monday-cli 0.2.0 → 0.4.0

package/dist/config/credentials.js

@@ -0,0 +1,300 @@
+/**
+ * Credentials cache primitive for the v0.3-M21 `monday auth login` /
+ * `monday auth logout` verbs (cli-design §7.4 — closes Decision 3).
+ *
+ * **What this module owns.** The mode-`0600` per-profile credentials
+ * file at `~/.monday-cli/credentials`, read/write/delete primitives,
+ * and the per-profile token-source-order resolver
+ * (§7.4.1: credentials cache > `api_token_env` > `config_error`).
+ *
+ * **What this module does NOT own.** The credentials file shape is
+ * intentionally orthogonal to:
+ *   - the OAuth wire flow (`src/api/oauth.ts`),
+ *   - the TOML profile loader (`src/config/profiles.ts`),
+ *   - the redaction layer (`src/utils/redact.ts`).
+ *
+ * **Mirrors `src/api/cache.ts writeJsonFile` verbatim** per cli-design
+ * §7.4.2. The R-candidate "secure-file primitive shared between cache
+ * + credentials" (v0.3-plan §22) flags consolidation when a third
+ * consumer lands; today's two-consumer state stays below threshold,
+ * so this module duplicates the disk-discipline shape rather than
+ * extracting it. The duplication is intentional and the §7.4.2
+ * "mirror verbatim" wording is the in-design backstop.
+ *
+ * **Disk discipline (§7.4.2):**
+ *
+ *   1. `mkdir({ recursive: true, mode: 0o700 })` + explicit `chmod
+ *      0o700` on the parent dir (advisory under umask on some
+ *      platforms; mirrors `src/api/cache.ts`).
+ *   2. Atomic-replace via `writeFile(tmp, payload, { mode: 0o600 })`
+ *      → `chmod(tmp, 0o600)` → `rename(tmp, final)`.
+ *   3. Read-time `fs.fstat`-against-open-descriptor permission check
+ *      (`(stats.mode & 0o077) !== 0` → refuse, surface
+ *      `config_error` with `details.path` + `details.hint`).
+ */
+import { constants as fsConstants } from 'node:fs';
+import { chmod, mkdir, open, rename, unlink, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { z } from 'zod';
+import { ConfigError, asError } from '../utils/errors.js';
+import { formatMode, isENOENT } from '../utils/fs.js';
+/**
+ * File-mode constant for the credentials file. Mirrors
+ * `src/api/cache.ts CACHE_FILE_MODE`. The R-candidate consolidation
+ * (v0.3-plan §22) would re-export this from a shared `secure-file`
+ * primitive; the constant lives here for pre-flight to keep the two
+ * surfaces independent.
+ */
+export const CREDENTIALS_FILE_MODE = 0o600;
+/**
+ * Bitmask used to detect group/world readable bits on read. A non-
+ * zero result means the file is loose; the read path refuses to
+ * open it.
+ */
+export const CREDENTIALS_INSECURE_BITS = 0o077;
+/**
+ * Pinned at `"1"` for v0.3; reserved for a future migration if the
+ * per-profile shape grows incompatibly. Mirrors the cache module's
+ * `CACHE_SCHEMA_VERSION`.
+ */
+export const CREDENTIALS_SCHEMA_VERSION = '1';
+/** Filename under `~/.monday-cli/`. Pinned for HOME-scoping. */
+export const CREDENTIALS_FILE_NAME = 'credentials';
+/** Parent directory under HOME. Pinned to match cli-design §7.4.2. */
+export const CREDENTIALS_DIR_NAME = '.monday-cli';
+/**
+ * Per-profile credentials entry per cli-design §7.4.1.
+ */
+export const profileEntrySchema = z
+    .object({
+    access_token: z.string().min(1),
+    obtained_at: z.string().min(1),
+    expires_at: z.union([z.string(), z.null()]),
+    scopes: z.array(z.string()),
+    account_id: z.string().min(1),
+})
+    .strict();
+/**
+ * Top-level credentials file shape per cli-design §7.4.1.
+ *
+ * **`schema_version` pinned to literal `"1"`** so a future-version
+ * credentials file (e.g., `"2"` after a v0.4 schema change) fails
+ * parse-time at this security-bearing surface rather than passing
+ * through and getting reinterpreted under the v0.3 schema.
