMENTS: 2,
+    AUTH_ERROR: 3,
+    AUTHORIZATION_ERROR: 4,
+    NOT_FOUND: 5,
+    RATE_LIMITED: 6,
+    NETWORK_ERROR: 7,
+};
+//# sourceMappingURL=config.js.map

package/dist/cli/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/cli/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,QAAQ,CAAC;AAE9C,MAAM,gBAAgB,GACrB,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,aAAa,CAAC,KAAK,YAAY;IAC3D,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,KAAK,MAAM,CAAC;AAEtD,IAAI,gBAAgB,EAAE,CAAC;IACtB,UAAU,EAAE,CAAC;AACd,CAAC;AAuBD,SAAS,oBAAoB,CAAC,OAK7B;IACA,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,OAAO,CAAC,SAAS,EAAE,CAAC;IACjF,CAAC;IACD,OAAO,OAAO,CAAC,YAAY,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAA8B;IACxD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC;IACpE,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,+BAA+B,CAAC;IAE/F,MAAM,QAAQ,GAAc;QAC3B,cAAc;QACd,cAAc;QACd,cAAc,EACb,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,cAAc,IAAI,uBAAuB;QAClF,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,IAAI;QACjD,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,IAAI;QACzD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI;QAC/C,aAAa,EAAE,oBAAoB,CAAC;YACnC,cAAc;YACd,MAAM,EAAE,sBAAsB;YAC9B,SAAS,EAAE,MAAM;YACjB,YAAY,EAAE,uBAAuB;SACrC,CAAC;QACF,eAAe,EAAE,oBAAoB,CAAC;YACrC,cAAc;YACd,MAAM,EAAE,wBAAwB;YAChC,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,uBAAuB;SACrC,CAAC;QACF,eAAe,EAAE,oBAAoB,CAAC;YACrC,cAAc;YACd,MAAM,EAAE,wBAAwB;YAChC,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,uBAAuB;SACrC,CAAC;QACF,gBAAgB,EAAE,oBAAoB,CAAC;YACtC,cAAc;YACd,MAAM,EAAE,yBAAyB;YACjC,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,uBAAuB;SACrC,CAAC;QACF,iBAAiB,EAAE,oBAAoB,CAAC;YACvC,cAAc;YACd,MAAM,EAAE,0BAA0B;YAClC,SAAS,EAAE,UAAU;YACrB,4EAA4E;YAC5E,yEAAyE;YACzE,oEAAoE;YACpE,YAAY,EAAE,+BAA+B;SAC7C,CAAC;QACF,uBAAuB,EAAE,oBAAoB,CAAC;YAC7C,cAAc;YACd,MAAM,EAAE,iCAAiC;YACzC,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,uBAAuB;SACrC,CAAC;QACF,4BAA4B,EAAE,oBAAoB,CAAC;YAClD,cAAc;YACd,MAAM,EAAE,sCAAsC;YAC9C,SAAS,EAAE,WAAW;YACtB,YAAY,EAAE,uBAAuB;SACrC,CAAC;QACF,iBAAiB,EAAE,oBAAoB,CAAC;YACvC,cAAc;YACd,MAAM,EAAE,0BAA0B;YAClC,SAAS,EAAE,UAAU;YACrB,YAAY,EAAE,uBAAuB;SACrC,CAAC;QACF,gBAAgB,EAAE,oBAAoB,CAAC;YACtC,cAAc;YACd,MAAM,EAAE,yBAAyB;YACjC,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,uBAAuB;SACrC,CAAC;QACF,uBAAuB,EAAE,oBAAoB,CAAC;YAC7C,cAAc;YACd,MAAM,EAAE,gCAAgC;YACxC,SAAS,EAAE,gBAAgB;YAC3B,YAAY,EAAE,uBAAuB;SACrC,CAAC;QACF,YAAY,EAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAA+B,IAAI,OAAO;QACzF,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,MAAM;KAC/C,CAAC;IAEF,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,SAAS,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG;IACzB,OAAO,EAAE,CAAC;IACV,aAAa,EAAE,CAAC;IAChB,iBAAiB,EAAE,CAAC;IACpB,UAAU,EAAE,CAAC;IACb,mBAAmB,EAAE,CAAC;IACtB,SAAS,EAAE,CAAC;IACZ,YAAY,EAAE,CAAC;IACf,aAAa,EAAE,CAAC;CACP,CAAC"}

