@nebulr-group/bridge-cli 0.6.6 → 1.0.0-alpha.0

package/dist/auth/sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in.js","sourceRoot":"","sources":["../../src/auth/sign-in.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAc,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAwB,MAAM,eAAe,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AA4BlF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAc,EAAE,QAAkB,EAAE,CAAY,EAAE,KAAqB;IAC9G,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAkB,OAAO,EAAE;QAClD,MAAM,EAAE,MAAM;QACd,GAAG,EAAE,CAAC,CAAC,MAAM;QACb,IAAI,EAAE;YACJ,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,cAAc,EAAE,SAAS;YACzB,qBAAqB,EAAE,MAAM;YAC7B,SAAS,EAAE,CAAC,CAAC,KAAK;YAClB,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;SACzE;KACF,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,IAAI,IAAI,EAAE,IAAI,KAAK,WAAW,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAClG,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACvD,CAAC,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAkB,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IACjJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;IACxB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,8DAA8D,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE;YACrI,IAAI,EAAE,wDAAwD;SAC/D,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClD,CAAC;AAaD;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,CAAY,EAAE,OAAsE;IAC9H,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAY,EAAE,QAA4B;IACzE,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAClI,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,4DAA4D,EAAE;YAC9F,IAAI,EAAE,kEAAkE;SACzE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,GAAG,KAAK,IAAI;QAAE,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,uEAAuE,QAAQ,EAAE,CAAC,CAAC;IACzI,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,6DAA6D,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,0BAA0B,GAAG,CAAC,MAAM,GAAG,EAAE;YAChK,IAAI,EAAE,kEAAkE;SACzE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;AAClC,CAAC;AAED,qHAAqH;AACrH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAkB,EAAE,CAAY,EAAE,KAAoB;IAC5F,IAAI,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,uEAAuE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IACjI,CAAC;IACD,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IACrH,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,aAAa,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IACxI,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC5C,KAAK,CAAC,IAAI,CACR,MAAM,CAAC,EAAE;YACP,CAAC,CAAC,iEAAiE,GAAG,EAAE;YACxE,CAAC,CAAC,oDAAoD,GAAG,EAAE,CAC9D,CAAC;QACF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;QACvC,OAAO,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,aAAa,EAAE,CAAC;YACnC,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/auth/store.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Where the developer's session is kept between commands: the operating
+ * system's keychain when there is one, else a file only its owner can read
+ * (mode 0600, in a 0700 directory). One session per issuer.
+ */
+export interface StoredSession {
+    readonly issuer: string;
+    /** The app the issuer signs in to (the Bridge App). */
+    readonly appId: string;
+    readonly accessToken: string;
+    /** When the access token expires, in ms since the epoch. */
+    readonly accessTokenExpiresAt: number;
+    readonly refreshToken: string | null;
+    /** The workspace the tokens are for, when they are for one. */
+    readonly workspace: string | null;
+    readonly signedInAt: number;
+}
+export interface SessionStore {
+    /** `keychain` or `file`, and where. */
+    describe(): string;
+    read(issuer: string): Promise<StoredSession | null>;
+    write(session: StoredSession): Promise<void>;
+    remove(issuer: string): Promise<void>;
+}
+export interface RunResult {
+    readonly code: number;
+    readonly stdout: string;
+    readonly stderr: string;
+}
+/** Runs a program with the given standard input. Secrets go on stdin, never in arguments. */
+export type Runner = (command: string, args: readonly string[], input?: string) => Promise<RunResult>;
+export declare const runProgram: Runner;
+/** Sessions in `<dir>/sessions.json`, readable only by its owner (see `private-files`). */
+export declare class FileStore implements SessionStore {
+    private readonly dir;
+    constructor(dir: string);
+    describe(): string;
+    private all;
+    private save;
+    read(issuer: string): Promise<StoredSession | null>;
+    write(session: StoredSession): Promise<void>;
+    remove(issuer: string): Promise<void>;
+}
+/** macOS: the login keychain, through `security`. */
+export declare class MacKeychainStore implements SessionStore {
+    private readonly run;
+    constructor(run: Runner);
+    describe(): string;
+    read(issuer: string): Promise<StoredSession | null>;
+    write(session: StoredSession): Promise<void>;
+    remove(issuer: string): Promise<void>;
+}
+/** Linux: the Secret Service (GNOME Keyring, KWallet), through `secret-tool`. */
+export declare class SecretToolStore implements SessionStore {
+    private readonly run;
+    constructor(run: Runner);
+    describe(): string;
+    read(issuer: string): Promise<StoredSession | null>;
+    write(session: StoredSession): Promise<void>;
+    remove(issuer: string): Promise<void>;
+}
+/**
+ * The keychain first, the file when the keychain cannot keep it. A session
+ * is read from wherever it is, and removed from both.
+ */
+export declare class KeychainWithFileStore implements SessionStore {
+    private readonly keychain;
+    private readonly file;
+    private readonly warn;
+    constructor(keychain: SessionStore, file: FileStore, warn: (message: string) => void);
+    describe(): string;
+    read(issuer: string): Promise<StoredSession | null>;
+    write(session: StoredSession): Promise<void>;
+    remove(issuer: string): Promise<void>;
+}
+export interface StoreOptions {
+    readonly dir: string;
+    readonly env: NodeJS.ProcessEnv;
+    readonly platform?: NodeJS.Platform;
+    readonly run?: Runner;
+    readonly warn?: (message: string) => void;
+}
+/**
+ * The store to use. `BRIDGE_TOKEN_STORE=file` forces the file (headless
+ * machines, CI); `keychain` forces the keychain; by default the keychain is
+ * used when this machine has one.
+ */
+export declare function chooseStore(options: StoreOptions): SessionStore;
+//# sourceMappingURL=store.d.ts.map

