gigabuddy 0.0.1

package/README.md

@@ -0,0 +1,61 @@
+# gigabuddy
+
+The Gigabuddy CLI. Sign in, and install `@gigabuddy` packages as yourself.
+
+```bash
+npm install -g gigabuddy      # or: npx gigabuddy login --npm
+
+gigabuddy login --npm
+npm install @gigabuddy/app-kit
+```
+
+That's the whole onboarding. `login --npm` signs you in if you haven't already,
+so there is no two-step dance.
+
+## Commands
+
+| Command                 | What it does                                              |
+| ----------------------- | --------------------------------------------------------- |
+| `gigabuddy login`       | Sign in (device flow — opens your browser)                |
+| `gigabuddy login --npm` | Set up `~/.npmrc` to install `@gigabuddy` packages as you |
+| `gigabuddy status`      | Who you're signed in as                                   |
+| `gigabuddy logout`      | Sign out (`--npm` clears only the npm credential)         |
+
+`--staging` targets the staging environment; its credentials are stored
+separately, so a staging login never becomes your production one.
+
+## What lands on disk
+
+`login` stores a **refresh token** in `~/.gigabuddy/credentials.json` (0600).
+Platform tokens are minted from it on demand and live an hour, so nothing
+long-lived and fully-authoritative sits on your filesystem.
+
+`login --npm` adds two lines to `~/.npmrc` (0600), leaving everything else in
+that file exactly where it was:
+
+```
+@gigabuddy:registry=https://npm.gigabuddy.com/
+//npm.gigabuddy.com/:_authToken=<registry credential>
+```
+
+**That credential is registry-scoped.** It can install what you can install and
+nothing else on the platform — because `.npmrc` is a file that ends up in CI
+logs and is readable by every postinstall script that runs on your machine. It
+lives 30 days (npm has nowhere to put a token refresh), and it dies with your
+session: signing out, or an admin revoking the session, stops installs within
+about a minute. Re-run `gigabuddy login --npm` to get a fresh one.
+
+Which packages you can install is decided per install, against your own access —
+the credential only proves who you are.
+
+## Scope
+
+This CLI does authentication and local setup, and nothing else. Gigabuddy's
+capabilities live behind hosted APIs; this is how you prove who you are to them.
+
+Requires Node 20+. No dependencies.
+
+---
+
+Internal notes for maintainers live in `NOTES.md` in the source repo — they are
+deliberately not shipped in this package.

package/bin/cli.js

@@ -0,0 +1,431 @@
+#!/usr/bin/env node
+
+// libs/gigabuddy/src/bin/cli.ts
+import { readFileSync as readFileSync3 } from "node:fs";
+import { dirname, join as join3 } from "node:path";
+import { fileURLToPath } from "node:url";
+import { parseArgs } from "node:util";
+
+// libs/client-core/dist/lib/credentials.js
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+var CONFIG_DIR = path.join(os.homedir(), ".gigabuddy");
+var USER_CREDENTIALS_FILE = path.join(CONFIG_DIR, "credentials.json");
+var USER_STAGING_CREDENTIALS_FILE = path.join(CONFIG_DIR, "credentials.staging.json");
+function getUserCredentialsPath(staging = false) {
+  return staging ? USER_STAGING_CREDENTIALS_FILE : USER_CREDENTIALS_FILE;
+}
+function loadUserCredentials(staging = false) {
+  try {
+    const content = fs.readFileSync(getUserCredentialsPath(staging), "utf-8");
+    const raw = JSON.parse(content);
+    return raw.refreshToken ? raw : null;
+  } catch {
+    return null;
+  }
+}
+function saveUserCredentials(credentials, staging = false) {
+  if (!fs.existsSync(CONFIG_DIR)) {
+    fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
+  }
+  writePrivateFile(getUserCredentialsPath(staging), JSON.stringify(credentials, null, 2));
