@seliseblocks/cli-os 0.1.1 → 0.1.3

package/dist/lib/secret-store.d.ts

@@ -17,7 +17,6 @@ export declare function writeSecretStore(store: BlocksSecretStore): Promise<void
 export declare function setClientSecret(account: string, clientSecret: string): Promise<void>;
 export declare function getClientSecret(account: string): Promise<string | undefined>;
 export declare function removeAccountSecrets(account: string): Promise<void>;
-export declare function clearSecretStore(): Promise<void>;
 export declare function setSecretValue(key: string, value: string): Promise<void>;
 export declare function getSecretValue(key: string): Promise<string | undefined>;
 export declare function removeSecretValue(key: string): Promise<void>;

package/dist/lib/secret-store.js

@@ -1,5 +1,5 @@
 import { execFile, spawn } from "node:child_process";
-import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { platform } from "node:os";
 import { dirname, join } from "node:path";
 import { promisify } from "node:util";
@@ -57,9 +57,6 @@ export async function removeAccountSecrets(account) {
     await removeSecretValue(`client-secret:${account}`);
     await removeFallbackSecret(account);
 }
-export async function clearSecretStore() {
-    await rm(secretPath(), { force: true });
-}
 export async function setSecretValue(key, value) {
     const backend = await resolveBackend();
     if (backend === "macos-keychain") {

package/dist/lib/token-store.d.ts

@@ -15,4 +15,3 @@ export declare function tokenStoreInfo(): Promise<{
 export declare function readTokenStore(): Promise<BlocksTokenStore>;
 export declare function writeTokenStore(store: BlocksTokenStore): Promise<void>;
 export declare function removeAccountTokens(account: string): Promise<void>;
-export declare function clearTokenStore(): Promise<void>;

package/dist/lib/token-store.js

@@ -1,7 +1,7 @@
 import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { configDir, configPath } from "./config.js";
-import { getSecretValue, removeSecretValue, secretStoreInfo, setSecretValue } from "./secret-store.js";
+import { getSecretValue, secretStoreInfo, setSecretValue } from "./secret-store.js";
 const TOKEN_SECRET_KEY = "oauth-token-store";
 export function tokenPath() {
     return join(configDir(), "tokens.json");
@@ -56,10 +56,6 @@ export async function removeAccountTokens(account) {
     const { [account]: _, ...accounts } = store.accounts;
     await writeTokenStore({ accounts });
 }
-export async function clearTokenStore() {
-    await removeSecretValue(TOKEN_SECRET_KEY);
-    await rm(tokenPath(), { force: true });
-}
 function normalizeTokenStore(store) {
     return {
         accounts: store?.accounts ?? {}

package/dist/lib/token.d.ts

@@ -8,12 +8,14 @@ export type TokenResponse = {
     expires_in?: number;
     id_token?: string;
     refresh_token?: string;
+    refresh_expires_in?: number;
+    refresh_token_expires_in?: number;
     scope?: string;
     token_type?: string;
 };
-export declare function randomState(): string;
 export declare function expiresAtFromToken(response: TokenResponse, accessToken: string): string | undefined;
 export declare function expiresAtFromJwtFirst(response: TokenResponse, accessToken: string): string | undefined;
+export declare function refreshExpiresAtFromToken(response: TokenResponse, refreshToken?: string): string | undefined;
 export declare function isExpiring(expiresAt?: string): boolean;
 export declare function applyAccountToken(config: BlocksCliConfig, store: BlocksTokenStore, account: string, clientId: string, response: TokenResponse): {
     config: BlocksCliConfig;

