@quatronic/qore 0.1.0

package/dist/cli.js

@@ -0,0 +1,1084 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { homedir } from "os";
+import { EnvHttpProxyAgent, setGlobalDispatcher } from "undici";
+
+// src/cli/io.ts
+import { select } from "@inquirer/prompts";
+import { createInterface } from "readline";
+
+// src/platform/browser.ts
+import open from "open";
+async function openBrowser(url) {
+  if (process.platform === "linux" && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY) return false;
+  try {
+    await open(url);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/core/errors.ts
+var EXIT = {
+  QORE_INTERNAL: 1,
+  QORE_KEYCHAIN_UNAVAILABLE: 1,
+  QORE_KEYCHAIN_DENIED: 1,
+  QORE_CONTEXT_REQUIRED: 2,
+  QORE_CONTEXT_INVALID: 2,
+  QORE_NOT_LOGGED_IN: 4,
+  QORE_SESSION_EXPIRED: 4,
+  QORE_LOGIN_EXPIRED: 4,
+  QORE_LOGIN_DENIED: 4,
+  QORE_CLOCK_SKEW: 4,
+  QORE_TENANT_ACCESS_LOST: 5,
+  QORE_RESOURCE_NOT_FOUND: 5,
+  QORE_ACCESS_DENIED: 5,
+  QORE_NO_DEVELOPER_ACCESS: 5,
+  QORE_AUTH_UNAVAILABLE: 6,
+  QORE_AUTH_BUSY: 6,
+  QORE_API_UNREACHABLE: 6,
+  QORE_API_UNAVAILABLE: 6,
+  QORE_INCOMPATIBLE_SERVER: 7,
+  QORE_UNSUPPORTED_BY_SERVER: 7,
+  QORE_UPGRADE_REQUIRED: 7,
+  QORE_PORTAL_UNTRUSTED: 7,
+  QORE_RATE_LIMITED: 8
+};
+var QoreError = class extends Error {
+  code;
+  hint;
+  status;
+  requestId;
+  candidates;
+  serverCode;
+  details;
+  constructor(code, message, opts = {}) {
+    super(message, opts.cause === void 0 ? void 0 : { cause: opts.cause });
+    this.name = "QoreError";
+    this.code = code;
+    this.hint = opts.hint;
+    this.status = opts.status;
+    this.requestId = opts.requestId;
+    this.candidates = opts.candidates;
+    this.serverCode = opts.serverCode;
+    this.details = opts.details;
+  }
+};
+var CancelledError = class extends Error {
+  constructor() {
+    super("Cancelled");
+    this.name = "CancelledError";
+  }
+};
+function exitCodeFor(err) {
+  if (err instanceof CancelledError || err instanceof Error && err.name === "CancelledError") return 130;
+  if (err instanceof QoreError) return EXIT[err.code];
+  return 1;
+}
+function toJsonError(err) {
+  if (!(err instanceof QoreError)) {
+    return { code: "QORE_INTERNAL", message: err instanceof Error ? err.message : String(err) };
+  }
+  const out = { code: err.code, message: err.message };
+  for (const k of ["hint", "status", "requestId", "candidates", "serverCode", "details"]) {
+    if (err[k] !== void 0) out[k] = err[k];
+  }
+  return out;
+}
+
+// src/cli/io.ts
+function isInteractive(o) {
+  return o.stdinTTY && o.stdoutTTY && !o.json && !o.noInput && !o.env.CI;
+}
+function processIo(interactive) {
+  return {
+    out: (s) => {
+      process.stdout.write(s + "\n");
+    },
+    err: (s) => {
+      process.stderr.write(s + "\n");
+    },
+    interactive,
+    async select(message, choices) {
+      try {
+        return await select({ message, choices });
+      } catch (e) {
+        if (e.name === "ExitPromptError") throw new CancelledError();
+        throw e;
+      }
+    },
+    waitForEnter: createWaitForEnter(process.stdin, process.stderr),
+    openUrl: openBrowser
+  };
+}
+function createWaitForEnter(input, output) {
+  return (message, signal) => new Promise((resolve, reject) => {
+    const rl = createInterface({ input, output, terminal: true });
+    const onAbort = () => {
+      rl.close();
+      reject(new CancelledError());
+    };
+    const done = () => {
+      signal.removeEventListener("abort", onAbort);
+      rl.close();
+      resolve();
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    rl.on("SIGINT", () => {
+      signal.removeEventListener("abort", onAbort);
+      rl.close();
+      reject(new CancelledError());
+    });
+    rl.question(message, done);
+  });
+}
+
+// src/cli/program.ts
+import { Command, CommanderError } from "commander";
+
+// src/core/api/http.ts
+function abortableFetch(fetch2, signal) {
+  return (input, init) => fetch2(input, { ...init, signal: init?.signal ? AbortSignal.any([init.signal, signal]) : signal });
+}
+var TLS = /* @__PURE__ */ new Set([
+  "SELF_SIGNED_CERT_IN_CHAIN",
+  "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
+  "DEPTH_ZERO_SELF_SIGNED_CERT",
+  "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+  "CERT_HAS_EXPIRED"
+]);
+function causeCode(e) {
+  const c = e?.cause;
+  const code = c?.code ?? e?.code;
+  return typeof code === "string" ? code : void 0;
+}
+function isAbortError(e) {
+  return e?.name === "AbortError";
+}
+function fetchError(e, host) {
+  return isAbortError(e) ? new CancelledError() : networkError(e, host);
+}
+function networkError(e, host) {
+  const code = causeCode(e) ?? "";
+  let reason = "connect";
+  let hint = "Check your network or VPN.";
+  if (code === "ENOTFOUND" || code === "EAI_AGAIN") {
+    reason = "dns";
+    hint = `${host} could not be resolved. Check your network or VPN.`;
+  } else if (TLS.has(code)) {
+    reason = "tls";
+    hint = "A proxy is re-signing TLS. Point NODE_EXTRA_CA_CERTS at your organisation's CA certificate.";
+  } else if (code.includes("TIMEOUT") || code === "ETIMEDOUT") {
+    reason = "timeout";
+  } else if (!process.env.HTTPS_PROXY && !process.env.https_proxy) {
+    hint = "Check your network. Behind a corporate proxy, set HTTPS_PROXY.";
+  }
+  return new QoreError("QORE_API_UNREACHABLE", `Could not reach ${host}`, { hint, details: { reason, host, errno: code || void 0 }, cause: e });
+}
+var BY_SERVER_CODE = {
+  "app.access.denied": "QORE_ACCESS_DENIED",
+  "auth.scope.insufficient": "QORE_ACCESS_DENIED",
+  "cli.upgrade_required": "QORE_UPGRADE_REQUIRED",
+  "rate_limited": "QORE_RATE_LIMITED"
+};