package/dist/auth/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAMA;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,4DAA4D;IAC5D,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,QAAQ,IAAI,MAAM,CAAC;IACnB,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACpD,KAAK,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,6FAA6F;AAC7F,MAAM,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;AAEtG,eAAO,MAAM,UAAU,EAAE,MAgBrB,CAAC;AAYL,2FAA2F;AAC3F,qBAAa,SAAU,YAAW,YAAY;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,MAAM;IAExC,QAAQ,IAAI,MAAM;YAIJ,GAAG;YAYH,IAAI;IAIZ,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAInD,KAAK,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAM5C,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAU5C;AA0BD,qDAAqD;AACrD,qBAAa,gBAAiB,YAAW,YAAY;IACvC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,MAAM;IAExC,QAAQ,IAAI,MAAM;IAIZ,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAKnD,KAAK,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAO5C,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG5C;AAED,iFAAiF;AACjF,qBAAa,eAAgB,YAAW,YAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,MAAM;IAExC,QAAQ,IAAI,MAAM;IAIZ,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAKnD,KAAK,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAK5C,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG5C;AAED;;;GAGG;AACH,qBAAa,qBAAsB,YAAW,YAAY;IAEtD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAFJ,QAAQ,EAAE,YAAY,EACtB,IAAI,EAAE,SAAS,EACf,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI;IAGlD,QAAQ,IAAI,MAAM;IAIZ,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAInD,KAAK,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB5C,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAI5C;AAMD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3C;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,YAAY,CAiB/D"}

