@undefineds.co/xpod 0.1.7 → 0.2.0

package/dist/api/store/DrizzleClientCredentialsStore.d.ts

@@ -2,10 +2,6 @@ import type { IdentityDatabase } from '../../identity/drizzle/db';
 import type { ClientCredentialsRecord, ClientCredentialsStore } from '../auth/ClientCredentialsAuthenticator';
 export interface DrizzleClientCredentialsStoreOptions {
     db: IdentityDatabase;
-    /**
-     * Encryption key for storing client secrets
-     */
-    encryptionKey: string;
     /**
      * Whether using SQLite (default: false for PostgreSQL)
      */
@@ -13,19 +9,20 @@ export interface DrizzleClientCredentialsStoreOptions {
 }
 /**
  * Storage for API Keys (client credentials) using Drizzle ORM
+ *
+ * Only stores clientId → webId/accountId mapping.
+ * The actual clientSecret lives in the sk-xxx token and is never persisted.
  */
 export declare class DrizzleClientCredentialsStore implements ClientCredentialsStore {
     private readonly logger;
     private readonly db;
-    private readonly encryptionKey;
     private readonly apiClientCredentials;
     constructor(options: DrizzleClientCredentialsStoreOptions);
     /**
-     * Store client credentials (called when user creates API Key via frontend)
+     * Store API Key registration (called when user creates API Key via frontend)
      */
     store(options: {
         clientId: string;
-        clientSecret: string;
         webId: string;
         accountId: string;
         displayName?: string;
@@ -35,7 +32,7 @@ export declare class DrizzleClientCredentialsStore implements ClientCredentialsS
      */
     findByClientId(clientId: string): Promise<ClientCredentialsRecord | undefined>;
     /**
-     * List API Keys for an account (without secrets)
+     * List API Keys for an account
      */
     listByAccount(accountId: string): Promise<Array<{
         clientId: string;
@@ -44,13 +41,11 @@ export declare class DrizzleClientCredentialsStore implements ClientCredentialsS
         createdAt: Date;
     }>>;
     /**
-     * Find the most recently created API Key for an account (including secret).
+     * Find the most recently created API Key for an account.
      */
     findByAccountId(accountId: string): Promise<ClientCredentialsRecord | undefined>;
     /**
      * Delete an API Key
      */
     delete(clientId: string, accountId?: string): Promise<boolean>;
-    private encrypt;
-    private decrypt;
 }

package/dist/api/store/DrizzleClientCredentialsStore.js

@@ -1,32 +1,30 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DrizzleClientCredentialsStore = void 0;
-const node_crypto_1 = require("node:crypto");
 const drizzle_orm_1 = require("drizzle-orm");
 const global_logger_factory_1 = require("global-logger-factory");
 const schema_pg_1 = require("../../identity/drizzle/schema.pg");
 const schema_sqlite_1 = require("../../identity/drizzle/schema.sqlite");
 /**
  * Storage for API Keys (client credentials) using Drizzle ORM
+ *
+ * Only stores clientId → webId/accountId mapping.
+ * The actual clientSecret lives in the sk-xxx token and is never persisted.
  */
 class DrizzleClientCredentialsStore {
     constructor(options) {
         this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
         this.db = options.db;
-        this.encryptionKey = (0, node_crypto_1.scryptSync)(options.encryptionKey, 'xpod-api-salt', 32);
-        // Select appropriate schema based on database type
         this.apiClientCredentials = options.isSqlite ? schema_sqlite_1.apiClientCredentials : schema_pg_1.apiClientCredentials;
     }
     /**
-     * Store client credentials (called when user creates API Key via frontend)
+     * Store API Key registration (called when user creates API Key via frontend)
      */
     async store(options) {
-        const encryptedSecret = this.encrypt(options.clientSecret);
         await this.db
             .insert(this.apiClientCredentials)
             .values({
             clientId: options.clientId,
-            clientSecretEncrypted: encryptedSecret,
             webId: options.webId,
             accountId: options.accountId,
             displayName: options.displayName ?? null,
@@ -34,7 +32,6 @@ class DrizzleClientCredentialsStore {
             .onConflictDoUpdate({
             target: this.apiClientCredentials.clientId,
             set: {
-                clientSecretEncrypted: encryptedSecret,
                 displayName: options.displayName ?? null,
             },
         });
@@ -55,7 +52,6 @@ class DrizzleClientCredentialsStore {
         const row = rows[0];
         return {
             clientId: row.clientId,
-            clientSecret: this.decrypt(row.clientSecretEncrypted),
             webId: row.webId,
             accountId: row.accountId,
             displayName: row.displayName ?? undefined,
@@ -63,7 +59,7 @@ class DrizzleClientCredentialsStore {
         };
     }
     /**
-     * List API Keys for an account (without secrets)
+     * List API Keys for an account
      */
     async listByAccount(accountId) {
         const rows = await this.db
@@ -84,7 +80,7 @@ class DrizzleClientCredentialsStore {
         }));
     }
     /**
-     * Find the most recently created API Key for an account (including secret).
+     * Find the most recently created API Key for an account.
      */
     async findByAccountId(accountId) {
         const rows = await this.db
@@ -99,7 +95,6 @@ class DrizzleClientCredentialsStore {
         const row = rows[0];
         return {
             clientId: row.clientId,
-            clientSecret: this.decrypt(row.clientSecretEncrypted),
             webId: row.webId,
             accountId: row.accountId,
             displayName: row.displayName ?? undefined,
@@ -110,36 +105,11 @@ class DrizzleClientCredentialsStore {
      * Delete an API Key
      */
     async delete(clientId, accountId) {
-        if (accountId) {
-            const result = await this.db
-                .delete(this.apiClientCredentials)
-                .where((0, drizzle_orm_1.eq)(this.apiClientCredentials.clientId, clientId));
-            // Check if the deleted row belonged to the account
-            // For safety, we could add an AND condition, but Drizzle doesn't support multiple where easily
-            // So we trust the caller to verify ownership before calling delete
-        }
-        else {
-            await this.db
-                .delete(this.apiClientCredentials)
-                .where((0, drizzle_orm_1.eq)(this.apiClientCredentials.clientId, clientId));
-        }
+        await this.db
+            .delete(this.apiClientCredentials)
+            .where((0, drizzle_orm_1.eq)(this.apiClientCredentials.clientId, clientId));
         return true;
     }
-    encrypt(plaintext) {
-        const iv = (0, node_crypto_1.randomBytes)(16);
-        const cipher = (0, node_crypto_1.createCipheriv)('aes-256-cbc', this.encryptionKey, iv);
-        let encrypted = cipher.update(plaintext, 'utf8', 'hex');
-        encrypted += cipher.final('hex');
-        return iv.toString('hex') + ':' + encrypted;
-    }
-    decrypt(ciphertext) {
-        const [ivHex, encrypted] = ciphertext.split(':');
-        const iv = Buffer.from(ivHex, 'hex');
-        const decipher = (0, node_crypto_1.createDecipheriv)('aes-256-cbc', this.encryptionKey, iv);
-        let decrypted = decipher.update(encrypted, 'hex', 'utf8');
-        decrypted += decipher.final('utf8');
-        return decrypted;
-    }
 }
 exports.DrizzleClientCredentialsStore = DrizzleClientCredentialsStore;
 //# sourceMappingURL=DrizzleClientCredentialsStore.js.map