+ */
+export const credentialsFileSchema = z
+    .object({
+    schema_version: z.literal(CREDENTIALS_SCHEMA_VERSION),
+    profiles: z.record(z.string().min(1), profileEntrySchema),
+})
+    .strict();
+const wrapAsConfigError = (err, message, details = {}) => {
+    return new ConfigError(message, { cause: asError(err), details });
+};
+/**
+ * Resolves the absolute credentials-file path. Pure helper — does
+ * not touch the filesystem.
+ */
+export const resolveCredentialsPath = (options = {}) => {
+    const home = options.home ?? homedir();
+    return join(home, CREDENTIALS_DIR_NAME, CREDENTIALS_FILE_NAME);
+};
+const credentialsDirPath = (options) => join(options.home ?? homedir(), CREDENTIALS_DIR_NAME);
+/**
+ * Reads the credentials file, parses it through
+ * {@link credentialsFileSchema}, and returns the parsed shape.
+ *
+ * Returns `undefined` when the file does not exist (typical first-
+ * run state). Throws `config_error` for every other failure mode
+ * (insecure mode, malformed JSON, schema mismatch).
+ */
+export const readCredentials = async (options = {}) => {
+    const fullPath = resolveCredentialsPath(options);
+    let handle;
+    try {
+        handle = await open(fullPath, fsConstants.O_RDONLY);
+    }
+    catch (err) {
+        if (isENOENT(err)) {
+            return undefined;
+        }
+        throw wrapAsConfigError(err, `cannot read credentials file ${fullPath}`, {
+            path: fullPath,
+        });
+    }
+    try {
+        const stats = await handle.stat();
+        if ((stats.mode & CREDENTIALS_INSECURE_BITS) !== 0) {
+            throw new ConfigError(`refusing to read credentials file with insecure permissions ${formatMode(stats.mode)}`, {
+                details: {
+                    path: fullPath,
+                    mode: formatMode(stats.mode),
+                    hint: `permissions must be 0600 — run \`chmod 600 ${fullPath}\``,
+                },
+            });
+        }
+        const raw = await handle.readFile('utf8');
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch (err) {
+            throw wrapAsConfigError(err, `malformed JSON in credentials file ${fullPath}`, {
+                path: fullPath,
+                hint: `delete the file and re-run \`monday auth login --profile <name>\``,
+            });
+        }
+        const result = credentialsFileSchema.safeParse(parsed);
+        if (!result.success) {
+            const issues = result.error.issues.map((i) => ({
+                path: i.path.join('.'),
+                message: i.message,
+                code: i.code,
+            }));
+            throw new ConfigError(`credentials file does not conform to v${CREDENTIALS_SCHEMA_VERSION} schema`, {
+                cause: result.error,
+                details: {
+                    path: fullPath,
+                    issues,
+                    hint: `delete the file and re-run \`monday auth login --profile <name>\``,
+                },
+            });
+        }
+        return result.data;
+    }
+    finally {
+        await handle.close();
+    }
+};
+const ensureSecureDir = async (path) => {
+    // mkdir respects umask, so the explicit `mode` is advisory on some
+    // platforms. Re-apply via chmod so a tightened-after-creation
+    // directory doesn't betray credentials to another user.
+    try {
+        await mkdir(path, { recursive: true, mode: 0o700 });
+        await chmod(path, 0o700);
+    }
+    catch (err) {
+        // Disk-full / permissions-denied path; not reproducible from a
+        // unit test against a tmp dir.
+        /* c8 ignore start */
+        throw wrapAsConfigError(err, `cannot prepare credentials directory ${path}`, {
+            path,
+        });
+        /* c8 ignore stop */
+    }
+};
+/**
+ * Atomically writes the credentials file. Mirrors `src/api/cache.ts
+ * writeEntry` verbatim:
+ *
+ *   1. `mkdir({ recursive: true, mode: 0o700 })` + `chmod 0o700`.
+ *   2. `writeFile(tmpPath, payload, { mode: 0o600 })`.
+ *   3. `chmod(tmpPath, 0o600)` (re-applied because `writeFile`'s
+ *      `mode` is advisory under umask).
+ *   4. `rename(tmpPath, finalPath)` (atomic on the same filesystem).
+ *
+ * Best-effort cleanup of `tmpPath` on any failure so a half-written
+ * `.tmp` doesn't accumulate.
