@nebulr-group/bridge-cli 0.4.4 → 0.5.1-beta.0

package/README.md

@@ -27,10 +27,48 @@ bridge auth login
 Opens your default browser, runs through a PKCE-secured loopback flow (RFC 8252), and stores a 10-day token at `~/.config/bridge/credentials.json` (mode `0600`). After that, every subsequent `bridge` command picks the token up automatically — no env vars needed.
 
 ```bash
-bridge auth status   # show who you're logged in as and when the token expires
-bridge auth logout   # revoke the token and delete the credentials file
+bridge auth status   # show every stored app, and which one is active
+bridge auth logout   # revoke the active token and remove it locally
 ```
 
+#### Several apps at once
+
+The credentials file holds one credential per app, so you can log in to your
+local, stage and prod apps and move between them without a browser round-trip —
+the tokens are already on disk with days left on them.
+
+```bash
+bridge auth login --label northwhistle-local     # once per app
+bridge auth login --label northwhistle-prod
+
+bridge auth status                               # lists both, marks the active one
+bridge auth use northwhistle-local               # switch the default, offline
+bridge --profile northwhistle-prod app get       # target ONE command, default untouched
+```
+
+A profile is selected by its `--label`, its app id, or its app name, in that
+order. An ambiguous name is an error rather than a guess. `BRIDGE_PROFILE` does
+the same thing as `--profile` for a whole shell session.
+
+Prefer `--profile` over `bridge auth use` in scripts and long-running agent
+sessions: `use` mutates state another process may be reading, `--profile` does
+not.
+
+Every command prints one line to **stderr** naming the app that answered:
+
+```
+bridge: northwhistle-prod (606b4416fabdc800087d09ec) · https://api.thebridge.dev · via saved default
+```
+
+stdout stays pure JSON, so this does not disturb anything parsing it. Silence it
+with `BRIDGE_NO_BANNER=true` if you are already certain which app you are on.
+
+`bridge auth logout` removes the active app only. Use `--profile <name>` for a
+specific one, or `--all` to clear the file.
+
+Existing single-app credentials files keep working and are upgraded in place the
+next time something writes.
+
 #### `bridge auth login` flags
 
 | Flag | Description |
@@ -56,7 +94,17 @@ For non-interactive contexts (CI/CD pipelines, Docker images, headless agents) s
 export BRIDGE_API_KEY=<your-api-token>
 ```
 
-If you have logged in via `bridge auth login`, the credentials file always wins — a fresh login takes effect immediately, even when `BRIDGE_API_KEY` is still exported in your shell. `BRIDGE_API_KEY` is only used when no credentials file is present (the typical CI runner shape). To switch back to env-var auth on a developer machine, run `bridge auth logout` first.
+If you have logged in via `bridge auth login`, the credentials file always wins — a fresh login takes effect immediately, even when `BRIDGE_API_KEY` is still exported in your shell. `BRIDGE_API_KEY` is only used when no credentials file is present (the typical CI runner shape). To switch back to env-var auth on a developer machine, run `bridge auth logout --all` first.
+
+Because that trips people up, the CLI now says so at the moment it happens: with
+both present you get a line on stderr telling you `BRIDGE_API_KEY` is set and
+being ignored, and what to do instead. To point the CLI at a different app, use
+`--profile`, not the env vars.
+
+**`BRIDGE_APP_ID` has no effect on any path.** The app is carried by the
+credential itself — a login token and an API key are both already scoped to one
+app, so there is nothing for it to change. It is called out on stderr whenever it
+is set, rather than being quietly ignored.
 
 Optional configuration (applies to both auth paths):
 
@@ -139,8 +187,11 @@ bridge auth login                # default: open browser, complete PKCE flow
 bridge auth login --app acme     # pin to a specific app
 bridge auth login --label "work laptop"
 bridge auth login --no-browser   # print the URL (headless / SSH)
-bridge auth status               # show current login state
-bridge auth logout               # revoke token + delete local file
+bridge auth status               # show every stored app, active one marked
+bridge auth use <label|app-id>   # switch the default app, no browser
+bridge auth logout               # revoke + remove the active app
+bridge auth logout --all         # ...or every stored app
+bridge --profile <label> <cmd>   # target one app for one command
 ```
 
 ### Auth Configuration (app-level — separate from `auth login`)
@@ -268,10 +319,20 @@ bridge event list --type USER_CREATED --since 24h --limit 50
 
 ```bash
 bridge setup sso --provider google --client-id <id> --client-secret <secret>
+bridge setup sso --provider azure --client-id <id> --client-secret <secret> --tenant-id <entra-directory-id>
 bridge setup payments --stripe-key sk_test_xxx
-bridge setup communication --provider sendgrid --api-key <key> --from-address noreply@acme.com
+bridge setup communication --from-address noreply@acme.com --from-name "Acme"
 ```
 
+`setup sso` supports google, github, linkedin, facebook and azure (azure also
+needs the Entra ID Directory (tenant) ID). SAML and OIDC are not supported by
+the Bridge API; set them up in the Bridge admin UI. The command prints the
+callback URL to register in the provider's console.