package/dist/api/store/DrizzleClientCredentialsStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"DrizzleClientCredentialsStore.js","sourceRoot":"","sources":["../../../src/api/store/DrizzleClientCredentialsStore.ts"],"names":[],"mappings":";;;AAAA,6CAAwF;AACxF,6CAAsC;AACtC,iEAAqD;AAErD,gEAAkG;AAClG,wEAA0G;AAe1G;;GAEG;AACH,MAAa,6BAA6B;IAMxC,YAAmB,OAA6C;QAL/C,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAM3C,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,aAAa,GAAG,IAAA,wBAAU,EAAC,OAAO,CAAC,aAAa,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC5E,mDAAmD;QACnD,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,oCAA0B,CAAC,CAAC,CAAC,gCAAsB,CAAC;IACrG,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,KAAK,CAAC,OAMlB;QACC,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAE3D,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC;aACjC,MAAM,CAAC;YACN,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,qBAAqB,EAAE,eAAe;YACtC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;SACzC,CAAC;aACD,kBAAkB,CAAC;YAClB,MAAM,EAAE,IAAI,CAAC,oBAAoB,CAAC,QAAQ;YAC1C,GAAG,EAAE;gBACH,qBAAqB,EAAE,eAAe;gBACtC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;aACzC;SACF,CAAC,CAAC;QAEL,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,cAAc,CAAC,QAAgB;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,EAAE;aACR,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC;aAC/B,KAAK,CAAC,IAAA,gBAAE,EAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;aACvD,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO;YACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YACrD,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,SAAS;YACzC,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC;IACJ,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,aAAa,CAAC,SAAiB;QAM1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,CAAC;YACN,QAAQ,EAAE,IAAI,CAAC,oBAAoB,CAAC,QAAQ;YAC5C,KAAK,EAAE,IAAI,CAAC,oBAAoB,CAAC,KAAK;YACtC,WAAW,EAAE,IAAI,CAAC,oBAAoB,CAAC,WAAW;YAClD,SAAS,EAAE,IAAI,CAAC,oBAAoB,CAAC,SAAS;SAC/C,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC;aAC/B,KAAK,CAAC,IAAA,gBAAE,EAAC,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;aACzD,OAAO,CAAC,IAAA,iBAAG,EAAA,GAAG,IAAI,CAAC,oBAAoB,CAAC,SAAS,OAAO,CAAC,CAAC;QAE7D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAwB,EAAE,EAAE,CAAC,CAAC;YAC7C,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,SAAS;YACzC,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,eAAe,CAAC,SAAiB;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,EAAE;aACR,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC;aAC/B,KAAK,CAAC,IAAA,gBAAE,EAAC,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;aACzD,OAAO,CAAC,IAAA,iBAAG,EAAA,GAAG,IAAI,CAAC,oBAAoB,CAAC,SAAS,OAAO,CAAC;aACzD,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO;YACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YACrD,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,SAAS;YACzC,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC;IACJ,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,SAAkB;QACtD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;iBACzB,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC;iBACjC,KAAK,CAAC,IAAA,gBAAE,EAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC3D,mDAAmD;YACnD,+FAA+F;YAC/F,mEAAmE;QACrE,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,EAAE;iBACV,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC;iBACjC,KAAK,CAAC,IAAA,gBAAE,EAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,OAAO,CAAC,SAAiB;QAC/B,MAAM,EAAE,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACxD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,SAAS,CAAC;IAC9C,CAAC;IAEO,OAAO,CAAC,UAAkB;QAChC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAA,8BAAgB,EAAC,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1D,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AA/JD,sEA+JC","sourcesContent":["import { randomBytes, createCipheriv, createDecipheriv, scryptSync } from 'node:crypto';\nimport { eq, sql } from 'drizzle-orm';\nimport { getLoggerFor } from 'global-logger-factory';\nimport type { IdentityDatabase } from '../../identity/drizzle/db';\nimport { apiClientCredentials as pgApiClientCredentials } from '../../identity/drizzle/schema.pg';\nimport { apiClientCredentials as sqliteApiClientCredentials } from '../../identity/drizzle/schema.sqlite';\nimport type { ClientCredentialsRecord, ClientCredentialsStore } from '../auth/ClientCredentialsAuthenticator';\n\nexport interface DrizzleClientCredentialsStoreOptions {\n  db: IdentityDatabase;\n  /**\n   * Encryption key for storing client secrets\n   */\n  encryptionKey: string;\n  /**\n   * Whether using SQLite (default: false for PostgreSQL)\n   */\n  isSqlite?: boolean;\n}\n\n/**\n * Storage for API Keys (client credentials) using Drizzle ORM\n */\nexport class DrizzleClientCredentialsStore implements ClientCredentialsStore {\n  private readonly logger = getLoggerFor(this);\n  private readonly db: IdentityDatabase;\n  private readonly encryptionKey: Buffer;\n  private readonly apiClientCredentials: typeof pgApiClientCredentials | typeof sqliteApiClientCredentials;\n\n  public constructor(options: DrizzleClientCredentialsStoreOptions) {\n    this.db = options.db;\n    this.encryptionKey = scryptSync(options.encryptionKey, 'xpod-api-salt', 32);\n    // Select appropriate schema based on database type\n    this.apiClientCredentials = options.isSqlite ? sqliteApiClientCredentials : pgApiClientCredentials;\n  }\n\n  /**\n   * Store client credentials (called when user creates API Key via frontend)\n   */\n  public async store(options: {\n    clientId: string;\n    clientSecret: string;\n    webId: string;\n    accountId: string;\n    displayName?: string;\n  }): Promise<void> {\n    const encryptedSecret = this.encrypt(options.clientSecret);\n\n    await this.db\n      .insert(this.apiClientCredentials)\n      .values({\n        clientId: options.clientId,\n        clientSecretEncrypted: encryptedSecret,\n        webId: options.webId,\n        accountId: options.accountId,\n        displayName: options.displayName ?? null,\n      })\n      .onConflictDoUpdate({\n        target: this.apiClientCredentials.clientId,\n        set: {\n          clientSecretEncrypted: encryptedSecret,\n          displayName: options.displayName ?? null,\n        },\n      });\n\n    this.logger.info(`Stored API Key: ${options.clientId}`);\n  }\n\n  /**\n   * Find by client_id (the \"API Key\")\n   */\n  public async findByClientId(clientId: string): Promise<ClientCredentialsRecord | undefined> {\n    const rows = await this.db\n      .select()\n      .from(this.apiClientCredentials)\n      .where(eq(this.apiClientCredentials.clientId, clientId))\n      .limit(1);\n\n    if (rows.length === 0) {\n      return undefined;\n    }\n\n    const row = rows[0];\n    return {\n      clientId: row.clientId,\n      clientSecret: this.decrypt(row.clientSecretEncrypted),\n      webId: row.webId,\n      accountId: row.accountId,\n      displayName: row.displayName ?? undefined,\n      createdAt: row.createdAt,\n    };\n  }\n\n  /**\n   * List API Keys for an account (without secrets)\n   */\n  public async listByAccount(accountId: string): Promise<Array<{\n    clientId: string;\n    webId: string;\n    displayName?: string;\n    createdAt: Date;\n  }>> {\n    const rows = await this.db\n      .select({\n        clientId: this.apiClientCredentials.clientId,\n        webId: this.apiClientCredentials.webId,\n        displayName: this.apiClientCredentials.displayName,\n        createdAt: this.apiClientCredentials.createdAt,\n      })\n      .from(this.apiClientCredentials)\n      .where(eq(this.apiClientCredentials.accountId, accountId))\n      .orderBy(sql`${this.apiClientCredentials.createdAt} DESC`);\n\n    return rows.map((row: typeof rows[number]) => ({\n      clientId: row.clientId,\n      webId: row.webId,\n      displayName: row.displayName ?? undefined,\n      createdAt: row.createdAt,\n    }));\n  }\n\n  /**\n   * Find the most recently created API Key for an account (including secret).\n   */\n  public async findByAccountId(accountId: string): Promise<ClientCredentialsRecord | undefined> {\n    const rows = await this.db\n      .select()\n      .from(this.apiClientCredentials)\n      .where(eq(this.apiClientCredentials.accountId, accountId))\n      .orderBy(sql`${this.apiClientCredentials.createdAt} DESC`)\n      .limit(1);\n\n    if (rows.length === 0) {\n      return undefined;\n    }\n\n    const row = rows[0];\n    return {\n      clientId: row.clientId,\n      clientSecret: this.decrypt(row.clientSecretEncrypted),\n      webId: row.webId,\n      accountId: row.accountId,\n      displayName: row.displayName ?? undefined,\n      createdAt: row.createdAt,\n    };\n  }\n\n  /**\n   * Delete an API Key\n   */\n  public async delete(clientId: string, accountId?: string): Promise<boolean> {\n    if (accountId) {\n      const result = await this.db\n        .delete(this.apiClientCredentials)\n        .where(eq(this.apiClientCredentials.clientId, clientId));\n      // Check if the deleted row belonged to the account\n      // For safety, we could add an AND condition, but Drizzle doesn't support multiple where easily\n      // So we trust the caller to verify ownership before calling delete\n    } else {\n      await this.db\n        .delete(this.apiClientCredentials)\n        .where(eq(this.apiClientCredentials.clientId, clientId));\n    }\n    return true;\n  }\n\n  private encrypt(plaintext: string): string {\n    const iv = randomBytes(16);\n    const cipher = createCipheriv('aes-256-cbc', this.encryptionKey, iv);\n    let encrypted = cipher.update(plaintext, 'utf8', 'hex');\n    encrypted += cipher.final('hex');\n    return iv.toString('hex') + ':' + encrypted;\n  }\n\n  private decrypt(ciphertext: string): string {\n    const [ivHex, encrypted] = ciphertext.split(':');\n    const iv = Buffer.from(ivHex, 'hex');\n    const decipher = createDecipheriv('aes-256-cbc', this.encryptionKey, iv);\n    let decrypted = decipher.update(encrypted, 'hex', 'utf8');\n    decrypted += decipher.final('utf8');\n    return decrypted;\n  }\n}\n"]}
+{"version":3,"file":"DrizzleClientCredentialsStore.js","sourceRoot":"","sources":["../../../src/api/store/DrizzleClientCredentialsStore.ts"],"names":[],"mappings":";;;AAAA,6CAAsC;AACtC,iEAAqD;AAErD,gEAAkG;AAClG,wEAA0G;AAW1G;;;;;GAKG;AACH,MAAa,6BAA6B;IAKxC,YAAmB,OAA6C;QAJ/C,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAK3C,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,oCAA0B,CAAC,CAAC,CAAC,gCAAsB,CAAC;IACrG,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,KAAK,CAAC,OAKlB;QACC,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC;aACjC,MAAM,CAAC;YACN,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;SACzC,CAAC;aACD,kBAAkB,CAAC;YAClB,MAAM,EAAE,IAAI,CAAC,oBAAoB,CAAC,QAAQ;YAC1C,GAAG,EAAE;gBACH,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;aACzC;SACF,CAAC,CAAC;QAEL,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,cAAc,CAAC,QAAgB;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,EAAE;aACR,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC;aAC/B,KAAK,CAAC,IAAA,gBAAE,EAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;aACvD,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO;YACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,SAAS;YACzC,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC;IACJ,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,aAAa,CAAC,SAAiB;QAM1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,CAAC;YACN,QAAQ,EAAE,IAAI,CAAC,oBAAoB,CAAC,QAAQ;YAC5C,KAAK,EAAE,IAAI,CAAC,oBAAoB,CAAC,KAAK;YACtC,WAAW,EAAE,IAAI,CAAC,oBAAoB,CAAC,WAAW;YAClD,SAAS,EAAE,IAAI,CAAC,oBAAoB,CAAC,SAAS;SAC/C,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC;aAC/B,KAAK,CAAC,IAAA,gBAAE,EAAC,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;aACzD,OAAO,CAAC,IAAA,iBAAG,EAAA,GAAG,IAAI,CAAC,oBAAoB,CAAC,SAAS,OAAO,CAAC,CAAC;QAE7D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAwB,EAAE,EAAE,CAAC,CAAC;YAC7C,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,SAAS;YACzC,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,eAAe,CAAC,SAAiB;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,EAAE;aACR,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC;aAC/B,KAAK,CAAC,IAAA,gBAAE,EAAC,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;aACzD,OAAO,CAAC,IAAA,iBAAG,EAAA,GAAG,IAAI,CAAC,oBAAoB,CAAC,SAAS,OAAO,CAAC;aACzD,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO;YACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,SAAS;YACzC,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC;IACJ,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,SAAkB;QACtD,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC;aACjC,KAAK,CAAC,IAAA,gBAAE,EAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AA3HD,sEA2HC","sourcesContent":["import { eq, sql } from 'drizzle-orm';\nimport { getLoggerFor } from 'global-logger-factory';\nimport type { IdentityDatabase } from '../../identity/drizzle/db';\nimport { apiClientCredentials as pgApiClientCredentials } from '../../identity/drizzle/schema.pg';\nimport { apiClientCredentials as sqliteApiClientCredentials } from '../../identity/drizzle/schema.sqlite';\nimport type { ClientCredentialsRecord, ClientCredentialsStore } from '../auth/ClientCredentialsAuthenticator';\n\nexport interface DrizzleClientCredentialsStoreOptions {\n  db: IdentityDatabase;\n  /**\n   * Whether using SQLite (default: false for PostgreSQL)\n   */\n  isSqlite?: boolean;\n}\n\n/**\n * Storage for API Keys (client credentials) using Drizzle ORM\n *\n * Only stores clientId → webId/accountId mapping.\n * The actual clientSecret lives in the sk-xxx token and is never persisted.\n */\nexport class DrizzleClientCredentialsStore implements ClientCredentialsStore {\n  private readonly logger = getLoggerFor(this);\n  private readonly db: IdentityDatabase;\n  private readonly apiClientCredentials: typeof pgApiClientCredentials | typeof sqliteApiClientCredentials;\n\n  public constructor(options: DrizzleClientCredentialsStoreOptions) {\n    this.db = options.db;\n    this.apiClientCredentials = options.isSqlite ? sqliteApiClientCredentials : pgApiClientCredentials;\n  }\n\n  /**\n   * Store API Key registration (called when user creates API Key via frontend)\n   */\n  public async store(options: {\n    clientId: string;\n    webId: string;\n    accountId: string;\n    displayName?: string;\n  }): Promise<void> {\n    await this.db\n      .insert(this.apiClientCredentials)\n      .values({\n        clientId: options.clientId,\n        webId: options.webId,\n        accountId: options.accountId,\n        displayName: options.displayName ?? null,\n      })\n      .onConflictDoUpdate({\n        target: this.apiClientCredentials.clientId,\n        set: {\n          displayName: options.displayName ?? null,\n        },\n      });\n\n    this.logger.info(`Stored API Key: ${options.clientId}`);\n  }\n\n  /**\n   * Find by client_id (the \"API Key\")\n   */\n  public async findByClientId(clientId: string): Promise<ClientCredentialsRecord | undefined> {\n    const rows = await this.db\n      .select()\n      .from(this.apiClientCredentials)\n      .where(eq(this.apiClientCredentials.clientId, clientId))\n      .limit(1);\n\n    if (rows.length === 0) {\n      return undefined;\n    }\n\n    const row = rows[0];\n    return {\n      clientId: row.clientId,\n      webId: row.webId,\n      accountId: row.accountId,\n      displayName: row.displayName ?? undefined,\n      createdAt: row.createdAt,\n    };\n  }\n\n  /**\n   * List API Keys for an account\n   */\n  public async listByAccount(accountId: string): Promise<Array<{\n    clientId: string;\n    webId: string;\n    displayName?: string;\n    createdAt: Date;\n  }>> {\n    const rows = await this.db\n      .select({\n        clientId: this.apiClientCredentials.clientId,\n        webId: this.apiClientCredentials.webId,\n        displayName: this.apiClientCredentials.displayName,\n        createdAt: this.apiClientCredentials.createdAt,\n      })\n      .from(this.apiClientCredentials)\n      .where(eq(this.apiClientCredentials.accountId, accountId))\n      .orderBy(sql`${this.apiClientCredentials.createdAt} DESC`);\n\n    return rows.map((row: typeof rows[number]) => ({\n      clientId: row.clientId,\n      webId: row.webId,\n      displayName: row.displayName ?? undefined,\n      createdAt: row.createdAt,\n    }));\n  }\n\n  /**\n   * Find the most recently created API Key for an account.\n   */\n  public async findByAccountId(accountId: string): Promise<ClientCredentialsRecord | undefined> {\n    const rows = await this.db\n      .select()\n      .from(this.apiClientCredentials)\n      .where(eq(this.apiClientCredentials.accountId, accountId))\n      .orderBy(sql`${this.apiClientCredentials.createdAt} DESC`)\n      .limit(1);\n\n    if (rows.length === 0) {\n      return undefined;\n    }\n\n    const row = rows[0];\n    return {\n      clientId: row.clientId,\n      webId: row.webId,\n      accountId: row.accountId,\n      displayName: row.displayName ?? undefined,\n      createdAt: row.createdAt,\n    };\n  }\n\n  /**\n   * Delete an API Key\n   */\n  public async delete(clientId: string, accountId?: string): Promise<boolean> {\n    await this.db\n      .delete(this.apiClientCredentials)\n      .where(eq(this.apiClientCredentials.clientId, clientId));\n    return true;\n  }\n}\n"]}

