@nebulr-group/bridge-cli 0.6.5 → 1.0.0-alpha.0

package/dist/commands/auth/login.command.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"login.command.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/login.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAazC,UAAU,YAAY;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAID,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;AAEvC,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAqB5D;AAED,iBAAe,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAiHzD;AAED,iBAAS,iBAAiB,CACxB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE;IACN,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,KAAK,GAAG,WAAW,CAAC;CACjC,GACA,MAAM,CAeR"}

package/dist/commands/auth/login.command.js

@@ -1,166 +0,0 @@
-import { writeCredentials } from '../../credentials.js';
-import { resetManagementClient } from '../../config.js';
-import { generateCodeVerifier, codeChallengeFor, generateState } from '../../auth/pkce.js';
-import { startLoopback, LoopbackError } from '../../auth/loopback.js';
-import { openBrowser } from '../../auth/browser-open.js';
-import { createCliApiClient, CliAuthApiError } from '../../auth/api-client.js';
-import { SCOPE_MANAGEMENT, SCOPE_MANAGEMENT_ADMIN } from '../../auth/scopes.js';
-const DEFAULT_API_BASE_URL = 'https://api.thebridge.dev';
-const DEFAULT_AUTH_BASE_URL = 'https://auth.thebridge.dev';
-export { runLogin, buildAuthorizeUrl };
-export function registerAuthLoginCommand(auth) {
-    auth
-        .command('login')
-        .description('Authenticate via browser (loopback PKCE) and save credentials')
-        .option('--app <id|name>', 'Pin the home app: an app id skips the picker entirely; an app name is resolved on the consent screen (falls back to the picker if not found)')
-        .option('--single-app', 'Ask for a login that covers only the home app. By default the consent screen preselects "Every app in <workspace>", so `bridge app use` / `--app` can switch apps without logging in again')
-        .option('--label <text>', 'Friendly label stored on the token (default: "bridge-cli")')
-        .option('--no-browser', 'Print the authorization URL instead of opening a browser')
-        .option('--reauth', 'Force the consent screen to sign you out and prompt for credentials again')
-        .option('--admin', 'Also request delete authority and the ability to create API tokens. Needed for `bridge token create`, `bridge role delete` and `bridge tenant delete`. Without this the token can read, create and update but cannot delete anything.')
-        .action(async (opts) => {
-        try {
-            await runLogin(opts);
-            process.exitCode = 0;
-        }
-        catch (err) {
-            // Friendly, single-line stderr — never log JWTs / verifiers.
-            const msg = err instanceof Error ? err.message : String(err);
-            process.stderr.write(`bridge auth login: ${msg}\n`);
-            process.exitCode = 1;
-        }
-    });
-}
-async function runLogin(opts) {
-    const apiBaseUrl = (process.env.BRIDGE_BASE_URL?.trim() || DEFAULT_API_BASE_URL).replace(/\/$/, '');
-    const authBaseUrl = (process.env.BRIDGE_AUTH_BASE_URL?.trim() || DEFAULT_AUTH_BASE_URL).replace(/\/$/, '');
-    // 1. PKCE + state.
-    const codeVerifier = generateCodeVerifier();
-    const codeChallenge = codeChallengeFor(codeVerifier);
-    const state = generateState();
-    // 2. Boot the single-shot loopback listener.
-    let loopback;
-    try {
-        loopback = await startLoopback({
-            expectedState: state,
-            // Bounce the browser to a branded success page on cloud-views instead
-            // of leaving the user staring at 127.0.0.1.
-            successRedirectUrl: `${authBaseUrl}/cli/login-complete`,
-        });
-    }
-    catch (err) {
-        throw new Error(`Could not bind a loopback port: ${err instanceof Error ? err.message : String(err)}. ` +
-            'Try `bridge auth login --device` once TBP-108 lands, or check whether your firewall blocks 127.0.0.1.');
-    }
-    const authorizeUrl = buildAuthorizeUrl(authBaseUrl, {
-        challenge: codeChallenge,
-        redirect: loopback.redirectUri,
-        state,
-        appId: opts.app,
-        label: opts.label,
-        reauth: opts.reauth === true,
-        admin: opts.admin === true,
-        appAccess: opts.singleApp === true ? 'app' : 'workspace',
-    });