+function byStatus(status) {
+  if (status === 403) return "QORE_ACCESS_DENIED";
+  if (status === 404) return "QORE_RESOURCE_NOT_FOUND";
+  if (status === 426) return "QORE_UPGRADE_REQUIRED";
+  if (status === 429) return "QORE_RATE_LIMITED";
+  if (status === 502 || status === 503 || status === 504) return "QORE_API_UNAVAILABLE";
+  return "QORE_INTERNAL";
+}
+async function problemToError(res) {
+  let body = {};
+  try {
+    body = await res.json();
+  } catch {
+  }
+  const serverCode = body.code;
+  const code = serverCode && BY_SERVER_CODE[serverCode] || byStatus(res.status);
+  const requestId = res.headers.get("x-request-id") ?? void 0;
+  const details = {};
+  if (body.detail && typeof body.detail === "object") Object.assign(details, body.detail);
+  const detail = typeof body.detail === "string" && body.detail ? body.detail : void 0;
+  if (detail) details.detail = detail;
+  const retry = res.headers.get("retry-after");
+  if (retry && /^\d+$/.test(retry)) details.retryAfter = Number(retry);
+  const hint = code === "QORE_UPGRADE_REQUIRED" ? "Run: npm i -g @quatronic/qore" : code === "QORE_RATE_LIMITED" ? `Wait ${details.retryAfter ?? "a moment"} s and retry.` : code === "QORE_API_UNAVAILABLE" ? "Qore is temporarily unavailable; retry in a minute." : void 0;
+  const genericTitle = !body.title || body.title === "HTTP error" || body.title === serverCode;
+  const message = genericTitle && detail || body.title || `Request failed (${res.status})`;
+  return new QoreError(code, message, {
+    status: res.status,
+    requestId,
+    serverCode,
+    hint,
+    details: Object.keys(details).length ? details : void 0
+  });
+}
+
+// src/cli/program.ts
+import pc2 from "picocolors";
+
+// src/cli/render.ts
+import pc, { createColors } from "picocolors";
+function renderJson(io2, data) {
+  io2.out(JSON.stringify({ ok: true, data }));
+}
+function renderError(io2, err, json2, colorEnabled = pc.isColorSupported) {
+  if (json2) {
+    io2.out(JSON.stringify({ ok: false, error: toJsonError(err) }));
+    return;
+  }
+  if (err instanceof Error && err.name === "CancelledError") {
+    io2.err("Cancelled");
+    return;
+  }
+  const c = createColors(colorEnabled);
+  const e = err instanceof QoreError ? err : new QoreError("QORE_INTERNAL", err instanceof Error ? err.message : String(err));
+  io2.err(c.red(`Error: ${e.message}`));
+  if (e.hint) io2.err(e.hint);
+  io2.err(c.dim(`Code: ${e.code}${e.requestId ? ` (request ${e.requestId})` : ""}`));
+}
+
+// src/cli/program.ts
+function jsonFromArgv(argv2) {
+  return argv2.some((a) => a === "--json" || a.startsWith("--json="));
+}
+function requestLog(ctx) {
+  return ctx.opts().verbose ? (line) => ctx.io.err(line) : void 0;
+}
+function buildProgram(deps2, io2, signal, register) {
+  const program = new Command("qore").description("Qore developer CLI").option("--portal <name|url>", "prod, staging, or a portal URL (default: the portal you last logged in to, else prod)").option("--json", "print exactly one JSON document on stdout").option("--no-input", "never prompt").option("--verbose", "log request lines (never secrets)").option("--no-color", "disable colours").exitOverride().configureOutput({ writeOut: (s) => io2.out(s.trimEnd()), writeErr: (s) => io2.err(s.trimEnd()) });
+  const ctx = { deps: deps2, io: io2, signal, opts: () => program.opts() };
+  for (const r of register) r(program, ctx);
+  return program;
+}
+async function run(argv2, deps2, io2, signal, register) {
+  const json2 = jsonFromArgv(argv2);
+  const parseIo = json2 ? { ...io2, err: () => {
+  } } : io2;
+  const program = buildProgram(deps2, parseIo, signal, register);
+  try {
+    await program.parseAsync(argv2, { from: "user" });
+    return 0;
+  } catch (caught) {
+    const e = signal.aborted && isAbortError(caught) ? new CancelledError() : caught;
+    if (e instanceof CommanderError) {
+      if (e.exitCode === 0) return 0;
+      if (json2) io2.out(JSON.stringify({ ok: false, error: { code: "QORE_CONTEXT_INVALID", message: e.message } }));
+      return 2;
+    }
+    const opts = program.opts();
+    renderError(io2, e, Boolean(opts.json), pc2.isColorSupported && opts.color !== false);
+    return exitCodeFor(e);
+  }
+}
+
+// src/core/api/meta.ts
+var SUPPORTED = ["v1"];
+var SEMVER = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?/;
+function compareVersions(a, b) {
+  const pa = SEMVER.exec(a), pb = SEMVER.exec(b);
+  if (!pa || !pb) return 0;
+  for (let i = 1; i <= 3; i++) {
+    const d = Number(pa[i]) - Number(pb[i]);
+    if (d !== 0) return d;
+  }
+  if (pa[4] && !pb[4]) return -1;
+  if (!pa[4] && pb[4]) return 1;
+  return 0;
+}
+async function fetchMeta(fetch2, apiOrigin) {
+  let res;
+  try {
+    res = await fetch2(`${apiOrigin}/api/cli/meta`, { headers: { accept: "application/json" } });
+  } catch (e) {
+    throw fetchError(e, new URL(apiOrigin).host);
+  }
+  if (res.status === 404) {
+    throw new QoreError("QORE_INCOMPATIBLE_SERVER", "This portal does not support the Qore CLI yet", {
+      status: 404,
+      requestId: res.headers.get("x-request-id") ?? void 0,
+      hint: `Check the portal URL (${apiOrigin}); if it is right, the portal must be upgraded before qore can use it.`
+    });
+  }
+  if (!res.ok) throw await problemToError(res);
+  return await res.json();
+}
+function negotiate(meta, portal, cliVersion) {
+  if (portal.pinnedIssuer && meta.auth.issuer !== portal.pinnedIssuer) {
+    throw new QoreError("QORE_PORTAL_UNTRUSTED", `${portal.apiOrigin} names an unexpected identity provider`, {
+      details: { expected: portal.pinnedIssuer, got: meta.auth.issuer },
+      hint: "Refusing to log in. Check the portal URL and your network."
