@vigilbase/cli 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Vigilbase
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,138 @@
+# @vigilbase/cli
+
+Terminal client for Vigilbase — public scanners/tools without login, plus Vigilbase One after [device authorization](https://better-auth.com/docs/plugins/device-authorization).
+
+The binary name is **`vigilbase`** — after a global install you run:
+
+```bash
+vigilbase help
+vigilbase run security-headers https://vigilbase.com
+```
+
+## Install
+
+```bash
+npm install -g @vigilbase/cli
+# or
+pnpm add -g @vigilbase/cli
+
+vigilbase help
+vigilbase list --json
+```
+
+Without a global install:
+
+```bash
+npx @vigilbase/cli help
+npx @vigilbase/cli run email-security vigilbase.com --json
+```
+
+### From this monorepo
+
+```bash
+pnpm install
+pnpm link:vigilbase
+# builds dist/ and symlinks `vigilbase` into PATH
+
+vigilbase help
+```
+
+Unlink later with `pnpm unlink:vigilbase`.
+
+## Commands
+
+### Public tools (no auth)
+
+| Command | Purpose |
+| --- | --- |
+| `vigilbase list` | Catalog from `GET /api/agent/tools` |
+| `vigilbase run <tool> <target>` | Execute a scan |
+| `vigilbase headers <url>` | Shortcut for `security-headers` |
+| `vigilbase email <domain>` | Shortcut for `email-security` |
+| `vigilbase describe` / `skill` | Tool metadata + skill markdown |
+| `vigilbase badge <domain>` | Public badge URL |
+| `vigilbase doctor` | Connectivity + auth status |
+
+Currently allowlisted for autonomous execution: `security-headers`, `email-security`.
+
+### Auth (Vigilbase One)
+
+| Command | Purpose |
+| --- | --- |
+| `vigilbase login` | Device-code sign-in (RFC 8628) at `one.vigilbase.com/device` |
+| `vigilbase logout` | Clear `~/.config/vigilbase/credentials.json` |
+| `vigilbase whoami` | Show local / live One session |
+
+Sensitive tools unlocked after login:
+
+```bash
+vigilbase login
+vigilbase run website-security vigilbase.com
+vigilbase run react2shell https://app.example.com
+vigilbase run fortibleed-check example.com
+```
+
+Public tools stay usable while signed out. Sensitive tools route through Vigilbase One after `vigilbase login`.
+
+## Agent-friendly mode
+
+```bash
+vigilbase list --json
+vigilbase run security-headers https://vigilbase.com --json
+vigilbase email vigilbase.com --json
+```
+
+| Exit code | Meaning |
+| --- | --- |
+| `0` | Success |
+| `1` | Error |
+| `2` | Rate limited (`HTTP 429`) |
+
+## Local development
+
+For pointing the CLI at local servers (not shown in `vigilbase help`):
+
+| Env / flag | Description |
+| --- | --- |
+| `VIGILBASE_BASE_URL` / `--base-url` | Public API (default `https://vigilbase.com`) |
+| `VIGILBASE_ONE_URL` / `--one-url` | One API (default `https://one.vigilbase.com`) |
+| `VIGILBASE_CLIENT_ID` / `--client-id` | OAuth client id for device auth |
+| `VIGILBASE_CONFIG_DIR` | Override `~/.config/vigilbase` |
+
+```bash
+vigilbase doctor --base-url http://localhost:3001
+vigilbase login --one-url http://localhost:3000
+```
+
+## Architecture notes
+
+- **Public surface** (`VigilbaseClient`) talks only to vigilbase.com agent/tool endpoints — no credentials.
+- **One surface** stores tokens from Better Auth `POST /api/auth/device/code` + `/device/token` under `~/.config/vigilbase/credentials.json`.
+- Headless / CI: `vigilbase login --token "$VIGILBASE_ONE_TOKEN"` or `--no-open` and approve the printed URL elsewhere.
+
+## Smoke test
+
+```bash
+VIGILBASE_BASE_URL=https://vigilbase.com pnpm --filter @vigilbase/cli smoke:e2e
+```
+
+## Publishing
+
+See [PUBLISH.md](./PUBLISH.md) for npm org setup and `npm publish` steps.
+
+## Library API
+
+```ts
+import { runCli, VigilbaseClient, createConfig } from '@vigilbase/cli'
+
+await runCli({ argv: ['list', '--json'] })
+
+const client = new VigilbaseClient(createConfig())
+await client.listTools()
+```
+
+## Related
+
+- OpenAPI: https://vigilbase.com/openapi.json
+- Skills index: https://vigilbase.com/.well-known/agent-skills/index.json
+- Device auth docs: https://better-auth.com/docs/plugins/device-authorization