package/dist/lib/token.js

@@ -1,9 +1,6 @@
-import { randomBytes } from "node:crypto";
 import { decodeJwtPayload, tenantFromToken } from "./jwt.js";
 const EXPIRY_SKEW_MS = 60_000;
-export function randomState() {
-    return randomBytes(24).toString("base64url");
-}
+const DEFAULT_REFRESH_TOKEN_LIFETIME_SECONDS = 30 * 60;
 export function expiresAtFromToken(response, accessToken) {
     if (typeof response.expires_in === "number" && response.expires_in > 0) {
         return new Date(Date.now() + response.expires_in * 1000).toISOString();
@@ -21,6 +18,26 @@ export function expiresAtFromJwtFirst(response, accessToken) {
     }
     return expiresAtFromToken(response, accessToken);
 }
+export function refreshExpiresAtFromToken(response, refreshToken) {
+    if (refreshToken) {
+        try {
+            const payload = decodeJwtPayload(refreshToken);
+            if (typeof payload.exp === "number") {
+                return new Date(payload.exp * 1000).toISOString();
+            }
+        }
+        catch {
+            // Opaque refresh tokens have no JWT payload; use server metadata or the configured lifetime.
+        }
+    }
+    const expiresIn = response.refresh_expires_in ?? response.refresh_token_expires_in;
+    if (typeof expiresIn === "number" && expiresIn > 0) {
+        return new Date(Date.now() + expiresIn * 1000).toISOString();
+    }
+    return refreshToken
+        ? new Date(Date.now() + DEFAULT_REFRESH_TOKEN_LIFETIME_SECONDS * 1000).toISOString()
+        : undefined;
+}
 export function isExpiring(expiresAt) {
     if (!expiresAt)
         return true;
@@ -34,12 +51,17 @@ export function applyAccountToken(config, store, account, clientId, response) {
     // rotate it (still valid, just not reissued) -- fall back to the previous
     // one instead of overwriting a working refresh token with undefined.
     const previousRefreshToken = store.accounts[account]?.account?.refreshToken;
+    const previousRefreshTokenExpiresAt = store.accounts[account]?.account?.refreshTokenExpiresAt;
+    const refreshToken = response.refresh_token ?? previousRefreshToken;
     const tokenSet = {
         accessToken: response.access_token,
         accountTenant: tenantFromToken(response.access_token),
-        expiresAt: expiresAtFromToken(response, response.access_token),
+        expiresAt: expiresAtFromJwtFirst(response, response.access_token),
         idToken: response.id_token,
-        refreshToken: response.refresh_token ?? previousRefreshToken,
+        refreshToken,
+        refreshTokenExpiresAt: response.refresh_token
+            ? refreshExpiresAtFromToken(response, response.refresh_token)
+            : previousRefreshTokenExpiresAt,
         scope: response.scope,
         tokenType: response.token_type ?? "Bearer"
     };
@@ -72,10 +94,15 @@ export function applyProjectToken(config, store, account, tenantId, response) {
         throw new Error(response.error_description ?? response.error ?? "Project token response did not include an access token");
     }
     const previousRefreshToken = store.accounts[account]?.projects?.[tenantId]?.refreshToken;
+    const previousRefreshTokenExpiresAt = store.accounts[account]?.projects?.[tenantId]?.refreshTokenExpiresAt;
+    const refreshToken = response.refresh_token ?? previousRefreshToken;
     const tokenSet = {
         accessToken: response.access_token,
         expiresAt: expiresAtFromJwtFirst(response, response.access_token),
-        refreshToken: response.refresh_token ?? previousRefreshToken,
+        refreshToken,
+        refreshTokenExpiresAt: response.refresh_token
+            ? refreshExpiresAtFromToken(response, response.refresh_token)
+            : previousRefreshTokenExpiresAt,
         scope: response.scope,
         tokenType: response.token_type ?? "Bearer"
     };

package/package.json

@@ -1,47 +1,47 @@
-{
-  "name": "@seliseblocks/cli-os",
-  "version": "0.1.1",
-  "description": "CLI for SELISE Blocks OS project setup and configuration.",
-  "license": "MIT",
-  "type": "module",
-  "bin": {
-    "blocks-os": "./bin/run.js"
-  },
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
-    },
-    "./package.json": "./package.json"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "sideEffects": false,
-  "files": [
-    "bin",
-    "dist",
-    "README.md",
-    "AI_USAGE_GUIDE.md",
-    "LICENSE"
-  ],
-  "scripts": {
-    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
-    "build": "npm run clean && tsc -p tsconfig.json",
-    "dev": "tsx src/index.ts",
-    "lint": "tsc -p tsconfig.json --noEmit",
-    "test": "npm run build && node --test test/*.test.mjs",
-    "prepack": "npm run build",
-    "prepublishOnly": "npm test"
-  },
-  "devDependencies": {
-    "@types/node": "^22.0.0",
-    "tsx": "^4.16.0",
-    "typescript": "^5.5.0"
-  },
-  "engines": {
-    "node": ">=20"
-  }
-}
+{
+  "name": "@seliseblocks/cli-os",
+  "version": "0.1.3",
+  "description": "CLI for SELISE Blocks OS project setup and configuration.",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "blocks-os": "bin/run.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "sideEffects": false,
+  "files": [
+    "bin",
+    "dist",
+    "README.md",
+    "AI_USAGE_GUIDE.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
+    "build": "npm run clean && tsc -p tsconfig.json",
+    "dev": "tsx src/index.ts",
+    "lint": "tsc -p tsconfig.json --noEmit",
+    "test": "npm run build && node --test test/*.test.mjs",
+    "prepack": "npm run build",
+    "prepublishOnly": "npm test"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "tsx": "^4.16.0",
+    "typescript": "^5.5.0"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}