package/dist/cli/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":""}

package/dist/cli/index.js

@@ -0,0 +1,54 @@
+#!/usr/bin/env node
+import { Command } from "commander";
+import cliPackage from "../../package.json" with { type: "json" };
+import { registerAccessControlCommands } from "./commands/access-control.js";
+import { registerAuditCommands } from "./commands/audit.js";
+import { registerAuthCommands } from "./commands/auth.js";
+import { registerBillingCommands } from "./commands/billing.js";
+import { registerCryptoPolicyCommands } from "./commands/crypto-policy.js";
+import { registerKmsCommands } from "./commands/kms.js";
+import { registerObservabilityCommands } from "./commands/observability.js";
+import { registerSearchCommands } from "./commands/search.js";
+import { registerSecurityCommands } from "./commands/security.js";
+import { registerStorageCommands } from "./commands/storage.js";
+import { registerTenantCommands } from "./commands/tenant.js";
+import { registerVaultCommands } from "./commands/vault.js";
+import { loadConfig } from "./config.js";
+const program = new Command();
+program
+    .name("qnsp")
+    .description("QNSP CLI - Command-line interface for the QNSP platform")
+    .version(cliPackage.version)
+    .option("--edge-gateway-url <url>", "Edge Gateway URL (production entrypoint)")
+    .option("--cloud-portal-url <url>", "Cloud Portal URL (for upgrade/add-on links)")
+    .option("--auth-service-url <url>", "Auth service URL")
+    .option("--service-id <id>", "Service account ID")
+    .option("--service-secret <secret>", "Service account secret")
+    .option("--tenant-id <id>", "Tenant identifier")
+    .option("--kms-service-url <url>", "KMS service URL")
+    .option("--vault-service-url <url>", "Vault service URL")
+    .option("--audit-service-url <url>", "Audit service URL")
+    .option("--tenant-service-url <url>", "Tenant service URL")
+    .option("--billing-service-url <url>", "Billing service URL")
+    .option("--access-control-service-url <url>", "Access control service URL")
+    .option("--security-monitoring-service-url <url>", "Security monitoring service URL")
+    .option("--storage-service-url <url>", "Storage service URL")
+    .option("--search-service-url <url>", "Search service URL")
+    .option("--observability-service-url <url>", "Observability service URL")
+    .option("--output <format>", "Output format: json, table, yaml", "table")
+    .option("--verbose", "Enable verbose output");
+const config = loadConfig();
+registerAuthCommands(program, config);
+registerKmsCommands(program, config);
+registerVaultCommands(program, config);
+registerAuditCommands(program, config);
+registerStorageCommands(program, config);
+registerSearchCommands(program, config);
+registerTenantCommands(program, config);
+registerCryptoPolicyCommands(program, config);
+registerBillingCommands(program, config);
+registerAccessControlCommands(program, config);
+registerObservabilityCommands(program, config);
+registerSecurityCommands(program, config);
+program.parse(process.argv);
+//# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,UAAU,MAAM,oBAAoB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAClE,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACL,IAAI,CAAC,MAAM,CAAC;KACZ,WAAW,CAAC,yDAAyD,CAAC;KACtE,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;KAC3B,MAAM,CAAC,0BAA0B,EAAE,0CAA0C,CAAC;KAC9E,MAAM,CAAC,0BAA0B,EAAE,6CAA6C,CAAC;KACjF,MAAM,CAAC,0BAA0B,EAAE,kBAAkB,CAAC;KACtD,MAAM,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;KACjD,MAAM,CAAC,2BAA2B,EAAE,wBAAwB,CAAC;KAC7D,MAAM,CAAC,kBAAkB,EAAE,mBAAmB,CAAC;KAC/C,MAAM,CAAC,yBAAyB,EAAE,iBAAiB,CAAC;KACpD,MAAM,CAAC,2BAA2B,EAAE,mBAAmB,CAAC;KACxD,MAAM,CAAC,2BAA2B,EAAE,mBAAmB,CAAC;KACxD,MAAM,CAAC,4BAA4B,EAAE,oBAAoB,CAAC;KAC1D,MAAM,CAAC,6BAA6B,EAAE,qBAAqB,CAAC;KAC5D,MAAM,CAAC,oCAAoC,EAAE,4BAA4B,CAAC;KAC1E,MAAM,CAAC,yCAAyC,EAAE,iCAAiC,CAAC;KACpF,MAAM,CAAC,6BAA6B,EAAE,qBAAqB,CAAC;KAC5D,MAAM,CAAC,4BAA4B,EAAE,oBAAoB,CAAC;KAC1D,MAAM,CAAC,mCAAmC,EAAE,2BAA2B,CAAC;KACxE,MAAM,CAAC,mBAAmB,EAAE,kCAAkC,EAAE,OAAO,CAAC;KACxE,MAAM,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC;AAE/C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;AAE5B,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACtC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACrC,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACvC,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACvC,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACzC,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACxC,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACxC,4BAA4B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC9C,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACzC,6BAA6B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC/C,6BAA6B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC/C,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAE1C,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC"}