+    });
+  }
+  const apiVersion = SUPPORTED.find((v) => meta.apiVersions.includes(v));
+  if (!apiVersion) {
+    throw new QoreError("QORE_INCOMPATIBLE_SERVER", "This portal speaks no API version this qore knows", {
+      details: { server: meta.apiVersions, client: [...SUPPORTED] },
+      hint: "Run: npm i -g @quatronic/qore"
+    });
+  }
+  if (!cliVersion.endsWith("-dev") && compareVersions(cliVersion, meta.minCliVersion) < 0) {
+    throw new QoreError("QORE_UPGRADE_REQUIRED", `qore ${cliVersion} is too old for this portal (needs ${meta.minCliVersion})`, {
+      hint: "Run: npm i -g @quatronic/qore"
+    });
+  }
+  return { apiVersion };
+}
+
+// src/core/auth/oidc.ts
+import * as oc from "openid-client";
+var LOGIN_SCOPE = "openid profile email offline_access qore:read qore:local-env";
+function decodeSub(accessToken) {
+  const part = accessToken.split(".")[1] ?? "";
+  const claims = JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
+  return { sub: claims.sub, email: claims.email };
+}
+function toTokenSet(t, fallbackRt) {
+  const rt = t.refresh_token ?? fallbackRt;
+  if (!rt) throw new QoreError("QORE_INTERNAL", "Keycloak returned no refresh token");
+  return {
+    accessToken: t.access_token,
+    refreshToken: rt,
+    expiresIn: t.expires_in ?? 600,
+    scope: t.scope ?? "",
+    ...decodeSub(t.access_token)
+  };
+}
+function unreachable(e, host) {
+  const n = networkError(e, host);
+  return new QoreError("QORE_AUTH_UNAVAILABLE", n.message, { hint: n.hint, details: n.details, cause: e });
+}
+function mapOidcError(e, host) {
+  if (e instanceof QoreError || e instanceof CancelledError) return e;
+  if (isAbortError(e) || e?.code === "OAUTH_ABORT" || isAbortError(e?.cause)) {
+    return new CancelledError();
+  }
+  const err = e.error;
+  if (err === "access_denied") return new QoreError("QORE_LOGIN_DENIED", "The login was denied in the browser");
+  if (err === "expired_token") return new QoreError("QORE_LOGIN_EXPIRED", "The login code expired", { hint: "Run `qore login` again." });
+  if (err === "invalid_grant") return new QoreError("QORE_SESSION_EXPIRED", "Your session has ended", { hint: "Run `qore login`." });
+  const status = e.status;
+  if (status && status >= 500) return new QoreError("QORE_AUTH_UNAVAILABLE", "Keycloak is unavailable", { cause: e });
+  if (e instanceof TypeError) return unreachable(e, host);
+  const cause = e?.cause;
+  if (cause instanceof TypeError) return unreachable(cause, host);
+  return new QoreError("QORE_AUTH_UNAVAILABLE", "Login failed", { cause: e });
+}
+async function createOidc(opts) {
+  const host = new URL(opts.issuer).host;
+  const execute = new URL(opts.issuer).protocol === "http:" ? [oc.allowInsecureRequests] : [];
+  let config;
+  try {
+    config = await oc.discovery(new URL(opts.issuer), opts.clientId, void 0, oc.None(), {
+      execute,
+      [oc.customFetch]: opts.fetch
+    });
+  } catch (e) {
+    throw mapOidcError(e, host);
+  }
+  return {
+    async startDevice(scope) {
+      try {
+        const r = await oc.initiateDeviceAuthorization(config, { scope });
+        return {
+          userCode: r.user_code,
+          verificationUri: r.verification_uri,
+          verificationUriComplete: r.verification_uri_complete,
+          expiresIn: r.expires_in,
+          handle: r
+        };
+      } catch (e) {
+        throw mapOidcError(e, host);
+      }
+    },
+    async pollDevice(start, signal) {
+      try {
+        const t = await oc.pollDeviceAuthorizationGrant(config, start.handle, void 0, { signal });
+        return toTokenSet(t);
+      } catch (e) {
+        throw mapOidcError(e, host);
+      }
+    },
+    async refresh(rt, scope) {
+      try {
+        const t = await oc.refreshTokenGrant(config, rt, scope ? { scope } : void 0);
+        return toTokenSet(t, rt);
+      } catch (e) {
+        throw mapOidcError(e, host);
+      }
+    },
+    async revoke(rt) {
+      try {
+        await oc.tokenRevocation(config, rt, { token_type_hint: "refresh_token" });
+      } catch (e) {
+        throw mapOidcError(e, host);
+      }
+    }
+  };
+}
+
+// src/core/auth/login.ts
+async function deviceLogin(opts) {
+  await opts.store.getRefresh();
+  const start = await opts.oidc.startDevice(LOGIN_SCOPE);
+  const stopPoll = new AbortController();
+  const settled = new AbortController();
+  const poll = opts.oidc.pollDevice(start, AbortSignal.any([opts.signal, stopPoll.signal])).finally(() => settled.abort());
+  poll.catch(() => {
+  });
+  try {
+    await opts.onCode(start, settled.signal);
+  } catch (e) {
+    stopPoll.abort();
+    const late = await poll.catch(() => null);
+    if (late) await opts.oidc.revoke(late.refreshToken).catch(() => {
+    });
+    throw e;
+  }
+  const t = await poll;
+  const at = opts.now();
+  const write = async () => {
+    await opts.store.setRefresh({ rt: t.refreshToken, sub: t.sub, scope: t.scope, obtainedAt: at.toISOString() });
+    await opts.store.setAccess({ at: t.accessToken, expiresAt: new Date(at.getTime() + t.expiresIn * 1e3).toISOString() });