-    // 3. Open browser (or print URL if --no-browser or open fails).
-    const stdout = process.stdout;
-    // commander's `--no-browser` sets opts.browser === false. Treat unset as the
-    // default (open browser); only skip when explicitly false.
-    const useBrowser = opts.browser !== false;
-    if (!useBrowser) {
-        stdout.write(`Open this URL in your browser to continue:\n  ${authorizeUrl}\n`);
-    }
-    else {
-        const open = await openBrowser(authorizeUrl);
-        if (!open.ok) {
-            stdout.write(`Could not open a browser automatically (${open.reason ?? 'unknown'}). ` +
-                `Open this URL manually:\n  ${authorizeUrl}\n`);
-        }
-        else {
-            stdout.write('Your browser just opened — complete the login there. Waiting...\n');
-        }
-    }
-    // 4. Await the callback. Translate cancel/CSRF/timeout into friendly errors.
-    let result;
-    try {
-        result = await loopback.result;
-    }
-    catch (err) {
-        if (err instanceof LoopbackError) {
-            throw new Error(err.message);
-        }
-        throw err;
-    }
-    // 5. Exchange the code for a JWT.
-    const api = createCliApiClient({ baseUrl: apiBaseUrl });
-    let exchanged;
-    try {
-        exchanged = await api.exchangeCode({
-            code: result.code,
-            codeVerifier,
-        });
-    }
-    catch (err) {
-        if (err instanceof CliAuthApiError) {
-            throw new Error(err.message);
-        }
-        throw err;
-    }
-    // 6. Persist credentials with mode 0600.
-    const issuedAt = new Date().toISOString();
-    const stored = {
-        apiKey: exchanged.api_token,
-        expiresAt: exchanged.expires_at,
-        issuedAt,
-        app: { id: exchanged.app.id, name: exchanged.app.name },
-        user: { id: exchanged.user.id, email: exchanged.user.email },
-        baseUrl: apiBaseUrl,
-        ...(opts.label ? { label: opts.label } : {}),
-        // TBP-769 — what the user actually chose on the consent screen (the URL
-        // only preselected it). An older server omits it: that login is one app.
-        appAccess: exchanged.app_access === 'workspace' ? 'workspace' : 'app',
-    };
-    writeCredentials(stored);
-    // Reset the cached BridgeManagement client so the next command picks up the
-    // new token (relevant when `auth login` is called within the same process).
-    resetManagementClient();
-    // 7. Friendly confirmation.
-    const expiryHuman = formatExpiryDate(exchanged.expires_at);
-    const scope = stored.appAccess === 'workspace'
-        ? `Workspace: every app (home app: ${exchanged.app.name})`
-        : `App: ${exchanged.app.name}`;
-    stdout.write(`Logged in as ${exchanged.user.email}. ${scope}. Token valid until ${expiryHuman}.\n`);
-    if (stored.appAccess === 'workspace') {
-        stdout.write('Run `bridge app list` to see the apps, `bridge app use <id|name>` to switch.\n');
-    }
-}
-function buildAuthorizeUrl(authBaseUrl, params) {
-    const url = new URL(`${authBaseUrl}/cli/authorize`);
-    url.searchParams.set('challenge', params.challenge);
-    url.searchParams.set('redirect', params.redirect);
-    url.searchParams.set('state', params.state);
-    url.searchParams.set('scope', params.admin ? SCOPE_MANAGEMENT_ADMIN : SCOPE_MANAGEMENT);
-    if (params.appId)
-        url.searchParams.set('app_id', params.appId);
-    if (params.label)
-        url.searchParams.set('label', params.label);
-    // TBP-769 — only PRESELECTS the choice on the consent screen; the user decides.
-    if (params.appAccess)
-        url.searchParams.set('app_access', params.appAccess);
-    // OAuth-style `prompt=login` — the consent screen reads this as "clear any
-    // existing browser session and re-prompt for credentials" so users who just
-    // ran `bridge auth logout` aren't dropped straight into the workspace picker.
-    if (params.reauth)
-        url.searchParams.set('prompt', 'login');
-    return url.toString();
-}
-function formatExpiryDate(iso) {
-    const d = new Date(iso);
-    if (Number.isNaN(d.getTime()))
-        return iso;
-    // YYYY-MM-DD HH:MM (local) — easier to glance at than a full ISO.
-    const pad = (n) => String(n).padStart(2, '0');
-    return (`${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())} ` +
-        `${pad(d.getHours())}:${pad(d.getMinutes())}`);
-}
-//# sourceMappingURL=login.command.js.map