+}
+function clearUserCredentials(staging = false) {
+  const file = getUserCredentialsPath(staging);
+  if (fs.existsSync(file)) {
+    fs.unlinkSync(file);
+  }
+}
+function writePrivateFile(file, contents) {
+  fs.writeFileSync(file, contents, { mode: 384 });
+  try {
+    fs.chmodSync(file, 384);
+  } catch {
+  }
+}
+
+// libs/client-core/dist/lib/device-flow.js
+async function openBrowser(url) {
+  const { exec } = await import("node:child_process");
+  const { promisify } = await import("node:util");
+  const execAsync = promisify(exec);
+  const platform = process.platform;
+  const command = platform === "darwin" ? `open "${url}"` : platform === "win32" ? `start "" "${url}"` : `xdg-open "${url}"`;
+  await execAsync(command);
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function deviceLogin(options) {
+  const { authUrl } = options;
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const startRes = await fetchImpl(`${authUrl}/api/auth/device/start`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      clientId: options.clientId ?? "gigabuddy-cli",
+      productId: options.productId ?? "gigabuddy/studio"
+    })
+  });
+  if (!startRes.ok) {
+    throw new Error(`Failed to start device flow: ${await startRes.text()}`);
+  }
+  const { deviceCode, userCode, verificationUrl, expiresIn, interval } = await startRes.json();
+  options.onPrompt?.({ verificationUrl, userCode });
+  (options.openBrowserImpl ?? openBrowser)(verificationUrl).catch(() => void 0);
+  const deadline = Date.now() + expiresIn * 1e3;
+  const pollInterval = (interval || 5) * 1e3;
+  while (Date.now() < deadline) {
+    await sleep(pollInterval);
+    const pollRes = await fetchImpl(`${authUrl}/api/auth/device/poll`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ deviceCode })
+    });
+    if (pollRes.status === 429) {
+      await sleep(pollInterval);
+      continue;
+    }
+    if (!pollRes.ok)
+      continue;
+    const pollData = await pollRes.json();
+    if (pollData.status === "complete" && pollData.platformToken && pollData.refreshToken && pollData.userId) {
+      return {
+        refreshToken: pollData.refreshToken,
+        platformToken: pollData.platformToken,
+        userId: pollData.userId
+      };
+    }
+    if (pollData.status === "expired") {
+      throw new Error("Device code expired. Please try again.");
+    }
+    options.onPending?.();
+  }
+  throw new Error("Authentication timed out. Please try again.");
+}
+
+// libs/client-core/dist/lib/npmrc.js
+function registryAuthKey(registryUrl) {
+  const url = new URL(registryUrl);
+  const path3 = url.pathname.replace(/\/+$/, "");
+  return `//${url.host}${path3}/:_authToken`;
+}
+function scopeRegistryKey(scope) {
+  return `${scope}:registry`;
+}
+function normalizedRegistryUrl(registryUrl) {
+  return registryUrl.replace(/\/+$/, "") + "/";
+}
+function upsertNpmrc(existing, entries) {
+  const registryUrl = normalizedRegistryUrl(entries.registryUrl);
+  const desired = /* @__PURE__ */ new Map([
+    [scopeRegistryKey(entries.scope).toLowerCase(), `${scopeRegistryKey(entries.scope)}=${registryUrl}`],
+    [registryAuthKey(registryUrl).toLowerCase(), `${registryAuthKey(registryUrl)}=${entries.token}`]
+  ]);
+  const lines = existing.length > 0 ? existing.split("\n") : [];
+  const written = /* @__PURE__ */ new Set();
+  const merged = lines.map((line) => {
+    const key = lineKey(line);
+    if (key && desired.has(key) && !written.has(key)) {
+      written.add(key);
+      return desired.get(key);
+    }
+    return line;
+  });
+  const additions = [...desired.entries()].filter(([key]) => !written.has(key)).map(([, line]) => line);