package/dist/authorization/AuthModeSelector.d.ts

@@ -0,0 +1,10 @@
+import { AsyncHandler } from 'asynchronous-handlers';
+import type { PermissionReader, PermissionReaderInput } from '@solid/community-server';
+export declare class AuthModeSelector extends AsyncHandler<any, any> implements PermissionReader {
+    private readonly authMode;
+    private readonly acpReader;
+    private readonly aclReader;
+    private readonly allowAllReader;
+    constructor(authMode: string, acpReader: PermissionReader, aclReader: PermissionReader);
+    handle(input: PermissionReaderInput): Promise<any>;
+}

package/dist/authorization/AuthModeSelector.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthModeSelector = void 0;
+const asynchronous_handlers_1 = require("asynchronous-handlers");
+const community_server_1 = require("@solid/community-server");
+class AuthModeSelector extends asynchronous_handlers_1.AsyncHandler {
+    constructor(authMode, acpReader, aclReader) {
+        super();
+        this.authMode = authMode || 'acp';
+        this.acpReader = acpReader;
+        this.aclReader = aclReader;
+        this.allowAllReader = new community_server_1.AllStaticReader(true);
+    }
+    async handle(input) {
+        switch (this.authMode) {
+            case 'allow-all':
+                return this.allowAllReader.handle(input);
+            case 'acl':
+                return this.aclReader.handle(input);
+            case 'acp':
+            default:
+                return this.acpReader.handle(input);
+        }
+    }
+}
+exports.AuthModeSelector = AuthModeSelector;
+//# sourceMappingURL=AuthModeSelector.js.map

package/dist/authorization/AuthModeSelector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthModeSelector.js","sourceRoot":"","sources":["../../src/authorization/AuthModeSelector.ts"],"names":[],"mappings":";;;AAAA,iEAAqD;AAErD,8DAA0D;AAE1D,MAAa,gBAAiB,SAAQ,oCAAsB;IAM1D,YACE,QAAgB,EAChB,SAA2B,EAC3B,SAA2B;QAE3B,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,KAAK,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,cAAc,GAAG,IAAI,kCAAe,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,KAA4B;QAC9C,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtB,KAAK,WAAW;gBACd,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3C,KAAK,KAAK;gBACR,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtC,KAAK,KAAK,CAAC;YACX;gBACE,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;CACF;AA7BD,4CA6BC","sourcesContent":["import { AsyncHandler } from 'asynchronous-handlers';\nimport type { PermissionReader, PermissionReaderInput, MultiPermissionMap } from '@solid/community-server';\nimport { AllStaticReader } from '@solid/community-server';\n\nexport class AuthModeSelector extends AsyncHandler<any, any> implements PermissionReader {\n  private readonly authMode: string;\n  private readonly acpReader: PermissionReader;\n  private readonly aclReader: PermissionReader;\n  private readonly allowAllReader: PermissionReader;\n\n  public constructor(\n    authMode: string,\n    acpReader: PermissionReader,\n    aclReader: PermissionReader,\n  ) {\n    super();\n    this.authMode = authMode || 'acp';\n    this.acpReader = acpReader;\n    this.aclReader = aclReader;\n    this.allowAllReader = new AllStaticReader(true);\n  }\n\n  public async handle(input: PermissionReaderInput): Promise<any> {\n    switch (this.authMode) {\n      case 'allow-all':\n        return this.allowAllReader.handle(input);\n      case 'acl':\n        return this.aclReader.handle(input);\n      case 'acp':\n      default:\n        return this.acpReader.handle(input);\n    }\n  }\n}\n"]}

