@jigx/sdk-tools 1.1.0-rc → 1.1.0-rc.4

package/README.md

@@ -1,57 +1,19 @@
 # @jigx/sdk-tools
 
-CLI for solution-designers to scaffold, build, and deploy Jigx Applications. Provides the `jigx` command with three verbs — `create`, `build`, and `deploy` — backed by `@jigx/core-sdk` builders.
+CLI for solution-designers to scaffold, build, and deploy Jigx Applications. Provides the `jigx` command with `create`, `build`, `login`, `init`, `deploy`, `whoami`, and `logout` verbs, backed by `@jigx/core-sdk` builders.
 
 ## Requirements
 
 - **Node.js ≥22** — install from [nodejs.org](https://nodejs.org/) or `brew install node`.
 - **Yarn 3+ recommended** (Yarn 1.x also works) — enable via `corepack enable` (ships with Node) or install Yarn 1 via `npm install -g yarn`. See [yarnpkg.com/getting-started/install](https://yarnpkg.com/getting-started/install).
 
-## Get your NPM_TOKEN
-
-`@jigx/*` packages are published to npm with **restricted access**. You need a read-only npm token before installing or running any `jigx` command.
-
-Get the token from **1Password**:
-
-- Item: `npm`
-- Field: `jigx read only token`
-
-## One-time machine setup
-
-Solution-designers run bash. The setup below targets `~/.bashrc` / `~/.bash_profile`.
-
-Export `NPM_TOKEN` in your shell so npm and yarn can read it:
+## Quick start
 
 ```bash
-echo 'export NPM_TOKEN="paste-token-here"' >> ~/.bashrc
-source ~/.bashrc
+npx @jigx/sdk-tools create my-portal && cd my-portal && jigx deploy
 ```
 
-Add the auth line to your user-level `~/.npmrc` so the very first `npx @jigx/sdk-tools create` can fetch the restricted package before a project-level `.npmrc` exists:
-
-```bash
-echo '//registry.npmjs.org/:_authToken=${NPM_TOKEN}' >> ~/.npmrc
-```
-
-After scaffold, the project-level `.npmrc` (committed to the new project) takes over for subsequent `yarn install`s.
-
-## End-to-end
-
-One-time setup plus per-Application flow:
-
-```bash
-# One-time, once per machine
-echo 'export NPM_TOKEN="paste-token-here"' >> ~/.bashrc
-source ~/.bashrc
-echo '//registry.npmjs.org/:_authToken=${NPM_TOKEN}' >> ~/.npmrc
-
-# Per Application
-npx @jigx/sdk-tools create
-cd <your-application-name>
-# Open .env and fill JIGX_API_KEY + JIGX_ORGANIZATION_ID
-yarn build
-yarn deploy            # deploys to prod; pass --env dev for staging
-```
+The first `jigx deploy` auto-runs `jigx login` (Cognito email + password) and `jigx init` (Organization picker, written to `<projectRoot>/jigx.json`). Subsequent deploys reuse the cached refresh token in `~/.jigx/refresh-tokens.json` and the bound Organization in `jigx.json`.
 
 ## Commands
 
@@ -59,21 +21,38 @@ yarn deploy            # deploys to prod; pass --env dev for staging
 | --- | --- |
 | `jigx create` | Prompts for Title → Name → Type, scaffolds a new Application project, runs `yarn install`. |
 | `jigx build` | Compiles `src/app.ts` into `build/output.json` plus the canonical Builder folder layout under `build/app/` for inspection. |
-| `jigx deploy` | Builds, then deploys content. Defaults to prod. Pass `--env dev` to target staging. |
+| `jigx login` | Signs in to Cognito (interactive email + password) and caches a refresh token in `~/.jigx/refresh-tokens.json`. |
+| `jigx init` | Picks an Organization for the current environment and writes the binding to `<projectRoot>/jigx.json`. |
+| `jigx deploy` | Builds, then deploys content. Defaults to prod. Pass `--env dev` to target staging. Auto-runs `jigx login` and `jigx init` if needed (TTY only). |
+| `jigx whoami` | Prints the live User identity and the project's Organization binding for the chosen environment. |
+| `jigx logout` | Clears cached refresh tokens for one env or all envs. |
 
-## Troubleshooting
+## Auth model
+
+Three commands compose the auth flow:
+
+1. **`jigx login`** — interactive Cognito SRP sign-in. Stores a long-lived refresh token at `~/.jigx/refresh-tokens.json`, file mode `0o600`, dir mode `0o700`. Keyed by `<env>:<userPoolId>` so dev and prod entries never collide.
+2. **`jigx init`** — picks an Organization from the User's memberships and writes `<projectRoot>/jigx.json` (`{ "<env>": { "organizationId": "..." } }`). `jigx.json` is a per-project, per-environment binding and is intentionally committable — multiple developers on the same project share the same Organization mapping.
+3. **`jigx deploy`** — refreshes a Cognito ID token from the cached refresh token, looks up the Organization in `jigx.json`, and `Bearer`s the ID token at the Strata API.
 