package/dist/auth/device-auth.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Better Auth device authorization (RFC 8628) client for Vigilbase One.
+ *
+ * Server plugin: https://better-auth.com/docs/plugins/device-authorization
+ * Endpoints (relative to One's Better Auth base, typically `/api/auth`):
+ *   POST /device/code
+ *   POST /device/token
+ *
+ * Public tool commands do not use this module. One-scoped commands will.
+ */
+import type { CliConfig } from '../lib/config.js';
+import type { DeviceCodeResponse, DeviceTokenPendingError, DeviceTokenSuccess } from './types.js';
+export declare class DeviceAuthError extends Error {
+    readonly code?: string;
+    readonly status: number;
+    readonly body: unknown;
+    constructor(message: string, options: {
+        status: number;
+        code?: string;
+        body?: unknown;
+    });
+}
+export declare function requestDeviceCode(config: CliConfig, options?: {
+    scope?: string;
+}): Promise<DeviceCodeResponse>;
+export type PollResult = {
+    status: 'authorized';
+    token: DeviceTokenSuccess;
+} | {
+    status: 'pending';
+    error: DeviceTokenPendingError;
+} | {
+    status: 'denied';
+    error: DeviceTokenPendingError;
+} | {
+    status: 'expired';
+    error: DeviceTokenPendingError;
+} | {
+    status: 'transient';
+    httpStatus: number;
+    error: DeviceTokenPendingError;
+};
+export declare function pollDeviceToken(config: CliConfig, deviceCode: string): Promise<PollResult>;
+export declare function sleep(ms: number): Promise<void>;
+/**
+ * Run the full device-code poll loop until authorized, denied, or expired.
+ * Returns the token payload on success.
+ */
+export declare function waitForDeviceAuthorization(config: CliConfig, device: DeviceCodeResponse, options?: {
+    onPending?: (info: {
+        attempt: number;
+        intervalSec: number;
+        kind: 'pending' | 'transient';
+    }) => void;
+    signal?: AbortSignal;
+    maxConsecutiveTransient?: number;
+}): Promise<DeviceTokenSuccess>;
+//# sourceMappingURL=device-auth.d.ts.map

package/dist/auth/device-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-auth.d.ts","sourceRoot":"","sources":["../../src/auth/device-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EACnB,MAAM,YAAY,CAAA;AAOnB,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;gBAGpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE;CAQ7D;AAkDD,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,SAAS,EACjB,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAyC7B;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,GACnD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,uBAAuB,CAAA;CAAE,GACrD;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,uBAAuB,CAAA;CAAE,GACpD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,uBAAuB,CAAA;CAAE,GACrD;IACE,MAAM,EAAE,WAAW,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,uBAAuB,CAAA;CAC/B,CAAA;AAEL,wBAAsB,eAAe,CACnC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,UAAU,CAAC,CAoErB;AAED,wBAAsB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAErD;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,kBAAkB,EAC1B,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE;QACjB,OAAO,EAAE,MAAM,CAAA;QACf,WAAW,EAAE,MAAM,CAAA;QACnB,IAAI,EAAE,SAAS,GAAG,WAAW,CAAA;KAC9B,KAAK,IAAI,CAAA;IACV,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,uBAAuB,CAAC,EAAE,MAAM,CAAA;CACjC,GACA,OAAO,CAAC,kBAAkB,CAAC,CAiF7B"}