package/dist/cli/utils/audit-logger.d.ts

@@ -0,0 +1,17 @@
+import type { CliConfig } from "../config.js";
+export interface AuditLogEntry {
+    readonly timestamp: string;
+    readonly action: string;
+    readonly actor: string;
+    readonly resource?: string;
+    readonly result: "success" | "failure";
+    readonly metadata?: Record<string, unknown>;
+}
+export declare class AuditLogger {
+    private readonly config;
+    private readonly enabled;
+    constructor(config: CliConfig);
+    log(entry: Omit<AuditLogEntry, "timestamp">): Promise<void>;
+    logCommand(command: string, args: string[], result: "success" | "failure", metadata?: Record<string, unknown>): Promise<void>;
+}
+//# sourceMappingURL=audit-logger.d.ts.map

package/dist/cli/utils/audit-logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-logger.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/audit-logger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAED,qBAAa,WAAW;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;gBAEtB,MAAM,EAAE,SAAS;IAKvB,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAmC3D,UAAU,CACf,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,MAAM,EAAE,SAAS,GAAG,SAAS,EAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,IAAI,CAAC;CAchB"}

package/dist/cli/utils/audit-logger.js

@@ -0,0 +1,52 @@
+export class AuditLogger {
+    config;
+    enabled;
+    constructor(config) {
+        this.config = config;
+        this.enabled = process.env["QNSP_CLI_AUDIT_LOGGING"] === "true";
+    }
+    async log(entry) {
+        if (!this.enabled) {
+            return;
+        }
+        const fullEntry = {
+            timestamp: new Date().toISOString(),
+            ...entry,
+        };
+        try {
+            const response = await fetch(`${this.config.auditServiceUrl}/audit/v1/events`, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    "x-qnsp-tenant": this.config.tenantId ?? "",
+                },
+                body: JSON.stringify({
+                    topic: "cli.operation",
+                    sourceService: "qnsp-cli",
+                    ...fullEntry,
+                }),
+            });
+            if (!response.ok) {
+                console.error(`Failed to log audit event: ${response.status}`);
+            }
+        }
+        catch (error) {
+            console.error("Audit logging failed:", error instanceof Error ? error.message : "Unknown error");
+        }
+    }
+    async logCommand(command, args, result, metadata) {
+        await this.log({
+            action: `cli.${command}`,
+            actor: this.config.serviceId ?? "unknown",
+            resource: args.join(" "),
+            result,
+            metadata: {
+                ...metadata,
+                command,
+                args,
+                version: "0.1.0",
+            },
+        });
+    }
+}
+//# sourceMappingURL=audit-logger.js.map

