@nebulr-group/bridge-cli 0.6.0-beta.7 → 0.6.0-beta.9

package/README.md

@@ -31,6 +31,30 @@ bridge auth status   # show every stored app, and which one is active
 bridge auth logout   # revoke the active token and remove it locally
 ```
 
+#### One login, every app of the workspace
+
+By default the consent screen preselects **Every app in <workspace>**, so one
+login covers all your apps — the same way the MCP server does. The app you pin
+at login (`--app`) is the *home* app; switch between the others locally:
+
+```bash
+bridge auth login                         # Logged in as you@acme.com. Workspace: every app (home app: Acme)
+bridge app list                           # every app, marking home and current
+bridge app use "Acme Stage"               # the default for every command, no re-login
+bridge app create --name "Acme Prod" --use
+bridge --app 66f0c0ffee0000000000abcd role list   # one command on another app
+```
+
+Precedence: `--app` > `bridge app use` > the home app. `--profile` still picks
+*which stored login*; `--app` picks the app *within* it. Acting on a non-home
+app prints `bridge: Acting on app <name> (<id>)` to stderr. Per-app tokens live
+only in memory for that one command and are never written to disk.
+
+`bridge auth login --single-app` asks for a login that covers only the home app
+(the user can still change the choice on the consent screen). On such a login,
+`--app` / `bridge app use` for another app fail and tell you to log in again.
+`BRIDGE_API_KEY` is always bound to its one app.
+
 #### Several apps at once
 
 The credentials file holds one credential per app, so you can log in to your
@@ -73,7 +97,8 @@ next time something writes.
 
 | Flag | Description |
 |------|-------------|
-| `--app <id\|name>` | Pin to a specific app, skipping the picker on the consent screen. |
+| `--app <id\|name>` | Pin the home app, skipping the picker on the consent screen. |
+| `--single-app`    | Preselect "only this app" instead of "every app in the workspace" on the consent screen. |
 | `--label <text>`  | Friendly label stored on the token (default: `bridge-cli`). Useful when listing CLI tokens at `app.thebridge.dev/keys`. |
 | `--no-browser`    | Print the authorization URL instead of opening a browser. Use this on headless boxes or over SSH. |
 
@@ -191,7 +216,11 @@ bridge auth status               # show every stored app, active one marked
 bridge auth use <label|app-id>   # switch the default app, no browser
 bridge auth logout               # revoke + remove the active app
 bridge auth logout --all         # ...or every stored app
-bridge --profile <label> <cmd>   # target one app for one command
+bridge --profile <label> <cmd>   # target one stored login for one command
+bridge app list                  # apps this login covers (home + current marked)
+bridge app use <id|name>         # switch app within a workspace login, no browser
+bridge app create --name <n> [--callback-url <url>] [--use]
+bridge --app <id|name> <cmd>     # one command on another app of the workspace
 ```
 
 ### Auth Configuration (app-level — separate from `auth login`)

package/dist/auth/api-client.d.ts

@@ -21,6 +21,8 @@ export interface CliTokenExchangeResponse {
         id: string;
         email: string;
     };
+    /** TBP-769 — what the login covers. Absent from servers before TBP-769. */
+    app_access?: 'app' | 'workspace';
 }
 export interface CliApiClientOptions {
     /** Base URL of bridge-api, e.g. `https://api.thebridge.dev`. No trailing slash. */

package/dist/auth/api-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../../src/auth/api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACrC;AAED,MAAM,WAAW,mBAAmB;IAClC,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kEAAkE;IAClE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,uFAAuF;IACvF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAM1D;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB;yBAU3B;QAChC,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,CAAC;KACtB,KAAG,OAAO,CAAC,wBAAwB,CAAC;yBA+BH,MAAM,KAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;EA2BzE"}
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../../src/auth/api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACpC,2EAA2E;IAC3E,UAAU,CAAC,EAAE,KAAK,GAAG,WAAW,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kEAAkE;IAClE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,uFAAuF;IACvF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAM1D;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB;yBAU3B;QAChC,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,CAAC;KACtB,KAAG,OAAO,CAAC,wBAAwB,CAAC;yBA+BH,MAAM,KAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;EA2BzE"}