+ */
+export const writeCredentials = async (file, options = {}) => {
+    // Re-validate before write so a caller passing a malformed shape
+    // (e.g., a hand-built object that bypassed the schema) can't slip
+    // a bad file onto disk.
+    const validated = credentialsFileSchema.parse(file);
+    const fullPath = resolveCredentialsPath(options);
+    const dir = credentialsDirPath(options);
+    await ensureSecureDir(dir);
+    const payload = JSON.stringify(validated, null, 2);
+    const tmpPath = `${fullPath}.${randomUUID()}.tmp`;
+    try {
+        await writeFile(tmpPath, payload, { mode: CREDENTIALS_FILE_MODE });
+        await chmod(tmpPath, CREDENTIALS_FILE_MODE);
+        await rename(tmpPath, fullPath);
+    }
+    catch (err) {
+        // Disk-full / atomic-rename failure path; not reproducible from a
+        // unit test against a tmp dir.
+        /* c8 ignore start */
+        await unlink(tmpPath).catch(() => undefined);
+        throw wrapAsConfigError(err, `cannot write credentials file ${fullPath}`, {
+            path: fullPath,
+        });
+        /* c8 ignore stop */
+    }
+};
+/**
+ * Read-modify-write convenience for `monday auth login`'s success
+ * path. Loads the existing file (or starts a fresh `{schema_version,
+ * profiles: {}}` if absent), inserts/replaces the named profile's
+ * entry, and writes the result back via {@link writeCredentials}.
+ */
+export const setProfileCredentials = async (inputs, options = {}) => {
+    const existing = await readCredentials(options);
+    const next = {
+        schema_version: CREDENTIALS_SCHEMA_VERSION,
+        profiles: {
+            ...(existing?.profiles ?? {}),
+            [inputs.profileName]: inputs.entry,
+        },
+    };
+    await writeCredentials(next, options);
+};
+/**
+ * Idempotent profile delete for `monday auth logout`. Loads the
+ * file (no-op if file is absent), removes the named profile from
+ * `profiles`, writes the result back. When the post-delete
+ * `profiles` map is empty, **still writes
+ * `{schema_version, profiles: {}}`** rather than deleting the file
+ * outright (per cli-design §7.3.2 — keeps the schema-version pin
+ * discoverable + avoids a fresh-install vs all-logged-out
+ * ambiguity).
+ *
+ * Returns whether the named profile was present pre-delete — the
+ * caller surfaces this in the success envelope's `was_present`
+ * slot.
+ */
+export const deleteProfileCredentials = async (profileName, options = {}) => {
+    const existing = await readCredentials(options);
+    if (existing === undefined) {
+        return { wasPresent: false };
+    }
+    const wasPresent = Object.prototype.hasOwnProperty.call(existing.profiles, profileName);
+    if (!wasPresent) {
+        return { wasPresent: false };
+    }
+    const nextProfiles = Object.fromEntries(Object.entries(existing.profiles).filter(([key]) => key !== profileName));
+    const next = {
+        schema_version: CREDENTIALS_SCHEMA_VERSION,
+        profiles: nextProfiles,
+    };
+    await writeCredentials(next, options);
+    return { wasPresent: true };
+};
+export const resolveProfileToken = async (inputs, options = {}) => {
+    const credentials = await readCredentials(options);
+    const cached = credentials?.profiles[inputs.profileName];
+    if (cached !== undefined) {
+        return { token: cached.access_token, source: 'credentials_cache' };
+    }
+    if (inputs.apiTokenEnvName !== undefined) {
+        const env = options.env ?? process.env;
+        const fromEnv = env[inputs.apiTokenEnvName];
+        if (fromEnv !== undefined && fromEnv.length > 0) {
+            return { token: fromEnv, source: 'api_token_env' };
+        }
+    }
+    const hint = inputs.apiTokenEnvName !== undefined
+        ? `no token for profile \`${inputs.profileName}\` — run \`monday auth login --profile ${inputs.profileName}\` or set ${inputs.apiTokenEnvName}`
+        : `no token for profile \`${inputs.profileName}\` — run \`monday auth login --profile ${inputs.profileName}\``;
+    throw new ConfigError(`no credentials available for profile \`${inputs.profileName}\``, {
+        details: {
+            profile: inputs.profileName,
+            api_token_env: inputs.apiTokenEnvName ?? null,
+            hint,
+        },
+    });
+};
+//# sourceMappingURL=credentials.js.map