+  };
+  try {
+    if (opts.withLock && opts.lockName) await opts.withLock(opts.lockName, write);
+    else await write();
+  } catch (e) {
+    await opts.oidc.revoke(t.refreshToken).catch(() => {
+    });
+    await opts.store.clear().catch(() => {
+    });
+    throw e;
+  }
+  return t;
+}
+
+// src/core/auth/tokenStore.ts
+var TokenStore = class {
+  constructor(kc, hash) {
+    this.kc = kc;
+    this.hash = hash;
+  }
+  kc;
+  hash;
+  async read(suffix) {
+    const raw = await this.kc.get(`${this.hash}:${suffix}`);
+    if (raw === null) return null;
+    try {
+      return JSON.parse(raw);
+    } catch {
+      return null;
+    }
+  }
+  getRefresh() {
+    return this.read("refresh");
+  }
+  getAccess() {
+    return this.read("access");
+  }
+  setRefresh(v) {
+    return this.kc.set(`${this.hash}:refresh`, JSON.stringify(v));
+  }
+  setAccess(v) {
+    return this.kc.set(`${this.hash}:access`, JSON.stringify(v));
+  }
+  async clear() {
+    await this.kc.delete(`${this.hash}:access`);
+    await this.kc.delete(`${this.hash}:refresh`);
+  }
+};
+
+// src/core/profiles.ts
+import { createHash } from "crypto";
+var BUILTIN_PORTALS = {
+  prod: {
+    apiOrigin: "https://api.quatronic.app",
+    pinnedIssuer: "https://auth.quatronic.app/realms/platform-prod"
+  },
+  staging: {
+    apiOrigin: "https://p01--portal-api-staging--hcywmtb2vksv.code.run",
+    pinnedIssuer: "https://auth-staging.quatronic.app/realms/platform-staging"
+  }
+};
+function builtinFor(origin) {
+  for (const [name, p] of Object.entries(BUILTIN_PORTALS)) {
+    if (p.apiOrigin === origin) return { ...p, builtin: name };
+  }
+  return null;
+}
+function toOrigin(raw) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new QoreError("QORE_CONTEXT_INVALID", `Not a portal name or URL: ${raw}`, {
+      hint: "Use --portal prod, --portal staging or --portal https://\u2026"
+    });
+  }
+  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1";
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+    throw new QoreError("QORE_CONTEXT_INVALID", "A portal URL must use https (http only for localhost)");
+  }
+  return url.origin.toLowerCase();
+}
+function resolvePortal(arg, defaultProfile) {
+  const chosen = arg ?? defaultProfile;
+  if (chosen === void 0 || chosen === "prod") return { ...BUILTIN_PORTALS.prod, builtin: "prod" };
+  if (chosen === "staging") return { ...BUILTIN_PORTALS.staging, builtin: "staging" };
+  const origin = toOrigin(chosen);
+  return builtinFor(origin) ?? { apiOrigin: origin, pinnedIssuer: null, builtin: null };
+}
+function profileHash(apiOrigin, issuer) {
+  return createHash("sha256").update(`${apiOrigin}|${issuer}`).digest("hex").slice(0, 16);
+}
+
+// src/core/api/client.ts
+var QoreApiClient = class {
+  constructor(o) {
+    this.o = o;
+  }
+  o;
+  async once(path, force) {
+    const token = await this.o.token(force);
+    let res;
+    try {
+      res = await this.o.fetch(`${this.o.apiOrigin}${path}`, {
+        headers: {
+          authorization: `Bearer ${token}`,
+          accept: "application/json",
+          "qore-cli-version": this.o.cliVersion,
+          "qore-command": this.o.command,
+          "user-agent": `qore/${this.o.cliVersion} (${this.o.platform})`
+        }
+      });
+    } catch (e) {
+      throw fetchError(e, new URL(this.o.apiOrigin).host);
+    }
+    this.o.onRequest?.(`GET ${path} \u2192 ${res.status}${res.headers.get("x-request-id") ? ` (${res.headers.get("x-request-id")})` : ""}`);
+    return res;
+  }
+  async get(path) {
+    let res = await this.once(path, false);
+    if (res.status === 401) {
+      res = await this.once(path, true);
+      if (res.status === 401) {
+        throw new QoreError("QORE_SESSION_EXPIRED", "The portal no longer accepts your session", {
+          hint: "Run `qore login`.",
+          status: 401,
+          requestId: res.headers.get("x-request-id") ?? void 0
+        });
+      }
+    }
+    if (!res.ok) throw await problemToError(res);
+    return await res.json();
+  }
+};
+
+// src/core/auth/refresh.ts
+var SKEW_MS = 6e4;
+var RefreshCoordinator = class {
+  constructor(o) {
+    this.o = o;
+  }
+  o;
+  fresh(expiresAt) {
+    return new Date(expiresAt).getTime() - this.o.now().getTime() > SKEW_MS;
+  }
+  async rotate(scope) {
+    let stored = await this.o.store.getRefresh();
+    if (!stored) throw new QoreError("QORE_NOT_LOGGED_IN", "Not logged in", { hint: "Run `qore login`." });
+    let t;
+    for (let attempt = 0; ; attempt++) {
+      try {
+        t = await (await this.o.oidc()).refresh(stored.rt, scope);
+        break;
+      } catch (e) {
+        if (!(e instanceof QoreError && e.code === "QORE_SESSION_EXPIRED")) throw e;
+        const now = await this.o.store.getRefresh();
+        if (now && now.rt !== stored.rt) {
+          if (attempt === 0) {
+            stored = now;
+            continue;
+          }
+          throw e;
+        }
+        await this.o.store.clear();
+        throw e;
+      }
+    }
