@nebulr-group/bridge-cli 0.1.0-beta.0 → 0.1.2

package/dist/commands/auth/login.command.js

@@ -0,0 +1,141 @@
+import { writeCredentials } from '../../credentials.js';
+import { resetManagementClient } from '../../config.js';
+import { generateCodeVerifier, codeChallengeFor, generateState } from '../../auth/pkce.js';
+import { startLoopback, LoopbackError } from '../../auth/loopback.js';
+import { openBrowser } from '../../auth/browser-open.js';
+import { createCliApiClient, CliAuthApiError } from '../../auth/api-client.js';
+const DEFAULT_API_BASE_URL = 'https://api.thebridge.dev';
+const DEFAULT_AUTH_BASE_URL = 'https://auth.thebridge.dev';
+export function registerAuthLoginCommand(auth) {
+    auth
+        .command('login')
+        .description('Authenticate via browser (loopback PKCE) and save credentials')
+        .option('--app <id|name>', 'Pin to a specific app (skips the picker on the consent screen)')
+        .option('--label <text>', 'Friendly label stored on the token (default: "bridge-cli")')
+        .option('--no-browser', 'Print the authorization URL instead of opening a browser')
+        .action(async (opts) => {
+        try {
+            await runLogin(opts);
+            process.exitCode = 0;
+        }
+        catch (err) {
+            // Friendly, single-line stderr — never log JWTs / verifiers.
+            const msg = err instanceof Error ? err.message : String(err);
+            process.stderr.write(`bridge auth login: ${msg}\n`);
+            process.exitCode = 1;
+        }
+    });
+}
+async function runLogin(opts) {
+    const apiBaseUrl = (process.env.BRIDGE_BASE_URL?.trim() || DEFAULT_API_BASE_URL).replace(/\/$/, '');
+    const authBaseUrl = (process.env.BRIDGE_AUTH_BASE_URL?.trim() || DEFAULT_AUTH_BASE_URL).replace(/\/$/, '');
+    // 1. PKCE + state.
+    const codeVerifier = generateCodeVerifier();
+    const codeChallenge = codeChallengeFor(codeVerifier);
+    const state = generateState();
+    // 2. Boot the single-shot loopback listener.
+    let loopback;
+    try {
+        loopback = await startLoopback({
+            expectedState: state,
+            // Bounce the browser to a branded success page on cloud-views instead
+            // of leaving the user staring at 127.0.0.1.
+            successRedirectUrl: `${authBaseUrl}/cli/login-complete`,
+        });
+    }
+    catch (err) {
+        throw new Error(`Could not bind a loopback port: ${err instanceof Error ? err.message : String(err)}. ` +
+            'Try `bridge auth login --device` once TBP-108 lands, or check whether your firewall blocks 127.0.0.1.');
+    }
+    const authorizeUrl = buildAuthorizeUrl(authBaseUrl, {
+        challenge: codeChallenge,
+        redirect: loopback.redirectUri,
+        state,
+        appId: opts.app,
+        label: opts.label,
+    });
+    // 3. Open browser (or print URL if --no-browser or open fails).
+    const stdout = process.stdout;
+    // commander's `--no-browser` sets opts.browser === false. Treat unset as the
+    // default (open browser); only skip when explicitly false.
+    const useBrowser = opts.browser !== false;
+    if (!useBrowser) {
+        stdout.write(`Open this URL in your browser to continue:\n  ${authorizeUrl}\n`);
+    }
+    else {
+        const open = await openBrowser(authorizeUrl);
+        if (!open.ok) {
+            stdout.write(`Could not open a browser automatically (${open.reason ?? 'unknown'}). ` +
+                `Open this URL manually:\n  ${authorizeUrl}\n`);
+        }
+        else {
+            stdout.write('Opened your browser. Waiting for authorization...\n');
+        }
+    }
+    // 4. Await the callback. Translate cancel/CSRF/timeout into friendly errors.
+    let result;
+    try {
+        result = await loopback.result;
+    }
+    catch (err) {
+        if (err instanceof LoopbackError) {
+            throw new Error(err.message);
+        }
+        throw err;
+    }
+    // 5. Exchange the code for a JWT.
+    const api = createCliApiClient({ baseUrl: apiBaseUrl });
+    let exchanged;
+    try {
+        exchanged = await api.exchangeCode({
+            code: result.code,
+            codeVerifier,
+        });
+    }
+    catch (err) {
+        if (err instanceof CliAuthApiError) {
+            throw new Error(err.message);
+        }
+        throw err;
+    }
+    // 6. Persist credentials with mode 0600.
+    const issuedAt = new Date().toISOString();
+    const stored = {
+        apiKey: exchanged.api_token,
+        expiresAt: exchanged.expires_at,
+        issuedAt,
+        app: { id: exchanged.app.id, name: exchanged.app.name },
+        user: { id: exchanged.user.id, email: exchanged.user.email },
+        baseUrl: apiBaseUrl,
+        ...(opts.label ? { label: opts.label } : {}),
+    };
+    writeCredentials(stored);
+    // Reset the cached BridgeManagement client so the next command picks up the
+    // new token (relevant when `auth login` is called within the same process).
+    resetManagementClient();
+    // 7. Friendly confirmation.
+    const expiryHuman = formatExpiryDate(exchanged.expires_at);
+    stdout.write(`Logged in as ${exchanged.user.email}. App: ${exchanged.app.name}. Token valid until ${expiryHuman}.\n`);
+}
+function buildAuthorizeUrl(authBaseUrl, params) {
+    const url = new URL(`${authBaseUrl}/cli/authorize`);
+    url.searchParams.set('challenge', params.challenge);
+    url.searchParams.set('redirect', params.redirect);
+    url.searchParams.set('state', params.state);
+    url.searchParams.set('scope', 'management');
+    if (params.appId)
+        url.searchParams.set('app_id', params.appId);
+    if (params.label)
+        url.searchParams.set('label', params.label);
+    return url.toString();
+}
+function formatExpiryDate(iso) {
+    const d = new Date(iso);
+    if (Number.isNaN(d.getTime()))
+        return iso;
+    // YYYY-MM-DD HH:MM (local) — easier to glance at than a full ISO.
+    const pad = (n) => String(n).padStart(2, '0');
+    return (`${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())} ` +
+        `${pad(d.getHours())}:${pad(d.getMinutes())}`);
+}
+//# sourceMappingURL=login.command.js.map