package/dist/config/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/config/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAE3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAE/C;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAE9C,gEAAgE;AAChE,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD,sEAAsE;AACtE,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAC;AAElD;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9B,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC;IACrD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC;CAC1D,CAAC;KACD,MAAM,EAAE,CAAC;AAwCZ,MAAM,iBAAiB,GAAG,CACxB,GAAY,EACZ,OAAe,EACf,UAA6C,EAAE,EAClC,EAAE;IACf,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;AACpE,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,UAAkC,EAAE,EAC5B,EAAE;IACV,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACvC,OAAO,IAAI,CAAC,IAAI,EAAE,oBAAoB,EAAE,qBAAqB,CAAC,CAAC;AACjE,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,OAA+B,EAAU,EAAE,CACrE,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,EAAE,EAAE,oBAAoB,CAAC,CAAC;AAExD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,UAAkC,EAAE,EACE,EAAE;IACxC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAEjD,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,iBAAiB,CAAC,GAAG,EAAE,gCAAgC,QAAQ,EAAE,EAAE;YACvE,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,WAAW,CACnB,+DAA+D,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EACvF;gBACE,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;oBAC5B,IAAI,EAAE,8CAA8C,QAAQ,IAAI;iBACjE;aACF,CACF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,iBAAiB,CAAC,GAAG,EAAE,sCAAsC,QAAQ,EAAE,EAAE;gBAC7E,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,mEAAmE;aAC1E,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;gBACtB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,IAAI,EAAE,CAAC,CAAC,IAAI;aACb,CAAC,CAAC,CAAC;YACJ,MAAM,IAAI,WAAW,CACnB,yCAAyC,0BAA0B,SAAS,EAC5E;gBACE,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,MAAM;oBACN,IAAI,EAAE,mEAAmE;iBAC1E;aACF,CACF,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;IAC5D,mEAAmE;IACnE,8DAA8D;IAC9D,wDAAwD;IACxD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,+DAA+D;QAC/D,+BAA+B;QAC/B,qBAAqB;QACrB,MAAM,iBAAiB,CAAC,GAAG,EAAE,wCAAwC,IAAI,EAAE,EAAE;YAC3E,IAAI;SACL,CAAC,CAAC;QACH,oBAAoB;IACtB,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,IAAqB,EACrB,UAAkC,EAAE,EACrB,EAAE;IACjB,iEAAiE;IACjE,kEAAkE;IAClE,wBAAwB;IACxB,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAExC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IAE3B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,UAAU,EAAE,MAAM,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACnE,MAAM,KAAK,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;QAC5C,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,kEAAkE;QAClE,+BAA+B;QAC/B,qBAAqB;QACrB,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,iBAAiB,CAAC,GAAG,EAAE,iCAAiC,QAAQ,EAAE,EAAE;YACxE,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;QACH,oBAAoB;IACtB,CAAC;AACH,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACxC,MAAmC,EACnC,UAAkC,EAAE,EACrB,EAAE;IACjB,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,IAAI,GAAoB;QAC5B,cAAc,EAAE,0BAA0B;QAC1C,QAAQ,EAAE;YACR,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,CAAC;YAC7B,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,KAAK;SACnC;KACF,CAAC;IACF,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACxC,CAAC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,EAC3C,WAAmB,EACnB,UAAkC,EAAE,EACO,EAAE;IAC7C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC/B,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CACrD,QAAQ,CAAC,QAAQ,EACjB,WAAW,CACZ,CAAC;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC/B,CAAC;IACD,MAAM,YAAY,GAAiC,MAAM,CAAC,WAAW,CACnE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,WAAW,CAAC,CACzE,CAAC;IACF,MAAM,IAAI,GAAoB;QAC5B,cAAc,EAAE,0BAA0B;QAC1C,QAAQ,EAAE,YAAY;KACvB,CAAC;IACF,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACtC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAC9B,CAAC,CAAC;AAiBF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EACtC,MAAiC,EACjC,UAAkC,EAAE,EACL,EAAE;IACjC,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACvC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC5C,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACrD,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GACR,MAAM,CAAC,eAAe,KAAK,SAAS;QAClC,CAAC,CAAC,0BAA0B,MAAM,CAAC,WAAW,0CAA0C,MAAM,CAAC,WAAW,aAAa,MAAM,CAAC,eAAe,EAAE;QAC/I,CAAC,CAAC,0BAA0B,MAAM,CAAC,WAAW,0CAA0C,MAAM,CAAC,WAAW,IAAI,CAAC;IACnH,MAAM,IAAI,WAAW,CACnB,0CAA0C,MAAM,CAAC,WAAW,IAAI,EAChE;QACE,OAAO,EAAE;YACP,OAAO,EAAE,MAAM,CAAC,WAAW;YAC3B,aAAa,EAAE,MAAM,CAAC,eAAe,IAAI,IAAI;YAC7C,IAAI;SACL;KACF,CACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/config/profiles.d.ts

@@ -0,0 +1,125 @@
+/**
+ * Profile-config loader for the v0.3-M21 multi-profile surface
+ * (cli-design §7.2 — `~/.monday-cli/config.toml`).