+  if (additions.length === 0)
+    return merged.join("\n");
+  while (merged.length > 0 && merged[merged.length - 1].trim() === "")
+    merged.pop();
+  return [...merged, ...additions, ""].join("\n");
+}
+function removeNpmrcEntries(existing, entries) {
+  const registryUrl = normalizedRegistryUrl(entries.registryUrl);
+  const drop = /* @__PURE__ */ new Set([scopeRegistryKey(entries.scope).toLowerCase(), registryAuthKey(registryUrl).toLowerCase()]);
+  const kept = existing.split("\n").filter((line) => {
+    const key = lineKey(line);
+    return !(key && drop.has(key));
+  });
+  const text = kept.join("\n");
+  return text.trim().length === 0 ? "" : text;
+}
+function lineKey(line) {
+  const trimmed = line.trim();
+  if (trimmed.length === 0 || trimmed.startsWith("#") || trimmed.startsWith(";"))
+    return null;
+  const eq = trimmed.indexOf("=");
+  if (eq === -1)
+    return null;
+  return trimmed.slice(0, eq).trim().toLowerCase();
+}
+
+// libs/client-core/dist/lib/registry-credential.js
+import * as fs2 from "node:fs";
+import * as os2 from "node:os";
+import * as path2 from "node:path";
+var GIGABUDDY_NPM_SCOPE = "@gigabuddy";
+async function mintRegistryCredential(options) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const res = await fetchImpl(`${options.authUrl}/api/token/registry`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ refreshToken: options.refreshToken })
+  });
+  if (!res.ok) {
+    throw new Error(`Could not mint a registry credential (${res.status}): ${await res.text()}`);
+  }
+  const data = await res.json();
+  if (!data.token || !data.registryUrl) {
+    throw new Error("Auth returned an incomplete registry credential");
+  }
+  return { token: data.token, expiresIn: data.expiresIn ?? 0, registryUrl: data.registryUrl };
+}
+function npmrcPath() {
+  return process.env["NPM_CONFIG_USERCONFIG"] ?? path2.join(os2.homedir(), ".npmrc");
+}
+function readNpmrc(file) {
+  try {
+    return fs2.readFileSync(file, "utf-8");
+  } catch {
+    return "";
+  }
+}
+function writeRegistryCredentialToNpmrc(credential, file = npmrcPath()) {
+  const updated = upsertNpmrc(readNpmrc(file), {
+    scope: GIGABUDDY_NPM_SCOPE,
+    registryUrl: credential.registryUrl,
+    token: credential.token
+  });
+  writePrivateFile(file, updated);
+  return file;
+}
+function removeRegistryCredentialFromNpmrc(registryUrl, file = npmrcPath()) {
+  const existing = readNpmrc(file);
+  const updated = removeNpmrcEntries(existing, { scope: GIGABUDDY_NPM_SCOPE, registryUrl });
+  if (updated === existing)
+    return null;
+  writePrivateFile(file, updated);
+  return file;
+}
+
+// libs/gigabuddy/src/lib/commands.ts
+var PRODUCTION_AUTH_URL = "https://auth.gigabuddy.com";
+var PRODUCTION_API_URL = "https://api.gigabuddy.com";
+var STAGING_AUTH_URL = "https://auth.staging.gigabuddy.com";
+var STAGING_API_URL = "https://api.staging.gigabuddy.com";
+function resolveEnv(options) {
+  const staging = options.staging ?? false;
+  return {
+    staging,
+    authUrl: options.authUrl ?? (staging ? STAGING_AUTH_URL : PRODUCTION_AUTH_URL),
+    apiUrl: options.apiUrl ?? (staging ? STAGING_API_URL : PRODUCTION_API_URL)
+  };
+}
+function say(line = "") {
+  console.error(line);
+}
+async function signIn(env) {
+  say(`Signing in to ${env.staging ? "Gigabuddy Staging" : "Gigabuddy"}\u2026`);
+  const result = await deviceLogin({
+    authUrl: env.authUrl,
+    apiUrl: env.apiUrl,
+    clientId: "gigabuddy-cli",
+    onPrompt: ({ verificationUrl, userCode }) => {
+      say();
+      say(`  Open: ${verificationUrl}`);
+      say(`  Code: ${userCode}`);
+      say();
+    },
+    onPending: () => process.stderr.write(".")