+    await this.o.store.setRefresh({ rt: t.refreshToken, sub: t.sub, scope: t.scope || (scope ?? stored.scope), obtainedAt: this.o.now().toISOString() });
+    return t;
+  }
+  async accessToken(opts = {}) {
+    const seen = await this.o.store.getAccess();
+    if (!opts.force && seen && this.fresh(seen.expiresAt)) return seen.at;
+    return this.o.withLock(this.o.lockName, async () => {
+      const again = await this.o.store.getAccess();
+      if (again && again.at !== seen?.at && this.fresh(again.expiresAt)) return again.at;
+      const t = await this.rotate();
+      await this.o.store.setAccess({ at: t.accessToken, expiresAt: new Date(this.o.now().getTime() + t.expiresIn * 1e3).toISOString() });
+      return t.accessToken;
+    });
+  }
+  /** A token carrying only `scopes`, held in memory by the caller (qore mcp). */
+  async downscoped(scopes) {
+    return this.o.withLock(this.o.lockName, async () => (await this.rotate(scopes.join(" "))).accessToken);
+  }
+};
+
+// src/core/session.ts
+function loginHint(portal) {
+  return portal.builtin === "prod" ? "Run `qore login`." : `Run \`qore login --portal ${portal.builtin ?? portal.apiOrigin}\`.`;
+}
+async function openSession(deps2, portal, command, onRequest) {
+  const profile = (await deps2.config.read()).profiles[portal.apiOrigin];
+  if (!profile) throw new QoreError("QORE_NOT_LOGGED_IN", `Not logged in to ${portal.apiOrigin}`, { hint: loginHint(portal) });
+  const hash = profileHash(profile.apiOrigin, profile.issuer);
+  const tokens = new TokenStore(deps2.keychain, hash);
+  if (!await tokens.getRefresh()) throw new QoreError("QORE_NOT_LOGGED_IN", `Not logged in to ${portal.apiOrigin}`, { hint: loginHint(portal) });
+  const refresh = new RefreshCoordinator({ store: tokens, oidc: () => deps2.oidcFor(profile.issuer), withLock: deps2.withLock, lockName: hash, now: deps2.now });
+  const api = new QoreApiClient({
+    apiOrigin: profile.apiOrigin,
+    fetch: deps2.fetch,
+    token: (force) => refresh.accessToken({ force }),
+    cliVersion: deps2.version,
+    command,
+    platform: `${deps2.platform} ${process.arch}; node ${process.versions.node}`,
+    onRequest
+  });
+  return { profile, api, tokens, refresh };
+}
+
+// src/cli/commands/login.ts
+function registerLogin(program, ctx) {
+  program.command("login").description("Log in with your Qore account").option("--no-browser", "only print the URL").action(async (cmd) => {
+    const { deps: deps2, io: io2, signal } = ctx;
+    const g = ctx.opts();
+    const cfg = await deps2.config.read();
+    const portal = resolvePortal(g.portal, cfg.defaultProfile);
+    const meta = await fetchMeta(deps2.fetch, portal.apiOrigin);
+    const known = cfg.profiles[portal.apiOrigin]?.issuer;
+    const pinned = { ...portal, pinnedIssuer: portal.pinnedIssuer ?? known ?? null };
+    if (!pinned.pinnedIssuer && portal.builtin === null) {
+      io2.err(`! Logging in to ${portal.apiOrigin}, identity provider ${meta.auth.issuer}`);
+    }
+    negotiate(meta, pinned, deps2.version);
+    const issuer = pinned.pinnedIssuer ?? meta.auth.issuer;
+    const hash = profileHash(portal.apiOrigin, issuer);
+    const store = new TokenStore(deps2.keychain, hash);
+    const t = await deviceLogin({
+      oidc: await deps2.oidcFor(issuer),
+      store,
+      now: deps2.now,
+      signal,
+      withLock: deps2.withLock,
+      lockName: hash,
+      onCode: async (s, settled) => {
+        const url = s.verificationUriComplete ?? s.verificationUri;
+        io2.err(`! First copy your one-time code: ${s.userCode}`);
+        if (io2.interactive && cmd.browser) {
+          try {
+            await io2.waitForEnter(`  Press Enter to open ${url} (or open it yourself)`, AbortSignal.any([signal, settled]));
+          } catch (e) {
+            if (settled.aborted && !signal.aborted) return;
+            throw e;
+          }
+          if (settled.aborted) return;
+          if (!await io2.openUrl(url)) io2.err(`  Open ${url} in a browser`);
+        } else {
+          io2.err(`  Open ${url} in a browser`);
+        }
+      }
+    });
+    await deps2.config.update((c) => {
+      c.profiles[portal.apiOrigin] = {
+        ...c.profiles[portal.apiOrigin],
+        apiOrigin: portal.apiOrigin,
+        issuer,
+        sub: t.sub,
+        email: t.email,
+        meta: { fetchedAt: deps2.now().toISOString(), doc: meta }
+      };
+      if (g.portal || !c.defaultProfile) c.defaultProfile = portal.apiOrigin;
+    });
+    const { api } = await openSession(deps2, { ...portal, pinnedIssuer: issuer }, "login", requestLog(ctx));
+    const me = await api.get("/api/cli/v1/me");
+    const prev = cfg.profiles[portal.apiOrigin];
+    let active = prev?.sub === t.sub && prev.activeTenant && me.tenants.some((x) => x.id === prev.activeTenant.id) ? prev.activeTenant : void 0;
+    if (active) {
+    } else if (me.tenants.length === 0) {
+      io2.err("! Your account is not a developer in any organisation. Ask an admin to invite you as developer.");
+    } else if (me.tenants.length === 1) {
