@qoren/cli 0.1.0

package/dist/commands/secrets.js

@@ -0,0 +1,164 @@
+import { readFile } from "node:fs/promises";
+import { extname } from "node:path";
+import { orgSlug, requireContext, run, } from "../context.js";
+import { age, details, dim, emit, note, table } from "../output.js";
+import { gated, resolveClient } from "./clients.js";
+// The vault: API keys and other values agents receive by NAME at setup.
+//
+//   echo "$HUBSPOT_KEY" | qoren secrets set HUBSPOT_API_KEY --client Acme
+//
+// A secret is agency-wide, or belongs to one of your clients (--client). The
+// same name can be saved once agency-wide and once per client. An agent gets
+// its own client's secret first, then the agency-wide one, and never another
+// client's, so client B's agent can't end up with client A's key.
+//
+// Values go in on stdin, from --file, or with --value (which leaves the value
+// in your shell history). They never come back out except through `reveal`,
+// which is audited.
+/** "all clients" for an agency-wide row, else the client's name. */
+export const scopeLabel = (s) => s.customerId ? (s.customerName ?? s.customerId) : "all clients";
+/** The agents a row is used by, two by name and the rest counted. */
+export function usedByLabel(agents) {
+    if (agents.length === 0)
+        return "none";
+    const shown = agents.slice(0, 2).map((a) => a.name).join(", ");
+    return agents.length > 2 ? `${shown} +${agents.length - 2}` : shown;
+}
+/** The rows `secrets list` prints, narrowed to one client when asked: that
+ * client's own secrets plus the agency-wide ones its agents can fall back to,
+ * with the agency-wide row left out where the client has its own. */
+export function secretsFor(rows, customerId) {
+    if (customerId === undefined)
+        return rows;
+    if (customerId === null)
+        return rows.filter((r) => !r.customerId);
+    const own = new Set(rows.filter((r) => r.customerId === customerId).map((r) => r.name));
+    return rows.filter((r) => r.customerId === customerId || (!r.customerId && !own.has(r.name)));
+}
+/** The scope a --client / --agency pair asks for: undefined = every scope. */
+async function scopeOf(ctx, options) {
+    if (options.client && options.agency) {
+        throw new Error("Pass --client or --agency, not both.");
+    }
+    if (options.agency)
+        return { id: null, name: "all clients" };
+    if (!options.client)
+        return undefined;
+    const client = await resolveClient(ctx, options.client);
+    return { id: client.id, name: client.name };
+}
+async function readStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+        chunks.push(typeof chunk === "string" ? Buffer.from(chunk, "utf8") : chunk);
+    }
+    return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+}
+export function secretsCommands(program, global) {
+    const secrets = program
+        .command("secrets")
+        .alias("secret")
+        .alias("vault")
+        .description("Keys your agents receive by name, agency-wide or per client");
+    secrets
+        .command("list")
+        .alias("ls")
+        .description("Secret names and who they belong to. Never values")
+        .option("--client <client>", "only what an agent of this client would get (id or exact name)")
+        .option("--agency", "only the agency-wide secrets")
+        .action((options) => run(async () => {
+        const ctx = requireContext(global());
+        const scope = await scopeOf(ctx, options);
+        const rows = secretsFor(await ctx.qoren.secrets.list(await orgSlug(ctx)), scope?.id);
+        emit(rows, () => {
+            if (scope)
+                note(dim(`As an agent of ${scope.name} sees them`));
+            table(rows, [
+                { header: "name", value: (s) => s.name },
+                { header: "client", value: (s) => scopeLabel(s) },
+                { header: "kind", value: (s) => s.kind ?? "value" },
+                // Absent on a control plane older than the batched used-by list: leave the cell blank.
+                { header: "used by", value: (s) => (s.usedBy ? usedByLabel(s.usedBy) : "") },
+                { header: "description", value: (s) => s.description ?? "" },
+                { header: "updated", value: (s) => age(s.updatedAt) },
+            ]);
+        });
+    })());
+    secrets
+        .command("set <name>")
+        .description("Save or replace a secret. Reads the value from stdin unless --value or --file")
+        .option("--client <client>", "save it for one client only (id or exact name)")
+        .option("--value <value>", "the value (stays in your shell history; prefer stdin)")
+        .option("--file <path>", "store this file's contents as a file secret")
+        .option("--description <text>", "a note shown beside the name")
+        .action((name, options) => run(async () => {
+        const ctx = requireContext(global());
+        if (options.value !== undefined && options.file) {
+            throw new Error("Pass --value or --file, not both.");
+        }
+        let value;
+        if (options.file)
+            value = await readFile(options.file, "utf8");
+        else if (options.value !== undefined)
+            value = options.value;
+        else if (process.stdin.isTTY) {
+            throw new Error("Pipe the value on stdin, or pass --file or --value.");
+        }
+        else
+            value = await readStdin();
+        if (!value)
+            throw new Error("The value is empty.");
