@openbkn/bkn-sdk 0.1.1-alpha.18 → 0.1.1-alpha.19

package/dist/{chunk-LCOMMFH7.js → chunk-ISJHU26W.js}

@@ -78,6 +78,23 @@ function truncate(s, n) {
 
 // src/auth/oauth.ts
 import { spawn } from "child_process";
+
+// src/api/tls.ts
+import { Agent, fetch as undiciFetch } from "undici";
+var insecureAgent;
+function insecureDispatcher() {
+  insecureAgent ??= new Agent({ connect: { rejectUnauthorized: false } });
+  return insecureAgent;
+}
+function tlsFetch(insecure, url, init) {
+  if (!insecure) return fetch(url, init);
+  return undiciFetch(url, {
+    ...init,
+    dispatcher: insecureDispatcher()
+  });
+}
+
+// src/auth/oauth.ts
 function normalizeBaseUrl(value) {
   return value.replace(/\/+$/, "");
 }
@@ -118,22 +135,9 @@ function mergeCookies(existing, res) {
   for (const sc of setCookies) add(sc.split(";")[0]?.trim() ?? "");
   return [...map.entries()].map(([k, v]) => `${k}=${v}`).join("; ");
 }
-async function fetchAuthStatus(baseUrl) {
-  try {
-    const res = await fetch(`${normalizeBaseUrl(baseUrl)}/install-status.json`, {
-      headers: { Accept: "application/json" }
-    });
-    if (!res.ok) return null;
-    const j = await res.json();
-    if (!j.auth) return null;
-    return { enabled: Boolean(j.auth.enabled), stack: j.auth.stack };
-  } catch {
-    return null;
-  }
-}
-async function refreshAccessToken(baseUrl, refreshToken, clientId = "openbkn-sdk") {
+async function refreshAccessToken(baseUrl, refreshToken, clientId = "openbkn-sdk", insecure) {
   const base = normalizeBaseUrl(baseUrl);
-  const res = await fetch(`${base}/oauth2/token`, {
+  const res = await tlsFetch(insecure, `${base}/oauth2/token`, {
     method: "POST",
     headers: {
       "Content-Type": "application/x-www-form-urlencoded",
@@ -163,10 +167,10 @@ var form = (body) => ({
   },
   body: new URLSearchParams(body).toString()
 });
-async function requestDeviceCode(base, clientId, scope, audience) {
+async function requestDeviceCode(base, clientId, scope, audience, insecure) {
   const params = { client_id: clientId, scope };
   if (audience) params.audience = audience;
-  const res = await fetch(`${base}/oauth2/device/auth`, form(params));
+  const res = await tlsFetch(insecure, `${base}/oauth2/device/auth`, form(params));
   if (!res.ok) {
     throw new Error(`Device auth failed (${res.status}): ${await res.text() || res.statusText}`);
   }
@@ -178,12 +182,13 @@ async function requestDeviceCode(base, clientId, scope, audience) {
   }
   return da;
 }
-async function pollDeviceToken(base, deviceCode, clientId, intervalMs, windowMs) {
+async function pollDeviceToken(base, deviceCode, clientId, intervalMs, windowMs, insecure) {
   let interval = intervalMs;
   const deadline = Date.now() + windowMs;
   while (Date.now() < deadline) {
     await new Promise((r) => setTimeout(r, interval));
-    const tokRes = await fetch(
+    const tokRes = await tlsFetch(
+      insecure,
       `${base}/oauth2/token`,
       form({ grant_type: DEVICE_GRANT, device_code: deviceCode, client_id: clientId })
     );
@@ -209,14 +214,27 @@ async function pollDeviceToken(base, deviceCode, clientId, intervalMs, windowMs)
 async function deviceLogin(baseUrl, opts = {}) {
   const base = normalizeBaseUrl(baseUrl);
   const clientId = opts.clientId ?? DEFAULT_DEVICE_CLIENT_ID;
-  const da = await requestDeviceCode(base, clientId, opts.scope ?? DEVICE_SCOPE, opts.audience);
+  const da = await requestDeviceCode(
+    base,
+    clientId,
+    opts.scope ?? DEVICE_SCOPE,
+    opts.audience,
+    opts.insecure
+  );
   opts.onPrompt?.({
     userCode: da.user_code,
     verificationUri: onBaseHost(base, da.verification_uri),
     verificationUriComplete: da.verification_uri_complete ? onBaseHost(base, da.verification_uri_complete) : void 0