+
+`setup communication` sets only the sender name and address. Bridge sends all
+email through its own provider, so there is no provider or API key to
+configure. A new sender address is verified by email before Bridge uses it.
+
 ### Info (context for AI agents)
 
 ```bash

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAwBpC,eAAO,MAAM,OAAO,SAAgB,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAyBpC,eAAO,MAAM,OAAO,SAAgB,CAAC"}

package/dist/cli.js

@@ -18,6 +18,7 @@ import { registerInfoCommands } from './commands/info.command.js';
 import { registerGuideCommands } from './commands/guide.command.js';
 import { registerOpsCommands } from './commands/ops.command.js';
 import { registerStripeCommands } from './commands/stripe.command.js';
+import { setProfileOverride } from './config.js';
 // Read version from package.json so `bridge --version` never drifts from the
 // published package. dist/cli.js lives at <pkg>/dist/cli.js, so `../package.json`
 // resolves to the package root in both the published tarball and during dev.
@@ -27,7 +28,18 @@ export const program = new Command();
 program
     .name('bridge')
     .description('Bridge platform CLI — optimized for AI coding agents')
-    .version(version);
+    .version(version)
+    // TBP-628 — target another stored app for ONE command, without touching the
+    // persisted default another process may be reading. Named `--profile` rather
+    // than `--app` because `bridge auth login --app` already exists and means
+    // something different (which app to authorise), and because `--profile` is
+    // what aws/npm users already reach for.
+    .option('--profile <label|app-id|app-name>', 'Use a specific stored credential for this command (env: BRIDGE_PROFILE)');
+// Runs before any subcommand action, so `getManagementClient()` sees the
+// override wherever in the tree it is eventually called from.
+program.hook('preAction', (thisCommand) => {
+    setProfileOverride(thisCommand.opts().profile);
+});
 registerAppCommands(program);
 registerTenantCommands(program);
 registerUserCommands(program);

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAEtE,6EAA6E;AAC7E,kFAAkF;AAClF,6EAA6E;AAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;AACpF,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAwB,CAAC;AAErF,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAErC,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CAAC,sDAAsD,CAAC;KACnE,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,yBAAyB,CAAC,OAAO,CAAC,CAAC;AACnC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,wBAAwB,CAAC,OAAO,CAAC,CAAC;AAClC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,sBAAsB,CAAC,OAAO,CAAC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,6EAA6E;AAC7E,kFAAkF;AAClF,6EAA6E;AAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;AACpF,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAwB,CAAC;AAErF,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAErC,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CAAC,sDAAsD,CAAC;KACnE,OAAO,CAAC,OAAO,CAAC;IACjB,4EAA4E;IAC5E,6EAA6E;IAC7E,0EAA0E;IAC1E,2EAA2E;IAC3E,wCAAwC;KACvC,MAAM,CACL,mCAAmC,EACnC,yEAAyE,CAC1E,CAAC;AAEJ,yEAAyE;AACzE,8DAA8D;AAC9D,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE;IACxC,kBAAkB,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,OAA6B,CAAC,CAAC;AACvE,CAAC,CAAC,CAAC;AAEH,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,yBAAyB,CAAC,OAAO,CAAC,CAAC;AACnC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,wBAAwB,CAAC,OAAO,CAAC,CAAC;AAClC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,sBAAsB,CAAC,OAAO,CAAC,CAAC"}

package/dist/commands/auth/logout.command.d.ts

@@ -3,11 +3,18 @@
  *
  * Behavior:
  *   - No credentials file → "Not logged in." (exit 0).
- *   - File present       → call `POST /v1/auth/cli/revoke` with `x-api-key`,
+ *   - Otherwise          → call `POST /v1/auth/cli/revoke` with `x-api-key`,
  *                          treat 401 as success (token already gone), then
- *                          delete the file. Network errors → warn but still
- *                          delete (the local file is the source of truth for
+ *                          remove it locally. Network errors → warn but still
+ *                          remove (the local file is the source of truth for
  *                          "logged in" on this machine).