package/dist/auth/device-auth.js

@@ -0,0 +1,229 @@
+/**
+ * Better Auth device authorization (RFC 8628) client for Vigilbase One.
+ *
+ * Server plugin: https://better-auth.com/docs/plugins/device-authorization
+ * Endpoints (relative to One's Better Auth base, typically `/api/auth`):
+ *   POST /device/code
+ *   POST /device/token
+ *
+ * Public tool commands do not use this module. One-scoped commands will.
+ */
+const DEVICE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
+/** How many consecutive unreachable token polls before aborting a live login. */
+const MAX_CONSECUTIVE_TRANSIENT = 8;
+export class DeviceAuthError extends Error {
+    code;
+    status;
+    body;
+    constructor(message, options) {
+        super(message);
+        this.name = 'DeviceAuthError';
+        this.status = options.status;
+        this.code = options.code;
+        this.body = options.body;
+    }
+}
+function authBase(config) {
+    return `${config.oneBaseUrl}/api/auth`;
+}
+function isRetryableTokenStatus(status) {
+    return (status === 404 ||
+        status === 408 ||
+        status === 425 ||
+        status === 429 ||
+        status >= 500);
+}
+async function postJson(config, path, body) {
+    const url = `${authBase(config)}${path}`;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), config.timeoutMs);
+    try {
+        const response = await fetch(url, {
+            method: 'POST',
+            signal: controller.signal,
+            headers: {
+                Accept: 'application/json',
+                'Content-Type': 'application/json',
+                'User-Agent': config.userAgent,
+            },
+            body: JSON.stringify(body),
+        });
+        const text = await response.text();
+        let json = null;
+        if (text) {
+            try {
+                json = JSON.parse(text);
+            }
+            catch {
+                json = { raw: text };
+            }
+        }
+        return { status: response.status, json };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+export async function requestDeviceCode(config, options) {
+    const { status, json } = await postJson(config, '/device/code', {
+        client_id: config.clientId,
+        ...(options?.scope ? { scope: options.scope } : {}),
+    });
+    if (status === 404) {
+        throw new DeviceAuthError(`Device authorization is not enabled on ${config.oneBaseUrl} yet. ` +
+            'Enable Better Auth\'s deviceAuthorization plugin on Vigilbase One, then retry `vigilbase login`.', { status, body: json, code: 'not_enabled' });
+    }
+    if (status < 200 || status >= 300) {
+        const message = json &&
+            typeof json === 'object' &&
+            'message' in json &&
+            typeof json.message === 'string'
+            ? json.message
+            : `Device code request failed (HTTP ${status})`;
+        throw new DeviceAuthError(message, { status, body: json });
+    }
+    const data = json;
+    if (!data.device_code || !data.user_code || !data.verification_uri) {
+        throw new DeviceAuthError('Device code response was missing required fields.', { status, body: json });
+    }
+    return {
+        device_code: data.device_code,
+        user_code: data.user_code,
+        verification_uri: data.verification_uri,
+        verification_uri_complete: data.verification_uri_complete,
+        expires_in: data.expires_in ?? 600,
+        interval: data.interval ?? 5,
+    };
+}
+export async function pollDeviceToken(config, deviceCode) {
+    let status;
+    let json;
+    try {
+        ;
+        ({ status, json } = await postJson(config, '/device/token', {
+            grant_type: DEVICE_GRANT,
+            device_code: deviceCode,
+            client_id: config.clientId,
+        }));
+    }
+    catch (error) {
+        const description = error instanceof Error ? error.message : 'Network error while polling';
+        return {
+            status: 'transient',
+            httpStatus: 0,
+            error: {
+                error: 'authorization_pending',
+                error_description: description,
+            },
+        };
+    }
+    if (json &&
+        typeof json === 'object' &&
+        'access_token' in json &&
+        typeof json.access_token === 'string') {
+        return { status: 'authorized', token: json };
+    }