+        const scope = await scopeOf(ctx, { client: options.client });
+        const saved = (await gated(ctx.qoren.secrets.set(await orgSlug(ctx), {
+            name,
+            value,
+            description: options.description,
+            ...(options.file
+                ? { kind: "file", fileExt: extname(options.file).replace(/^\./, "") || undefined }
+                : {}),
+            customerId: scope?.id ?? null,
+        })));
+        emit(saved, () => details([
+            ["Saved", saved.name],
+            ["For", scopeLabel(saved)],
+            ["Kind", saved.kind ?? "value"],
+        ]));
+    })());
+    secrets
+        .command("rm <name>")
+        .alias("remove")
+        .description("Delete one secret. Agents that already have it keep their copy")
+        .option("--client <client>", "the client's secret (id or exact name); default is the agency-wide one")
+        .action((name, options) => run(async () => {
+        const ctx = requireContext(global());
+        const scope = await scopeOf(ctx, options);
+        const result = await ctx.qoren.secrets.remove(await orgSlug(ctx), name, scope?.id ?? null);
+        emit(result, () => note(`Deleted ${name.toUpperCase()} (${scope?.name ?? "all clients"}).`));
+    })());
+    secrets
+        .command("reveal <name>")
+        .description("Print one value. Every reveal is recorded in the audit log")
+        .option("--client <client>", "the client's secret (id or exact name); default is the agency-wide one")
+        .action((name, options) => run(async () => {
+        const ctx = requireContext(global());
+        const scope = await scopeOf(ctx, options);
+        const revealed = await ctx.qoren.secrets.reveal(await orgSlug(ctx), name, scope?.id ?? null);
+        emit(revealed, () => process.stdout.write(`${revealed.value}\n`));
+    })());
+    secrets
+        .command("used-by <name>")
+        .description("Agents that have this secret injected")
+        .option("--client <client>", "the client's secret (id or exact name); default is the agency-wide one")
+        .action((name, options) => run(async () => {
+        const ctx = requireContext(global());
+        const scope = await scopeOf(ctx, options);
+        const agents = await ctx.qoren.secrets.usedBy(await orgSlug(ctx), name, scope?.id ?? null);
+        emit(agents, () => table(agents, [
+            { header: "id", value: (a) => a.id },
+            { header: "agent", value: (a) => a.name },
+            { header: "environment", value: (a) => a.machineName },
+            { header: "status", value: (a) => a.status },
+        ]));
+    })());
+}
+//# sourceMappingURL=secrets.js.map

package/dist/commands/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/commands/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EACL,OAAO,EACP,cAAc,EACd,GAAG,GAGJ,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEpD,wEAAwE;AACxE,EAAE;AACF,0EAA0E;AAC1E,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,6EAA6E;AAC7E,kEAAkE;AAClE,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,oBAAoB;AAEpB,oEAAoE;AACpE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAoD,EAAU,EAAE,CACzF,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;AAElE,qEAAqE;AACrE,MAAM,UAAU,WAAW,CAAC,MAA0B;IACpD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AACtE,CAAC;AAED;;qEAEqE;AACrE,MAAM,UAAU,UAAU,CACxB,IAAoB,EACpB,UAAqC;IAErC,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CACnE,CAAC;IACF,OAAO,IAAI,CAAC,MAAM,CAChB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CACrE,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,OAAO,CACpB,GAAY,EACZ,OAA8C;IAE9C,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAC7D,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAuC,EAAE,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAgB,EAAE,MAA2B;IAC3E,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,SAAS,CAAC;SAClB,KAAK,CAAC,QAAQ,CAAC;SACf,KAAK,CAAC,OAAO,CAAC;SACd,WAAW,CAAC,6DAA6D,CAAC,CAAC;IAE9E,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,KAAK,CAAC,IAAI,CAAC;SACX,WAAW,CAAC,mDAAmD,CAAC;SAChE,MAAM,CACL,mBAAmB,EACnB,gEAAgE,CACjE;SACA,MAAM,CAAC,UAAU,EAAE,8BAA8B,CAAC;SAClD,MAAM,CAAC,CAAC,OAA8C,EAAE,EAAE,CACzD,GAAG,CAAC,KAAK,IAAI,EAAE;QACb,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,UAAU,CACrB,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,EAChD,KAAK,EAAE,EAAE,CACV,CAAC;QACF,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE;YACd,IAAI,KAAK;gBAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC;YAC/D,KAAK,CAAC,IAAI,EAAE;gBACV,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;gBACxC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;gBACjD,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,EAAE;gBACnD,uFAAuF;gBACvF,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;gBAC5E,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE;gBAC5D,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;aACtD,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,EAAE,CACL,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,+EAA+E,CAAC;SAC5F,MAAM,CAAC,mBAAmB,EAAE,gDAAgD,CAAC;SAC7E,MAAM,CAAC,iBAAiB,EAAE,uDAAuD,CAAC;SAClF,MAAM,CAAC,eAAe,EAAE,6CAA6C,CAAC;SACtE,MAAM,CAAC,sBAAsB,EAAE,8BAA8B,CAAC;SAC9D,MAAM,CACL,CACE,IAAY,EACZ,OAAiF,EACjF,EAAE,CACF,GAAG,CAAC,KAAK,IAAI,EAAE;QACb,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,KAAa,CAAC;QAClB,IAAI,OAAO,CAAC,IAAI;YAAE,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