-### `401` or `403` on install
+In TTY mode, `jigx deploy` fills in missing pieces inline by invoking `jigx login` or `jigx init` as needed. In non-TTY mode (CI), missing pieces surface as typed errors naming the exact command to run.
+
+## Limitations
+
+- **No CI / non-interactive auth.** The auth flow assumes a TTY for the email + password prompt. There is no service-account / API-key / Personal-Access-Token path. CI deploys must pre-populate `~/.jigx/refresh-tokens.json` from a prior interactive `jigx login` (out of scope for the CLI).
+- **No SSO.** Users whose Jigx accounts are managed by an external IdP cannot use `jigx login` today.
+
+See [ADR-0002](../../docs/adr/0002-sdk-tools-cognito-only-auth.md) for the rationale.
+
+## Troubleshooting
 
-`NPM_TOKEN` is missing, expired, or not readable by npm/yarn. Check:
+### `Not authenticated. Run jigx login --env <env>.`
 
-- `echo $NPM_TOKEN` prints a value in your shell.
-- `~/.npmrc` contains `//registry.npmjs.org/:_authToken=${NPM_TOKEN}`.
-- Get a fresh token from 1Password (item `npm`, field `jigx read only token`) and re-export it.
+`~/.jigx/refresh-tokens.json` is missing or the cached refresh token has expired/been revoked. Run `jigx login` (add `--env dev` for staging) and retry.
 
-### `Missing required environment variables` on deploy
+### `No Organization configured for env "<env>".`
 
-`jigx deploy` requires `JIGX_API_KEY` and `JIGX_ORGANIZATION_ID` in the project's `.env`. Open `.env` (auto-created by `jigx create`) and fill both values. Get them from the Jigx manage UI under Organization → Settings → API Keys.
+`<projectRoot>/jigx.json` has no binding for the requested environment. Run `jigx init --env <env>` (optionally with `--org <id>` to skip the picker).
 
 ### `yarn: command not found`
 

package/dist/auth/cognito-auth.d.ts

@@ -0,0 +1,26 @@
+import type { DeployEnvironment } from '../deployer/index.js';
+export interface SignInOptions {
+    readonly email: string;
+    readonly password: string;
+    readonly environment: DeployEnvironment;
+}
+export interface SignInResult {
+    readonly idToken: string;
+    readonly refreshToken: string;
+    readonly userId: string;
+    readonly fullName: string;
+}
+export interface RefreshSessionOptions {
+    readonly refreshToken: string;
+    readonly environment: DeployEnvironment;
+    readonly username: string;
+}
+export interface RefreshSessionResult {
+    readonly idToken: string;
+    readonly expiresAt: string;
+}
+export declare class CognitoAuth {
+    signIn(options: SignInOptions): Promise<SignInResult>;
+    refreshSession(options: RefreshSessionOptions): Promise<RefreshSessionResult>;
+}
+//# sourceMappingURL=cognito-auth.d.ts.map

package/dist/auth/cognito-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognito-auth.d.ts","sourceRoot":"","sources":["../../src/auth/cognito-auth.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAS7D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAA;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAA;IAMvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IAExB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AA+FD,qBAAa,WAAW;IAChB,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CA4D1D;IASK,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA6ClF;CACF"}