package/dist/auth/api-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../../src/auth/api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAkBH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,uFAAuF;IAC9E,IAAI,CAAS;IACb,MAAM,CAAS;IACxB,YAAY,IAAY,EAAE,OAAe,EAAE,MAAc;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA4B;IAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IAExD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,IAG3B;QACC,MAAM,GAAG,GAAG,GAAG,OAAO,oBAAoB,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,aAAa,EAAE,IAAI,CAAC,YAAY;aACjC,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA6B,CAAC;QAC5D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,qEAAqE,EACrE,GAAG,CAAC,MAAM,CACX,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,WAAW,CAAC,KAAa;QACtC,MAAM,GAAG,GAAG,GAAG,OAAO,qBAAqB,CAAC;QAC5C,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;gBACzB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,WAAW,EAAE,KAAK;iBACnB;gBACD,IAAI,EAAE,IAAI;aACX,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,4DAA4D;YAC5D,MAAM,IAAI,eAAe,CACvB,eAAe,EACf,+CAA+C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACjG,CAAC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACrC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,4BAA4B;QAC9E,MAAM,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAa;IACzC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,eAAe,CACxB,YAAY,EACZ,4BAA4B,GAAG,CAAC,MAAM,GAAG,EACzC,GAAG,CAAC,MAAM,CACX,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;IACnF,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC;IACtE,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;IAE3F,IAAI,QAAgB,CAAC;IACrB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,iBAAiB;YACpB,QAAQ,GAAG,IAAI,IAAI,8CAA8C,CAAC;YAClE,MAAM;QACR,KAAK,eAAe;YAClB,QAAQ,GAAG,mGAAmG,CAAC;YAC/G,MAAM;QACR,KAAK,eAAe;YAClB,QAAQ,GAAG,oGAAoG,CAAC;YAChH,MAAM;QACR,KAAK,eAAe;YAClB,QAAQ,GAAG,kBAAkB,CAAC;YAC9B,MAAM;QACR;YACE,QAAQ,GAAG,IAAI,IAAI,4BAA4B,GAAG,CAAC,MAAM,GAAG,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;AACzD,CAAC"}
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../../src/auth/api-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAoBH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,uFAAuF;IAC9E,IAAI,CAAS;IACb,MAAM,CAAS;IACxB,YAAY,IAAY,EAAE,OAAe,EAAE,MAAc;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA4B;IAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IAExD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,IAG3B;QACC,MAAM,GAAG,GAAG,GAAG,OAAO,oBAAoB,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,aAAa,EAAE,IAAI,CAAC,YAAY;aACjC,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA6B,CAAC;QAC5D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,qEAAqE,EACrE,GAAG,CAAC,MAAM,CACX,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,WAAW,CAAC,KAAa;QACtC,MAAM,GAAG,GAAG,GAAG,OAAO,qBAAqB,CAAC;QAC5C,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;gBACzB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,WAAW,EAAE,KAAK;iBACnB;gBACD,IAAI,EAAE,IAAI;aACX,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,4DAA4D;YAC5D,MAAM,IAAI,eAAe,CACvB,eAAe,EACf,+CAA+C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACjG,CAAC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACrC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,4BAA4B;QAC9E,MAAM,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAa;IACzC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,eAAe,CACxB,YAAY,EACZ,4BAA4B,GAAG,CAAC,MAAM,GAAG,EACzC,GAAG,CAAC,MAAM,CACX,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;IACnF,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC;IACtE,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;IAE3F,IAAI,QAAgB,CAAC;IACrB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,iBAAiB;YACpB,QAAQ,GAAG,IAAI,IAAI,8CAA8C,CAAC;YAClE,MAAM;QACR,KAAK,eAAe;YAClB,QAAQ,GAAG,mGAAmG,CAAC;YAC/G,MAAM;QACR,KAAK,eAAe;YAClB,QAAQ,GAAG,oGAAoG,CAAC;YAChH,MAAM;QACR,KAAK,eAAe;YAClB,QAAQ,GAAG,kBAAkB,CAAC;YAC9B,MAAM;QACR;YACE,QAAQ,GAAG,IAAI,IAAI,4BAA4B,GAAG,CAAC,MAAM,GAAG,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;AACzD,CAAC"}

package/dist/auth/workspace-client.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Thin client for the bridge-api `/v1/cli/workspace/*` routes (TBP-769).
+ *
+ * One `bridge auth login` covers every app of the workspace (unless the user
+ * chose "only this app" on the consent screen). These routes are how the CLI
+ * lists those apps, creates one, and trades the login token for a short-lived
+ * token for ANOTHER app — the same shape the MCP server's `app` argument uses.
+ *
+ * Every call authenticates with the LOGIN token (`x-api-key`); per-app tokens
+ * are never accepted here, and are never written to disk by the CLI.
+ *
+ * Errors come back as `{ code, message, fix }`. They are surfaced as a
+ * `WorkspaceApiError` whose `code` and `hint` (= the server's `fix`) are picked
+ * up by `outputError`, so the reader gets the next step, not just the failure.
+ */
+export interface WorkspaceApp {
+    id: string;
+    name: string;
+    home: boolean;
+}
+export interface WorkspaceAppsResponse {
+    scope: 'workspace' | 'app';
+    homeAppId: string;
+    apps: WorkspaceApp[];
+}
+export interface WorkspaceAppToken {
+    apiKey: string;
+    expiresAt: string;
+    app: {
+        id: string;
+        name: string;
+    };
+}
+export declare class WorkspaceApiError extends Error {
+    readonly code: string;
+    readonly hint?: string;
+    readonly status: number;
+    constructor(code: string, message: string, status: number, hint?: string);
+}
+export interface WorkspaceClientOptions {
+    baseUrl: string;
+    /** The `bridge auth login` token. */
+    loginToken: string;
+    fetchImpl?: typeof fetch;
+}
+export declare function createWorkspaceClient(options: WorkspaceClientOptions): {
+    listApps: () => Promise<WorkspaceAppsResponse>;
+    appToken: (appId: string) => Promise<WorkspaceAppToken>;
+    createApp: (input: {
+        name: string;
+        callbackUrl?: string;
+    }) => Promise<{
+        app: {
+            id: string;
+            name: string;
+        };
+    }>;
+};
+/** App ids are Mongo ObjectIds. Anything else is treated as an app name. */
+export declare function looksLikeAppId(value: string): boolean;
+/**
+ * Resolve `<id|name>` against a list of apps. Id first (exact), then name
+ * (case-insensitive). Two apps sharing a name is an ERROR, never a first match
+ * — acting on the wrong app is the failure this whole area exists to prevent.
+ */
+export declare function resolveAppSelector<T extends {
+    id: string;
+    name: string;
+}>(selector: string, apps: T[]): T;
+//# sourceMappingURL=workspace-client.d.ts.map