;aAC1D,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;aACvD,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,qDAAqD,CACtD,CAAC;QACJ,CAAC;;YAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAEnD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,CAAC,MAAM,KAAK,CACxB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE;YACxC,IAAI;YACJ,KAAK;YACL,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,GAAG,CAAC,OAAO,CAAC,IAAI;gBACd,CAAC,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,SAAS,EAAE;gBAC3F,CAAC,CAAC,EAAE,CAAC;YACP,UAAU,EAAE,KAAK,EAAE,EAAE,IAAI,IAAI;SAC9B,CAAC,CACH,CAAiB,CAAC;QACnB,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CACf,OAAO,CAAC;YACN,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC;YACrB,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC;SAChC,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,EAAE,CACP,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,WAAW,CAAC;SACpB,KAAK,CAAC,QAAQ,CAAC;SACf,WAAW,CAAC,gEAAgE,CAAC;SAC7E,MAAM,CAAC,mBAAmB,EAAE,wEAAwE,CAAC;SACrG,MAAM,CAAC,CAAC,IAAY,EAAE,OAA4B,EAAE,EAAE,CACrD,GAAG,CAAC,KAAK,IAAI,EAAE;QACb,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAC3C,MAAM,OAAO,CAAC,GAAG,CAAC,EAClB,IAAI,EACJ,KAAK,EAAE,EAAE,IAAI,IAAI,CAClB,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAChB,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,IAAI,IAAI,aAAa,IAAI,CAAC,CACzE,CAAC;IACJ,CAAC,CAAC,EAAE,CACL,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,mBAAmB,EAAE,wEAAwE,CAAC;SACrG,MAAM,CAAC,CAAC,IAAY,EAAE,OAA4B,EAAE,EAAE,CACrD,GAAG,CAAC,KAAK,IAAI,EAAE;QACb,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAC7C,MAAM,OAAO,CAAC,GAAG,CAAC,EAClB,IAAI,EACJ,KAAK,EAAE,EAAE,IAAI,IAAI,CAClB,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;IACpE,CAAC,CAAC,EAAE,CACL,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CAAC,uCAAuC,CAAC;SACpD,MAAM,CAAC,mBAAmB,EAAE,wEAAwE,CAAC;SACrG,MAAM,CAAC,CAAC,IAAY,EAAE,OAA4B,EAAE,EAAE,CACrD,GAAG,CAAC,KAAK,IAAI,EAAE;QACb,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAC3C,MAAM,OAAO,CAAC,GAAG,CAAC,EAClB,IAAI,EACJ,KAAK,EAAE,EAAE,IAAI,IAAI,CAClB,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAChB,KAAK,CAAC,MAAM,EAAE;YACZ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YACpC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;YACzC,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE;YACtD,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE;SAC7C,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,EAAE,CACL,CAAC;AACN,CAAC"}

package/dist/commands/webhook.d.ts

@@ -0,0 +1,4 @@
+import type { Command } from "commander";
+import { type GlobalOptions } from "../context.js";
+export declare function webhookCommands(program: Command, global: () => GlobalOptions): void;
+//# sourceMappingURL=webhook.d.ts.map

package/dist/commands/webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../src/commands/webhook.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOzC,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAgFxE,wBAAgB,eAAe,CAC7B,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,aAAa,QAwT5B"}

package/dist/commands/webhook.js

@@ -0,0 +1,275 @@
+import { requireContext, run } from "../context.js";
+import { age, bold, details, dim, emit, note, statusColor, table, warn, } from "../output.js";
+// Webhook triggers: what wakes an agent when you are not there.
+//
+// The shape of the whole thing in one line:
+//
+//   qoren webhook create <agent> --name "Bookings" --source cal \
+//     --event BOOKING_CREATED --rules "Add the attendee to the CRM and brief me."
+//
+// That prints a URL and a secret, once. Paste both into cal.com's webhook
+// settings and the agent starts getting bookings.
+//
+// `deliveries` is the command you will actually live in: it says whether an
+// event arrived, whether it was acted on, and if not, why not.
+const SOURCES = [
+    "cal",
+    "github",
+    "stripe",
+    "generic",
+    "none",
+];
+function triggerTable(rows) {
+    table(rows, [
+        { header: "id", value: (t) => t.id },
+        { header: "name", value: (t) => t.name },
+        { header: "source", value: (t) => t.source },
+        { header: "status", value: (t) => statusColor(t.status) },
+        { header: "events", value: (t) => t.events.join(", ") || "all" },
+        { header: "autonomy", value: (t) => t.autonomy },
+        { header: "deliveries", value: (t) => String(t.deliveryCount) },
+        { header: "last", value: (t) => age(t.lastDeliveryAt) },
+    ]);
+}
+function deliveryTable(rows) {
+    table(rows, [
+        { header: "id", value: (d) => d.id },
+        { header: "event", value: (d) => d.eventType },
+        { header: "status", value: (d) => statusColor(d.status) },
+        { header: "summary", value: (d) => d.summary ?? d.error ?? "" },
+        { header: "when", value: (d) => age(d.createdAt) },
+    ]);
+}
+/** Print the URL and secret with the one instruction that matters: this is the
+ * only time either is readable. Goes to stderr via `note` so `--json` still
+ * pipes clean data — a script storing the secret reads it from the JSON. */
+function printSecret(value, what) {
+    note(`${what}. Copy both of these into your webhook settings now:`);
+    details([
+        ["URL", value.url],
+        ["Secret", value.secret],
+        ...(value.signatureHeader
+            ? [["Signature header", value.signatureHeader]]
+            : []),
+    ]);