package/dist/auth/cognito-auth.js

@@ -0,0 +1,150 @@
+import { AuthenticationDetails, CognitoRefreshToken, CognitoUser, CognitoUserPool, } from 'amazon-cognito-identity-js';
+import { COGNITO_CONFIG } from './cognito-config.js';
+import { InvalidCredentialsError, MalformedTokenError, NetworkError, RefreshExpiredError, } from './errors.js';
+function decodeIdTokenPayload(idToken) {
+    const parts = idToken.split('.');
+    if (parts.length !== 3) {
+        throw new MalformedTokenError(`ID token is not a JWT (expected 3 parts, got ${parts.length}).`);
+    }
+    try {
+        const json = Buffer.from(parts[1], 'base64url').toString('utf8');
+        return JSON.parse(json);
+    }
+    catch (error) {
+        throw new MalformedTokenError(`ID token payload could not be decoded as base64url JSON: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function fullNameFromPayload(payload) {
+    if (payload.name)
+        return payload.name;
+    if (payload.given_name || payload.family_name) {
+        return [payload.given_name, payload.family_name].filter(Boolean).join(' ');
+    }
+    return payload.email ?? '';
+}
+class CognitoFailure extends Error {
+    code;
+    constructor(raw) {
+        const obj = raw && typeof raw === 'object'
+            ? raw
+            : undefined;
+        super(obj?.message ?? String(raw));
+        this.name = obj?.name ?? 'CognitoFailure';
+        this.code = obj?.code;
+    }
+}
+function cognitoErrorCode(error) {
+    if (!error || typeof error !== 'object')
+        return undefined;
+    const obj = error;
+    return obj.code ?? obj.name;
+}
+function isCognitoNotAuthorized(error) {
+    const code = cognitoErrorCode(error);
+    return code === 'NotAuthorizedException' || code === 'UserNotFoundException';
+}
+function cognitoErrorMessage(error) {
+    if (!error || typeof error !== 'object')
+        return '';
+    const obj = error;
+    return obj.message ?? '';
+}
+function isRefreshExpired(error) {
+    const code = cognitoErrorCode(error);
+    if (code !== 'NotAuthorizedException')
+        return false;
+    const message = cognitoErrorMessage(error).toLowerCase();
+    return (message.includes('refresh token has expired') ||
+        message.includes('refresh token has been revoked') ||
+        message.includes('refresh token is invalid'));
+}
+function isCognitoNetworkFailure(error) {
+    const code = cognitoErrorCode(error);
+    return code === 'NetworkError' || code === 'NetworkingError' || code === 'TimeoutError';
+}
+export class CognitoAuth {
+    async signIn(options) {
+        const { email, password, environment } = options;
+        const { userPoolId, userPoolClientId } = COGNITO_CONFIG[environment];
+        const userPool = new CognitoUserPool({
+            UserPoolId: userPoolId,
+            ClientId: userPoolClientId,
+        });
+        const cognitoUser = new CognitoUser({ Username: email, Pool: userPool });
+        const authenticationDetails = new AuthenticationDetails({
+            Username: email,
+            Password: password,
+        });
+        const session = await new Promise((resolve, reject) => {
+            cognitoUser.authenticateUser(authenticationDetails, {
+                onSuccess: (result) => {
+                    resolve(result);
+                },
+                onFailure: (err) => {
+                    reject(err instanceof Error ? err : new CognitoFailure(err));
+                },
+                newPasswordRequired: () => {
+                    reject(new InvalidCredentialsError('New password required for this user. Set a permanent password in the manage UI before retrying.'));
+                },
+            });
+        }).catch((error) => {
+            if (error instanceof InvalidCredentialsError)
+                throw error;
+            if (isCognitoNetworkFailure(error)) {
+                throw new NetworkError(`Cognito sign-in failed: ${error instanceof Error ? error.message : String(error)}`);
+            }
+            if (isCognitoNotAuthorized(error)) {
+                throw new InvalidCredentialsError('Invalid email or password. SSO accounts are not currently supported by jigx login (see ADR-0002).');
+            }
+            throw new NetworkError(`Cognito sign-in failed: ${error instanceof Error ? error.message : String(error)}`);
+        });
+        const idToken = session.getIdToken().getJwtToken();
+        const refreshToken = session.getRefreshToken().getToken();
+        const payload = decodeIdTokenPayload(idToken);
+        const userId = payload.sub ?? '';
+        if (!userId) {
+            throw new InvalidCredentialsError('Cognito sign-in succeeded but ID token had no sub claim.');
+        }
+        return {
+            idToken,
+            refreshToken,
+            userId,
+            fullName: fullNameFromPayload(payload) || email,
+        };
+    }
+    async refreshSession(options) {
+        const { refreshToken, environment, username } = options;
+        const { userPoolId, userPoolClientId } = COGNITO_CONFIG[environment];
+        const userPool = new CognitoUserPool({
+            UserPoolId: userPoolId,
+            ClientId: userPoolClientId,
+        });
+        const cognitoUser = new CognitoUser({ Username: username, Pool: userPool });
+        const cognitoRefreshToken = new CognitoRefreshToken({ RefreshToken: refreshToken });
+        const session = await new Promise((resolve, reject) => {
+            cognitoUser.refreshSession(cognitoRefreshToken, (err, result) => {
+                if (err) {
+                    reject(err instanceof Error ? err : new CognitoFailure(err));
+                    return;
+                }
+                resolve(result);
+            });
+        }).catch((error) => {
+            if (isRefreshExpired(error)) {
+                throw new RefreshExpiredError('Cognito refresh token has expired or been revoked. Re-run `jigx login`.');
+            }
+            if (isCognitoNetworkFailure(error)) {
+                throw new NetworkError(`Cognito refresh failed: ${error instanceof Error ? error.message : String(error)}`);
+            }
+            if (isCognitoNotAuthorized(error)) {
+                throw new RefreshExpiredError('Cognito refresh token was rejected. Re-run `jigx login`.');
+            }
+            throw new NetworkError(`Cognito refresh failed: ${error instanceof Error ? error.message : String(error)}`);
+        });
+        const idToken = session.getIdToken().getJwtToken();
+        const expiresAtSeconds = session.getIdToken().getExpiration();
+        const expiresAt = new Date(expiresAtSeconds * 1000).toISOString();
+        return { idToken, expiresAt };
+    }
+}
+//# sourceMappingURL=cognito-auth.js.map