+ *
+ * **What this module owns.** Reading + parsing the TOML config file,
+ * the per-profile config schema (zod-validated at the parse boundary
+ * per `.claude/rules/validation.md`), and the profile-selection
+ * resolver per §7.2 source order:
+ *
+ *     `--profile flag > MONDAY_PROFILE env > default_profile in
+ *      config > implicit v1 mode (no config file present)`
+ *
+ * **What this module does NOT own.** The credentials cache (token
+ * source-order within a profile) lives in
+ * `src/config/credentials.ts`.
+ *
+ * **Token-storage rule (cli-design §7.2 + §7.4 + .claude/rules/
+ * security.md):** tokens are NEVER stored in `config.toml`. Profile
+ * entries reference an env-var name via `api_token_env =
+ * "MONDAY_API_TOKEN_<X>"` (the env var's *name*, never its value).
+ * Two layers of defense:
+ *
+ *   1. **Structural exclusion** — `.strict()` on the zod object
+ *      rejects unknown keys (`api_token`, `access_token`, `secret`).
+ *   2. **Value-level shape check** — `api_token_env` is constrained
+ *      to the env-var-identifier regex `/^[A-Z_][A-Z0-9_]*$/u`.
+ */
+import { z } from 'zod';
+/** Filename under `~/.monday-cli/`. Pinned for HOME-scoping. */
+export declare const PROFILES_CONFIG_FILE_NAME = "config.toml";
+/** Parent directory under HOME (shared with credentials cache). */
+export declare const PROFILES_DIR_NAME = ".monday-cli";
+/**
+ * Optional `[profiles.<name>.dev]` block per cli-design §11.3 (Monday
+ * Dev convenience). Pinned here so v0.3-M26 (`monday dev …`) can read
+ * the same shape without a fresh schema landing alongside that
+ * milestone.
+ */
+export declare const profileDevBlockSchema: z.ZodObject<{
+    tasks_board: z.ZodOptional<z.ZodString>;
+    sprints_board: z.ZodOptional<z.ZodString>;
+    epics_board: z.ZodOptional<z.ZodString>;
+    bugs_board: z.ZodOptional<z.ZodString>;
+    releases_board: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type ProfileDevBlock = z.infer<typeof profileDevBlockSchema>;
+export declare const profileEntrySchema: z.ZodObject<{
+    api_token_env: z.ZodOptional<z.ZodString>;
+    api_version: z.ZodOptional<z.ZodString>;
+    default_workspace: z.ZodOptional<z.ZodString>;
+    timezone: z.ZodOptional<z.ZodString>;
+    dev: z.ZodOptional<z.ZodObject<{
+        tasks_board: z.ZodOptional<z.ZodString>;
+        sprints_board: z.ZodOptional<z.ZodString>;
+        epics_board: z.ZodOptional<z.ZodString>;
+        bugs_board: z.ZodOptional<z.ZodString>;
+        releases_board: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ProfileEntry = z.infer<typeof profileEntrySchema>;
+/**
+ * Top-level config-file shape per cli-design §7.2.