package/dist/commands/auth/add.d.ts

@@ -1 +0,0 @@
-export declare function authAdd(argv: string[]): Promise<void>;

package/dist/commands/auth/add.js

@@ -1,51 +0,0 @@
-import { parseFlags, stringFlag } from "../../lib/args.js";
-import { defaults, normalizeAccountName, readConfig, writeConfig } from "../../lib/config.js";
-import { promptSecret, promptValue } from "../../lib/prompt.js";
-import { getClientSecret, setClientSecret } from "../../lib/secret-store.js";
-export async function authAdd(argv) {
-    const { args, flags } = parseFlags(argv);
-    const account = normalizeAccountName(args[0]);
-    const current = await readConfig();
-    const previous = current.accounts[account];
-    const now = new Date().toISOString();
-    const apiUrl = stringFlag(flags, "api-url") || previous?.apiUrl || defaults().apiUrl;
-    const oidcUrl = stringFlag(flags, "oidc-url") || previous?.oidcUrl || defaults().oidcUrl;
-    const osUrl = stringFlag(flags, "os-url") || defaults().osUrl;
-    const clientId = await value(flags, "client-id", "OIDC client id", previous?.clientId);
-    const existingSecret = await getClientSecret(account);
-    const clientSecret = await value(flags, "client-secret", "OIDC client secret", existingSecret, true);
-    const scope = stringFlag(flags, "scope") || previous?.scope || defaults().scope;
-    const redirectUri = stringFlag(flags, "redirect-uri") || previous?.redirectUri || defaults().redirectUri;
-    const rootTenantId = optionalStringFlag(flags, "root-tenant") ?? previous?.rootTenantId ?? defaults().rootTenantId;
-    await writeConfig({
-        ...current,
-        activeAccount: current.activeAccount ?? account,
-        accounts: {
-            ...current.accounts,
-            [account]: {
-                apiUrl,
-                clientId,
-                createdAt: previous?.createdAt ?? now,
-                oidcUrl,
-                osUrl,
-                redirectUri,
-                rootTenantId,
-                scope,
-                updatedAt: now
-            }
-        }
-    });
-    await setClientSecret(account, clientSecret);
-    console.log(`Saved OIDC account '${account}'.`);
-}
-async function value(flags, name, label, defaultValue, secret = false) {
-    const flag = stringFlag(flags, name);
-    const resolved = flag || await (secret ? promptSecret(label, defaultValue) : promptValue(label, defaultValue));
-    if (!resolved)
-        throw new Error(`Missing --${name}`);
-    return resolved;
-}
-function optionalStringFlag(flags, name) {
-    const value = flags[name];
-    return typeof value === "string" && value ? value : undefined;
-}

package/dist/commands/auth/list.d.ts

@@ -1 +0,0 @@
-export declare function authList(argv?: string[]): Promise<void>;

package/dist/commands/auth/list.js

@@ -1,33 +0,0 @@
-import { parseFlags } from "../../lib/args.js";
-import { readConfig } from "../../lib/config.js";
-import { writeOutput } from "../../lib/output.js";
-export async function authList(argv = []) {
-    const { flags } = parseFlags(argv);
-    const config = await readConfig();
-    const names = Object.keys(config.accounts);
-    if (names.length === 0) {
-        if (flags.json) {
-            writeOutput({ activeAccount: config.activeAccount ?? null, accounts: [] }, flags);
-            return;
-        }
-        console.log("No OIDC accounts configured.");
-        return;
-    }
-    if (flags.json) {
-        writeOutput({
-            activeAccount: config.activeAccount ?? null,
-            accounts: names.map((name) => ({
-                name,
-                active: config.activeAccount === name,
-                apiUrl: config.accounts[name].apiUrl,
-                oidcUrl: config.accounts[name].oidcUrl
-            }))
-        }, flags);
-        return;
-    }
-    for (const name of names) {
-        const profile = config.accounts[name];
-        const active = config.activeAccount === name ? "*" : " ";
-        console.log(`${active} ${name}  ${profile.apiUrl}  ${profile.oidcUrl}`);
-    }
-}

