ardent-cli-beta 0.0.4 → 0.0.6

package/README.md

@@ -4,12 +4,25 @@
 
 The Ardent CLI is the customer command-line client for the control-plane API.
 
-The Oclif foundation and token authentication are implemented. `ardent login
---token <token>` validates and stores an API token; `ARDENT_TOKEN` supplies the
-same flag non-interactively. `ardent status` and `ardent logout` inspect and
-remove that local session. The CLI always talks to Ardent's production control
-plane. Oclif provides help, version, autocomplete, and native JSON command
-behavior. Resource commands and resource context are not implemented yet.
+The Oclif foundation and authentication are implemented. `ardent login` opens
+the Ardent frontend and returns the approved API key through a loopback callback
+bound with PKCE. `ardent login --token <token>` validates and stores an existing
+API token for CI and automation; `ARDENT_TOKEN` supplies the same flag
+non-interactively. `ardent status` and `ardent logout` inspect and remove that
+local session. The CLI always talks to Ardent's production control plane. Oclif
+provides help, version, autocomplete, and native JSON command behavior.
+Connector credential delivery is the first resource command; general resource
+commands and resource context remain owed.
+
+`ardent connectors credentials set` delivers a source database password and a
+verified CA directly to the selected environment's authoritative AWS account and
+region. The caller must be logged in to Ardent and authenticated to that AWS account. Supply
+the password only as `{"password":"..."}` on standard input and the CA with
+`--ca-file`; `--request` is a caller-generated UUID that must be reused for a
+retry. The command checks connector ownership through the control-plane API,
+checks the local AWS account through STS, prints its target, then creates the CA
+and password secrets in that order. It never sends either value to the control
+plane or places one on the AWS command's argument vector.
 
 Set `ARDENT_API_URL` to point the CLI at a development control plane. Without
 it, the CLI uses `https://production.tryardent.com`.
@@ -18,6 +31,7 @@ it, the CLI uses `https://production.tryardent.com`.
 npm ci
 npm run build
 ./bin/run.js --help
+./bin/run.js login
 ./bin/run.js login --token <token>
 ARDENT_API_URL=http://localhost:8080 ./bin/run.js login --token <token>
 ```

package/dist/api/client.d.ts

@@ -5,3 +5,4 @@ export declare class APIError extends Error {
     constructor(message: string, status: number, code?: string | undefined);
 }
 export declare function request<T>(token: string, path: string, init?: RequestInit): Promise<T>;
+export declare function requestWithoutAuthentication<T>(path: string, init?: RequestInit): Promise<T>;

package/dist/api/client.js

@@ -10,13 +10,24 @@ export class APIError extends Error {
     }
 }
 export async function request(token, path, init = {}) {
+    return requestJSON(path, {
+        ...init,
+        headers: {
+            Authorization: `Bearer ${token}`,
+            ...init.headers,
+        },
+    });
+}
+export async function requestWithoutAuthentication(path, init = {}) {
+    return requestJSON(path, init);
+}
+async function requestJSON(path, init) {
     let response;
     try {
         response = await fetch(new URL(path, `${API_URL}/`), {
             ...init,
             headers: {
                 Accept: 'application/json',
-                Authorization: `Bearer ${token}`,
                 ...(init.body === undefined ? {} : { 'Content-Type': 'application/json' }),
                 ...init.headers,
             },

package/dist/auth/browser.d.ts

@@ -0,0 +1,8 @@
+import { type Organization } from './token.js';
+interface BrowserLoginOptions {
+    onAuthorizationURL?: (url: string, opened: boolean) => void;
+    open?: (url: string) => Promise<void>;
+    timeoutMs?: number;
+}
+export declare function loginWithBrowser(directory: string, options?: BrowserLoginOptions): Promise<Organization[]>;
+export {};

package/dist/auth/browser.js

@@ -0,0 +1,149 @@
+import { spawn } from 'node:child_process';
+import { createHash, randomBytes } from 'node:crypto';
+import { createServer } from 'node:http';
+import { setTimeout as wait } from 'node:timers/promises';
+import { APIError, API_URL, requestWithoutAuthentication } from '../api/client.js';
+import { loginWithToken } from './token.js';
+const LOGIN_TIMEOUT_MS = 30 * 60 * 1000;
+export async function loginWithBrowser(directory, options = {}) {
+    const state = randomValue();
+    const verifier = randomValue();
+    const challenge = createHash('sha256').update(verifier).digest('base64url');
+    const deadline = new AbortController();
+    let callbackURI = '';
+    let exchanging = false;
+    let resolveLogin;
+    let rejectLogin;
