@epilot/cli 0.1.194 → 0.1.196

package/dist/chunk-G6KI5Z7X.js

@@ -0,0 +1,606 @@
+#!/usr/bin/env node
+import {
+  saveCredentials
+} from "./chunk-SQ55BTMV.js";
+import {
+  getConfigDir,
+  getResolvedProfile,
+  resolveProfileName
+} from "./chunk-QPUCHKXS.js";
+import {
+  BOLD,
+  DIM,
+  RESET,
+  YELLOW
+} from "./chunk-7ZQ666ZQ.js";
+
+// src/lib/agent-auth.ts
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { join } from "path";
+
+// ../agent-auth/dist/index.js
+import { createHash, generateKeyPairSync } from "crypto";
+import { createPrivateKey, randomUUID, sign as cryptoSign } from "crypto";
+var AgentAuthError = class extends Error {
+  constructor(status, code, message, details) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.details = details;
+    this.name = "AgentAuthError";
+  }
+};
+var jwkThumbprint = (jwk) => createHash("sha256").update(JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x })).digest("base64url");
+var publicJwk = (jwk) => ({ kty: "OKP", crv: "Ed25519", x: jwk.x });
+var generateKeyPair = () => {
+  const { privateKey } = generateKeyPairSync("ed25519");
+  const jwk = privateKey.export({ format: "jwk" });
+  const privateJwk = { kty: "OKP", crv: "Ed25519", x: jwk.x, d: jwk.d };
+  return { publicKey: publicJwk(privateJwk), privateKey: privateJwk, thumbprint: jwkThumbprint(privateJwk) };
+};
+var keyPairFromPrivateJwk = (privateJwk) => {
+  if (!privateJwk.d) throw new Error('A private Ed25519 JWK (with "d") is required.');
+  return { publicKey: publicJwk(privateJwk), privateKey: privateJwk, thumbprint: jwkThumbprint(privateJwk) };
+};
+var b64url = (input) => Buffer.from(input).toString("base64url");
+var nowSeconds = () => Math.floor(Date.now() / 1e3);
+var signJwt = (privateJwk, header, payload) => {
+  const key = createPrivateKey({
+    key: { kty: "OKP", crv: "Ed25519", x: privateJwk.x, d: privateJwk.d },
+    format: "jwk"
+  });
+  const encodedHeader = b64url(JSON.stringify({ alg: "EdDSA", ...header }));
+  const encodedPayload = b64url(JSON.stringify(payload));
+  const signature = cryptoSign(null, Buffer.from(`${encodedHeader}.${encodedPayload}`), key);
+  return `${encodedHeader}.${encodedPayload}.${b64url(signature)}`;
+};
+var createHostJwt = ({ hostKey, audience, agentPublicKey, ttlSeconds = 60 }) => {
+  const iat = nowSeconds();
+  return signJwt(
+    hostKey.privateKey,
+    { typ: "host+jwt" },
+    {
+      iss: hostKey.thumbprint,
+      aud: audience,
+      iat,
+      exp: iat + ttlSeconds,
+      jti: randomUUID(),
+      host_public_key: hostKey.publicKey,
+      ...agentPublicKey ? { agent_public_key: publicJwk(agentPublicKey) } : {}
+    }
+  );
+};
+var createAgentJwt = ({
+  agentKey,
+  hostThumbprint,
+  agentId,
+  audience,
+  capabilities,
+  ttlSeconds = 60
+}) => {
+  const iat = nowSeconds();
+  return signJwt(
+    agentKey.privateKey,
+    { typ: "agent+jwt" },
+    {
+      iss: hostThumbprint,
+      sub: agentId,
+      aud: audience,
+      iat,
+      exp: iat + Math.min(ttlSeconds, 60),
+      jti: randomUUID(),
+      ...capabilities ? { capabilities } : {}
+    }
+  );
+};
+var trimSlash = (value) => {
+  let end = value.length;
+  while (end > 0 && value[end - 1] === "/") end--;
+  return value.slice(0, end);
+};
+var safeJson = (text) => {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+};
+var AgentAuthClient = class {
+  baseUrl;
+  fetchImpl;
+  discoveryTtlMs;
+  timeoutMs;
+  discovery;
+  constructor(options) {
+    this.baseUrl = trimSlash(options.baseUrl);
+    this.fetchImpl = options.fetch ?? fetch;
+    this.discoveryTtlMs = options.discoveryTtlMs ?? 36e5;
+    this.timeoutMs = options.timeoutMs ?? 15e3;
+  }
+  /** GET /.well-known/agent-configuration (cached). */
+  async discover(force = false) {
+    if (!force && this.discovery && Date.now() - this.discovery.fetchedAt < this.discoveryTtlMs) {
+      return this.discovery.value;
+    }
+    const value = await this.request("GET", `${this.baseUrl}/.well-known/agent-configuration`);