package/dist/auth/workspace-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-client.d.ts","sourceRoot":"","sources":["../../src/auth/workspace-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,WAAW,GAAG,KAAK,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACnC;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM;CAOzE;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB;;sBA4B/C,MAAM;uBAEL;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;aAC3C;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE;;EAE7C;AA2BD,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACvE,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,CAAC,EAAE,GACR,CAAC,CAqBH"}

package/dist/auth/workspace-client.js

@@ -0,0 +1,105 @@
+/**
+ * Thin client for the bridge-api `/v1/cli/workspace/*` routes (TBP-769).
+ *
+ * One `bridge auth login` covers every app of the workspace (unless the user
+ * chose "only this app" on the consent screen). These routes are how the CLI
+ * lists those apps, creates one, and trades the login token for a short-lived
+ * token for ANOTHER app — the same shape the MCP server's `app` argument uses.
+ *
+ * Every call authenticates with the LOGIN token (`x-api-key`); per-app tokens
+ * are never accepted here, and are never written to disk by the CLI.
+ *
+ * Errors come back as `{ code, message, fix }`. They are surfaced as a
+ * `WorkspaceApiError` whose `code` and `hint` (= the server's `fix`) are picked
+ * up by `outputError`, so the reader gets the next step, not just the failure.
+ */
+export class WorkspaceApiError extends Error {
+    code;
+    hint;
+    status;
+    constructor(code, message, status, hint) {
+        super(message);
+        this.name = 'WorkspaceApiError';
+        this.code = code;
+        this.status = status;
+        if (hint)
+            this.hint = hint;
+    }
+}
+export function createWorkspaceClient(options) {
+    const baseUrl = options.baseUrl.replace(/\/$/, '');
+    const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    async function call(method, path, body) {
+        let res;
+        try {
+            res = await fetchImpl(`${baseUrl}/v1/cli/workspace${path}`, {
+                method,
+                headers: {
+                    'x-api-key': options.loginToken,
+                    ...(body !== undefined ? { 'content-type': 'application/json' } : {}),
+                },
+                ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+            });
+        }
+        catch (err) {
+            throw new WorkspaceApiError('NETWORK_ERROR', `Could not reach ${baseUrl}: ${err instanceof Error ? err.message : String(err)}`, 0);
+        }
+        if (!res.ok)
+            throw await translateError(res);
+        return (await res.json());
+    }
+    return {
+        listApps: () => call('GET', '/apps'),
+        appToken: (appId) => call('POST', `/apps/${encodeURIComponent(appId)}/token`),
+        createApp: (input) => call('POST', '/apps', input),
+    };
+}
+async function translateError(res) {
+    let raw;
+    try {
+        raw = await res.json();
+    }
+    catch {
+        raw = undefined;
+    }
+    const obj = (raw && typeof raw === 'object' ? raw : {});
+    const str = (v) => (typeof v === 'string' && v.length > 0 ? v : undefined);
+    let code = str(obj.code) ?? `HTTP_${res.status}`;
+    let message = str(obj.message) ?? `Bridge API returned HTTP ${res.status}.`;
+    let fix = str(obj.fix);
+    if (res.status === 401) {
+        code = str(obj.code) ?? 'UNAUTHORIZED';
+        if (!str(obj.message))
+            message = 'Your login is no longer valid.';
+        fix = fix ?? 'Run `bridge auth login` again.';
+    }
+    else if (res.status === 403 && !fix && !str(obj.code)) {
+        // A token that is not a `bridge auth login` token (e.g. BRIDGE_API_KEY).
+        fix = 'App selection needs a `bridge auth login` credential.';
+    }
+    return new WorkspaceApiError(code, message, res.status, fix);
+}
+/** App ids are Mongo ObjectIds. Anything else is treated as an app name. */
+export function looksLikeAppId(value) {
+    return /^[a-f0-9]{24}$/i.test(value.trim());
+}
+/**
+ * Resolve `<id|name>` against a list of apps. Id first (exact), then name
+ * (case-insensitive). Two apps sharing a name is an ERROR, never a first match
+ * — acting on the wrong app is the failure this whole area exists to prevent.
+ */
+export function resolveAppSelector(selector, apps) {
+    const needle = selector.trim();
+    const byId = apps.find((a) => a.id === needle);
+    if (byId)
+        return byId;
+    const lower = needle.toLowerCase();
+    const byName = apps.filter((a) => a.name.toLowerCase() === lower);
+    if (byName.length === 1)
+        return byName[0];
+    if (byName.length > 1) {
+        throw new WorkspaceApiError('APP_AMBIGUOUS', `"${needle}" matches ${byName.length} apps by name (${byName.map((a) => a.id).join(', ')}).`, 0, 'Select the app by id instead. `bridge app list` shows them.');
+    }
+    throw new WorkspaceApiError('APP_NOT_FOUND', `No app in this login matches "${needle}". Known: ${apps.map((a) => `${a.name} (${a.id})`).join(', ') || '(none)'}.`, 0, 'Run `bridge app list` to see the apps this login covers.');
+}
+//# sourceMappingURL=workspace-client.js.map