+    const errorBody = (json ?? {});
+    const code = errorBody.error || `http_${status}`;
+    switch (code) {
+        case 'authorization_pending':
+        case 'slow_down':
+            return { status: 'pending', error: errorBody };
+        case 'access_denied':
+            return { status: 'denied', error: errorBody };
+        case 'expired_token':
+            return { status: 'expired', error: errorBody };
+        default:
+            break;
+    }
+    // After a successful device/code, brief 404/5xx (deploys, rollbacks, blips)
+    // must not abort login as "not enabled".
+    if (isRetryableTokenStatus(status)) {
+        return {
+            status: 'transient',
+            httpStatus: status,
+            error: {
+                error: 'authorization_pending',
+                error_description: errorBody.error_description ||
+                    errorBody.error ||
+                    `Temporary device token error (HTTP ${status})`,
+            },
+        };
+    }
+    throw new DeviceAuthError(errorBody.error_description ||
+        errorBody.error ||
+        `Device token request failed (HTTP ${status})`, { status, body: json, code });
+}
+export async function sleep(ms) {
+    await new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+ * Run the full device-code poll loop until authorized, denied, or expired.
+ * Returns the token payload on success.
+ */
+export async function waitForDeviceAuthorization(config, device, options) {
+    let intervalSec = device.interval && device.interval > 0 ? device.interval : 5;
+    const deadline = Date.now() + device.expires_in * 1000;
+    let attempt = 0;
+    let consecutiveTransient = 0;
+    const maxTransient = options?.maxConsecutiveTransient ?? MAX_CONSECUTIVE_TRANSIENT;
+    let lastTransientStatus = 0;
+    while (Date.now() < deadline) {
+        if (options?.signal?.aborted) {
+            throw new DeviceAuthError('Login cancelled.', {
+                status: 0,
+                code: 'cancelled',
+            });
+        }
+        attempt += 1;
+        options?.onPending?.({
+            attempt,
+            intervalSec,
+            kind: consecutiveTransient > 0 ? 'transient' : 'pending',
+        });
+        await sleep(intervalSec * 1000);
+        const result = await pollDeviceToken(config, device.device_code);
+        switch (result.status) {
+            case 'authorized':
+                return result.token;
+            case 'pending':
+                consecutiveTransient = 0;
+                if (result.error.error === 'slow_down') {
+                    intervalSec += 5;
+                }
+                break;
+            case 'transient':
+                consecutiveTransient += 1;
+                lastTransientStatus = result.httpStatus;
+                if (consecutiveTransient >= maxTransient) {
+                    throw new DeviceAuthError(`Lost contact with device authorization on ${config.oneBaseUrl} while waiting for approval` +
+                        (lastTransientStatus
+                            ? ` (HTTP ${lastTransientStatus})`
+                            : '') +
+                        '. Retry `vigilbase login` once One is healthy.', {
+                        status: lastTransientStatus,
+                        code: 'unreachable',
+                        body: result.error,
+                    });
+                }
+                break;
+            case 'denied':
+                throw new DeviceAuthError('Access was denied in the browser.', {
+                    status: 403,
+                    code: 'access_denied',
+                    body: result.error,
+                });
+            case 'expired':
+                throw new DeviceAuthError('The device code expired. Run `vigilbase login` again.', { status: 400, code: 'expired_token', body: result.error });
+            default: {
+                const _exhaustive = result;
+                throw new DeviceAuthError(`Unexpected poll result: ${JSON.stringify(_exhaustive)}`, {
+                    status: 0,
+                    code: 'unexpected',
+                });
+            }
+        }
+    }
+    throw new DeviceAuthError('Timed out waiting for browser authorization. Run `vigilbase login` again.', { status: 0, code: 'timeout' });
+}
+//# sourceMappingURL=device-auth.js.map

