@inferdat/crm-auth 0.0.0-stage → 1.0.0

package/README.md

@@ -1,3 +1,283 @@
-# Temporary Holding Version
+# crm-auth CLI
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Command-line tool for assuming cross-account AWS roles through the CRM. Get temporary AWS credentials or open the AWS Console for any customer account directly from your terminal.
+
+## Prerequisites
+
+- **Node.js 18+** (check with `node -v`)
+- A CRM account with `aws-access:assume` permission (Admin, Manager, or Sales Rep)
+- The customer's AWS account must have ACTIVE access status in the CRM (verified via "Verify Access")
+
+## Installation
+
+```bash
+npm install -g @inferdat/crm-auth
+```
+
+Requires Node.js 18 or later. To check: `node -v`.
+
+To update to the latest version:
+
+```bash
+npm update -g @inferdat/crm-auth
+```
+
+### Building from source (contributors only)
+
+If you're working on the CLI itself:
+
+```bash
+cd cli
+npm install
+npm run build
+npm link        # makes `crm-auth` available globally
+```
+
+## Quick Start
+
+```bash
+# 1. Authenticate (opens browser)
+crm-auth login --url https://portal.inferdat.ai
+
+# 2. See what accounts are available
+crm-auth list
+
+# 3. Get credentials for a customer account
+crm-auth assume acme-corp-production
+
+# 4. Use them
+aws s3 ls --profile acme-corp-production
+```
+
+## Commands
+
+### `crm-auth login --url <CRM_URL>`
+
+Authenticates you with the CRM. Opens your browser to the login page, you sign in, click "Authorize CLI", and the token is saved locally.
+
+```bash
+crm-auth login --url https://portal.inferdat.ai
+```
+
+The `--url` flag is required on first login. After that, the URL is saved in your config.
+
+**Multi-workspace support:** If your account has access to multiple workspaces, the CLI prompts you to choose one. All workspaces are saved and you can switch between them without re-authenticating.
+
+**What happens:**
+1. CLI starts a temporary HTTP server on localhost
+2. Opens your browser to `{CRM_URL}/auth/cli`
+3. You log in and click "Authorize CLI"
+4. Token is saved to `~/.crm-auth/config.json` (file permissions: 600)
+
+Token is valid for 90 days.
+
+### `crm-auth list`
+
+Shows all ACTIVE customer AWS accounts you can access.
+
+```
+  Available AWS Accounts (3)
+
+  Acme Corp
+    761018891308 (Production)  [ReadOnly, Administrator]  verified 7/11/2026
+    slug: acme-corp-production
+    crm-auth assume acme-corp-production
+
+  Globex Inc
+    112233445566  [ReadOnly]  verified 7/10/2026
+    slug: globex-inc-112233445566
+    crm-auth assume globex-inc-112233445566
+```
+
+The **slug** is the stable identifier you pass to `assume` and `console` commands. You can also use the 12-digit AWS account ID directly.
+
+### `crm-auth assume <slug>`
+
+Assumes a cross-account role and writes temporary credentials to `~/.aws/credentials` as a named profile.
+
+```bash
+# If only one role available — assumes it automatically
+crm-auth assume acme-corp-production
+
+# If multiple roles — prompts you to choose:
+#   Multiple roles available:
+#     1. ReadOnly
+#     2. Administrator
+#   Select role [1-2]:
+
+# Specify role explicitly (by short name)
+crm-auth assume acme-corp-production --role ReadOnly
+
+# Custom session duration (in seconds, max 12 hours = 43200)
+crm-auth assume acme-corp-production --role Administrator --duration 3600
+
+# Output as env vars instead (for eval or piping)
+crm-auth assume acme-corp-production --env
+
+# Just print credentials, don't write to file
+crm-auth assume acme-corp-production --no-profile
+```
+
+After running, use the profile:
+
+```bash
+aws s3 ls --profile acme-corp-production
+aws ec2 describe-instances --profile acme-corp-production --region us-east-1
+```
+
+Or with `--env`:
+
+```bash
+eval $(crm-auth assume acme-corp-production --env)
+aws s3 ls   # uses env vars directly
+```
+
+**Options:**
+
+| Flag | Description | Default |
+|------|-------------|---------|
+| `-r, --role <name>` | Role short name (e.g. `ReadOnly`, `Administrator`) | Prompts if multiple |
+| `-d, --duration <seconds>` | Session duration (900–43200) | Role's configured max |
+| `--env` | Output `export` statements instead of writing profile | off |
+| `--json` | Output credentials in AWS `credential_process` JSON format | off |
+| `--no-profile` | Print raw credentials without writing to file | off |
+
+**Using with `~/.aws/config` (`credential_process`)**
+
+The `--json` flag outputs credentials in the exact format AWS expects for [`credential_process`](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sourcing-external.html), so AWS tools automatically refresh credentials without any wrapper script:
+
+```ini
+# ~/.aws/config