+  });
+  const credentials = {
+    refreshToken: result.refreshToken,
+    userId: result.userId,
+    userEmail: result.userEmail,
+    authUrl: env.authUrl,
+    apiUrl: env.apiUrl,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  saveUserCredentials(credentials, env.staging);
+  return credentials;
+}
+async function loginCommand(env) {
+  const credentials = await signIn(env);
+  say();
+  say("  Signed in.");
+  if (credentials.userEmail)
+    say(`  Account: ${credentials.userEmail}`);
+  say(`  Saved to: ${getUserCredentialsPath(env.staging)}`);
+  say();
+  say("  Next:  gigabuddy login --npm     (to install @gigabuddy packages)");
+}
+function describeValidity(expiresIn) {
+  if (expiresIn <= 0)
+    return "";
+  const days = Math.round(expiresIn / 86400);
+  return days >= 1 ? ` (valid ~${days} days)` : ` (valid ${Math.round(expiresIn / 3600)}h)`;
+}
+async function npmLoginCommand(env) {
+  let credentials = loadUserCredentials(env.staging);
+  if (!credentials) {
+    say("Not signed in yet \u2014 signing in first.");
+    say();
+    credentials = await signIn(env);
+    say();
+    say("  Signed in.");
+  }
+  const credential = await mintRegistryCredential({
+    authUrl: credentials.authUrl,
+    refreshToken: credentials.refreshToken
+  });
+  const file = writeRegistryCredentialToNpmrc(credential);
+  say();
+  say(`  npm is set up for ${GIGABUDDY_NPM_SCOPE} packages${describeValidity(credential.expiresIn)}`);
+  say(`  Registry: ${credential.registryUrl}`);
+  say(`  Written to: ${file}`);
+  say();
+  say(`  Try it:  npm install ${GIGABUDDY_NPM_SCOPE}/app-kit`);
+  say();
+  say("  This credential is registry-only \u2014 it installs what you can install and nothing else.");
+  say("  Run this again when it expires, or after your access changes.");
+}
+function registryUrlFor(staging) {
+  const creds = loadUserCredentials(staging);
+  const fromEnv = process.env["GIGABUDDY_NPM_REGISTRY_URL"];
+  if (fromEnv)
+    return fromEnv;
+  return creds?.authUrl.includes("staging") ? "https://npm.staging.gigabuddy.com" : "https://npm.gigabuddy.com";
+}
+function npmLogoutCommand(env) {
+  const file = removeRegistryCredentialFromNpmrc(registryUrlFor(env.staging));
+  if (!file) {
+    say(`No ${GIGABUDDY_NPM_SCOPE} registry entries found in ${npmrcPath()}`);
+    return;
+  }
+  say(`Removed ${GIGABUDDY_NPM_SCOPE} registry credentials from ${file}`);
+}
+function logoutCommand(env) {
+  npmLogoutCommand(env);
+  if (!loadUserCredentials(env.staging)) {
+    say("Not signed in.");
+    return;
+  }
+  clearUserCredentials(env.staging);
+  say(`Signed out${env.staging ? " of staging" : ""}.`);
+}
+function statusCommand() {
+  const production = loadUserCredentials(false);
+  const staging = loadUserCredentials(true);
+  if (!production && !staging) {
+    say("Not signed in.");
+    say();
+    say("  gigabuddy login");
+    return;
+  }
+  for (const [label, creds] of [
+    ["Production", production],
+    ["Staging", staging]
+  ]) {
+    if (!creds)
+      continue;
+    say(`${label}:`);
+    say(`  Account: ${creds.userEmail ?? creds.userId}`);
+    say(`  Since: ${creds.createdAt}`);
+  }
+}
+
+// libs/gigabuddy/src/bin/cli.ts
+function version() {
+  try {
+    const pkgPath = join3(dirname(fileURLToPath(import.meta.url)), "..", "package.json");
+    return JSON.parse(readFileSync3(pkgPath, "utf-8")).version;
+  } catch {
+    return "unknown";
+  }
+}
+function showHelp() {
+  console.error(`
+gigabuddy \u2014 the Gigabuddy CLI
+
+Usage:
+  gigabuddy <command> [options]
+
+Commands:
+  login              Sign in (opens your browser)
+  login --npm        Set up npm to install @gigabuddy packages as you
+  logout             Sign out (--npm clears only the npm credential)
+  status             Show who you are signed in as
+
+Options:
+  --npm              Act on npm registry access in ~/.npmrc
+  --staging          Use the staging environment
+  --auth-url         Auth URL override
+  --api-url          API URL override
+  -v, --version      Show version
+  -h, --help         Show this help
+
+Installing packages:
+  gigabuddy login --npm
+  npm install @gigabuddy/app-kit
+
+  The npm credential is registry-scoped: it installs what you can install,
+  and cannot do anything else on the platform.