package/dist/commands/auth/login.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.command.js","sourceRoot":"","sources":["../../../src/commands/auth/login.command.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,gBAAgB,EAA0B,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE/E,MAAM,oBAAoB,GAAG,2BAA2B,CAAC;AACzD,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAY3D,MAAM,UAAU,wBAAwB,CAAC,IAAa;IACpD,IAAI;SACD,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,+DAA+D,CAAC;SAC5E,MAAM,CAAC,iBAAiB,EAAE,gEAAgE,CAAC;SAC3F,MAAM,CAAC,gBAAgB,EAAE,4DAA4D,CAAC;SACtF,MAAM,CAAC,cAAc,EAAE,0DAA0D,CAAC;SAClF,MAAM,CAAC,KAAK,EAAE,IAAkB,EAAE,EAAE;QACnC,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;YACrB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,6DAA6D;YAC7D,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;YACpD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAkB;IACxC,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,oBAAoB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACpG,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,qBAAqB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAE3G,mBAAmB;IACnB,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;IAC5C,MAAM,aAAa,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAE9B,6CAA6C;IAC7C,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,aAAa,CAAC;YAC7B,aAAa,EAAE,KAAK;YACpB,sEAAsE;YACtE,4CAA4C;YAC5C,kBAAkB,EAAE,GAAG,WAAW,qBAAqB;SACxD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,mCAAmC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI;YACrF,uGAAuG,CAC1G,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,iBAAiB,CAAC,WAAW,EAAE;QAClD,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,QAAQ,CAAC,WAAW;QAC9B,KAAK;QACL,KAAK,EAAE,IAAI,CAAC,GAAG;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IAEH,gEAAgE;IAChE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,6EAA6E;IAC7E,2DAA2D;IAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC;IAC1C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,CAAC,iDAAiD,YAAY,IAAI,CAAC,CAAC;IAClF,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CACV,2CAA2C,IAAI,CAAC,MAAM,IAAI,SAAS,KAAK;gBACtE,8BAA8B,YAAY,IAAI,CACjD,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,kCAAkC;IAClC,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IACxD,IAAI,SAAS,CAAC;IACd,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC;YACjC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,eAAe,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,yCAAyC;IACzC,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAsB;QAChC,MAAM,EAAE,SAAS,CAAC,SAAS;QAC3B,SAAS,EAAE,SAAS,CAAC,UAAU;QAC/B,QAAQ;QACR,GAAG,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE;QACvD,IAAI,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE;QAC5D,OAAO,EAAE,UAAU;QACnB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;IACF,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAEzB,4EAA4E;IAC5E,4EAA4E;IAC5E,qBAAqB,EAAE,CAAC;IAExB,4BAA4B;IAC5B,MAAM,WAAW,GAAG,gBAAgB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC3D,MAAM,CAAC,KAAK,CACV,gBAAgB,SAAS,CAAC,IAAI,CAAC,KAAK,UAAU,SAAS,CAAC,GAAG,CAAC,IAAI,uBAAuB,WAAW,KAAK,CACxG,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,WAAmB,EACnB,MAA8F;IAE9F,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,WAAW,gBAAgB,CAAC,CAAC;IACpD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAAE,OAAO,GAAG,CAAC;IAC1C,kEAAkE;IAClE,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtD,OAAO,CACL,GAAG,CAAC,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG;QAClE,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE,CAC9C,CAAC;AACJ,CAAC"}