+    warn("Neither is readable again. Lose them and you rotate.");
+    if (value.url.startsWith("/")) {
+        warn("That URL has no host: the control plane has no public URL configured. Fix that, then rotate to get a complete one.");
+    }
+}
+export function webhookCommands(program, global) {
+    const webhook = program
+        .command("webhook")
+        .alias("webhooks")
+        .alias("trigger")
+        .description("Let an outside service wake an agent");
+    webhook
+        .command("sources")
+        .description("Services Qoren can receive webhooks from")
+        .action(() => run(async () => {
+        const ctx = requireContext(global());
+        const sources = await ctx.qoren.webhooks.sources();
+        emit(sources, () => table(sources, [
+            { header: "source", value: (s) => s.source },
+            { header: "name", value: (s) => s.label },
+            { header: "verified", value: (s) => (s.verified ? "yes" : "no") },
+            {
+                header: "known events",
+                value: (s) => (s.events.length ? String(s.events.length) : "any"),
+            },
+        ]));
+    })());
+    webhook
+        .command("ls <agentId>")
+        .alias("list")
+        .description("List an agent's triggers")
+        .action((agentId) => run(async () => {
+        const ctx = requireContext(global());
+        const triggers = await ctx.qoren.webhooks.list(agentId);
+        emit(triggers, () => triggers.length
+            ? triggerTable(triggers)
+            : note(`No triggers yet. ${dim(`qoren webhook create ${agentId} --name … --source cal`)}`));
+    })());
+    webhook
+        .command("get <id>")
+        .description("Show one trigger")
+        .action((id) => run(async () => {
+        const ctx = requireContext(global());
+        const t = await ctx.qoren.webhooks.get(id);
+        emit(t, () => details([
+            ["Id", t.id],
+            ["Name", t.name],
+            ["Agent", t.agentSlug ?? t.agentId],
+            ["Source", t.source],
+            ["Status", statusColor(t.status)],
+            ["Events", t.events.join(", ") || "all"],
+            ["Autonomy", t.autonomy],
+            ["Rules", t.instructions ?? ""],
+            ["Limit", `${t.maxPerHour}/hour`],
+            ["Deliveries", `${t.deliveryCount} (${t.failureCount} failed)`],
+            ["Last delivery", t.lastDeliveryAt ?? "never"],
+        ]));
+    })());
+    webhook
+        .command("create <agentId>")
+        .description("Create a trigger and print its URL and secret")
+        .requiredOption("--name <name>", "what this trigger is for")
+        .option(`--source <source>`, SOURCES.join(" | "), "cal")
+        .option("--event <name...>", "only act on these events (repeatable; omit for all)")
+        .option("--rules <text>", "what the agent should do when this fires")
+        .option("--propose", "let the agent only propose actions, not take them")
+        .option("--max-per-hour <n>", "paid turns per hour before throttling")
+        .option("--secret <secret>", "the secret the sender already has")
+        .option("--header <name>", "custom source: header carrying the signature")
+        .option("--encoding <encoding>", "custom source: hex | base64")
+        .option("--prefix <prefix>", "custom source: signature prefix, e.g. sha256=")
+        .option("--event-path <path>", "custom source: path to the event name")
+        .action((agentId, options) => run(async () => {
+        const ctx = requireContext(global());
+        const body = {
+            name: options.name,
+            source: options.source,
+            ...(options.event ? { events: options.event } : {}),
+            ...(options.rules !== undefined
+                ? { instructions: options.rules }
+                : {}),
+            ...(options.propose ? { autonomy: "propose" } : {}),
+            ...(options.maxPerHour !== undefined
+                ? { maxPerHour: Number(options.maxPerHour) }
+                : {}),
+            ...(options.secret !== undefined
+                ? { secret: options.secret }
+                : {}),
+            ...(options.header !== undefined
+                ? { headerName: options.header }
+                : {}),
+            ...(options.encoding !== undefined
+                ? { encoding: options.encoding }
+                : {}),
+            ...(options.prefix !== undefined
+                ? { signaturePrefix: options.prefix }
+                : {}),
+            ...(options.eventPath !== undefined
+                ? { eventPath: options.eventPath }
+                : {}),
+        };
+        const created = await ctx.qoren.webhooks.create(agentId, body);
+        emit(created, () => {
+            printSecret(created, `Trigger ${bold(options.name)} created`);
+            if (!options.event?.length) {
+                warn("This trigger fires on every event the source sends, and each one is a paid agent turn. Narrow it with --event.");
+            }
+        });
+    })());
+    webhook
+        .command("rules <id> <text>")
+        .description("Rewrite what the agent should do when this trigger fires")
+        .action((id, text) => run(async () => {
+        const ctx = requireContext(global());
+        const t = await ctx.qoren.webhooks.update(id, { instructions: text });
+        emit(t, () => note(`Updated the rules for ${bold(t.name)}.`));
+    })());
+    webhook
+        .command("events <id> [names...]")
