@nebulr-group/bridge-cli 0.6.5 → 1.0.0-alpha.0

package/dist/config.js

@@ -1,376 +1,63 @@
-import { BridgeManagement, ManagementHttpClient } from '@nebulr-group/bridge-auth-core';
-import { CredentialSelectorError, findCredential, isExpired, readCredentials, } from './credentials.js';
-import { createWorkspaceClient, looksLikeAppId, resolveAppSelector, } from './auth/workspace-client.js';
-export const DEFAULT_BASE_URL = 'https://api.thebridge.dev';
-let _client = null;
-let _baseUrl = null;
-let _apiKey = null;
-let _http = null;
-/**
- * The `--profile` value for this invocation, set by the CLI's preAction hook.
- *
- * A per-invocation override rather than a persisted switch, because that is
- * what scripts and long-running agent sessions need: target one app for one
- * command without mutating state another process is reading (TBP-628).
- */
-let _profileOverride = null;
-/** Called once from the CLI entrypoint, before any action runs. */
-export function setProfileOverride(profile) {
-    _profileOverride = profile?.trim() || null;
-}
-/** The profile in force: `--profile` beats `BRIDGE_PROFILE`. */
-function activeProfileSelector() {
-    if (_profileOverride)
-        return _profileOverride;
-    return process.env.BRIDGE_PROFILE?.trim() || null;
-}
-/**
- * Resolution order:
- *   1. `--profile <label|id|name>` / `BRIDGE_PROFILE` — a stored credential,
- *      named for this one invocation. Never falls back: naming a profile and
- *      silently getting a different app is the exact failure TBP-628 exists to
- *      stop, so an unknown or expired profile is an error.
- *   2. The ACTIVE credential in `~/.config/bridge/credentials.json` (or
- *      `$XDG_CONFIG_HOME/...`), written by `bridge auth login` and moved by
- *      `bridge auth use`.
- *   3. `BRIDGE_API_KEY` env var (CI / service-account fallback). Used when no
- *      usable credentials file exists — the typical CI runner shape.
- *   4. Throw `ConfigError("Not logged in. Run `bridge auth login`.")`.
- *
- * The credentials file still wins over `BRIDGE_API_KEY`, unchanged, so
- * `bridge auth login` takes effect immediately and CI is unaffected. What HAS
- * changed is that being ignored is now said out loud: `BRIDGE_API_KEY` and
- * `BRIDGE_APP_ID` look like a way to retarget the CLI and are not, and reading
- * that in the output beats discovering it from a write that went to the wrong
- * app (TBP-628).
- *
- * Every resolution also prints one line to stderr naming the app that is about
- * to answer. See `writeContextBanner`.
- */
-export function getManagementClient() {
-    if (_client)
-        return _client;
-    const debug = process.env.BRIDGE_DEBUG === 'true';
-    const envBaseUrl = process.env.BRIDGE_BASE_URL?.trim();
-    const selected = resolveSelectedCredential();
-    const { creds, source, selector, baseUrl } = selected;
-    // TBP-769 — a workspace login acting on another app swaps in that app's
-    // short-lived token, fetched by `prepareAppContext()` before the action ran.
-    const apiKey = _appContext ? _appContext.apiKey : selected.apiKey;
-    writeContextBanner({ creds, source, baseUrl, selector, appContext: _appContext });
-    if (debug) {
-        const baseSource = envBaseUrl && envBaseUrl.length > 0
-            ? 'env'
-            : source === 'env'
-                ? 'default'
-                : 'credentials-file';
-        console.error(`[bridge-cli] apiKey=<redacted from ${source}> baseUrl=${baseUrl} (${baseSource})`);
-    }
-    _client = new BridgeManagement({ apiKey, baseUrl, debug });
-    _baseUrl = baseUrl;
-    _apiKey = apiKey;
-    return _client;
-}
-/**
- * WHICH login is in force, per the resolution order documented on
- * `getManagementClient()`. Throws `ConfigError` exactly as it always has.
- * Offline; prints nothing.
- */
-export function resolveSelectedCredential() {
-    const envApiKey = process.env.BRIDGE_API_KEY?.trim();
-    const envBaseUrl = process.env.BRIDGE_BASE_URL?.trim();
-    const withBase = (fallback) => envBaseUrl && envBaseUrl.length > 0 ? envBaseUrl : fallback;
-    const selector = activeProfileSelector();
-    if (selector) {
-        // 1. Explicit profile. Resolve it or fail — no fallback of any kind.