package/dist/auth/cognito-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognito-auth.js","sourceRoot":"","sources":["../../src/auth/cognito-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,WAAW,EACX,eAAe,GAEhB,MAAM,4BAA4B,CAAA;AAGnC,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,YAAY,EACZ,mBAAmB,GACpB,MAAM,aAAa,CAAA;AAyCpB,SAAS,oBAAoB,CAAC,OAAe,EAAkB;IAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,mBAAmB,CAAC,gDAAgD,KAAK,CAAC,MAAM,IAAI,CAAC,CAAA;IACjG,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAChE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAA;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,mBAAmB,CAC3B,4DAA4D,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACrH,CAAA;IACH,CAAC;AAAA,CACF;AAED,SAAS,mBAAmB,CAAC,OAAuB,EAAU;IAC5D,IAAI,OAAO,CAAC,IAAI;QAAE,OAAO,OAAO,CAAC,IAAI,CAAA;IACrC,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QAC9C,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC5E,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,IAAI,EAAE,CAAA;AAAA,CAC3B;AAQD,MAAM,cAAe,SAAQ,KAAK;IACvB,IAAI,CAAS;IAEtB,YAAY,GAAY,EAAE;QACxB,MAAM,GAAG,GACP,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAC5B,CAAC,CAAE,GAA0D;YAC7D,CAAC,CAAC,SAAS,CAAA;QACf,KAAK,CAAC,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;QAClC,IAAI,CAAC,IAAI,GAAG,GAAG,EAAE,IAAI,IAAI,gBAAgB,CAAA;QACzC,IAAI,CAAC,IAAI,GAAG,GAAG,EAAE,IAAI,CAAA;IAAA,CACtB;CACF;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAsB;IAC5D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IACzD,MAAM,GAAG,GAAG,KAAyC,CAAA;IACrD,OAAO,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAA;AAAA,CAC5B;AAED,SAAS,sBAAsB,CAAC,KAAc,EAAW;IACvD,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;IACpC,OAAO,IAAI,KAAK,wBAAwB,IAAI,IAAI,KAAK,uBAAuB,CAAA;AAAA,CAC7E;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAU;IACnD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAA;IAClD,MAAM,GAAG,GAAG,KAA6B,CAAA;IACzC,OAAO,GAAG,CAAC,OAAO,IAAI,EAAE,CAAA;AAAA,CACzB;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAW;IACjD,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;IACpC,IAAI,IAAI,KAAK,wBAAwB;QAAE,OAAO,KAAK,CAAA;IACnD,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;IACxD,OAAO,CACL,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC;QAC7C,OAAO,CAAC,QAAQ,CAAC,gCAAgC,CAAC;QAClD,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAC7C,CAAA;AAAA,CACF;AAED,SAAS,uBAAuB,CAAC,KAAc,EAAW;IACxD,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;IACpC,OAAO,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,iBAAiB,IAAI,IAAI,KAAK,cAAc,CAAA;AAAA,CACxF;AAUD,MAAM,OAAO,WAAW;IACtB,KAAK,CAAC,MAAM,CAAC,OAAsB,EAAyB;QAC1D,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,OAAO,CAAA;QAChD,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAAG,cAAc,CAAC,WAAW,CAAC,CAAA;QAEpE,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC;YACnC,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,gBAAgB;SAC3B,CAAC,CAAA;QACF,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;QACxE,MAAM,qBAAqB,GAAG,IAAI,qBAAqB,CAAC;YACtD,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,MAAM,IAAI,OAAO,CAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;YACzE,WAAW,CAAC,gBAAgB,CAAC,qBAAqB,EAAE;gBAClD,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;oBACrB,OAAO,CAAC,MAAM,CAAC,CAAA;gBAAA,CAChB;gBACD,SAAS,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC;oBAC3B,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAA;gBAAA,CAC7D;gBACD,mBAAmB,EAAE,GAAG,EAAE,CAAC;oBACzB,MAAM,CACJ,IAAI,uBAAuB,CACzB,iGAAiG,CAClG,CACF,CAAA;gBAAA,CACF;aACF,CAAC,CAAA;QAAA,CACH,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC;YAC3B,IAAI,KAAK,YAAY,uBAAuB;gBAAE,MAAM,KAAK,CAAA;YACzD,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,YAAY,CACpB,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACpF,CAAA;YACH,CAAC;YACD,IAAI,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,uBAAuB,CAC/B,mGAAmG,CACpG,CAAA;YACH,CAAC;YACD,MAAM,IAAI,YAAY,CACpB,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACpF,CAAA;QAAA,CACF,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,WAAW,EAAE,CAAA;QAClD,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,QAAQ,EAAE,CAAA;QACzD,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAA;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAA;QAChC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,uBAAuB,CAAC,0DAA0D,CAAC,CAAA;QAC/F,CAAC;QACD,OAAO;YACL,OAAO;YACP,YAAY;YACZ,MAAM;YACN,QAAQ,EAAE,mBAAmB,CAAC,OAAO,CAAC,IAAI,KAAK;SAChD,CAAA;IAAA,CACF;IASD,KAAK,CAAC,cAAc,CAAC,OAA8B,EAAiC;QAClF,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;QACvD,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAAG,cAAc,CAAC,WAAW,CAAC,CAAA;QAEpE,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC;YACnC,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,gBAAgB;SAC3B,CAAC,CAAA;QACF,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC3E,MAAM,mBAAmB,GAAG,IAAI,mBAAmB,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAA;QAEnF,MAAM,OAAO,GAAG,MAAM,IAAI,OAAO,CAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;YACzE,WAAW,CAAC,cAAc,CACxB,mBAAmB,EACnB,CAAC,GAAY,EAAE,MAA0B,EAAE,EAAE,CAAC;gBAC5C,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAA;oBAC5D,OAAM;gBACR,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,CAAA;YAAA,CAChB,CACF,CAAA;QAAA,CACF,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC;YAC3B,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,mBAAmB,CAC3B,yEAAyE,CAC1E,CAAA;YACH,CAAC;YACD,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,YAAY,CACpB,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACpF,CAAA;YACH,CAAC;YACD,IAAI,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,mBAAmB,CAAC,0DAA0D,CAAC,CAAA;YAC3F,CAAC;YACD,MAAM,IAAI,YAAY,CACpB,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACpF,CAAA;QAAA,CACF,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,WAAW,EAAE,CAAA;QAClD,MAAM,gBAAgB,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE,CAAA;QAC7D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;QACjE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;IAAA,CAC9B;CACF"}