+      active = { id: me.tenants[0].id, slug: me.tenants[0].slug };
+      io2.err(`\u2713 Using tenant ${me.tenants[0].name}`);
+    } else if (io2.interactive) {
+      active = await io2.select("Select a tenant", me.tenants.map((x) => ({ name: `${x.name}  ${x.role}`, value: { id: x.id, slug: x.slug } })));
+    } else {
+      io2.err(`! You belong to ${me.tenants.length} tenants; choose one with \`qore tenant use <slug>\``);
+    }
+    await deps2.config.update((c) => {
+      c.profiles[portal.apiOrigin].activeTenant = active;
+    });
+    const label = portal.builtin ?? portal.apiOrigin;
+    if (g.json) renderJson(io2, { portal: label, email: me.email, activeTenant: active ?? null });
+    else io2.out(`\u2713 Logged in as ${me.email} (${label})`);
+  });
+}
+
+// src/cli/commands/logout.ts
+function registerLogout(program, ctx) {
+  program.command("logout").description("End the CLI session").option("--all", "log out of every portal").action(async (cmd) => {
+    const { deps: deps2, io: io2 } = ctx;
+    const g = ctx.opts();
+    const cfg = await deps2.config.read();
+    const targets = cmd.all ? Object.values(cfg.profiles) : [cfg.profiles[resolvePortal(g.portal, cfg.defaultProfile).apiOrigin]].filter((p) => p !== void 0);
+    const done = [];
+    for (const p of targets) {
+      const hash = profileHash(p.apiOrigin, p.issuer);
+      const store = new TokenStore(deps2.keychain, hash);
+      const host = new URL(p.issuer).host;
+      await deps2.withLock(hash, async () => {
+        const rt = await store.getRefresh();
+        if (rt) {
+          try {
+            await (await deps2.oidcFor(p.issuer)).revoke(rt.rt);
+          } catch (e) {
+            const network = e instanceof QoreError && e.details?.reason !== void 0;
+            io2.err(network ? `! Could not reach ${host}; the server session may persist until it expires.` : `! Could not revoke the session at ${host} (${e instanceof Error ? e.message : String(e)}); the server session may persist until it expires.`);
+          }
+        }
+        await store.clear();
+      });
+      done.push(p.apiOrigin);
+    }
+    if (g.json) renderJson(io2, { loggedOut: done });
+    else if (done.length === 0) io2.out("Not logged in");
+    else io2.out(`\u2713 Logged out of ${done.map((o) => resolvePortal(o, void 0).builtin ?? o).join(", ")}`);
+  });
+}
+
+// src/cli/commands/tenant.ts
+function registerTenant(program, ctx) {
+  const tenant = program.command("tenant").description("Manage the active tenant");
+  tenant.command("list").description("List tenants you have access to").action(async () => {
+    const { deps: deps2, io: io2 } = ctx;
+    const g = ctx.opts();
+    const cfg = await deps2.config.read();
+    const portal = resolvePortal(g.portal, cfg.defaultProfile);
+    const { profile, api } = await openSession(deps2, portal, "tenant list", requestLog(ctx));
+    const me = await api.get("/api/cli/v1/me");
+    const activeId = profile.activeTenant?.id;
+    if (g.json) {
+      renderJson(io2, { tenants: me.tenants.map((t) => ({ ...t, active: t.id === activeId })) });
+      return;
+    }
+    for (const t of me.tenants) {
+      const mark = t.id === activeId ? "*" : " ";
+      io2.out(`${mark} ${t.name}  ${t.role}`);
+    }
+  });
+  tenant.command("use").description("Set the active tenant").argument("[slug]", "tenant slug").action(async (slug) => {
+    const { deps: deps2, io: io2 } = ctx;
+    const g = ctx.opts();
+    const cfg = await deps2.config.read();
+    const portal = resolvePortal(g.portal, cfg.defaultProfile);
+    const { api } = await openSession(deps2, portal, "tenant use", requestLog(ctx));
+    const me = await api.get("/api/cli/v1/me");
+    const candidates = me.tenants.map((t) => t.slug);
+    let chosen;
+    if (slug) {
+      const found = me.tenants.find((t) => t.slug === slug);
+      if (!found) throw new QoreError("QORE_RESOURCE_NOT_FOUND", `No tenant "${slug}" for this account`, { candidates });
+      chosen = { id: found.id, slug: found.slug };
+    } else if (io2.interactive) {
+      chosen = await io2.select("Select a tenant", me.tenants.map((t) => ({ name: `${t.name}  ${t.role}`, value: { id: t.id, slug: t.slug } })));
+    } else {
+      throw new QoreError("QORE_CONTEXT_REQUIRED", "Which tenant? Pass a slug or run interactively.", { candidates });
+    }
+    await deps2.config.update((c) => {
+      c.profiles[portal.apiOrigin].activeTenant = chosen;
+    });
+    if (g.json) renderJson(io2, { activeTenant: chosen });
+    else io2.out(`\u2713 Using tenant ${chosen.slug}`);
+  });
+}
+
+// src/cli/commands/version.ts
+function registerVersion(program, ctx) {
+  program.command("version").description("Show the CLI and portal version").action(async () => {
+    const { deps: deps2, io: io2 } = ctx;
+    const g = ctx.opts();
+    const cfg = await deps2.config.read();
+    const portal = resolvePortal(g.portal, cfg.defaultProfile);
+    let portalInfo = null;
+    try {
+      const meta = await fetchMeta(deps2.fetch, portal.apiOrigin);