package/dist/authorization/AuthModeSelector.jsonld

@@ -0,0 +1,81 @@
+{
+  "@context": [
+    "https://linkedsoftwaredependencies.org/bundles/npm/@undefineds.co/xpod/^0.0.0/components/context.jsonld",
+    "https://linkedsoftwaredependencies.org/bundles/npm/@solid/community-server/^8.0.0/components/context.jsonld",
+    "https://linkedsoftwaredependencies.org/bundles/npm/asynchronous-handlers/^1.0.0/components/context.jsonld"
+  ],
+  "@id": "npmd:@undefineds.co/xpod",
+  "components": [
+    {
+      "@id": "undefineds:dist/authorization/AuthModeSelector.jsonld#AuthModeSelector",
+      "@type": "Class",
+      "requireElement": "AuthModeSelector",
+      "extends": [
+        {
+          "@type": "GenericComponentExtension",
+          "component": "ah:dist/AsyncHandler.jsonld#AsyncHandler",
+          "genericTypeInstances": [
+            {
+              "@type": "ParameterRangeWildcard"
+            },
+            {
+              "@type": "ParameterRangeWildcard"
+            }
+          ]
+        },
+        "css:dist/authorization/PermissionReader.jsonld#PermissionReader"
+      ],
+      "parameters": [
+        {
+          "@id": "undefineds:dist/authorization/AuthModeSelector.jsonld#AuthModeSelector_authMode",
+          "range": "xsd:string"
+        },
+        {
+          "@id": "undefineds:dist/authorization/AuthModeSelector.jsonld#AuthModeSelector_acpReader",
+          "range": "css:dist/authorization/PermissionReader.jsonld#PermissionReader"
+        },
+        {
+          "@id": "undefineds:dist/authorization/AuthModeSelector.jsonld#AuthModeSelector_aclReader",
+          "range": "css:dist/authorization/PermissionReader.jsonld#PermissionReader"
+        }
+      ],
+      "memberFields": [
+        {
+          "@id": "undefineds:dist/authorization/AuthModeSelector.jsonld#AuthModeSelector__member_authMode",
+          "memberFieldName": "authMode"
+        },
+        {
+          "@id": "undefineds:dist/authorization/AuthModeSelector.jsonld#AuthModeSelector__member_acpReader",
+          "memberFieldName": "acpReader"
+        },
+        {
+          "@id": "undefineds:dist/authorization/AuthModeSelector.jsonld#AuthModeSelector__member_aclReader",
+          "memberFieldName": "aclReader"
+        },
+        {
+          "@id": "undefineds:dist/authorization/AuthModeSelector.jsonld#AuthModeSelector__member_allowAllReader",
+          "memberFieldName": "allowAllReader"
+        },
+        {
+          "@id": "undefineds:dist/authorization/AuthModeSelector.jsonld#AuthModeSelector__member_constructor",
+          "memberFieldName": "constructor"
+        },
+        {
+          "@id": "undefineds:dist/authorization/AuthModeSelector.jsonld#AuthModeSelector__member_handle",
+          "memberFieldName": "handle"
+        }
+      ],
+      "constructorArguments": [
+        {
+          "@id": "undefineds:dist/authorization/AuthModeSelector.jsonld#AuthModeSelector_authMode"
+        },
+        {
+          "@id": "undefineds:dist/authorization/AuthModeSelector.jsonld#AuthModeSelector_acpReader"
+        },
+        {
+          "@id": "undefineds:dist/authorization/AuthModeSelector.jsonld#AuthModeSelector_aclReader"
+        }
+      ]
+    }
+  ]
+}

package/dist/cli/commands/account.d.ts

@@ -0,0 +1,6 @@
+import type { CommandModule } from 'yargs';
+interface AccountArgs {
+    url?: string;
+}
+export declare const accountCommand: CommandModule<object, AccountArgs>;
+export {};

package/dist/cli/commands/account.js

@@ -0,0 +1,119 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.accountCommand = void 0;
+const css_account_1 = require("../lib/css-account");
+const credentials_store_1 = require("../lib/credentials-store");
+function resolveUrl(url, credUrl) {
+    const raw = url || credUrl || process.env.CSS_BASE_URL || 'http://localhost:3000';
+    return raw.endsWith('/') ? raw : `${raw}/`;
+}
+async function loginOrExit(email, password, baseUrl) {
+    if (!email || !password) {
+        console.error('This command requires --email and --password.');
+        console.error('Account management commands use the CSS Account API which requires email/password authentication.');
+        process.exit(1);
+    }
+    if (!(await (0, css_account_1.checkServer)(baseUrl))) {
+        console.error(`Cannot reach server at ${baseUrl}`);
+        process.exit(1);
+    }
+    const token = await (0, css_account_1.login)(email, password, baseUrl);
+    if (!token) {
+        console.error('Login failed. Check email/password.');
+        process.exit(1);
+    }
+    return token;
+}
+const accountCreateCommand = {
+    command: 'create',
+    describe: 'Create a new account (register)',
+    builder: (yargs) => yargs
+        .option('email', { type: 'string', demandOption: true, description: 'Account email' })
+        .option('password', { type: 'string', demandOption: true, description: 'Account password' }),
+    handler: async (argv) => {
+        const creds = (0, credentials_store_1.loadCredentials)();
+        const baseUrl = resolveUrl(argv.url, creds?.url);
+        if (!(await (0, css_account_1.checkServer)(baseUrl))) {
+            console.error(`Cannot reach server at ${baseUrl}`);
+            process.exit(1);
+        }
+        const res = await fetch(`${baseUrl}.account/login/password/`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Accept: 'application/json',
+            },
+            body: JSON.stringify({ email: argv.email, password: argv.password }),
+        });
+        if (!res.ok) {
+            const text = await res.text();
+            console.error(`Account creation failed: ${res.status} ${text.slice(0, 200)}`);
+            process.exit(1);
+        }
+        const data = (await res.json());
+        if (data.authorization) {
+            console.log('Account created and logged in.');
+        }
+        else {
+            console.log('Account created.');
+        }
+    },
+};
+const accountListCommand = {
+    command: 'list',
+    describe: 'Show current account info',
+    builder: (yargs) => yargs
+        .option('email', { type: 'string', description: 'Account email' })
+        .option('password', { type: 'string', description: 'Account password' }),
+    handler: async (argv) => {
+        const creds = (0, credentials_store_1.loadCredentials)();
+        const baseUrl = resolveUrl(argv.url, creds?.url);
+        const token = await loginOrExit(argv.email, argv.password, baseUrl);
+        const data = await (0, css_account_1.getAccountData)(token, baseUrl);
+        if (!data) {
+            console.error('Failed to get account info.');
+            process.exit(1);
+        }
+        const podEntries = Object.entries(data.pods);
+        const webIdEntries = Object.entries(data.webIds);
+        const credEntries = Object.entries(data.clientCredentials);
+        console.log('Account info:\n');
+        if (podEntries.length > 0) {
+            console.log(`  Pods (${podEntries.length}):`);
+            for (const [url, name] of podEntries) {
+                console.log(`    ${name} — ${url}`);
+            }
+        }
+        else {
+            console.log('  Pods: none');
+        }
+        if (webIdEntries.length > 0) {
+            console.log(`\n  WebIDs (${webIdEntries.length}):`);
+            for (const [url] of webIdEntries) {
+                console.log(`    ${url}`);
+            }
+        }
+        if (credEntries.length > 0) {
+            console.log(`\n  Client credentials (${credEntries.length}):`);
+            for (const [url, webId] of credEntries) {
+                const id = url.split('/').filter(Boolean).pop() ?? url;
+                console.log(`    ${id} → ${webId}`);
+            }
+        }
+    },
+};
+exports.accountCommand = {
+    command: 'account',
+    describe: 'Account management',
+    builder: (yargs) => yargs
+        .option('url', {
+        alias: 'u',
+        type: 'string',
+        description: 'Server base URL',
+    })
+        .command(accountCreateCommand)
+        .command(accountListCommand)
+        .demandCommand(1, 'Please specify an account subcommand'),
+    handler: () => { },
+};
+//# sourceMappingURL=account.js.map