package/dist/auth/cognito-config.d.ts

@@ -0,0 +1,10 @@
+import type { DeployEnvironment } from '../deployer/index.js';
+export interface CognitoEnvironmentConfig {
+    readonly userPoolId: string;
+    readonly userPoolClientId: string;
+    readonly cognitoRegion: 'us-west-2' | 'us-east-1';
+    readonly strataRestUrl: string;
+    readonly manageBaseUrl: string;
+}
+export declare const COGNITO_CONFIG: Record<DeployEnvironment, CognitoEnvironmentConfig>;
+//# sourceMappingURL=cognito-config.d.ts.map

package/dist/auth/cognito-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognito-config.d.ts","sourceRoot":"","sources":["../../src/auth/cognito-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAW7D,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,aAAa,EAAE,WAAW,GAAG,WAAW,CAAA;IACjD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,iBAAiB,EAAE,wBAAwB,CAe9E,CAAA"}

package/dist/auth/cognito-config.js

@@ -0,0 +1,17 @@
+export const COGNITO_CONFIG = {
+    dev: {
+        userPoolId: 'us-west-2_TD7N2X8jI',
+        userPoolClientId: '3fmgcm5oghvkqkve6pdgc4di6t',
+        cognitoRegion: 'us-west-2',
+        strataRestUrl: 'https://us-west-2.dev-api.jigx.com/v2.0',
+        manageBaseUrl: 'https://manage-dev.jigx.com',
+    },
+    prod: {
+        userPoolId: 'us-east-1_sPI6yqUOC',
+        userPoolClientId: '4d9brj8uakjpdthammcpnofil4',
+        cognitoRegion: 'us-east-1',
+        strataRestUrl: 'https://us-east-1.api.jigx.com/v2.0',
+        manageBaseUrl: 'https://manage.jigx.com',
+    },
+};
+//# sourceMappingURL=cognito-config.js.map

package/dist/auth/cognito-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognito-config.js","sourceRoot":"","sources":["../../src/auth/cognito-config.ts"],"names":[],"mappings":"AAmBA,MAAM,CAAC,MAAM,cAAc,GAAwD;IACjF,GAAG,EAAE;QACH,UAAU,EAAE,qBAAqB;QACjC,gBAAgB,EAAE,4BAA4B;QAC9C,aAAa,EAAE,WAAW;QAC1B,aAAa,EAAE,yCAAyC;QACxD,aAAa,EAAE,6BAA6B;KAC7C;IACD,IAAI,EAAE;QACJ,UAAU,EAAE,qBAAqB;QACjC,gBAAgB,EAAE,4BAA4B;QAC9C,aAAa,EAAE,WAAW;QAC1B,aAAa,EAAE,qCAAqC;QACpD,aAAa,EAAE,yBAAyB;KACzC;CACF,CAAA"}