+ *
+ * TBP-628 — the file can hold several apps, so logout now has a scope.
+ * Bare `logout` removes the ACTIVE credential and leaves the others; the
+ * alternative, wiping every app because you finished with one of them, throws
+ * away valid tokens and forces browser round-trips to get them back, which is
+ * the friction this ticket exists to remove. `--profile` names one, `--all`
+ * asks for the old whole-file behaviour explicitly.
  */
 import type { Command } from 'commander';
 export declare function registerAuthLogoutCommand(auth: Command): void;

package/dist/commands/auth/logout.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logout.command.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/logout.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKzC,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAc7D"}
+{"version":3,"file":"logout.command.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/logout.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAczC,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAgB7D"}

package/dist/commands/auth/logout.command.js

@@ -1,13 +1,15 @@
-import { credentialsPath, deleteCredentials, readCredentials } from '../../credentials.js';
+import { credentialsPath, CredentialSelectorError, deleteAllCredentials, findCredential, listCredentials, readCredentials, removeCredential, } from '../../credentials.js';
 import { resetManagementClient } from '../../config.js';
 import { createCliApiClient, CliAuthApiError } from '../../auth/api-client.js';
 export function registerAuthLogoutCommand(auth) {
     auth
         .command('logout')
-        .description('Revoke the saved CLI token and delete local credentials')
-        .action(async () => {
+        .description('Revoke the active CLI token and remove it locally')
+        .option('--profile <label|app-id|app-name>', 'Log out of one specific stored app')
+        .option('--all', 'Log out of every stored app and delete the credentials file')
+        .action(async (opts) => {
         try {
-            await runLogout();
+            await runLogout(opts);
             process.exitCode = 0;
         }
         catch (err) {
@@ -17,41 +19,79 @@ export function registerAuthLogoutCommand(auth) {
         }
     });
 }
-async function runLogout() {
+async function runLogout(opts = {}) {
     const stdout = process.stdout;
     const stderr = process.stderr;
-    let creds;
+    let entries;
     try {
-        creds = readCredentials();
+        entries = listCredentials();
     }
     catch (err) {
-        // Malformed credentials file — still try to delete it so the user gets unstuck.
+        // Malformed credentials file — still delete it so the user gets unstuck.
         stderr.write(`Warning: existing credentials file at ${credentialsPath()} could not be parsed (${err instanceof Error ? err.message : String(err)}). Removing it.\n`);
-        deleteCredentials();
+        deleteAllCredentials();
         stdout.write('Logged out (credentials file removed).\n');
         return;
     }
-    if (!creds) {
+    if (entries.length === 0) {
         stdout.write('Not logged in.\n');
         return;
     }
+    if (opts.all) {
+        for (const entry of entries)
+            await revoke(entry.creds, stderr);
+        deleteAllCredentials();
+        resetManagementClient();
+        stdout.write(`Logged out of ${entries.length} app(s).\n`);
+        return;
+    }
+    let target;
+    if (opts.profile) {
+        try {
+            target = findCredential(opts.profile);
+        }
+        catch (err) {
+            if (err instanceof CredentialSelectorError)
+                throw new Error(err.message);
+            throw err;
+        }
+    }
+    else {
+        const active = readCredentials();
+        if (!active) {
+            // Several stored, none active. Removing one by guess is exactly the
+            // silent choice this ticket forbids.
+            throw new Error('No active credential. Name one with `--profile <label|app id>`, or use `--all`. ' +
+                `Stored: ${entries.map((e) => e.creds.label ?? e.creds.app.name).join(', ')}.`);
+        }
+        target = entries.find((e) => e.key === active.app.id);
+    }
+    await revoke(target.creds, stderr);
+    const remaining = removeCredential(target.key);
+    resetManagementClient();
+    const name = target.creds.label ?? target.creds.app.name;
+    stdout.write(`Logged out ${target.creds.user.email} from ${name}.\n`);
+    if (remaining > 0) {
+        const rest = listCredentials();
+        const nowActive = rest.find((e) => e.isActive);
+        stdout.write(`  ${remaining} credential(s) still stored` +
+            (nowActive ? `; now using ${nowActive.creds.label ?? nowActive.creds.app.name}` : '') +
+            '.\n');
+    }
+}
+/** Best-effort server-side revoke. Never fatal — local removal is the point. */
+async function revoke(creds, stderr) {
     const api = createCliApiClient({ baseUrl: creds.baseUrl });
     try {
         await api.revokeToken(creds.apiKey);
     }
     catch (err) {
-        // Network failure — warn but still proceed with local deletion.
         if (err instanceof CliAuthApiError && err.code === 'network_error') {
-            stderr.write(`Warning: could not reach bridge-api to revoke server-side (${err.message}). Removing local credentials anyway.\n`);
+            stderr.write(`Warning: could not reach bridge-api to revoke ${creds.app.name} server-side (${err.message}). Removing local credentials anyway.\n`);
         }
         else {
-            // Any other API error is also non-fatal for the local cleanup, but we
-            // surface it so the user knows the server-side revoke didn't happen.