package/dist/auth/workspace-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-client.js","sourceRoot":"","sources":["../../src/auth/workspace-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAoBH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,CAAS;IACb,IAAI,CAAU;IACd,MAAM,CAAS;IACxB,YAAY,IAAY,EAAE,OAAe,EAAE,MAAc,EAAE,IAAa;QACtE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAC7B,CAAC;CACF;AASD,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IACnE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IAExD,KAAK,UAAU,IAAI,CAAI,MAAsB,EAAE,IAAY,EAAE,IAAc;QACzE,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,oBAAoB,IAAI,EAAE,EAAE;gBAC1D,MAAM;gBACN,OAAO,EAAE;oBACP,WAAW,EAAE,OAAO,CAAC,UAAU;oBAC/B,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtE;gBACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,iBAAiB,CACzB,eAAe,EACf,mBAAmB,OAAO,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACjF,CAAC,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;QAC7C,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;IACjC,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAwB,KAAK,EAAE,OAAO,CAAC;QAC3D,QAAQ,EAAE,CAAC,KAAa,EAAE,EAAE,CAC1B,IAAI,CAAoB,MAAM,EAAE,SAAS,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC7E,SAAS,EAAE,CAAC,KAA6C,EAAE,EAAE,CAC3D,IAAI,CAAwC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAa;IACzC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;IACnF,MAAM,GAAG,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAEpF,IAAI,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;IACjD,IAAI,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,4BAA4B,GAAG,CAAC,MAAM,GAAG,CAAC;IAC5E,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAEvB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,GAAG,gCAAgC,CAAC;QAClE,GAAG,GAAG,GAAG,IAAI,gCAAgC,CAAC;IAChD,CAAC;SAAM,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,yEAAyE;QACzE,GAAG,GAAG,uDAAuD,CAAC;IAChE,CAAC;IACD,OAAO,IAAI,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAgB,EAChB,IAAS;IAET,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;IAC/C,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,iBAAiB,CACzB,eAAe,EACf,IAAI,MAAM,aAAa,MAAM,CAAC,MAAM,kBAAkB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAC5F,CAAC,EACD,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,iBAAiB,CACzB,eAAe,EACf,iCAAiC,MAAM,aAAa,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,GAAG,EACpH,CAAC,EACD,0DAA0D,CAC3D,CAAC;AACJ,CAAC"}

package/dist/bin.js

@@ -1,6 +1,9 @@
 #!/usr/bin/env node
 import { program } from './cli.js';
 program.parseAsync(process.argv).catch(() => {
-    process.exitCode = 1;
+    // Keep a more specific code already set (e.g. 3 for a config error printed
+    // by the preAction hook before it aborted the action).
+    if (!process.exitCode)
+        process.exitCode = 1;
 });
 //# sourceMappingURL=bin.js.map

package/dist/bin.js.map

@@ -1 +1 @@
-{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEnC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;IAC1C,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEnC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;IAC1C,2EAA2E;IAC3E,uDAAuD;IACvD,IAAI,CAAC,OAAO,CAAC,QAAQ;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AAC9C,CAAC,CAAC,CAAC"}

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAUpC,eAAO,MAAM,OAAO,SAAgB,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AASpC,eAAO,MAAM,OAAO,SAAgB,CAAC"}

package/dist/cli.js

@@ -2,8 +2,7 @@ import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 import { Command } from 'commander';
-import { setProfileOverride } from './config.js';
-import { registerCommands } from './program.js';
+import { registerCommands, registerGlobalOptions } from './program.js';
 // Read version from package.json so `bridge --version` never drifts from the
 // published package. dist/cli.js lives at <pkg>/dist/cli.js, so `../package.json`
 // resolves to the package root in both the published tarball and during dev.
@@ -13,17 +12,9 @@ export const program = new Command();
 program
     .name('bridge')
     .description('Bridge platform CLI — optimized for AI coding agents')
-    .version(version)
-    // TBP-628 — target another stored app for ONE command, without touching the
-    // persisted default another process may be reading. Named `--profile` rather
-    // than `--app` because `bridge auth login --app` already exists and means
-    // something different (which app to authorise), and because `--profile` is
-    // what aws/npm users already reach for.
-    .option('--profile <label|app-id|app-name>', 'Use a specific stored credential for this command (env: BRIDGE_PROFILE)');
-// Runs before any subcommand action, so `getManagementClient()` sees the
-// override wherever in the tree it is eventually called from.
-program.hook('preAction', (thisCommand) => {
-    setProfileOverride(thisCommand.opts().profile);
-});
+    .version(version);
+// TBP-628 `--profile` (which stored login) and TBP-769 `--app` (which app
+// within that login), plus the preAction hook that applies them.
+registerGlobalOptions(program);
 registerCommands(program);
 //# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,6EAA6E;AAC7E,kFAAkF;AAClF,6EAA6E;AAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;AACpF,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAwB,CAAC;AAErF,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAErC,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CAAC,sDAAsD,CAAC;KACnE,OAAO,CAAC,OAAO,CAAC;IACjB,4EAA4E;IAC5E,6EAA6E;IAC7E,0EAA0E;IAC1E,2EAA2E;IAC3E,wCAAwC;KACvC,MAAM,CACL,mCAAmC,EACnC,yEAAyE,CAC1E,CAAC;AAEJ,yEAAyE;AACzE,8DAA8D;AAC9D,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,EAAE;IACxC,kBAAkB,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,OAA6B,CAAC,CAAC;AACvE,CAAC,CAAC,CAAC;AAEH,gBAAgB,CAAC,OAAO,CAAC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAEvE,6EAA6E;AAC7E,kFAAkF;AAClF,6EAA6E;AAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;AACpF,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAwB,CAAC;AAErF,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAErC,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CAAC,sDAAsD,CAAC;KACnE,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,0EAA0E;AAC1E,iEAAiE;AACjE,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAE/B,gBAAgB,CAAC,OAAO,CAAC,CAAC"}