-        let entry;
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { CliError } from './core/errors.js';
+import { readPrivateFile, writePrivateFile } from './core/private-files.js';
+import { normalizeIssuer } from './core/urls.js';
+export function configDir(env, platform = process.platform) {
+    const given = env['BRIDGE_CONFIG_DIR']?.trim();
+    if (given)
+        return given;
+    if (platform === 'win32' && env['APPDATA'])
+        return join(env['APPDATA'], 'bridge', 'v1');
+    const xdg = env['XDG_CONFIG_HOME']?.trim();
+    if (xdg)
+        return join(xdg, 'bridge', 'v1');
+    const home = env['HOME']?.trim() || homedir();
+    return join(home, '.config', 'bridge', 'v1');
+}
+export class Config {
+    dir;
+    constructor(dir) {
+        this.dir = dir;
+    }
+    async read() {
+        const raw = await readPrivateFile(this.dir, FILE);
+        if (raw === null)
+            return {};
         try {
-            entry = findCredential(selector);
-        }
-        catch (err) {
-            if (err instanceof CredentialSelectorError)
-                throw new ConfigError(err.message);
-            throw err;
+            const parsed = JSON.parse(raw);
+            return typeof parsed === 'object' && parsed !== null ? parsed : {};
         }
-        if (isExpired(entry.creds)) {
-            throw new ConfigError(`Credential for "${selector}" (${entry.creds.app.name}) expired ` +
-                `${entry.creds.expiresAt}. Run \`bridge auth login\` to re-authenticate it. ` +
-                'Refusing to fall back to another app.');
+        catch {
+            return {};
         }
-        return {
-            key: entry.key,
-            creds: entry.creds,
-            apiKey: entry.creds.apiKey,
-            baseUrl: withBase(entry.creds.baseUrl),
-            source: 'profile',
-            selector,
-        };
     }
-    // 2. Active credential from `bridge auth login` / `bridge auth use`.
-    const active = safeReadCredentials();
-    if (active && !isExpired(active)) {
-        // Env override still wins for baseUrl (useful for hitting a local
-        // bridge-api with a token issued by prod, or vice versa during dev).
-        return {
-            key: active.app.id,
-            creds: active,
-            apiKey: active.apiKey,
-            baseUrl: withBase(active.baseUrl),
-            source: 'credentials-file',
-            selector: null,
-        };
+    async update(change) {
+        const settings = await this.read();
+        change(settings);
+        await writePrivateFile(this.dir, FILE, JSON.stringify(settings, null, 2) + '\n');
+        return settings;
     }
-    if (envApiKey && envApiKey.length > 0) {
-        // 3. BRIDGE_API_KEY env var (CI / service-account fallback).
-        return {
-            key: null,
-            creds: null,
-            apiKey: envApiKey,
-            baseUrl: withBase(DEFAULT_BASE_URL),
-            source: 'env',
-            selector: null,
-        };
-    }
-    if (active && isExpired(active)) {
-        // 4a. Found a credentials file but token expired; no env fallback either.
-        throw new ConfigError('Token expired. Run `bridge auth login` to re-authenticate.');
-    }
-    // 4b. No credentials at all.
-    throw new ConfigError('Not logged in. Run `bridge auth login`.');
-}
-let _appFlag = null;
-let _appContext = null;
-/** Per-app tokens, in memory for this process only. Never written to disk. */
-const _appTokenCache = new Map();
-/** The global `--app` value for this invocation, set by the preAction hook. */
-export function setAppOverride(app) {
-    _appFlag = app?.trim() || null;
-}
-/** The app the NEXT management client will act on (workspace logins only). */
-export function getAppContext() {
-    return _appContext;
 }
-function isHomeSelector(selector, home) {
-    return selector === home.id || selector.toLowerCase() === home.name.toLowerCase();
-}
-/**
- * Decide which app this command acts on and, for a workspace login, fetch
- * the token for it before the action runs — the server re-checks access on
- * every call (`getManagementClient()` is synchronous, so this happens up front).
- *
- * Precedence: `--app` > the credential's `currentApp` (`bridge app use`) > home.
- * A workspace login calls the token route for every target, the home app
- * included, so the server re-checks access each time. Single-app logins and `BRIDGE_API_KEY` behave exactly as
- * before; asking them for another app is an error that says how to fix it.
- */
-export async function prepareAppContext(fetchImpl) {
-    _appContext = null;
-    _client = null;
-    _http = null;
-    let selected;
-    try {
-        selected = resolveSelectedCredential();
-    }
-    catch (err) {
-        // Without --app, leave "not logged in" etc. to the command, as before.
-        if (!_appFlag)
-            return;
-        throw err;
-    }
-    if (selected.source === 'env' || !selected.creds || !selected.key) {
-        if (_appFlag) {
-            throw new ConfigError('--app needs a workspace login from `bridge auth login`. ' +
-                'BRIDGE_API_KEY is bound to the one app it was issued for.');
-        }
-        return;
-    }
-    const creds = selected.creds;
-    const target = _appFlag ?? creds.currentApp?.id ?? null;
-    if (creds.appAccess !== 'workspace') {
-        // Single-app login: unchanged, no extra call — its token IS its one app.
-        if (!target || isHomeSelector(target, creds.app))
-            return;
-        // A stray currentApp on a single-app login cannot be honoured; ignore it
-        // rather than fail every command. An explicit --app is a request: refuse.