   });
   const windowMs = Math.min(opts.timeoutMs ?? Number.POSITIVE_INFINITY, da.expires_in * 1e3);
-  return pollDeviceToken(base, da.device_code, clientId, (da.interval ?? 5) * 1e3, windowMs);
+  return pollDeviceToken(
+    base,
+    da.device_code,
+    clientId,
+    (da.interval ?? 5) * 1e3,
+    windowMs,
+    opts.insecure
+  );
 }
 function onBaseHost(base, uri) {
   try {
@@ -230,10 +248,16 @@ function onBaseHost(base, uri) {
 async function credentialDeviceLogin(baseUrl, username, password, opts = {}) {
   const base = normalizeBaseUrl(baseUrl);
   const clientId = opts.clientId ?? DEFAULT_DEVICE_CLIENT_ID;
-  const da = await requestDeviceCode(base, clientId, opts.scope ?? DEVICE_SCOPE, opts.audience);
+  const da = await requestDeviceCode(
+    base,
+    clientId,
+    opts.scope ?? DEVICE_SCOPE,
+    opts.audience,
+    opts.insecure
+  );
   let jar = "";
   const hop = async (url, init) => {
-    const r = await fetch(url, {
+    const r = await tlsFetch(opts.insecure, url, {
       method: init?.method ?? "GET",
       headers: { Cookie: jar, Accept: "text/html,*/*;q=0.8", ...init?.headers ?? {} },
       body: init?.body,
@@ -271,26 +295,25 @@ async function credentialDeviceLogin(baseUrl, username, password, opts = {}) {
     loc = r.headers.get("location");
   }
   const windowMs = Math.min(opts.timeoutMs ?? Number.POSITIVE_INFINITY, da.expires_in * 1e3);
-  return pollDeviceToken(base, da.device_code, clientId, (da.interval ?? 5) * 1e3, windowMs);
+  return pollDeviceToken(
+    base,
+    da.device_code,
+    clientId,
+    (da.interval ?? 5) * 1e3,
+    windowMs,
+    opts.insecure
+  );
 }
 
 // src/api/headers.ts
 function buildHeaders(ctx, extra) {
   return {
-    // No token = a no-auth platform (no bkn-safe); send no Authorization.
-    ...ctx.token ? { authorization: `Bearer ${ctx.token}`, token: ctx.token } : {},
+    authorization: `Bearer ${ctx.token}`,
     "x-business-domain": ctx.businessDomain,
     ...extra
   };
 }
 
-// src/api/tls.ts
-function applyTls(ctx) {
-  if (ctx.insecure && process.env.NODE_TLS_REJECT_UNAUTHORIZED !== "0") {
-    process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
-  }
-}
-
 // src/api/http.ts
 var DEFAULT_TIMEOUT_MS = 3e4;
 async function request(ctx, path, init = {}) {
@@ -302,11 +325,10 @@ async function request(ctx, path, init = {}) {
       url.searchParams.set(k, String(v));
     }
   }
-  applyTls(ctx);
   const hasBody = init.body !== void 0;
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), init.timeoutMs ?? DEFAULT_TIMEOUT_MS);
-  const send = () => fetch(url, {
+  const send = () => tlsFetch(ctx.insecure, url, {
     method: init.method ?? (hasBody ? "POST" : "GET"),
     headers: buildHeaders(ctx, {
       ...hasBody ? { "content-type": "application/json" } : {},
@@ -336,7 +358,12 @@ function hintFor(ctx, status2) {
 async function tryRefresh(ctx) {
   if (!ctx.refresh) return false;
   try {
-    const t = await refreshAccessToken(ctx.baseUrl, ctx.refresh.refreshToken, ctx.refresh.clientId);
+    const t = await refreshAccessToken(
+      ctx.baseUrl,
+      ctx.refresh.refreshToken,
+      ctx.refresh.clientId,
+      ctx.insecure
+    );
     ctx.token = t.accessToken;
     if (t.refreshToken) ctx.refresh.refreshToken = t.refreshToken;
     ctx.refresh.persist(t);
@@ -381,6 +408,7 @@ function isExpired(claims, nowMs = Date.now()) {
 
 // src/config/store.ts
 var PROFILE_RE = /^[A-Za-z0-9_-]{1,64}$/;
+var USER_ID_RE = /^[A-Za-z0-9._@-]{1,128}$/;
 var IS_WIN = process.platform === "win32";
 function configDir() {
   return process.env.BKN_CONFIG_DIR ?? join(homedir(), ".bkn");
@@ -407,7 +435,14 @@ function userDir(baseUrl, userId) {
   return join(platformDir(baseUrl), "users", userId);
