@epilot/cli 0.1.194 → 0.1.196

package/README.md

@@ -29,7 +29,7 @@ npm install -g @epilot/cli
 
 <!-- usage-help -->
 ```
-epilot v0.1.194 — CLI for epilot APIs
+epilot v0.1.196 — CLI for epilot APIs
 
 USAGE
   epilot <api> <operationId> [params...] [flags]
@@ -60,6 +60,13 @@ COMMANDS
   profile                 Manage named profiles
   completion              Generate shell completion scripts
 
+AGENT MODE (optional)
+  auth login --agent      Register this CLI as an Agent Auth agent (org switching, silent token refresh, scoped access profiles)
+  org list                List your organizations and this CLI's access
+  org use <id>            Switch the active organization
+  org request <id>        Request access (--access <profile> --reason "…")
+  org current             Show the active organization
+
 APIs
   access-token         Access Token API
   address              Address API
@@ -123,6 +130,8 @@ EXAMPLES
   $ epilot entity searchEntities -d '{"q":"*"}'
   $ epilot entity searchEntities --jsonata 'results[0]._title'
   $ echo '{"q":"*"}' | epilot entity searchEntities
+  $ epilot auth login --agent --org 739224   # agent mode (optional)
+  $ epilot org request 739224 --access config:write --reason "Fix the PV journey mapping"
 
 Run epilot <api> to list available operations.
 Run epilot <api> <operationId> --help for operation details.
@@ -158,6 +167,82 @@ Token resolution order:
 4. Stored credentials (`~/.config/epilot/credentials.json`)
 5. Interactive prompt (if TTY)
 
+### Agent mode (optional)
+
+`epilot auth login --agent` registers the CLI through the
+[Agent Auth Protocol](https://agentauthprotocol.com/specification/v1.0-draft) (via
+[`@epilot/agent-auth`](../agent-auth)): your machine is a **host**, the CLI is an **agent** you approve once in the
+browser, and short-lived epilot tokens are issued per organization and refreshed silently. In return you get
+organization switching, scoped **access profiles** and sessions that outlive a single token. Plain logins are not
+affected: a profile without an agent behaves exactly as before.
+
+```bash
+# Register the CLI as an agent and approve it in the browser (read access, your login organization)
+epilot auth login --agent
+
+# A specific organization, an access profile and the purpose shown to the approving user
+epilot auth login --agent --org 739224 --access config:write --reason "Fix the PV registration journey mapping"
+
+# Non-interactive (CI / agents): requires --org; prints the approval URL and polls until approved
+epilot auth login --agent --org 739224 --no-interactive --json
+
+# Status shows the agent, its grants (profile, expiry, reason); logout revokes the agent
+epilot auth status
+epilot auth logout
+```
+
+Access profiles scope what the issued tokens may do. `read` is the default and lives as long as the agent; every
+other profile is an escalation that requires a `--reason` (10–200 characters, prompted for in a TTY) and expires.
+The flag is `--access` because `--profile` already selects a [named CLI profile](#profiles):
+
+| `--access` | Meaning | Read-only | Expires after |
+| --- | --- | --- | --- |
+| `read` | Read everything you can see | yes | never (agent lifetime) |
+| `config:read` | Read configuration (journeys, automations, workflows, schemas, portals, designs) | yes | 7 days |
+| `config:write` | Change configuration | no | 24 hours |
+| `data:read` | Read business data (contacts, opportunities, orders, files, messages) | yes | 7 days |
+| `data:write` | Change business data | no | 24 hours |
+| `full` | Everything your account can do | no | 24 hours |
+
+Anonymization is a read-only property: `--anonymize` (and `org request` without `--full-pii`) only applies to read
+profiles. Combining `--anonymize` with a write profile is an error ("anonymize is only available with read
+profiles"), because an agent must never write masked data back. `--readonly` with a write profile downgrades it to
+its read sibling (`config:write` → `config:read`, `full` → `read`). On the approval page the user can only narrow what
+the CLI asked for; the CLI then issues tokens for the profile that was actually granted.