+[profile acme-corp-production]
+credential_process = crm-auth assume acme-corp-production --role ReadOnly --json
+region = us-east-1
+```
+
+Then use any AWS tool normally:
+
+```bash
+aws s3 ls --profile acme-corp-production
+terraform plan   # if AWS_PROFILE=acme-corp-production is set
+```
+
+Credentials are fetched on demand and refreshed automatically when they expire.
+
+### `crm-auth console <slug>`
+
+Opens the AWS Console in your browser for a customer account. No password needed — uses federation URL.
+
+```bash
+crm-auth console acme-corp-production
+crm-auth console acme-corp-production --role Administrator
+```
+
+Same role selection behavior as `assume`: prompts if multiple roles are available and no `--role` flag is given.
+
+**Note:** This opens a new AWS Console session. If you already have a different AWS session in the same browser, it will be replaced. Use a different browser profile or incognito window if you need both.
+
+### `crm-auth status`
+
+Shows your current auth status.
+
+```
+  CRM CLI Status
+
+  CRM URL:  https://portal.inferdat.ai
+  User:     sujaiy@inferdat.ai
+  Role:     Admin
+  Token:    valid (expires 10/9/2026)
+  Workspace: inferdat (active)
+```
+
+### `crm-auth workspace list`
+
+Shows all stored workspaces.
+
+```
+  Workspaces:
+
+  * inferdat (Inferdat)
+    acme-partner (Acme Partner Portal)
+```
+
+### `crm-auth workspace switch <slug>`
+
+Switches the active workspace. All subsequent commands operate against the selected workspace.
+
+```bash
+crm-auth workspace switch acme-partner
+```
+
+### `crm-auth logout`
+
+Clears the locally stored token.
+
+## Where Credentials Are Stored
+
+| File | Purpose |
+|------|---------|
+| `~/.crm-auth/config.json` | CRM URL, API token, workspace info. Permissions: `0600` |
+| `~/.aws/credentials` | AWS profiles written by `assume`. Permissions: `0600` |
+
+## Roles and Permissions
+
+You need these CRM permissions to use the CLI:
+
+| CRM Role | Can list accounts | Can assume roles | Can open console |
+|----------|-------------------|------------------|------------------|
+| Admin | ✓ | ✓ | ✓ |
+| Manager | ✓ | ✓ | ✓ |
+| Sales Rep | ✓ | ✓ | ✓ |
+| Read-Only | ✓ | ✗ | ✗ |
+
+The AWS role you assume (e.g. `ReadOnly` vs `Administrator`) determines what you can do inside the customer's account. These roles are configured by your admin in Access Settings.
+
+## Role Selection
+
+When you have access to multiple roles on an account:
+
+- **With `--role` flag**: The CLI resolves the role by short name (case-insensitive). `--role readonly` matches `inferdat-ReadOnly`.
+- **Without `--role` flag**: If only one role is available, it's used automatically. If multiple roles are available, the CLI prompts you to choose.
+
+This prevents accidentally assuming a higher-privilege role when you meant to use read-only access.
+
+## Account Slugs
+
+Each customer account has a stable slug generated by the server:
+- Format: `{company-name}-{account-name}` (e.g., `acme-corp-production`)
+- If no account name: `{company-name}-{aws-account-id}` (e.g., `globex-inc-112233445566`)
+- Run `crm-auth list` to see all slugs
+- You can also use the raw 12-digit AWS account ID instead of the slug
+
+## Multi-Workspace (Multi-Tenant)
+
+If you're on a multi-tenant platform:
+1. `crm-auth login` shows all workspaces you belong to and prompts you to pick one
+2. All commands operate against the active workspace
+3. `crm-auth workspace switch <slug>` changes context without re-authenticating
+4. Each workspace has its own set of customer accounts
+
+## Troubleshooting
+
+**"Not logged in" / "Token expired"**
+```bash
+crm-auth login --url https://portal.inferdat.ai
+```
+
+**"Permission denied"**
+Your CRM role doesn't have `aws-access:assume`. Contact your admin.
+
+**"No active account found"**
+The slug doesn't match any ACTIVE account. Run `crm-auth list` to see available slugs. The account might still be in PENDING status (needs verification in the CRM UI first).
+
+**"You don't have access to any roles"**
+Your admin has restricted access to this account. Contact them to be added to the authorization list.
+
+**"Account is frozen"**
+An admin froze access to this account. It won't appear in `assume`/`console` commands until unfrozen.
+
+**Login callback not working**
+The CLI starts a localhost server for the OAuth callback. If it times out after 5 minutes, check that nothing is blocking localhost connections. The CLI prints the auth URL so you can copy it manually.
+
+**Multiple workspaces**
+If you work across multiple workspaces, use `crm-auth workspace switch <slug>` to change context. Run `crm-auth workspace list` to see all options.