package/dist/commands/auth/login.command.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"login.command.js","sourceRoot":"","sources":["../../../src/commands/auth/login.command.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,gBAAgB,EAA0B,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE/E,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAEhF,MAAM,oBAAoB,GAAG,2BAA2B,CAAC;AACzD,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAmB3D,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;AAEvC,MAAM,UAAU,wBAAwB,CAAC,IAAa;IACpD,IAAI;SACD,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,+DAA+D,CAAC;SAC5E,MAAM,CAAC,iBAAiB,EAAE,8IAA8I,CAAC;SACzK,MAAM,CAAC,cAAc,EAAE,4LAA4L,CAAC;SACpN,MAAM,CAAC,gBAAgB,EAAE,4DAA4D,CAAC;SACtF,MAAM,CAAC,cAAc,EAAE,0DAA0D,CAAC;SAClF,MAAM,CAAC,UAAU,EAAE,2EAA2E,CAAC;SAC/F,MAAM,CAAC,SAAS,EAAE,uOAAuO,CAAC;SAC1P,MAAM,CAAC,KAAK,EAAE,IAAkB,EAAE,EAAE;QACnC,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;YACrB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,6DAA6D;YAC7D,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;YACpD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAkB;IACxC,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,oBAAoB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACpG,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,qBAAqB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAE3G,mBAAmB;IACnB,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;IAC5C,MAAM,aAAa,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAE9B,6CAA6C;IAC7C,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,aAAa,CAAC;YAC7B,aAAa,EAAE,KAAK;YACpB,sEAAsE;YACtE,4CAA4C;YAC5C,kBAAkB,EAAE,GAAG,WAAW,qBAAqB;SACxD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,mCAAmC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI;YACrF,uGAAuG,CAC1G,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,iBAAiB,CAAC,WAAW,EAAE;QAClD,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,QAAQ,CAAC,WAAW;QAC9B,KAAK;QACL,KAAK,EAAE,IAAI,CAAC,GAAG;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI;QAC5B,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI;QAC1B,SAAS,EAAE,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW;KACzD,CAAC,CAAC;IAEH,gEAAgE;IAChE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,6EAA6E;IAC7E,2DAA2D;IAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC;IAC1C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,CAAC,iDAAiD,YAAY,IAAI,CAAC,CAAC;IAClF,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CACV,2CAA2C,IAAI,CAAC,MAAM,IAAI,SAAS,KAAK;gBACtE,8BAA8B,YAAY,IAAI,CACjD,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,kCAAkC;IAClC,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IACxD,IAAI,SAAS,CAAC;IACd,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC;YACjC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,eAAe,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,yCAAyC;IACzC,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAsB;QAChC,MAAM,EAAE,SAAS,CAAC,SAAS;QAC3B,SAAS,EAAE,SAAS,CAAC,UAAU;QAC/B,QAAQ;QACR,GAAG,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE;QACvD,IAAI,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE;QAC5D,OAAO,EAAE,UAAU;QACnB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,wEAAwE;QACxE,yEAAyE;QACzE,SAAS,EAAE,SAAS,CAAC,UAAU,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK;KACtE,CAAC;IACF,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAEzB,4EAA4E;IAC5E,4EAA4E;IAC5E,qBAAqB,EAAE,CAAC;IAExB,4BAA4B;IAC5B,MAAM,WAAW,GAAG,gBAAgB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC3D,MAAM,KAAK,GACT,MAAM,CAAC,SAAS,KAAK,WAAW;QAC9B,CAAC,CAAC,mCAAmC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG;QAC1D,CAAC,CAAC,QAAQ,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,CAAC,KAAK,CACV,gBAAgB,SAAS,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,uBAAuB,WAAW,KAAK,CACtF,CAAC;IACF,IAAI,MAAM,CAAC,SAAS,KAAK,WAAW,EAAE,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,WAAmB,EACnB,MASC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,WAAW,gBAAgB,CAAC,CAAC;IACpD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;IACxF,IAAI,MAAM,CAAC,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,gFAAgF;IAChF,IAAI,MAAM,CAAC,SAAS;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,IAAI,MAAM,CAAC,MAAM;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3D,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAAE,OAAO,GAAG,CAAC;IAC1C,kEAAkE;IAClE,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtD,OAAO,CACL,GAAG,CAAC,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG;QAClE,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE,CAC9C,CAAC;AACJ,CAAC"}