+
+#### Organizations
+
+One approval grants access to one organization. Switching or adding organizations goes through `epilot org`
+(agent mode only — without an agent the commands exit 1 with "This profile has no agent identity. Run
+`epilot auth login --agent` first.", or `{"error":"agent_required"}` with `--json`):
+
+```bash
+epilot org list                 # organizations with access (profile, anonymized, "expires in 23h", pending)
+epilot org current              # the active organization and its profile
+epilot org use 911210           # switch: issues a token under the most permissive grant (asks for access otherwise)
+epilot org use 911210 --access data:read            # ...or under a specific granted profile
+epilot org request 911210       # ask for read, anonymized access (approved in the browser)
+epilot org request 911210 --full-pii                # read access with unmasked personal data
+epilot org request 911210 --access data:write --reason "Import meter readings from the portal export"
+epilot org request 911210 --access full --reason "…" --no-interactive --json   # prints the approval, exits 0 (pending)
+```
+
+`--write` is a deprecated alias for `--access full`. Write profiles always get full personal data (`--full-pii` is
+implied). After an approval that happened outside the CLI (e.g. from a `--no-interactive` request),
+`epilot org use <id>` completes the switch; `auth status` lists every grant with its profile, expiry and reason.
+
+#### Silent refresh
+
+Issued tokens are short-lived. Whenever a command runs and the stored token of an agent-mode profile is missing or
+expires within two minutes, the CLI issues a fresh one through the agent (same organization and profile) and stores
+it — you stay logged in for as long as the agent and its grant are active. If the agent was revoked or expired, run
+`epilot auth login --agent` again. A plain `epilot auth login` (or `--token`) on the same profile revokes that
+profile's agent, so plain tokens are never replaced.
+
+Local state lives in `~/.config/epilot/agent-auth/` (`host.json` for the machine key, `agents/<profile>.json` for
+the per-profile agent; both mode 0600). `EPILOT_AGENT_AUTH_ISSUER` overrides the Agent Auth server URL (defaults per
+stage: `--use-dev`, `--use-staging`).
+
 ## Profiles
 
 Manage multiple environments, similar to AWS CLI profiles:
@@ -383,6 +468,9 @@ Full documentation with sample calls and responses for all APIs:
 # Install dependencies
 pnpm install
 
+# Build the workspace dependency once (bundled into the CLI by tsup; also needed by tests and `pnpm dev`)
+pnpm --filter @epilot/agent-auth build
+
 # Generate API commands + definitions + docs from client specs
 pnpm generate
 

package/dist/{access-token-3XCBQDFI.js → access-token-7DZIIHDK.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   callApi
-} from "./chunk-WWO5RPHF.js";
+} from "./chunk-Y4B3K4IO.js";
+import "./chunk-JQW3WOJB.js";
 import "./chunk-IOLKUHUB.js";
-import "./chunk-KTCBDUL2.js";
-import "./chunk-M3M3C5WH.js";
-import "./chunk-YHQA2AVG.js";
+import "./chunk-SQ55BTMV.js";
+import "./chunk-QPUCHKXS.js";
 import "./chunk-7ZQ666ZQ.js";
 
 // src/commands/apis/access-token.ts

package/dist/{add-component-GTIUBZP6.js → add-component-M2NRQPLH.js}

@@ -3,10 +3,10 @@ import {
   log,
   readManifest,
   writeManifest
-} from "./chunk-5KHD2F3J.js";