package/dist/commands/auth/logout.command.d.ts

@@ -0,0 +1,14 @@
+/**
+ * `bridge auth logout` — best-effort revoke + delete credentials file.
+ *
+ * Behavior:
+ *   - No credentials file → "Not logged in." (exit 0).
+ *   - File present       → call `POST /v1/auth/cli/revoke` with `x-api-key`,
+ *                          treat 401 as success (token already gone), then
+ *                          delete the file. Network errors → warn but still
+ *                          delete (the local file is the source of truth for
+ *                          "logged in" on this machine).
+ */
+import type { Command } from 'commander';
+export declare function registerAuthLogoutCommand(auth: Command): void;
+//# sourceMappingURL=logout.command.d.ts.map

package/dist/commands/auth/logout.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.command.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/logout.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKzC,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAc7D"}

package/dist/commands/auth/logout.command.js

@@ -0,0 +1,57 @@
+import { credentialsPath, deleteCredentials, readCredentials } from '../../credentials.js';
+import { resetManagementClient } from '../../config.js';
+import { createCliApiClient, CliAuthApiError } from '../../auth/api-client.js';
+export function registerAuthLogoutCommand(auth) {
+    auth
+        .command('logout')
+        .description('Revoke the saved CLI token and delete local credentials')
+        .action(async () => {
+        try {
+            await runLogout();
+            process.exitCode = 0;
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            process.stderr.write(`bridge auth logout: ${msg}\n`);
+            process.exitCode = 1;
+        }
+    });
+}
+async function runLogout() {
+    const stdout = process.stdout;
+    const stderr = process.stderr;
+    let creds;
+    try {
+        creds = readCredentials();
+    }
+    catch (err) {
+        // Malformed credentials file — still try to delete it so the user gets unstuck.
+        stderr.write(`Warning: existing credentials file at ${credentialsPath()} could not be parsed (${err instanceof Error ? err.message : String(err)}). Removing it.\n`);
+        deleteCredentials();
+        stdout.write('Logged out (credentials file removed).\n');
+        return;
+    }
+    if (!creds) {
+        stdout.write('Not logged in.\n');
+        return;
+    }
+    const api = createCliApiClient({ baseUrl: creds.baseUrl });
+    try {
+        await api.revokeToken(creds.apiKey);
+    }
+    catch (err) {
+        // Network failure — warn but still proceed with local deletion.
+        if (err instanceof CliAuthApiError && err.code === 'network_error') {
+            stderr.write(`Warning: could not reach bridge-api to revoke server-side (${err.message}). Removing local credentials anyway.\n`);
+        }
+        else {
+            // Any other API error is also non-fatal for the local cleanup, but we
+            // surface it so the user knows the server-side revoke didn't happen.
+            stderr.write(`Warning: server-side revoke returned an error (${err instanceof Error ? err.message : String(err)}). Removing local credentials anyway.\n`);
+        }
+    }
+    deleteCredentials();
+    resetManagementClient();
+    stdout.write(`Logged out ${creds.user.email}.\n`);
+}
+//# sourceMappingURL=logout.command.js.map

package/dist/commands/auth/logout.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.command.js","sourceRoot":"","sources":["../../../src/commands/auth/logout.command.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE/E,MAAM,UAAU,yBAAyB,CAAC,IAAa;IACrD,IAAI;SACD,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,yDAAyD,CAAC;SACtE,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,SAAS,EAAE,CAAC;YAClB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;YACrD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAE9B,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,eAAe,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gFAAgF;QAChF,MAAM,CAAC,KAAK,CACV,yCAAyC,eAAe,EAAE,yBACxD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,mBAAmB,CACpB,CAAC;QACF,iBAAiB,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACzD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gEAAgE;QAChE,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,8DAA8D,GAAG,CAAC,OAAO,yCAAyC,CAAC,CAAC;QACnI,CAAC;aAAM,CAAC;YACN,sEAAsE;YACtE,qEAAqE;YACrE,MAAM,CAAC,KAAK,CACV,kDACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,yCAAyC,CAC1C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,iBAAiB,EAAE,CAAC;IACpB,qBAAqB,EAAE,CAAC;IACxB,MAAM,CAAC,KAAK,CAAC,cAAc,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;AACpD,CAAC"}

package/dist/commands/auth/status.command.d.ts

@@ -0,0 +1,14 @@
+/**
+ * `bridge auth status` — prints whether a credentials file exists, who it's
+ * for, and how long until it expires.
+ *
+ * Output is plain text (one key=value per line after the first), tuned for
+ * humans. Other CLI commands emit structured JSON — auth status is the one
+ * place where a developer is most likely to be eyeballing the result, so we
+ * optimize for readability over machine-parseability.
+ *
+ * If the user wants JSON, they can run `cat ~/.config/bridge/credentials.json`.
+ */
+import type { Command } from 'commander';
+export declare function registerAuthStatusCommand(auth: Command): void;
+//# sourceMappingURL=status.command.d.ts.map

package/dist/commands/auth/status.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.command.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/status.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIzC,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAc7D"}