package/dist/commands/auth/logout.command.d.ts

@@ -1,21 +0,0 @@
-/**
- * `bridge auth logout` — best-effort revoke + delete credentials file.
- *
- * Behavior:
- *   - No credentials file → "Not logged in." (exit 0).
- *   - Otherwise          → call `POST /v1/auth/cli/revoke` with `x-api-key`,
- *                          treat 401 as success (token already gone), then
- *                          remove it locally. Network errors → warn but still
- *                          remove (the local file is the source of truth for
- *                          "logged in" on this machine).
- *
- * TBP-628 — the file can hold several apps, so logout now has a scope.
- * Bare `logout` removes the ACTIVE credential and leaves the others; the
- * alternative, wiping every app because you finished with one of them, throws
- * away valid tokens and forces browser round-trips to get them back, which is
- * the friction this ticket exists to remove. `--profile` names one, `--all`
- * asks for the old whole-file behaviour explicitly.
- */
-import type { Command } from 'commander';
-export declare function registerAuthLogoutCommand(auth: Command): void;
-//# sourceMappingURL=logout.command.d.ts.map

package/dist/commands/auth/logout.command.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"logout.command.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/logout.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAczC,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAgB7D"}

package/dist/commands/auth/logout.command.js

@@ -1,97 +0,0 @@
-import { credentialsPath, CredentialSelectorError, deleteAllCredentials, findCredential, listCredentials, readCredentials, removeCredential, } from '../../credentials.js';
-import { resetManagementClient } from '../../config.js';
-import { createCliApiClient, CliAuthApiError } from '../../auth/api-client.js';
-export function registerAuthLogoutCommand(auth) {
-    auth
-        .command('logout')
-        .description('Revoke the active CLI token and remove it locally')
-        .option('--profile <label|app-id|app-name>', 'Log out of one specific stored app')
-        .option('--all', 'Log out of every stored app and delete the credentials file')
-        .action(async (opts) => {
-        try {
-            await runLogout(opts);
-            process.exitCode = 0;
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            process.stderr.write(`bridge auth logout: ${msg}\n`);
-            process.exitCode = 1;
-        }
-    });
-}
-async function runLogout(opts = {}) {
-    const stdout = process.stdout;
-    const stderr = process.stderr;
-    let entries;
-    try {
-        entries = listCredentials();
-    }
-    catch (err) {
-        // Malformed credentials file — still delete it so the user gets unstuck.
-        stderr.write(`Warning: existing credentials file at ${credentialsPath()} could not be parsed (${err instanceof Error ? err.message : String(err)}). Removing it.\n`);
-        deleteAllCredentials();
-        stdout.write('Logged out (credentials file removed).\n');
-        return;
-    }
-    if (entries.length === 0) {
-        stdout.write('Not logged in.\n');
-        return;
-    }
-    if (opts.all) {
-        for (const entry of entries)
-            await revoke(entry.creds, stderr);
-        deleteAllCredentials();
-        resetManagementClient();
-        stdout.write(`Logged out of ${entries.length} app(s).\n`);
-        return;
-    }
-    let target;
-    if (opts.profile) {
-        try {
-            target = findCredential(opts.profile);
-        }
-        catch (err) {
-            if (err instanceof CredentialSelectorError)
-                throw new Error(err.message);
-            throw err;
-        }
-    }
-    else {
-        const active = readCredentials();
-        if (!active) {
-            // Several stored, none active. Removing one by guess is exactly the
-            // silent choice this ticket forbids.
-            throw new Error('No active credential. Name one with `--profile <label|app id>`, or use `--all`. ' +
-                `Stored: ${entries.map((e) => e.creds.label ?? e.creds.app.name).join(', ')}.`);
-        }
-        target = entries.find((e) => e.key === active.app.id);
-    }
-    await revoke(target.creds, stderr);
-    const remaining = removeCredential(target.key);
-    resetManagementClient();
-    const name = target.creds.label ?? target.creds.app.name;
-    stdout.write(`Logged out ${target.creds.user.email} from ${name}.\n`);
-    if (remaining > 0) {
-        const rest = listCredentials();
-        const nowActive = rest.find((e) => e.isActive);
-        stdout.write(`  ${remaining} credential(s) still stored` +
-            (nowActive ? `; now using ${nowActive.creds.label ?? nowActive.creds.app.name}` : '') +
-            '.\n');
-    }
-}
-/** Best-effort server-side revoke. Never fatal — local removal is the point. */
-async function revoke(creds, stderr) {
-    const api = createCliApiClient({ baseUrl: creds.baseUrl });
-    try {
-        await api.revokeToken(creds.apiKey);
-    }
-    catch (err) {
-        if (err instanceof CliAuthApiError && err.code === 'network_error') {
-            stderr.write(`Warning: could not reach bridge-api to revoke ${creds.app.name} server-side (${err.message}). Removing local credentials anyway.\n`);
-        }
-        else {
-            stderr.write(`Warning: server-side revoke for ${creds.app.name} returned an error (${err instanceof Error ? err.message : String(err)}). Removing local credentials anyway.\n`);
-        }
-    }
-}
-//# sourceMappingURL=logout.command.js.map

package/dist/commands/auth/logout.command.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"logout.command.js","sourceRoot":"","sources":["../../../src/commands/auth/logout.command.ts"],"names":[],"mappings":"AAmBA,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,eAAe,EACf,gBAAgB,GAEjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE/E,MAAM,UAAU,yBAAyB,CAAC,IAAa;IACrD,IAAI;SACD,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,mDAAmD,CAAC;SAChE,MAAM,CAAC,mCAAmC,EAAE,oCAAoC,CAAC;SACjF,MAAM,CAAC,OAAO,EAAE,6DAA6D,CAAC;SAC9E,MAAM,CAAC,KAAK,EAAE,IAAyC,EAAE,EAAE;QAC1D,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;YACtB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;YACrD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAA4C,EAAE;IACrE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAE9B,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,eAAe,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yEAAyE;QACzE,MAAM,CAAC,KAAK,CACV,yCAAyC,eAAe,EAAE,yBACxD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,mBAAmB,CACpB,CAAC;QACF,oBAAoB,EAAE,CAAC;QACvB,MAAM,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACzD,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,KAAK,MAAM,KAAK,IAAI,OAAO;YAAE,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/D,oBAAoB,EAAE,CAAC;QACvB,qBAAqB,EAAE,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,iBAAiB,OAAO,CAAC,MAAM,YAAY,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IAED,IAAI,MAAM,CAAC;IACX,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,uBAAuB;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACzE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,oEAAoE;YACpE,qCAAqC;YACrC,MAAM,IAAI,KAAK,CACb,kFAAkF;gBAChF,WAAW,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACjF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC;IACzD,CAAC;IAED,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC/C,qBAAqB,EAAE,CAAC;IAExB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,cAAc,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC;IACtE,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CACV,KAAK,SAAS,6BAA6B;YACzC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,KAAK,CACR,CAAC;IACJ,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,MAAM,CAAC,KAAwB,EAAE,MAA0B;IACxE,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACnE,MAAM,CAAC,KAAK,CACV,iDAAiD,KAAK,CAAC,GAAG,CAAC,IAAI,iBAAiB,GAAG,CAAC,OAAO,yCAAyC,CACrI,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CACV,mCAAmC,KAAK,CAAC,GAAG,CAAC,IAAI,uBAC/C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,yCAAyC,CAC1C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/commands/auth/methods.command.d.ts