+ */
+export declare const profilesConfigSchema: z.ZodObject<{
+    default_profile: z.ZodOptional<z.ZodString>;
+    profiles: z.ZodRecord<z.ZodString, z.ZodObject<{
+        api_token_env: z.ZodOptional<z.ZodString>;
+        api_version: z.ZodOptional<z.ZodString>;
+        default_workspace: z.ZodOptional<z.ZodString>;
+        timezone: z.ZodOptional<z.ZodString>;
+        dev: z.ZodOptional<z.ZodObject<{
+            tasks_board: z.ZodOptional<z.ZodString>;
+            sprints_board: z.ZodOptional<z.ZodString>;
+            epics_board: z.ZodOptional<z.ZodString>;
+            bugs_board: z.ZodOptional<z.ZodString>;
+            releases_board: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ProfilesConfig = z.infer<typeof profilesConfigSchema>;
+export interface ProfilesRootOptions {
+    readonly env?: NodeJS.ProcessEnv;
+    readonly home?: string;
+}
+/**
+ * Resolves the absolute config-file path. Pure helper.
+ */
+export declare const resolveProfilesConfigPath: (options?: ProfilesRootOptions) => string;
+/**
+ * Reads + parses `~/.monday-cli/config.toml`. Returns `undefined`
+ * when the file does not exist (typical first-run state — implicit
+ * v1 mode applies). Throws `config_error` for parse failures (TOML
+ * malformed) or schema-validation failures (unknown keys, type
+ * mismatch, token-smuggled-as-env-var-name).
+ */
+export declare const loadProfilesConfig: (options?: ProfilesRootOptions) => Promise<ProfilesConfig | undefined>;
+export interface SelectProfileInputs {
+    readonly flag: string | undefined;
+    readonly env: NodeJS.ProcessEnv;
+    readonly config: ProfilesConfig | undefined;
+}
+export type SelectProfileResult = {
+    readonly mode: 'named';
+    readonly name: string;
+    readonly entry: ProfileEntry;
+} | {
+    readonly mode: 'implicit_v1';
+};
+/**
+ * Resolves the active profile per cli-design §7.2 source order:
+ *
+ *   1. `flag` (from `--profile <name>`).
+ *   2. `env.MONDAY_PROFILE`.
+ *   3. `config.default_profile`.
+ *   4. Implicit-v1 sentinel.
+ *
+ * Surfaces `config_error` when:
+ *   - any of (1)/(2)/(3) names a profile not present in the config
+ *     file, OR
+ *   - `flag` / `MONDAY_PROFILE` is set but no config file exists
+ *     (the flag/env imply per-profile resolution that the missing
+ *     config can't fulfil).
+ */
+export declare const selectProfile: (inputs: SelectProfileInputs) => SelectProfileResult;
+//# sourceMappingURL=profiles.d.ts.map

package/dist/config/profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../src/config/profiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAMH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,gEAAgE;AAChE,eAAO,MAAM,yBAAyB,gBAAgB,CAAC;AAEvD,mEAAmE;AACnE,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;;;;kBAQvB,CAAC;AAEZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAUpE,eAAO,MAAM,kBAAkB;;;;;;;;;;;;kBAkBpB,CAAC;AAEZ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;kBAKtB,CAAC;AAEZ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB,GACpC,UAAS,mBAAwB,KAChC,MAGF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAC7B,UAAS,mBAAwB,KAChC,OAAO,CAAC,cAAc,GAAG,SAAS,CA6DpC,CAAC;AAEF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,SAAS,CAAC;CAC7C;AAED,MAAM,MAAM,mBAAmB,GAC3B;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;CAC9B,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC;AAErC;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,GACxB,QAAQ,mBAAmB,KAC1B,mBAmEF,CAAC"}

package/dist/config/profiles.js

@@ -0,0 +1,227 @@
+/**
+ * Profile-config loader for the v0.3-M21 multi-profile surface
+ * (cli-design §7.2 — `~/.monday-cli/config.toml`).
+ *
+ * **What this module owns.** Reading + parsing the TOML config file,
+ * the per-profile config schema (zod-validated at the parse boundary
+ * per `.claude/rules/validation.md`), and the profile-selection
+ * resolver per §7.2 source order:
+ *
+ *     `--profile flag > MONDAY_PROFILE env > default_profile in
+ *      config > implicit v1 mode (no config file present)`
+ *
+ * **What this module does NOT own.** The credentials cache (token
+ * source-order within a profile) lives in
+ * `src/config/credentials.ts`.
+ *
+ * **Token-storage rule (cli-design §7.2 + §7.4 + .claude/rules/
+ * security.md):** tokens are NEVER stored in `config.toml`. Profile
+ * entries reference an env-var name via `api_token_env =
+ * "MONDAY_API_TOKEN_<X>"` (the env var's *name*, never its value).
