@mediaruntime/cli 0.1.0 → 0.2.1

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { createHash, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
 import { constants, realpathSync } from "fs";
 import {
   access,
@@ -52,6 +52,312 @@ var BundleDownloadError = class extends CliError {
   }
 };
 
+// src/auth/api.ts
+var PRODUCTION_ORIGIN = "https://mediaruntime.com";
+var AuthApiError = class extends CliError {
+  status;
+  constructor(code, message, status) {
+    super(code, message, status >= 500 ? 5 : 3);
+    this.name = "AuthApiError";
+    this.status = status;
+  }
+};
+function endpoint(baseUrl, path) {
+  return `${baseUrl.replace(/\/+$/, "")}/api/cli/auth/${path}`;
+}
+async function responsePayload(response) {
+  try {
+    const value = await response.json();
+    return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+  } catch {
+    return {};
+  }
+}
+async function post(baseUrl, path, body, apiKey) {
+  let response;
+  try {
+    response = await fetch(endpoint(baseUrl, path), {
+      method: "POST",
+      redirect: "error",
+      headers: {
+        "Content-Type": "application/json",
+        ...apiKey ? { "X-API-Key": apiKey } : {}
+      },
+      body: JSON.stringify(body)
+    });
+  } catch (error) {
+    throw new CliError("auth_connection_error", "Could not reach MediaRuntime authentication", 5, { cause: error });
+  }
+  const payload = await responsePayload(response);
+  if (!response.ok) {
+    const errorPayload = payload;
+    throw new AuthApiError(
+      typeof errorPayload.error === "string" ? errorPayload.error : "authorization_failed",
+      typeof errorPayload.detail === "string" ? errorPayload.detail : `Authentication failed with HTTP ${response.status}`,
+      response.status
+    );
+  }
+  return payload;
+}
+function requireString(payload, key) {
+  const value = payload[key];
+  if (typeof value !== "string" || !value) throw new CliError("invalid_auth_response", "MediaRuntime returned an invalid authentication response", 5);
+  return value;
+}
+async function startAuthorization(baseUrl, codeChallenge) {
+  const payload = await post(baseUrl, "start", { codeChallenge, clientName: "MediaRuntime CLI" });
+  return {
+    deviceCode: requireString(payload, "deviceCode"),
+    userCode: requireString(payload, "userCode"),
+    verificationUri: requireString(payload, "verificationUri"),
+    verificationUriComplete: requireString(payload, "verificationUriComplete"),
+    expiresIn: Number(payload.expiresIn),
+    interval: Number(payload.interval)
+  };
+}
+async function exchangeAuthorization(baseUrl, deviceCode, codeVerifier) {
+  const payload = await post(baseUrl, "token", { deviceCode, codeVerifier });
+  const credentialType = requireString(payload, "credentialType");
+  if (credentialType !== "cli") throw new CliError("invalid_auth_response", "MediaRuntime returned the wrong credential type", 5);
+  return {
+    apiKey: requireString(payload, "apiKey"),
+    accountId: requireString(payload, "accountId"),
+    keyId: requireString(payload, "keyId"),
+    credentialType
+  };
+}
+async function inspectCredential(baseUrl, apiKey) {
+  const payload = await post(baseUrl, "status", {}, apiKey);
+  const credentialType = requireString(payload, "credentialType");
+  if (credentialType !== "cli" && credentialType !== "api_key") {
+    throw new CliError("invalid_auth_response", "MediaRuntime returned the wrong credential type", 5);
+  }
+  return {
+    status: "authenticated",
+    accountId: requireString(payload, "accountId"),
+    keyId: requireString(payload, "keyId"),
+    credentialType
+  };
+}
+async function revokeCredential(baseUrl, apiKey) {
+  await post(baseUrl, "revoke", {}, apiKey);
+}
+
+// src/commands/auth.ts
+import { createHash, randomBytes } from "crypto";
+
+// src/auth/browser.ts
+import { spawn } from "child_process";
+async function openBrowser(url) {
+  const command = process.platform === "darwin" ? { executable: "open", args: [url] } : process.platform === "win32" ? { executable: "rundll32", args: ["url.dll,FileProtocolHandler", url] } : { executable: "xdg-open", args: [url] };
+  await new Promise((resolve2, reject) => {
+    const child = spawn(command.executable, command.args, {
+      detached: true,
+      stdio: "ignore"
+    });
+    child.once("error", (error) => reject(new CliError(
+      "browser_open_failed",