-import "./chunk-KTCBDUL2.js";
-import "./chunk-M3M3C5WH.js";
-import "./chunk-YHQA2AVG.js";
+} from "./chunk-BIOWN64A.js";
+import "./chunk-JQW3WOJB.js";
+import "./chunk-SQ55BTMV.js";
+import "./chunk-QPUCHKXS.js";
 import "./chunk-7ZQ666ZQ.js";
 
 // src/commands/app/add-component.ts

package/dist/{add-function-5RIKXAEC.js → add-function-ZA7DR3NM.js}

@@ -4,10 +4,10 @@ import {
   readManifest,
   validateScheduleExpression,
   writeManifest
-} from "./chunk-5KHD2F3J.js";
-import "./chunk-KTCBDUL2.js";
-import "./chunk-M3M3C5WH.js";
-import "./chunk-YHQA2AVG.js";
+} from "./chunk-BIOWN64A.js";
+import "./chunk-JQW3WOJB.js";
+import "./chunk-SQ55BTMV.js";
+import "./chunk-QPUCHKXS.js";
 import "./chunk-7ZQ666ZQ.js";
 
 // src/commands/app/add-function.ts

package/dist/{address-ACXTZTLB.js → address-OEHR5MKW.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   callApi
-} from "./chunk-WWO5RPHF.js";
+} from "./chunk-Y4B3K4IO.js";
+import "./chunk-JQW3WOJB.js";
 import "./chunk-IOLKUHUB.js";
-import "./chunk-KTCBDUL2.js";
-import "./chunk-M3M3C5WH.js";
-import "./chunk-YHQA2AVG.js";
+import "./chunk-SQ55BTMV.js";
+import "./chunk-QPUCHKXS.js";
 import "./chunk-7ZQ666ZQ.js";
 
 // src/commands/apis/address.ts

package/dist/{address-suggestions-MIUHAFVV.js → address-suggestions-SF3YNSJN.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   callApi
-} from "./chunk-WWO5RPHF.js";
+} from "./chunk-Y4B3K4IO.js";
+import "./chunk-JQW3WOJB.js";
 import "./chunk-IOLKUHUB.js";
-import "./chunk-KTCBDUL2.js";
-import "./chunk-M3M3C5WH.js";
-import "./chunk-YHQA2AVG.js";
+import "./chunk-SQ55BTMV.js";
+import "./chunk-QPUCHKXS.js";
 import "./chunk-7ZQ666ZQ.js";
 
 // src/commands/apis/address-suggestions.ts

package/dist/agent-auth-GV2T4GET.js

@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+import {
+  REFRESH_WINDOW_MS,
+  agentPath,
+  agentProfileKey,
+  deleteAgentRecord,
+  ensureHostKey,
+  forgetAgentForProfile,
+  formatExpiresIn,
+  getAgentAuthClient,
+  isAgentGoneError,
+  issueTokenForOrg,
+  loadAgentIdentity,
+  loadAgentRecord,
+  loadHostKey,
+  printLoginAgainHint,
+  refreshTokenIfNeeded,
+  resolveAgentAuthIssuer,
+  saveAgentRecord
+} from "./chunk-G6KI5Z7X.js";
+import "./chunk-SQ55BTMV.js";
+import "./chunk-QPUCHKXS.js";
+import "./chunk-7ZQ666ZQ.js";
+export {
+  REFRESH_WINDOW_MS,
+  agentPath,
+  agentProfileKey,
+  deleteAgentRecord,
+  ensureHostKey,
+  forgetAgentForProfile,
+  formatExpiresIn,
+  getAgentAuthClient,
+  isAgentGoneError,
+  issueTokenForOrg,
+  loadAgentIdentity,
+  loadAgentRecord,
+  loadHostKey,
+  printLoginAgainHint,
+  refreshTokenIfNeeded,
+  resolveAgentAuthIssuer,
+  saveAgentRecord
+};

package/dist/{ai-agents-OWQRQK5A.js → ai-agents-3SI3KJ5H.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   callApi
-} from "./chunk-WWO5RPHF.js";
+} from "./chunk-Y4B3K4IO.js";
+import "./chunk-JQW3WOJB.js";
 import "./chunk-IOLKUHUB.js";
-import "./chunk-KTCBDUL2.js";
-import "./chunk-M3M3C5WH.js";
-import "./chunk-YHQA2AVG.js";
+import "./chunk-SQ55BTMV.js";
+import "./chunk-QPUCHKXS.js";
 import "./chunk-7ZQ666ZQ.js";
 
 // src/commands/apis/ai-agents.ts

package/dist/{api-PQZEGSUV.js → api-7HGTYTZV.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   callApi
-} from "./chunk-WWO5RPHF.js";
+} from "./chunk-Y4B3K4IO.js";
+import "./chunk-JQW3WOJB.js";