@@ -1,68 +0,0 @@
-/**
- * `bridge auth methods list|enable|disable <method>` — TBP-547.
- *
- * One view of every login method and one verb to switch any of them.
- *
- *  - `list` prints the same `loginMethods` object as the MCP tool
- *    get_auth_config, from the same `app.get()` that `bridge auth config` and
- *    `bridge info auth-config` read, so the three never disagree.
- *  - `enable` / `disable` flip the one app switch behind the method. Social
- *    providers keep their saved credentials when switched off, so switching
- *    them back on needs no new setup.
- *  - Bridge itself refuses a social provider with no credentials yet
- *    (SIGN_IN_CREDENTIALS_MISSING) and the last remaining sign-in method
- *    (LAST_SIGN_IN_METHOD); its code and fix come through as the error.
- *  - Password has no switch on Bridge: it is listed as always available, and
- *    enabling or disabling it is refused here with that reason.
- */
-import type { Command } from 'commander';
-type AppSwitch = 'magicLinkEnabled' | 'passkeysEnabled' | 'mfaEnabled' | 'googleSsoEnabled' | 'linkedinSsoEnabled' | 'azureAdSsoEnabled' | 'appleSsoEnabled' | 'githubSsoEnabled' | 'facebookSsoEnabled';
-/** Method name → the app switch behind it. Names match get_auth_config. */
-export declare const METHOD_SWITCHES: Readonly<Record<string, AppSwitch>>;
-export declare const METHOD_NAMES: string[];
-type AppLike = Partial<Record<AppSwitch, boolean>>;
-/** The `loginMethods` object get_auth_config returns — kept identical on purpose. */
-export declare function loginMethods(app: AppLike): {
-    password: {
-        enabled: boolean;
-        note: string;
-    };
-    magicLink: {
-        enabled: boolean | undefined;
-    };
-    passkeys: {
-        enabled: boolean | undefined;
-    };
-    mfa: {
-        enabled: boolean | undefined;
-        note: string;
-    };
-    socialProviders: {
-        google: {
-            enabled: boolean | undefined;
-        };
-        linkedin: {
-            enabled: boolean | undefined;
-        };
-        azureAd: {
-            enabled: boolean | undefined;
-        };
-        apple: {
-            enabled: boolean | undefined;
-        };
-        github: {
-            enabled: boolean | undefined;
-        };
-        facebook: {
-            enabled: boolean | undefined;
-        };
-    };
-};
-/** Accepts the canonical name in any case, and kebab/snake forms (magic-link). */
-export declare function resolveMethod(input: string): {
-    method: string;
-    field: AppSwitch;
-};
-export declare function registerAuthMethodsCommands(auth: Command): void;
-export {};
-//# sourceMappingURL=methods.command.d.ts.map

package/dist/commands/auth/methods.command.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"methods.command.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/methods.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIzC,KAAK,SAAS,GACV,kBAAkB,GAClB,iBAAiB,GACjB,YAAY,GACZ,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,GACnB,iBAAiB,GACjB,kBAAkB,GAClB,oBAAoB,CAAC;AAEzB,2EAA2E;AAC3E,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAU/D,CAAC;AAEF,eAAO,MAAM,YAAY,UAAgD,CAAC;AAE1E,KAAK,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AAEnD,qFAAqF;AACrF,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAexC;AAQD,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAkBjF;AAYD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAgC/D"}