+      "Could not open a browser; rerun with --no-browser and open the printed URL",
+      2,
+      { cause: error }
+    )));
+    child.once("spawn", () => {
+      child.unref();
+      resolve2();
+    });
+  });
+}
+
+// src/auth/credential-store.ts
+var SERVICE = "mediaruntime-cli";
+function vaultAccount(baseUrl) {
+  return new URL(baseUrl).host.toLowerCase();
+}
+function validCredential(value) {
+  if (!value || typeof value !== "object") return false;
+  const item = value;
+  return typeof item.apiKey === "string" && item.apiKey.startsWith("sk_") && typeof item.accountId === "string" && item.accountId.length > 0 && typeof item.keyId === "string" && item.keyId.length > 0 && typeof item.baseUrl === "string" && item.baseUrl.length > 0 && typeof item.createdAt === "string" && item.createdAt.length > 0;
+}
+async function entry(baseUrl) {
+  try {
+    const { Entry } = await import("@napi-rs/keyring");
+    return new Entry(SERVICE, vaultAccount(baseUrl));
+  } catch (error) {
+    throw new CliError(
+      "credential_store_unavailable",
+      "The operating-system credential vault is unavailable; use MEDIARUNTIME_API_KEY on this machine",
+      2,
+      { cause: error }
+    );
+  }
+}
+var OsCredentialStore = class {
+  async get(baseUrl) {
+    try {
+      const raw = (await entry(baseUrl)).getPassword();
+      if (!raw) return null;
+      const parsed = JSON.parse(raw);
+      if (!validCredential(parsed) || parsed.baseUrl !== baseUrl) {
+        throw new Error("Stored credential has an invalid shape");
+      }
+      return parsed;
+    } catch (error) {
+      if (error instanceof SyntaxError || error instanceof Error && error.message.includes("invalid shape")) {
+        throw new CliError("credential_store_invalid", "The stored MediaRuntime credential is invalid; run mediaruntime logout --local-only", 3);
+      }
+      if (error instanceof CliError) throw error;
+      if (error instanceof Error && /not found|no entry|no matching|item.*exist/i.test(error.message)) return null;
+      throw new CliError("credential_store_error", "Could not read the operating-system credential vault", 2, { cause: error });
+    }
+  }
+  async set(credential) {
+    try {
+      (await entry(credential.baseUrl)).setPassword(JSON.stringify(credential));
+    } catch (error) {
+      if (error instanceof CliError) throw error;
+      throw new CliError("credential_store_error", "Could not save the login in the operating-system credential vault", 2, { cause: error });
+    }
+  }
+  async delete(baseUrl) {
+    try {
+      (await entry(baseUrl)).deletePassword();
+    } catch (error) {
+      if (error instanceof CliError) throw error;
+      if (error instanceof Error && /not found|no entry|no matching|item.*exist/i.test(error.message)) return;
+      throw new CliError("credential_store_error", "Could not remove the login from the operating-system credential vault", 2, { cause: error });
+    }
+  }
+};
+
+// src/commands/auth.ts
+var defaultSleep = (milliseconds) => new Promise((resolve2) => setTimeout(resolve2, milliseconds));
+function verifierChallenge(verifier) {
+  return createHash("sha256").update(verifier).digest("base64url");
+}
+function defaultVerifier() {
+  return randomBytes(32).toString("base64url");
+}
+function store(dependencies) {
+  return dependencies.credentialStore ?? new OsCredentialStore();
+}
+function assertOnly(args, allowed) {
+  const unexpected = args.find((arg) => !allowed.includes(arg));
+  if (unexpected) throw new UsageError(`Unknown authentication option: ${unexpected}`);
+}
+async function resolveCredential(baseUrl, dependencies = {}) {
+  const environment = process.env.MEDIARUNTIME_API_KEY?.trim();
+  if (environment) return { apiKey: environment, source: "environment" };
+  const stored = await store(dependencies).get(baseUrl);
+  return stored ? { apiKey: stored.apiKey, source: "keychain", stored } : null;
+}
+async function runLoginCommand(args, baseUrl, dependencies = {}) {
+  assertOnly(args, ["--no-browser"]);
+  const noBrowser = args.includes("--no-browser");
+  const write = dependencies.writeStdout ?? ((text) => process.stdout.write(text));
+  const existing = await store(dependencies).get(baseUrl);
+  if (existing) {
+    try {
+      await inspectCredential(baseUrl, existing.apiKey);
+      write(`Already logged in to ${baseUrl} (account ${existing.accountId}).