+`);
+}
+async function main() {
+  const { values, positionals } = parseArgs({
+    options: {
+      npm: { type: "boolean" },
+      staging: { type: "boolean" },
+      "auth-url": { type: "string" },
+      "api-url": { type: "string" },
+      help: { type: "boolean", short: "h" },
+      version: { type: "boolean", short: "v" }
+    },
+    allowPositionals: true
+  });
+  if (values.version) {
+    console.log(`gigabuddy v${version()}`);
+    return;
+  }
+  const command = positionals[0];
+  if (values.help || !command) {
+    showHelp();
+    process.exitCode = values.help ? 0 : 1;
+    return;
+  }
+  const env = resolveEnv({
+    staging: values.staging,
+    authUrl: values["auth-url"],
+    apiUrl: values["api-url"]
+  });
+  switch (command) {
+    case "login":
+      if (values.npm)
+        await npmLoginCommand(env);
+      else
+        await loginCommand(env);
+      return;
+    case "logout":
+      if (values.npm)
+        npmLogoutCommand(env);
+      else
+        logoutCommand(env);
+      return;
+    case "status":
+      statusCommand();
+      return;
+    default:
+      console.error(`Unknown command: ${command}`);
+      console.error("");
+      showHelp();
+      process.exitCode = 1;
+  }
+}
+main().catch((error) => {
+  console.error("");
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/index.js

@@ -0,0 +1,342 @@
+// libs/client-core/dist/lib/credentials.js
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+var CONFIG_DIR = path.join(os.homedir(), ".gigabuddy");
+var USER_CREDENTIALS_FILE = path.join(CONFIG_DIR, "credentials.json");
+var USER_STAGING_CREDENTIALS_FILE = path.join(CONFIG_DIR, "credentials.staging.json");
+function getUserCredentialsPath(staging = false) {
+  return staging ? USER_STAGING_CREDENTIALS_FILE : USER_CREDENTIALS_FILE;
+}
+function loadUserCredentials(staging = false) {
+  try {
+    const content = fs.readFileSync(getUserCredentialsPath(staging), "utf-8");
+    const raw = JSON.parse(content);
+    return raw.refreshToken ? raw : null;
+  } catch {
+    return null;
+  }
+}
+function saveUserCredentials(credentials, staging = false) {
+  if (!fs.existsSync(CONFIG_DIR)) {
+    fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
+  }
+  writePrivateFile(getUserCredentialsPath(staging), JSON.stringify(credentials, null, 2));
+}
+function clearUserCredentials(staging = false) {
+  const file = getUserCredentialsPath(staging);
+  if (fs.existsSync(file)) {
+    fs.unlinkSync(file);
+  }
+}
+function writePrivateFile(file, contents) {
+  fs.writeFileSync(file, contents, { mode: 384 });
+  try {
+    fs.chmodSync(file, 384);
+  } catch {
+  }
+}
+
+// libs/client-core/dist/lib/device-flow.js
+async function openBrowser(url) {
+  const { exec } = await import("node:child_process");
+  const { promisify } = await import("node:util");
+  const execAsync = promisify(exec);
+  const platform = process.platform;
+  const command = platform === "darwin" ? `open "${url}"` : platform === "win32" ? `start "" "${url}"` : `xdg-open "${url}"`;
+  await execAsync(command);
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function deviceLogin(options) {
+  const { authUrl } = options;
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const startRes = await fetchImpl(`${authUrl}/api/auth/device/start`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      clientId: options.clientId ?? "gigabuddy-cli",
+      productId: options.productId ?? "gigabuddy/studio"
+    })
+  });
+  if (!startRes.ok) {
+    throw new Error(`Failed to start device flow: ${await startRes.text()}`);
+  }
+  const { deviceCode, userCode, verificationUrl, expiresIn, interval } = await startRes.json();
+  options.onPrompt?.({ verificationUrl, userCode });
+  (options.openBrowserImpl ?? openBrowser)(verificationUrl).catch(() => void 0);
+  const deadline = Date.now() + expiresIn * 1e3;
+  const pollInterval = (interval || 5) * 1e3;