package/dist/commands/app.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.command.d.ts","sourceRoot":"","sources":["../../src/commands/app.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA0F1D"}
+{"version":3,"file":"app.command.d.ts","sourceRoot":"","sources":["../../src/commands/app.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAUpC,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAmH1D"}

package/dist/commands/app.command.js

@@ -1,7 +1,43 @@
-import { getManagementClient } from '../config.js';
+import { ConfigError, getManagementClient, resolveSelectedCredential, resetManagementClient } from '../config.js';
 import { outputSuccess, outputError } from '../output.js';
+import { updateCredential } from '../credentials.js';
+import { createWorkspaceClient, resolveAppSelector, } from '../auth/workspace-client.js';
 export function registerAppCommands(program) {
     const app = program.command('app').description('Manage app configuration');
+    // TBP-769 — one login, every app of the workspace (MCP parity).
+    app.command('list')
+        .description('List the apps your login covers, marking the home app and the current one')
+        .action(async () => {
+        try {
+            outputSuccess(await runAppList());
+        }
+        catch (err) {
+            outputError(err);
+        }
+    });
+    app.command('use <id|name>')
+        .description('Make another app of your workspace login the default for every command (local, no re-login)')
+        .action(async (selector) => {
+        try {
+            outputSuccess(await runAppUse(selector));
+        }
+        catch (err) {
+            outputError(err);
+        }
+    });
+    app.command('create')
+        .description('Create a new app in your workspace')
+        .requiredOption('--name <name>', 'App name')
+        .option('--callback-url <url>', 'OAuth callback URL to register on the new app')
+        .option('--use', 'Also make the new app the current one (like `bridge app use`)')
+        .action(async (opts) => {
+        try {
+            outputSuccess(await runAppCreate(opts));
+        }
+        catch (err) {
+            outputError(err);
+        }
+    });
     app.command('get')
         .description('Get current app configuration')
         .action(async () => {
@@ -99,6 +135,86 @@ export function registerAppCommands(program) {
         }
     });
 }
+/** The stored login these commands work with; BRIDGE_API_KEY cannot list apps. */
+function loginContext() {
+    const selected = resolveSelectedCredential();
+    if (!selected.creds || !selected.key) {
+        throw Object.assign(new ConfigError('App selection needs a login from `bridge auth login`; BRIDGE_API_KEY is bound to one app.'), { hint: 'Run `bridge auth login` (it covers every app of the workspace by default).' });
+    }
+    return { key: selected.key, creds: selected.creds, baseUrl: selected.baseUrl };
+}
+function workspaceClient(ctx) {
+    return createWorkspaceClient({ baseUrl: ctx.baseUrl, loginToken: ctx.creds.apiKey });
+}
+/** Current = the locally chosen app of this login, else its home app. */
+function currentAppId(creds) {
+    return creds.appAccess === 'workspace' && creds.currentApp ? creds.currentApp.id : creds.app.id;
+}
+/** Learn the login's scope from the server (credentials from before TBP-769 lack it). */
+function rememberScope(key, creds, scope) {
+    const appAccess = scope === 'workspace' ? 'workspace' : 'app';
+    return creds.appAccess === appAccess ? creds : updateCredential(key, { appAccess });
+}
+async function runAppList() {
+    const ctx = loginContext();
+    const res = await workspaceClient(ctx).listApps();
+    const creds = rememberScope(ctx.key, ctx.creds, res.scope);
+    const current = currentAppId(creds);
+    return {
+        scope: res.scope,
+        homeAppId: res.homeAppId,
+        currentAppId: current,
+        apps: res.apps.map((a) => ({ id: a.id, name: a.name, home: a.home, current: a.id === current })),
+    };
+}
+async function runAppUse(selector) {
+    const ctx = loginContext();
+    const home = ctx.creds.app;
+    const lower = selector.trim().toLowerCase();
+    let target;
+    if (selector.trim() === home.id || lower === home.name.toLowerCase()) {
+        target = home;
+    }
+    else {
+        const res = await workspaceClient(ctx).listApps();
+        rememberScope(ctx.key, ctx.creds, res.scope);
+        if (res.scope !== 'workspace') {
+            throw Object.assign(new ConfigError(`This login covers only the app ${home.name} (${home.id}), so it cannot switch to "${selector}".`), {
+                code: 'APP_NOT_IN_CONNECTION',
+                hint: 'Run `bridge auth login` again and choose "Every app in <workspace>" on the consent ' +
+                    'screen; one login then covers every app and `bridge app use` switches between them.',
+            });
+        }
+        target = resolveAppSelector(selector, res.apps);
+    }
+    const isHome = target.id === home.id;
+    updateCredential(ctx.key, { currentApp: isHome ? undefined : { id: target.id, name: target.name } });
+    resetManagementClient();
+    return {
+        currentApp: { id: target.id, name: target.name, home: isHome },
+        message: isHome
+            ? `Now using the home app ${target.name} (${target.id}).`
+            : `Now using ${target.name} (${target.id}). Commands act on it until \`bridge app use\` again; \`--app\` overrides it for one command.`,
+    };
+}
+async function runAppCreate(opts) {
+    const ctx = loginContext();
+    const res = await workspaceClient(ctx).createApp({
+        name: opts.name,
+        ...(opts.callbackUrl ? { callbackUrl: opts.callbackUrl } : {}),
+    });
+    let current = false;
+    if (opts.use) {
+        // A create that succeeded proves the login spans the workspace.
+        updateCredential(ctx.key, {
+            appAccess: 'workspace',
+            currentApp: res.app.id === ctx.creds.app.id ? undefined : { id: res.app.id, name: res.app.name },
+        });
+        resetManagementClient();
+        current = true;
+    }
+    return { app: res.app, current };
+}
 function validateRedirectUri(value) {
     let parsed;
     try {