+`);
+      return 0;
+    } catch (error) {
+      if (!(error instanceof AuthApiError) || error.status >= 500) throw error;
+    }
+  }
+  const verifier = dependencies.randomVerifier?.() ?? defaultVerifier();
+  if (verifier.length < 43 || verifier.length > 128) {
+    throw new CliError("invalid_verifier", "Generated PKCE verifier is invalid", 1);
+  }
+  const authorization = await startAuthorization(baseUrl, verifierChallenge(verifier));
+  if (!Number.isFinite(authorization.expiresIn) || authorization.expiresIn <= 0 || !Number.isFinite(authorization.interval) || authorization.interval < 1) {
+    throw new CliError("invalid_auth_response", "MediaRuntime returned invalid authorization timing", 5);
+  }
+  write(`Open this URL to authorize MediaRuntime CLI:
+${authorization.verificationUriComplete}
+
+`);
+  write(`Confirm code: ${authorization.userCode}
+`);
+  if (!noBrowser) await (dependencies.openBrowser ?? openBrowser)(authorization.verificationUriComplete);
+  write("Waiting for browser approval\u2026\n");
+  const now = dependencies.now ?? Date.now;
+  const sleep = dependencies.sleep ?? defaultSleep;
+  const deadline = now() + authorization.expiresIn * 1e3;
+  let credential;
+  while (now() < deadline) {
+    try {
+      credential = await exchangeAuthorization(baseUrl, authorization.deviceCode, verifier);
+      break;
+    } catch (error) {
+      if (error instanceof AuthApiError && error.code === "authorization_pending") {
+        await sleep(authorization.interval * 1e3);
+        continue;
+      }
+      throw error;
+    }
+  }
+  if (!credential) throw new CliError("authorization_timeout", "Browser authorization expired; run mediaruntime login again", 7);
+  try {
+    await inspectCredential(baseUrl, credential.apiKey);
+    await store(dependencies).set({
+      apiKey: credential.apiKey,
+      accountId: credential.accountId,
+      keyId: credential.keyId,
+      baseUrl,
+      createdAt: new Date(now()).toISOString()
+    });
+  } catch (error) {
+    await revokeCredential(baseUrl, credential.apiKey).catch(() => void 0);
+    throw error;
+  }
+  write(`Logged in to ${baseUrl} (account ${credential.accountId}).
+`);
+  if (process.env.MEDIARUNTIME_API_KEY?.trim()) {
+    write("MEDIARUNTIME_API_KEY is set and will take precedence over this login.\n");
+  }
+  return 0;
+}
+async function runAuthStatusCommand(args, baseUrl, dependencies = {}) {
+  assertOnly(args, ["--json"]);
+  const json = args.includes("--json");
+  const write = dependencies.writeStdout ?? ((text) => process.stdout.write(text));
+  const resolved = await resolveCredential(baseUrl, dependencies);
+  if (!resolved) throw new CliError("authentication_required", "Run mediaruntime login or set MEDIARUNTIME_API_KEY", 3);
+  const status = await inspectCredential(baseUrl, resolved.apiKey);
+  if (json) {
+    write(`${JSON.stringify({ authenticated: true, source: resolved.source, ...status })}
+`);
+  } else {
+    write(`Authenticated via ${resolved.source} (account ${status.accountId}, key ${status.keyId}).
+`);
+  }
+  return 0;
+}
+async function runLogoutCommand(args, baseUrl, dependencies = {}) {
+  assertOnly(args, ["--local-only"]);
+  const localOnly = args.includes("--local-only");
+  const write = dependencies.writeStdout ?? ((text) => process.stdout.write(text));
+  const credentialStore = store(dependencies);
+  const credential = await credentialStore.get(baseUrl);
+  if (!credential) {
+    write(`No stored login for ${baseUrl}.