 }
 function userIdFromToken(token) {
-  return decodeJwt(token.idToken ?? "")?.sub ?? decodeJwt(token.accessToken)?.sub ?? "default";
+  const sub = decodeJwt(token.idToken ?? "")?.sub ?? decodeJwt(token.accessToken)?.sub;
+  if (sub === void 0) return "default";
+  if (typeof sub !== "string" || !USER_ID_RE.test(sub) || sub === "." || sub === "..") {
+    throw new Error(
+      `Token subject '${String(sub)}' is not a usable user id (expected 1-128 chars from [A-Za-z0-9._@-]). Refusing to store this token.`
+    );
+  }
+  return sub;
 }
 function readState() {
   return readJson(statePath()) ?? {};
@@ -432,10 +467,10 @@ function readToken(baseUrl, userId = activeUserId(baseUrl)) {
   if (!userId) return void 0;
   return readJson(join(userDir(baseUrl, userId), "token.json")) ?? void 0;
 }
-function writeToken(baseUrl, token) {
+function writeToken(baseUrl, token, opts = {}) {
   const userId = userIdFromToken(token);
   writeJson(join(userDir(baseUrl, userId), "token.json"), token, 384);
-  setActiveUser(baseUrl, userId);
+  if (opts.setActive !== false) setActiveUser(baseUrl, userId);
   return userId;
 }
 function deleteToken(baseUrl, userId = activeUserId(baseUrl)) {
@@ -474,6 +509,14 @@ function listPlatforms() {
   }
   return out;
 }
+function findUserId(baseUrl, userOrName) {
+  const users = listPlatforms().find((p) => p.baseUrl === baseUrl)?.users ?? [];
+  const match = users.find((u) => u.userId === userOrName) ?? users.find((u) => (u.username ?? u.displayName) === userOrName);
+  return match?.userId ?? null;
+}
+function usersOfPlatform(baseUrl) {
+  return listPlatforms().find((p) => p.baseUrl === baseUrl)?.users ?? [];
+}
 function decodeKey(key) {
   try {
     const b64 = key.replace(/-/g, "+").replace(/_/g, "/");
@@ -499,6 +542,14 @@ function writeJson(path, value, mode = 384) {
 }
 
 // src/config/resolve.ts
+function resolveUserId(baseUrl, userOrName) {
+  const id = findUserId(baseUrl, userOrName);
+  if (id) return id;
+  const known = usersOfPlatform(baseUrl).map((u) => u.username ?? u.userId).join(", ");
+  throw new InputError(
+    `No saved user '${userOrName}' on ${baseUrl}. Saved: ${known || "(none)"}. See \`openbkn auth users ${baseUrl}\`.`
+  );
+}
 function resolveContext(opts = {}) {
   const baseUrl = opts.baseUrl ?? process.env.BKN_BASE_URL ?? activePlatform();
   if (!baseUrl) {
@@ -507,22 +558,29 @@ function resolveContext(opts = {}) {
     );
   }
   const normalized = baseUrl.replace(/\/+$/, "");
-  const stored = readToken(normalized);
+  const user = opts.user ?? process.env.BKN_USER;
+  const stored = user ? readToken(normalized, resolveUserId(normalized, user)) : readToken(normalized);
   const explicit = opts.token ?? process.env.BKN_TOKEN;
   const token = explicit ?? stored?.accessToken ?? "";
-  if (!token && !stored?.noAuth) {
+  if (!token) {
     throw new InputError("No access token. Set BKN_TOKEN or run `openbkn auth login`.");
   }
-  const insecure = opts.insecure ?? stored?.tlsInsecure ?? false;
+  const insecure = opts.insecure ?? false;
   const refresh = !explicit && stored?.refreshToken ? {
     refreshToken: stored.refreshToken,
     persist: (t) => {
-      writeToken(normalized, {
-        ...stored,
-        accessToken: t.accessToken,
-        refreshToken: t.refreshToken ?? stored.refreshToken,
-        idToken: t.idToken ?? stored.idToken
-      });
+      writeToken(
+        normalized,
+        {
+          ...stored,
+          accessToken: t.accessToken,
+          refreshToken: t.refreshToken ?? stored.refreshToken,
+          idToken: t.idToken ?? stored.idToken
+        },
+        // `--user` picks an identity for this command only; a refresh
+        // must not promote it to the default for the next one.