+    const completion = new Promise((resolve, reject) => {
+        resolveLogin = resolve;
+        rejectLogin = reject;
+    });
+    const server = createServer(async (request, response) => {
+        const callback = new URL(request.url ?? '/', 'http://127.0.0.1');
+        if (request.method !== 'GET' || callback.pathname !== '/callback') {
+            response.writeHead(404).end();
+            return;
+        }
+        if (callback.searchParams.get('state') !== state) {
+            browserResponse(response, 400, 'Ardent CLI login was rejected because the request did not match.');
+            return;
+        }
+        const authorizationError = callback.searchParams.get('error');
+        if (authorizationError) {
+            const error = new Error(`Ardent CLI login was not authorized: ${authorizationError}`);
+            browserResponse(response, 400, error.message, () => rejectLogin(error));
+            return;
+        }
+        const code = callback.searchParams.get('code');
+        if (!code || exchanging) {
+            browserResponse(response, 400, 'Ardent CLI login could not be completed.');
+            return;
+        }
+        exchanging = true;
+        try {
+            const token = await exchange(code, verifier, deadline.signal);
+            const organizations = await loginWithToken(directory, token, deadline.signal);
+            browserResponse(response, 200, 'Return to your terminal to continue. You can close this tab.', () => resolveLogin(organizations));
+        }
+        catch (error) {
+            const loginError = error instanceof Error ? error : new Error(String(error));
+            browserResponse(response, 500, 'Ardent CLI login failed. Return to your terminal for details.', () => rejectLogin(loginError));
+        }
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', resolve);
+    });
+    const address = server.address();
+    callbackURI = `http://127.0.0.1:${address.port}/callback`;
+    const authorizationURL = new URL('/auth/cli', `${API_URL}/`);
+    authorizationURL.search = new URLSearchParams({
+        callback_uri: callbackURI,
+        state,
+        code_challenge: challenge,
+        code_challenge_method: 'S256',
+    }).toString();
+    let opened = true;
+    try {
+        await (options.open ?? openBrowser)(authorizationURL.toString());
+    }
+    catch {
+        opened = false;
+    }
+    options.onAuthorizationURL?.(authorizationURL.toString(), opened);
+    const timeout = setTimeout(() => {
+        deadline.abort();
+        rejectLogin(new Error('Ardent CLI login timed out. Run ardent login to try again.'));
+    }, options.timeoutMs ?? LOGIN_TIMEOUT_MS);
+    try {
+        return await completion;
+    }
+    finally {
+        clearTimeout(timeout);
+        await new Promise((resolve) => {
+            server.close(() => resolve());
+            server.closeAllConnections();
+        });
+    }
+}
+async function exchange(code, verifier, signal) {
+    for (;;) {
+        try {
+            const result = await requestWithoutAuthentication('/auth/cli/exchange', {
+                body: JSON.stringify({ code, code_verifier: verifier }),
+                method: 'POST',
+                signal: AbortSignal.any([signal, AbortSignal.timeout(90_000)]),
+            });
+            if (typeof result.key !== 'string' || result.key.length === 0)
+                throw new Error('Ardent API returned an invalid CLI credential.');
+            return result.key;
+        }
+        catch (error) {
+            if (!(error instanceof APIError) || error.status !== 503 || error.code !== 'workflow_result_timeout')
+                throw error;
+            await wait(5000, undefined, { signal });
+        }
+    }
+}
+function randomValue() {
+    return randomBytes(32).toString('base64url');
+}
+function browserResponse(response, status, message, complete) {
+    response.writeHead(status, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' });
+    const escapedMessage = message.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;');
+    const succeeded = status < 400;
+    response.end(`<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Ardent CLI</title>
+  <style>
+    * { box-sizing: border-box; }
+    html { color-scheme: dark; }
+    body { margin: 0; background: #0a0a0a; color: #f4f4f5; font-family: "Helvetica Neue", Helvetica, sans-serif; }
+    header { display: flex; height: 48px; align-items: center; border-bottom: 1px solid #242424; padding: 0 20px; color: #d4d4d8; font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace; font-size: 12px; font-weight: 600; letter-spacing: .16em; }
+    main { min-height: calc(100vh - 48px); display: grid; place-items: center; padding: 24px; }
+    section { width: 100%; max-width: 400px; border: 1px solid #2a2a2a; background: #111; }