package/dist/commands/auth/repair.d.ts

@@ -1 +0,0 @@
-export declare function authRepair(argv: string[]): Promise<void>;

package/dist/commands/auth/repair.js

@@ -1,39 +0,0 @@
-import { booleanFlag, parseFlags } from "../../lib/args.js";
-import { confirmMutation } from "../../lib/confirm.js";
-import { getAccountProfile, normalizeAccountName, readConfig } from "../../lib/config.js";
-import { writeOutput } from "../../lib/output.js";
-import { removeAccountSecrets } from "../../lib/secret-store.js";
-import { clearTokenStore } from "../../lib/token-store.js";
-export async function authRepair(argv) {
-    const { args, flags } = parseFlags(argv);
-    const config = await readConfig();
-    const account = args[0] ? normalizeAccountName(args[0]) : getAccountProfile(config).name;
-    if (!config.accounts[account]) {
-        throw new Error(`OIDC account '${account}' is not configured.`);
-    }
-    const result = {
-        account,
-        clearedClientSecret: true,
-        clearedTokenCache: "all accounts",
-        nextSteps: [
-            ["blocks-os auth:add", account === "default" ? "" : account, "--client-id <id>", "--client-secret <secret>"].filter(Boolean).join(" "),
-            `blocks-os login${account === "default" ? "" : ` --account ${account}`}`
-        ]
-    };
-    if (booleanFlag(flags, "dry-run")) {
-        writeOutput({ dryRun: true, ...result }, flags);
-        return;
-    }
-    await confirmMutation(flags, `Repair local auth state for '${account}'. This clears the account client secret and all cached OAuth tokens, but keeps account profile config.`);
-    await removeAccountSecrets(account);
-    await clearTokenStore();
-    if (flags.json) {
-        writeOutput(result, flags);
-        return;
-    }
-    console.log(`Repaired local auth state for '${account}'.`);
-    console.log("Client secret and cached OAuth tokens were cleared.");
-    console.log("Next:");
-    for (const step of result.nextSteps)
-        console.log(`  ${step}`);
-}

package/dist/commands/auth/show.d.ts

@@ -1 +0,0 @@
-export declare function authShow(argv: string[]): Promise<void>;

package/dist/commands/auth/show.js

@@ -1,23 +0,0 @@
-import { parseFlags, stringFlag } from "../../lib/args.js";
-import { getAccountProfile, readConfig } from "../../lib/config.js";
-import { getClientSecret, secretStoreInfo } from "../../lib/secret-store.js";
-export async function authShow(argv) {
-    const { args, flags } = parseFlags(argv);
-    const config = await readConfig();
-    const account = args[0] || stringFlag(flags, "account") || config.activeAccount;
-    const { name, profile } = getAccountProfile(config, account);
-    const secretInfo = await secretStoreInfo();
-    console.log(JSON.stringify({
-        account: name,
-        active: config.activeAccount === name,
-        apiUrl: profile.apiUrl,
-        clientId: profile.clientId,
-        clientSecret: await getClientSecret(name) ? "configured" : "missing",
-        secretStorage: secretInfo,
-        oidcUrl: profile.oidcUrl,
-        osUrl: profile.osUrl,
-        redirectUri: profile.redirectUri,
-        rootTenantId: profile.rootTenantId,
-        scope: profile.scope
-    }, null, 2));
-}

package/dist/commands/auth/use.d.ts

@@ -1 +0,0 @@
-export declare function authUse(argv: string[]): Promise<void>;

package/dist/commands/auth/use.js

@@ -1,15 +0,0 @@
-import { parseFlags } from "../../lib/args.js";
-import { normalizeAccountName, readConfig, writeConfig } from "../../lib/config.js";
-export async function authUse(argv) {
-    const { args } = parseFlags(argv);
-    const account = normalizeAccountName(args[0]);
-    const config = await readConfig();
-    if (!config.accounts[account]) {
-        throw new Error("OIDC account is not configured. Run 'blocks-os auth:add --client-id <id> --client-secret <secret>' first.");
-    }
-    await writeConfig({
-        ...config,
-        activeAccount: account
-    });
-    console.log(`Active account is now '${account}'.`);
-}

