signet-auth 1.0.0-beta.0

package/dist/cli/commands/init.js

@@ -0,0 +1,244 @@
+/**
+ * sig init — Interactive setup command.
+ * Creates ~/.signet/config.yaml with sensible defaults.
+ * Does NOT take deps (runs before config exists).
+ */
+import fs from 'node:fs';
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import { execSync } from 'node:child_process';
+import { createInterface } from 'node:readline/promises';
+import YAML from 'yaml';
+import { getConfigPath } from '../../config/loader.js';
+import { generateConfigYaml } from '../../config/generator.js';
+import { validateConfig } from '../../config/validator.js';
+import { isOk } from '../../core/result.js';
+const PROVIDER_TEMPLATES = {
+    github: {
+        name: 'GitHub',
+        domains: ['github.com', 'api.github.com'],
+        strategy: 'api-token',
+        config: { headerName: 'Authorization', headerPrefix: 'Bearer' },
+    },
+    gitlab: {
+        name: 'GitLab',
+        domains: ['gitlab.com'],
+        strategy: 'api-token',
+        config: { headerName: 'PRIVATE-TOKEN', headerPrefix: '' },
+    },
+    jira: {
+        name: 'Jira (Cloud)',
+        domains: [],
+        strategy: 'cookie',
+        needsDomain: true,
+    },
+    confluence: {
+        name: 'Confluence',
+        domains: [],
+        strategy: 'cookie',
+        needsDomain: true,
+    },
+};
+// ---------------------------------------------------------------------------
+// Browser channel detection
+// ---------------------------------------------------------------------------
+function detectBrowserChannel() {
+    const platform = process.platform;
+    if (platform === 'darwin') {
+        if (fs.existsSync('/Applications/Google Chrome.app'))
+            return 'chrome';
+        if (fs.existsSync('/Applications/Microsoft Edge.app'))
+            return 'msedge';
+        return 'chrome';
+    }
+    if (platform === 'linux') {
+        try {
+            execSync('which google-chrome', { stdio: 'ignore' });
+            return 'chrome';
+        }
+        catch { /* not found */ }
+        try {
+            execSync('which microsoft-edge', { stdio: 'ignore' });
+            return 'msedge';
+        }
+        catch { /* not found */ }
+        try {
+            execSync('which chromium', { stdio: 'ignore' });
+            return 'chromium';
+        }
+        catch { /* not found */ }
+        return 'chrome';
+    }
+    // Windows or unknown
+    return 'chrome';
+}
+// ---------------------------------------------------------------------------
+// Interactive prompts
+// ---------------------------------------------------------------------------
+async function promptProviders(rl) {
+    const providers = [];
+    const addMore = await rl.question('\nWould you like to add a provider? (y/N) ');
+    if (addMore.toLowerCase() !== 'y')
+        return providers;
+    let keepAdding = true;
+    while (keepAdding) {
+        const templateNames = Object.keys(PROVIDER_TEMPLATES);
+        console.log('\nProvider templates:');
+        for (let i = 0; i < templateNames.length; i++) {
+            const key = templateNames[i];
+            const tmpl = PROVIDER_TEMPLATES[key];
+            console.log(`  ${i + 1}. ${tmpl.name} (${key})`);
+        }
+        console.log(`  ${templateNames.length + 1}. Custom`);
+        const choice = await rl.question(`\nSelect template (1-${templateNames.length + 1}): `);
+        const choiceNum = parseInt(choice, 10);
+        if (choiceNum >= 1 && choiceNum <= templateNames.length) {
+            const templateKey = templateNames[choiceNum - 1];
+            const template = PROVIDER_TEMPLATES[templateKey];
+            let domains = template.domains;
+            if (template.needsDomain) {
+                const domain = await rl.question(`Enter your ${template.name} domain (e.g., ${templateKey}.example.com): `);
+                if (domain.trim()) {
+                    domains = [domain.trim()];
+                }
+                else {
+                    console.log('  Skipping — domain is required.');
+                    const again = await rl.question('\nAdd another provider? (y/N) ');
+                    keepAdding = again.toLowerCase() === 'y';
+                    continue;
+                }
+            }
+            providers.push({
+                id: templateKey,
+                domains,
+                strategy: template.strategy,
+                ...(template.config ? { config: template.config } : {}),
+            });
+            console.log(`  Added ${template.name}.`);
+        }
+        else if (choiceNum === templateNames.length + 1) {
+            const id = await rl.question('Provider id (e.g., my-api): ');
+            if (!id.trim()) {
+                console.log('  Skipping — id is required.');
+                const again = await rl.question('\nAdd another provider? (y/N) ');
+                keepAdding = again.toLowerCase() === 'y';
+                continue;
+            }