package/dist/commands/auth/status.command.js

@@ -0,0 +1,59 @@
+import { credentialsPath, isExpired, readCredentials } from '../../credentials.js';
+import { formatRelativeTime } from '../../auth/relative-time.js';
+export function registerAuthStatusCommand(auth) {
+    auth
+        .command('status')
+        .description('Show current authentication state (who, which app, expiry)')
+        .action(() => {
+        try {
+            runStatus();
+            process.exitCode = 0;
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            process.stderr.write(`bridge auth status: ${msg}\n`);
+            process.exitCode = 1;
+        }
+    });
+}
+function runStatus() {
+    const stdout = process.stdout;
+    // Prefer the credentials file; report on `BRIDGE_API_KEY` separately if set
+    // (so a CI user setting the env var sees something useful).
+    const envApiKey = process.env.BRIDGE_API_KEY?.trim();
+    let creds;
+    try {
+        creds = readCredentials();
+    }
+    catch (err) {
+        stdout.write(`Credentials file at ${credentialsPath()} is unreadable: ${err instanceof Error ? err.message : String(err)}\n` + 'Run `bridge auth login` to refresh, or delete the file manually.\n');
+        return;
+    }
+    if (!creds) {
+        if (envApiKey && envApiKey.length > 0) {
+            stdout.write('Using BRIDGE_API_KEY from environment (service-account / CI path).\n' +
+                'Run `bridge auth login` to switch to interactive credentials.\n');
+            return;
+        }
+        stdout.write('Not logged in. Run `bridge auth login`.\n');
+        return;
+    }
+    const expiryDate = new Date(creds.expiresAt);
+    const expiryDelta = expiryDate.getTime() - Date.now();
+    const expiryRel = formatRelativeTime(expiryDelta);
+    const expiredLabel = isExpired(creds) ? ' (EXPIRED)' : '';
+    stdout.write(`Logged in as ${creds.user.email}\n`);
+    stdout.write(`  app=${creds.app.name} (${creds.app.id})\n`);
+    stdout.write(`  expires=${expiryRel} — ${creds.expiresAt}${expiredLabel}\n`);
+    stdout.write(`  baseUrl=${creds.baseUrl}\n`);
+    if (creds.label)
+        stdout.write(`  label=${creds.label}\n`);
+    stdout.write(`  credentials=${credentialsPath()}\n`);
+    if (envApiKey && envApiKey.length > 0) {
+        stdout.write('\nNote: BRIDGE_API_KEY is also set in your environment — it takes precedence over the credentials file.\n');
+    }
+    if (isExpired(creds)) {
+        process.exitCode = 0; // status is informational; don't fail just because expired.
+    }
+}
+//# sourceMappingURL=status.command.js.map

package/dist/commands/auth/status.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.command.js","sourceRoot":"","sources":["../../../src/commands/auth/status.command.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEjE,MAAM,UAAU,yBAAyB,CAAC,IAAa;IACrD,IAAI;SACD,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,GAAG,EAAE;QACX,IAAI,CAAC;YACH,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;YACrD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAE9B,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IAErD,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,eAAe,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,uBAAuB,eAAe,EAAE,mBACtC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,IAAI,GAAG,oEAAoE,CAC5E,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,KAAK,CACV,sEAAsE;gBACpE,iEAAiE,CACpE,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACtD,MAAM,SAAS,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IAE1D,MAAM,CAAC,KAAK,CAAC,gBAAgB,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,SAAS,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,CAAC,KAAK,CAAC,aAAa,SAAS,MAAM,KAAK,CAAC,SAAS,GAAG,YAAY,IAAI,CAAC,CAAC;IAC7E,MAAM,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,KAAK;QAAE,MAAM,CAAC,KAAK,CAAC,WAAW,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,iBAAiB,eAAe,EAAE,IAAI,CAAC,CAAC;IAErD,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,KAAK,CACV,2GAA2G,CAC5G,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,4DAA4D;IACpF,CAAC;AACH,CAAC"}

package/dist/commands/auth.command.d.ts

@@ -1,3 +1,12 @@
-import { Command } from 'commander';
+/**
+ * `bridge auth …` — top-level wiring for the auth command tree.
+ *
+ * Subcommand modules live in `./auth/*.command.ts`:
+ *   - `login`           (TBP-113): browser-based PKCE auth.
+ *   - `logout`          (TBP-113): revoke + delete credentials.
+ *   - `status`          (TBP-113): show current login state.
+ *   - `config`/`mfa`/`password-policy`: pre-existing app auth-config commands.
+ */
+import type { Command } from 'commander';
 export declare function registerAuthCommands(program: Command): void;
 //# sourceMappingURL=auth.command.d.ts.map

package/dist/commands/auth.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.command.d.ts","sourceRoot":"","sources":["../../src/commands/auth.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAiD3D"}
+{"version":3,"file":"auth.command.d.ts","sourceRoot":"","sources":["../../src/commands/auth.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMzC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAY3D"}