-            stderr.write(`Warning: server-side revoke returned an error (${err instanceof Error ? err.message : String(err)}). Removing local credentials anyway.\n`);
+            stderr.write(`Warning: server-side revoke for ${creds.app.name} returned an error (${err instanceof Error ? err.message : String(err)}). Removing local credentials anyway.\n`);
         }
     }
-    deleteCredentials();
-    resetManagementClient();
-    stdout.write(`Logged out ${creds.user.email}.\n`);
 }
 //# sourceMappingURL=logout.command.js.map

package/dist/commands/auth/logout.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"logout.command.js","sourceRoot":"","sources":["../../../src/commands/auth/logout.command.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE/E,MAAM,UAAU,yBAAyB,CAAC,IAAa;IACrD,IAAI;SACD,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,yDAAyD,CAAC;SACtE,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,SAAS,EAAE,CAAC;YAClB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;YACrD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAE9B,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,eAAe,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gFAAgF;QAChF,MAAM,CAAC,KAAK,CACV,yCAAyC,eAAe,EAAE,yBACxD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,mBAAmB,CACpB,CAAC;QACF,iBAAiB,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACzD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gEAAgE;QAChE,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,8DAA8D,GAAG,CAAC,OAAO,yCAAyC,CAAC,CAAC;QACnI,CAAC;aAAM,CAAC;YACN,sEAAsE;YACtE,qEAAqE;YACrE,MAAM,CAAC,KAAK,CACV,kDACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,yCAAyC,CAC1C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,iBAAiB,EAAE,CAAC;IACpB,qBAAqB,EAAE,CAAC;IACxB,MAAM,CAAC,KAAK,CAAC,cAAc,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"logout.command.js","sourceRoot":"","sources":["../../../src/commands/auth/logout.command.ts"],"names":[],"mappings":"AAmBA,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,eAAe,EACf,gBAAgB,GAEjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE/E,MAAM,UAAU,yBAAyB,CAAC,IAAa;IACrD,IAAI;SACD,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,mDAAmD,CAAC;SAChE,MAAM,CAAC,mCAAmC,EAAE,oCAAoC,CAAC;SACjF,MAAM,CAAC,OAAO,EAAE,6DAA6D,CAAC;SAC9E,MAAM,CAAC,KAAK,EAAE,IAAyC,EAAE,EAAE;QAC1D,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;YACtB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;YACrD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAA4C,EAAE;IACrE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAE9B,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,eAAe,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yEAAyE;QACzE,MAAM,CAAC,KAAK,CACV,yCAAyC,eAAe,EAAE,yBACxD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,mBAAmB,CACpB,CAAC;QACF,oBAAoB,EAAE,CAAC;QACvB,MAAM,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACzD,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,KAAK,MAAM,KAAK,IAAI,OAAO;YAAE,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/D,oBAAoB,EAAE,CAAC;QACvB,qBAAqB,EAAE,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,iBAAiB,OAAO,CAAC,MAAM,YAAY,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IAED,IAAI,MAAM,CAAC;IACX,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,uBAAuB;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACzE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,oEAAoE;YACpE,qCAAqC;YACrC,MAAM,IAAI,KAAK,CACb,kFAAkF;gBAChF,WAAW,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACjF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC;IACzD,CAAC;IAED,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC/C,qBAAqB,EAAE,CAAC;IAExB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,cAAc,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC;IACtE,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CACV,KAAK,SAAS,6BAA6B;YACzC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,KAAK,CACR,CAAC;IACJ,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,MAAM,CAAC,KAAwB,EAAE,MAA0B;IACxE,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACnE,MAAM,CAAC,KAAK,CACV,iDAAiD,KAAK,CAAC,GAAG,CAAC,IAAI,iBAAiB,GAAG,CAAC,OAAO,yCAAyC,CACrI,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CACV,mCAAmC,KAAK,CAAC,GAAG,CAAC,IAAI,uBAC/C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,yCAAyC,CAC1C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/commands/auth/status.command.d.ts

@@ -8,6 +8,10 @@
  * optimize for readability over machine-parseability.