package/dist/api.d.ts

@@ -0,0 +1,6 @@
+import type { Config } from "./config.js";
+export declare class ApiError extends Error {
+    status: number;
+    constructor(message: string, status: number);
+}
+export declare function api<T = unknown>(config: Config, path: string, options?: RequestInit): Promise<T>;

package/dist/api.js

@@ -0,0 +1,31 @@
+export class ApiError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+        this.name = "ApiError";
+    }
+}
+export async function api(config, path, options = {}) {
+    const url = `${config.url}${path}`;
+    const headers = {
+        Authorization: `Bearer ${config.token}`,
+        "Content-Type": "application/json",
+        ...options.headers,
+    };
+    // In multi-tenant mode, include the active workspace slug
+    if (config.activeWorkspace) {
+        headers["X-Tenant-Slug"] = config.activeWorkspace;
+    }
+    const res = await fetch(url, {
+        ...options,
+        headers,
+    });
+    if (!res.ok) {
+        const body = await res.json().catch(() => ({}));
+        const msg = body.error || `HTTP ${res.status}`;
+        throw new ApiError(msg, res.status);
+    }
+    const json = (await res.json());
+    return json.data;
+}

package/dist/commands/assume.d.ts

@@ -0,0 +1,7 @@
+export declare function assume(target: string, options: {
+    role?: string;
+    duration?: string;
+    profile?: boolean;
+    env?: boolean;
+    json?: boolean;
+}): Promise<void>;