+        .description("Set which events this trigger acts on (none = all)")
+        .action((id, names) => run(async () => {
+        const ctx = requireContext(global());
+        const t = await ctx.qoren.webhooks.update(id, { events: names });
+        emit(t, () => note(names.length
+            ? `${bold(t.name)} now acts on ${names.join(", ")}.`
+            : `${bold(t.name)} now acts on every event the source sends.`));
+    })());
+    webhook
+        .command("pause <id>")
+        .description("Stop deliveries without changing the URL")
+        .action((id) => run(async () => {
+        const ctx = requireContext(global());
+        const t = await ctx.qoren.webhooks.update(id, { status: "paused" });
+        emit(t, () => note(`${bold(t.name)} is paused. Its URL still answers, and ignores.`));
+    })());
+    webhook
+        .command("resume <id>")
+        .description("Start accepting deliveries again")
+        .action((id) => run(async () => {
+        const ctx = requireContext(global());
+        const t = await ctx.qoren.webhooks.update(id, { status: "active" });
+        emit(t, () => note(`${bold(t.name)} is live again.`));
+    })());
+    webhook
+        .command("rotate <id>")
+        .description("Issue a new URL and secret, invalidating the old pair")
+        .action((id) => run(async () => {
+        const ctx = requireContext(global());
+        const rotated = await ctx.qoren.webhooks.rotate(id);
+        emit(rotated, () => {
+            printSecret(rotated, "Rotated");
+            warn("The old URL now 404s, so the sender stops working until you paste these in.");
+        });
+    })());
+    webhook
+        .command("test <id>")
+        .description("Send a sample event through the real path")
+        .option("--event <name>", "event name to simulate")
+        .action((id, options) => run(async () => {
+        const ctx = requireContext(global());
+        const delivery = await ctx.qoren.webhooks.test(id, options.event !== undefined ? { eventType: options.event } : {});
+        emit(delivery, () => note(`Delivery ${bold(delivery.id)} is ${delivery.status}. ${dim(`qoren webhook delivery ${id} ${delivery.id}`)}`));
+    })());
+    webhook
+        .command("deliveries <id>")
+        .alias("log")
+        .description("What this trigger has received, newest first")
+        .option("--limit <n>", "how many to show", "20")
+        .action((id, options) => run(async () => {
+        const ctx = requireContext(global());
+        const rows = await ctx.qoren.webhooks.deliveries(id, Number(options.limit));
+        emit(rows, () => rows.length
+            ? deliveryTable(rows)
+            : note("Nothing has arrived at this trigger yet."));
+    })());
+    webhook
+        .command("delivery <id> <deliveryId>")
+        .description("One delivery: the payload, the prompt, and the agent's reply")
+        .action((id, deliveryId) => run(async () => {
+        const ctx = requireContext(global());
+        const d = await ctx.qoren.webhooks.delivery(id, deliveryId);
+        emit(d, () => {
+            details([
+                ["Id", d.delivery.id],
+                ["Event", d.delivery.eventType],
+                ["Status", statusColor(d.delivery.status)],
+                ["Summary", d.delivery.summary ?? ""],
+                ["Error", d.delivery.error ?? ""],
+                ["Job", d.delivery.jobId ?? "never reached the agent"],
+                ["Received", d.delivery.createdAt],
+                ["Finished", d.delivery.finishedAt ?? ""],
+            ]);
+            if (d.payload) {
+                note("Payload");
+                process.stdout.write(`${d.payload}\n`);
+            }
+            if (d.agentResult) {
+                note("The agent replied");
+                process.stdout.write(`${d.agentResult}\n`);
+            }
+        });
+    })());
+    webhook
+        .command("replay <id> <deliveryId>")
+        .description("Run a past delivery's payload through the agent again")
+        .action((id, deliveryId) => run(async () => {
+        const ctx = requireContext(global());
+        const replayed = await ctx.qoren.webhooks.replay(id, deliveryId);
+        emit(replayed, () => note(`Replayed as delivery ${bold(replayed.id)}.`));
+    })());
+    webhook
+        .command("rm <id>")
+        .alias("delete")
+        .description("Delete a trigger and its delivery log")
+        .action((id) => run(async () => {
+        const ctx = requireContext(global());
+        const result = await ctx.qoren.webhooks.remove(id);
+        emit(result, () => note(`Removed ${bold(result.removed)}. Its URL now 404s.`));
+    })());
+}
+//# sourceMappingURL=webhook.js.map

package/dist/commands/webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.js","sourceRoot":"","sources":["../../src/commands/webhook.