-        if (!_appFlag)
-            return;
-        throw Object.assign(new ConfigError(`This login covers only the app ${creds.app.name} (${creds.app.id}), so --app ${_appFlag} is not available.`), {
-            hint: 'Run `bridge auth login` again and choose "Every app in <workspace>" on the consent ' +
-                'screen to work across apps with one login.',
+const FILE = 'config.json';
+/** The issuer: `--issuer`, else `BRIDGE_ISSUER`, else the one saved at sign-in. */
+export function resolveIssuer(flag, env, settings) {
+    const given = flag ?? env['BRIDGE_ISSUER'] ?? settings.issuer;
+    if (given === undefined || given.trim() === '') {
+        throw new CliError('misconfigured', 'No issuer is set.', {
+            hint: 'Sign in with `bridge auth login --issuer <the Bridge App\'s issuer>`, or set BRIDGE_ISSUER.',
         });
     }
-    const client = createWorkspaceClient({
-        baseUrl: selected.baseUrl,
-        loginToken: creds.apiKey,
-        fetchImpl,
-    });
-    // A workspace login re-checks access on EVERY command, home app included
-    // (the server answers the home app with the login token itself, after the
-    // check) — same as the MCP server.
-    let targetId;
-    if (!target || isHomeSelector(target, creds.app)) {
-        targetId = creds.app.id;
-    }
-    else if (looksLikeAppId(target)) {
-        targetId = target;
-    }
-    else if (creds.currentApp && target.toLowerCase() === creds.currentApp.name.toLowerCase()) {
-        targetId = creds.currentApp.id;
-    }
-    else {
-        const { apps } = await client.listApps();
-        targetId = resolveAppSelector(target, apps).id;
-    }
-    const cacheKey = `${selected.key}:${targetId}`;
-    const cached = _appTokenCache.get(cacheKey);
-    let token;
-    if (cached && cached.expiresAt - Date.now() > 15_000) {
-        token = cached;
-    }
-    else {
-        const res = await client.appToken(targetId);
-        const exp = Date.parse(res.expiresAt);
-        _appTokenCache.set(cacheKey, {
-            apiKey: res.apiKey,
-            app: res.app,
-            expiresAt: Number.isNaN(exp) ? Date.now() + 60_000 : exp,
-        });
-        token = res;
-    }
-    _appContext = {
-        apiKey: token.apiKey,
-        app: token.app,
-        via: _appFlag ? `--app ${_appFlag}` : 'current app (bridge app use)',
-        home: targetId === creds.app.id,
-    };
-}
-/** For tests: forget --app, the chosen app and every cached per-app token. */
-export function resetAppContext() {
-    _appFlag = null;
-    _appContext = null;
-    _appTokenCache.clear();
-}
-/**
- * One line on stderr naming the app that is about to answer.
- *
- * On EVERY command, not only writes. The incident behind TBP-628 started with a
- * read: `bridge role list` was believed to describe the local app and described
- * production, and nothing in the output said otherwise. A banner that only
- * appears on writes would not have prevented it, because the wrong belief was
- * already formed by then.
- *
- * stderr, so stdout stays pure JSON for the agents and scripts that parse it.
- * Suppress with `BRIDGE_NO_BANNER=true` — for the one caller who is already
- * certain and is merging the two streams.
- */
-function writeContextBanner(ctx) {
-    const { creds, source, baseUrl, selector, appContext } = ctx;
-    // TBP-769 — acting on an app other than the login's home app is said out
-    // loud even with BRIDGE_NO_BANNER: it is the one case where the credential
-    // on disk does not name the app that is about to answer.
-    if (appContext && !appContext.home) {
-        const home = creds ? `${creds.label ?? creds.app.name} (${creds.app.id})` : 'login';
-        process.stderr.write(`bridge: Acting on app ${appContext.app.name} (${appContext.app.id}) · ${baseUrl} · ` +
-            `via ${appContext.via}, workspace login ${home}\n`);
-        return;
-    }
-    if (process.env.BRIDGE_NO_BANNER === 'true')
-        return;
-    const who = creds
-        ? `${creds.label ?? creds.app.name} (${creds.app.id})`
-        : 'BRIDGE_API_KEY (app unknown — the key carries it)';
-    const via = source === 'profile'
-        ? `--profile ${selector}`
-        : source === 'env'
-            ? 'BRIDGE_API_KEY'
-            : 'saved default';
-    process.stderr.write(`bridge: ${who} · ${baseUrl} · via ${via}\n`);
-    // The two env vars that look like a way to retarget the CLI and are not.
-    // Saying so here, at the moment they are being ignored, is the whole point:
-    // the reported incident was a session that set them and believed them.
-    if (source !== 'env' && process.env.BRIDGE_API_KEY?.trim()) {
-        process.stderr.write('bridge: BRIDGE_API_KEY is set but IGNORED — the credentials file wins. ' +
-            'Use `--profile <label>` to pick a stored login, `--app` to pick an app within it, ' +
-            'or `bridge auth logout` to use the key.\n');
-    }
-    if (process.env.BRIDGE_APP_ID?.trim()) {
-        process.stderr.write('bridge: BRIDGE_APP_ID has no effect — the app is carried by the credential itself. ' +
-            'Use `--app <id|name>` (workspace login) or `--profile <label|app id>` to target another app.\n');
-    }
-}
-/**
- * The Bridge API base URL the management client talks to, resolved exactly as
- * `getManagementClient()` resolves it: `--profile`, then the active credential,
- * then `BRIDGE_API_KEY`, with `BRIDGE_BASE_URL` overriding each.