+            const domain = await rl.question('Domain(s) (comma-separated): ');
+            const domains = domain.split(',').map(d => d.trim()).filter(Boolean);
+            if (domains.length === 0) {
+                console.log('  Skipping — at least one domain is required.');
+                const again = await rl.question('\nAdd another provider? (y/N) ');
+                keepAdding = again.toLowerCase() === 'y';
+                continue;
+            }
+            const strategy = await rl.question('Strategy (cookie, oauth2, api-token, basic) [cookie]: ') || 'cookie';
+            providers.push({ id: id.trim(), domains, strategy });
+            console.log(`  Added custom provider "${id.trim()}".`);
+        }
+        else {
+            console.log('  Invalid selection.');
+        }
+        const again = await rl.question('\nAdd another provider? (y/N) ');
+        keepAdding = again.toLowerCase() === 'y';
+    }
+    return providers;
+}
+// ---------------------------------------------------------------------------
+// Main command
+// ---------------------------------------------------------------------------
+export async function runInit(positionals, flags) {
+    const configPath = getConfigPath();
+    const signetDir = path.dirname(configPath);
+    const force = flags.force === true;
+    const yes = flags.yes === true;
+    // Check if config already exists
+    if (fs.existsSync(configPath) && !force) {
+        process.stderr.write(`Config file already exists: ${configPath}\n` +
+            'Use --force to overwrite.\n');
+        process.exitCode = 1;
+        return;
+    }
+    // Detect defaults
+    const detectedChannel = detectBrowserChannel();
+    const defaultChannel = typeof flags.channel === 'string' ? flags.channel : detectedChannel;
+    const defaultBrowserDataDir = typeof flags['browser-data-dir'] === 'string'
+        ? flags['browser-data-dir']
+        : path.join(signetDir, 'browser-data');
+    const defaultCredentialsDir = typeof flags['credentials-dir'] === 'string'
+        ? flags['credentials-dir']
+        : path.join(signetDir, 'credentials');
+    let channel = defaultChannel;
+    let browserDataDir = defaultBrowserDataDir;
+    let credentialsDir = defaultCredentialsDir;
+    let providers = [];
+    // Interactive mode
+    const isTTY = process.stdin.isTTY && process.stdout.isTTY;
+    if (isTTY && !yes) {
+        const rl = createInterface({ input: process.stdin, output: process.stdout });
+        try {
+            console.log('\nWelcome to Signet! Let\'s set up your configuration.\n');
+            const channelAnswer = await rl.question(`Browser channel [${defaultChannel}]: `);
+            if (channelAnswer.trim())
+                channel = channelAnswer.trim();
+            providers = await promptProviders(rl);
+        }
+        finally {
+            rl.close();
+        }
+    }
+    else {
+        if (!yes) {
+            // Non-TTY, non-yes: use defaults silently
+        }
+    }
+    // Resolve ~ in paths for display but keep ~ in config for portability
+    const displayBrowserDataDir = browserDataDir.replace(os.homedir(), '~');
+    const displayCredentialsDir = credentialsDir.replace(os.homedir(), '~');
+    // Generate config YAML
+    const yaml = generateConfigYaml({
+        channel,
+        browserDataDir: displayBrowserDataDir,
+        credentialsDir: displayCredentialsDir,
+        headlessTimeout: 30_000,
+        visibleTimeout: 120_000,
+        waitUntil: 'load',
+        providers: providers.length > 0 ? providers : undefined,
+    });
+    // Validate the generated config before writing (sanity check)
+    let raw;
+    try {
+        raw = YAML.parse(yaml);
+    }
+    catch (e) {
+        process.stderr.write(`Bug: generated invalid YAML: ${e.message}\n`);
+        process.exitCode = 1;
+        return;
+    }
+    const validationResult = validateConfig(raw);
+    if (!isOk(validationResult)) {
+        process.stderr.write(`Bug: generated config failed validation: ${validationResult.error.message}\n`);
+        process.exitCode = 1;
+        return;
+    }
+    // Create directories
+    await fsp.mkdir(signetDir, { recursive: true });
+    await fsp.mkdir(browserDataDir, { recursive: true });
+    await fsp.mkdir(credentialsDir, { recursive: true });
+    // Write config
+    await fsp.writeFile(configPath, yaml, 'utf-8');
+    // Success message
+    console.log(`\n  Config written to ${configPath}`);
+    console.log(`  Browser data:   ${browserDataDir}`);
+    console.log(`  Credentials:    ${credentialsDir}`);
+    console.log(`  Browser:        ${channel}`);
+    if (providers.length > 0) {
+        console.log(`  Providers:      ${providers.map(p => p.id).join(', ')}`);
+    }
+    console.log('\nNext steps:');
+    console.log('  sig login <url>       Authenticate with a service');
+    console.log('  sig providers         List configured providers');
+    console.log('  sig doctor            Check your setup');
+    console.log('');
+}