+    .content { padding: 24px; }
+    .status { display: flex; align-items: center; gap: 8px; margin-bottom: 16px; color: ${succeeded ? '#22c55e' : '#f87171'}; font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace; font-size: 12px; font-weight: 600; text-transform: uppercase; letter-spacing: .08em; }
+    .indicator { width: 7px; height: 7px; background: currentColor; }
+    h1 { margin: 0 0 8px; font-size: 24px; line-height: 1.2; letter-spacing: -.02em; }
+    p { margin: 0; color: #a1a1aa; font-size: 15px; line-height: 1.6; }
+  </style>
+</head>
+<body><header>ARDENT</header><main><section><div class="content"><div class="status"><span class="indicator"></span>${succeeded ? 'Connected' : 'Not connected'}</div><h1>${succeeded ? 'You\'re signed in' : 'Login failed'}</h1><p>${escapedMessage}</p></div></section></main></body>
+</html>`, complete);
+}
+async function openBrowser(url) {
+    const command = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'rundll32' : 'xdg-open';
+    const arguments_ = process.platform === 'win32' ? ['url.dll,FileProtocolHandler', url] : [url];
+    await new Promise((resolve, reject) => {
+        const child = spawn(command, arguments_, { detached: true, stdio: 'ignore' });
+        child.once('error', reject);
+        child.once('spawn', () => {
+            child.unref();
+            resolve();
+        });
+    });
+}

package/dist/auth/token.d.ts

@@ -2,4 +2,4 @@ export interface Organization {
     id: string;
     name: string;
 }
-export declare function loginWithToken(directory: string, value: string): Promise<Organization[]>;
+export declare function loginWithToken(directory: string, value: string, signal?: AbortSignal): Promise<Organization[]>;

package/dist/auth/token.js

@@ -1,10 +1,10 @@
 import { request } from '../api/client.js';
 import { saveSession } from './credentials.js';
-export async function loginWithToken(directory, value) {
+export async function loginWithToken(directory, value, signal) {
     const token = value.trim();
     if (!token)
         throw new Error('Ardent API token cannot be empty.');
-    const organizations = await request(token, '/organizations');
+    const organizations = await request(token, '/organizations', { signal });
     if (!Array.isArray(organizations) ||
         organizations.some((organization) => typeof organization !== 'object' ||
             organization === null ||
@@ -12,6 +12,7 @@ export async function loginWithToken(directory, value) {
             typeof organization.name !== 'string')) {
         throw new Error('Ardent API returned an invalid organization response.');
     }
+    signal?.throwIfAborted();
     await saveSession(directory, { token });
     return organizations;
 }

package/dist/cloud/source-credentials.d.ts

@@ -0,0 +1,18 @@
+export interface Target {
+    account: string;
+    region: string;
+    environment: string;
+    connector: string;
+    request: string;
+}
+type Run = (arguments_: string[], input?: string) => Promise<string>;
+export declare function validateCA(pem: string, now?: Date): string;
+export declare function parsePasswordDocument(raw: string): string;
+export declare function deliver(target: Target, ca: string, password: string, run?: Run): Promise<void>;
+export declare class AWSFailure extends Error {
+    readonly notFound: boolean;
+    constructor(notFound?: boolean);
+}
+export declare function account(run?: Run): Promise<string>;
+export declare function runAWS(arguments_: string[], input?: string, executable?: string, timeoutMilliseconds?: number): Promise<string>;
+export {};

package/dist/cloud/source-credentials.js

@@ -0,0 +1,143 @@
+import { spawn } from 'node:child_process';
+import { timingSafeEqual, X509Certificate } from 'node:crypto';
+const secretName = (target, suffix) => `ardent/${target.environment}/connectors/${target.connector}/${suffix}`;
+export function validateCA(pem, now = new Date()) {
+    if (Buffer.byteLength(pem) > 64 * 1024 || !pem.endsWith('\n'))
+        throw new Error('The source CA must be a newline-terminated PEM certificate under 64 KiB.');
+    if ((pem.match(/-----BEGIN CERTIFICATE-----/g) ?? []).length !== 1 || /PRIVATE KEY/.test(pem))
+        throw new Error('The source CA must contain exactly one certificate and no private key.');
+    let certificate;
+    try {
+        certificate = new X509Certificate(pem);
+    }
+    catch {
+        throw new Error('The source CA is not a valid PEM certificate.');
+    }
+    if (!certificate.ca || now < new Date(certificate.validFrom) || now >= new Date(certificate.validTo))
+        throw new Error('The source CA must be a currently valid certificate authority.');
+    return pem;
+}
+export function parsePasswordDocument(raw) {
+    if (Buffer.byteLength(raw) > 64 * 1024)