package/dist/auth/device-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-auth.js","sourceRoot":"","sources":["../../src/auth/device-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,MAAM,YAAY,GAAG,8CAA8C,CAAA;AAEnE,iFAAiF;AACjF,MAAM,yBAAyB,GAAG,CAAC,CAAA;AAEnC,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,IAAI,CAAS;IACb,MAAM,CAAQ;IACd,IAAI,CAAS;IAEtB,YACE,OAAe,EACf,OAA0D;QAE1D,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;QAC7B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC5B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QACxB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;IAC1B,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,MAAiB;IACjC,OAAO,GAAG,MAAM,CAAC,UAAU,WAAW,CAAA;AACxC,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAc;IAC5C,OAAO,CACL,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG;QACd,MAAM,KAAK,GAAG;QACd,MAAM,IAAI,GAAG,CACd,CAAA;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,MAAiB,EACjB,IAAY,EACZ,IAA6B;IAE7B,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAA;IACxC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;IACpE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,MAAM,CAAC,SAAS;aAC/B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,IAAI,IAAI,GAAY,IAAI,CAAA;QACxB,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAA;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;YACtB,CAAC;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAA;IAC1C,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAiB,EACjB,OAA4B;IAE5B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,cAAc,EAAE;QAC9D,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAA;IAEF,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,MAAM,IAAI,eAAe,CACvB,0CAA0C,MAAM,CAAC,UAAU,QAAQ;YACjE,kGAAkG,EACpG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,CAC5C,CAAA;IACH,CAAC;IAED,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAClC,MAAM,OAAO,GACX,IAAI;YACJ,OAAO,IAAI,KAAK,QAAQ;YACxB,SAAS,IAAI,IAAI;YACjB,OAAQ,IAA6B,CAAC,OAAO,KAAK,QAAQ;YACxD,CAAC,CAAE,IAA4B,CAAC,OAAO;YACvC,CAAC,CAAC,oCAAoC,MAAM,GAAG,CAAA;QACnD,MAAM,IAAI,eAAe,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED,MAAM,IAAI,GAAG,IAAmC,CAAA;IAChD,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACnE,MAAM,IAAI,eAAe,CACvB,mDAAmD,EACnD,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CACvB,CAAA;IACH,CAAC;IAED,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,GAAG;QAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC;KAC7B,CAAA;AACH,CAAC;AAaD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAiB,EACjB,UAAkB;IAElB,IAAI,MAAc,CAAA;IAClB,IAAI,IAAa,CAAA;IACjB,IAAI,CAAC;QACH,CAAC;QAAA,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,eAAe,EAAE;YAC3D,UAAU,EAAE,YAAY;YACxB,WAAW,EAAE,UAAU;YACvB,SAAS,EAAE,MAAM,CAAC,QAAQ;SAC3B,CAAC,CAAC,CAAA;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,WAAW,GACf,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAA;QACxE,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,UAAU,EAAE,CAAC;YACb,KAAK,EAAE;gBACL,KAAK,EAAE,uBAAuB;gBAC9B,iBAAiB,EAAE,WAAW;aAC/B;SACF,CAAA;IACH,CAAC;IAED,IACE,IAAI;QACJ,OAAO,IAAI,KAAK,QAAQ;QACxB,cAAc,IAAI,IAAI;QACtB,OAAQ,IAAkC,CAAC,YAAY,KAAK,QAAQ,EACpE,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,IAA0B,EAAE,CAAA;IACpE,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAA;IACzD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,IAAI,QAAQ,MAAM,EAAE,CAAA;IAEhD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,uBAAuB,CAAC;QAC7B,KAAK,WAAW;YACd,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QAChD,KAAK,eAAe;YAClB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QAC/C,KAAK,eAAe;YAClB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;QAChD;YACE,MAAK;IACT,CAAC;IAED,4EAA4E;IAC5E,yCAAyC;IACzC,IAAI,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,UAAU,EAAE,MAAM;YAClB,KAAK,EAAE;gBACL,KAAK,EAAE,uBAAuB;gBAC9B,iBAAiB,EACf,SAAS,CAAC,iBAAiB;oBAC3B,SAAS,CAAC,KAAK;oBACf,sCAAsC,MAAM,GAAG;aAClD;SACF,CAAA;IACH,CAAC;IAED,MAAM,IAAI,eAAe,CACvB,SAAS,CAAC,iBAAiB;QACzB,SAAS,CAAC,KAAK;QACf,qCAAqC,MAAM,GAAG,EAChD,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAC7B,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,EAAU;IACpC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAiB,EACjB,MAA0B,EAC1B,OAQC;IAED,IAAI,WAAW,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAA;IACtD,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,IAAI,oBAAoB,GAAG,CAAC,CAAA;IAC5B,MAAM,YAAY,GAChB,OAAO,EAAE,uBAAuB,IAAI,yBAAyB,CAAA;IAC/D,IAAI,mBAAmB,GAAG,CAAC,CAAA;IAE3B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE;gBAC5C,MAAM,EAAE,CAAC;gBACT,IAAI,EAAE,WAAW;aAClB,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,CAAA;QACZ,OAAO,EAAE,SAAS,EAAE,CAAC;YACnB,OAAO;YACP,WAAW;YACX,IAAI,EAAE,oBAAoB,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;SACzD,CAAC,CAAA;QACF,MAAM,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;QAE/B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;QAChE,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,KAAK,YAAY;gBACf,OAAO,MAAM,CAAC,KAAK,CAAA;YACrB,KAAK,SAAS;gBACZ,oBAAoB,GAAG,CAAC,CAAA;gBACxB,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;oBACvC,WAAW,IAAI,CAAC,CAAA;gBAClB,CAAC;gBACD,MAAK;YACP,KAAK,WAAW;gBACd,oBAAoB,IAAI,CAAC,CAAA;gBACzB,mBAAmB,GAAG,MAAM,CAAC,UAAU,CAAA;gBACvC,IAAI,oBAAoB,IAAI,YAAY,EAAE,CAAC;oBACzC,MAAM,IAAI,eAAe,CACvB,6CAA6C,MAAM,CAAC,UAAU,6BAA6B;wBACzF,CAAC,mBAAmB;4BAClB,CAAC,CAAC,UAAU,mBAAmB,GAAG;4BAClC,CAAC,CAAC,EAAE,CAAC;wBACP,gDAAgD,EAClD;wBACE,MAAM,EAAE,mBAAmB;wBAC3B,IAAI,EAAE,aAAa;wBACnB,IAAI,EAAE,MAAM,CAAC,KAAK;qBACnB,CACF,CAAA;gBACH,CAAC;gBACD,MAAK;YACP,KAAK,QAAQ;gBACX,MAAM,IAAI,eAAe,CAAC,mCAAmC,EAAE;oBAC7D,MAAM,EAAE,GAAG;oBACX,IAAI,EAAE,eAAe;oBACrB,IAAI,EAAE,MAAM,CAAC,KAAK;iBACnB,CAAC,CAAA;YACJ,KAAK,SAAS;gBACZ,MAAM,IAAI,eAAe,CACvB,uDAAuD,EACvD,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,CAC3D,CAAA;YACH,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,WAAW,GAAU,MAAM,CAAA;gBACjC,MAAM,IAAI,eAAe,CACvB,2BAA2B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,EACxD;oBACE,MAAM,EAAE,CAAC;oBACT,IAAI,EAAE,YAAY;iBACnB,CACF,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,IAAI,eAAe,CACvB,2EAA2E,EAC3E,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAC/B,CAAA;AACH,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,4 @@
+export { clearOneCredentials, credentialsPath, getOneAccessToken, readCredentials, writeOneCredentials, } from './store.js';
+export { DeviceAuthError, pollDeviceToken, requestDeviceCode, waitForDeviceAuthorization, } from './device-auth.js';
+export type { CredentialsFile, DeviceCodeResponse, DeviceTokenSuccess, OneCredentials, StoredUser, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,mBAAmB,GACpB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,UAAU,GACX,MAAM,YAAY,CAAA"}