package/dist/auth/store.js

@@ -0,0 +1,214 @@
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { delimiter, join } from 'node:path';
+import { CliError } from '../core/errors.js';
+import { readPrivateFile, removePrivateFile, writePrivateFile } from '../core/private-files.js';
+export const runProgram = (command, args, input) => new Promise((resolve) => {
+    let stdout = '';
+    let stderr = '';
+    let child;
+    try {
+        child = spawn(command, [...args], { stdio: ['pipe', 'pipe', 'pipe'] });
+    }
+    catch (error) {
+        resolve({ code: 127, stdout: '', stderr: error instanceof Error ? error.message : String(error) });
+        return;
+    }
+    child.stdout.on('data', (chunk) => (stdout += chunk.toString('utf8')));
+    child.stderr.on('data', (chunk) => (stderr += chunk.toString('utf8')));
+    child.on('error', (error) => resolve({ code: 127, stdout, stderr: error.message }));
+    child.on('close', (code) => resolve({ code: code ?? 1, stdout, stderr }));
+    child.stdin.end(input ?? '');
+});
+function isSession(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const s = value;
+    return typeof s['issuer'] === 'string' && typeof s['appId'] === 'string' && typeof s['accessToken'] === 'string' && typeof s['accessTokenExpiresAt'] === 'number';
+}
+// ── File ─────────────────────────────────────────────────────────────────────
+const FILE = 'sessions.json';
+/** Sessions in `<dir>/sessions.json`, readable only by its owner (see `private-files`). */
+export class FileStore {
+    dir;
+    constructor(dir) {
+        this.dir = dir;
+    }
+    describe() {
+        return `file ${join(this.dir, FILE)}`;
+    }
+    async all() {
+        const raw = await readPrivateFile(this.dir, FILE);
+        if (raw === null)
+            return {};
+        try {
+            const parsed = JSON.parse(raw);
+            if (typeof parsed !== 'object' || parsed === null)
+                return {};
+            return Object.fromEntries(Object.entries(parsed).filter((entry) => isSession(entry[1])));
+        }
+        catch {
+            return {};
+        }
+    }
+    async save(all) {
+        await writePrivateFile(this.dir, FILE, JSON.stringify(all, null, 2) + '\n');
+    }
+    async read(issuer) {
+        return (await this.all())[issuer] ?? null;
+    }
+    async write(session) {
+        const all = await this.all();
+        all[session.issuer] = session;
+        await this.save(all);
+    }
+    async remove(issuer) {
+        const all = await this.all();
+        if (!(issuer in all))
+            return;
+        delete all[issuer];
+        if (Object.keys(all).length === 0) {
+            await removePrivateFile(this.dir, FILE);
+            return;
+        }
+        await this.save(all);
+    }
+}
+// ── Keychain ─────────────────────────────────────────────────────────────────
+const SERVICE = 'bridge-cli';
+/** The session as one base64 text, so it passes through a keychain tool with no quoting. */
+function encode(session) {
+    return Buffer.from(JSON.stringify(session), 'utf8').toString('base64');
+}
+function decode(text) {
+    try {
+        const parsed = JSON.parse(Buffer.from(text.trim(), 'base64').toString('utf8'));
+        return isSession(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The account name a session is kept under: the issuer, which a URL parser has already encoded. */
+function account(issuer) {
+    if (/["'\\\s]/.test(issuer))
+        throw new CliError('misconfigured', 'The issuer has characters a keychain entry cannot be named with.');
+    return issuer;
+}
+/** macOS: the login keychain, through `security`. */
+export class MacKeychainStore {
+    run;
+    constructor(run) {
+        this.run = run;
+    }
+    describe() {
+        return 'macOS keychain';
+    }
+    async read(issuer) {
+        const found = await this.run('security', ['find-generic-password', '-s', SERVICE, '-a', account(issuer), '-w']);
+        return found.code === 0 ? decode(found.stdout) : null;
+    }
+    async write(session) {
+        // `security -i` reads the command from stdin, so the secret never shows in the process list.
+        const line = `add-generic-password -U -s ${SERVICE} -a "${account(session.issuer)}" -l "Bridge CLI session" -w "${encode(session)}"\n`;