+        throw new Error('The source credential document is too large.');
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error('Standard input must be one JSON object containing password.');
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed) || Object.keys(parsed).length !== 1 || typeof parsed.password !== 'string' || parsed.password.length === 0 || parsed.password.includes('\0')) {
+        throw new Error('Standard input must be one JSON object containing a non-empty password and no other fields.');
+    }
+    return parsed.password;
+}
+export async function deliver(target, ca, password, run = runAWS) {
+    for (const [name, value] of [
+        [secretName(target, 'source-database-ca'), ca],
+        [secretName(target, 'source-database-password'), password],
+    ]) {
+        const description = await describe(run, target, name);
+        if (description !== undefined) {
+            const tags = new Map((description.Tags ?? []).map((tag) => [tag.Key, tag.Value]));
+            if (tags.get('ardent:credential-request') !== target.request || tags.get('ardent:environment') !== target.environment || tags.get('ardent:connector') !== target.connector) {
+                throw new Error(`The deterministic ${name.endsWith('-ca') ? 'CA' : 'password'} secret already belongs to another request.`);
+            }
+            const encodedExisting = await run(['secretsmanager', 'get-secret-value', '--region', target.region, '--secret-id', name, '--query', 'SecretString', '--output', 'json']);
+            let existing;
+            try {
+                existing = JSON.parse(encodedExisting);
+            }
+            catch {
+                throw new AWSFailure();
+            }
+            if (typeof existing !== 'string')
+                throw new AWSFailure();
+            const existingBytes = Buffer.from(existing);
+            const requestedBytes = Buffer.from(value);
+            if (existingBytes.length !== requestedBytes.length || !timingSafeEqual(existingBytes, requestedBytes)) {
+                throw new Error(`The deterministic ${name.endsWith('-ca') ? 'CA' : 'password'} secret already has different contents for this request.`);
+            }
+            continue;
+        }
+        await run([
+            'secretsmanager', 'create-secret', '--region', target.region, '--name', name,
+            '--secret-string', 'file:///dev/stdin', '--tags',
+            `Key=ardent:credential-request,Value=${target.request}`,
+            `Key=ardent:environment,Value=${target.environment}`,
+            `Key=ardent:connector,Value=${target.connector}`,
+            '--output', 'json',
+        ], value);
+    }
+}
+async function describe(run, target, name) {
+    try {
+        return JSON.parse(await run(['secretsmanager', 'describe-secret', '--region', target.region, '--secret-id', name, '--output', 'json']));
+    }
+    catch (error) {
+        if (error instanceof AWSFailure && error.notFound)
+            return undefined;
+        throw error;
+    }
+}
+export class AWSFailure extends Error {
+    notFound;
+    constructor(notFound = false) {
+        super(notFound ? 'The AWS secret does not exist.' : 'The AWS credential operation failed.');
+        this.notFound = notFound;
+    }
+}
+export async function account(run = runAWS) {
+    const value = (await run(['sts', 'get-caller-identity', '--query', 'Account', '--output', 'text'])).trim();
+    if (!/^\d{12}$/.test(value))
+        throw new Error('AWS returned an invalid account identity.');
+    return value;
+}
+export function runAWS(arguments_, input, executable = 'aws', timeoutMilliseconds = 30_000) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(executable, arguments_, { shell: false, stdio: ['pipe', 'pipe', 'pipe'] });
+        let settled = false;
+        let stdout = '';
+        let stderr = '';
+        let timeout;
+        const finish = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            if (timeout)
+                clearTimeout(timeout);
+            if (error)
+                reject(error);
+            else
+                resolve(stdout);
+        };
+        timeout = setTimeout(() => {
+            child.kill('SIGKILL');
+            finish(new AWSFailure());
+        }, timeoutMilliseconds);
+        const failInput = () => {
+            child.kill('SIGKILL');
+            finish(new AWSFailure());
+        };
+        child.stdout.setEncoding('utf8').on('data', (chunk) => {
+            if (stdout.length <= 128 * 1024)
+                stdout += chunk;
+        });
+        child.stderr.setEncoding('utf8').on('data', (chunk) => {
+            if (stderr.length <= 16 * 1024)
+                stderr += chunk;
+        });
+        child.on('error', () => finish(new AWSFailure()));
+        child.stdin.on('error', failInput);