 import "./chunk-IOLKUHUB.js";
-import "./chunk-KTCBDUL2.js";
-import "./chunk-M3M3C5WH.js";
-import "./chunk-YHQA2AVG.js";
+import "./chunk-SQ55BTMV.js";
+import "./chunk-QPUCHKXS.js";
 import "./chunk-7ZQ666ZQ.js";
 
 // src/commands/app/api.ts

package/dist/app-JLV2WOYK.js

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+
+// src/commands/app/index.ts
+import { defineCommand } from "citty";
+var app_default = defineCommand({
+  meta: {
+    name: "app",
+    description: "Manage epilot Apps \u2014 create, deploy, and manage app manifests"
+  },
+  subCommands: {
+    init: () => import("./init-5PYFSAQA.js").then((m) => m.default),
+    "add-component": () => import("./add-component-M2NRQPLH.js").then((m) => m.default),
+    "remove-component": () => import("./remove-component-W2E6ZA2E.js").then((m) => m.default),
+    "add-function": () => import("./add-function-ZA7DR3NM.js").then((m) => m.default),
+    validate: () => import("./validate-7TSPYKFI.js").then((m) => m.default),
+    deploy: () => import("./deploy-Y2EQYBAB.js").then((m) => m.default),
+    dev: () => import("./dev-OFEMDQSS.js").then((m) => m.default),
+    export: () => import("./export-RNPPIDBT.js").then((m) => m.default),
+    versions: () => import("./versions-LBLHNSOL.js").then((m) => m.default),
+    review: () => import("./review-Y5RBCWJX.js").then((m) => m.default),
+    api: () => import("./api-7HGTYTZV.js").then((m) => m.default)
+  }
+});
+export {
+  app_default as default
+};

package/dist/{audit-logs-3DVFWVWL.js → audit-logs-I2MPPQ3V.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   callApi
-} from "./chunk-WWO5RPHF.js";
+} from "./chunk-Y4B3K4IO.js";
+import "./chunk-JQW3WOJB.js";
 import "./chunk-IOLKUHUB.js";
-import "./chunk-KTCBDUL2.js";
-import "./chunk-M3M3C5WH.js";
-import "./chunk-YHQA2AVG.js";
+import "./chunk-SQ55BTMV.js";
+import "./chunk-QPUCHKXS.js";
 import "./chunk-7ZQ666ZQ.js";
 
 // src/commands/apis/audit-logs.ts

package/dist/auth-6NBJQ6NB.js

@@ -0,0 +1,235 @@
+#!/usr/bin/env node
+import {
+  ACCESS_PROFILE_INFO,
+  AgentAuthError,
+  deleteAgentRecord,
+  formatExpiresIn,
+  isAccessProfile,
+  loadAgentIdentity,
+  organizationGrants
+} from "./chunk-G6KI5Z7X.js";
+import {
+  loadCredentials,
+  removeCredentials
+} from "./chunk-SQ55BTMV.js";
+import {
+  getResolvedProfile,
+  resolveProfileName,
+  upsertProfile
+} from "./chunk-QPUCHKXS.js";
+import {
+  BOLD,
+  DIM,
+  GREEN,
+  RED,
+  RESET,
+  YELLOW
+} from "./chunk-7ZQ666ZQ.js";
+
+// src/commands/auth.ts
+import { defineCommand } from "citty";
+var auth_default = defineCommand({
+  meta: {
+    name: "auth",
+    description: "Manage authentication"
+  },
+  subCommands: {
+    login: () => import("./auth-login-7D6YJLCA.js").then((m) => m.default),
+    token: () => import("./auth-token-CI5L3CCJ.js").then((m) => m.default),
+    logout: defineCommand({
+      meta: { name: "logout", description: "Remove stored credentials" },
+      args: {
+        profile: { type: "string", description: "Profile to log out (or EPILOT_PROFILE env)" }
+      },
+      run: async ({ args }) => {
+        const profileName = args.profile || process.env.EPILOT_PROFILE;
+        const loaded = loadAgentIdentity(profileName);
+        if (loaded) {
+          try {
+            await loaded.client.revokeAgent(loaded.identity.hostKey, loaded.identity.agentId);