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,cAAc,EAAE,GAAG,EAAsB,MAAM,eAAe,CAAC;AACxE,OAAO,EACL,GAAG,EACH,IAAI,EACJ,OAAO,EACP,GAAG,EACH,IAAI,EACJ,IAAI,EACJ,WAAW,EACX,KAAK,EACL,IAAI,GACL,MAAM,cAAc,CAAC;AAEtB,gEAAgE;AAChE,EAAE;AACF,4CAA4C;AAC5C,EAAE;AACF,kEAAkE;AAClE,kFAAkF;AAClF,EAAE;AACF,0EAA0E;AAC1E,kDAAkD;AAClD,EAAE;AACF,4EAA4E;AAC5E,+DAA+D;AAE/D,MAAM,OAAO,GAAwB;IACnC,KAAK;IACL,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,MAAM;CACP,CAAC;AAEF,SAAS,YAAY,CAAC,IAAsB;IAC1C,KAAK,CAAC,IAAI,EAAE;QACV,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;QACpC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;QACxC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE;QAC5C,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE;QACzD,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE;QAChE,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChD,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE;QAC/D,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE;KACxD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,IAAuB;IAC5C,KAAK,CAAC,IAAI,EAAE;QACV,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;QACpC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE;QAC9C,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE;QACzD,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE;QAC/D,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;KACnD,CAAC,CAAC;AACL,CAAC;AAED;;4EAE4E;AAC5E,SAAS,WAAW,CAClB,KAAsE,EACtE,IAAY;IAEZ,IAAI,CAAC,GAAG,IAAI,sDAAsD,CAAC,CAAC;IACpE,OAAO,CAAC;QACN,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;QAClB,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;QACxB,GAAG,CAAC,KAAK,CAAC,eAAe;YACvB,CAAC,CAAE,CAAC,CAAC,kBAAkB,EAAE,KAAK,CAAC,eAAe,CAAC,CAAwB;YACvE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IACH,IAAI,CAAC,sDAAsD,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,IAAI,CACF,oHAAoH,CACrH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,OAAgB,EAChB,MAA2B;IAE3B,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,SAAS,CAAC;SAClB,KAAK,CAAC,UAAU,CAAC;SACjB,KAAK,CAAC,SAAS,CAAC;SAChB,WAAW,CAAC,sCAAsC,CAAC,CAAC;IAEvD,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,0CAA0C,CAAC;SACvD,MAAM,CAAC,GAAG,EAAE,CACX,GAAG,CAAC,KAAK,IAAI,EAAE;QACb,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnD,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CACjB,KAAK,CAAC,OAAO,EAAE;YACb,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE;YAC5C,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE;YACzC,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;YACjE;gBACE,MAAM,EAAE,cAAc;gBACtB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;aAClE;SACF,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,EAAE,CACL,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,cAAc,CAAC;SACvB,KAAK,CAAC,MAAM,CAAC;SACb,WAAW,CAAC,0BAA0B,CAAC;SACvC,MAAM,CAAC,CAAC,OAAe,EAAE,EAAE,CAC1B,GAAG,CAAC,KAAK,IAAI,EAAE;QACb,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAClB,QAAQ,CAAC,MAAM;YACb,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC;YACxB,CAAC,CAAC,IAAI,CACF,oBAAoB,GAAG,CAAC,wBAAwB,OAAO,wBAAwB,CAAC,EAAE,CACnF,CACN,CAAC;IACJ,CAAC,CAAC,EAAE,CACL,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,kBAAkB,CAAC;SAC/B,MAAM,CAAC,CAAC,EAAU,EAAE,EAAE,CACrB,GAAG,CAAC,KAAK,IAAI,EAAE;QACb,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,CACX,OAAO,CAAC;YACN,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACZ,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;YAChB,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC;YACnC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACjC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC;YACxC,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC;YACxB,CAAC,OAAO,EAAE,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC;YAC/B,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,UAAU,OAAO,CAAC;YACjC,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,YAAY,UAAU,CAAC;YAC/D,CAAC,eAAe,EAAE,CAAC,CAAC,cAAc,IAAI,OAAO,CAAC;SAC/C,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,EAAE,CACL,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,kBAAkB,CAAC;SAC3B,WAAW,CAAC,+CAA+C,CAAC;SAC5D,cAAc,CAAC,eAAe,EAAE,0BAA0B,CAAC;SAC3D,MAAM,CAAC,mBAAmB,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;SACvD,MAAM,CACL,mBAAmB,EACnB,qDAAqD,CACtD;SACA,MAAM,CAAC,gBAAgB,EAAE,0CAA0C,CAAC;SACpE,MAAM,CAAC,WAAW,EAAE,mDAAmD,CAAC;SACxE,MAAM,CAAC,oBAAoB,EAAE,uCAAuC,CAAC;SACrE,MAAM,CAAC,mBAAmB,EAAE,mCAAmC,CAAC;SAChE,MAAM,CAAC,iBAAiB,EAAE,8CAA8C,CAAC;SACzE,MAAM,CAAC,uBAAuB,EAAE,6BAA6B,CAAC;SAC9D,MAAM,CAAC,mBAAmB,EAAE,+CAA+C,CAAC;SAC5E,MAAM,CAAC,qBAAqB,EAAE,uCAAuC,CAAC;SACtE,MAAM,CACL,CACE,OAAe,EACf,OAYC,EACD,EAAE,CACF,GAAG,CAAC,KAAK,IAAI,EAAE;QACb,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,MAAM,IAAI,GAAuB;YAC/B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAA2B;YAC3C,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS;gBAC7B,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,KAAK,EAAE;gBACjC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,QAAQ,EAAE,SAAS,EAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS;gBAClC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS;gBAC9B,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;gBAC5B,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS;gBAC9B,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE;gBAChC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS;gBAChC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAA4B,EAAE;gBACpD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS;gBAC9B,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,MAAM,EAAE;gBACrC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS;gBACjC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;gBAClC,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACjB,WAAW,CAAC,OAAO,EAAE,WAAW,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC9D,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;gBAC3B,IAAI,CACF,gHAAgH,CACjH,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,EAAE,CACP,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CAAC,0DAA0D,CAAC;SACvE,MAAM,CAAC,CAAC,EAAU,EAAE,IAAY,EAAE,EAAE,CACnC,GAAG,CAAC,KAAK,IAAI,EAAE;QACb,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,yBAAyB,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