+        { setActive: !user }
+      );
     }
   } : void 0;
   return {
@@ -585,6 +643,13 @@ async function setUserPasswordSafe(ctx, userId, password) {
   });
   return { ok: true };
 }
+async function changePasswordSafe(ctx, account, oldPassword, newPassword) {
+  await request(ctx, "/api/safe/v1/auth/change-password", {
+    method: "POST",
+    body: { account, old_password: oldPassword, new_password: newPassword }
+  });
+  return { ok: true };
+}
 function getUserRolesSafe(ctx, userId) {
   return request(ctx, `${ADMIN}/role-bindings`, { query: { accessor_id: userId } });
 }
@@ -873,7 +938,6 @@ function extractText(result) {
   return "";
 }
 async function sendChat(ctx, info, query, opts = {}) {
-  applyTls(ctx);
   const body = {
     agent_id: info.id,
     agent_key: info.key,
@@ -884,7 +948,7 @@ async function sendChat(ctx, info, query, opts = {}) {
   if (opts.conversationId) body.conversation_id = opts.conversationId;
   const res = await authFetch(
     ctx,
-    () => fetch(`${ctx.baseUrl}${FACTORY}/v1/app/${info.key}/chat/completion`, {
+    () => tlsFetch(ctx.insecure, `${ctx.baseUrl}${FACTORY}/v1/app/${info.key}/chat/completion`, {
       method: "POST",
       headers: {
         ...buildHeaders(ctx),
@@ -1110,10 +1174,9 @@ function parseBody(text) {
   }
 }
 async function post(ctx, knId, sessionId, body) {
-  applyTls(ctx);
   const res = await authFetch(
     ctx,
-    () => fetch(mcpUrl(ctx), {
+    () => tlsFetch(ctx.insecure, mcpUrl(ctx), {
       method: "POST",
       headers: headers(ctx, knId, sessionId),
       body: JSON.stringify(body)
@@ -2906,7 +2969,6 @@ function knPath(knId, path) {
   return `${BASE4}/${encodeURIComponent(knId)}/${path}`;
 }
 async function uploadBkn(ctx, tarBuffer, opts = {}) {
-  applyTls(ctx);
   const url = new URL(`${ctx.baseUrl}${BKNS}`);
   url.searchParams.set("branch", opts.branch ?? "main");
   const form2 = new FormData();
@@ -2917,17 +2979,19 @@ async function uploadBkn(ctx, tarBuffer, opts = {}) {
   );
   const res = await authFetch(
     ctx,
-    () => fetch(url, { method: "POST", headers: buildHeaders(ctx), body: form2 })
+    () => tlsFetch(ctx.insecure, url, { method: "POST", headers: buildHeaders(ctx), body: form2 })
   );
   const text = await res.text();
   if (!res.ok) throw new HttpError(res.status, res.statusText, text);
   return text ? JSON.parse(text) : void 0;
 }
 async function downloadBkn(ctx, knId, opts = {}) {
-  applyTls(ctx);
   const url = new URL(`${ctx.baseUrl}${BKNS}/${encodeURIComponent(knId)}`);
   url.searchParams.set("branch", opts.branch ?? "main");
-  const res = await authFetch(ctx, () => fetch(url, { method: "GET", headers: buildHeaders(ctx) }));
+  const res = await authFetch(
+    ctx,
+    () => tlsFetch(ctx.insecure, url, { method: "GET", headers: buildHeaders(ctx) })
+  );
   if (!res.ok) throw new HttpError(res.status, res.statusText, await res.text());
   return Buffer.from(await res.arrayBuffer());