package/dist/commands/app.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.command.js","sourceRoot":"","sources":["../../src/commands/app.command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE1D,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,0BAA0B,CAAC,CAAC;IAE3E,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC;SACf,WAAW,CAAC,+BAA+B,CAAC;SAC5C,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YAAC,aAAa,CAAC,MAAM,mBAAmB,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QAAC,CAAC;QAC7D,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEL,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;SAClB,WAAW,CAAC,qBAAqB,CAAC;SAClC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;SACnC,MAAM,CAAC,iBAAiB,EAAE,SAAS,CAAC;SACpC,MAAM,CAAC,gBAAgB,EAAE,sMAAsM,CAAC;SAChO,MAAM,CAAC,qBAAqB,EAAE,aAAa,CAAC;SAC5C,MAAM,CAAC,6BAA6B,EAAE,0BAA0B,EAAE,SAAS,CAAC;SAC5E,MAAM,CAAC,sBAAsB,EAAE,YAAY,EAAE,SAAS,CAAC;SACvD,MAAM,CAAC,2BAA2B,EAAE,iBAAiB,EAAE,SAAS,CAAC;SACjE,MAAM,CAAC,6BAA6B,EAAE,oBAAoB,EAAE,SAAS,CAAC;SACtE,MAAM,CAAC,iCAAiC,EAAE,0EAA0E,EAAE,SAAS,CAAC;SAChI,MAAM,CAAC,wBAAwB,EAAE,qDAAqD,EAAE,SAAS,CAAC;SAClG,MAAM,CAAC,6BAA6B,EAAE,8CAA8C,EAAE,SAAS,CAAC;SAChG,MAAM,CAAC,8BAA8B,EAAE,4BAA4B,CAAC;SACpE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,cAAc,CAAC;gBAC1B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;gBAC/C,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;aAC5C,CAAC,CAAC;YACH,aAAa,CAAC,MAAM,mBAAmB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,MAAM,YAAY,GAAG,GAAG;SACrB,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,qEAAqE,CAAC,CAAC;IAEtF,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC;SACzB,WAAW,CAAC,+BAA+B,CAAC;SAC5C,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YACtD,aAAa,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC;SAC9B,WAAW,CAAC,qDAAqD,CAAC;SAClE,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;QAC5B,IAAI,CAAC;YACH,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACzB,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC;YAC5D,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,aAAa,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,GAAG,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC9F,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,CAAC,CAAC;YAC/B,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,aAAa,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,YAAY,CAAC,OAAO,CAAC,cAAc,CAAC;SACjC,WAAW,CAAC,kCAAkC,CAAC;SAC/C,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;QAC5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC;YAC5D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,gCAAgC,GAAG,sBAAsB,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAC1G,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;YAC9C,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,0BAA0B,KAAK,uFAAuF,CACvH,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,2BAA2B,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,KAAK,MAAM,CAAC;AACxB,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,cAAc,CAAC,GAA4B;IAClD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;AACpF,CAAC"}
+{"version":3,"file":"app.command.js","sourceRoot":"","sources":["../../src/commands/app.command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAClH,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAA0B,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EACL,qBAAqB,EACrB,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,0BAA0B,CAAC,CAAC;IAE3E,gEAAgE;IAChE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;SAChB,WAAW,CAAC,2EAA2E,CAAC;SACxF,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YAAC,aAAa,CAAC,MAAM,UAAU,EAAE,CAAC,CAAC;QAAC,CAAC;QAC1C,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEL,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC;SACzB,WAAW,CAAC,6FAA6F,CAAC;SAC1G,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,EAAE;QACjC,IAAI,CAAC;YAAC,aAAa,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAC,CAAC;QACjD,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEL,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;SAClB,WAAW,CAAC,oCAAoC,CAAC;SACjD,cAAc,CAAC,eAAe,EAAE,UAAU,CAAC;SAC3C,MAAM,CAAC,sBAAsB,EAAE,+CAA+C,CAAC;SAC/E,MAAM,CAAC,OAAO,EAAE,+DAA+D,CAAC;SAChF,MAAM,CAAC,KAAK,EAAE,IAA2D,EAAE,EAAE;QAC5E,IAAI,CAAC;YAAC,aAAa,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAAC,CAAC;QAChD,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEL,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC;SACf,WAAW,CAAC,+BAA+B,CAAC;SAC5C,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YAAC,aAAa,CAAC,MAAM,mBAAmB,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QAAC,CAAC;QAC7D,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEL,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;SAClB,WAAW,CAAC,qBAAqB,CAAC;SAClC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC;SACnC,MAAM,CAAC,iBAAiB,EAAE,SAAS,CAAC;SACpC,MAAM,CAAC,gBAAgB,EAAE,sMAAsM,CAAC;SAChO,MAAM,CAAC,qBAAqB,EAAE,aAAa,CAAC;SAC5C,MAAM,CAAC,6BAA6B,EAAE,0BAA0B,EAAE,SAAS,CAAC;SAC5E,MAAM,CAAC,sBAAsB,EAAE,YAAY,EAAE,SAAS,CAAC;SACvD,MAAM,CAAC,2BAA2B,EAAE,iBAAiB,EAAE,SAAS,CAAC;SACjE,MAAM,CAAC,6BAA6B,EAAE,oBAAoB,EAAE,SAAS,CAAC;SACtE,MAAM,CAAC,iCAAiC,EAAE,0EAA0E,EAAE,SAAS,CAAC;SAChI,MAAM,CAAC,wBAAwB,EAAE,qDAAqD,EAAE,SAAS,CAAC;SAClG,MAAM,CAAC,6BAA6B,EAAE,8CAA8C,EAAE,SAAS,CAAC;SAChG,MAAM,CAAC,8BAA8B,EAAE,4BAA4B,CAAC;SACpE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,cAAc,CAAC;gBAC1B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;gBAC/C,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;aAC5C,CAAC,CAAC;YACH,aAAa,CAAC,MAAM,mBAAmB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,MAAM,YAAY,GAAG,GAAG;SACrB,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,qEAAqE,CAAC,CAAC;IAEtF,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC;SACzB,WAAW,CAAC,+BAA+B,CAAC;SAC5C,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YACtD,aAAa,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC;SAC9B,WAAW,CAAC,qDAAqD,CAAC;SAClE,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;QAC5B,IAAI,CAAC;YACH,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACzB,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC;YAC5D,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,aAAa,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,GAAG,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC9F,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,CAAC,CAAC;YAC/B,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,aAAa,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,YAAY,CAAC,OAAO,CAAC,cAAc,CAAC;SACjC,WAAW,CAAC,kCAAkC,CAAC;SAC/C,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;QAC5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC;YAC5D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,gCAAgC,GAAG,sBAAsB,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAC1G,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;YAC9C,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACP,CAAC;AAED,kFAAkF;AAClF,SAAS,YAAY;IACnB,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,WAAW,CAAC,2FAA2F,CAAC,EAC5G,EAAE,IAAI,EAAE,4EAA4E,EAAE,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;AACjF,CAAC;AAED,SAAS,eAAe,CAAC,GAAkD;IACzE,OAAO,qBAAqB,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,yEAAyE;AACzE,SAAS,YAAY,CAAC,KAAwB;IAC5C,OAAO,KAAK,CAAC,SAAS,KAAK,WAAW,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAClG,CAAC;AAED,yFAAyF;AACzF,SAAS,aAAa,CAAC,GAAW,EAAE,KAAwB,EAAE,KAAqC;IACjG,MAAM,SAAS,GAAG,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9D,OAAO,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;AACtF,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,YAAY,EAAE,OAAO;QACrB,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC,CAAC;KACjG,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,QAAgB;IACvC,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;IAC3B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE5C,IAAI,MAAoC,CAAC;IACzC,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,EAAE,IAAI,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACrE,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QAClD,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAC9B,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,WAAW,CACb,kCAAkC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,8BAA8B,QAAQ,IAAI,CAClG,EACD;gBACE,IAAI,EAAE,uBAAuB;gBAC7B,IAAI,EACF,qFAAqF;oBACrF,qFAAqF;aACxF,CACF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,kBAAkB,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;IACrC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrG,qBAAqB,EAAE,CAAC;IACxB,OAAO;QACL,UAAU,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE;QAC9D,OAAO,EAAE,MAAM;YACb,CAAC,CAAC,0BAA0B,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,IAAI;YACzD,CAAC,CAAC,aAAa,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,+FAA+F;KAC1I,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAA2D;IACrF,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;QAC/C,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC,CAAC;IACH,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,gEAAgE;QAChE,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE;YACxB,SAAS,EAAE,WAAW;YACtB,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE;SACjG,CAAC,CAAC;QACH,qBAAqB,EAAE,CAAC;QACxB,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,0BAA0B,KAAK,uFAAuF,CACvH,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,2BAA2B,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,KAAK,MAAM,CAAC;AACxB,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,cAAc,CAAC,GAA4B;IAClD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;AACpF,CAAC"}