package/dist/cli/utils/audit-logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-logger.js","sourceRoot":"","sources":["../../../src/cli/utils/audit-logger.ts"],"names":[],"mappings":"AAWA,MAAM,OAAO,WAAW;IACN,MAAM,CAAY;IAClB,OAAO,CAAU;IAElC,YAAY,MAAiB;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,KAAK,MAAM,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAuC;QAChD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO;QACR,CAAC;QAED,MAAM,SAAS,GAAkB;YAChC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,GAAG,KAAK;SACR,CAAC;QAEF,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,kBAAkB,EAAE;gBAC9E,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACR,cAAc,EAAE,kBAAkB;oBAClC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE;iBAC3C;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACpB,KAAK,EAAE,eAAe;oBACtB,aAAa,EAAE,UAAU;oBACzB,GAAG,SAAS;iBACZ,CAAC;aACF,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAClB,OAAO,CAAC,KAAK,CAAC,8BAA8B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAChE,CAAC;QACF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CACZ,uBAAuB,EACvB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CACxD,CAAC;QACH,CAAC;IACF,CAAC;IAED,KAAK,CAAC,UAAU,CACf,OAAe,EACf,IAAc,EACd,MAA6B,EAC7B,QAAkC;QAElC,MAAM,IAAI,CAAC,GAAG,CAAC;YACd,MAAM,EAAE,OAAO,OAAO,EAAE;YACxB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,SAAS;YACzC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACxB,MAAM;YACN,QAAQ,EAAE;gBACT,GAAG,QAAQ;gBACX,OAAO;gBACP,IAAI;gBACJ,OAAO,EAAE,OAAO;aAChB;SACD,CAAC,CAAC;IACJ,CAAC;CACD"}

package/dist/cli/utils/auth.d.ts

@@ -0,0 +1,4 @@
+import type { CliConfig } from "../config.js";
+export declare function requestServiceToken(config: CliConfig): Promise<string | null>;
+export declare function getAuthHeaders(config: CliConfig): Promise<Record<string, string>>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/cli/utils/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAc9C,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAuFnF;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAiBvF"}

package/dist/cli/utils/auth.js

@@ -0,0 +1,100 @@
+import { EXIT_CODES } from "../config.js";
+import { validateHttpsUrl } from "./https-validator.js";
+import { printError, printVerbose } from "./output.js";
+import { promptForSecret } from "./prompt.js";
+import { RateLimitError, RateLimiter } from "./rate-limiter.js";
+import { getCachedToken, setCachedToken } from "./token-cache.js";
+const authRateLimiter = new RateLimiter(50, 60000);
+export async function requestServiceToken(config) {
+    if (!config.serviceId) {
+        printError("QNSP_SERVICE_ID must be set");
+        process.exit(EXIT_CODES.AUTH_ERROR);
+    }
+    const cached = getCachedToken(config.serviceId);
+    if (cached) {
+        printVerbose("Using cached service token", config.verbose);
+        return cached;
+    }
+    let serviceSecret = config.serviceSecret;
+    if (!serviceSecret) {
+        if (process.stdin.isTTY) {
+            printVerbose("Service secret not found, prompting for input", config.verbose);
+            serviceSecret = await promptForSecret("Enter service secret: ");
+        }
+        else {
+            printError("QNSP_SERVICE_SECRET must be set (non-interactive mode)");
+            process.exit(EXIT_CODES.AUTH_ERROR);
+        }
+    }
+    validateHttpsUrl(config.authServiceUrl, "Auth service URL", process.env["NODE_ENV"]);
+    try {
+        await authRateLimiter.checkLimit();
+    }
+    catch (error) {
+        if (error instanceof RateLimitError) {
+            printError(error.message);
+            process.exit(EXIT_CODES.RATE_LIMITED);
+        }
+        throw error;
+    }
+    printVerbose(`Requesting service token from ${config.authServiceUrl}`, config.verbose);
+    try {
+        const response = await fetch(`${config.authServiceUrl}/auth/service-token`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${serviceSecret}`,
+            },
+            body: JSON.stringify({
+                serviceId: config.serviceId,
+                audience: "internal-service",
+            }),
+        });
+        if (!response.ok) {
+            const errorText = await response.text();
+            let errorBody;
+            try {
+                errorBody = JSON.parse(errorText);
+            }
+            catch {
+                errorBody = { error: "unknown", message: errorText };
+            }
+            if (response.status === 429 ||
+                response.status === 402 ||
+                response.status === 403 ||
+                response.status === 507) {
+                const { handleBackendError } = await import("./backend-validator.js");
+                handleBackendError(response, errorBody);
+            }
+            printError(`Failed to get service token: ${response.status} ${errorText}`);
+            process.exit(EXIT_CODES.AUTH_ERROR);
+        }
+        const data = (await response.json());
+        printVerbose("Service token obtained successfully", config.verbose);
+        const { parseRateLimitHeaders, warnIfLowQuota } = await import("./backend-validator.js");
+        const rateLimits = parseRateLimitHeaders(response.headers);
+        warnIfLowQuota(rateLimits.remaining, rateLimits.limit);
+        setCachedToken(config.serviceId, data.accessToken);
+        return data.accessToken;
+    }
+    catch (error) {
+        printError(`Network error: ${error instanceof Error ? error.message : "Unknown error"}`);
+        process.exit(EXIT_CODES.NETWORK_ERROR);
+    }
+}
+export async function getAuthHeaders(config) {
+    const token = await requestServiceToken(config);
+    if (!token) {
+        process.exit(EXIT_CODES.AUTH_ERROR);
+    }
+    const headers = {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json",
+    };
+    if (config.tenantId) {
+        headers["x-qnsp-tenant"] = config.tenantId;
+        headers["x-tenant-id"] = config.tenantId;
+    }
+    return headers;
+}
+//# sourceMappingURL=auth.js.map