package/dist/commands/auth.command.js

@@ -1,58 +1,16 @@
-import { getManagementClient } from '../config.js';
-import { outputSuccess, outputError } from '../output.js';
+import { registerAuthLoginCommand } from './auth/login.command.js';
+import { registerAuthLogoutCommand } from './auth/logout.command.js';
+import { registerAuthStatusCommand } from './auth/status.command.js';
+import { registerAuthConfigCommands } from './auth/config.command.js';
 export function registerAuthCommands(program) {
-    const auth = program.command('auth').description('Manage authentication configuration');
-    auth.command('config')
-        .description('Get current auth configuration')
-        .action(async () => {
-        try {
-            const app = await getManagementClient().app.get();
-            outputSuccess({
-                mfaEnabled: app.mfaEnabled,
-                passkeysEnabled: app.passkeysEnabled,
-                magicLinkEnabled: app.magicLinkEnabled,
-                googleSsoEnabled: app.googleSsoEnabled,
-                azureAdSsoEnabled: app.azureAdSsoEnabled,
-                githubSsoEnabled: app.githubSsoEnabled,
-                linkedinSsoEnabled: app.linkedinSsoEnabled,
-                facebookSsoEnabled: app.facebookSsoEnabled,
-                appleSsoEnabled: app.appleSsoEnabled,
-                onboardingFlow: app.onboardingFlow,
-                tenantSelfSignup: app.tenantSelfSignup,
-                accessTokenTTL: app.accessTokenTTL,
-                refreshTokenTTL: app.refreshTokenTTL,
-            });
-        }
-        catch (err) {
-            outputError(err);
-        }
-    });
-    auth.command('mfa')
-        .description('Enable or disable MFA')
-        .requiredOption('--enabled <bool>', 'true or false', (v) => v === 'true')
-        .action(async (opts) => {
-        try {
-            outputSuccess(await getManagementClient().app.update({ mfaEnabled: opts.enabled }));
-        }
-        catch (err) {
-            outputError(err);
-        }
-    });
-    auth.command('password-policy')
-        .description('Update access token TTL')
-        .option('--access-token-ttl <seconds>', 'Access token TTL in seconds', parseInt)
-        .option('--refresh-token-ttl <seconds>', 'Refresh token TTL in seconds', parseInt)
-        .action(async (opts) => {
-        try {
-            const data = Object.fromEntries(Object.entries({
-                accessTokenTTL: opts.accessTokenTtl,
-                refreshTokenTTL: opts.refreshTokenTtl,
-            }).filter(([, v]) => v !== undefined));
-            outputSuccess(await getManagementClient().app.update(data));
-        }
-        catch (err) {
-            outputError(err);
-        }
-    });
+    const auth = program
+        .command('auth')
+        .description('Authenticate with Bridge and manage app auth configuration');
+    // TBP-113 — interactive credentials.
+    registerAuthLoginCommand(auth);
+    registerAuthLogoutCommand(auth);
+    registerAuthStatusCommand(auth);
+    // Pre-existing — app-level auth configuration.
+    registerAuthConfigCommands(auth);
 }
 //# sourceMappingURL=auth.command.js.map

package/dist/commands/auth.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.command.js","sourceRoot":"","sources":["../../src/commands/auth.command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE1D,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,qCAAqC,CAAC,CAAC;IAExF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;SACnB,WAAW,CAAC,gCAAgC,CAAC;SAC7C,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,mBAAmB,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YAClD,aAAa,CAAC;gBACZ,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;gBACtC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;gBACtC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;gBACxC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;gBACtC,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;gBAC1C,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;gBAC1C,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;gBACtC,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,eAAe,EAAE,GAAG,CAAC,eAAe;aACrC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;SAChB,WAAW,CAAC,uBAAuB,CAAC;SACpC,cAAc,CAAC,kBAAkB,EAAE,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC;SACxE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YAAC,aAAa,CAAC,MAAM,mBAAmB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAAC,CAAC;QAC5F,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEL,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;SAC5B,WAAW,CAAC,yBAAyB,CAAC;SACtC,MAAM,CAAC,8BAA8B,EAAE,6BAA6B,EAAE,QAAQ,CAAC;SAC/E,MAAM,CAAC,+BAA+B,EAAE,8BAA8B,EAAE,QAAQ,CAAC;SACjF,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAC7B,MAAM,CAAC,OAAO,CAAC;gBACb,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,eAAe,EAAE,IAAI,CAAC,eAAe;aACtC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CACtC,CAAC;YACF,aAAa,CAAC,MAAM,mBAAmB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"auth.command.js","sourceRoot":"","sources":["../../src/commands/auth.command.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAEtE,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,MAAM,IAAI,GAAG,OAAO;SACjB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,4DAA4D,CAAC,CAAC;IAE7E,qCAAqC;IACrC,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC/B,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChC,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAEhC,+CAA+C;IAC/C,0BAA0B,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC"}