package/dist/commands/assume.js

@@ -0,0 +1,206 @@
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import readline from "node:readline";
+import { requireConfig } from "../config.js";
+import { api } from "../api.js";
+/**
+ * Find a matching account by server-generated slug or AWS account ID.
+ */
+function findAccount(accounts, target) {
+    // Direct AWS account ID match (12 digits)
+    const byId = accounts.find((a) => a.awsAccountId === target);
+    if (byId)
+        return byId;
+    // Exact slug match (authoritative, from server)
+    const bySlug = accounts.find((a) => a.slug === target);
+    if (bySlug)
+        return bySlug;
+    // Prefix match on slug (for convenience — "acme" matches "acme-production")
+    const prefixMatches = accounts.filter((a) => a.slug.startsWith(target + "-") || a.slug === target);
+    if (prefixMatches.length === 1)
+        return prefixMatches[0];
+    if (prefixMatches.length > 1) {
+        console.error(`Multiple accounts match "${target}". Be more specific:\n`);
+        for (const a of prefixMatches) {
+            const name = a.accountName ? ` (${a.accountName})` : "";
+            console.error(`  ${a.slug}  →  ${a.awsAccountId}${name}`);
+        }
+        console.error(`\nUsage: crm-auth assume ${prefixMatches[0].slug}`);
+        process.exit(1);
+    }
+    return null;
+}
+/**
+ * Resolve a role name from the --role flag.
+ * Accepts: short name (ReadOnly), full name (inferdat-ReadOnly), or partial match.
+ * If no flag provided and multiple roles available, prompts the user to choose
+ * (only when interactive is true). When interactive is false, uses first role silently.
+ */
+async function resolveRoleName(account, roleFlag, interactive) {
+    const allowedRoles = account.userAllowedRoles;
+    if (allowedRoles.length === 0) {
+        console.error("You don't have access to any roles in this account.");
+        console.error("Contact your admin to request access.");
+        process.exit(1);
+    }
+    // If --role flag provided, resolve it
+    if (roleFlag) {
+        // Exact full name match
+        const exactMatch = allowedRoles.find((r) => r === roleFlag);
+        if (exactMatch)
+            return exactMatch;
+        // Case-insensitive short name match (strip prefix)
+        const shortMatch = allowedRoles.find((r) => {
+            const shortName = r.split("-").slice(1).join("-");
+            return shortName.toLowerCase() === roleFlag.toLowerCase();
+        });
+        if (shortMatch)
+            return shortMatch;
+        // Partial match
+        const partialMatch = allowedRoles.find((r) => r.toLowerCase().includes(roleFlag.toLowerCase()));
+        if (partialMatch)
+            return partialMatch;
+        console.error(`Role "${roleFlag}" not found. Available roles:`);
+        for (const r of allowedRoles) {
+            const shortName = r.split("-").slice(1).join("-");
+            console.error(`  --role ${shortName}`);
+        }
+        process.exit(1);
+    }
+    // No --role flag: if only one role, use it silently
+    if (allowedRoles.length === 1) {
+        return allowedRoles[0];
+    }
+    // Multiple roles available but non-interactive — use first role silently
+    if (!interactive) {
+        const shortName = allowedRoles[0].split("-").slice(1).join("-") || allowedRoles[0];
+        process.stderr.write(`(Using first available role: ${shortName}. Specify --role to choose.)\n`);
+        return allowedRoles[0];
+    }
+    // Multiple roles available — prompt user to choose
+    console.log("\nMultiple roles available:\n");
+    for (let i = 0; i < allowedRoles.length; i++) {
+        const shortName = allowedRoles[i].split("-").slice(1).join("-") || allowedRoles[i];
+        const desc = account.userAllowedRoleDescriptions?.find((d) => d.roleName === allowedRoles[i])?.description;
+        if (desc) {
+            console.log(`  ${i + 1}. ${shortName} — ${desc}`);
+        }
+        else {
+            console.log(`  ${i + 1}. ${shortName}`);
+        }
+    }
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const answer = await new Promise((resolve) => {
+        rl.question(`\nSelect role [1-${allowedRoles.length}]: `, resolve);
+    });
+    rl.close();
+    const idx = parseInt(answer, 10) - 1;
+    if (isNaN(idx) || idx < 0 || idx >= allowedRoles.length) {
+        console.log("Invalid selection, using first role.");
+        return allowedRoles[0];
+    }
+    return allowedRoles[idx];
+}
+export async function assume(target, options) {
+    // Mutual exclusion: --json and --env can't both be used
+    if (options.json && options.env) {
+        console.error("Cannot use --json and --env together. Choose one output format.");
+        process.exit(1);
+    }
+    const config = requireConfig();
+    // Fetch accounts the user can access
+    const result = await api(config, "/api/aws/access-accounts?status=ACTIVE&limit=100");
+    const accounts = result.accounts.filter((a) => a.userCanAssume && !a.isFrozen);
+    if (accounts.length === 0) {
+        console.error("No accessible AWS accounts found.");
+        console.error("Run: crm-auth list");
+        process.exit(1);
+    }
+    const account = findAccount(accounts, target);
+    if (!account) {
+        console.error(`No active account found for "${target}".`);
+        console.error("Run: crm-auth list");
+        process.exit(1);
+    }
+    // Non-interactive when --env or --json is used (output is likely piped/eval'd)
+    const interactive = !options.env && !options.json;
+    const roleName = await resolveRoleName(account, options.role, interactive);
+    const durationSeconds = options.duration ? parseInt(options.duration, 10) : undefined;
+    const creds = await api(config, "/api/aws/assume-role", {
+        method: "POST",
+        body: JSON.stringify({
+            companyAwsAccountId: account.id,
+            accessType: "cli",
+            roleName,
+            ...(durationSeconds && { sessionDurationSeconds: durationSeconds }),
+        }),
+    });
+    // --json: output credentials in AWS credential_process format (RFC spec)
+    // https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sourcing-external.html
+    // AWS requires: Version (int), AccessKeyId, SecretAccessKey, SessionToken, Expiration — all PascalCase.
+    // Errors must go to stderr; exit 1 on failure (handled by caller).
+    if (options.json) {
+        const output = JSON.stringify({
+            Version: 1,
+            AccessKeyId: creds.accessKeyId,
+            SecretAccessKey: creds.secretAccessKey,
+            SessionToken: creds.sessionToken,
+            Expiration: creds.expiration,
+        });
+        process.stdout.write(output + "\n");
+        return;
+    }
+    // --env: output export statements for eval
+    if (options.env) {
+        console.log(creds.envSnippet);
+        return;
+    }
+    // --no-profile: just print raw credentials
+    if (options.profile === false) {
+        console.log(`AWS_ACCESS_KEY_ID=${creds.accessKeyId}`);
+        console.log(`AWS_SECRET_ACCESS_KEY=${creds.secretAccessKey}`);
+        console.log(`AWS_SESSION_TOKEN=${creds.sessionToken}`);
+        console.log(`# Expires: ${creds.expiration}`);
+        return;
+    }
+    // Default: write to ~/.aws/credentials as a named profile
+    const awsDir = path.join(os.homedir(), ".aws");
+    const credFile = path.join(awsDir, "credentials");
+    const profileName = creds.profileName;
+    if (!fs.existsSync(awsDir)) {
+        fs.mkdirSync(awsDir, { recursive: true, mode: 0o700 });
+    }
+    let content = "";
+    if (fs.existsSync(credFile)) {
+        content = fs.readFileSync(credFile, "utf-8");
+    }
+    // Remove existing profile section if present
+    const profileRegex = new RegExp(`\\[${escapeRegex(profileName)}\\][^\\[]*`, "g");
+    content = content.replace(profileRegex, "").trim();
+    // Append new profile
+    const accountLabel = account.accountName
+        ? `${account.accountName} (${account.awsAccountId})`
+        : account.awsAccountId;
+    const shortRole = roleName.split("-").slice(1).join("-") || roleName;
+    const profileBlock = [
+        "",
+        `[${profileName}]`,
+        `aws_access_key_id = ${creds.accessKeyId}`,
+        `aws_secret_access_key = ${creds.secretAccessKey}`,
+        `aws_session_token = ${creds.sessionToken}`,
+        `# crm-auth: ${shortRole} for ${account.company.name} / ${accountLabel}`,
+        `# expires ${creds.expiration}`,
+        "",
+    ].join("\n");
+    content = content + "\n" + profileBlock;
+    fs.writeFileSync(credFile, content.trim() + "\n", { mode: 0o600 });
+    console.log(`\n  Credentials written to ~/.aws/credentials [${profileName}]`);
+    console.log(`  Account:  ${account.company.name} / ${accountLabel}`);
+    console.log(`  Role:     ${shortRole}`);
+    console.log(`  Expires:  ${new Date(creds.expiration).toLocaleString()}`);
+    console.log(`\n  Usage:    aws s3 ls --profile ${profileName}`);
+}
+function escapeRegex(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}