+    this.discovery = { value, fetchedAt: Date.now() };
+    return value;
+  }
+  /** Resolve an endpoint from discovery; relative paths are resolved against the issuer. */
+  async endpoint(name) {
+    const config = await this.discover();
+    const path = config.endpoints[name];
+    return /^https?:\/\//.test(path) ? path : `${trimSlash(config.issuer)}${path.startsWith("/") ? "" : "/"}${path}`;
+  }
+  /** POST /agent/register with a host JWT that carries the agent's public key. */
+  async registerAgent(hostKey, agentKey, body) {
+    const config = await this.discover();
+    const jwt = createHostJwt({ hostKey, audience: config.issuer, agentPublicKey: agentKey.publicKey });
+    return this.request("POST", await this.endpoint("register"), body, jwt);
+  }
+  /** POST /agent/request-capability with an agent JWT. */
+  async requestCapability(identity, body) {
+    const config = await this.discover();
+    const jwt = createAgentJwt({
+      agentKey: identity.agentKey,
+      hostThumbprint: identity.hostKey.thumbprint,
+      agentId: identity.agentId,
+      audience: config.issuer
+    });
+    return this.request(
+      "POST",
+      await this.endpoint("request_capability"),
+      body,
+      jwt
+    );
+  }
+  /** GET /agent/status?agent_id=… with a host JWT. */
+  async getAgentStatus(hostKey, agentId) {
+    const config = await this.discover();
+    const jwt = createHostJwt({ hostKey, audience: config.issuer });
+    const url = new URL(await this.endpoint("status"));
+    url.searchParams.set("agent_id", agentId);
+    return this.request("GET", url.toString(), void 0, jwt);
+  }
+  /**
+   * Poll /agent/status until the agent leaves `pending` (or, when `pendingGrantIds`
+   * is given, until none of those grants is pending). Honors the approval
+   * interval and stops at the approval expiry.
+   */
+  async waitForApproval(hostKey, agentId, approval, options = {}) {
+    const intervalMs = Math.max(1, approval?.interval ?? 5) * 1e3;
+    const deadline = Date.now() + (approval?.expires_in ?? 600) * 1e3;
+    for (; ; ) {
+      if (options.signal?.aborted) throw new AgentAuthError(499, "aborted", "Approval wait was aborted.");
+      const status = await this.getAgentStatus(hostKey, agentId);
+      options.onPoll?.(status);
+      const stillPending = options.pendingGrantIds?.length ? status.agent_capability_grants.some(
+        (grant) => grant.id && options.pendingGrantIds?.includes(grant.id) && grant.status === "pending"
+      ) : status.status === "pending";
+      if (!stillPending) return status;
+      if (Date.now() + intervalMs > deadline) {
+        throw new AgentAuthError(408, "approval_expired", "The user did not approve the request in time.");
+      }
+      await new Promise((resolve) => setTimeout(resolve, intervalMs));
+    }
+  }
+  /** POST /capability/execute with an agent JWT whose `aud` is the capability location. */
+  async execute(identity, body, location) {
+    const target = location ?? (await this.discover()).default_location;
+    const jwt = createAgentJwt({
+      agentKey: identity.agentKey,
+      hostThumbprint: identity.hostKey.thumbprint,
+      agentId: identity.agentId,
+      audience: target,
+      capabilities: [body.capability]
+    });
+    const result = await this.request("POST", target, body, jwt);
+    if (result && typeof result === "object" && "data" in result) return result.data;
+    if (result?.status === "completed") return result.result;
+    return result;
+  }
+  /** GET /capability/list — anonymous, or with grant status when authenticated. */
+  async listCapabilities(auth, query = {}) {
+    const config = await this.discover();
+    const url = new URL(await this.endpoint("capabilities"));
+    for (const [key, value] of Object.entries(query)) {
+      if (value !== void 0) url.searchParams.set(key, String(value));
+    }
+    const jwt = auth ? this.jwtFor(auth, config.issuer) : void 0;
+    return this.request("GET", url.toString(), void 0, jwt);
+  }