+            process.stdout.write(`${DIM}Agent ${loaded.record.agent_id} revoked.${RESET}
+`);
+          } catch (error) {
+            const reason = error instanceof AgentAuthError ? error.code : "error";
+            process.stdout.write(
+              `${DIM}Could not revoke agent ${loaded.record.agent_id} (${reason}); removing it locally.${RESET}
+`
+            );
+          }
+          deleteAgentRecord(profileName);
+          const resolvedName = resolveProfileName(profileName);
+          if (resolvedName && getResolvedProfile(profileName)?.token) {
+            upsertProfile(resolvedName, {
+              token: void 0,
+              org_id: void 0,
+              user_id: void 0,
+              expires_at: void 0,
+              access_profile: void 0
+            });
+          }
+        }
+        const removed = removeCredentials();
+        if (removed || loaded) {
+          process.stdout.write(`${GREEN}Logged out successfully.${RESET}
+`);
+        } else {
+          process.stdout.write(`No stored credentials found.
+`);
+        }
+      }
+    }),
+    status: defineCommand({
+      meta: { name: "status", description: "Show authentication status" },
+      args: {
+        profile: { type: "string", description: "Profile to inspect (or EPILOT_PROFILE env)" }
+      },
+      run: async ({ args }) => {
+        const profileName = args.profile || process.env.EPILOT_PROFILE;
+        const loaded = loadAgentIdentity(profileName);
+        if (!loaded) {
+          const plain = loadCredentials();
+          if (!plain) {
+            process.stdout.write(`${YELLOW}Not authenticated.${RESET}
+`);
+            process.stdout.write(`Run ${BOLD}epilot auth login${RESET} to authenticate.
+`);
+            return;
+          }
+          printTokenStatus(plain, { agent: false });
+          return;
+        }
+        const creds = loadCredentials() ?? profileCredentials(profileName);
+        if (creds) {
+          printTokenStatus(creds, { agent: true });
+        } else {
+          process.stdout.write(`${YELLOW}No valid token stored${RESET} ${DIM}(issued on next API call)${RESET}
+`);
+        }
+        process.stdout.write(`
+${BOLD}Agent Auth${RESET}
+`);
+        process.stdout.write(`  Agent:   ${loaded.record.agent_id} ${DIM}(${loaded.record.name})${RESET}
+`);
+        process.stdout.write(`  Host:    ${loaded.record.host_id}
+`);
+        process.stdout.write(`  Issuer:  ${loaded.record.issuer}
+`);
+        try {
+          const status = await loaded.client.getAgentStatus(loaded.identity.hostKey, loaded.identity.agentId);
+          const color = status.status === "active" ? GREEN : status.status === "pending" ? YELLOW : RED;
+          process.stdout.write(`  Status:  ${color}${status.status}${RESET}`);
+          if (status.expires_at) process.stdout.write(` ${DIM}(expires ${status.expires_at})${RESET}`);
+          process.stdout.write("\n");
+          const grants = organizationGrants(status.agent_capability_grants);
+          if (grants.length) {
+            process.stdout.write(`  Grants:
+`);
+            for (const g of grants) {
+              const expiry = formatExpiresIn(g.expiresAt);
+              const expired = expiry === "expired";
+              const level = [g.profile, g.anonymized ? "anonymized" : "", expiry ?? ""].filter(Boolean);