  *
  * If the user wants JSON, they can run `cat ~/.config/bridge/credentials.json`.
+ *
+ * TBP-628 — the file can hold several apps, so this lists ALL of them and marks
+ * the active one. Knowing which app is in force is the whole reason somebody
+ * runs this command, and it was already the only place that told them.
  */
 import type { Command } from 'commander';
 export declare function registerAuthStatusCommand(auth: Command): void;

package/dist/commands/auth/status.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.command.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/status.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIzC,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAc7D"}
+{"version":3,"file":"status.command.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/status.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAUzC,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAc7D"}

package/dist/commands/auth/status.command.js

@@ -1,4 +1,4 @@
-import { credentialsPath, isExpired, readCredentials } from '../../credentials.js';
+import { credentialsPath, isExpired, listCredentials, readCredentialsFile, } from '../../credentials.js';
 import { formatRelativeTime } from '../../auth/relative-time.js';
 export function registerAuthStatusCommand(auth) {
     auth
@@ -18,18 +18,20 @@ export function registerAuthStatusCommand(auth) {
 }
 function runStatus() {
     const stdout = process.stdout;
-    // Prefer the credentials file; report on `BRIDGE_API_KEY` separately if set
-    // (so a CI user setting the env var sees something useful).
+    // Report on `BRIDGE_API_KEY` separately if set, so a CI user setting the env
+    // var sees something useful.
     const envApiKey = process.env.BRIDGE_API_KEY?.trim();
-    let creds;
+    const envProfile = process.env.BRIDGE_PROFILE?.trim();
+    let entries;
     try {
-        creds = readCredentials();
+        readCredentialsFile();
+        entries = listCredentials();
     }
     catch (err) {
         stdout.write(`Credentials file at ${credentialsPath()} is unreadable: ${err instanceof Error ? err.message : String(err)}\n` + 'Run `bridge auth login` to refresh, or delete the file manually.\n');
         return;
     }
-    if (!creds) {
+    if (entries.length === 0) {
         if (envApiKey && envApiKey.length > 0) {
             stdout.write('Using BRIDGE_API_KEY from environment (service-account / CI path).\n' +
                 'Run `bridge auth login` to switch to interactive credentials.\n');
@@ -38,22 +40,51 @@ function runStatus() {
         stdout.write('Not logged in. Run `bridge auth login`.\n');
         return;
     }
-    const expiryDate = new Date(creds.expiresAt);
-    const expiryDelta = expiryDate.getTime() - Date.now();
-    const expiryRel = formatRelativeTime(expiryDelta);
-    const expiredLabel = isExpired(creds) ? ' (EXPIRED)' : '';
-    stdout.write(`Logged in as ${creds.user.email}\n`);
-    stdout.write(`  app=${creds.app.name} (${creds.app.id})\n`);
-    stdout.write(`  expires=${expiryRel} — ${creds.expiresAt}${expiredLabel}\n`);
-    stdout.write(`  baseUrl=${creds.baseUrl}\n`);
-    if (creds.label)
-        stdout.write(`  label=${creds.label}\n`);
+    const active = entries.find((e) => e.isActive);
+    if (active) {
+        stdout.write(`Logged in as ${active.creds.user.email}\n`);
+    }
+    else {
+        // A pointer at a credential that is gone. Say so rather than picking one:
+        // an inferred default is exactly what this ticket is about.
+        stdout.write('No active credential selected — run `bridge auth use <profile>` to pick one.\n');
+    }
+    for (const entry of entries) {
+        writeEntry(entry, entries.length > 1);
+    }
     stdout.write(`  credentials=${credentialsPath()}\n`);
+    if (entries.length > 1) {
+        stdout.write('\nSwitch the default with `bridge auth use <label|app id>`, ' +
+            'or target one command with `--profile <label|app id>`.\n');
+    }
+    if (envProfile) {
+        stdout.write(`\nBRIDGE_PROFILE=${envProfile} is set — it overrides the active credential above.\n`);
+    }
     if (envApiKey && envApiKey.length > 0) {
-        stdout.write('\nNote: BRIDGE_API_KEY is also set in your environment — it takes precedence over the credentials file.\n');
+        // This used to claim the opposite. The credentials file has always won;
+        // saying otherwise is how somebody comes to believe they retargeted the
+        // CLI when they did not (TBP-628).