+`);
+    if (process.env.MEDIARUNTIME_API_KEY?.trim()) write("MEDIARUNTIME_API_KEY remains active in this shell.\n");
+    return 0;
+  }
+  if (!localOnly) await revokeCredential(baseUrl, credential.apiKey);
+  await credentialStore.delete(baseUrl);
+  write(localOnly ? "Removed the local CLI login without server revocation.\n" : "Logged out and revoked the CLI credential.\n");
+  if (process.env.MEDIARUNTIME_API_KEY?.trim()) write("MEDIARUNTIME_API_KEY remains active in this shell.\n");
+  return 0;
+}
+async function runAuthCommand(args, baseUrl, dependencies = {}) {
+  const subcommand = args[0];
+  if (subcommand !== "status") throw new UsageError("Usage: mediaruntime auth status [--json]");
+  return runAuthStatusCommand(args.slice(1), baseUrl, dependencies);
+}
+
 // src/commands/jobs.ts
 var UNSUCCESSFUL_TERMINAL_STATUSES = /* @__PURE__ */ new Set(["FAILED", "REJECTED", "PARTIAL"]);
 function optionValue(args, index, option) {
@@ -360,47 +666,63 @@ async function runCommand(args, dependencies) {
     ...options.metadata === void 0 ? {} : { metadata: options.metadata },
     ...options.idempotencyKey === void 0 ? {} : { idempotencyKey: options.idempotencyKey }
   };
-  const submitted = await dependencies.jobs.create(params);
-  if (!options.wait) {
-    if (options.json) dependencies.writeStdout(`${JSON.stringify(receiptProjection(submitted))}
-`);
-    else writeHumanReceipt(submitted, dependencies.writeStdout);
-    return UNSUCCESSFUL_TERMINAL_STATUSES2.has(String(submitted.status).toUpperCase()) ? 6 : 0;
-  }
-  const details = await submitted.wait(
-    options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs }
+  const isLocalSource = !/^(?:https?|gs):\/\//i.test(options.source);
+  dependencies.activity.start(
+    isLocalSource ? "Uploading local source and creating job\u2026" : "Creating job\u2026"
   );
-  if (!options.json) writeHumanDetails(details, dependencies.writeStdout);
-  if (String(details.status).toUpperCase() !== "COMPLETED") {
-    if (options.json) dependencies.writeStdout(`${JSON.stringify(detailsProjection2(details))}
+  try {
+    const submitted = await dependencies.jobs.create(params);
+    if (!options.wait) {
+      dependencies.activity.stop();
+      if (options.json) dependencies.writeStdout(`${JSON.stringify(receiptProjection(submitted))}
 `);
-    return 6;
-  }
-  if (options.download) {
-    const url = details.bundle.downloadUrl;
-    if (!details.bundle.available || !url) {
-      throw new BundleDownloadError("Completed job does not have an available canonical bundle");
+      else writeHumanReceipt(submitted, dependencies.writeStdout);
+      return UNSUCCESSFUL_TERMINAL_STATUSES2.has(String(submitted.status).toUpperCase()) ? 6 : 0;
     }
-    try {
-      await dependencies.downloadBundle(url, options.download, {
-        force: options.force,
-        expectedSizeBytes: details.bundle.sizeBytes,
-        expectedSha256: details.bundle.sha256
-      });
-    } catch (error) {
-      if (error instanceof BundleDownloadError) throw error;
-      throw new BundleDownloadError(`Could not download bundle to ${options.download}`, { cause: error });
+    dependencies.activity.update(`Waiting for job ${submitted.id} to complete\u2026`);
+    const details = await submitted.wait(
+      options.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs }
+    );
+    if (String(details.status).toUpperCase() !== "COMPLETED") {
+      dependencies.activity.stop();
+      if (!options.json) writeHumanDetails(details, dependencies.writeStdout);
+      if (options.json) dependencies.writeStdout(`${JSON.stringify(detailsProjection2(details))}
+`);
+      return 6;
+    }
+    if (options.download) {
+      const url = details.bundle.downloadUrl;
+      if (!details.bundle.available || !url) {
+        throw new BundleDownloadError("Completed job does not have an available canonical bundle");
+      }