package/dist/cli/utils/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/cli/utils/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElE,MAAM,eAAe,GAAG,IAAI,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;AAMnD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAiB;IAC1D,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACvB,UAAU,CAAC,6BAA6B,CAAC,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,MAAM,EAAE,CAAC;QACZ,YAAY,CAAC,4BAA4B,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3D,OAAO,MAAM,CAAC;IACf,CAAC;IAED,IAAI,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;IACzC,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACzB,YAAY,CAAC,+CAA+C,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9E,aAAa,GAAG,MAAM,eAAe,CAAC,wBAAwB,CAAC,CAAC;QACjE,CAAC;aAAM,CAAC;YACP,UAAU,CAAC,wDAAwD,CAAC,CAAC;YACrE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC;IACF,CAAC;IAED,gBAAgB,CAAC,MAAM,CAAC,cAAc,EAAE,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAErF,IAAI,CAAC;QACJ,MAAM,eAAe,CAAC,UAAU,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;YACrC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IAED,YAAY,CAAC,iCAAiC,MAAM,CAAC,cAAc,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAEvF,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,cAAc,qBAAqB,EAAE;YAC3E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,aAAa,EAAE;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAE,kBAAkB;aAC5B,CAAC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,SAAkB,CAAC;YACvB,IAAI,CAAC;gBACJ,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACR,SAAS,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YACtD,CAAC;YAED,IACC,QAAQ,CAAC,MAAM,KAAK,GAAG;gBACvB,QAAQ,CAAC,MAAM,KAAK,GAAG;gBACvB,QAAQ,CAAC,MAAM,KAAK,GAAG;gBACvB,QAAQ,CAAC,MAAM,KAAK,GAAG,EACtB,CAAC;gBACF,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;gBACtE,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACzC,CAAC;YAED,UAAU,CAAC,gCAAgC,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;YAC3E,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyB,CAAC;QAC7D,YAAY,CAAC,qCAAqC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAEpE,MAAM,EAAE,qBAAqB,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACzF,MAAM,UAAU,GAAG,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3D,cAAc,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;QAEvD,cAAc,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAEnD,OAAO,IAAI,CAAC,WAAW,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,UAAU,CAAC,kBAAkB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;QACzF,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IACxC,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAiB;IACrD,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,OAAO,GAA2B;QACvC,aAAa,EAAE,UAAU,KAAK,EAAE;QAChC,cAAc,EAAE,kBAAkB;KAClC,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,CAAC,eAAe,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC3C,OAAO,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC1C,CAAC;IAED,OAAO,OAAO,CAAC;AAChB,CAAC"}

package/dist/cli/utils/backend-validator.d.ts

@@ -0,0 +1,19 @@
+export interface BackendErrorResponse {
+    readonly error: string;
+    readonly message: string;
+    readonly statusCode: number;
+    readonly tier?: string;
+    readonly requiredTier?: string;
+    readonly requiredAddOn?: string;
+    readonly limit?: number;
+    readonly remaining?: number;
+    readonly retryAfter?: number;
+}
+export declare function handleBackendError(response: Response, body: unknown): void;
+export declare function parseRateLimitHeaders(headers: Headers): {
+    limit: number | null;
+    remaining: number | null;
+    reset: number | null;
+};
+export declare function warnIfLowQuota(remaining: number | null, limit: number | null): void;
+//# sourceMappingURL=backend-validator.d.ts.map

package/dist/cli/utils/backend-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend-validator.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/backend-validator.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAiE1E;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG;IACxD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB,CAUA;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAOnF"}