+  while (Date.now() < deadline) {
+    await sleep(pollInterval);
+    const pollRes = await fetchImpl(`${authUrl}/api/auth/device/poll`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ deviceCode })
+    });
+    if (pollRes.status === 429) {
+      await sleep(pollInterval);
+      continue;
+    }
+    if (!pollRes.ok)
+      continue;
+    const pollData = await pollRes.json();
+    if (pollData.status === "complete" && pollData.platformToken && pollData.refreshToken && pollData.userId) {
+      return {
+        refreshToken: pollData.refreshToken,
+        platformToken: pollData.platformToken,
+        userId: pollData.userId
+      };
+    }
+    if (pollData.status === "expired") {
+      throw new Error("Device code expired. Please try again.");
+    }
+    options.onPending?.();
+  }
+  throw new Error("Authentication timed out. Please try again.");
+}
+
+// libs/client-core/dist/lib/npmrc.js
+function registryAuthKey(registryUrl) {
+  const url = new URL(registryUrl);
+  const path3 = url.pathname.replace(/\/+$/, "");
+  return `//${url.host}${path3}/:_authToken`;
+}
+function scopeRegistryKey(scope) {
+  return `${scope}:registry`;
+}
+function normalizedRegistryUrl(registryUrl) {
+  return registryUrl.replace(/\/+$/, "") + "/";
+}
+function upsertNpmrc(existing, entries) {
+  const registryUrl = normalizedRegistryUrl(entries.registryUrl);
+  const desired = /* @__PURE__ */ new Map([
+    [scopeRegistryKey(entries.scope).toLowerCase(), `${scopeRegistryKey(entries.scope)}=${registryUrl}`],
+    [registryAuthKey(registryUrl).toLowerCase(), `${registryAuthKey(registryUrl)}=${entries.token}`]
+  ]);
+  const lines = existing.length > 0 ? existing.split("\n") : [];
+  const written = /* @__PURE__ */ new Set();
+  const merged = lines.map((line) => {
+    const key = lineKey(line);
+    if (key && desired.has(key) && !written.has(key)) {
+      written.add(key);
+      return desired.get(key);
+    }
+    return line;
+  });
+  const additions = [...desired.entries()].filter(([key]) => !written.has(key)).map(([, line]) => line);
+  if (additions.length === 0)
+    return merged.join("\n");
+  while (merged.length > 0 && merged[merged.length - 1].trim() === "")
+    merged.pop();
+  return [...merged, ...additions, ""].join("\n");
+}
+function removeNpmrcEntries(existing, entries) {
+  const registryUrl = normalizedRegistryUrl(entries.registryUrl);
+  const drop = /* @__PURE__ */ new Set([scopeRegistryKey(entries.scope).toLowerCase(), registryAuthKey(registryUrl).toLowerCase()]);
+  const kept = existing.split("\n").filter((line) => {
+    const key = lineKey(line);
+    return !(key && drop.has(key));
+  });
+  const text = kept.join("\n");
+  return text.trim().length === 0 ? "" : text;
+}
+function lineKey(line) {
+  const trimmed = line.trim();
+  if (trimmed.length === 0 || trimmed.startsWith("#") || trimmed.startsWith(";"))
+    return null;
+  const eq = trimmed.indexOf("=");
+  if (eq === -1)
+    return null;
+  return trimmed.slice(0, eq).trim().toLowerCase();
+}
+
+// libs/client-core/dist/lib/registry-credential.js
+import * as fs2 from "node:fs";
+import * as os2 from "node:os";
+import * as path2 from "node:path";
+var GIGABUDDY_NPM_SCOPE = "@gigabuddy";
+async function mintRegistryCredential(options) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const res = await fetchImpl(`${options.authUrl}/api/token/registry`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ refreshToken: options.refreshToken })
+  });
+  if (!res.ok) {
+    throw new Error(`Could not mint a registry credential (${res.status}): ${await res.text()}`);
+  }
+  const data = await res.json();
+  if (!data.token || !data.registryUrl) {
+    throw new Error("Auth returned an incomplete registry credential");
+  }
+  return { token: data.token, expiresIn: data.expiresIn ?? 0, registryUrl: data.registryUrl };
+}
+function npmrcPath() {