package/dist/cli/commands/login.d.ts

@@ -0,0 +1,2 @@
+import type { AuthDeps } from '../../deps.js';
+export declare function runLogin(positionals: string[], flags: Record<string, string | boolean>, deps: AuthDeps): Promise<void>;

package/dist/cli/commands/login.js

@@ -0,0 +1,77 @@
+import { buildStrategyConfig } from '../../config/validator.js';
+import { isOk } from '../../core/result.js';
+import { formatJson } from '../formatters.js';
+export async function runLogin(positionals, flags, deps) {
+    const url = positionals[0];
+    if (!url) {
+        process.stderr.write('Usage: sig login <url>\n');
+        process.exitCode = 1;
+        return;
+    }
+    const baseProvider = deps.authManager.resolveProvider(url);
+    const hasOverrides = flags.strategy !== undefined;
+    const provider = hasOverrides
+        ? { ...baseProvider }
+        : baseProvider;
+    if (typeof flags.strategy === 'string') {
+        const strategyName = flags.strategy;
+        provider.strategy = strategyName;
+        provider.strategyConfig = buildStrategyConfig(strategyName);
+    }
+    if (hasOverrides) {
+        deps.authManager.providerRegistry.register(provider);
+    }
+    if (typeof flags.token === 'string') {
+        // Read headerName/headerPrefix from the typed strategy config if api-token
+        const headerName = provider.strategyConfig.strategy === 'api-token'
+            ? provider.strategyConfig.headerName ?? 'Authorization'
+            : 'Authorization';
+        const headerPrefix = provider.strategyConfig.strategy === 'api-token'
+            ? provider.strategyConfig.headerPrefix ?? 'Bearer'
+            : 'Bearer';
+        const credential = {
+            type: 'api-key',
+            key: flags.token,
+            headerName,
+            headerPrefix,
+        };
+        const result = await deps.authManager.setCredential(provider.id, credential);
+        if (!isOk(result)) {
+            process.stderr.write(`Error: ${result.error.message}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        process.stderr.write(`Token stored for "${provider.name}" (${provider.id}).\n`);
+        process.stdout.write(formatJson({ provider: provider.id, type: 'api-key' }) + '\n');
+        return;
+    }
+    if (typeof flags.username === 'string' && typeof flags.password === 'string') {
+        const credential = {
+            type: 'basic',
+            username: flags.username,
+            password: flags.password,
+        };
+        const result = await deps.authManager.setCredential(provider.id, credential);
+        if (!isOk(result)) {
+            process.stderr.write(`Error: ${result.error.message}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        process.stderr.write(`Basic auth credentials stored for "${provider.name}" (${provider.id}).\n`);
+        process.stdout.write(formatJson({ provider: provider.id, type: 'basic' }) + '\n');
+        return;
+    }
+    process.stderr.write(`Authenticating with "${provider.name}" via browser...\n`);
+    const result = await deps.authManager.forceReauth(provider.id);
+    if (!isOk(result)) {
+        process.stderr.write(`Authentication failed: ${result.error.message}\n`);
+        process.exit(1);
+    }
+    const status = await deps.authManager.getStatus(provider.id);
+    process.stderr.write(`Authenticated with "${provider.name}".\n`);
+    process.stdout.write(formatJson({
+        provider: provider.id,
+        type: result.value.type,
+        ...(status.expiresAt ? { expiresAt: status.expiresAt } : {}),
+    }) + '\n');
+}