package/dist/commands/console.d.ts

@@ -0,0 +1,4 @@
+export declare function openConsole(target: string, options: {
+    role?: string;
+    duration?: string;
+}): Promise<void>;

package/dist/commands/console.js

@@ -0,0 +1,120 @@
+import readline from "node:readline";
+import open from "open";
+import { requireConfig } from "../config.js";
+import { api } from "../api.js";
+/**
+ * Find a matching account by server-generated slug or AWS account ID.
+ */
+function findAccount(accounts, target) {
+    const byId = accounts.find((a) => a.awsAccountId === target);
+    if (byId)
+        return byId;
+    const bySlug = accounts.find((a) => a.slug === target);
+    if (bySlug)
+        return bySlug;
+    const prefixMatches = accounts.filter((a) => a.slug.startsWith(target + "-") || a.slug === target);
+    if (prefixMatches.length === 1)
+        return prefixMatches[0];
+    if (prefixMatches.length > 1) {
+        console.error(`Multiple accounts match "${target}". Be more specific:\n`);
+        for (const a of prefixMatches) {
+            const name = a.accountName ? ` (${a.accountName})` : "";
+            console.error(`  ${a.slug}  →  ${a.awsAccountId}${name}`);
+        }
+        console.error(`\nUsage: crm-auth console ${prefixMatches[0].slug}`);
+        process.exit(1);
+    }
+    return null;
+}
+/**
+ * Resolve a role name from the --role flag or prompt user.
+ * When stdout is not a TTY (piped/scripted), skips prompting and uses first role.
+ */
+async function resolveRoleName(account, roleFlag) {
+    const allowedRoles = account.userAllowedRoles;
+    if (allowedRoles.length === 0) {
+        console.error("You don't have access to any roles in this account.");
+        console.error("Contact your admin to request access.");
+        process.exit(1);
+    }
+    if (roleFlag) {
+        const exactMatch = allowedRoles.find((r) => r === roleFlag);
+        if (exactMatch)
+            return exactMatch;
+        const shortMatch = allowedRoles.find((r) => {
+            const shortName = r.split("-").slice(1).join("-");
+            return shortName.toLowerCase() === roleFlag.toLowerCase();
+        });
+        if (shortMatch)
+            return shortMatch;
+        const partialMatch = allowedRoles.find((r) => r.toLowerCase().includes(roleFlag.toLowerCase()));
+        if (partialMatch)
+            return partialMatch;
+        console.error(`Role "${roleFlag}" not found. Available roles:`);
+        for (const r of allowedRoles) {
+            const shortName = r.split("-").slice(1).join("-");
+            console.error(`  --role ${shortName}`);
+        }
+        process.exit(1);
+    }
+    if (allowedRoles.length === 1) {
+        return allowedRoles[0];
+    }
+    // Multiple roles available but non-interactive (not a TTY) — use first role silently
+    if (!process.stdout.isTTY) {
+        const shortName = allowedRoles[0].split("-").slice(1).join("-") || allowedRoles[0];
+        process.stderr.write(`(Using first available role: ${shortName}. Specify --role to choose.)\n`);
+        return allowedRoles[0];
+    }
+    // Multiple roles — prompt
+    console.log("\nMultiple roles available:\n");
+    for (let i = 0; i < allowedRoles.length; i++) {
+        const shortName = allowedRoles[i].split("-").slice(1).join("-") || allowedRoles[i];
+        console.log(`  ${i + 1}. ${shortName}`);
+    }
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const answer = await new Promise((resolve) => {
+        rl.question(`\nSelect role [1-${allowedRoles.length}]: `, resolve);
+    });
+    rl.close();
+    const idx = parseInt(answer, 10) - 1;
+    if (isNaN(idx) || idx < 0 || idx >= allowedRoles.length) {
+        console.log("Invalid selection, using first role.");
+        return allowedRoles[0];
+    }
+    return allowedRoles[idx];
+}
+export async function openConsole(target, options) {
+    const config = requireConfig();
+    const result = await api(config, "/api/aws/access-accounts?status=ACTIVE&limit=100");
+    const accounts = result.accounts.filter((a) => a.userCanAssume && !a.isFrozen);
+    if (accounts.length === 0) {
+        console.error("No accessible AWS accounts found.");
+        console.error("Run: crm-auth list");
+        process.exit(1);
+    }
+    const account = findAccount(accounts, target);
+    if (!account) {
+        console.error(`No active account found for "${target}".`);
+        console.error("Run: crm-auth list");
+        process.exit(1);
+    }
+    const roleName = await resolveRoleName(account, options.role);
+    const durationSeconds = options.duration ? parseInt(options.duration, 10) : undefined;
+    const consoleResult = await api(config, "/api/aws/assume-role", {
+        method: "POST",
+        body: JSON.stringify({
+            companyAwsAccountId: account.id,
+            accessType: "console",
+            roleName,
+            ...(durationSeconds && { sessionDurationSeconds: durationSeconds }),
+        }),
+    });
+    const accountLabel = account.accountName
+        ? `${account.accountName} (${account.awsAccountId})`
+        : account.awsAccountId;
+    const shortRole = roleName.split("-").slice(1).join("-") || roleName;
+    console.log(`\nOpening AWS Console for ${account.company.name} / ${accountLabel} (${shortRole})...`);
+    console.log(`Session expires: ${new Date(consoleResult.expiration).toLocaleString()}`);
+    await open(consoleResult.consoleUrl);
+}

package/dist/commands/list.d.ts

@@ -0,0 +1,3 @@
+export declare function list(options?: {
+    company?: string;
+}): Promise<void>;

package/dist/commands/list.js

@@ -0,0 +1,43 @@
+import { requireConfig } from "../config.js";
+import { api } from "../api.js";
+export async function list(options) {
+    const config = requireConfig();
+    let url = "/api/aws/access-accounts?status=ACTIVE&limit=100";
+    if (options?.company) {
+        url += `&companyName=${encodeURIComponent(options.company)}`;
+    }
+    const result = await api(config, url);
+    const accounts = result.accounts;
+    if (accounts.length === 0) {
+        console.log("\n  No active AWS accounts available.");
+        console.log("  Accounts must be set up and verified in the CRM before they appear here.\n");
+        return;
+    }
+    console.log(`\n  Available AWS Accounts (${accounts.length})\n`);
+    // Group by company
+    const grouped = new Map();
+    for (const a of accounts) {
+        const list = grouped.get(a.company.name) || [];
+        list.push(a);
+        grouped.set(a.company.name, list);
+    }
+    for (const [company, accts] of grouped) {
+        console.log(`  ${company}`);
+        for (const a of accts) {
+            // Show roles as short names (strip partner slug prefix)
+            const roles = a.userAllowedRoles
+                .map((r) => r.split("-").slice(1).join("-") || r)
+                .join(", ");
+            const name = a.accountName ? ` (${a.accountName})` : "";
+            const frozen = a.isFrozen ? " [FROZEN]" : "";
+            const verified = a.accessVerifiedAt
+                ? `verified ${new Date(a.accessVerifiedAt).toLocaleDateString()}`
+                : "not verified";
+            const access = a.userCanAssume ? "" : " (no access)";
+            console.log(`    ${a.awsAccountId}${name}${frozen}  [${roles || "no roles"}]  ${verified}${access}`);
+            console.log(`    slug: ${a.slug}`);
+            console.log(`    crm-auth assume ${a.slug}`);
+        }
+        console.log();
+    }
+}

package/dist/commands/login.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Start a temporary localhost HTTP server, open the CRM auth page in the
+ * browser, and wait for the redirect callback with the token.
+ */
+export declare function login(crmUrl: string): Promise<void>;