+  return process.env["NPM_CONFIG_USERCONFIG"] ?? path2.join(os2.homedir(), ".npmrc");
+}
+function readNpmrc(file) {
+  try {
+    return fs2.readFileSync(file, "utf-8");
+  } catch {
+    return "";
+  }
+}
+function writeRegistryCredentialToNpmrc(credential, file = npmrcPath()) {
+  const updated = upsertNpmrc(readNpmrc(file), {
+    scope: GIGABUDDY_NPM_SCOPE,
+    registryUrl: credential.registryUrl,
+    token: credential.token
+  });
+  writePrivateFile(file, updated);
+  return file;
+}
+function removeRegistryCredentialFromNpmrc(registryUrl, file = npmrcPath()) {
+  const existing = readNpmrc(file);
+  const updated = removeNpmrcEntries(existing, { scope: GIGABUDDY_NPM_SCOPE, registryUrl });
+  if (updated === existing)
+    return null;
+  writePrivateFile(file, updated);
+  return file;
+}
+
+// libs/gigabuddy/src/lib/commands.ts
+var PRODUCTION_AUTH_URL = "https://auth.gigabuddy.com";
+var PRODUCTION_API_URL = "https://api.gigabuddy.com";
+var STAGING_AUTH_URL = "https://auth.staging.gigabuddy.com";
+var STAGING_API_URL = "https://api.staging.gigabuddy.com";
+function resolveEnv(options) {
+  const staging = options.staging ?? false;
+  return {
+    staging,
+    authUrl: options.authUrl ?? (staging ? STAGING_AUTH_URL : PRODUCTION_AUTH_URL),
+    apiUrl: options.apiUrl ?? (staging ? STAGING_API_URL : PRODUCTION_API_URL)
+  };
+}
+function say(line = "") {
+  console.error(line);
+}
+async function signIn(env) {
+  say(`Signing in to ${env.staging ? "Gigabuddy Staging" : "Gigabuddy"}\u2026`);
+  const result = await deviceLogin({
+    authUrl: env.authUrl,
+    apiUrl: env.apiUrl,
+    clientId: "gigabuddy-cli",
+    onPrompt: ({ verificationUrl, userCode }) => {
+      say();
+      say(`  Open: ${verificationUrl}`);
+      say(`  Code: ${userCode}`);
+      say();
+    },
+    onPending: () => process.stderr.write(".")
+  });
+  const credentials = {
+    refreshToken: result.refreshToken,
+    userId: result.userId,
+    userEmail: result.userEmail,
+    authUrl: env.authUrl,
+    apiUrl: env.apiUrl,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  saveUserCredentials(credentials, env.staging);
+  return credentials;
+}
+async function loginCommand(env) {
+  const credentials = await signIn(env);
+  say();
+  say("  Signed in.");
+  if (credentials.userEmail)
+    say(`  Account: ${credentials.userEmail}`);
+  say(`  Saved to: ${getUserCredentialsPath(env.staging)}`);
+  say();
+  say("  Next:  gigabuddy login --npm     (to install @gigabuddy packages)");
+}
+function describeValidity(expiresIn) {
+  if (expiresIn <= 0)
+    return "";
+  const days = Math.round(expiresIn / 86400);
+  return days >= 1 ? ` (valid ~${days} days)` : ` (valid ${Math.round(expiresIn / 3600)}h)`;
+}
+async function npmLoginCommand(env) {
+  let credentials = loadUserCredentials(env.staging);
+  if (!credentials) {
+    say("Not signed in yet \u2014 signing in first.");
+    say();
+    credentials = await signIn(env);
+    say();
+    say("  Signed in.");
+  }
+  const credential = await mintRegistryCredential({
+    authUrl: credentials.authUrl,
+    refreshToken: credentials.refreshToken
+  });
+  const file = writeRegistryCredentialToNpmrc(credential);
+  say();
+  say(`  npm is set up for ${GIGABUDDY_NPM_SCOPE} packages${describeValidity(credential.expiresIn)}`);
+  say(`  Registry: ${credential.registryUrl}`);
+  say(`  Written to: ${file}`);
+  say();
+  say(`  Try it:  npm install ${GIGABUDDY_NPM_SCOPE}/app-kit`);
+  say();
+  say("  This credential is registry-only \u2014 it installs what you can install and nothing else.");
+  say("  Run this again when it expires, or after your access changes.");
+}
+function registryUrlFor(staging) {
+  const creds = loadUserCredentials(staging);
+  const fromEnv = process.env["GIGABUDDY_NPM_REGISTRY_URL"];
+  if (fromEnv)
+    return fromEnv;
+  return creds?.authUrl.includes("staging") ? "https://npm.staging.gigabuddy.com" : "https://npm.gigabuddy.com";