+ * Two layers of defense:
+ *
+ *   1. **Structural exclusion** — `.strict()` on the zod object
+ *      rejects unknown keys (`api_token`, `access_token`, `secret`).
+ *   2. **Value-level shape check** — `api_token_env` is constrained
+ *      to the env-var-identifier regex `/^[A-Z_][A-Z0-9_]*$/u`.
+ */
+import { readFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { parse as parseToml } from 'smol-toml';
+import { z } from 'zod';
+import { ConfigError, asError } from '../utils/errors.js';
+import { isENOENT } from '../utils/fs.js';
+/** Filename under `~/.monday-cli/`. Pinned for HOME-scoping. */
+export const PROFILES_CONFIG_FILE_NAME = 'config.toml';
+/** Parent directory under HOME (shared with credentials cache). */
+export const PROFILES_DIR_NAME = '.monday-cli';
+/**
+ * Optional `[profiles.<name>.dev]` block per cli-design §11.3 (Monday
+ * Dev convenience). Pinned here so v0.3-M26 (`monday dev …`) can read
+ * the same shape without a fresh schema landing alongside that
+ * milestone.
+ */
+export const profileDevBlockSchema = z
+    .object({
+    tasks_board: z.string().min(1).optional(),
+    sprints_board: z.string().min(1).optional(),
+    epics_board: z.string().min(1).optional(),
+    bugs_board: z.string().min(1).optional(),
+    releases_board: z.string().min(1).optional(),
+})
+    .strict();
+/**
+ * Env-var identifier shape (POSIX-style). Rejects token-looking
+ * values like `tok-fixture-xxxx` or JWT-looking values like
+ * `eyJhbGciOi...` so a user pasting a token under the allowed
+ * `api_token_env` key fails at parse time.
+ */
+const ENV_VAR_NAME_PATTERN = /^[A-Z_][A-Z0-9_]*$/u;
+export const profileEntrySchema = z
+    .object({
+    api_token_env: z
+        .string()
+        .min(1)
+        .regex(ENV_VAR_NAME_PATTERN, {
+        message: '`api_token_env` must be an env-var name (e.g., `MONDAY_API_TOKEN_WORK`), NOT the token value itself. The CLI never reads tokens from `config.toml`; reference an env var or use `monday auth login` instead.',
+    })
+        .optional(),
+    api_version: z
+        .string()
+        .regex(/^\d{4}-\d{2}$/u, { message: 'expected YYYY-MM' })
+        .optional(),
+    default_workspace: z.string().min(1).optional(),
+    timezone: z.string().min(1).optional(),
+    dev: profileDevBlockSchema.optional(),
+})
+    .strict();
+/**
+ * Top-level config-file shape per cli-design §7.2.
+ */
+export const profilesConfigSchema = z
+    .object({
+    default_profile: z.string().min(1).optional(),
+    profiles: z.record(z.string().min(1), profileEntrySchema),
+})
+    .strict();
+/**
+ * Resolves the absolute config-file path. Pure helper.
+ */
+export const resolveProfilesConfigPath = (options = {}) => {
+    const home = options.home ?? homedir();
+    return join(home, PROFILES_DIR_NAME, PROFILES_CONFIG_FILE_NAME);
+};
+/**
+ * Reads + parses `~/.monday-cli/config.toml`. Returns `undefined`
+ * when the file does not exist (typical first-run state — implicit
+ * v1 mode applies). Throws `config_error` for parse failures (TOML
+ * malformed) or schema-validation failures (unknown keys, type
+ * mismatch, token-smuggled-as-env-var-name).
+ */
+export const loadProfilesConfig = async (options = {}) => {
+    const fullPath = resolveProfilesConfigPath(options);
+    let raw;
+    try {
+        raw = await readFile(fullPath, 'utf8');
+    }
+    catch (err) {
+        if (isENOENT(err)) {
+            return undefined;
+        }
+        // Non-ENOENT readFile errors (EACCES, EISDIR) are platform-
+        // specific and not reproducible from a tmp-dir test.