,EAAE,CACL,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,wBAAwB,CAAC;SACjC,WAAW,CAAC,oDAAoD,CAAC;SACjE,MAAM,CAAC,CAAC,EAAU,EAAE,KAAe,EAAE,EAAE,CACtC,GAAG,CAAC,KAAK,IAAI,EAAE;QACb,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,CACX,IAAI,CACF,KAAK,CAAC,MAAM;YACV,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACpD,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,4CAA4C,CAChE,CACF,CAAC;IACJ,CAAC,CAAC,EAAE,CACL,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,0CAA0C,CAAC;SACvD,MAAM,CAAC,CAAC,EAAU,EAAE,EAAE,CACrB,GAAG,CAAC,KAAK,IAAI,EAAE;QACb,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,CACX,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,iDAAiD,CAAC,CACvE,CAAC;IACJ,CAAC,CAAC,EAAE,CACL,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,kCAAkC,CAAC;SAC/C,MAAM,CAAC,CAAC,EAAU,EAAE,EAAE,CACrB,GAAG,CAAC,KAAK,IAAI,EAAE;QACb,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,EAAE,CACL,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,uDAAuD,CAAC;SACpE,MAAM,CAAC,CAAC,EAAU,EAAE,EAAE,CACrB,GAAG,CAAC,KAAK,IAAI,EAAE;QACb,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACjB,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAChC,IAAI,CACF,6EAA6E,CAC9E,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,EAAE,CACL,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,2CAA2C,CAAC;SACxD,MAAM,CAAC,gBAAgB,EAAE,wBAAwB,CAAC;SAClD,MAAM,CAAC,CAAC,EAAU,EAAE,OAA2B,EAAE,EAAE,CAClD,GAAG,CAAC,KAAK,IAAI,EAAE;QACb,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAC5C,EAAE,EACF,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAChE,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAClB,IAAI,CACF,YAAY,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,QAAQ,CAAC,MAAM,KAAK,GAAG,CACzD,0BAA0B,EAAE,IAAI,QAAQ,CAAC,EAAE,EAAE,CAC9C,EAAE,CACJ,CACF,CAAC;IACJ,CAAC,CAAC,EAAE,CACL,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,iBAAiB,CAAC;SAC1B,KAAK,CAAC,KAAK,CAAC;SACZ,WAAW,CAAC,8CAA8C,CAAC;SAC3D,MAAM,CAAC,aAAa,EAAE,kBAAkB,EAAE,IAAI,CAAC;SAC/C,MAAM,CAAC,CAAC,EAAU,EAAE,OAA0B,EAAE,EAAE,CACjD,GAAG,CAAC,KAAK,IAAI,EAAE;QACb,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAC9C,EAAE,EACF,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CACtB,CAAC;QACF,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CACd,IAAI,CAAC,MAAM;YACT,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC;YACrB,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC,CACrD,CAAC;IACJ,CAAC,CAAC,EAAE,CACL,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,4BAA4B,CAAC;SACrC,WAAW,CAAC,8DAA8D,CAAC;SAC3E,MAAM,CAAC,CAAC,EAAU,EAAE,UAAkB,EAAE,EAAE,CACzC,GAAG,CAAC,KAAK,IAAI,EAAE;QACb,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QAC5D,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE;YACX,OAAO,CAAC;gBACN,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrB,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC/B,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC1C,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;gBACrC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;gBACjC,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,yBAAyB,CAAC;gBACtD,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAClC,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC;aAC1C,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBACd,IAAI,CAAC,SAAS,CAAC,CAAC;gBAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClB,IAAI,CAAC,mBAAmB,CAAC,CAAC;gBAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,EAAE,CACL,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,0BAA0B,CAAC;SACnC,WAAW,CAAC,uDAAuD,CAAC;SACpE,MAAM,CAAC,CAAC,EAAU,EAAE,UAAkB,EAAE,EAAE,CACzC,GAAG,CAAC,KAAK,IAAI,EAAE;QACb,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAClB,IAAI,CAAC,wBAAwB,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,CACnD,CAAC;IACJ,CAAC,CAAC,EAAE,CACL,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,KAAK,CAAC,QAAQ,CAAC;SACf,WAAW,CAAC,uCAAuC,CAAC;SACpD,MAAM,CAAC,CAAC,EAAU,EAAE,EAAE,CACrB,GAAG,CAAC,KAAK,IAAI,EAAE;QACb,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAChB,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAC3D,CAAC;IACJ,CAAC,CAAC,EAAE,CACL,CAAC;AACN,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,38 @@
+export declare const DEFAULT_BASE_URL = "https://qoren.sh";
+export type Profile = {
+    token: string;
+    baseUrl: string;
+    /** Cached from `GET /clients` so environment commands don't re-resolve the
+     * org's fleet tenant on every invocation. Refreshed on a miss. */
+    orgSlug?: string;
+    email?: string;
+};
+export declare function configDir(): string;
+export declare function configPath(): string;
+/** The name of the profile a command should use. */
+export declare function profileName(explicit?: string): string;
+/**
+ * The credentials to run with, or null when there are none.
+ *
+ * Resolution order, highest first:
+ *   1. QOREN_TOKEN / QOREN_API_URL   (CI, and any deliberate override)
+ *   2. --api-url                     (a flag beats stored config)
+ *   3. the named profile
+ */
+export declare function resolveProfile(options: {
+    profile?: string;
+    baseUrl?: string;
+}): Profile | null;
+/** The base URL to talk to even when there is no stored login (so `qoren login`
+ * knows where to send the browser). */
+export declare function resolveBaseUrl(explicit?: string): string;
+/** Store a profile and make it current. */
+export declare function saveProfile(name: string, profile: Profile): void;
+/** Update fields on an existing profile, e.g. caching the resolved org slug.