+      dependencies.activity.update("Downloading and verifying ZIP bundle\u2026");
+      try {
+        await dependencies.downloadBundle(url, options.download, {
+          force: options.force,
+          expectedSizeBytes: details.bundle.sizeBytes,
+          expectedSha256: details.bundle.sha256
+        });
+      } catch (error) {
+        if (error instanceof BundleDownloadError) throw error;
+        throw new BundleDownloadError(`Could not download bundle to ${options.download}`, { cause: error });
+      }
     }
-    if (!options.json) dependencies.writeStdout(`Downloaded bundle to ${options.download}
+    dependencies.activity.stop();
+    if (!options.json) {
+      writeHumanDetails(details, dependencies.writeStdout);
+      if (options.download) dependencies.writeStdout(`Downloaded bundle to ${options.download}
 `);
-  }
-  if (options.json) dependencies.writeStdout(`${JSON.stringify(detailsProjection2(details))}
+    }
+    if (options.json) dependencies.writeStdout(`${JSON.stringify(detailsProjection2(details))}
 `);
-  return 0;
+    return 0;
+  } finally {
+    dependencies.activity.stop();
+  }
 }
 
 // src/commands/trigger.ts
-import { randomBytes, randomUUID } from "crypto";
+import { randomBytes as randomBytes2, randomUUID } from "crypto";
 import { readFile } from "fs/promises";
 
 // src/trigger/destination.ts
@@ -628,7 +950,7 @@ async function runTriggerCommand(args, dependencies = {}) {
     fetch: dependencies.fetch ?? globalThis.fetch,
     now: dependencies.now ?? Date.now,
     randomUUID: dependencies.randomUUID ?? randomUUID,
-    randomBytes: dependencies.randomBytes ?? randomBytes,
+    randomBytes: dependencies.randomBytes ?? randomBytes2,
     readFile: dependencies.readFile ?? readFile,
     writeStdout: dependencies.writeStdout ?? ((text) => process.stdout.write(text))
   };
@@ -676,8 +998,49 @@ async function runTriggerCommand(args, dependencies = {}) {
   return 0;
 }
 
+// src/ui/activity.ts
+var FRAMES = ["\u28CB", "\u28D9", "\u28F9", "\u28F8", "\u28FC", "\u28F4", "\u28E6", "\u28E7", "\u28C7", "\u28CF"];
+var CLEAR_LINE = "\r\x1B[2K";
+function createActivityIndicator(write, enabled) {
+  let timer;
+  let frameIndex = 0;
+  let message = "";
+  let startedAt = 0;
+  const render = () => {
+    if (!timer && startedAt === 0) return;
+    const elapsedSeconds = Math.max(0, Math.floor((Date.now() - startedAt) / 1e3));
+    const elapsed = elapsedSeconds > 0 ? ` (${elapsedSeconds}s)` : "";
+    write(`${CLEAR_LINE}${FRAMES[frameIndex % FRAMES.length]} ${message}${elapsed}`);
+    frameIndex += 1;
+  };
+  return {
+    start(nextMessage) {
+      if (!enabled) return;
+      if (timer) clearInterval(timer);
+      message = nextMessage;
+      startedAt = Date.now();
+      frameIndex = 0;
+      render();
+      timer = setInterval(render, 80);
+      timer.unref?.();
+    },
+    update(nextMessage) {
+      if (!enabled || startedAt === 0) return;
+      message = nextMessage;
+      render();
+    },
+    stop() {
+      if (!enabled || startedAt === 0) return;
+      if (timer) clearInterval(timer);
+      timer = void 0;
+      startedAt = 0;
+      write(CLEAR_LINE);
+    }
+  };
+}
+
 // src/cli.ts
-var VERSION = "0.1.0";
+var VERSION = "0.2.1";
 var HELP = `MediaRuntime CLI
 
 Usage:
@@ -685,6 +1048,9 @@ Usage:
   mediaruntime jobs list [--status <status>] [--limit <n>] [--cursor <cursor>]
   mediaruntime jobs get <job_id> [--download <bundle.zip>] [--force]
   mediaruntime trigger <job.completed|job.failed|job.rejected> --to <local-url>
+  mediaruntime login [--no-browser]
+  mediaruntime auth status
+  mediaruntime logout [--local-only]
 
 Global options:
   --base-url <url>  Developer override; normally leave unset
@@ -694,7 +1060,7 @@ Global options:
 Run/jobs options:
   --json            Machine-readable, URL-redacted output
 
-Authentication uses MEDIARUNTIME_API_KEY.
+Authentication uses a secure login or MEDIARUNTIME_API_KEY.