package/dist/cli/commands/account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.js","sourceRoot":"","sources":["../../../src/cli/commands/account.ts"],"names":[],"mappings":";;;AACA,oDAI4B;AAC5B,gEAA2D;AAW3D,SAAS,UAAU,CAAC,GAAY,EAAE,OAAgB;IAChD,MAAM,GAAG,GAAG,GAAG,IAAI,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,uBAAuB,CAAC;IAClF,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;AAC7C,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAAyB,EAAE,QAA4B,EAAE,OAAe;IACjG,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC/D,OAAO,CAAC,KAAK,CAAC,mGAAmG,CAAC,CAAC;QACnH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,IAAA,yBAAW,EAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,IAAA,mBAAK,EAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,oBAAoB,GAAgD;IACxE,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,iCAAiC;IAC3C,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,KAAK;SACF,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;SACrF,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAChG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,MAAM,KAAK,GAAG,IAAA,mCAAe,GAAE,CAAC;QAChC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QAEjD,IAAI,CAAC,CAAC,MAAM,IAAA,yBAAW,EAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,KAAK,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,0BAA0B,EAAE;YAC5D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;SACrE,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,4BAA4B,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA+B,CAAC;QAC9D,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;CACF,CAAC;AAEF,MAAM,kBAAkB,GAAgD;IACtE,OAAO,EAAE,MAAM;IACf,QAAQ,EAAE,2BAA2B;IACrC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,KAAK;SACF,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;SACjE,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAC5E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,MAAM,KAAK,GAAG,IAAA,mCAAe,GAAE,CAAC;QAChC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAEpE,MAAM,IAAI,GAAG,MAAM,IAAA,4BAAc,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAE3D,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAE/B,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,WAAW,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC;YAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,UAAU,EAAE,CAAC;gBACrC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC9B,CAAC;QAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,eAAe,YAAY,CAAC,MAAM,IAAI,CAAC,CAAC;YACpD,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,YAAY,EAAE,CAAC;gBACjC,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,2BAA2B,WAAW,CAAC,MAAM,IAAI,CAAC,CAAC;YAC/D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC;gBACvC,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC;gBACvD,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,EAAE,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAC;AAEW,QAAA,cAAc,GAAuC;IAChE,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,oBAAoB;IAC9B,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,KAAK;SACF,MAAM,CAAC,KAAK,EAAE;QACb,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,iBAAiB;KAC/B,CAAC;SACD,OAAO,CAAC,oBAAoB,CAAC;SAC7B,OAAO,CAAC,kBAAkB,CAAC;SAC3B,aAAa,CAAC,CAAC,EAAE,sCAAsC,CAAC;IAC7D,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC;CAClB,CAAC","sourcesContent":["import type { CommandModule } from 'yargs';\nimport {\n  checkServer,\n  login,\n  getAccountData,\n} from '../lib/css-account';\nimport { loadCredentials } from '../lib/credentials-store';\n\ninterface AccountArgs {\n  url?: string;\n}\n\ninterface AccountAuthArgs extends AccountArgs {\n  email?: string;\n  password?: string;\n}\n\nfunction resolveUrl(url?: string, credUrl?: string): string {\n  const raw = url || credUrl || process.env.CSS_BASE_URL || 'http://localhost:3000';\n  return raw.endsWith('/') ? raw : `${raw}/`;\n}\n\nasync function loginOrExit(email: string | undefined, password: string | undefined, baseUrl: string): Promise<string> {\n  if (!email || !password) {\n    console.error('This command requires --email and --password.');\n    console.error('Account management commands use the CSS Account API which requires email/password authentication.');\n    process.exit(1);\n  }\n\n  if (!(await checkServer(baseUrl))) {\n    console.error(`Cannot reach server at ${baseUrl}`);\n    process.exit(1);\n  }\n\n  const token = await login(email, password, baseUrl);\n  if (!token) {\n    console.error('Login failed. Check email/password.');\n    process.exit(1);\n  }\n  return token;\n}\n\nconst accountCreateCommand: CommandModule<AccountArgs, AccountAuthArgs> = {\n  command: 'create',\n  describe: 'Create a new account (register)',\n  builder: (yargs) =>\n    yargs\n      .option('email', { type: 'string', demandOption: true, description: 'Account email' })\n      .option('password', { type: 'string', demandOption: true, description: 'Account password' }),\n  handler: async (argv) => {\n    const creds = loadCredentials();\n    const baseUrl = resolveUrl(argv.url, creds?.url);\n\n    if (!(await checkServer(baseUrl))) {\n      console.error(`Cannot reach server at ${baseUrl}`);\n      process.exit(1);\n    }\n\n    const res = await fetch(`${baseUrl}.account/login/password/`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Accept: 'application/json',\n      },\n      body: JSON.stringify({ email: argv.email, password: argv.password }),\n    });\n\n    if (!res.ok) {\n      const text = await res.text();\n      console.error(`Account creation failed: ${res.status} ${text.slice(0, 200)}`);\n      process.exit(1);\n    }\n\n    const data = (await res.json()) as { authorization?: string };\n    if (data.authorization) {\n      console.log('Account created and logged in.');\n    } else {\n      console.log('Account created.');\n    }\n  },\n};\n\nconst accountListCommand: CommandModule<AccountArgs, AccountAuthArgs> = {\n  command: 'list',\n  describe: 'Show current account info',\n  builder: (yargs) =>\n    yargs\n      .option('email', { type: 'string', description: 'Account email' })\n      .option('password', { type: 'string', description: 'Account password' }),\n  handler: async (argv) => {\n    const creds = loadCredentials();\n    const baseUrl = resolveUrl(argv.url, creds?.url);\n    const token = await loginOrExit(argv.email, argv.password, baseUrl);\n\n    const data = await getAccountData(token, baseUrl);\n    if (!data) {\n      console.error('Failed to get account info.');\n      process.exit(1);\n    }\n\n    const podEntries = Object.entries(data.pods);\n    const webIdEntries = Object.entries(data.webIds);\n    const credEntries = Object.entries(data.clientCredentials);\n\n    console.log('Account info:\\n');\n\n    if (podEntries.length > 0) {\n      console.log(`  Pods (${podEntries.length}):`);\n      for (const [url, name] of podEntries) {\n        console.log(`    ${name} — ${url}`);\n      }\n    } else {\n      console.log('  Pods: none');\n    }\n\n    if (webIdEntries.length > 0) {\n      console.log(`\\n  WebIDs (${webIdEntries.length}):`);\n      for (const [url] of webIdEntries) {\n        console.log(`    ${url}`);\n      }\n    }\n\n    if (credEntries.length > 0) {\n      console.log(`\\n  Client credentials (${credEntries.length}):`);\n      for (const [url, webId] of credEntries) {\n        const id = url.split('/').filter(Boolean).pop() ?? url;\n        console.log(`    ${id} → ${webId}`);\n      }\n    }\n  },\n};\n\nexport const accountCommand: CommandModule<object, AccountArgs> = {\n  command: 'account',\n  describe: 'Account management',\n  builder: (yargs) =>\n    yargs\n      .option('url', {\n        alias: 'u',\n        type: 'string',\n        description: 'Server base URL',\n      })\n      .command(accountCreateCommand)\n      .command(accountListCommand)\n      .demandCommand(1, 'Please specify an account subcommand'),\n  handler: () => {},\n};\n"]}