+        stdout.write('\nNote: BRIDGE_API_KEY is set in your environment but is IGNORED while a ' +
+            'credentials file exists.\nTo use it, run `bridge auth logout --all`. ' +
+            'To target another stored app, use `--profile`.\n');
     }
-    if (isExpired(creds)) {
-        process.exitCode = 0; // status is informational; don't fail just because expired.
+    if (process.env.BRIDGE_APP_ID?.trim()) {
+        stdout.write('\nNote: BRIDGE_APP_ID has no effect. The app is carried by the credential ' +
+            'itself; use `--profile <label|app id>` to target another one.\n');
     }
 }
+function writeEntry(entry, showMarker) {
+    const stdout = process.stdout;
+    const { creds } = entry;
+    const expiryDelta = new Date(creds.expiresAt).getTime() - Date.now();
+    const expiryRel = formatRelativeTime(expiryDelta);
+    const expiredLabel = isExpired(creds) ? ' (EXPIRED)' : '';
+    const marker = showMarker ? (entry.isActive ? '* ' : '  ') : '';
+    stdout.write(`  ${marker}app=${creds.app.name} (${creds.app.id})\n`);
+    if (creds.label)
+        stdout.write(`  ${marker}  label=${creds.label}\n`);
+    stdout.write(`  ${marker}  user=${creds.user.email}\n`);
+    stdout.write(`  ${marker}  expires=${expiryRel} — ${creds.expiresAt}${expiredLabel}\n`);
+    stdout.write(`  ${marker}  baseUrl=${creds.baseUrl}\n`);
+}
 //# sourceMappingURL=status.command.js.map

package/dist/commands/auth/status.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"status.command.js","sourceRoot":"","sources":["../../../src/commands/auth/status.command.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEjE,MAAM,UAAU,yBAAyB,CAAC,IAAa;IACrD,IAAI;SACD,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,GAAG,EAAE;QACX,IAAI,CAAC;YACH,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;YACrD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAE9B,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IAErD,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,eAAe,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,uBAAuB,eAAe,EAAE,mBACtC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,IAAI,GAAG,oEAAoE,CAC5E,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,KAAK,CACV,sEAAsE;gBACpE,iEAAiE,CACpE,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACtD,MAAM,SAAS,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IAE1D,MAAM,CAAC,KAAK,CAAC,gBAAgB,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,SAAS,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,CAAC,KAAK,CAAC,aAAa,SAAS,MAAM,KAAK,CAAC,SAAS,GAAG,YAAY,IAAI,CAAC,CAAC;IAC7E,MAAM,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,KAAK;QAAE,MAAM,CAAC,KAAK,CAAC,WAAW,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,iBAAiB,eAAe,EAAE,IAAI,CAAC,CAAC;IAErD,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,KAAK,CACV,2GAA2G,CAC5G,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,4DAA4D;IACpF,CAAC;AACH,CAAC"}
+{"version":3,"file":"status.command.js","sourceRoot":"","sources":["../../../src/commands/auth/status.command.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,eAAe,EACf,SAAS,EACT,eAAe,EACf,mBAAmB,GAEpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEjE,MAAM,UAAU,yBAAyB,CAAC,IAAa;IACrD,IAAI;SACD,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,GAAG,EAAE;QACX,IAAI,CAAC;YACH,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;YACrD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAE9B,6EAA6E;IAC7E,6BAA6B;IAC7B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IACrD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IAEtD,IAAI,OAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,mBAAmB,EAAE,CAAC;QACtB,OAAO,GAAG,eAAe,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,uBAAuB,eAAe,EAAE,mBACtC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,IAAI,GAAG,oEAAoE,CAC5E,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,KAAK,CACV,sEAAsE;gBACpE,iEAAiE,CACpE,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,KAAK,CAAC,gBAAgB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;IAC5D,CAAC;SAAM,CAAC;QACN,0EAA0E;QAC1E,4DAA4D;QAC5D,MAAM,CAAC,KAAK,CACV,gFAAgF,CACjF,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,iBAAiB,eAAe,EAAE,IAAI,CAAC,CAAC;IAErD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,KAAK,CACV,8DAA8D;YAC5D,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CACV,oBAAoB,UAAU,uDAAuD,CACtF,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,wEAAwE;QACxE,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,CAAC,KAAK,CACV,2EAA2E;YACzE,uEAAuE;YACvE,kDAAkD,CACrD,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,KAAK,CACV,4EAA4E;YAC1E,iEAAiE,CACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAsB,EAAE,UAAmB;IAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAExB,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACrE,MAAM,SAAS,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEhE,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IACrE,IAAI,KAAK,CAAC,KAAK;QAAE,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,WAAW,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;IACrE,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,UAAU,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,aAAa,SAAS,MAAM,KAAK,CAAC,SAAS,GAAG,YAAY,IAAI,CAAC,CAAC;IACxF,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,aAAa,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;AAC1D,CAAC"}

package/dist/commands/auth/use.command.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `bridge auth use <profile>` — move the persisted default to another stored
+ * credential, without a browser round-trip (TBP-628).