- *
- * Anything the CLI writes into a project (`bridge flag init`) takes its base
- * URL from here, so a project is wired to the environment the command just
- * read the app from. Re-reading the credentials file instead ignored
- * `--profile` and `BRIDGE_BASE_URL`, and wrote production into a project
- * scaffolded against stage (TBP-708).
- */
-export function getResolvedBaseUrl() {
-    getManagementClient();
-    return _baseUrl;
+    return normalizeIssuer(given);
 }
-/**
- * A raw authenticated HTTP client, resolved exactly as `getManagementClient()`
- * resolves (same `--profile`, credential, key and base URL, same banner).
- *
- * For routes auth-core has no typed service for yet — the integration checks
- * (TBP-541) — so the CLI can call them without waiting on an auth-core
- * release. The MCP tools use the same client type over the same routes.
- */
-export function getManagementHttp() {
-    if (_http)
-        return _http;
-    getManagementClient();
-    const debug = process.env.BRIDGE_DEBUG === 'true';
-    const quiet = () => undefined;
-    const logger = {
-        debug: debug ? (...a) => console.error('[bridge-cli]', ...a) : quiet,
-        warn: debug ? (...a) => console.error('[bridge-cli]', ...a) : quiet,
-        error: debug ? (...a) => console.error('[bridge-cli]', ...a) : quiet,
-    };
-    _http = new ManagementHttpClient(_baseUrl, _apiKey, logger);
-    return _http;
-}
-/**
- * For tests and for `bridge auth logout` / `bridge auth status` — they need
- * to reset the cached client between operations.
- */
-export function resetManagementClient() {
-    _appContext = null;
-    _client = null;
-    _baseUrl = null;
-    _apiKey = null;
-    _http = null;
-}
-export function resolveTenantId(opts) {
-    const tenantId = opts.tenantId || process.env.BRIDGE_TENANT_ID;
-    if (!tenantId) {
-        throw new ConfigError('Tenant context required. Set BRIDGE_TENANT_ID environment variable or use --tenant-id flag.');
-    }
-    return tenantId;
-}
-export class ConfigError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'ConfigError';
-    }
-}
-/**
- * Wraps `readCredentials()` so a malformed file produces a `ConfigError` (caught
- * by `outputError`) rather than a raw `Error` stack trace. Returns `null` if
- * the file just doesn't exist (caller decides what to do).
- */
-function safeReadCredentials() {
-    try {
-        return readCredentials();
-    }
-    catch (err) {
-        throw new ConfigError(`Could not read credentials file: ${err instanceof Error ? err.message : String(err)}\n` +
-            'Run `bridge auth login` to refresh, or delete the file manually.');
+/** The app commands act on: `--app`, else `BRIDGE_APP`, else the one chosen with `bridge app use`. */
+export function resolveApp(flag, env, settings, issuer) {
+    const given = flag ?? env['BRIDGE_APP'] ?? settings.apps?.[issuer];
+    if (given === undefined || given.trim() === '') {
+        throw new CliError('misconfigured', 'No app is chosen.', {
+            hint: 'Choose one with `bridge app use <id>`, pass `--app <id>`, or create one with `bridge app create --name <name>`.',
+        });
     }
+    return given.trim();
 }
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACxF,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,SAAS,EACT,eAAe,GAEhB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAE5D,IAAI,OAAO,GAA4B,IAAI,CAAC;AAC5C,IAAI,QAAQ,GAAkB,IAAI,CAAC;AACnC,IAAI,OAAO,GAAkB,IAAI,CAAC;AAClC,IAAI,KAAK,GAAgC,IAAI,CAAC;AAE9C;;;;;;GAMG;AACH,IAAI,gBAAgB,GAAkB,IAAI,CAAC;AAE3C,mEAAmE;AACnE,MAAM,UAAU,kBAAkB,CAAC,OAAkC;IACnE,gBAAgB,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AAC7C,CAAC;AAED,gEAAgE;AAChE,SAAS,qBAAqB;IAC5B,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAC;IAC9C,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,MAAM,CAAC;IAClD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAEvD,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAC;IAC7C,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;IACtD,wEAAwE;IACxE,6EAA6E;IAC7E,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;IAElE,kBAAkB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC;IAElF,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,UAAU,GACd,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YACjC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,MAAM,KAAK,