 }
@@ -3921,10 +3985,9 @@ function deltaContent(chunk) {
   return typeof c === "string" ? c : "";
 }
 async function chatCompletionsStream(ctx, model, messages, onDelta) {
-  applyTls(ctx);
   const res = await authFetch(
     ctx,
-    () => fetch(`${ctx.baseUrl}${API}/chat/completions`, {
+    () => tlsFetch(ctx.insecure, `${ctx.baseUrl}${API}/chat/completions`, {
       method: "POST",
       headers: {
         ...buildHeaders(ctx),
@@ -4059,7 +4122,6 @@ import { basename as basename2, dirname as dirname3, resolve as resolve5 } from
 // src/api/skills.ts
 var BASE5 = "/api/agent-operator-integration/v1";
 async function registerSkillZip(ctx, bytes, opts = {}) {
-  applyTls(ctx);
   const form2 = new FormData();
   form2.set("file_type", "zip");
   form2.set("file", new Blob([bytes]), opts.filename ?? "skill.zip");
@@ -4067,7 +4129,7 @@ async function registerSkillZip(ctx, bytes, opts = {}) {
   if (opts.extendInfo) form2.set("extend_info", JSON.stringify(opts.extendInfo));
   const res = await authFetch(
     ctx,
-    () => fetch(`${ctx.baseUrl}${BASE5}/skills`, {
+    () => tlsFetch(ctx.insecure, `${ctx.baseUrl}${BASE5}/skills`, {
       method: "POST",
       headers: buildHeaders(ctx),
       body: form2
@@ -4078,13 +4140,12 @@ async function registerSkillZip(ctx, bytes, opts = {}) {
   return text ? JSON.parse(text) : void 0;
 }
 async function updateSkillPackageZip(ctx, skillId, bytes, filename = "skill.zip") {
-  applyTls(ctx);
   const form2 = new FormData();
   form2.set("file_type", "zip");
   form2.set("file", new Blob([bytes]), filename);
   const res = await authFetch(
     ctx,
-    () => fetch(`${ctx.baseUrl}${BASE5}/skills/${encodeURIComponent(skillId)}/package`, {
+    () => tlsFetch(ctx.insecure, `${ctx.baseUrl}${BASE5}/skills/${encodeURIComponent(skillId)}/package`, {
       method: "PUT",
       headers: buildHeaders(ctx),
       body: form2
@@ -4095,10 +4156,9 @@ async function updateSkillPackageZip(ctx, skillId, bytes, filename = "skill.zip"
   return text ? JSON.parse(text) : void 0;
 }
 async function downloadSkill(ctx, skillId) {
-  applyTls(ctx);
   const res = await authFetch(
     ctx,
-    () => fetch(`${ctx.baseUrl}${BASE5}/skills/${encodeURIComponent(skillId)}/download`, {
+    () => tlsFetch(ctx.insecure, `${ctx.baseUrl}${BASE5}/skills/${encodeURIComponent(skillId)}/download`, {
       headers: buildHeaders(ctx)
     })
   );
@@ -4254,25 +4314,27 @@ import { basename as basename3 } from "path";
 var PATH = "/api/agent-operator-integration/v1/tool-box";
 var IMPEX = "/api/agent-operator-integration/v1/impex";
 async function exportConfig(ctx, id, type = "toolbox") {
-  applyTls(ctx);
   const res = await authFetch(
     ctx,
-    () => fetch(`${ctx.baseUrl}${IMPEX}/export/${encodeURIComponent(type)}/${encodeURIComponent(id)}`, {
-      headers: buildHeaders(ctx)
-    })
+    () => tlsFetch(
+      ctx.insecure,