package/dist/cli/commands/logout.d.ts

@@ -0,0 +1,2 @@
+import type { AuthDeps } from '../../deps.js';
+export declare function runLogout(positionals: string[], flags: Record<string, string | boolean>, deps: AuthDeps): Promise<void>;

package/dist/cli/commands/logout.js

@@ -0,0 +1,11 @@
+export async function runLogout(positionals, flags, deps) {
+    const providerId = positionals[0];
+    if (providerId) {
+        await deps.authManager.clearCredentials(providerId);
+        process.stderr.write(`Credentials cleared for "${providerId}".\n`);
+    }
+    else {
+        await deps.authManager.clearAll();
+        process.stderr.write('All credentials cleared.\n');
+    }
+}

package/dist/cli/commands/providers.d.ts

@@ -0,0 +1,2 @@
+import type { AuthDeps } from '../../deps.js';
+export declare function runProviders(positionals: string[], flags: Record<string, string | boolean>, deps: AuthDeps): Promise<void>;

package/dist/cli/commands/providers.js

@@ -0,0 +1,30 @@
+import { formatJson, formatTable } from '../formatters.js';
+export async function runProviders(positionals, flags, deps) {
+    const format = flags.format ?? (process.stdout.isTTY ? 'table' : 'json');
+    const providers = deps.authManager.providerRegistry.list();
+    const statuses = await Promise.all(providers.map(p => deps.authManager.getStatus(p.id)));
+    if (format === 'json') {
+        const output = statuses.map(s => ({
+            id: s.id,
+            name: s.name,
+            strategy: s.strategy,
+            configured: s.configured,
+            valid: s.valid,
+            credentialType: s.credentialType ?? null,
+        }));
+        process.stdout.write(formatJson(output) + '\n');
+    }
+    else {
+        if (statuses.length === 0) {
+            process.stderr.write('No providers configured.\n');
+            return;
+        }
+        const rows = statuses.map(s => ({
+            id: s.id,
+            name: s.name,
+            strategy: s.strategy,
+            status: s.valid ? 'authenticated' : 'not authenticated',
+        }));
+        process.stdout.write(formatTable(rows) + '\n');
+    }
+}

package/dist/cli/commands/remote.d.ts

@@ -0,0 +1 @@
+export declare function runRemote(positionals: string[], flags: Record<string, string | boolean>): Promise<void>;

package/dist/cli/commands/remote.js

@@ -0,0 +1,67 @@
+import { getRemotes, addRemote, removeRemote } from '../../sync/remote-config.js';
+import { formatJson, formatTable } from '../formatters.js';
+export async function runRemote(positionals, flags) {
+    const subcommand = positionals[0];
+    switch (subcommand) {
+        case 'add': {
+            const name = positionals[1];
+            const host = positionals[2];
+            if (!name || !host) {
+                process.stderr.write('Usage: sig remote add <name> <host> [--user <user>] [--path <path>] [--ssh-key <key>]\n');
+                process.exitCode = 1;
+                return;
+            }
+            const remote = {
+                name,
+                type: 'ssh',
+                host,
+                ...(typeof flags.user === 'string' ? { user: flags.user } : {}),
+                ...(typeof flags.path === 'string' ? { path: flags.path } : {}),
+                ...(typeof flags['ssh-key'] === 'string' ? { sshKey: flags['ssh-key'] } : {}),
+            };
+            await addRemote(remote);
+            process.stderr.write(`Remote "${name}" added (${host})\n`);
+            return;
+        }
+        case 'remove': {
+            const name = positionals[1];
+            if (!name) {
+                process.stderr.write('Usage: sig remote remove <name>\n');
+                process.exitCode = 1;
+                return;
+            }
+            const removed = await removeRemote(name);
+            if (removed) {
+                process.stderr.write(`Remote "${name}" removed\n`);
+            }
+            else {
+                process.stderr.write(`Remote "${name}" not found\n`);
+                process.exitCode = 1;
+            }
+            return;
+        }
+        case 'list':
+        default: {
+            const remotes = await getRemotes();
+            if (remotes.length === 0) {
+                process.stderr.write('No remotes configured. Use "sig remote add <name> <host>" to add one.\n');
+                return;
+            }
+            const format = typeof flags.format === 'string' ? flags.format : 'table';
+            if (format === 'json') {
+                process.stdout.write(formatJson(remotes) + '\n');
+            }
+            else {
+                const rows = remotes.map(r => ({
+                    name: r.name,
+                    type: r.type,
+                    host: r.host,
+                    user: r.user ?? '-',
+                    path: r.path ?? '~/.signet/credentials',
+                }));
+                process.stdout.write(formatTable(rows) + '\n');
+            }
+            return;
+        }
+    }
+}