package/dist/cli/commands/auth.js

@@ -1,12 +1,8 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.authCommand = void 0;
-const fs_1 = __importDefault(require("fs"));
-const path_1 = __importDefault(require("path"));
 const css_account_1 = require("../lib/css-account");
+const credentials_store_1 = require("../lib/credentials-store");
 function resolveUrl(url) {
     const raw = url || process.env.CSS_BASE_URL || 'http://localhost:3000';
     return raw.endsWith('/') ? raw : `${raw}/`;
@@ -40,7 +36,7 @@ const createCredentialsCommand = {
         .option('password', { type: 'string', demandOption: true, description: 'Account password' })
         .option('web-id', { type: 'string', description: 'WebID to bind credentials to' })
         .option('name', { type: 'string', description: 'Credential label' })
-        .option('write-env', { type: 'string', description: 'Write credentials to env file (e.g. .env.local)' }),
+        .option('output', { type: 'boolean', default: false, description: 'Print credentials to terminal instead of saving to ~/.xpod/' }),
     handler: async (argv) => {
         const baseUrl = resolveUrl(argv.url);
         if (!(await (0, css_account_1.checkServer)(baseUrl))) {
@@ -90,29 +86,14 @@ const createCredentialsCommand = {
         console.log(`  client_id:     ${cred.id}`);
         console.log(`  client_secret: ${cred.secret}`);
         console.log(`  webId:         ${webId}`);
-        if (argv['write-env']) {
-            const envPath = path_1.default.resolve(process.cwd(), argv['write-env']);
-            let content = '';
-            if (fs_1.default.existsSync(envPath)) {
-                content = fs_1.default.readFileSync(envPath, 'utf-8');
-            }
-            const updates = {
-                SOLID_CLIENT_ID: cred.id,
-                SOLID_CLIENT_SECRET: cred.secret ?? '',
-                SOLID_WEBID: webId,
-                SOLID_OIDC_ISSUER: baseUrl,
-            };
-            for (const [key, value] of Object.entries(updates)) {
-                const regex = new RegExp(`^${key}=.*$`, 'm');
-                if (regex.test(content)) {
-                    content = content.replace(regex, `${key}=${value}`);
-                }
-                else {
-                    content += `\n${key}=${value}`;
-                }
-            }
-            fs_1.default.writeFileSync(envPath, content.trim() + '\n');
-            console.log(`\nWritten to ${envPath}`);
+        if (!argv.output) {
+            (0, credentials_store_1.saveCredentials)({
+                url: baseUrl,
+                clientId: cred.id,
+                clientSecret: cred.secret ?? '',
+                webId,
+            });
+            console.log(`\nSaved to ${(0, credentials_store_1.getConfigPath)().replace('/config.json', '/')}`);
         }
     },
 };
@@ -174,6 +155,15 @@ const revokeCommand = {
         }
     },
 };
+const logoutCommand = {
+    command: 'logout',
+    describe: 'Remove stored credentials from ~/.xpod/',
+    builder: (yargs) => yargs,
+    handler: async () => {
+        (0, credentials_store_1.clearCredentials)();
+        console.log('Credentials removed.');
+    },
+};
 exports.authCommand = {
     command: 'auth',
     describe: 'Authentication and credential management',
@@ -186,6 +176,7 @@ exports.authCommand = {
     })
         .command(loginCommand)
         .command(createCredentialsCommand)
+        .command(logoutCommand)
         .command(listCommand)
         .command(revokeCommand)
         .demandCommand(1, 'Please specify an auth subcommand'),