+        const done = await this.run('security', ['-i'], line);
+        if (done.code !== 0 || /error/i.test(done.stderr))
+            throw new Error(`The keychain refused the session: ${done.stderr.trim()}`);
+    }
+    async remove(issuer) {
+        await this.run('security', ['delete-generic-password', '-s', SERVICE, '-a', account(issuer)]);
+    }
+}
+/** Linux: the Secret Service (GNOME Keyring, KWallet), through `secret-tool`. */
+export class SecretToolStore {
+    run;
+    constructor(run) {
+        this.run = run;
+    }
+    describe() {
+        return 'Secret Service keyring';
+    }
+    async read(issuer) {
+        const found = await this.run('secret-tool', ['lookup', 'service', SERVICE, 'account', account(issuer)]);
+        return found.code === 0 ? decode(found.stdout) : null;
+    }
+    async write(session) {
+        const done = await this.run('secret-tool', ['store', '--label=Bridge CLI session', 'service', SERVICE, 'account', account(session.issuer)], encode(session));
+        if (done.code !== 0)
+            throw new Error(`The keyring refused the session: ${done.stderr.trim()}`);
+    }
+    async remove(issuer) {
+        await this.run('secret-tool', ['clear', 'service', SERVICE, 'account', account(issuer)]);
+    }
+}
+/**
+ * The keychain first, the file when the keychain cannot keep it. A session
+ * is read from wherever it is, and removed from both.
+ */
+export class KeychainWithFileStore {
+    keychain;
+    file;
+    warn;
+    constructor(keychain, file, warn) {
+        this.keychain = keychain;
+        this.file = file;
+        this.warn = warn;
+    }
+    describe() {
+        return this.keychain.describe();
+    }
+    async read(issuer) {
+        return (await this.keychain.read(issuer)) ?? (await this.file.read(issuer));
+    }
+    async write(session) {
+        try {
+            await this.keychain.write(session);
+            // Read it back: a keychain tool that cut a long entry short must not leave a session that cannot be read.
+            const back = await this.keychain.read(session.issuer);
+            if (back === null || JSON.stringify(back) !== JSON.stringify(session)) {
+                await this.keychain.remove(session.issuer).catch(() => undefined);
+                throw new Error('The keychain did not keep the session whole.');
+            }
+        }
+        catch (error) {
+            this.warn(`${error instanceof Error ? error.message : String(error)} Keeping it in ${this.file.describe()} instead.`);
+            await this.file.write(session);
+            return;
+        }
+        await this.file.remove(session.issuer);
+    }
+    async remove(issuer) {
+        await this.keychain.remove(issuer);
+        await this.file.remove(issuer);
+    }
+}
+function onPath(program, env) {
+    return (env['PATH'] ?? '').split(delimiter).some((dir) => dir !== '' && existsSync(join(dir, program)));
+}
+/**
+ * The store to use. `BRIDGE_TOKEN_STORE=file` forces the file (headless
+ * machines, CI); `keychain` forces the keychain; by default the keychain is
+ * used when this machine has one.
+ */
+export function chooseStore(options) {
+    const platform = options.platform ?? process.platform;
+    const run = options.run ?? runProgram;
+    const warn = options.warn ?? ((message) => process.stderr.write(`${message}\n`));
+    const file = new FileStore(options.dir);
+    const wanted = (options.env['BRIDGE_TOKEN_STORE'] ?? 'auto').toLowerCase();
+    if (wanted === 'file')
+        return file;
+    let keychain = null;
+    if (platform === 'darwin' && (wanted === 'keychain' || existsSync('/usr/bin/security')))
+        keychain = new MacKeychainStore(run);
+    if (platform === 'linux' && (wanted === 'keychain' || (onPath('secret-tool', options.env) && options.env['DBUS_SESSION_BUS_ADDRESS']))) {
+        keychain = new SecretToolStore(run);
+    }
+    if (keychain === null) {
+        if (wanted === 'keychain')
+            throw new CliError('misconfigured', 'This machine has no keychain the CLI can use.', { hint: 'Unset BRIDGE_TOKEN_STORE, or set it to file.' });
+        return file;
+    }
+    return new KeychainWithFileStore(keychain, file, warn);
+}
+//# sourceMappingURL=store.js.map