+      portalInfo = { apiVersions: meta.apiVersions, minCliVersion: meta.minCliVersion, latestCliVersion: meta.latestCliVersion, capabilities: meta.capabilities };
+    } catch (e) {
+      if (e instanceof CancelledError) throw e;
+    }
+    if (g.json) {
+      renderJson(io2, { cli: deps2.version, portal: portalInfo });
+      return;
+    }
+    io2.out(`qore ${deps2.version}`);
+    const label = portal.builtin ?? portal.apiOrigin;
+    if (portalInfo) {
+      io2.out(`portal ${label}: api ${portalInfo.apiVersions.join(",")}, min ${portalInfo.minCliVersion}, latest ${portalInfo.latestCliVersion}`);
+    } else {
+      io2.out(`portal ${label}: unreachable`);
+    }
+  });
+}
+
+// src/cli/commands/whoami.ts
+function registerWhoami(program, ctx) {
+  program.command("whoami").description("Show who you're logged in as").action(async () => {
+    const { deps: deps2, io: io2 } = ctx;
+    const g = ctx.opts();
+    const cfg = await deps2.config.read();
+    const portal = resolvePortal(g.portal, cfg.defaultProfile);
+    const { profile, api } = await openSession(deps2, portal, "whoami", requestLog(ctx));
+    const me = await api.get("/api/cli/v1/me");
+    const activeTenant = profile.activeTenant;
+    if (activeTenant && !me.tenants.some((t) => t.id === activeTenant.id)) {
+      io2.err(`! You no longer have developer access to ${activeTenant.slug}`);
+    }
+    const label = portal.builtin ?? portal.apiOrigin;
+    if (g.json) {
+      renderJson(io2, { portal: label, activeTenant: activeTenant ?? null, me });
+      return;
+    }
+    io2.out(`${me.email} (${label})`);
+    for (const t of me.tenants) {
+      const mark = activeTenant?.id === t.id ? "*" : " ";
+      io2.out(`${mark} ${t.name}  ${t.role}`);
+      for (const a of t.apps) {
+        io2.out(`  ${a.slug}  ${a.access}`);
+        for (const m of a.modules) {
+          io2.out(`    ${m.slug}  ${m.type}  ${m.access}`);
+        }
+      }
+    }
+  });
+}
+
+// src/cli/commands/index.ts
+var COMMANDS = [registerLogin, registerLogout, registerWhoami, registerTenant, registerVersion];
+
+// src/cli/updateCheck.ts
+var REGISTRY_URL = "https://registry.npmjs.org/@quatronic%2Fqore/latest";
+var DAY_MS = 24 * 60 * 60 * 1e3;
+var DEFAULT_TIMEOUT_MS = 1500;
+async function maybeNotifyUpdate(deps2, io2, o, timeoutMs = DEFAULT_TIMEOUT_MS) {
+  if (o.json || deps2.env.CI || deps2.env.QORE_NO_UPDATE_CHECK === "1" || !io2.interactive) return;
+  const cfg = await deps2.config.read();
+  const last = cfg.updateCheck?.lastCheckedAt;
+  if (last && deps2.now().getTime() - new Date(last).getTime() < DAY_MS) return;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  let latest;
+  try {
+    const res = await deps2.fetch(REGISTRY_URL, { signal: controller.signal });
+    if (res.ok) latest = (await res.json()).version;
+  } catch {
+  } finally {
+    clearTimeout(timer);
+  }
+  try {
+    await deps2.config.update((c) => {
+      c.updateCheck = { lastCheckedAt: deps2.now().toISOString(), latest: latest ?? c.updateCheck?.latest ?? deps2.version };
+    });
+  } catch {
+    return;
+  }
+  if (latest && compareVersions(latest, deps2.version) > 0) {
+    io2.err(`A new qore is available: ${deps2.version} \u2192 ${latest}  npm i -g @quatronic/qore`);
+  }
+}
+
+// src/core/config.ts
+import { mkdir, readFile, rename, writeFile, chmod } from "fs/promises";
+import { join } from "path";
+import { randomBytes } from "crypto";
+var empty = () => ({ schemaVersion: 1, profiles: {} });
+var ConfigStore = class {
+  constructor(dir2) {
+    this.dir = dir2;
+  }
+  dir;
+  get file() {
+    return join(this.dir, "config.json");
+  }
+  async read() {
+    let raw;
+    try {
+      raw = await readFile(this.file, "utf8");
+    } catch (e) {
+      if (e.code === "ENOENT") return empty();
+      throw e;
+    }
+    try {
+      const parsed = JSON.parse(raw);
+      if (parsed.schemaVersion !== 1 || typeof parsed.profiles !== "object") throw new Error("shape");
+      return parsed;
+    } catch (cause) {
+      throw new QoreError("QORE_CONTEXT_INVALID", `Qore config is malformed: ${this.file}`, {
+        hint: "Fix or delete the file, then run `qore login` again",
+        cause
+      });
+    }
+  }
+  async update(fn) {
+    const current = await this.read();
+    const next = fn(current) ?? current;
+    await mkdir(this.dir, { recursive: true, mode: 448 });
+    const tmp = join(this.dir, `.config.${randomBytes(6).toString("hex")}.tmp`);
+    await writeFile(tmp, JSON.stringify(next, null, 2) + "\n", { mode: 384 });
+    await chmod(tmp, 384);
+    await rename(tmp, this.file);
+    return next;
+  }
+};
+
+// src/platform/keychain.ts
+import { Entry } from "@napi-rs/keyring";
+var SERVICE = "qore";
+var HINTS = {
+  linux: "Install and unlock a Secret Service provider (gnome-keyring or KWallet); headless machines and containers have none.",
+  darwin: "Unlock your login keychain in Keychain Access.",
+  win32: "Windows Credential Manager must be available for your user."