+ * A no-op when the profile isn't stored (an env-token session has no file). */
+export declare function patchProfile(name: string, patch: Partial<Profile>): void;
+/** Forget a profile. Returns false when there was nothing to forget. */
+export declare function removeProfile(name: string): boolean;
+/** Every stored profile name, for `qoren logout --all` and diagnostics. */
+export declare function listProfiles(): string[];
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD,MAAM,MAAM,OAAO,GAAG;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB;sEACkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAQF,wBAAgB,SAAS,IAAI,MAAM,CAGlC;AAED,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAsBD,oDAAoD;AACpD,wBAAgB,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,GAAG,IAAI,CAgBjB;AAED;uCACuC;AACvC,wBAAgB,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAOxD;AAED,2CAA2C;AAC3C,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAOhE;AAED;+EAC+E;AAC/E,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAQxE;AAED,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAWnD;AAED,2EAA2E;AAC3E,wBAAgB,YAAY,IAAI,MAAM,EAAE,CAEvC"}

package/dist/config.js

@@ -0,0 +1,117 @@
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+// Where the CLI keeps its credentials.
+//
+// One file, `~/.config/qoren/config.json`, holding named profiles so a person
+// who works across accounts can switch with --profile rather than logging out.
+// It is written 0600 and its directory 0700: it holds bearer tokens, and a
+// world-readable token is the same as a published one.
+//
+// Environment variables win over the file, always. That is what makes CI work
+// without a login step, and it means a script can never accidentally pick up a
+// developer's personal profile — set QOREN_TOKEN and the file is not consulted.
+export const DEFAULT_BASE_URL = "https://qoren.sh";
+export function configDir() {
+    const xdg = process.env.XDG_CONFIG_HOME?.trim();
+    return xdg ? join(xdg, "qoren") : join(homedir(), ".config", "qoren");
+}
+export function configPath() {
+    return join(configDir(), "config.json");
+}
+function readFile() {
+    try {
+        return JSON.parse(readFileSync(configPath(), "utf8"));
+    }
+    catch {
+        // Missing, unreadable or corrupt all mean the same thing to a CLI: there is
+        // no stored login. Refusing to run would only strand someone whose file got
+        // truncated, when `qoren login` fixes it.
+        return {};
+    }
+}
+function writeFileAtomically(config) {
+    const path = configPath();
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    writeFileSync(path, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 });
+    // writeFileSync's mode only applies when it CREATES the file, so an existing
+    // file keeps whatever permissions it had. Set them every time.
+    chmodSync(path, 0o600);
+}
+/** The name of the profile a command should use. */
+export function profileName(explicit) {
+    return explicit ?? process.env.QOREN_PROFILE?.trim() ?? readFile().current ?? "default";
+}
+/**
+ * The credentials to run with, or null when there are none.
+ *
+ * Resolution order, highest first:
+ *   1. QOREN_TOKEN / QOREN_API_URL   (CI, and any deliberate override)
+ *   2. --api-url                     (a flag beats stored config)
+ *   3. the named profile
+ */
+export function resolveProfile(options) {
+    const envToken = process.env.QOREN_TOKEN?.trim();
+    const envUrl = process.env.QOREN_API_URL?.trim();
+    if (envToken) {
+        return {
+            token: envToken,
+            baseUrl: options.baseUrl ?? envUrl ?? DEFAULT_BASE_URL,
+        };
+    }
+    const stored = readFile().profiles?.[profileName(options.profile)];
+    if (!stored)
+        return null;
+    return {
+        ...stored,
+        baseUrl: options.baseUrl ?? envUrl ?? stored.baseUrl ?? DEFAULT_BASE_URL,
+    };
+}
+/** The base URL to talk to even when there is no stored login (so `qoren login`
+ * knows where to send the browser). */
+export function resolveBaseUrl(explicit) {
+    return (explicit ??
+        process.env.QOREN_API_URL?.trim() ??
+        resolveProfile({})?.baseUrl ??
+        DEFAULT_BASE_URL);
+}
+/** Store a profile and make it current. */
+export function saveProfile(name, profile) {
+    const config = readFile();
+    writeFileAtomically({
+        ...config,
+        current: name,
+        profiles: { ...config.profiles, [name]: profile },
+    });
+}
+/** Update fields on an existing profile, e.g. caching the resolved org slug.
+ * A no-op when the profile isn't stored (an env-token session has no file). */
+export function patchProfile(name, patch) {
+    const config = readFile();
+    const existing = config.profiles?.[name];
+    if (!existing)
+        return;
+    writeFileAtomically({
+        ...config,
+        profiles: { ...config.profiles, [name]: { ...existing, ...patch } },
+    });
+}
+/** Forget a profile. Returns false when there was nothing to forget. */
+export function removeProfile(name) {
+    const config = readFile();
+    if (!config.profiles?.[name])
+        return false;
+    const profiles = { ...config.profiles };
+    delete profiles[name];
+    writeFileAtomically({
+        ...config,
+        profiles,
+        ...(config.current === name ? { current: undefined } : {}),
+    });
+    return true;
+}
+/** Every stored profile name, for `qoren logout --all` and diagnostics. */
+export function listProfiles() {
+    return Object.keys(readFile().profiles ?? {});
+}
+//# sourceMappingURL=config.js.map