KAAK;gBAChB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,kBAAkB,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,sCAAsC,MAAM,aAAa,OAAO,KAAK,UAAU,GAAG,CAAC,CAAC;IACpG,CAAC;IAED,OAAO,GAAG,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,QAAQ,GAAG,OAAO,CAAC;IACnB,OAAO,GAAG,MAAM,CAAC;IAEjB,OAAO,OAAO,CAAC;AACjB,CAAC;AAaD;;;;GAIG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IACrD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IACvD,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAE,EAAE,CACpC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;IAE9D,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAC;IACzC,IAAI,QAAQ,EAAE,CAAC;QACb,qEAAqE;QACrE,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,uBAAuB;gBAAE,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC/E,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,WAAW,CACnB,mBAAmB,QAAQ,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,YAAY;gBAC/D,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,qDAAqD;gBAC7E,uCAAuC,CAC1C,CAAC;QACJ,CAAC;QACD,OAAO;YACL,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;YAC1B,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;YACtC,MAAM,EAAE,SAAS;YACjB,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACrC,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,kEAAkE;QAClE,qEAAqE;QACrE,OAAO;YACL,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;YAClB,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;YACjC,MAAM,EAAE,kBAAkB;YAC1B,QAAQ,EAAE,IAAI;SACf,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,6DAA6D;QAC7D,OAAO;YACL,GAAG,EAAE,IAAI;YACT,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,QAAQ,CAAC,gBAAgB,CAAC;YACnC,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,IAAI;SACf,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,0EAA0E;QAC1E,MAAM,IAAI,WAAW,CAAC,4DAA4D,CAAC,CAAC;IACtF,CAAC;IACD,6BAA6B;IAC7B,MAAM,IAAI,WAAW,CAAC,yCAAyC,CAAC,CAAC;AACnE,CAAC;AAgBD,IAAI,QAAQ,GAAkB,IAAI,CAAC;AACnC,IAAI,WAAW,GAAsB,IAAI,CAAC;AAC1C,8EAA8E;AAC9E,MAAM,cAAc,GAAG,IAAI,GAAG,EAAoF,CAAC;AAEnH,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,GAA8B;IAC3D,QAAQ,GAAG,GAAG,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACjC,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,aAAa;IAC3B,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB,EAAE,IAAkC;IAC1E,OAAO,QAAQ,KAAK,IAAI,CAAC,EAAE,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAwB;IAC9D,WAAW,GAAG,IAAI,CAAC;IACnB,OAAO,GAAG,IAAI,CAAC;IACf,KAAK,GAAG,IAAI,CAAC;IAEb,IAAI,QAA4B,CAAC;IACjC,IAAI,CAAC;QACH,QAAQ,GAAG,yBAAyB,EAAE,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QAClE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CACnB,0DAA0D;gBACxD,2DAA2D,CAC9D,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC7B,MAAM,MAAM,GAAG,QAAQ,IAAI,KAAK,CAAC,UAAU,EAAE,EAAE,IAAI,IAAI,CAAC;IAExD,IAAI,KAAK,CAAC,SAAS,KAAK,WAAW,EAAE,CAAC;QACpC,yEAAyE;QACzE,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC;YAAE,OAAO;QACzD,yEAAyE;QACzE,0EAA0E;QAC1E,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,WAAW,CACb,kCAAkC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,GAAG,CAAC,EAAE,eAAe,QAAQ,oBAAoB,CAC7G,EACD;YACE,IAAI,EACF,qFAAqF;gBACrF,4CAA4C;SAC/C,CACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC;QACnC,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,UAAU,EAAE,KAAK,CAAC,MAAM;QACxB,SAAS;KACV,CAAC,CAAC;IAEH,yEAAyE;IACzE,0EAA0E;IAC1E,mCAAmC;IACnC,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1B,CAAC;SAAM,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,QAAQ,GAAG,MAAM,CAAC;IACpB,CAAC;SAAM,IAAI,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QAC5F,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;QACzC,QAAQ,GAAG,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,GAAG,IAAI,QAAQ,EAAE,CAAC;IAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,KAA4D,CAAC;IACjE,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;QACrD,KAAK,GAAG,MAAM,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE;YAC3B,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG;SACzD,CAAC,CAAC;QACH,KAAK,GAAG,GAAG,CAAC;IACd,CAAC;IAED,WAAW,GAAG;QACZ,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC,CAAC,8BAA8B;QACpE,IAAI,EAAE,QAAQ,KAAK,KAAK,CAAC,GAAG,CAAC,EAAE;KAChC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,eAAe;IAC7B,QAAQ,GAAG,IAAI,CAAC;IAChB,WAAW,GAAG,IAAI,CAAC;IACnB,cAAc,CAAC,