package/dist/auth/index.js

@@ -0,0 +1,3 @@
+export { clearOneCredentials, credentialsPath, getOneAccessToken, readCredentials, writeOneCredentials, } from './store.js';
+export { DeviceAuthError, pollDeviceToken, requestDeviceCode, waitForDeviceAuthorization, } from './device-auth.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,mBAAmB,GACpB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAA"}

package/dist/auth/store.d.ts

@@ -0,0 +1,12 @@
+import type { CliConfig } from '../lib/config.js';
+import type { CredentialsFile, OneCredentials } from './types.js';
+/**
+ * Resolve the credentials file path and reject path traversal outside configDir.
+ * Filename is a fixed constant — only configDir varies (from env / XDG).
+ */
+export declare function credentialsPath(config: Pick<CliConfig, 'configDir'>): string;
+export declare function readCredentials(config: Pick<CliConfig, 'configDir'>): Promise<CredentialsFile>;
+export declare function writeOneCredentials(config: Pick<CliConfig, 'configDir'>, one: OneCredentials): Promise<void>;
+export declare function clearOneCredentials(config: Pick<CliConfig, 'configDir'>): Promise<boolean>;
+export declare function getOneAccessToken(config: Pick<CliConfig, 'configDir'>): Promise<string | null>;
+//# sourceMappingURL=store.d.ts.map

package/dist/auth/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAMjE;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,MAAM,CAQ5E;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,GACnC,OAAO,CAAC,eAAe,CAAC,CAsB1B;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EACpC,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,GACnC,OAAO,CAAC,OAAO,CAAC,CAmBlB;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,GACnC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWxB"}

package/dist/auth/store.js

@@ -0,0 +1,85 @@
+import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { basename, resolve, sep } from 'node:path';
+const FILE_NAME = 'credentials.json';
+const MODE_DIR = 0o700;
+const MODE_FILE = 0o600;
+/**
+ * Resolve the credentials file path and reject path traversal outside configDir.
+ * Filename is a fixed constant — only configDir varies (from env / XDG).
+ */
+export function credentialsPath(config) {
+    const configDir = resolve(config.configDir);
+    const path = resolve(configDir, FILE_NAME);
+    const allowedPrefix = configDir.endsWith(sep) ? configDir : `${configDir}${sep}`;
+    if (!path.startsWith(allowedPrefix) || basename(path) !== FILE_NAME) {
+        throw new Error('Refusing to read credentials outside the config directory.');
+    }
+    return path;
+}
+export async function readCredentials(config) {
+    const path = credentialsPath(config);
+    try {
+        // Path is confined to configDir + fixed FILE_NAME by credentialsPath().
+        // no-dd-sa:typescript-node-security/detect-non-literal-fs-filename — validated credentials path under configDir
+        const raw = await readFile(path, 'utf8');
+        const parsed = JSON.parse(raw);
+        if (parsed?.version !== 1) {
+            return { version: 1, one: null };
+        }
+        return parsed;
+    }
+    catch (error) {
+        if (error &&
+            typeof error === 'object' &&
+            'code' in error &&
+            error.code === 'ENOENT') {
+            return { version: 1, one: null };
+        }
+        throw error;
+    }
+}
+export async function writeOneCredentials(config, one) {
+    const configDir = resolve(config.configDir);
+    await mkdir(configDir, { recursive: true, mode: MODE_DIR });
+    const next = { version: 1, one };
+    const path = credentialsPath(config);
+    // no-dd-sa:typescript-node-security/detect-non-literal-fs-filename — validated credentials path under configDir
+    await writeFile(path, `${JSON.stringify(next, null, 2)}\n`, {
+        encoding: 'utf8',
+        mode: MODE_FILE,
+    });
+}
+export async function clearOneCredentials(config) {
+    const current = await readCredentials(config);
+    if (!current.one)
+        return false;
+    const path = credentialsPath(config);
+    try {
+        // no-dd-sa:typescript-node-security/detect-non-literal-fs-filename — validated credentials path under configDir
+        await rm(path);
+    }
+    catch (error) {
+        if (error &&
+            typeof error === 'object' &&
+            'code' in error &&
+            error.code === 'ENOENT') {
+            return false;
+        }
+        throw error;
+    }
+    return true;
+}
+export async function getOneAccessToken(config) {
+    const credentials = await readCredentials(config);
+    const token = credentials.one?.accessToken;
+    if (!token)
+        return null;
+    if (credentials.one?.expiresAt) {
+        const expires = Date.parse(credentials.one.expiresAt);
+        if (Number.isFinite(expires) && expires <= Date.now()) {
+            return null;
+        }
+    }
+    return token;
+}
+//# sourceMappingURL=store.js.map