+        /* c8 ignore start */
+        throw new ConfigError(`cannot read profiles config ${fullPath}`, {
+            cause: asError(err),
+            details: { path: fullPath },
+        });
+        /* c8 ignore stop */
+    }
+    let tomlParsed;
+    try {
+        tomlParsed = parseToml(raw);
+    }
+    catch (err) {
+        throw new ConfigError(`malformed TOML in profiles config ${fullPath}`, {
+            cause: asError(err),
+            details: {
+                path: fullPath,
+                hint: 'check the file for unmatched quotes, missing `=`, or invalid section headers',
+            },
+        });
+    }
+    const result = profilesConfigSchema.safeParse(tomlParsed);
+    if (!result.success) {
+        const issues = result.error.issues.map((i) => ({
+            path: i.path.join('.'),
+            message: i.message,
+            code: i.code,
+        }));
+        const summary = issues
+            .map((i) => (i.path !== '' ? `${i.path}: ${i.message}` : i.message))
+            .join('; ');
+        throw new ConfigError(`invalid profiles config: ${summary}`, {
+            cause: result.error,
+            details: {
+                path: fullPath,
+                issues,
+                hint: 'profile entries must reference an env-var NAME via `api_token_env`, never the token value itself; tokens belong in env vars or the credentials cache (run `monday auth login`).',
+            },
+        });
+    }
+    return result.data;
+};
+/**
+ * Resolves the active profile per cli-design §7.2 source order:
+ *
+ *   1. `flag` (from `--profile <name>`).
+ *   2. `env.MONDAY_PROFILE`.
+ *   3. `config.default_profile`.
+ *   4. Implicit-v1 sentinel.
+ *
+ * Surfaces `config_error` when:
+ *   - any of (1)/(2)/(3) names a profile not present in the config
+ *     file, OR
+ *   - `flag` / `MONDAY_PROFILE` is set but no config file exists
+ *     (the flag/env imply per-profile resolution that the missing
+ *     config can't fulfil).
+ */
+export const selectProfile = (inputs) => {
+    const flagName = inputs.flag !== undefined && inputs.flag.length > 0
+        ? inputs.flag
+        : undefined;
+    const envName = inputs.env.MONDAY_PROFILE !== undefined &&
+        inputs.env.MONDAY_PROFILE.length > 0
+        ? inputs.env.MONDAY_PROFILE
+        : undefined;
+    // (1)/(2): explicit selection. The credentials cache is the
+    // authoritative store for tokens (cli-design §7.4.1), and
+    // `monday auth login --profile <name>` populates it without
+    // requiring a `config.toml` edit. Two cases:
+    //
+    //   - No config file: return a synthetic empty entry. The caller
+    //     resolves the token via `resolveProfileToken`, which checks
+    //     the credentials cache first and surfaces `config_error`
+    //     only if neither cache nor `api_token_env` is populated.
+    //   - Config file present but profile not in `profiles`: error
+    //     loud — the user expressed an explicit `[profiles.<name>]`
+    //     intent that the file doesn't satisfy.
+    const explicit = flagName ?? envName;
+    if (explicit !== undefined) {
+        if (inputs.config === undefined) {
+            return { mode: 'named', name: explicit, entry: {} };
+        }
+        const entry = inputs.config.profiles[explicit];
+        if (entry === undefined) {
+            throw new ConfigError(`profile \`${explicit}\` not found in ~/.monday-cli/config.toml`, {
+                details: {
+                    profile: explicit,
+                    available_profiles: Object.keys(inputs.config.profiles),
+                    source: flagName !== undefined ? '--profile flag' : 'MONDAY_PROFILE env',
+                    hint: `add a [profiles.${explicit}] section to ~/.monday-cli/config.toml, OR run \`monday auth login --profile ${explicit}\` to populate the credentials cache directly`,
+                },
+            });
+        }
+        return { mode: 'named', name: explicit, entry };
+    }
+    // (3): default_profile from config.
+    if (inputs.config?.default_profile !== undefined) {
+        const name = inputs.config.default_profile;
+        const entry = inputs.config.profiles[name];
+        if (entry === undefined) {
+            throw new ConfigError(`default_profile \`${name}\` not found in ~/.monday-cli/config.toml`, {
+                details: {
+                    profile: name,
+                    available_profiles: Object.keys(inputs.config.profiles),
+                    source: 'default_profile in config.toml',
+                    hint: 'set `default_profile` to one of the listed available_profiles, or remove the `default_profile` line to fall back to the first profile listed',
+                },
+            });
+        }
+        return { mode: 'named', name, entry };
+    }
+    // (4): implicit v1.
+    return { mode: 'implicit_v1' };
+};
+//# sourceMappingURL=profiles.js.map