package/dist/commands/guide.command.js

@@ -1,7 +1,7 @@
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { outputSuccess, outputError } from '../output.js';
-const GUIDE_BASE_URL = 'https://raw.githubusercontent.com/nebulr-group';
+const GUIDE_BASE_URL = 'https://raw.githubusercontent.com/thebridgedev';
 const GUIDE_REPOS = {
     react: 'bridge-react/main',
     svelte: 'bridge-svelte/main',
@@ -94,7 +94,7 @@ async function fetchGuide(tech, feature) {
     guideCache.set(cacheKey, { content, fetchedAt: Date.now() });
     return content;
 }
-const MASTER_PROMPT_GITHUB_URL = 'https://raw.githubusercontent.com/nebulr-group/bridge-cli/main/prompts/master-integration-prompt.md';
+const MASTER_PROMPT_GITHUB_URL = 'https://raw.githubusercontent.com/thebridgedev/bridge-cli/main/bridge-cli/prompts/master-integration-prompt.md';
 async function fetchMasterPrompt() {
     // Local override for development
     const localDir = process.env.BRIDGE_GUIDE_LOCAL_DIR;
@@ -121,7 +121,7 @@ This guide covers integrating Bridge into any language/framework using the REST
 Bridge issues JWTs signed with PS256. Verify them using your app's JWKS endpoint:
 
 \`\`\`
-GET https://account-api.thebridge.dev/v1/account/app/.well-known/jwks.json
+GET https://api.thebridge.dev/v1/account/app/.well-known/jwks.json
 \`\`\`
 
 Use a JWT library in your language that supports JWKS auto-refresh:
@@ -144,7 +144,7 @@ The access token contains:
 
 Evaluate flags server-side:
 \`\`\`
-POST https://account-api.thebridge.dev/cloud-views/flags/bulkEvaluate/{appId}
+POST https://api.thebridge.dev/cloud-views/flags/bulkEvaluate/{appId}
 Authorization: Bearer <user-access-token>
 \`\`\`
 
@@ -152,7 +152,7 @@ Authorization: Bearer <user-access-token>
 
 Use the Bridge REST API with an API token:
 \`\`\`
-GET https://account-api.thebridge.dev/v1/account/tenant
+GET https://api.thebridge.dev/v1/account/tenant
 x-api-key: <your-api-token>
 \`\`\`
 