package/dist/commands/login.js

@@ -0,0 +1,154 @@
+import http from "node:http";
+import crypto from "node:crypto";
+import readline from "node:readline";
+import open from "open";
+import { saveWorkspace } from "../config.js";
+/**
+ * Prompt the user to pick a workspace from a numbered list.
+ * Returns the selected workspace object.
+ */
+async function pickWorkspace(workspaces) {
+    if (workspaces.length === 1) {
+        return workspaces[0];
+    }
+    console.log("\nAvailable workspaces:\n");
+    for (let i = 0; i < workspaces.length; i++) {
+        console.log(`  ${i + 1}. ${workspaces[i].name} (${workspaces[i].slug})`);
+    }
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const answer = await new Promise((resolve) => {
+        rl.question(`\nSelect workspace [1-${workspaces.length}]: `, resolve);
+    });
+    rl.close();
+    const idx = parseInt(answer, 10) - 1;
+    if (isNaN(idx) || idx < 0 || idx >= workspaces.length) {
+        console.log("Invalid selection, using first workspace.");
+        return workspaces[0];
+    }
+    return workspaces[idx];
+}
+/**
+ * Start a temporary localhost HTTP server, open the CRM auth page in the
+ * browser, and wait for the redirect callback with the token.
+ */
+export async function login(crmUrl) {
+    // Normalise URL — strip trailing slash
+    const baseUrl = crmUrl.replace(/\/+$/, "");
+    const state = crypto.randomBytes(16).toString("hex");
+    let timeoutHandle;
+    // Find a free port by binding to 0
+    const { token, user, expiresAt, workspaces } = await new Promise((resolve, reject) => {
+        const connections = new Set();
+        const server = http.createServer((req, res) => {
+            const url = new URL(req.url || "/", `http://localhost`);
+            if (url.pathname !== "/callback") {
+                res.writeHead(404);
+                res.end("Not found");
+                return;
+            }
+            const receivedToken = url.searchParams.get("token");
+            const receivedState = url.searchParams.get("state");
+            if (receivedState !== state) {
+                res.writeHead(400);
+                res.end("State mismatch — possible CSRF. Please try again.");
+                destroyServer();
+                reject(new Error("State mismatch"));
+                return;
+            }
+            if (!receivedToken) {
+                res.writeHead(400);
+                res.end("No token received. Authorization may have been denied.");
+                destroyServer();
+                reject(new Error("No token received"));
+                return;
+            }
+            // Send a nice HTML response before closing
+            res.writeHead(200, { "Content-Type": "text/html" });
+            res.end(`
+        <html>
+          <body style="font-family: system-ui, sans-serif; display: flex; align-items: center; justify-content: center; height: 100vh; margin: 0;">
+            <div style="text-align: center;">
+              <h2 style="color: #16a34a;">&#10003; Authenticated</h2>
+              <p>You can close this tab and return to your terminal.</p>
+            </div>
+          </body>
+        </html>
+      `);
+            // Now validate the token by calling /api/auth/cli/me
+            fetch(`${baseUrl}/api/auth/cli/me`, {
+                headers: { Authorization: `Bearer ${receivedToken}` },
+            })
+                .then(async (meRes) => {
+                if (!meRes.ok) {
+                    throw new Error("Token validation failed");
+                }
+                const json = (await meRes.json());
+                destroyServer();
+                resolve({
+                    token: receivedToken,
+                    user: { email: json.data.email, name: json.data.name, role: json.data.role },
+                    expiresAt: new Date(Date.now() + 90 * 24 * 60 * 60 * 1000).toISOString(),
+                    workspaces: json.data.workspaces || [{ slug: "default", name: "Default Workspace" }],
+                });
+            })
+                .catch((err) => {
+                destroyServer();
+                reject(err);
+            });
+        });
+        // Track connections so we can force-destroy them on close
+        server.on("connection", (socket) => {
+            connections.add(socket);
+            socket.on("close", () => connections.delete(socket));
+        });
+        function destroyServer() {
+            if (timeoutHandle)
+                clearTimeout(timeoutHandle);
+            for (const socket of connections) {
+                socket.destroy();
+            }
+            server.close();
+        }
+        // Listen on a random available port
+        server.listen(0, "127.0.0.1", () => {
+            const addr = server.address();
+            const p = typeof addr === "object" && addr ? addr.port : 0;
+            const authUrl = `${baseUrl}/auth/cli?redirect_uri=${encodeURIComponent(`http://localhost:${p}/callback`)}&state=${state}`;
+            console.log(`Opening browser to authenticate...`);
+            console.log(`If the browser doesn't open, visit:\n  ${authUrl}\n`);
+            open(authUrl).catch(() => {
+                // If open fails (e.g. headless server), user can copy the URL
+            });
+            // Timeout after 5 minutes
+            timeoutHandle = setTimeout(() => {
+                destroyServer();
+                reject(new Error("Login timed out after 5 minutes"));
+            }, 5 * 60 * 1000);
+            timeoutHandle.unref();
+        });
+        server.on("error", reject);
+    });
+    // If multiple workspaces, let the user pick one
+    const selected = await pickWorkspace(workspaces);
+    // Save workspace to config
+    const wsConfig = {
+        token,
+        name: selected.name,
+        expiresAt,
+        user,
+    };
+    saveWorkspace(baseUrl, selected.slug, wsConfig, true);
+    // Also save other workspaces (with the same token — server determines access)
+    for (const ws of workspaces) {
+        if (ws.slug !== selected.slug) {
+            saveWorkspace(baseUrl, ws.slug, { token, name: ws.name, expiresAt, user }, false);
+        }
+    }
+    console.log(`\nLogged in as ${user.email} (${user.role})`);
+    console.log(`Active workspace: ${selected.name} (${selected.slug})`);
+    console.log(`Token expires: ${new Date(expiresAt).toLocaleDateString()}`);
+    console.log(`CRM: ${baseUrl}`);
+    if (workspaces.length > 1) {
+        console.log(`\n${workspaces.length} workspaces available. Switch with: crm-auth workspace switch <slug>`);
+    }
+}

package/dist/commands/logout.d.ts

@@ -0,0 +1 @@
+export declare function logout(): void;

package/dist/commands/logout.js

@@ -0,0 +1,10 @@
+import { clearConfig, loadConfig } from "../config.js";
+export function logout() {
+    const config = loadConfig();
+    if (!config) {
+        console.log("Not logged in.");
+        return;
+    }
+    clearConfig();
+    console.log(`Logged out from ${config.url} (${config.user.email})`);
+}