+ *
+ * The credential is already on disk with days left on it; switching is a
+ * pointer move. Before this existed the only way to change apps was
+ * `auth logout` + `auth login`, which discarded a perfectly valid token and
+ * cost a browser trip, so people did not switch — they ran commands against
+ * whichever app happened to be active and read the answers as if they came
+ * from the one they meant.
+ *
+ * For a single command, prefer `--profile` / `BRIDGE_PROFILE`: this command
+ * mutates state that other processes read.
+ */
+import type { Command } from 'commander';
+export declare function registerAuthUseCommand(auth: Command): void;
+//# sourceMappingURL=use.command.d.ts.map

package/dist/commands/auth/use.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use.command.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/use.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAUzC,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAc1D"}

package/dist/commands/auth/use.command.js

@@ -0,0 +1,47 @@
+import { CredentialSelectorError, findCredential, isExpired, listCredentials, setActiveCredential, } from '../../credentials.js';
+import { resetManagementClient } from '../../config.js';
+export function registerAuthUseCommand(auth) {
+    auth
+        .command('use <profile>')
+        .description('Switch the default app to another stored credential (no re-login)')
+        .action((profile) => {
+        try {
+            runUse(profile);
+            process.exitCode = 0;
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            process.stderr.write(`bridge auth use: ${msg}\n`);
+            process.exitCode = 1;
+        }
+    });
+}
+function runUse(profile) {
+    const stdout = process.stdout;
+    let entry;
+    try {
+        entry = findCredential(profile);
+    }
+    catch (err) {
+        if (err instanceof CredentialSelectorError)
+            throw new Error(err.message);
+        throw err;
+    }
+    setActiveCredential(entry.key);
+    resetManagementClient();
+    const name = entry.creds.label ?? entry.creds.app.name;
+    stdout.write(`Now using ${name} — ${entry.creds.app.name} (${entry.creds.app.id})\n`);
+    stdout.write(`  baseUrl=${entry.creds.baseUrl}\n`);
+    // Switching TO an expired credential is allowed — it is the user's stated
+    // intent, and refusing would leave them unable to make it the default before
+    // re-authenticating it. But it must not be a surprise at the next command.
+    if (isExpired(entry.creds)) {
+        stdout.write(`  WARNING: this credential expired ${entry.creds.expiresAt}. ` +
+            'Run `bridge auth login` to refresh it.\n');
+    }
+    const others = listCredentials().filter((e) => e.key !== entry.key);
+    if (others.length > 0) {
+        stdout.write(`  also stored: ${others.map((e) => e.creds.label ?? e.creds.app.name).join(', ')}\n`);
+    }
+}
+//# sourceMappingURL=use.command.js.map

package/dist/commands/auth/use.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"use.command.js","sourceRoot":"","sources":["../../../src/commands/auth/use.command.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,SAAS,EACT,eAAe,EACf,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD,MAAM,UAAU,sBAAsB,CAAC,IAAa;IAClD,IAAI;SACD,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,mEAAmE,CAAC;SAChF,MAAM,CAAC,CAAC,OAAe,EAAE,EAAE;QAC1B,IAAI,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,CAAC;YAChB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;YAClD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,MAAM,CAAC,OAAe;IAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAE9B,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,uBAAuB;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzE,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,qBAAqB,EAAE,CAAC;IAExB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;IACvD,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IACtF,MAAM,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;IAEnD,0EAA0E;IAC1E,6EAA6E;IAC7E,2EAA2E;IAC3E,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,KAAK,CACV,sCAAsC,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI;YAC7D,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,KAAK,CACV,kBAAkB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACtF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/commands/auth.command.d.ts

@@ -5,6 +5,7 @@
  *   - `login`           (TBP-113): browser-based PKCE auth.
  *   - `logout`          (TBP-113): revoke + delete credentials.
  *   - `status`          (TBP-113): show current login state.
+ *   - `use`             (TBP-628): switch the default app, offline.
  *   - `config`/`mfa`/`password-policy`: pre-existing app auth-config commands.