KAAK,EAAE,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,kBAAkB,CAAC,GAM3B;IACC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC;IAE7D,yEAAyE;IACzE,2EAA2E;IAC3E,yDAAyD;IACzD,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;QACpF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yBAAyB,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,OAAO,KAAK;YACnF,OAAO,UAAU,CAAC,GAAG,qBAAqB,IAAI,IAAI,CACrD,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,MAAM;QAAE,OAAO;IAEpD,MAAM,GAAG,GAAG,KAAK;QACf,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG;QACtD,CAAC,CAAC,mDAAmD,CAAC;IACxD,MAAM,GAAG,GACP,MAAM,KAAK,SAAS;QAClB,CAAC,CAAC,aAAa,QAAQ,EAAE;QACzB,CAAC,CAAC,MAAM,KAAK,KAAK;YAChB,CAAC,CAAC,gBAAgB;YAClB,CAAC,CAAC,eAAe,CAAC;IACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,GAAG,MAAM,OAAO,UAAU,GAAG,IAAI,CAAC,CAAC;IAEnE,yEAAyE;IACzE,4EAA4E;IAC5E,uEAAuE;IACvE,IAAI,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;QAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yEAAyE;YACvE,oFAAoF;YACpF,2CAA2C,CAC9C,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qFAAqF;YACnF,gGAAgG,CACnG,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB;IAChC,mBAAmB,EAAE,CAAC;IACtB,OAAO,QAAkB,CAAC;AAC5B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,mBAAmB,EAAE,CAAC;IACtB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,MAAM,CAAC;IAClD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC;IAC9B,MAAM,MAAM,GAAG;QACb,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAY,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK;QAC/E,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAY,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK;QAC9E,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAY,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK;KAChF,CAAC;IACF,KAAK,GAAG,IAAI,oBAAoB,CAAC,QAAkB,EAAE,OAAiB,EAAE,MAAM,CAAC,CAAC;IAChF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,WAAW,GAAG,IAAI,CAAC;IACnB,OAAO,GAAG,IAAI,CAAC;IACf,QAAQ,GAAG,IAAI,CAAC;IAChB,OAAO,GAAG,IAAI,CAAC;IACf,KAAK,GAAG,IAAI,CAAC;AACf,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAA2B;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,WAAW,CACnB,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,mBAAmB;IAC1B,IAAI,CAAC;QACH,OAAO,eAAe,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,WAAW,CACnB,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI;YACtF,kEAAkE,CACrE,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAgBjD,MAAM,UAAU,SAAS,CAAC,GAAsB,EAAE,WAA4B,OAAO,CAAC,QAAQ;IAC5F,MAAM,KAAK,GAAG,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACxF,MAAM,GAAG,GAAG,GAAG,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC;IAC9C,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,OAAO,MAAM;IACI;IAArB,YAAqB,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;IAAG,CAAC;IAEpC,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClD,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;YAC1C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAE,MAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAoC;QAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjB,MAAM,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACjF,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED,MAAM,IAAI,GAAG,aAAa,CAAC;AAE3B,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,IAAwB,EAAE,GAAsB,EAAE,QAAkB;IAChG,MAAM,KAAK,GAAG,IAAI,IAAI,GAAG,CAAC,eAAe,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC;IAC9D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,mBAAmB,EAAE;YACvD,IAAI,EAAE,6FAA6F;SACpG,CAAC,CAAC;IACL,CAAC;IACD,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,UAAU,CAAC,IAAwB,EAAE,GAAsB,EAAE,QAAkB,EAAE,MAAc;IAC7G,MAAM,KAAK,GAAG,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;IACnE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,mBAAmB,EAAE;YACvD,IAAI,EAAE,iHAAiH;SACxH,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/core/discovery.d.ts

@@ -0,0 +1,27 @@
+import { type Fetch } from './http.js';
+import { type Service } from './routes.js';
+/**
+ * Discovery: the issuer is the only address the CLI is given. Everything else
+ * comes from the issuer's metadata at `<issuer>/.well-known/openid-configuration`
+ * (RFC 8414), which lists each version's endpoints under `bridge_endpoints`.
+ * The CLI reads version 2 only, so a newer version never changes what it calls.