 `;
 function isFileExistsError(error) {
   return error instanceof Error && "code" in error && error.code === "EEXIST";
@@ -728,7 +1094,7 @@ async function downloadBundleAtomically(url, destination, options) {
       throw new BundleDownloadError(`Bundle download failed with HTTP ${response.status}`);
     }
     if (!response.body) throw new BundleDownloadError("Bundle download returned an empty response body");
-    const hash = createHash("sha256");
+    const hash = createHash2("sha256");
     let sizeBytes = 0;
     const integrity = new Transform({
       transform(chunk, _encoding, callback) {
@@ -832,6 +1198,7 @@ async function executeCli(argv, dependencies = {}) {
   const writeStdout = dependencies.writeStdout ?? ((text) => process.stdout.write(text));
   const writeStderr = dependencies.writeStderr ?? ((text) => process.stderr.write(text));
   const json = argv.includes("--json");
+  const isStderrTTY = dependencies.isStderrTTY ?? (dependencies.writeStderr === void 0 && process.stderr.isTTY === true);
   try {
     const global = extractGlobalOptions(argv);
     const command = global.args[0];
@@ -849,14 +1216,39 @@ async function executeCli(argv, dependencies = {}) {
     }
     const configuredBaseUrl = global.baseUrl ?? process.env.MEDIARUNTIME_API_URL;
     const baseUrl = configuredBaseUrl ? normalizeBaseUrl(configuredBaseUrl) : void 0;
-    if (!dependencies.createClient && !process.env.MEDIARUNTIME_API_KEY?.trim()) {
-      throw new UsageError("Set MEDIARUNTIME_API_KEY before using run or jobs");
+    const authBaseUrl = baseUrl ?? PRODUCTION_ORIGIN;
+    const authDependencies = {
+      ...dependencies.credentialStore ? { credentialStore: dependencies.credentialStore } : {},
+      ...dependencies.openBrowser ? { openBrowser: dependencies.openBrowser } : {},
+      ...dependencies.sleep ? { sleep: dependencies.sleep } : {},
+      ...dependencies.now ? { now: dependencies.now } : {},
+      ...dependencies.randomVerifier ? { randomVerifier: dependencies.randomVerifier } : {},
+      writeStdout
+    };
+    if (command === "login") return await runLoginCommand(global.args.slice(1), authBaseUrl, authDependencies);
+    if (command === "auth") return await runAuthCommand(global.args.slice(1), authBaseUrl, authDependencies);
+    if (command === "logout") return await runLogoutCommand(global.args.slice(1), authBaseUrl, authDependencies);
+    let apiKey = process.env.MEDIARUNTIME_API_KEY?.trim();
+    if (!apiKey && (!dependencies.createClient || dependencies.credentialStore)) {
+      apiKey = (await resolveCredential(authBaseUrl, authDependencies))?.apiKey;
+    }
+    if (!dependencies.createClient && !apiKey) {
+      throw new UsageError("Run mediaruntime login or set MEDIARUNTIME_API_KEY before using run or jobs");
     }
     const client = dependencies.createClient?.({
-      ...baseUrl === void 0 ? {} : { baseUrl }
-    }) ?? new MediaRuntime({ ...baseUrl === void 0 ? {} : { baseUrl } });
+      ...baseUrl === void 0 ? {} : { baseUrl },
+      ...apiKey === void 0 ? {} : { apiKey }
+    }) ?? new MediaRuntime({
+      ...baseUrl === void 0 ? {} : { baseUrl },
+      ...apiKey === void 0 ? {} : { apiKey }
+    });
     const downloadBundle = dependencies.downloadBundle ?? downloadBundleAtomically;
-    const commandDependencies = { jobs: client.jobs, writeStdout, downloadBundle };
+    const commandDependencies = {
+      jobs: client.jobs,
+      writeStdout,
+      downloadBundle,
+      activity: createActivityIndicator(writeStderr, isStderrTTY && !json)
+    };
     if (command === "run") return await runCommand(global.args.slice(1), commandDependencies);
     if (command === "jobs") {
       return await runJobsCommand(global.args.slice(1), commandDependencies);
@@ -889,6 +1281,11 @@ export {
   downloadBundleAtomically,
   executeCli,
   parseTriggerArguments,
+  resolveCredential,
+  runAuthCommand,
+  runAuthStatusCommand,
+  runLoginCommand,
+  runLogoutCommand,
   runTriggerCommand,
   signSyntheticWebhook
 };