+        child.on('close', (status) => {
+            if (status === 0 && Buffer.byteLength(stdout) <= 128 * 1024)
+                finish();
+            else
+                finish(new AWSFailure(/ResourceNotFoundException/.test(stderr)));
+        });
+        child.stdin.end(input, (error) => {
+            if (error)
+                failInput();
+        });
+    });
+}

package/dist/commands/connectors/credentials/set.d.ts

@@ -0,0 +1,20 @@
+import { ArdentCommand } from '../../../command.js';
+export default class SetSourceCredentials extends ArdentCommand {
+    static description: string;
+    static helpGroup: string;
+    static flags: {
+        organization: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        project: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        environment: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        connector: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        request: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'ca-file': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'password-stdin': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<{
+        connector: string;
+        environment: string;
+        account: string;
+        delivered: true;
+    }>;
+}

package/dist/commands/connectors/credentials/set.js

@@ -0,0 +1,59 @@
+import { Flags } from '@oclif/core';
+import { readFile } from 'node:fs/promises';
+import { request } from '../../../api/client.js';
+import { loadSession } from '../../../auth/credentials.js';
+import { account, deliver, parsePasswordDocument, validateCA } from '../../../cloud/source-credentials.js';
+import { ArdentCommand } from '../../../command.js';
+export default class SetSourceCredentials extends ArdentCommand {
+    static description = 'Deliver a connector password and source CA directly to its environment AWS account';
+    static helpGroup = 'Connectors';
+    static flags = {
+        organization: Flags.string({ required: true, description: 'Owning Ardent organization ID' }),
+        project: Flags.string({ required: true, description: 'Owning Ardent project ID' }),
+        environment: Flags.string({ required: true, description: 'Target Ardent environment ID' }),
+        connector: Flags.string({ required: true, description: 'Target Ardent connector ID' }),
+        request: Flags.string({ required: true, description: 'Stable UUID for safe retries' }),
+        'ca-file': Flags.string({ required: true, description: 'PEM source certificate-authority file' }),
+        'password-stdin': Flags.boolean({ required: true, description: 'Read {"password":"…"} from standard input' }),
+    };
+    async run() {
+        const { flags } = await this.parse(SetSourceCredentials);
+        const uuid = '[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}';
+        if (!new RegExp(`^environment_${uuid}$`).test(flags.environment) || !new RegExp(`^connector_${uuid}$`).test(flags.connector) || !new RegExp(`^${uuid}$`).test(flags.request))
+            this.error('Environment, connector, or request identity is invalid.');
+        const session = await loadSession(this.config.configDir);
+        if (!session)
+            this.error('Log in before delivering source credentials.');
+        const connectors = await request(session.token, `/connectors?organization_id=${encodeURIComponent(flags.organization)}&project_id=${encodeURIComponent(flags.project)}`);
+        if (!connectors.some((connector) => connector.id === flags.connector && connector.environment_id === flags.environment))
+            this.error('The selected connector does not belong to the selected project and environment.');
+        const environments = await request(session.token, `/connector-environments?organization_id=${encodeURIComponent(flags.organization)}&project_id=${encodeURIComponent(flags.project)}`);
+        const environment = environments.find((candidate) => candidate.id === flags.environment);
+        if (!environment || !/^\d{12}$/.test(environment.cloud_account_id) || !/^[a-z]{2}(?:-gov)?-[a-z]+-\d$/.test(environment.cloud_region))
+            this.error('The selected environment has no authoritative AWS placement.');
+        const actualAccount = await account();
+        if (actualAccount !== environment.cloud_account_id)
+            this.error(`AWS is authenticated to account ${actualAccount}, not the environment account ${environment.cloud_account_id}.`);
+        const ca = validateCA(await readFile(flags['ca-file'], 'utf8'));
+        const input = await readStdin();
+        const password = parsePasswordDocument(input);
+        if (!this.jsonEnabled())
+            this.log(`Delivering source credentials for ${flags.connector} in ${flags.environment} to AWS account ${environment.cloud_account_id} (${environment.cloud_region})`);