+};
+function classifyKeychainError(e, platform) {
+  const msg = e instanceof Error ? e.message : String(e);
+  if (/TooLong|longer than the platform limit/i.test(msg)) {
+    return new QoreError("QORE_KEYCHAIN_UNAVAILABLE", "The session token is too large for the OS keychain", {
+      hint: platform === "win32" ? "The token exceeds the Windows Credential Manager size limit. Report this to the Qore team." : "The token exceeds the keychain's size limit. Report this to the Qore team.",
+      cause: e
+    });
+  }
+  if (/cancel|denied|errSecAuthFailed|user interaction/i.test(msg)) {
+    return new QoreError("QORE_KEYCHAIN_DENIED", "Access to the OS keychain was denied", {
+      hint: "Allow qore to use the keychain when your OS asks, then retry.",
+      cause: e
+    });
+  }
+  return new QoreError("QORE_KEYCHAIN_UNAVAILABLE", "No usable OS keychain", {
+    hint: HINTS[platform] ?? "qore stores tokens only in the OS keychain.",
+    cause: e
+  });
+}
+var OsKeychain = class {
+  constructor(platform = process.platform) {
+    this.platform = platform;
+  }
+  platform;
+  wrap(fn) {
+    try {
+      return Promise.resolve(fn());
+    } catch (e) {
+      return Promise.reject(classifyKeychainError(e, this.platform));
+    }
+  }
+  get(account) {
+    return this.wrap(() => new Entry(SERVICE, account).getPassword() ?? null);
+  }
+  set(account, value) {
+    return this.wrap(() => {
+      new Entry(SERVICE, account).setPassword(value);
+    });
+  }
+  delete(account) {
+    return this.wrap(() => {
+      new Entry(SERVICE, account).deletePassword();
+    });
+  }
+};
+
+// src/platform/lock.ts
+import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
+import { join as join2 } from "path";
+import lockfile from "proper-lockfile";
+function fileLock(dir2) {
+  return async (name, fn) => {
+    const locks = join2(dir2, "locks");
+    await mkdir2(locks, { recursive: true, mode: 448 });
+    const target = join2(locks, `${name}.lock`);
+    await writeFile2(target, "", { flag: "a" });
+    let release;
+    let compromised;
+    try {
+      release = await lockfile.lock(target, {
+        stale: 3e4,
+        retries: { retries: 30, minTimeout: 100, maxTimeout: 1e3, randomize: true },
+        onCompromised: (err) => {
+          compromised = err;
+        }
+      });
+    } catch (cause) {
+      throw new QoreError("QORE_AUTH_BUSY", "Another qore process is refreshing the session", { hint: "Retry in a moment.", cause });
+    }
+    try {
+      return await fn();
+    } finally {
+      await release().catch((e) => {
+        if (!compromised) throw e;
+      });
+    }
+  };
+}
+
+// src/platform/paths.ts
+import { posix, win32 } from "path";
+function configDir(env, platform, home) {
+  if (platform === "win32") return win32.join(env.APPDATA ?? win32.join(home, "AppData", "Roaming"), "qore");
+  if (platform === "darwin") return posix.join(home, "Library", "Application Support", "qore");
+  const xdg = env.XDG_CONFIG_HOME && posix.isAbsolute(env.XDG_CONFIG_HOME) ? env.XDG_CONFIG_HOME : void 0;
+  return posix.join(xdg ?? posix.join(home, ".config"), "qore");
+}
+
+// src/version.ts
+var VERSION = true ? "0.1.0" : "0.0.0-dev";
+
+// src/cli.ts
+if (process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY) setGlobalDispatcher(new EnvHttpProxyAgent());
+var dir = configDir(process.env, process.platform, homedir());
+var argv = process.argv.slice(2);
+var json = argv.includes("--json");
+var ac = new AbortController();
+process.on("SIGINT", () => {
+  if (ac.signal.aborted) process.exit(130);
+  ac.abort();
+});
+var fetch = abortableFetch(globalThis.fetch, ac.signal);
+var deps = {
+  fetch,
+  keychain: new OsKeychain(),
+  config: new ConfigStore(dir),
+  withLock: fileLock(dir),
+  now: () => /* @__PURE__ */ new Date(),
+  oidcFor: (issuer) => createOidc({ issuer, clientId: "qore-cli", fetch }),
+  env: process.env,
+  platform: process.platform,
+  version: VERSION
+};
+var io = processIo(isInteractive({
+  stdinTTY: Boolean(process.stdin.isTTY),
+  stdoutTTY: Boolean(process.stdout.isTTY),
+  json,
+  noInput: argv.includes("--no-input"),
+  env: process.env
+}));
+process.exitCode = await run(argv, deps, io, ac.signal, COMMANDS);
+if (!ac.signal.aborted) {
+  try {
+    await maybeNotifyUpdate(deps, io, { json });
+  } catch {
+  }
+}
+//# sourceMappingURL=cli.js.map