package/dist/auth/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAqChG,MAAM,CAAC,MAAM,UAAU,GAAW,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CACzD,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IACtB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnG,OAAO;IACT,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/E,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/E,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACpF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1E,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEL,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,sBAAsB,CAAC,KAAK,QAAQ,CAAC;AACpK,CAAC;AAED,gFAAgF;AAEhF,MAAM,IAAI,GAAG,eAAe,CAAC;AAE7B,2FAA2F;AAC3F,MAAM,OAAO,SAAS;IACS;IAA7B,YAA6B,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;IAAG,CAAC;IAE5C,QAAQ;QACN,OAAO,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;IACxC,CAAC;IAEO,KAAK,CAAC,GAAG;QACf,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClD,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;YAC1C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,EAAE,CAAC;YAC7D,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAoC,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,GAAkC;QACnD,MAAM,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAc;QACvB,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAsB;QAChC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC;QAC9B,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;YAAE,OAAO;QAC7B,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;CACF;AAED,gFAAgF;AAEhF,MAAM,OAAO,GAAG,YAAY,CAAC;AAE7B,4FAA4F;AAC5F,SAAS,MAAM,CAAC,OAAsB;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;QAC1F,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,oGAAoG;AACpG,SAAS,OAAO,CAAC,MAAc;IAC7B,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,kEAAkE,CAAC,CAAC;IACrI,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qDAAqD;AACrD,MAAM,OAAO,gBAAgB;IACE;IAA7B,YAA6B,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;IAAG,CAAC;IAE5C,QAAQ;QACN,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAc;QACvB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAChH,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAsB;QAChC,6FAA6F;QAC7F,MAAM,IAAI,GAAG,8BAA8B,OAAO,QAAQ,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,iCAAiC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QACvI,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChI,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc;QACzB,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChG,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,OAAO,eAAe;IACG;IAA7B,YAA6B,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;IAAG,CAAC;IAE5C,QAAQ;QACN,OAAO,wBAAwB,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAc;QACvB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACxG,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAsB;QAChC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,4BAA4B,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7J,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc;QACzB,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3F,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAqB;IAEb;IACA;IACA;IAHnB,YACmB,QAAsB,EACtB,IAAe,EACf,IAA+B;QAF/B,aAAQ,GAAR,QAAQ,CAAc;QACtB,SAAI,GAAJ,IAAI,CAAW;QACf,SAAI,GAAJ,IAAI,CAA2B;IAC/C,CAAC;IAEJ,QAAQ;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAc;QACvB,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAsB;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,0GAA0G;YAC1G,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACtD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YACtH,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc;QACzB,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;CACF;AAED,SAAS,MAAM,CAAC,OAAe,EAAE,GAAsB;IACrD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AAC1G,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,OAAqB;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC;IACtC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,IAAI,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3E,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,QAAQ,GAAwB,IAAI,CAAC;IACzC,IAAI,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,KAAK,UAAU,IAAI,UAAU,CAAC,mBAAmB,CAAC,CAAC;QAAE,QAAQ,GAAG,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC9H,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE,CAAC;QACvI,QAAQ,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,IAAI,MAAM,KAAK,UAAU;YAAE,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,+CAA+C,EAAE,EAAE,IAAI,EAAE,8CAA8C,EAAE,CAAC,CAAC;QAC1K,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,qBAAqB,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACzD,CAAC"}