package/dist/auth/credentials-store.d.ts

@@ -0,0 +1,34 @@
+import type { DeployEnvironment } from '../deployer/index.js';
+export interface UserHomeRefreshToken {
+    readonly refreshToken: string;
+    readonly userId: string;
+    readonly expiresAt: string;
+}
+export interface WriteUserHomeOptions {
+    readonly environment: DeployEnvironment;
+    readonly userPoolId: string;
+    readonly refreshToken: string;
+    readonly userId: string;
+    readonly expiresAt: string;
+    readonly homeDir?: string;
+}
+export interface ReadUserHomeOptions {
+    readonly environment: DeployEnvironment;
+    readonly userPoolId: string;
+    readonly homeDir?: string;
+}
+export declare class CredentialsStore {
+    writeUserHome(options: WriteUserHomeOptions): Promise<void>;
+    readUserHome(options: ReadUserHomeOptions): Promise<UserHomeRefreshToken | null>;
+    clearUserHome(options: ClearUserHomeOptions): Promise<ClearUserHomeResult>;
+}
+export interface ClearUserHomeOptions {
+    readonly environment: DeployEnvironment;
+    readonly userPoolId: string;
+    readonly homeDir?: string;
+}
+export interface ClearUserHomeResult {
+    readonly cleared: boolean;
+    readonly fileDeleted: boolean;
+}
+//# sourceMappingURL=credentials-store.d.ts.map

package/dist/auth/credentials-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-store.d.ts","sourceRoot":"","sources":["../../src/auth/credentials-store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AA4B7D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IAEvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAqED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAA;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAE1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAA;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAE3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAUD,qBAAa,gBAAgB;IACrB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhE;IAEK,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAKrF;IAEK,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAsB/E;CACF;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAA;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAE3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAElC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IAEzB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAC9B"}

package/dist/auth/credentials-store.js

@@ -0,0 +1,116 @@
+import { chmod, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { CredentialsSchemaError } from './errors.js';
+function schemaMismatchMessage(options) {
+    const { path: filePath, fileVersion, expectedVersion } = options;
+    if (fileVersion > expectedVersion) {
+        return `${filePath} was written by a newer @jigx/sdk-tools (schema v${fileVersion} > v${expectedVersion}). Upgrade @jigx/sdk-tools to read this file.`;
+    }
+    return `${filePath} has unsupported schema version ${fileVersion} (expected ${expectedVersion}).`;
+}
+function isFileNotFoundError(error) {
+    return (error instanceof Error && 'code' in error && error.code === 'ENOENT');
+}
+const REFRESH_TOKENS_SCHEMA_VERSION = 1;
+const REFRESH_TOKENS_DIR = '.jigx';
+const REFRESH_TOKENS_DIR_MODE = 0o700;
+const REFRESH_TOKENS_FILE = 'refresh-tokens.json';
+const REFRESH_TOKENS_FILE_MODE = 0o600;
+function refreshTokensPath(homeDir) {
+    return path.join(homeDir, REFRESH_TOKENS_DIR, REFRESH_TOKENS_FILE);
+}
+function refreshTokenKey(options) {
+    return `${options.environment}:${options.userPoolId}`;
+}
+async function readRefreshTokensFile(homeDir) {
+    try {
+        const raw = await readFile(refreshTokensPath(homeDir), 'utf8');
+        const parsed = JSON.parse(raw);
+        if (parsed === null ||
+            typeof parsed !== 'object' ||
+            !('version' in parsed) ||
+            !('tokens' in parsed)) {
+            throw new CredentialsSchemaError(`Refresh-tokens file at ${refreshTokensPath(homeDir)} is malformed: missing version or tokens field.`);
+        }
+        const file = parsed;
+        if (file.version !== REFRESH_TOKENS_SCHEMA_VERSION) {
+            throw new CredentialsSchemaError(schemaMismatchMessage({
+                path: refreshTokensPath(homeDir),
+                fileVersion: file.version,
+                expectedVersion: REFRESH_TOKENS_SCHEMA_VERSION,
+            }));
+        }
+        return file;
+    }
+    catch (error) {
+        if (isFileNotFoundError(error))
+            return null;
+        if (error instanceof CredentialsSchemaError)
+            throw error;
+        if (error instanceof SyntaxError) {
+            throw new CredentialsSchemaError(`Refresh-tokens file at ${refreshTokensPath(homeDir)} is not valid JSON: ${error.message}`);
+        }
+        throw error;
+    }
+}
+async function ensureRefreshTokensDir(homeDir) {
+    const dir = path.join(homeDir, REFRESH_TOKENS_DIR);
+    await mkdir(dir, { recursive: true, mode: REFRESH_TOKENS_DIR_MODE });
+    await chmod(dir, REFRESH_TOKENS_DIR_MODE);
+    return dir;
+}
+export class CredentialsStore {
+    async writeUserHome(options) {
+        const { homeDir = os.homedir(), environment, userPoolId, refreshToken, userId, expiresAt, } = options;
+        await ensureRefreshTokensDir(homeDir);
+        const filePath = refreshTokensPath(homeDir);
+        const existing = await readRefreshTokensFile(homeDir);
+        const next = {
+            version: REFRESH_TOKENS_SCHEMA_VERSION,
+            tokens: {
+                ...(existing?.tokens ?? {}),
+                [refreshTokenKey({ environment, userPoolId })]: {
+                    refreshToken,
+                    userId,
+                    expiresAt,
+                },
+            },
+        };
+        await writeFile(filePath, `${JSON.stringify(next, null, 2)}\n`, {
+            encoding: 'utf8',
+            mode: REFRESH_TOKENS_FILE_MODE,
+        });
+        await chmod(filePath, REFRESH_TOKENS_FILE_MODE);
+    }
+    async readUserHome(options) {
+        const { homeDir = os.homedir(), environment, userPoolId } = options;
+        const file = await readRefreshTokensFile(homeDir);
+        if (!file)
+            return null;
+        return file.tokens[refreshTokenKey({ environment, userPoolId })] ?? null;
+    }
+    async clearUserHome(options) {
+        const { homeDir = os.homedir(), environment, userPoolId } = options;
+        const file = await readRefreshTokensFile(homeDir);
+        if (!file)
+            return { cleared: false, fileDeleted: false };
+        const key = refreshTokenKey({ environment, userPoolId });
+        if (!(key in file.tokens))
+            return { cleared: false, fileDeleted: false };
+        const { [key]: _removed, ...remaining } = file.tokens;
+        const filePath = refreshTokensPath(homeDir);
+        if (Object.keys(remaining).length === 0) {
+            await rm(filePath, { force: true });
+            return { cleared: true, fileDeleted: true };
+        }
+        const next = { version: REFRESH_TOKENS_SCHEMA_VERSION, tokens: remaining };
+        await writeFile(filePath, `${JSON.stringify(next, null, 2)}\n`, {
+            encoding: 'utf8',
+            mode: REFRESH_TOKENS_FILE_MODE,
+        });
+        await chmod(filePath, REFRESH_TOKENS_FILE_MODE);
+        return { cleared: true, fileDeleted: false };
+    }
+}
+//# sourceMappingURL=credentials-store.js.map