package/dist/commands/status.d.ts

@@ -0,0 +1 @@
+export declare function status(): Promise<void>;

package/dist/commands/status.js

@@ -0,0 +1,33 @@
+import { loadConfig } from "../config.js";
+import { api, ApiError } from "../api.js";
+export async function status() {
+    const config = loadConfig();
+    if (!config) {
+        console.log("Not logged in. Run: crm-auth login --url <CRM_URL>");
+        return;
+    }
+    const expired = new Date(config.expiresAt) < new Date();
+    console.log(`\n  CRM CLI Status\n`);
+    console.log(`  CRM URL:  ${config.url}`);
+    console.log(`  User:     ${config.user.email}`);
+    console.log(`  Role:     ${config.user.role}`);
+    console.log(`  Token:    ${expired ? "EXPIRED" : "valid"} (expires ${new Date(config.expiresAt).toLocaleDateString()})`);
+    if (expired) {
+        console.log(`\n  Token expired. Run: crm-auth login --url ${config.url}`);
+        return;
+    }
+    // Verify token is still valid server-side
+    try {
+        const me = await api(config, "/api/auth/cli/me");
+        console.log(`  Server:   connected (${me.email})`);
+    }
+    catch (err) {
+        if (err instanceof ApiError && err.status === 401) {
+            console.log(`  Server:   token revoked or invalid`);
+        }
+        else {
+            console.log(`  Server:   unreachable`);
+        }
+    }
+    console.log();
+}

package/dist/commands/workspace.d.ts

@@ -0,0 +1,8 @@
+/**
+ * List all stored workspaces and indicate which is active.
+ */
+export declare function workspaceList(): void;
+/**
+ * Switch the active workspace to the given slug.
+ */
+export declare function workspaceSwitch(slug: string): void;

package/dist/commands/workspace.js

@@ -0,0 +1,30 @@
+import { listWorkspaces, switchWorkspace } from "../config.js";
+/**
+ * List all stored workspaces and indicate which is active.
+ */
+export function workspaceList() {
+    const workspaces = listWorkspaces();
+    if (workspaces.length === 0) {
+        console.log("No workspaces configured. Run: crm-auth login --url <CRM_URL>");
+        return;
+    }
+    console.log("\nWorkspaces:\n");
+    for (const ws of workspaces) {
+        const marker = ws.active ? " * " : "   ";
+        console.log(`${marker}${ws.slug} (${ws.name})${ws.active ? "  ← active" : ""}`);
+    }
+    console.log("");
+}
+/**
+ * Switch the active workspace to the given slug.
+ */
+export function workspaceSwitch(slug) {
+    const success = switchWorkspace(slug);
+    if (success) {
+        console.log(`Switched to workspace: ${slug}`);
+    }
+    else {
+        console.error(`Workspace "${slug}" not found. Run: crm-auth workspace list`);
+        process.exit(1);
+    }
+}

package/dist/config.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Per-workspace stored credentials.
+ */
+export interface WorkspaceConfig {
+    token: string;
+    name: string;
+    expiresAt: string;
+    user: {
+        email: string;
+        name: string | null;
+        role: string;
+    };
+}
+/**
+ * Multi-workspace config file format.
+ */
+export interface MultiWorkspaceFile {
+    url: string;
+    activeWorkspace: string;
+    workspaces: Record<string, WorkspaceConfig>;
+}
+/**
+ * The runtime config shape exposed to commands.
+ */
+export interface Config {
+    url: string;
+    token: string;
+    expiresAt: string;
+    activeWorkspace: string | null;
+    user: {
+        email: string;
+        name: string | null;
+        role: string;
+    };
+}
+export declare function loadConfig(): Config | null;
+export declare function loadMultiConfig(): MultiWorkspaceFile | null;
+export declare function saveWorkspace(url: string, slug: string, workspace: WorkspaceConfig, setActive?: boolean): void;
+export declare function switchWorkspace(slug: string): boolean;
+export declare function listWorkspaces(): {
+    slug: string;
+    name: string;
+    active: boolean;
+}[];
+export declare function clearConfig(): void;
+export declare function requireConfig(): Config;