+ */
+export interface Discovery {
+    readonly issuer: string;
+    /** The app the issuer signs in to: the Bridge App, for the developer. */
+    readonly appId: string;
+    readonly signIn: string;
+    readonly token: string;
+    readonly revoke: string;
+    readonly signOut: string | null;
+    /** Bridge's own sign-in page for programs on this machine, when the issuer lists one. */
+    readonly signInPage: string | null;
+    /** Each microservice's base address at version 2. */
+    readonly bases: Readonly<Record<Service, string>>;
+}
+export declare function metadataUrl(issuer: string): string;
+/** Reads the metadata document into the endpoints the CLI calls. Exposed for tests. */
+export declare function readMetadata(issuer: string, document: unknown): Discovery;
+/** Fetches and reads the issuer's metadata. */
+export declare function discover(fetchFn: Fetch, issuer: string): Promise<Discovery>;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/core/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/core/discovery.ts"],"names":[],"mappings":"AACA,OAAO,EAAQ,KAAK,KAAK,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAe,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AAGxD;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,qDAAqD;IACrD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;CACnD;AAiCD,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,uFAAuF;AACvF,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,SAAS,CA8CzE;AAED,+CAA+C;AAC/C,wBAAsB,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAWjF"}

package/dist/core/discovery.js

@@ -0,0 +1,97 @@
+import { CliError } from './errors.js';
+import { call } from './http.js';
+import { API_VERSION } from './routes.js';
+import { secureUrl } from './urls.js';
+/** The standard fields an issuer at version 2 may list instead of `bridge_endpoints["2"]`. */
+const STANDARD_FIELDS = {
+    sign_in: 'authorization_challenge_endpoint',
+    token: 'token_endpoint',
+    revoke: 'revocation_endpoint',
+};
+function misconfigured(message) {
+    return new CliError('misconfigured', message, {
+        hint: 'Check the issuer: it is the Bridge App\'s issuer, as Bridge publishes it.',
+    });
+}
+function listed(value, name) {
+    if (value === undefined || value === null)
+        return null;
+    const url = secureUrl(value);
+    if (url === null)
+        throw misconfigured(`The issuer's metadata lists "${name}" at an address that is not https: ${String(value)}`);
+    return url.toString().replace(/\/+$/, '');
+}
+function required(value, name) {
+    if (value === null)
+        throw misconfigured(`The issuer's metadata lists no "${name}" endpoint.`);
+    return value;
+}
+/** The address of a microservice's base, from a listed address under it: `<base>/<service>/…` gives `<base>/<service>`. */
+function baseFrom(address, suffix) {
+    if (address === null || !address.endsWith(suffix))
+        return null;
+    return address.slice(0, -suffix.length);
+}
+export function metadataUrl(issuer) {
+    return `${issuer}/.well-known/openid-configuration`;
+}
+/** Reads the metadata document into the endpoints the CLI calls. Exposed for tests. */
+export function readMetadata(issuer, document) {
+    if (typeof document !== 'object' || document === null || Array.isArray(document)) {
+        throw misconfigured('The issuer\'s metadata is not a JSON object.');
+    }
+    const meta = document;
+    if (meta['issuer'] !== issuer) {
+        throw misconfigured(`The metadata names another issuer (${String(meta['issuer'])}) than the one asked for (${issuer}).`);
+    }
+    const appId = meta['bridge_app'];
+    if (typeof appId !== 'string' || appId === '')
+        throw misconfigured('The issuer\'s metadata does not name its app (bridge_app).');
+    const all = meta['bridge_endpoints'];
+    const byVersion = typeof all === 'object' && all !== null ? all[String(API_VERSION)] : undefined;
+    const v2 = typeof byVersion === 'object' && byVersion !== null ? byVersion : null;
+    // Without version 2's own list, the standard fields are read only from an issuer that says it is at version 2.
+    if (v2 === null && meta['bridge_api_version'] !== API_VERSION) {
+        throw misconfigured(`The issuer does not offer version ${String(API_VERSION)} of Bridge's API, which this CLI uses.`);
+    }
+    const endpoint = (name) => required(listed(v2?.[name], name) ?? (meta['bridge_api_version'] === API_VERSION ? listed(meta[STANDARD_FIELDS[name]], STANDARD_FIELDS[name]) : null), name);
+    const accounts = listed(v2?.['accounts'], 'accounts');
+    const billing = listed(v2?.['billing'], 'billing');
+    const flags = listed(v2?.['flags'], 'flags');
+    const sessions = listed(v2?.['sessions'], 'sessions');
+    const signOut = listed(v2?.['sign_out'], 'sign_out');
+    // Listed by name when the issuer lists them; else found next to the ones it lists.
+    const identityAccess = listed(v2?.['identity_access'], 'identity_access') ?? baseFrom(sessions, '/sessions') ?? baseFrom(signOut, '/sign-out');
+    const appRegistry = listed(v2?.['app_registry'], 'app_registry') ?? (baseFrom(accounts, '/accounts') === null ? null : `${baseFrom(accounts, '/accounts')}/app-registry`);
+    return {
+        issuer,
+        appId,
+        signIn: endpoint('sign_in'),
+        token: endpoint('token'),
+        revoke: endpoint('revoke'),
+        signOut,
+        signInPage: listed(v2?.['sign_in_page'], 'sign_in_page') ?? listed(meta['authorization_endpoint'], 'authorization_endpoint'),
+        bases: {
+            'app-registry': required(appRegistry, 'app_registry'),
+            'identity-access': required(identityAccess, 'identity_access'),
+            billing: required(billing, 'billing'),
+            flags: required(flags, 'flags'),