+              const statusColor = g.grant.status === "active" && !expired ? GREEN : g.grant.status === "pending" ? YELLOW : RED;
+              const active = g.organizationId && g.organizationId === creds?.org_id && g.profile === (creds?.access_profile ?? "read") ? ` ${DIM}(active)${RESET}` : "";
+              const reason = g.reason ? ` ${DIM}\u2014 "${g.reason}"${RESET}` : "";
+              process.stdout.write(
+                `    ${(g.organizationId ?? "login organization").padEnd(12)} ${statusColor}${expired ? "expired" : g.grant.status}${RESET} ${DIM}${level.join(", ")}${RESET}${active}${reason}
+`
+              );
+            }
+          }
+        } catch (error) {
+          const reason = error instanceof AgentAuthError ? `${error.message} (${error.code})` : String(error);
+          process.stdout.write(`  Status:  ${RED}unavailable${RESET} ${DIM}${reason}${RESET}
+`);
+        }
+      }
+    })
+  }
+});
+var profileCredentials = (profileName) => {
+  const profile = getResolvedProfile(profileName);
+  if (!profile?.token) return null;
+  if (profile.expires_at && new Date(profile.expires_at) < /* @__PURE__ */ new Date()) return null;
+  return {
+    token: profile.token,
+    org_id: profile.org_id,
+    user_id: profile.user_id,
+    expires_at: profile.expires_at,
+    access_profile: profile.access_profile
+  };
+};
+var printTokenStatus = (creds, { agent }) => {
+  const claims = parseJwtPayload(creds.token);
+  const isApiToken = claims?.token_type === "api";
+  const isCognitoToken = typeof claims?.iss === "string" && claims.iss.includes("cognito-idp");
+  const tokenType = isApiToken ? "API Token" : isCognitoToken ? "User Token" : "Token";
+  process.stdout.write(`${GREEN}${BOLD}Authenticated${RESET} ${DIM}(${tokenType})${RESET}
+`);
+  const name = claims?.token_name || claims?.email || claims?.["cognito:username"] || creds.name;
+  const orgId = claims?.org_id || claims?.["custom:ivy_org_id"] || creds.org_id;
+  const userId = claims?.user_id || claims?.["custom:ivy_user_id"] || creds.user_id;
+  const tokenId = claims?.token_id;
+  const adminEmail = claims?.admin_email;
+  const tokenUse = claims?.token_use;
+  const roles = claims?.assume_roles;
+  const readOnly = claims?.read_only === true;
+  const anonymize = claims?.anonymize === true;
+  if (name) process.stdout.write(`  Name:    ${name}
+`);
+  if (adminEmail && adminEmail !== name) process.stdout.write(`  Email:   ${adminEmail}
+`);
+  if (orgId) process.stdout.write(`  Org:     ${orgId}
+`);
+  if (userId) process.stdout.write(`  User:    ${userId}
+`);
+  if (tokenId && tokenId !== userId) process.stdout.write(`  Token ID: ${tokenId}
+`);
+  if (tokenUse) process.stdout.write(`  Use:     ${tokenUse}
+`);
+  if (roles?.length) process.stdout.write(`  Roles:   ${roles.join(", ")}
+`);
+  process.stdout.write(`  Access:  ${readOnly ? `${YELLOW}read-only${RESET}` : `${GREEN}read-write${RESET}`}
+`);
+  if (isAccessProfile(creds.access_profile)) {
+    process.stdout.write(
+      `  Profile: ${creds.access_profile} ${DIM}(${ACCESS_PROFILE_INFO[creds.access_profile].title})${RESET}
+`
+    );
+  }
+  if (anonymize) process.stdout.write(`  Data:    ${YELLOW}anonymized${RESET}
+`);
+  if (creds.expires_at) {
+    const expiry = new Date(creds.expires_at);
+    const now = /* @__PURE__ */ new Date();