package/dist/config.js

@@ -0,0 +1,129 @@
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+const CONFIG_DIR = path.join(os.homedir(), ".crm-auth");
+const CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
+function ensureDir() {
+    if (!fs.existsSync(CONFIG_DIR)) {
+        fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    }
+}
+function readRawConfig() {
+    try {
+        if (!fs.existsSync(CONFIG_FILE))
+            return null;
+        const raw = fs.readFileSync(CONFIG_FILE, "utf-8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+function isMultiWorkspace(raw) {
+    return "workspaces" in raw && "activeWorkspace" in raw;
+}
+/**
+ * Migrate legacy format to multi-workspace on read.
+ */
+function migrateLegacy(legacy) {
+    const defaultSlug = "default";
+    const multi = {
+        url: legacy.url,
+        activeWorkspace: defaultSlug,
+        workspaces: {
+            [defaultSlug]: {
+                token: legacy.token,
+                name: "Default Workspace",
+                expiresAt: legacy.expiresAt,
+                user: legacy.user,
+            },
+        },
+    };
+    // Persist the migration
+    writeRawConfig(multi);
+    return multi;
+}
+function writeRawConfig(config) {
+    ensureDir();
+    fs.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), {
+        mode: 0o600,
+    });
+}
+export function loadConfig() {
+    const raw = readRawConfig();
+    if (!raw)
+        return null;
+    const multi = isMultiWorkspace(raw) ? raw : migrateLegacy(raw);
+    const slug = multi.activeWorkspace;
+    const ws = multi.workspaces[slug];
+    if (!ws)
+        return null;
+    return {
+        url: multi.url,
+        token: ws.token,
+        expiresAt: ws.expiresAt,
+        activeWorkspace: slug,
+        user: ws.user,
+    };
+}
+export function loadMultiConfig() {
+    const raw = readRawConfig();
+    if (!raw)
+        return null;
+    return isMultiWorkspace(raw) ? raw : migrateLegacy(raw);
+}
+export function saveWorkspace(url, slug, workspace, setActive = true) {
+    let multi = loadMultiConfig();
+    if (!multi) {
+        multi = { url, activeWorkspace: slug, workspaces: {} };
+    }
+    multi.url = url;
+    multi.workspaces[slug] = workspace;
+    if (setActive) {
+        multi.activeWorkspace = slug;
+    }
+    writeRawConfig(multi);
+}
+export function switchWorkspace(slug) {
+    const multi = loadMultiConfig();
+    if (!multi)
+        return false;
+    if (!multi.workspaces[slug])
+        return false;
+    multi.activeWorkspace = slug;
+    writeRawConfig(multi);
+    return true;
+}
+export function listWorkspaces() {
+    const multi = loadMultiConfig();
+    if (!multi)
+        return [];
+    return Object.entries(multi.workspaces).map(([slug, ws]) => ({
+        slug,
+        name: ws.name,
+        active: slug === multi.activeWorkspace,
+    }));
+}
+export function clearConfig() {
+    try {
+        if (fs.existsSync(CONFIG_FILE)) {
+            fs.unlinkSync(CONFIG_FILE);
+        }
+    }
+    catch {
+        // ignore
+    }
+}
+export function requireConfig() {
+    const config = loadConfig();
+    if (!config) {
+        console.error("Not logged in. Run: crm-auth login --url <CRM_URL>");
+        process.exit(1);
+    }
+    if (new Date(config.expiresAt) < new Date()) {
+        console.error("Token expired. Run: crm-auth login --url " + config.url);
+        clearConfig();
+        process.exit(1);
+    }
+    return config;
+}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/index.js

@@ -0,0 +1,101 @@
+#!/usr/bin/env node
+import { Command } from "commander";
+import { login } from "./commands/login.js";
+import { list } from "./commands/list.js";
+import { assume } from "./commands/assume.js";
+import { openConsole } from "./commands/console.js";
+import { status } from "./commands/status.js";
+import { logout } from "./commands/logout.js";
+import { workspaceList, workspaceSwitch } from "./commands/workspace.js";
+import { ApiError } from "./api.js";
+const program = new Command();
+program
+    .name("crm-auth")
+    .description("CLI tool for CRM cross-account AWS access")
+    .version("1.0.0");
+program
+    .command("login")
+    .description("Authenticate with the CRM via browser")
+    .requiredOption("--url <url>", "CRM base URL (e.g. https://crm.example.com)")
+    .action(async (opts) => {
+    await login(opts.url);
+});
+program
+    .command("list")
+    .description("List available customer AWS accounts")
+    .option("-c, --company <name>", "Filter by company name")
+    .action(async (opts) => {
+    await list(opts);
+});
+program
+    .command("assume <company>")
+    .description("Assume role and write credentials to ~/.aws/credentials")
+    .option("-r, --role <name>", "Role short name (e.g. ReadOnly, Administrator)")
+    .option("-d, --duration <seconds>", "Session duration in seconds")
+    .option("--env", "Output as environment variable exports")
+    .option("--json", "Output credentials as JSON (for scripting)")
+    .option("--no-profile", "Print credentials without writing to file")
+    .action(async (company, opts) => {
+    await assume(company, opts);
+});
+program
+    .command("console <company>")
+    .description("Open AWS Console in browser for a customer account")
+    .option("-r, --role <name>", "Role short name (e.g. ReadOnly, Administrator)")
+    .option("-d, --duration <seconds>", "Session duration in seconds")
+    .action(async (company, opts) => {
+    await openConsole(company, opts);
+});
+program
+    .command("status")
+    .description("Show current authentication status")
+    .action(async () => {
+    await status();
+});
+program
+    .command("logout")
+    .description("Clear cached authentication token")
+    .action(() => {
+    logout();
+});
+// Workspace commands
+const workspace = program
+    .command("workspace")
+    .description("Manage workspaces");
+workspace
+    .command("list")
+    .description("List stored workspaces")
+    .action(() => {
+    workspaceList();
+});
+workspace
+    .command("switch <slug>")
+    .description("Switch the active workspace")
+    .action((slug) => {
+    workspaceSwitch(slug);
+});
+// Global error handler
+program.hook("postAction", () => { });
+async function main() {
+    try {
+        await program.parseAsync(process.argv);
+    }
+    catch (err) {
+        if (err instanceof ApiError) {
+            if (err.status === 401) {
+                console.error("Authentication failed. Run: crm-auth login --url <CRM_URL>");
+            }
+            else if (err.status === 403) {
+                console.error(`Permission denied: ${err.message}`);
+            }
+            else {
+                console.error(`API error (${err.status}): ${err.message}`);
+            }
+        }
+        else if (err instanceof Error) {
+            console.error(`Error: ${err.message}`);
+        }
+        process.exit(1);
+    }
+}
+main();

package/package.json

@@ -1,6 +1,32 @@
 {
   "name": "@inferdat/crm-auth",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0",
+  "description": "CLI tool for Inferdat CRM cross-account AWS access",
+  "type": "module",
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "bin": {
+    "crm-auth": "./dist/index.js"
+  },
+  "files": [
+    "dist/",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "start": "node dist/index.js"
+  },
+  "dependencies": {
+    "commander": "^13.1.0",
+    "open": "^10.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "typescript": "^5.0.0"
+  }
+}