+}
+function npmLogoutCommand(env) {
+  const file = removeRegistryCredentialFromNpmrc(registryUrlFor(env.staging));
+  if (!file) {
+    say(`No ${GIGABUDDY_NPM_SCOPE} registry entries found in ${npmrcPath()}`);
+    return;
+  }
+  say(`Removed ${GIGABUDDY_NPM_SCOPE} registry credentials from ${file}`);
+}
+function logoutCommand(env) {
+  npmLogoutCommand(env);
+  if (!loadUserCredentials(env.staging)) {
+    say("Not signed in.");
+    return;
+  }
+  clearUserCredentials(env.staging);
+  say(`Signed out${env.staging ? " of staging" : ""}.`);
+}
+function statusCommand() {
+  const production = loadUserCredentials(false);
+  const staging = loadUserCredentials(true);
+  if (!production && !staging) {
+    say("Not signed in.");
+    say();
+    say("  gigabuddy login");
+    return;
+  }
+  for (const [label, creds] of [
+    ["Production", production],
+    ["Staging", staging]
+  ]) {
+    if (!creds)
+      continue;
+    say(`${label}:`);
+    say(`  Account: ${creds.userEmail ?? creds.userId}`);
+    say(`  Since: ${creds.createdAt}`);
+  }
+}
+export {
+  PRODUCTION_API_URL,
+  PRODUCTION_AUTH_URL,
+  STAGING_API_URL,
+  STAGING_AUTH_URL,
+  loginCommand,
+  logoutCommand,
+  npmLoginCommand,
+  npmLogoutCommand,
+  resolveEnv,
+  signIn,
+  statusCommand
+};
+//# sourceMappingURL=index.js.map

package/package.json

@@ -0,0 +1,27 @@
+{
+  "name": "gigabuddy",
+  "version": "0.0.1",
+  "description": "The Gigabuddy CLI — sign in, and install @gigabuddy packages as yourself.",
+  "type": "module",
+  "license": "UNLICENSED",
+  "homepage": "https://gigabuddy.com",
+  "bin": {
+    "gigabuddy": "bin/cli.js"
+  },
+  "main": "./index.js",
+  "exports": {
+    ".": "./index.js"
+  },
+  "files": [
+    "bin/**/*.js",
+    "index.js",
+    "src/**/*.d.ts",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/bin/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/src/index.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Library entry point for the `gigabuddy` CLI's commands, so other tooling can
+ * drive sign-in without shelling out. The binary is `src/bin/cli.ts`.
+ */
+export * from './lib/commands.js';

package/src/lib/commands.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The `gigabuddy` commands. Kept separate from bin/cli.ts (which only parses
+ * argv and dispatches) so each one is testable without spawning a process.
+ *
+ * Everything here is deliberately thin: sign in, prove who you are to the npm
+ * door, say what state you're in, sign out. The platform's actual capabilities
+ * live behind hosted doors — this client never grows tool implementations.
+ */
+import { type UserCredentials } from '@gigabuddy/client-core';
+export declare const PRODUCTION_AUTH_URL = "https://auth.gigabuddy.com";
+export declare const PRODUCTION_API_URL = "https://api.gigabuddy.com";
+export declare const STAGING_AUTH_URL = "https://auth.staging.gigabuddy.com";
+export declare const STAGING_API_URL = "https://api.staging.gigabuddy.com";
+export interface Env {
+    authUrl: string;
+    apiUrl: string;
+    staging: boolean;
+}
+export declare function resolveEnv(options: {
+    staging?: boolean;
+    authUrl?: string;
+    apiUrl?: string;
+}): Env;
+export declare function signIn(env: Env): Promise<UserCredentials>;
+export declare function loginCommand(env: Env): Promise<void>;
+/**
+ * `gigabuddy login --npm` — make `npm install @gigabuddy/…` work as you.
+ *
+ * Signs in first if needed, then mints a registry-scoped credential (never a
+ * full platform token) and merges two lines into `.npmrc`. Which packages you
+ * can install is still decided per install, against your own access; this only
+ * proves who you are.
+ */
+export declare function npmLoginCommand(env: Env): Promise<void>;
+export declare function npmLogoutCommand(env: Env): void;
+export declare function logoutCommand(env: Env): void;
+export declare function statusCommand(): void;