package/dist/cli/commands/request.d.ts

@@ -0,0 +1,2 @@
+import type { AuthDeps } from '../../deps.js';
+export declare function runRequest(positionals: string[], flags: Record<string, string | boolean>, deps: AuthDeps): Promise<void>;

package/dist/cli/commands/request.js

@@ -0,0 +1,82 @@
+import { isOk } from '../../core/result.js';
+import { buildUserAgent } from '../../utils/http.js';
+import { formatJson } from '../formatters.js';
+export async function runRequest(positionals, flags, deps) {
+    const url = positionals[0];
+    if (!url) {
+        process.stderr.write('Usage: sig request <url> [--method GET] [--header "Name: Value"] [--body \'{}\']\n');
+        process.exitCode = 1;
+        return;
+    }
+    const result = await deps.authManager.getCredentialsByUrl(url);
+    if (!isOk(result)) {
+        process.stderr.write(`Auth error: ${result.error.message}\n`);
+        process.exitCode = 1;
+        return;
+    }
+    const { provider, credential } = result.value;
+    const authHeaders = deps.authManager.applyToRequest(provider.id, credential);
+    const requestHeaders = {
+        'User-Agent': buildUserAgent(),
+        ...authHeaders,
+    };
+    // Parse --header flags (may appear multiple times via positionals workaround, or as single value)
+    if (typeof flags.header === 'string') {
+        const idx = flags.header.indexOf(':');
+        if (idx > 0) {
+            requestHeaders[flags.header.slice(0, idx).trim()] = flags.header.slice(idx + 1).trim();
+        }
+    }
+    const httpMethod = (flags.method ?? 'GET').toUpperCase();
+    const fetchOptions = { method: httpMethod, headers: requestHeaders };
+    const body = flags.body;
+    if (body && ['POST', 'PUT', 'PATCH'].includes(httpMethod)) {
+        fetchOptions.body = body;
+        if (!requestHeaders['Content-Type']) {
+            requestHeaders['Content-Type'] = 'application/json';
+        }
+    }
+    try {
+        const response = await fetch(url, fetchOptions);
+        const responseBody = await response.text();
+        let formattedBody;
+        try {
+            formattedBody = JSON.stringify(JSON.parse(responseBody), null, 2);
+        }
+        catch {
+            formattedBody = responseBody;
+        }
+        const format = flags.format ?? 'json';
+        switch (format) {
+            case 'body':
+                process.stdout.write(formattedBody + '\n');
+                break;
+            case 'headers': {
+                process.stdout.write(`${response.status} ${response.statusText}\n`);
+                response.headers.forEach((value, key) => {
+                    process.stdout.write(`${key}: ${value}\n`);
+                });
+                break;
+            }
+            case 'json':
+            default: {
+                const responseHeaders = {};
+                response.headers.forEach((value, key) => { responseHeaders[key] = value; });
+                process.stdout.write(formatJson({
+                    status: response.status,
+                    statusText: response.statusText,
+                    headers: responseHeaders,
+                    body: formattedBody,
+                }) + '\n');
+                break;
+            }
+        }
+        if (!response.ok) {
+            process.exitCode = 1;
+        }
+    }
+    catch (e) {
+        process.stderr.write(`Request failed: ${e.message}\n`);
+        process.exitCode = 1;
+    }
+}

package/dist/cli/commands/status.d.ts

@@ -0,0 +1,2 @@
+import type { AuthDeps } from '../../deps.js';
+export declare function runStatus(positionals: string[], flags: Record<string, string | boolean>, deps: AuthDeps): Promise<void>;