+            accounts: required(accounts, 'accounts'),
+        },
+    };
+}
+/** Fetches and reads the issuer's metadata. */
+export async function discover(fetchFn, issuer) {
+    let body;
+    try {
+        ({ body } = await call(fetchFn, { method: 'GET', url: metadataUrl(issuer) }));
+    }
+    catch (error) {
+        if (error instanceof CliError && (error.kind === 'not-found' || error.kind === 'invalid')) {
+            throw misconfigured(`No Bridge issuer answers at ${issuer}.`);
+        }
+        throw error;
+    }
+    return readMetadata(issuer, body);
+}
+//# sourceMappingURL=discovery.js.map

package/dist/core/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/core/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,IAAI,EAAc,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAgB,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAsBtC,8FAA8F;AAC9F,MAAM,eAAe,GAAG;IACtB,OAAO,EAAE,kCAAkC;IAC3C,KAAK,EAAE,gBAAgB;IACvB,MAAM,EAAE,qBAAqB;CACrB,CAAC;AAEX,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,IAAI,QAAQ,CAAC,eAAe,EAAE,OAAO,EAAE;QAC5C,IAAI,EAAE,2EAA2E;KAClF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,IAAY;IAC1C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,IAAI;QAAE,MAAM,aAAa,CAAC,gCAAgC,IAAI,sCAAsC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjI,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAoB,EAAE,IAAY;IAClD,IAAI,KAAK,KAAK,IAAI;QAAE,MAAM,aAAa,CAAC,mCAAmC,IAAI,aAAa,CAAC,CAAC;IAC9F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2HAA2H;AAC3H,SAAS,QAAQ,CAAC,OAAsB,EAAE,MAAc;IACtD,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,OAAO,GAAG,MAAM,mCAAmC,CAAC;AACtD,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,QAAiB;IAC5D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,MAAM,aAAa,CAAC,8CAA8C,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,IAAI,GAAG,QAAmC,CAAC;IACjD,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,aAAa,CAAC,sCAAsC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,6BAA6B,MAAM,IAAI,CAAC,CAAC;IAC3H,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;QAAE,MAAM,aAAa,CAAC,4DAA4D,CAAC,CAAC;IAEjI,MAAM,GAAG,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAE,GAA+B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9H,MAAM,EAAE,GAAG,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,CAAC,CAAC,CAAE,SAAqC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/G,+GAA+G;IAC/G,IAAI,EAAE,KAAK,IAAI,IAAI,IAAI,CAAC,oBAAoB,CAAC,KAAK,WAAW,EAAE,CAAC;QAC9D,MAAM,aAAa,CAAC,qCAAqC,MAAM,CAAC,WAAW,CAAC,wCAAwC,CAAC,CAAC;IACxH,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,IAAkC,EAAU,EAAE,CAC9D,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAE/J,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;IACrD,mFAAmF;IACnF,MAAM,cAAc,GAAG,MAAM,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC/I,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAW,eAAe,CAAC,CAAC;IAEpL,OAAO;QACL,MAAM;QACN,KAAK;QACL,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC;QAC3B,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC;QACxB,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC;QAC1B,OAAO;QACP,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;QAC5H,KAAK,EAAE;YACL,cAAc,EAAE,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;YACrD,iBAAiB,EAAE,QAAQ,CAAC,cAAc,EAAE,iBAAiB,CAAC;YAC9D,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;YACrC,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;YAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;SACzC;KACF,CAAC;AACJ,CAAC;AAED,+CAA+C;AAC/C,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAc,EAAE,MAAc;IAC3D,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,CAAC,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;YAC1F,MAAM,aAAa,CAAC,+BAA+B,MAAM,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC"}

package/dist/core/errors.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The one error type every command reports. `kind` says what went wrong in
+ * words a script can branch on; `hint` says what to do next.
+ */
+export type CliErrorKind = 'not-signed-in' | 'session-ended' | 'reauthenticate' | 'wrong-credentials' | 'flow-expired' | 'unsupported-step' | 'cancelled' | 'forbidden' | 'plan-required' | 'not-found' | 'conflict' | 'invalid' | 'rate-limited' | 'unavailable' | 'network' | 'not-offered' | 'misconfigured';
+export interface CliErrorOptions {
+    readonly status?: number;
+    readonly hint?: string;
+    readonly details?: unknown;
+}
+export declare class CliError extends Error {
+    readonly kind: CliErrorKind;
+    readonly status: number | undefined;
+    readonly hint: string | undefined;
+    readonly details: unknown;
+    constructor(kind: CliErrorKind, message: string, options?: CliErrorOptions);
+}
+export declare function isCliError(value: unknown): value is CliError;
+/**
+ * Exit codes: 1 for a refused or failed command, 2 when Bridge could not be
+ * reached or could not answer, 3 when the CLI is not set up (no issuer, not
+ * signed in, a setting that is wrong).
+ */
+export declare function exitCodeOf(error: unknown): number;
+export declare const SIGN_IN_AGAIN = "Sign in again with `bridge auth login` (or `bridge auth login --password`).";
+//# sourceMappingURL=errors.d.ts.map

package/dist/core/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,MAAM,YAAY,GACpB,eAAe,GACf,eAAe,GACf,gBAAgB,GAChB,mBAAmB,GACnB,cAAc,GACd,kBAAkB,GAClB,WAAW,GACX,WAAW,GACX,eAAe,GACf,WAAW,GACX,UAAU,GACV,SAAS,GACT,cAAc,GACd,aAAa,GACb,SAAS,GACT,aAAa,GACb,eAAe,CAAC;AAEpB,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;gBAEd,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAQ/E;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAE5D;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAKjD;AAED,eAAO,MAAM,aAAa,gFAAgF,CAAC"}