package/dist/commands/auth/login.command.d.ts

@@ -27,8 +27,20 @@ interface LoginOptions {
     reauth?: boolean;
     /** TBP-593 — request the elevated `management:admin` scope. */
     admin?: boolean;
+    /** TBP-769 — preselect "only this app" instead of "every app" on consent. */
+    singleApp?: boolean;
 }
-export { runLogin };
+export { runLogin, buildAuthorizeUrl };
 export declare function registerAuthLoginCommand(auth: Command): void;
 declare function runLogin(opts: LoginOptions): Promise<void>;
+declare function buildAuthorizeUrl(authBaseUrl: string, params: {
+    challenge: string;
+    redirect: string;
+    state: string;
+    appId?: string;
+    label?: string;
+    reauth?: boolean;
+    admin?: boolean;
+    appAccess?: 'app' | 'workspace';
+}): string;
 //# sourceMappingURL=login.command.d.ts.map

package/dist/commands/auth/login.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.command.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/login.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAazC,UAAU,YAAY;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAID,OAAO,EAAE,QAAQ,EAAE,CAAC;AAEpB,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAoB5D;AAED,iBAAe,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAsGzD"}
+{"version":3,"file":"login.command.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/login.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAazC,UAAU,YAAY;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAID,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;AAEvC,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAqB5D;AAED,iBAAe,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAiHzD;AAED,iBAAS,iBAAiB,CACxB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE;IACN,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,KAAK,GAAG,WAAW,CAAC;CACjC,GACA,MAAM,CAeR"}

package/dist/commands/auth/login.command.js

@@ -7,12 +7,13 @@ import { createCliApiClient, CliAuthApiError } from '../../auth/api-client.js';
 import { SCOPE_MANAGEMENT, SCOPE_MANAGEMENT_ADMIN } from '../../auth/scopes.js';
 const DEFAULT_API_BASE_URL = 'https://api.thebridge.dev';
 const DEFAULT_AUTH_BASE_URL = 'https://auth.thebridge.dev';
-export { runLogin };
+export { runLogin, buildAuthorizeUrl };
 export function registerAuthLoginCommand(auth) {
     auth
         .command('login')
         .description('Authenticate via browser (loopback PKCE) and save credentials')
-        .option('--app <id|name>', 'Pin to a specific app: an app id skips the picker entirely; an app name is resolved on the consent screen (falls back to the picker if not found)')
+        .option('--app <id|name>', 'Pin the home app: an app id skips the picker entirely; an app name is resolved on the consent screen (falls back to the picker if not found)')
+        .option('--single-app', 'Ask for a login that covers only the home app. By default the consent screen preselects "Every app in <workspace>", so `bridge app use` / `--app` can switch apps without logging in again')
         .option('--label <text>', 'Friendly label stored on the token (default: "bridge-cli")')
         .option('--no-browser', 'Print the authorization URL instead of opening a browser')
         .option('--reauth', 'Force the consent screen to sign you out and prompt for credentials again')
@@ -59,6 +60,7 @@ async function runLogin(opts) {
         label: opts.label,
         reauth: opts.reauth === true,
         admin: opts.admin === true,
+        appAccess: opts.singleApp === true ? 'app' : 'workspace',
     });
     // 3. Open browser (or print URL if --no-browser or open fails).
     const stdout = process.stdout;
@@ -114,6 +116,9 @@ async function runLogin(opts) {
         user: { id: exchanged.user.id, email: exchanged.user.email },
         baseUrl: apiBaseUrl,
         ...(opts.label ? { label: opts.label } : {}),
+        // TBP-769 — what the user actually chose on the consent screen (the URL
+        // only preselected it). An older server omits it: that login is one app.
+        appAccess: exchanged.app_access === 'workspace' ? 'workspace' : 'app',
     };
     writeCredentials(stored);
     // Reset the cached BridgeManagement client so the next command picks up the
@@ -121,7 +126,13 @@ async function runLogin(opts) {
     resetManagementClient();
     // 7. Friendly confirmation.
     const expiryHuman = formatExpiryDate(exchanged.expires_at);
-    stdout.write(`Logged in as ${exchanged.user.email}. App: ${exchanged.app.name}. Token valid until ${expiryHuman}.\n`);
+    const scope = stored.appAccess === 'workspace'
+        ? `Workspace: every app (home app: ${exchanged.app.name})`
+        : `App: ${exchanged.app.name}`;
+    stdout.write(`Logged in as ${exchanged.user.email}. ${scope}. Token valid until ${expiryHuman}.\n`);
+    if (stored.appAccess === 'workspace') {
+        stdout.write('Run `bridge app list` to see the apps, `bridge app use <id|name>` to switch.\n');
+    }
 }
 function buildAuthorizeUrl(authBaseUrl, params) {
     const url = new URL(`${authBaseUrl}/cli/authorize`);
@@ -133,6 +144,9 @@ function buildAuthorizeUrl(authBaseUrl, params) {
         url.searchParams.set('app_id', params.appId);
     if (params.label)
         url.searchParams.set('label', params.label);
+    // TBP-769 — only PRESELECTS the choice on the consent screen; the user decides.
+    if (params.appAccess)
+        url.searchParams.set('app_access', params.appAccess);
     // OAuth-style `prompt=login` — the consent screen reads this as "clear any
     // existing browser session and re-prompt for credentials" so users who just
     // ran `bridge auth logout` aren't dropped straight into the workspace picker.