package/dist/commands/guide.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"guide.command.js","sourceRoot":"","sources":["../../src/commands/guide.command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE1D,MAAM,cAAc,GAAG,gDAAgD,CAAC;AACxE,MAAM,WAAW,GAA2B;IAC1C,KAAK,EAAE,mBAAmB;IAC1B,MAAM,EAAE,oBAAoB;IAC5B,OAAO,EAAE,qBAAqB;IAC9B,MAAM,EAAE,oBAAoB;IAC5B,OAAO,EAAE,qBAAqB;IAC9B,MAAM,EAAE,oBAAoB;CAC7B,CAAC;AAEF,MAAM,kBAAkB,GAA6B;IACnD,MAAM,EAAE,CAAC,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,CAAC;CAC1D,CAAC;AAEF,SAAS,aAAa,CAAC,OAAgB;IACrC,IAAI,CAAC,OAAO;QAAE,OAAO,uBAAuB,CAAC;IAC7C,OAAO,GAAG,OAAO,YAAY,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkD,CAAC;AAC7E,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAEhD,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;SACnC,WAAW,CAAC,8EAA8E,CAAC;SAC3F,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;YAC1C,aAAa,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,MAAM,YAAY,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAC;IAE7D,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;SAClB,WAAW,CAAC,sDAAsD,CAAC;SACnE,MAAM,CAAC,GAAG,EAAE;QACX,aAAa,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEL,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5C,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;aAChB,QAAQ,CAAC,WAAW,EAAE,8DAA8D,CAAC;aACrF,WAAW,CAAC,yBAAyB,IAAI,EAAE,CAAC;aAC5C,MAAM,CAAC,KAAK,EAAE,OAAgB,EAAE,EAAE;YACjC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAChD,aAAa,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACrF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAAC,CAAC;QACrC,CAAC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;SACpB,WAAW,CAAC,sEAAsE,CAAC;SACnF,MAAM,CAAC,GAAG,EAAE;QACX,aAAa,CAAC;YACZ,UAAU,EAAE,QAAQ;YACpB,KAAK,EAAE,YAAY;SACpB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,OAAgB;IACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,YAAY,EAAE,CAAC;QAC3D,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;IAEhE,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAExC,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACpD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACpE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACnD,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC7D,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;QACxD,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,cAAc,IAAI,UAAU,QAAQ,QAAQ,EAAE,CAAC;IAC9D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAElC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,UAAU,QAAQ,CAAC,MAAM,0DAA0D,CAAC,CAAC;IACvI,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACtC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,wBAAwB,GAC5B,qGAAqG,CAAC;AAExG,KAAK,UAAU,iBAAiB;IAC9B,iCAAiC;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACpD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,8BAA8B,CAAC,CAAC;QACxG,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAChC,CAAC;IAED,eAAe;IACf,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACvD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iDAAiD,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoDpB,CAAC"}
+{"version":3,"file":"guide.command.js","sourceRoot":"","sources":["../../src/commands/guide.command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE1D,MAAM,cAAc,GAAG,gDAAgD,CAAC;AACxE,MAAM,WAAW,GAA2B;IAC1C,KAAK,EAAE,mBAAmB;IAC1B,MAAM,EAAE,oBAAoB;IAC5B,OAAO,EAAE,qBAAqB;IAC9B,MAAM,EAAE,oBAAoB;IAC5B,OAAO,EAAE,qBAAqB;IAC9B,MAAM,EAAE,oBAAoB;CAC7B,CAAC;AAEF,MAAM,kBAAkB,GAA6B;IACnD,MAAM,EAAE,CAAC,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,CAAC;CAC1D,CAAC;AAEF,SAAS,aAAa,CAAC,OAAgB;IACrC,IAAI,CAAC,OAAO;QAAE,OAAO,uBAAuB,CAAC;IAC7C,OAAO,GAAG,OAAO,YAAY,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkD,CAAC;AAC7E,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAEhD,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;SACnC,WAAW,CAAC,8EAA8E,CAAC;SAC3F,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;YAC1C,aAAa,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,MAAM,YAAY,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAC;IAE7D,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;SAClB,WAAW,CAAC,sDAAsD,CAAC;SACnE,MAAM,CAAC,GAAG,EAAE;QACX,aAAa,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEL,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5C,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;aAChB,QAAQ,CAAC,WAAW,EAAE,8DAA8D,CAAC;aACrF,WAAW,CAAC,yBAAyB,IAAI,EAAE,CAAC;aAC5C,MAAM,CAAC,KAAK,EAAE,OAAgB,EAAE,EAAE;YACjC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAChD,aAAa,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACrF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAAC,CAAC;QACrC,CAAC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;SACpB,WAAW,CAAC,sEAAsE,CAAC;SACnF,MAAM,CAAC,GAAG,EAAE;QACX,aAAa,CAAC;YACZ,UAAU,EAAE,QAAQ;YACpB,KAAK,EAAE,YAAY;SACpB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,OAAgB;IACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,YAAY,EAAE,CAAC;QAC3D,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;IAEhE,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAExC,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACpD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACpE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACnD,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC7D,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;QACxD,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,cAAc,IAAI,UAAU,QAAQ,QAAQ,EAAE,CAAC;IAC9D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAElC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,UAAU,QAAQ,CAAC,MAAM,0DAA0D,CAAC,CAAC;IACvI,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACtC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,wBAAwB,GAC5B,gHAAgH,CAAC;AAEnH,KAAK,UAAU,iBAAiB;IAC9B,iCAAiC;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACpD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,8BAA8B,CAAC,CAAC;QACxG,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAChC,CAAC;IAED,eAAe;IACf,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACvD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iDAAiD,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoDpB,CAAC"}

package/dist/config.d.ts

@@ -1,5 +1,29 @@
 import { BridgeManagement } from '@nebulr-group/bridge-auth-core';
+export declare const DEFAULT_BASE_URL = "https://api.thebridge.dev";
+/**
+ * Resolution order:
+ *   1. `~/.config/bridge/credentials.json` (or `$XDG_CONFIG_HOME/bridge/credentials.json`)
+ *      written by `bridge auth login`. The interactive primary path. Token
+ *      carries the appId baked in by /v1/auth/cli/token, so post-login the
+ *      JWT is the source of truth for which app the CLI operates on.
+ *   2. `BRIDGE_API_KEY` env var  (CI / service-account fallback). Used when no
+ *      credentials file exists — typical CI runner shape.
+ *   3. Throw `ConfigError("Not logged in. Run `bridge auth login`.")`.
+ *
+ * Note: credentials-file wins over env so `bridge auth login` does what users
+ * expect — the new login takes effect immediately. CI is unaffected because
+ * runners typically have no credentials file and fall through to step 2.
+ *
+ * If a credentials file exists but its `expiresAt` is in the past, we fall
+ * through to env (if set) — same as if there were no file. Otherwise throw a
+ * friendly error pointing the user back to `bridge auth login`.
+ */
 export declare function getManagementClient(): BridgeManagement;
+/**
+ * For tests and for `bridge auth logout` / `bridge auth status` — they need
+ * to reset the cached client between operations.
+ */
+export declare function resetManagementClient(): void;
 export declare function resolveTenantId(opts: {
     tenantId?: string;
 }): string;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAIlE,wBAAgB,mBAAmB,IAAI,gBAAgB,CAetD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAQnE;AAED,qBAAa,WAAY,SAAQ,KAAK;gBACxB,OAAO,EAAE,MAAM;CAI5B"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAGlE,eAAO,MAAM,gBAAgB,8BAA8B,CAAC;AAI5D;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,IAAI,gBAAgB,CA+CtD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAQnE;AAED,qBAAa,WAAY,SAAQ,KAAK;gBACxB,OAAO,EAAE,MAAM;CAI5B"}