package/dist/auth/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAIlD,MAAM,SAAS,GAAG,kBAAkB,CAAA;AACpC,MAAM,QAAQ,GAAG,KAAK,CAAA;AACtB,MAAM,SAAS,GAAG,KAAK,CAAA;AAEvB;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAAoC;IAClE,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IAC1C,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,GAAG,GAAG,EAAE,CAAA;IAChF,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;IAC/E,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAoC;IAEpC,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IACpC,IAAI,CAAC;QACH,wEAAwE;QACxE,gHAAgH;QAChH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAA;QACjD,IAAI,MAAM,EAAE,OAAO,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;QAClC,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK;YACL,OAAO,KAAK,KAAK,QAAQ;YACzB,MAAM,IAAI,KAAK;YACd,KAA0B,CAAC,IAAI,KAAK,QAAQ,EAC7C,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;QAClC,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAoC,EACpC,GAAmB;IAEnB,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAC3C,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC3D,MAAM,IAAI,GAAoB,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,CAAA;IACjD,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IACpC,gHAAgH;IAChH,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC1D,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,SAAS;KAChB,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAoC;IAEpC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAA;IAC7C,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,KAAK,CAAA;IAC9B,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IACpC,IAAI,CAAC;QACH,gHAAgH;QAChH,MAAM,EAAE,CAAC,IAAI,CAAC,CAAA;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK;YACL,OAAO,KAAK,KAAK,QAAQ;YACzB,MAAM,IAAI,KAAK;YACd,KAA0B,CAAC,IAAI,KAAK,QAAQ,EAC7C,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAoC;IAEpC,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAA;IACjD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,WAAW,CAAA;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,IAAI,WAAW,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACtD,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/auth/types.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Credential shapes for Vigilbase One CLI auth.
+ *
+ * Intended to store tokens from Better Auth's device authorization grant
+ * (RFC 8628): https://better-auth.com/docs/plugins/device-authorization
+ */
+export type StoredUser = {
+    id?: string;
+    email?: string;
+    name?: string;
+};
+export type OneCredentials = {
+    accessToken: string;
+    refreshToken?: string;
+    tokenType?: string;
+    scope?: string;
+    /** ISO timestamp when the access token expires, if known. */
+    expiresAt?: string;
+    user?: StoredUser;
+    /** When these credentials were written. */
+    obtainedAt: string;
+};
+export type CredentialsFile = {
+    version: 1;
+    one?: OneCredentials | null;
+};
+export type DeviceCodeResponse = {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete?: string;
+    expires_in: number;
+    interval?: number;
+};
+export type DeviceTokenSuccess = {
+    access_token: string;
+    token_type?: string;
+    expires_in?: number;
+    refresh_token?: string;
+    scope?: string;
+};
+export type DeviceTokenPendingError = {
+    error: 'authorization_pending' | 'slow_down' | 'access_denied' | 'expired_token' | string;
+    error_description?: string;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,CAAC,CAAA;IACV,GAAG,CAAC,EAAE,cAAc,GAAG,IAAI,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,gBAAgB,EAAE,MAAM,CAAA;IACxB,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAClC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,EACD,uBAAuB,GACvB,WAAW,GACX,eAAe,GACf,eAAe,GACf,MAAM,CAAA;IACV,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B,CAAA"}

package/dist/auth/types.js

@@ -0,0 +1,8 @@
+/**
+ * Credential shapes for Vigilbase One CLI auth.
+ *
+ * Intended to store tokens from Better Auth's device authorization grant
+ * (RFC 8628): https://better-auth.com/docs/plugins/device-authorization
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/bin.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=bin.d.ts.map