package/dist/commands/auth/methods.command.js

@@ -1,91 +0,0 @@
-import { getManagementClient } from '../../config.js';
-import { outputSuccess, outputError } from '../../output.js';
-/** Method name → the app switch behind it. Names match get_auth_config. */
-export const METHOD_SWITCHES = {
-    magicLink: 'magicLinkEnabled',
-    passkeys: 'passkeysEnabled',
-    mfa: 'mfaEnabled',
-    google: 'googleSsoEnabled',
-    linkedin: 'linkedinSsoEnabled',
-    azureAd: 'azureAdSsoEnabled',
-    apple: 'appleSsoEnabled',
-    github: 'githubSsoEnabled',
-    facebook: 'facebookSsoEnabled',
-};
-export const METHOD_NAMES = ['password', ...Object.keys(METHOD_SWITCHES)];
-/** The `loginMethods` object get_auth_config returns — kept identical on purpose. */
-export function loginMethods(app) {
-    return {
-        password: { enabled: true, note: 'Always available on Bridge' },
-        magicLink: { enabled: app.magicLinkEnabled },
-        passkeys: { enabled: app.passkeysEnabled },
-        mfa: { enabled: app.mfaEnabled, note: 'Second factor, not a standalone login method' },
-        socialProviders: {
-            google: { enabled: app.googleSsoEnabled },
-            linkedin: { enabled: app.linkedinSsoEnabled },
-            azureAd: { enabled: app.azureAdSsoEnabled },
-            apple: { enabled: app.appleSsoEnabled },
-            github: { enabled: app.githubSsoEnabled },
-            facebook: { enabled: app.facebookSsoEnabled },
-        },
-    };
-}
-class AuthMethodError extends Error {
-    code;
-    hint;
-    constructor(message, code, hint) {
-        super(message);
-        this.code = code;
-        this.hint = hint;
-    }
-}
-/** Accepts the canonical name in any case, and kebab/snake forms (magic-link). */
-export function resolveMethod(input) {
-    const wanted = input.replace(/[-_\s]/g, '').toLowerCase();
-    const method = METHOD_NAMES.find((m) => m.toLowerCase() === wanted);
-    if (method === 'password') {
-        throw new AuthMethodError('Password sign-in has no switch on Bridge: it is always available, so it cannot be enabled or disabled.', 'PASSWORD_ALWAYS_ON', `To change how people sign in, switch one of these instead: ${Object.keys(METHOD_SWITCHES).join(', ')}.`);
-    }
-    if (!method) {
-        throw new AuthMethodError(`Unknown login method "${input}".`, 'UNKNOWN_AUTH_METHOD', `Use one of: ${Object.keys(METHOD_SWITCHES).join(', ')}. \`bridge auth methods list\` shows them all.`);
-    }
-    return { method, field: METHOD_SWITCHES[method] };
-}
-async function setMethod(input, enabled) {
-    try {
-        const { method, field } = resolveMethod(input);
-        const app = (await getManagementClient().app.update({ [field]: enabled }));
-        outputSuccess({ method, enabled: app[field] === true, loginMethods: loginMethods(app) });
-    }
-    catch (err) {
-        outputError(err);
-    }
-}
-export function registerAuthMethodsCommands(auth) {
-    const methods = auth
-        .command('methods')
-        .description('Every login method in one place: list them, switch one on or off');
-    methods
-        .command('list')
-        .description('List every login method and whether it is on (same as the MCP tool get_auth_config)')
-        .action(async () => {
-        try {
-            const app = (await getManagementClient().app.get());
-            outputSuccess({ loginMethods: loginMethods(app) });
-        }
-        catch (err) {
-            outputError(err);
-        }
-    });
-    methods
-        .command('enable <method>')
-        .description(`Switch a login method on (${Object.keys(METHOD_SWITCHES).join(', ')}). ` +
-        'A social provider needs its credentials first: bridge setup sso --provider <p>')
-        .action((method) => setMethod(method, true));
-    methods
-        .command('disable <method>')
-        .description('Switch a login method off. A social provider keeps its credentials, so enable switches it back on. ' +
-        'Bridge refuses to switch off the last remaining sign-in method.')
-        .action((method) => setMethod(method, false));
-}
-//# sourceMappingURL=methods.command.js.map

package/dist/commands/auth/methods.command.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"methods.command.js","sourceRoot":"","sources":["../../../src/commands/auth/methods.command.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAa7D,2EAA2E;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAwC;IAClE,SAAS,EAAE,kBAAkB;IAC7B,QAAQ,EAAE,iBAAiB;IAC3B,GAAG,EAAE,YAAY;IACjB,MAAM,EAAE,kBAAkB;IAC1B,QAAQ,EAAE,oBAAoB;IAC9B,OAAO,EAAE,mBAAmB;IAC5B,KAAK,EAAE,iBAAiB;IACxB,MAAM,EAAE,kBAAkB;IAC1B,QAAQ,EAAE,oBAAoB;CAC/B,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,UAAU,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;AAI1E,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,OAAO;QACL,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,4BAA4B,EAAE;QAC/D,SAAS,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,gBAAgB,EAAE;QAC5C,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE;QAC1C,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,8CAA8C,EAAE;QACtF,eAAe,EAAE;YACf,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,gBAAgB,EAAE;YACzC,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,kBAAkB,EAAE;YAC7C,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,iBAAiB,EAAE;YAC3C,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE;YACvC,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,gBAAgB,EAAE;YACzC,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,kBAAkB,EAAE;SAC9C;KACF,CAAC;AACJ,CAAC;AAED,MAAM,eAAgB,SAAQ,KAAK;IACK;IAAuB;IAA7D,YAAY,OAAe,EAAW,IAAY,EAAW,IAAY;QACvE,KAAK,CAAC,OAAO,CAAC,CAAC;QADqB,SAAI,GAAJ,IAAI,CAAQ;QAAW,SAAI,GAAJ,IAAI,CAAQ;IAEzE,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;IACpE,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1B,MAAM,IAAI,eAAe,CACvB,wGAAwG,EACxG,oBAAoB,EACpB,8DAA8D,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,eAAe,CACvB,yBAAyB,KAAK,IAAI,EAClC,qBAAqB,EACrB,eAAe,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gDAAgD,CACvG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAa,EAAE,OAAgB;IACtD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,CAAC,MAAM,mBAAmB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAW,CAAC,CAAuB,CAAC;QAC1G,aAAa,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,IAAa;IACvD,MAAM,OAAO,GAAG,IAAI;SACjB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,kEAAkE,CAAC,CAAC;IAEnF,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,qFAAqF,CAAC;SAClG,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,CAAC,MAAM,mBAAmB,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAuB,CAAC;YAC1E,aAAa,CAAC,EAAE,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CACV,6BAA6B,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;QACvE,gFAAgF,CACnF;SACA,MAAM,CAAC,CAAC,MAAc,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAEvD,OAAO;SACJ,OAAO,CAAC,kBAAkB,CAAC;SAC3B,WAAW,CACV,qGAAqG;QACnG,iEAAiE,CACpE;SACA,MAAM,CAAC,CAAC,MAAc,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAC1D,CAAC"}