+    const diffMs = expiry.getTime() - now.getTime();
+    const label = agent ? diffMs < 864e5 ? `${Math.floor(diffMs / 36e5)}h ${Math.floor(diffMs % 36e5 / 6e4)}m` : `${Math.floor(diffMs / 864e5)} days` : `${Math.floor(diffMs / (1e3 * 60 * 60 * 24))} days`;
+    process.stdout.write(`  Expires: ${creds.expires_at} ${DIM}(${label})${RESET}
+`);
+  } else if (claims?.exp) {
+    const expiry = new Date(claims.exp * 1e3);
+    const now = /* @__PURE__ */ new Date();
+    const diffMs = expiry.getTime() - now.getTime();
+    const label = diffMs < 0 ? `${RED}expired${RESET}` : diffMs < 864e5 ? `${Math.floor(diffMs / 36e5)}h ${Math.floor(diffMs % 36e5 / 6e4)}m` : `${Math.floor(diffMs / 864e5)} days`;
+    process.stdout.write(`  Expires: ${expiry.toISOString()} ${DIM}(${label})${RESET}
+`);
+  } else if (claims?.iat && !claims?.exp) {
+    const issued = new Date(claims.iat * 1e3);
+    process.stdout.write(`  Issued:  ${issued.toISOString()} ${DIM}(no expiry)${RESET}
+`);
+  }
+  process.stdout.write(`  Token:   ${creds.token.substring(0, 20)}...${RESET}
+`);
+};
+var parseJwtPayload = (token) => {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+    const payload = Buffer.from(parts[1], "base64url").toString("utf-8");
+    return JSON.parse(payload);
+  } catch {
+    return null;
+  }
+};
+export {
+  auth_default as default
+};

package/dist/auth-login-7D6YJLCA.js

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+import {
+  AGENT_FLAG_DESCRIPTION,
+  agentLogin,
+  auth_login_default,
+  browserLogin,
+  chooseOrganization,
+  describeAccess,
+  openBrowser,
+  parseAccessProfile,
+  printApproval,
+  readOnlySibling,
+  resolveLoginProfile,
+  resolveReason
+} from "./chunk-OI6GYEIX.js";
+import "./chunk-IOLKUHUB.js";
+import "./chunk-G6KI5Z7X.js";
+import "./chunk-SQ55BTMV.js";
+import "./chunk-QPUCHKXS.js";
+import "./chunk-7ZQ666ZQ.js";
+export {
+  AGENT_FLAG_DESCRIPTION,
+  agentLogin,
+  browserLogin,
+  chooseOrganization,
+  auth_login_default as default,
+  describeAccess,
+  openBrowser,
+  parseAccessProfile,
+  printApproval,
+  readOnlySibling,
+  resolveLoginProfile,
+  resolveReason
+};

package/dist/{auth-token-APXLIQAO.js → auth-token-CI5L3CCJ.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   saveCredentials
-} from "./chunk-M3M3C5WH.js";
-import "./chunk-YHQA2AVG.js";
+} from "./chunk-SQ55BTMV.js";
+import "./chunk-QPUCHKXS.js";
 import {
   BOLD,
   GREEN,

package/dist/{automation-NHRRP6J4.js → automation-GTVLSKXA.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   callApi
-} from "./chunk-WWO5RPHF.js";
+} from "./chunk-Y4B3K4IO.js";
+import "./chunk-JQW3WOJB.js";
 import "./chunk-IOLKUHUB.js";
-import "./chunk-KTCBDUL2.js";
-import "./chunk-M3M3C5WH.js";
-import "./chunk-YHQA2AVG.js";
+import "./chunk-SQ55BTMV.js";
+import "./chunk-QPUCHKXS.js";
 import "./chunk-7ZQ666ZQ.js";
 
 // src/commands/apis/automation.ts

package/dist/{billing-PCSW2TQP.js → billing-TNGDZAJ2.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   callApi
-} from "./chunk-WWO5RPHF.js";
+} from "./chunk-Y4B3K4IO.js";
+import "./chunk-JQW3WOJB.js";
 import "./chunk-IOLKUHUB.js";
-import "./chunk-KTCBDUL2.js";
-import "./chunk-M3M3C5WH.js";
-import "./chunk-YHQA2AVG.js";
+import "./chunk-SQ55BTMV.js";
+import "./chunk-QPUCHKXS.js";
 import "./chunk-7ZQ666ZQ.js";
 
 // src/commands/apis/billing.ts