package/dist/cli/commands/status.js

@@ -0,0 +1,41 @@
+import { formatJson, formatTable } from '../formatters.js';
+export async function runStatus(positionals, flags, deps) {
+    const providerId = flags.provider ?? positionals[0];
+    const format = flags.format ?? (process.stdout.isTTY ? 'table' : 'json');
+    if (providerId) {
+        const status = await deps.authManager.getStatus(providerId);
+        if (format === 'json') {
+            process.stdout.write(formatJson(status) + '\n');
+        }
+        else {
+            process.stdout.write(formatTable([{
+                    id: status.id,
+                    name: status.name,
+                    strategy: status.strategy,
+                    valid: status.valid ? 'yes' : 'no',
+                    type: status.credentialType ?? '-',
+                    expires: status.expiresInMinutes !== undefined ? `${status.expiresInMinutes}m` : '-',
+                }]) + '\n');
+        }
+        return;
+    }
+    const statuses = await deps.authManager.getAllStatus();
+    if (format === 'json') {
+        process.stdout.write(formatJson(statuses) + '\n');
+    }
+    else {
+        if (statuses.length === 0) {
+            process.stderr.write('No providers configured.\n');
+            return;
+        }
+        const rows = statuses.map(s => ({
+            id: s.id,
+            name: s.name,
+            strategy: s.strategy,
+            valid: s.valid ? 'yes' : 'no',
+            type: s.credentialType ?? '-',
+            expires: s.expiresInMinutes !== undefined ? `${s.expiresInMinutes}m` : '-',
+        }));
+        process.stdout.write(formatTable(rows) + '\n');
+    }
+}

package/dist/cli/commands/sync.d.ts

@@ -0,0 +1,2 @@
+import type { AuthDeps } from '../../deps.js';
+export declare function runSync(positionals: string[], flags: Record<string, string | boolean>, deps: AuthDeps): Promise<void>;

package/dist/cli/commands/sync.js

@@ -0,0 +1,62 @@
+import { getRemote, getRemotes } from '../../sync/remote-config.js';
+import { SyncEngine } from '../../sync/sync-engine.js';
+import { formatJson } from '../formatters.js';
+export async function runSync(positionals, flags, deps) {
+    const subcommand = positionals[0];
+    if (subcommand !== 'push' && subcommand !== 'pull') {
+        process.stderr.write('Usage: sig sync <push|pull> [remote] [--provider <id>] [--force]\n');
+        process.exitCode = 1;
+        return;
+    }
+    // Resolve remote: explicit name or default (if only one configured)
+    const remoteName = positionals[1];
+    let remote;
+    if (remoteName) {
+        remote = await getRemote(remoteName);
+        if (!remote) {
+            process.stderr.write(`Remote "${remoteName}" not found. Run "sig remote list" to see configured remotes.\n`);
+            process.exitCode = 4;
+            return;
+        }
+    }
+    else {
+        const remotes = await getRemotes();
+        if (remotes.length === 0) {
+            process.stderr.write('No remotes configured. Run "sig remote add <name> <host>" first.\n');
+            process.exitCode = 4;
+            return;
+        }
+        if (remotes.length > 1) {
+            process.stderr.write('Multiple remotes configured. Specify which one:\n');
+            for (const r of remotes) {
+                process.stderr.write(`  ${r.name} (${r.host})\n`);
+            }
+            process.exitCode = 1;
+            return;
+        }
+        remote = remotes[0];
+    }
+    const engine = new SyncEngine(deps.storage, remote);
+    const force = flags.force === true;
+    const provider = typeof flags.provider === 'string' ? [flags.provider] : undefined;
+    process.stderr.write(`${subcommand === 'push' ? 'Pushing' : 'Pulling'} credentials ${subcommand === 'push' ? 'to' : 'from'} "${remote.name}" (${remote.host})...\n`);
+    const result = subcommand === 'push'
+        ? await engine.push(provider, force)
+        : await engine.pull(provider, force);
+    // Report results
+    const synced = subcommand === 'push' ? result.pushed : result.pulled;
+    if (synced.length > 0) {
+        process.stderr.write(`Synced: ${synced.join(', ')}\n`);
+    }
+    if (result.skipped.length > 0) {
+        process.stderr.write(`Skipped (conflict): ${result.skipped.join(', ')} — use --force to overwrite\n`);
+    }
+    if (result.errors.length > 0) {
+        for (const e of result.errors) {
+            process.stderr.write(`Error (${e.providerId}): ${e.error}\n`);
+        }
+        process.exitCode = 4;
+    }
+    // JSON output to stdout
+    process.stdout.write(formatJson(result) + '\n');
+}

package/dist/cli/formatters.d.ts

@@ -0,0 +1,3 @@
+export declare function formatJson(data: unknown): string;
+export declare function formatTable(rows: Record<string, string>[]): string;
+export declare function formatCredentialHeaders(headers: Record<string, string>): string;