  */
 import type { Command } from 'commander';

package/dist/commands/auth.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.command.d.ts","sourceRoot":"","sources":["../../src/commands/auth.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMzC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAY3D"}
+{"version":3,"file":"auth.command.d.ts","sourceRoot":"","sources":["../../src/commands/auth.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOzC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAe3D"}

package/dist/commands/auth.command.js

@@ -1,6 +1,7 @@
 import { registerAuthLoginCommand } from './auth/login.command.js';
 import { registerAuthLogoutCommand } from './auth/logout.command.js';
 import { registerAuthStatusCommand } from './auth/status.command.js';
+import { registerAuthUseCommand } from './auth/use.command.js';
 import { registerAuthConfigCommands } from './auth/config.command.js';
 export function registerAuthCommands(program) {
     const auth = program
@@ -10,6 +11,8 @@ export function registerAuthCommands(program) {
     registerAuthLoginCommand(auth);
     registerAuthLogoutCommand(auth);
     registerAuthStatusCommand(auth);
+    // TBP-628 — several apps side by side; switch without a browser round-trip.
+    registerAuthUseCommand(auth);
     // Pre-existing — app-level auth configuration.
     registerAuthConfigCommands(auth);
 }

package/dist/commands/auth.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.command.js","sourceRoot":"","sources":["../../src/commands/auth.command.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAEtE,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,MAAM,IAAI,GAAG,OAAO;SACjB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,4DAA4D,CAAC,CAAC;IAE7E,qCAAqC;IACrC,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC/B,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChC,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAEhC,+CAA+C;IAC/C,0BAA0B,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC"}
+{"version":3,"file":"auth.command.js","sourceRoot":"","sources":["../../src/commands/auth.command.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAEtE,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,MAAM,IAAI,GAAG,OAAO;SACjB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,4DAA4D,CAAC,CAAC;IAE7E,qCAAqC;IACrC,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC/B,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAChC,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAEhC,4EAA4E;IAC5E,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAE7B,+CAA+C;IAC/C,0BAA0B,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC"}

package/dist/commands/setup.command.d.ts

@@ -1,3 +1,63 @@
 import { Command } from 'commander';
+export declare const SSO_PROVIDERS: {
+    readonly google: {
+        readonly clientId: "googleClientId";
+        readonly clientSecret: "googleClientSecret";
+        readonly enable: "googleSsoEnabled";
+    };
+    readonly github: {
+        readonly clientId: "githubClientId";
+        readonly clientSecret: "githubClientSecret";
+        readonly enable: "githubSsoEnabled";
+    };
+    readonly linkedin: {
+        readonly clientId: "linkedinClientId";
+        readonly clientSecret: "linkedinClientSecret";
+        readonly enable: "linkedinSsoEnabled";
+    };
+    readonly facebook: {
+        readonly clientId: "facebookClientId";
+        readonly clientSecret: "facebookClientSecret";
+        readonly enable: "facebookSsoEnabled";
+    };
+    readonly azure: {
+        readonly clientId: "microsoftAzureADClientId";
+        readonly clientSecret: "microsoftAzureADClientSecret";
+        readonly tenantId: "microsoftAzureADTenantId";
+        readonly enable: "azureAdSsoEnabled";
+    };
+};
+export type SupportedSsoProvider = keyof typeof SSO_PROVIDERS;
+/** Carries a machine-readable `code`, which `outputError` reports. */
+export declare class SetupError extends Error {
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+export interface SetupSsoOptions {
+    provider: string;
+    clientId?: string;
+    clientSecret?: string;
+    tenantId?: string;
+    metadataUrl?: string;
+    discoveryUrl?: string;
+}
+export declare function setupSso(opts: SetupSsoOptions): Promise<{
+    provider: "google" | "github" | "linkedin" | "facebook" | "azure";
+    enabled: boolean;
+    callbackUrl: string;
+    app: import("@nebulr-group/bridge-auth-core").AppResponse;
+}>;
+export interface SetupCommunicationOptions {
+    fromAddress?: string;
+    fromName?: string;
+    provider?: string;
+    apiKey?: string;
+}
+export declare function setupCommunication(opts: SetupCommunicationOptions): Promise<{
+    configured: boolean;
+    emailSenderEmail: string | null;
+    emailSenderName: string | null;
+    app: import("@nebulr-group/bridge-auth-core").AppResponse;
+}>;
 export declare function registerSetupCommands(program: Command): void;
 //# sourceMappingURL=setup.command.d.ts.map