+      `${ctx.baseUrl}${IMPEX}/export/${encodeURIComponent(type)}/${encodeURIComponent(id)}`,
+      {
+        headers: buildHeaders(ctx)
+      }
+    )
   );
   const buf = new Uint8Array(await res.arrayBuffer());
   if (!res.ok) throw new HttpError(res.status, res.statusText, new TextDecoder().decode(buf));
   return buf;
 }
 async function importConfig(ctx, filePath, type = "toolbox") {
-  applyTls(ctx);
   const buf = await readFile2(filePath);
   const form2 = new FormData();
   form2.append("data", new Blob([new Uint8Array(buf)]), basename3(filePath));
   const res = await authFetch(
     ctx,
-    () => fetch(`${ctx.baseUrl}${IMPEX}/import/${encodeURIComponent(type)}`, {
+    () => tlsFetch(ctx.insecure, `${ctx.baseUrl}${IMPEX}/import/${encodeURIComponent(type)}`, {
       method: "POST",
       headers: buildHeaders(ctx),
       body: form2
@@ -4283,14 +4345,13 @@ async function importConfig(ctx, filePath, type = "toolbox") {
   return text ? JSON.parse(text) : text;
 }
 async function uploadTool(ctx, boxId, filePath, metadataType = "openapi") {
-  applyTls(ctx);
   const buf = await readFile2(filePath);
   const form2 = new FormData();
   form2.append("metadata_type", metadataType);
   form2.append("data", new Blob([new Uint8Array(buf)]), basename3(filePath));
   const res = await authFetch(
     ctx,
-    () => fetch(`${ctx.baseUrl}${PATH}/${encodeURIComponent(boxId)}/tool`, {
+    () => tlsFetch(ctx.insecure, `${ctx.baseUrl}${PATH}/${encodeURIComponent(boxId)}/tool`, {
       method: "POST",
       headers: buildHeaders(ctx),
       body: form2
@@ -5257,7 +5318,6 @@ function resolveUrl(ctx, path) {
   return path.startsWith("http") ? path : `${ctx.baseUrl}${path.startsWith("/") ? "" : "/"}${path}`;
 }
 async function rawCall(ctx, path, opts = {}) {
-  applyTls(ctx);
   const url = resolveUrl(ctx, path);
   const extra = {};
   for (const h of opts.header ?? []) {
@@ -5286,7 +5346,12 @@ async function rawCall(ctx, path, opts = {}) {
   try {
     const res = await authFetch(
       ctx,
-      () => fetch(url, { method, headers: headersFor(), body, signal: controller.signal })
+      () => tlsFetch(ctx.insecure, url, {
+        method,
+        headers: headersFor(),
+        body,
+        signal: controller.signal
+      })
     );
     return { status: res.status, statusText: res.statusText, body: await res.text() };
   } finally {
@@ -5365,7 +5430,6 @@ function createClient(opts = {}) {
 // src/resources/auth.ts
 var auth_exports = {};
 __export(auth_exports, {
-  attachNoAuth: () => attachNoAuth,
   attachToken: () => attachToken,
   currentToken: () => currentToken,
   currentTokenFresh: () => currentTokenFresh,
@@ -5403,7 +5467,6 @@ function attachToken(baseUrl, accessToken, opts = {}) {
     accessToken,
     refreshToken: opts.refreshToken,
     idToken: opts.idToken,
-    tlsInsecure: opts.insecure,
     // Prefer the account the user typed (-u); device tokens carry no username.