package/dist/config.js

@@ -1,19 +1,75 @@
 import { BridgeManagement } from '@nebulr-group/bridge-auth-core';
+import { isExpired, readCredentials } from './credentials.js';
+export const DEFAULT_BASE_URL = 'https://api.thebridge.dev';
 let _client = null;
+/**
+ * Resolution order:
+ *   1. `~/.config/bridge/credentials.json` (or `$XDG_CONFIG_HOME/bridge/credentials.json`)
+ *      written by `bridge auth login`. The interactive primary path. Token
+ *      carries the appId baked in by /v1/auth/cli/token, so post-login the
+ *      JWT is the source of truth for which app the CLI operates on.
+ *   2. `BRIDGE_API_KEY` env var  (CI / service-account fallback). Used when no
+ *      credentials file exists — typical CI runner shape.
+ *   3. Throw `ConfigError("Not logged in. Run `bridge auth login`.")`.
+ *
+ * Note: credentials-file wins over env so `bridge auth login` does what users
+ * expect — the new login takes effect immediately. CI is unaffected because
+ * runners typically have no credentials file and fall through to step 2.
+ *
+ * If a credentials file exists but its `expiresAt` is in the past, we fall
+ * through to env (if set) — same as if there were no file. Otherwise throw a
+ * friendly error pointing the user back to `bridge auth login`.
+ */
 export function getManagementClient() {
     if (_client)
         return _client;
-    const apiKey = process.env.BRIDGE_API_KEY;
-    if (!apiKey) {
-        throw new ConfigError('BRIDGE_API_KEY environment variable is required.');
-    }
-    _client = new BridgeManagement({
-        apiKey,
-        baseUrl: process.env.BRIDGE_BASE_URL || undefined,
-        debug: process.env.BRIDGE_DEBUG === 'true',
-    });
+    const debug = process.env.BRIDGE_DEBUG === 'true';
+    const envApiKey = process.env.BRIDGE_API_KEY?.trim();
+    const envBaseUrl = process.env.BRIDGE_BASE_URL?.trim();
+    let apiKey;
+    let baseUrl;
+    let source;
+    // 1. Credentials file from `bridge auth login` (interactive primary).
+    const creds = safeReadCredentials();
+    if (creds && !isExpired(creds)) {
+        apiKey = creds.apiKey;
+        // Env override still wins for baseUrl (useful for hitting a local bridge-api
+        // with a token issued by prod, or vice versa during dev).
+        baseUrl = envBaseUrl && envBaseUrl.length > 0 ? envBaseUrl : creds.baseUrl;
+        source = 'credentials-file';
+    }
+    else if (envApiKey && envApiKey.length > 0) {
+        // 2. BRIDGE_API_KEY env var (CI / service-account fallback).
+        apiKey = envApiKey;
+        baseUrl = envBaseUrl && envBaseUrl.length > 0 ? envBaseUrl : DEFAULT_BASE_URL;
+        source = 'env';
+    }
+    else if (creds && isExpired(creds)) {
+        // 3a. Found a credentials file but token expired; no env fallback either.
+        throw new ConfigError('Token expired. Run `bridge auth login` to re-authenticate.');
+    }
+    else {
+        // 3b. No credentials at all.
+        throw new ConfigError('Not logged in. Run `bridge auth login`.');
+    }
+    if (debug) {
+        const baseSource = envBaseUrl && envBaseUrl.length > 0
+            ? 'env'
+            : source === 'env'
+                ? 'default'
+                : 'credentials-file';
+        console.error(`[bridge-cli] apiKey=<redacted from ${source}> baseUrl=${baseUrl} (${baseSource})`);
+    }
+    _client = new BridgeManagement({ apiKey, baseUrl, debug });
     return _client;
 }
+/**
+ * For tests and for `bridge auth logout` / `bridge auth status` — they need
+ * to reset the cached client between operations.
+ */
+export function resetManagementClient() {
+    _client = null;
+}
 export function resolveTenantId(opts) {
     const tenantId = opts.tenantId || process.env.BRIDGE_TENANT_ID;
     if (!tenantId) {
@@ -27,4 +83,18 @@ export class ConfigError extends Error {
         this.name = 'ConfigError';
     }
 }
+/**
+ * Wraps `readCredentials()` so a malformed file produces a `ConfigError` (caught
+ * by `outputError`) rather than a raw `Error` stack trace. Returns `null` if
+ * the file just doesn't exist (caller decides what to do).
+ */
+function safeReadCredentials() {
+    try {
+        return readCredentials();
+    }
+    catch (err) {
+        throw new ConfigError(`Could not read credentials file: ${err instanceof Error ? err.message : String(err)}\n` +
+            'Run `bridge auth login` to refresh, or delete the file manually.');
+    }
+}
 //# sourceMappingURL=config.js.map