package/dist/bin.js

@@ -1,8 +1,6 @@
 #!/usr/bin/env node
 import { program } from './cli.js';
 program.parseAsync(process.argv).catch(() => {
-    // Keep a more specific code already set (e.g. 3 for a config error printed
-    // by the preAction hook before it aborted the action).
     if (!process.exitCode)
         process.exitCode = 1;
 });

package/dist/bin.js.map

@@ -1 +1 @@
-{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEnC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;IAC1C,2EAA2E;IAC3E,uDAAuD;IACvD,IAAI,CAAC,OAAO,CAAC,QAAQ;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AAC9C,CAAC,CAAC,CAAC"}
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEnC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;IAC1C,IAAI,CAAC,OAAO,CAAC,QAAQ;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AAC9C,CAAC,CAAC,CAAC"}

package/dist/cli.d.ts

@@ -1,3 +1,2 @@
-import { Command } from 'commander';
-export declare const program: Command;
+export declare const program: import("commander").Command;
 //# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AASpC,eAAO,MAAM,OAAO,SAAgB,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,OAAO,6BAQnB,CAAC"}

package/dist/cli.js

@@ -1,20 +1,16 @@
 import { readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
-import { Command } from 'commander';
-import { registerCommands, registerGlobalOptions } from './program.js';
-// Read version from package.json so `bridge --version` never drifts from the
-// published package. dist/cli.js lives at <pkg>/dist/cli.js, so `../package.json`
-// resolves to the package root in both the published tarball and during dev.
-const pkgPath = join(dirname(fileURLToPath(import.meta.url)), '..', 'package.json');
-const { version } = JSON.parse(readFileSync(pkgPath, 'utf8'));
-export const program = new Command();
-program
-    .name('bridge')
-    .description('Bridge platform CLI — optimized for AI coding agents')
-    .version(version);
-// TBP-628 `--profile` (which stored login) and TBP-769 `--app` (which app
-// within that login), plus the preAction hook that applies them.
-registerGlobalOptions(program);
-registerCommands(program);
+import { fileURLToPath } from 'node:url';
+import { openBrowser } from './auth/browser-open.js';
+import { processIo } from './io.js';
+import { buildProgram } from './program.js';
+// dist/cli.js sits at <package>/dist/cli.js, so the version is in ../package.json.
+const here = dirname(fileURLToPath(import.meta.url));
+const { version } = JSON.parse(readFileSync(join(here, '..', 'package.json'), 'utf8'));
+export const program = buildProgram({
+    fetch: (input, init) => fetch(input, init),
+    env: process.env,
+    io: processIo,
+    openBrowser,
+}, version);
 //# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAEvE,6EAA6E;AAC7E,kFAAkF;AAClF,6EAA6E;AAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;AACpF,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAwB,CAAC;AAErF,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAErC,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CAAC,sDAAsD,CAAC;KACnE,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,0EAA0E;AAC1E,iEAAiE;AACjE,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAE/B,gBAAgB,CAAC,OAAO,CAAC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,mFAAmF;AACnF,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACrD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAwB,CAAC;AAE9G,MAAM,CAAC,MAAM,OAAO,GAAG,YAAY,CACjC;IACE,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC;IAC1C,GAAG,EAAE,OAAO,CAAC,GAAG;IAChB,EAAE,EAAE,SAAS;IACb,WAAW;CACZ,EACD,OAAO,CACR,CAAC"}

package/dist/client.d.ts

@@ -0,0 +1,31 @@
+import type { Sessions } from './auth/session.js';
+import type { Discovery } from './core/discovery.js';
+import { type Fetch, type HttpResponse } from './core/http.js';
+import { type RouteName } from './core/routes.js';
+export interface CallOptions {
+    readonly params?: Readonly<Record<string, string>>;
+    readonly query?: Readonly<Record<string, string | undefined>>;
+    readonly body?: unknown;
+    readonly headers?: Readonly<Record<string, string>>;
+}
+export interface KeyCallOptions extends CallOptions {
+    /** For routes that act in one workspace of the app. */
+    readonly workspace?: string;
+}
+/**
+ * Calls Bridge's version 2 API for the signed-in developer. Every call is a
+ * named route from {@link ROUTES}; its address is the microservice's base
+ * from the issuer's metadata plus the route's path.
+ */
+export declare class BridgeClient {
+    readonly discovery: Discovery;
+    private readonly fetchFn;
+    readonly sessions: Sessions;
+    constructor(discovery: Discovery, fetchFn: Fetch, sessions: Sessions);
+    url(name: RouteName, params?: Readonly<Record<string, string>>, query?: Readonly<Record<string, string | undefined>>): string;
+    /** A call with the developer's token. Renewed first when it is about to expire, and once more if Bridge refuses it. */
+    person<T = unknown>(name: RouteName, options?: CallOptions): Promise<HttpResponse<T>>;
+    /** A call with an app key, for the routes version 2 offers only to the app's own server. */
+    withKey<T = unknown>(name: RouteName, key: string, options?: KeyCallOptions): Promise<HttpResponse<T>>;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAQ,KAAK,KAAK,EAAE,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAU,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAG1D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,uDAAuD;IACvD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;GAIG;AACH,qBAAa,YAAY;IAErB,QAAQ,CAAC,SAAS,EAAE,SAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,QAAQ,CAAC,QAAQ,EAAE,QAAQ;gBAFlB,SAAS,EAAE,SAAS,EACZ,OAAO,EAAE,KAAK,EACtB,QAAQ,EAAE,QAAQ;IAG7B,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAM,EAAE,KAAK,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAM,GAAG,MAAM;IAOrI,uHAAuH;IACjH,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAkB/F,4FAA4F;IACtF,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;CAiBjH"}