package/dist/auth/credentials-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-store.js","sourceRoot":"","sources":["../../src/auth/credentials-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACxE,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,IAAI,MAAM,WAAW,CAAA;AAG5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAEpD,SAAS,qBAAqB,CAAC,OAI9B,EAAU;IACT,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,OAAO,CAAA;IAChE,IAAI,WAAW,GAAG,eAAe,EAAE,CAAC;QAClC,OAAO,GAAG,QAAQ,oDAAoD,WAAW,OAAO,eAAe,+CAA+C,CAAA;IACxJ,CAAC;IACD,OAAO,GAAG,QAAQ,mCAAmC,WAAW,cAAc,eAAe,IAAI,CAAA;AAAA,CAClG;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAW;IACpD,OAAO,CACL,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,CAChG,CAAA;AAAA,CACF;AAqBD,MAAM,6BAA6B,GAAG,CAAC,CAAA;AACvC,MAAM,kBAAkB,GAAG,OAAO,CAAA;AAClC,MAAM,uBAAuB,GAAG,KAAK,CAAA;AACrC,MAAM,mBAAmB,GAAG,qBAAqB,CAAA;AACjD,MAAM,wBAAwB,GAAG,KAAK,CAAA;AAEtC,SAAS,iBAAiB,CAAC,OAAe,EAAU;IAClD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,CAAA;AAAA,CACnE;AAED,SAAS,eAAe,CAAC,OAGxB,EAAU;IACT,OAAO,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,UAAU,EAAE,CAAA;AAAA,CACtD;AAED,KAAK,UAAU,qBAAqB,CAAC,OAAe,EAAqC;IACvF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAA;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAA;QACzC,IACE,MAAM,KAAK,IAAI;YACf,OAAO,MAAM,KAAK,QAAQ;YAC1B,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC;YACtB,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC,EACrB,CAAC;YACD,MAAM,IAAI,sBAAsB,CAC9B,0BAA0B,iBAAiB,CAAC,OAAO,CAAC,iDAAiD,CACtG,CAAA;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAA2B,CAAA;QACxC,IAAI,IAAI,CAAC,OAAO,KAAK,6BAA6B,EAAE,CAAC;YACnD,MAAM,IAAI,sBAAsB,CAC9B,qBAAqB,CAAC;gBACpB,IAAI,EAAE,iBAAiB,CAAC,OAAO,CAAC;gBAChC,WAAW,EAAE,IAAI,CAAC,OAAO;gBACzB,eAAe,EAAE,6BAA6B;aAC/C,CAAC,CACH,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAC3C,IAAI,KAAK,YAAY,sBAAsB;YAAE,MAAM,KAAK,CAAA;QACxD,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,MAAM,IAAI,sBAAsB,CAC9B,0BAA0B,iBAAiB,CAAC,OAAO,CAAC,uBAAuB,KAAK,CAAC,OAAO,EAAE,CAC3F,CAAA;QACH,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;AAAA,CACF;AAED,KAAK,UAAU,sBAAsB,CAAC,OAAe,EAAmB;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAA;IAClD,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAA;IAEpE,MAAM,KAAK,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAA;IACzC,OAAO,GAAG,CAAA;AAAA,CACX;AA2BD,MAAM,OAAO,gBAAgB;IAC3B,KAAK,CAAC,aAAa,CAAC,OAA6B,EAAiB;QAChE,MAAM,EACJ,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE,EACtB,WAAW,EACX,UAAU,EACV,YAAY,EACZ,MAAM,EACN,SAAS,GACV,GAAG,OAAO,CAAA;QACX,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAA;QAErC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAA;QACrD,MAAM,IAAI,GAAsB;YAC9B,OAAO,EAAE,6BAA6B;YACtC,MAAM,EAAE;gBACN,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC;gBAC3B,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE;oBAC9C,YAAY;oBACZ,MAAM;oBACN,SAAS;iBACV;aACF;SACF,CAAA;QACD,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YAC9D,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,wBAAwB;SAC/B,CAAC,CAAA;QAEF,MAAM,KAAK,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAA;IAAA,CAChD;IAED,KAAK,CAAC,YAAY,CAAC,OAA4B,EAAwC;QACrF,MAAM,EAAE,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,OAAO,CAAA;QACnE,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAA;QACjD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,IAAI,CAAA;IAAA,CACzE;IAED,KAAK,CAAC,aAAa,CAAC,OAA6B,EAAgC;QAC/E,MAAM,EAAE,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,OAAO,CAAA;QACnE,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAA;QACjD,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAA;QACxD,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAA;QAExE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,GAAG,SAAS,EAAE,GAAG,IAAI,CAAC,MAAM,CAAA;QAErD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;QAC3C,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;QAC7C,CAAC;QAED,MAAM,IAAI,GAAsB,EAAE,OAAO,EAAE,6BAA6B,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QAC7F,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YAC9D,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,wBAAwB;SAC/B,CAAC,CAAA;QACF,MAAM,KAAK,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAA;QAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAA;IAAA,CAC7C;CACF"}