     username: opts.username ?? decodeJwt(opts.idToken ?? accessToken)?.preferred_username
   };
@@ -5411,33 +5474,40 @@ function attachToken(baseUrl, accessToken, opts = {}) {
   setActivePlatform(url);
   return { baseUrl: url, userId, username: usernameOf(token) };
 }
-function attachNoAuth(baseUrl, opts = {}) {
-  const url = normalize(baseUrl);
-  writeToken(url, { baseUrl: url, accessToken: "", noAuth: true, tlsInsecure: opts.insecure });
-  setActivePlatform(url);
-  return { baseUrl: url, noAuth: true };
+function targetUser(baseUrl, userOrName) {
+  if (!userOrName) return activeUserId(baseUrl);
+  const id = findUserId(baseUrl, userOrName);
+  if (!id) {
+    const known = usersOfPlatform(baseUrl).map((u) => u.username ?? u.userId).join(", ");
+    throw new InputError(
+      `No saved user '${userOrName}' on ${baseUrl}. Saved: ${known || "(none)"}.`
+    );
+  }
+  return id;
 }
-function status() {
+function status(opts = {}) {
   const baseUrl = activePlatform();
   if (!baseUrl) return { hasToken: false };
-  const token = readToken(baseUrl);
+  const userId = targetUser(baseUrl, opts.user);
+  const token = readToken(baseUrl, userId);
   return {
     baseUrl,
-    userId: activeUserId(baseUrl),
+    userId,
     hasToken: token !== void 0,
     username: usernameOf(token),
     expired: token ? isExpired(decodeJwt(token.accessToken)) : void 0
   };
 }
-function currentToken() {
+function currentToken(opts = {}) {
   const baseUrl = activePlatform();
-  const token = baseUrl ? readToken(baseUrl) : void 0;
+  const token = baseUrl ? readToken(baseUrl, targetUser(baseUrl, opts.user)) : void 0;
   if (!token) throw new InputError("Not logged in. Run `openbkn auth login <url> --token <t>`.");
   return token.accessToken;
 }
-async function currentTokenFresh() {
+async function currentTokenFresh(opts = {}) {
   const baseUrl = activePlatform();
-  const token = baseUrl ? readToken(baseUrl) : void 0;
+  const userId = baseUrl ? targetUser(baseUrl, opts.user) : void 0;
+  const token = baseUrl ? readToken(baseUrl, userId) : void 0;
   if (!baseUrl || !token) {
     throw new InputError("Not logged in. Run `openbkn auth login <url> --token <t>`.");
   }
@@ -5446,22 +5516,27 @@ async function currentTokenFresh() {
   const needsRefresh = decodable ? isExpired(claims) : true;
   if (token.refreshToken && needsRefresh) {
     try {
-      const t = await refreshAccessToken(baseUrl, token.refreshToken);
-      writeToken(baseUrl, {
-        ...token,
-        accessToken: t.accessToken,
-        refreshToken: t.refreshToken ?? token.refreshToken,
-        idToken: t.idToken ?? token.idToken
-      });
+      const t = await refreshAccessToken(baseUrl, token.refreshToken, void 0, opts.insecure);
+      writeToken(
+        baseUrl,
+        {
+          ...token,
+          accessToken: t.accessToken,
+          refreshToken: t.refreshToken ?? token.refreshToken,
+          idToken: t.idToken ?? token.idToken
+        },
+        { setActive: !opts.user }
+      );
       return t.accessToken;
     } catch {
     }
   }
   return token.accessToken;
 }
-function whoami() {
+function whoami(opts = {}) {
   const baseUrl = activePlatform();
-  const token = baseUrl ? readToken(baseUrl) : void 0;
+  const userId = baseUrl ? targetUser(baseUrl, opts.user) : void 0;
+  const token = baseUrl ? readToken(baseUrl, userId) : void 0;
   const claims = decodeJwt(token?.idToken ?? "") ?? decodeJwt(token?.accessToken ?? "");
   if (!claims) {
     throw new InputError(
@@ -5471,7 +5546,7 @@ function whoami() {
   return {
     ...claims,
     baseUrl: baseUrl ?? void 0,
-    userId: baseUrl ? activeUserId(baseUrl) : void 0,
+    userId,
     username: usernameOf(token)
   };
 }
@@ -5535,7 +5610,6 @@ export {
   formatError,
   isHeadless,
   openBrowser,
-  fetchAuthStatus,
   deviceLogin,
   credentialDeviceLogin,
   request,
@@ -5550,6 +5624,7 @@ export {
   writePlatformConfig,
   resolveContext,
   getUserSafe,
+  changePasswordSafe,
   admin,
   agents,
   context,
@@ -5566,7 +5641,6 @@ export {
   vega,
   createClient,
   attachToken,
-  attachNoAuth,
   status,
   currentToken,
   currentTokenFresh,
@@ -5579,4 +5653,4 @@ export {
   exportCreds,
   auth_exports
 };
-//# sourceMappingURL=chunk-LCOMMFH7.js.map
+//# sourceMappingURL=chunk-ISJHU26W.js.map