package/dist/commands/auth/status.command.d.ts

@@ -1,18 +0,0 @@
-/**
- * `bridge auth status` — prints whether a credentials file exists, who it's
- * for, and how long until it expires.
- *
- * Output is plain text (one key=value per line after the first), tuned for
- * humans. Other CLI commands emit structured JSON — auth status is the one
- * place where a developer is most likely to be eyeballing the result, so we
- * optimize for readability over machine-parseability.
- *
- * If the user wants JSON, they can run `cat ~/.config/bridge/credentials.json`.
- *
- * TBP-628 — the file can hold several apps, so this lists ALL of them and marks
- * the active one. Knowing which app is in force is the whole reason somebody
- * runs this command, and it was already the only place that told them.
- */
-import type { Command } from 'commander';
-export declare function registerAuthStatusCommand(auth: Command): void;
-//# sourceMappingURL=status.command.d.ts.map

package/dist/commands/auth/status.command.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"status.command.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/status.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAUzC,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAc7D"}

package/dist/commands/auth/status.command.js

@@ -1,104 +0,0 @@
-import { credentialsPath, isExpired, listCredentials, readCredentialsFile, } from '../../credentials.js';
-import { formatRelativeTime } from '../../auth/relative-time.js';
-export function registerAuthStatusCommand(auth) {
-    auth
-        .command('status')
-        .description('Show current authentication state (who, which app, expiry)')
-        .action(() => {
-        try {
-            runStatus();
-            process.exitCode = 0;
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            process.stderr.write(`bridge auth status: ${msg}\n`);
-            process.exitCode = 1;
-        }
-    });
-}
-function runStatus() {
-    const stdout = process.stdout;
-    // Report on `BRIDGE_API_KEY` separately if set, so a CI user setting the env
-    // var sees something useful.
-    const envApiKey = process.env.BRIDGE_API_KEY?.trim();
-    const envProfile = process.env.BRIDGE_PROFILE?.trim();
-    let entries;
-    try {
-        readCredentialsFile();
-        entries = listCredentials();
-    }
-    catch (err) {
-        stdout.write(`Credentials file at ${credentialsPath()} is unreadable: ${err instanceof Error ? err.message : String(err)}\n` + 'Run `bridge auth login` to refresh, or delete the file manually.\n');
-        return;
-    }
-    if (entries.length === 0) {
-        if (envApiKey && envApiKey.length > 0) {
-            stdout.write('Using BRIDGE_API_KEY from environment (service-account / CI path).\n' +
-                'Run `bridge auth login` to switch to interactive credentials.\n');
-            return;
-        }
-        stdout.write('Not logged in. Run `bridge auth login`.\n');
-        return;
-    }
-    const active = entries.find((e) => e.isActive);
-    if (active) {
-        stdout.write(`Logged in as ${active.creds.user.email}\n`);
-    }
-    else {
-        // A pointer at a credential that is gone. Say so rather than picking one:
-        // an inferred default is exactly what this ticket is about.
-        stdout.write('No active credential selected — run `bridge auth use <profile>` to pick one.\n');
-    }
-    for (const entry of entries) {
-        writeEntry(entry, entries.length > 1);
-    }
-    stdout.write(`  credentials=${credentialsPath()}\n`);
-    if (entries.length > 1) {
-        stdout.write('\nSwitch the default with `bridge auth use <label|app id>`, ' +
-            'or target one command with `--profile <label|app id>`.\n');
-    }
-    if (entries.some((e) => e.creds.appAccess === 'workspace')) {
-        stdout.write('\nWithin a workspace login: `bridge app list`, `bridge app use <id|name>`, ' +
-            'or `--app <id|name>` for one command.\n');
-    }
-    if (envProfile) {
-        stdout.write(`\nBRIDGE_PROFILE=${envProfile} is set — it overrides the active credential above.\n`);
-    }
-    if (envApiKey && envApiKey.length > 0) {
-        // This used to claim the opposite. The credentials file has always won;
-        // saying otherwise is how somebody comes to believe they retargeted the
-        // CLI when they did not (TBP-628).
-        stdout.write('\nNote: BRIDGE_API_KEY is set in your environment but is IGNORED while a ' +
-            'credentials file exists.\nTo use it, run `bridge auth logout --all`. ' +
-            'To target another stored app, use `--profile`.\n');
-    }
-    if (process.env.BRIDGE_APP_ID?.trim()) {
-        stdout.write('\nNote: BRIDGE_APP_ID has no effect. The app is carried by the credential ' +
-            'itself; use `--profile <label|app id>` to target another one.\n');
-    }
-}
-function writeEntry(entry, showMarker) {
-    const stdout = process.stdout;
-    const { creds } = entry;
-    const expiryDelta = new Date(creds.expiresAt).getTime() - Date.now();
-    const expiryRel = formatRelativeTime(expiryDelta);
-    const expiredLabel = isExpired(creds) ? ' (EXPIRED)' : '';
-    const marker = showMarker ? (entry.isActive ? '* ' : '  ') : '';
-    stdout.write(`  ${marker}app=${creds.app.name} (${creds.app.id})\n`);
-    // TBP-769 — what the login covers, and which app commands act on.
-    if (creds.appAccess === 'workspace') {
-        const current = creds.currentApp ?? creds.app;
-        stdout.write(`  ${marker}  scope=workspace (every app)\n`);
-        stdout.write(`  ${marker}  homeApp=${creds.app.name} (${creds.app.id})\n`);
-        stdout.write(`  ${marker}  currentApp=${current.name} (${current.id})${creds.currentApp ? '' : ' — the home app'}\n`);
-    }
-    else {
-        stdout.write(`  ${marker}  scope=single app\n`);
-    }
-    if (creds.label)
-        stdout.write(`  ${marker}  label=${creds.label}\n`);
-    stdout.write(`  ${marker}  user=${creds.user.email}\n`);
-    stdout.write(`  ${marker}  expires=${expiryRel} — ${creds.expiresAt}${expiredLabel}\n`);
-    stdout.write(`  ${marker}  baseUrl=${creds.baseUrl}\n`);
-}
-//# sourceMappingURL=status.command.js.map