package/dist/commands/login-device.d.ts

@@ -1 +0,0 @@
-export declare function loginDevice(argv: string[]): Promise<void>;

package/dist/commands/login-device.js

@@ -1,6 +0,0 @@
-import { parseFlags, stringFlag } from "../lib/args.js";
-import { loginWithDeviceProfile } from "./login.js";
-export async function loginDevice(argv) {
-    const { flags } = parseFlags(argv);
-    await loginWithDeviceProfile(stringFlag(flags, "account"));
-}

package/dist/lib/login-server.d.ts

@@ -1 +0,0 @@
-export declare function waitForAuthorizationCode(port: number, expectedState?: string): Promise<string>;

package/dist/lib/login-server.js

@@ -1,43 +0,0 @@
-import { createServer } from "node:http";
-export async function waitForAuthorizationCode(port, expectedState) {
-    return new Promise((resolve, reject) => {
-        const server = createServer((request, response) => {
-            const url = new URL(request.url ?? "/", `http://127.0.0.1:${port}`);
-            if (url.pathname !== "/callback") {
-                response.writeHead(404);
-                response.end("Not found");
-                return;
-            }
-            const error = url.searchParams.get("error");
-            const code = url.searchParams.get("code");
-            const state = url.searchParams.get("state");
-            if (error) {
-                response.writeHead(400, { "Content-Type": "text/plain" });
-                response.end(`Blocks OS login failed: ${error}`);
-                server.close();
-                reject(new Error(error));
-                return;
-            }
-            if (expectedState && state !== expectedState) {
-                response.writeHead(400, { "Content-Type": "text/plain" });
-                response.end("Blocks OS login failed: invalid state");
-                server.close();
-                reject(new Error("Invalid authorization state"));
-                return;
-            }
-            if (!code) {
-                response.writeHead(400, { "Content-Type": "text/plain" });
-                response.end("Blocks OS login failed: missing code");
-                server.close();
-                reject(new Error("Missing authorization code"));
-                return;
-            }
-            response.writeHead(200, { "Content-Type": "text/plain" });
-            response.end("Blocks OS login complete. You can close this tab.");
-            server.close();
-            resolve(code);
-        });
-        server.on("error", reject);
-        server.listen(port, "127.0.0.1");
-    });
-}

package/dist/lib/pkce.d.ts

@@ -1,4 +0,0 @@
-export declare function createPkcePair(): {
-    challenge: string;
-    verifier: string;
-};

package/dist/lib/pkce.js

@@ -1,9 +0,0 @@
-import { createHash, randomBytes } from "node:crypto";
-function base64Url(input) {
-    return input.toString("base64").replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
-}
-export function createPkcePair() {
-    const verifier = base64Url(randomBytes(32));
-    const challenge = base64Url(createHash("sha256").update(verifier).digest());
-    return { challenge, verifier };
-}

package/dist/lib/prompt.d.ts

@@ -1,2 +0,0 @@
-export declare function promptValue(label: string, defaultValue?: string): Promise<string>;
-export declare function promptSecret(label: string, defaultValue?: string): Promise<string>;

package/dist/lib/prompt.js

@@ -1,36 +0,0 @@
-import { createInterface } from "node:readline";
-import { createInterface as createPromiseInterface } from "node:readline/promises";
-import { stdin as input, stdout as output } from "node:process";
-export async function promptValue(label, defaultValue) {
-    const rl = createPromiseInterface({ input, output });
-    try {
-        const suffix = defaultValue ? ` (${defaultValue})` : "";
-        const answer = await rl.question(`${label}${suffix}: `);
-        return answer.trim() || defaultValue || "";
-    }
-    finally {
-        rl.close();
-    }
-}
-export async function promptSecret(label, defaultValue) {
-    if (!input.isTTY || !output.isTTY)
-        return promptValue(label, defaultValue);
-    return new Promise((resolve) => {
-        const rl = createInterface({ input, output, terminal: true });
-        const muted = rl;
-        muted._writeToOutput = (value) => {
-            if (value === "\r\n" || value === "\n" || value === "\r") {
-                output.write(value);
-                return;
-            }
-            output.write("*".repeat(value.length));
-        };
-        const suffix = defaultValue ? " (configured, press Enter to keep)" : "";
-        output.write(`${label}${suffix}: `);
-        rl.question("", (answer) => {
-            rl.close();
-            output.write("\n");
-            resolve(answer.trim() || defaultValue || "");
-        });
-    });
-}