package/dist/auth/errors.d.ts

@@ -0,0 +1,23 @@
+export declare class InvalidCredentialsError extends Error {
+    constructor(message: string);
+}
+export declare class NetworkError extends Error {
+    constructor(message: string);
+}
+export declare class AuthHttpError extends Error {
+    readonly status: number;
+    constructor(options: {
+        readonly message: string;
+        readonly status: number;
+    });
+}
+export declare class CredentialsSchemaError extends Error {
+    constructor(message: string);
+}
+export declare class RefreshExpiredError extends Error {
+    constructor(message: string);
+}
+export declare class MalformedTokenError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/auth/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAOA,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,YAAa,SAAQ,KAAK;IACrC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IAEvB,YAAY,OAAO,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAIzE;CACF;AAED,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAOD,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAOD,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF"}

package/dist/auth/errors.js

@@ -0,0 +1,39 @@
+export class InvalidCredentialsError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'InvalidCredentialsError';
+    }
+}
+export class NetworkError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'NetworkError';
+    }
+}
+export class AuthHttpError extends Error {
+    status;
+    constructor(options) {
+        super(options.message);
+        this.name = 'AuthHttpError';
+        this.status = options.status;
+    }
+}
+export class CredentialsSchemaError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CredentialsSchemaError';
+    }
+}
+export class RefreshExpiredError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'RefreshExpiredError';
+    }
+}
+export class MalformedTokenError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'MalformedTokenError';
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/auth/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAOA,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe,EAAE;QAC3B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;IAAA,CACtC;CACF;AAED,MAAM,OAAO,YAAa,SAAQ,KAAK;IACrC,YAAY,OAAe,EAAE;QAC3B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,cAAc,CAAA;IAAA,CAC3B;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,MAAM,CAAQ;IAEvB,YAAY,OAA8D,EAAE;QAC1E,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACtB,IAAI,CAAC,IAAI,GAAG,eAAe,CAAA;QAC3B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;IAAA,CAC7B;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe,EAAE;QAC3B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IAAA,CACrC;CACF;AAOD,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe,EAAE;QAC3B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IAAA,CAClC;CACF;AAOD,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe,EAAE;QAC3B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IAAA,CAClC;CACF"}

package/dist/auth/identity-client.d.ts

@@ -0,0 +1,19 @@
+import type { DeployEnvironment } from '../deployer/index.js';
+export interface OrganizationSummary {
+    readonly organizationId: string;
+    readonly organizationName: string;
+}
+export interface GetMeOptions {
+    readonly environment: DeployEnvironment;
+    readonly idToken: string;
+}
+export interface GetMeResult {
+    readonly userId: string;
+    readonly fullName: string;
+    readonly email: string;
+    readonly organizations: readonly OrganizationSummary[];
+}
+export declare class IdentityClient {
+    getMe(options: GetMeOptions): Promise<GetMeResult>;
+}
+//# sourceMappingURL=identity-client.d.ts.map

package/dist/auth/identity-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-client.d.ts","sourceRoot":"","sources":["../../src/auth/identity-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAI7D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAClC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAA;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,aAAa,EAAE,SAAS,mBAAmB,EAAE,CAAA;CACvD;AAiDD,qBAAa,cAAc;IACnB,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA8CvD;CACF"}