package/dist/commands/auth/status.command.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"status.command.js","sourceRoot":"","sources":["../../../src/commands/auth/status.command.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,eAAe,EACf,SAAS,EACT,eAAe,EACf,mBAAmB,GAEpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEjE,MAAM,UAAU,yBAAyB,CAAC,IAAa;IACrD,IAAI;SACD,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,GAAG,EAAE;QACX,IAAI,CAAC;YACH,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;YACrD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAE9B,6EAA6E;IAC7E,6BAA6B;IAC7B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IACrD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IAEtD,IAAI,OAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,mBAAmB,EAAE,CAAC;QACtB,OAAO,GAAG,eAAe,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CACV,uBAAuB,eAAe,EAAE,mBACtC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,IAAI,GAAG,oEAAoE,CAC5E,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,KAAK,CACV,sEAAsE;gBACpE,iEAAiE,CACpE,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,KAAK,CAAC,gBAAgB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;IAC5D,CAAC;SAAM,CAAC;QACN,0EAA0E;QAC1E,4DAA4D;QAC5D,MAAM,CAAC,KAAK,CACV,gFAAgF,CACjF,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,iBAAiB,eAAe,EAAE,IAAI,CAAC,CAAC;IAErD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,KAAK,CACV,8DAA8D;YAC5D,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,KAAK,WAAW,CAAC,EAAE,CAAC;QAC3D,MAAM,CAAC,KAAK,CACV,6EAA6E;YAC3E,yCAAyC,CAC5C,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CACV,oBAAoB,UAAU,uDAAuD,CACtF,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,wEAAwE;QACxE,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,CAAC,KAAK,CACV,2EAA2E;YACzE,uEAAuE;YACvE,kDAAkD,CACrD,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,KAAK,CACV,4EAA4E;YAC1E,iEAAiE,CACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAsB,EAAE,UAAmB;IAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAExB,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACrE,MAAM,SAAS,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEhE,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IACrE,kEAAkE;IAClE,IAAI,KAAK,CAAC,SAAS,KAAK,WAAW,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,GAAG,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,iCAAiC,CAAC,CAAC;QAC3D,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,aAAa,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QAC3E,MAAM,CAAC,KAAK,CACV,KAAK,MAAM,gBAAgB,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,IAAI,CACxG,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,sBAAsB,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,KAAK,CAAC,KAAK;QAAE,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,WAAW,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;IACrE,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,UAAU,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,aAAa,SAAS,MAAM,KAAK,CAAC,SAAS,GAAG,YAAY,IAAI,CAAC,CAAC;IACxF,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,aAAa,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;AAC1D,CAAC"}

package/dist/commands/auth/use.command.d.ts

@@ -1,17 +0,0 @@
-/**
- * `bridge auth use <profile>` — move the persisted default to another stored
- * credential, without a browser round-trip (TBP-628).
- *
- * The credential is already on disk with days left on it; switching is a
- * pointer move. Before this existed the only way to change apps was
- * `auth logout` + `auth login`, which discarded a perfectly valid token and
- * cost a browser trip, so people did not switch — they ran commands against
- * whichever app happened to be active and read the answers as if they came
- * from the one they meant.
- *
- * For a single command, prefer `--profile` / `BRIDGE_PROFILE`: this command
- * mutates state that other processes read.
- */
-import type { Command } from 'commander';
-export declare function registerAuthUseCommand(auth: Command): void;
-//# sourceMappingURL=use.command.d.ts.map