+        await deliver({ account: environment.cloud_account_id, region: environment.cloud_region, environment: flags.environment, connector: flags.connector, request: flags.request }, ca, password);
+        if (!this.jsonEnabled())
+            this.log('✓ Source password and CA delivered');
+        return { connector: flags.connector, environment: flags.environment, account: environment.cloud_account_id, delivered: true };
+    }
+}
+async function readStdin() {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of process.stdin) {
+        const value = Buffer.from(chunk);
+        size += value.length;
+        if (size > 64 * 1024)
+            throw new Error('The source credential document is too large.');
+        chunks.push(value);
+    }
+    return Buffer.concat(chunks).toString('utf8');
+}

package/dist/commands/login.js

@@ -1,4 +1,5 @@
 import { Flags } from '@oclif/core';
+import { loginWithBrowser } from '../auth/browser.js';
 import { loginWithToken } from '../auth/token.js';
 import { ArdentCommand } from '../command.js';
 export default class Login extends ArdentCommand {
@@ -9,16 +10,19 @@ export default class Login extends ArdentCommand {
     };
     async run() {
         const { flags } = await this.parse(Login);
-        if (!flags.token)
-            this.error('Interactive login is not implemented yet.');
-        const organizations = await loginWithToken(this.config.configDir, flags.token);
-        if (!this.jsonEnabled()) {
-            this.log('✓ Logged in to Ardent');
-            if (organizations.length === 1)
-                this.log(`  Organization: ${organizations[0].name} (${organizations[0].id})`);
-            else
-                this.log(`  Organizations: ${organizations.length}`);
-        }
+        const organizations = flags.token
+            ? await loginWithToken(this.config.configDir, flags.token)
+            : await loginWithBrowser(this.config.configDir, {
+                onAuthorizationURL: (url, opened) => {
+                    this.log(opened ? 'Opening Ardent in your browser…' : `Open this URL to log in:\n\n${url}`);
+                    this.log('Complete login in your browser. Keep this terminal open.');
+                },
+            });
+        this.log('✓ Logged in to Ardent');
+        if (organizations.length === 1)
+            this.log(`  Organization: ${organizations[0].name} (${organizations[0].id})`);
+        else
+            this.log(`  Organizations: ${organizations.length}`);
         return { authenticated: true, organizations };
     }
 }

package/oclif.manifest.json

@@ -94,7 +94,93 @@
         "commands",
         "status.js"
       ]
+    },
+    "connectors:credentials:set": {
+      "aliases": [],
+      "args": {},
+      "description": "Deliver a connector password and source CA directly to its environment AWS account",
+      "flags": {
+        "json": {
+          "description": "Format output as json.",
+          "helpGroup": "GLOBAL",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "organization": {
+          "description": "Owning Ardent organization ID",
+          "name": "organization",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "project": {
+          "description": "Owning Ardent project ID",
+          "name": "project",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "environment": {
+          "description": "Target Ardent environment ID",
+          "name": "environment",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "connector": {
+          "description": "Target Ardent connector ID",
+          "name": "connector",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "request": {
+          "description": "Stable UUID for safe retries",
+          "name": "request",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "ca-file": {
+          "description": "PEM source certificate-authority file",
+          "name": "ca-file",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "password-stdin": {
+          "description": "Read {\"password\":\"…\"} from standard input",
+          "name": "password-stdin",
+          "required": true,
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "connectors:credentials:set",
+      "pluginAlias": "ardent-cli-beta",
+      "pluginName": "ardent-cli-beta",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": true,
+      "helpGroup": "Connectors",
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "connectors",
+        "credentials",
+        "set.js"
+      ]
     }
   },
-  "version": "0.0.4"
+  "version": "0.0.6"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ardent-cli-beta",
-  "version": "0.0.4",
+  "version": "0.0.6",
   "description": "The Ardent command-line interface",
   "license": "Apache-2.0",
   "type": "module",