package/dist/client.js

@@ -0,0 +1,67 @@
+import { CliError } from './core/errors.js';
+import { call } from './core/http.js';
+import { ROUTES } from './core/routes.js';
+import { fillPath } from './core/urls.js';
+/**
+ * Calls Bridge's version 2 API for the signed-in developer. Every call is a
+ * named route from {@link ROUTES}; its address is the microservice's base
+ * from the issuer's metadata plus the route's path.
+ */
+export class BridgeClient {
+    discovery;
+    fetchFn;
+    sessions;
+    constructor(discovery, fetchFn, sessions) {
+        this.discovery = discovery;
+        this.fetchFn = fetchFn;
+        this.sessions = sessions;
+    }
+    url(name, params = {}, query = {}) {
+        const route = ROUTES[name];
+        const url = new URL(this.discovery.bases[route.service] + fillPath(route.path, { issuerApp: this.discovery.appId, ...params }));
+        for (const [key, value] of Object.entries(query))
+            if (value !== undefined)
+                url.searchParams.set(key, value);
+        return url.toString();
+    }
+    /** A call with the developer's token. Renewed first when it is about to expire, and once more if Bridge refuses it. */
+    async person(name, options = {}) {
+        const route = ROUTES[name];
+        if (route.auth !== 'person')
+            throw new Error(`${name} does not take the developer's token.`);
+        const send = (token) => call(this.fetchFn, {
+            method: route.method,
+            url: this.url(name, options.params, options.query),
+            headers: { ...options.headers, authorization: `Bearer ${token}` },
+            body: options.body,
+        });
+        try {
+            return await send(await this.sessions.accessToken(this.discovery));
+        }
+        catch (error) {
+            if (!(error instanceof CliError) || error.status !== 401 || error.kind === 'reauthenticate')
+                throw error;
+            return send(await this.sessions.accessToken(this.discovery, { force: true }));
+        }
+    }
+    /** A call with an app key, for the routes version 2 offers only to the app's own server. */
+    async withKey(name, key, options = {}) {
+        const route = ROUTES[name];
+        if (route.auth !== 'app-key')
+            throw new Error(`${name} does not take an app key.`);
+        if ('workspace' in route && options.workspace === undefined) {
+            throw new CliError('invalid', 'Name the workspace with --workspace <id> (`bridge workspace list` shows them).');
+        }
+        return call(this.fetchFn, {
+            method: route.method,
+            url: this.url(name, options.params, options.query),
+            headers: {
+                ...options.headers,
+                'x-api-key': key,
+                ...(options.workspace === undefined ? {} : { 'bridge-workspace': options.workspace }),
+            },
+            body: options.body,
+        });
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAiC,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,MAAM,EAAkB,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAc1C;;;;GAIG;AACH,MAAM,OAAO,YAAY;IAEZ;IACQ;IACR;IAHX,YACW,SAAoB,EACZ,OAAc,EACtB,QAAkB;QAFlB,cAAS,GAAT,SAAS,CAAW;QACZ,YAAO,GAAP,OAAO,CAAO;QACtB,aAAQ,GAAR,QAAQ,CAAU;IAC1B,CAAC;IAEJ,GAAG,CAAC,IAAe,EAAE,SAA2C,EAAE,EAAE,QAAsD,EAAE;QAC1H,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;QAChI,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,IAAI,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5G,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED,uHAAuH;IACvH,KAAK,CAAC,MAAM,CAAc,IAAe,EAAE,UAAuB,EAAE;QAClE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uCAAuC,CAAC,CAAC;QAC7F,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAC7B,IAAI,CAAI,IAAI,CAAC,OAAO,EAAE;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC;YAClD,OAAO,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;YACjE,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACL,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,QAAQ,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB;gBAAE,MAAM,KAAK,CAAC;YACzG,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,OAAO,CAAc,IAAe,EAAE,GAAW,EAAE,UAA0B,EAAE;QACnF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,4BAA4B,CAAC,CAAC;QACnF,IAAI,WAAW,IAAI,KAAK,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5D,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE,gFAAgF,CAAC,CAAC;QAClH,CAAC;QACD,OAAO,IAAI,CAAI,IAAI,CAAC,OAAO,EAAE;YAC3B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC;YAClD,OAAO,EAAE;gBACP,GAAG,OAAO,CAAC,OAAO;gBAClB,WAAW,EAAE,GAAG;gBAChB,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;aACtF;YACD,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/commands/accounts.command.d.ts

@@ -0,0 +1,4 @@
+import type { Command } from 'commander';
+import { type Deps } from './context.js';
+export declare function registerAccountCommands(program: Command, deps: Deps): void;
+//# sourceMappingURL=accounts.command.d.ts.map

package/dist/commands/accounts.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accounts.command.d.ts","sourceRoot":"","sources":["../../src/commands/accounts.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKzC,OAAO,EAAiC,KAAK,IAAI,EAAE,MAAM,cAAc,CAAC;AAuBxE,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAqH1E"}