+  /** GET /capability/describe?name=… */
+  async describeCapability(name, auth) {
+    const config = await this.discover();
+    const url = new URL(await this.endpoint("describe_capability"));
+    url.searchParams.set("name", name);
+    const jwt = auth ? this.jwtFor(auth, config.issuer) : void 0;
+    return this.request("GET", url.toString(), void 0, jwt);
+  }
+  async reactivateAgent(hostKey, agentId) {
+    return this.hostPost("reactivate", hostKey, { agent_id: agentId });
+  }
+  async revokeAgent(hostKey, agentId) {
+    return this.hostPost("revoke", hostKey, { agent_id: agentId });
+  }
+  async rotateAgentKey(hostKey, agentId, newAgentKey) {
+    return this.hostPost("rotate_key", hostKey, { agent_id: agentId, public_key: newAgentKey.publicKey });
+  }
+  async rotateHostKey(hostKey, newHostKey) {
+    return this.hostPost("rotate_host_key", hostKey, { public_key: newHostKey.publicKey });
+  }
+  async revokeHost(hostKey) {
+    return this.hostPost("revoke_host", hostKey, {});
+  }
+  /** Server-to-server: validate an agent JWT. `bearer` is whatever the server requires (epilot: an epilot token). */
+  async introspect(token, bearer) {
+    return this.request("POST", await this.endpoint("introspect"), { token }, bearer);
+  }
+  jwtFor(auth, audience) {
+    return "agentId" in auth ? createAgentJwt({
+      agentKey: auth.agentKey,
+      hostThumbprint: auth.hostKey.thumbprint,
+      agentId: auth.agentId,
+      audience
+    }) : createHostJwt({ hostKey: auth.hostKey, audience });
+  }
+  async hostPost(name, hostKey, body) {
+    const config = await this.discover();
+    const jwt = createHostJwt({ hostKey, audience: config.issuer });
+    return this.request("POST", await this.endpoint(name), body, jwt);
+  }
+  async request(method, url, body, bearer) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    let response;
+    try {
+      response = await this.fetchImpl(url, {
+        method,
+        headers: {
+          accept: "application/json",
+          ...body !== void 0 ? { "content-type": "application/json" } : {},
+          ...bearer ? { authorization: `Bearer ${bearer}` } : {}
+        },
+        body: body !== void 0 ? JSON.stringify(body) : void 0,
+        signal: controller.signal
+      });
+    } catch (error) {
+      throw new AgentAuthError(0, "network_error", `Agent Auth request failed: ${String(error)}`);
+    } finally {
+      clearTimeout(timer);
+    }
+    const text = await response.text();
+    const json = text ? safeJson(text) : void 0;
+    if (!response.ok) {
+      const error = json ?? {};
+      throw new AgentAuthError(
+        response.status,
+        error.error ?? `http_${response.status}`,
+        error.message ?? error.error_description ?? `Agent Auth server responded with ${response.status}.`,
+        error
+      );
+    }
+    return json;
+  }
+};
+var EPILOT_CAPABILITIES = {
+  /** The linked user's organizations annotated with this agent's grants. Host default capability. */
+  organizationsList: "epilot.organizations.list",
+  /** Mint a short-lived epilot access token for an organization the agent has a grant for. */
+  accessTokenIssue: "epilot.access_token.issue"
+};
+var ACCESS_PROFILES = ["read", "config:read", "config:write", "data:read", "data:write", "full"];
+var DAY = 86400;
+var ACCESS_PROFILE_INFO = {
+  read: {
+    title: "Read everything you can see",
+    description: "Look at data and configuration you have access to. Nothing can be created or changed.",
+    readOnly: true,
+    anonymizeAllowed: true
+  },
+  "config:read": {
+    title: "Read configuration",
+    description: "Look at journeys, automations, workflows, schemas, portals, designs and other configuration. No business data, nothing changed.",
+    readOnly: true,
+    anonymizeAllowed: true,
+    escalationTtlSeconds: 7 * DAY
+  },
+  "config:write": {
+    title: "Change configuration",
+    description: "Create and change journeys, automations, workflows, schemas, portals, designs and other configuration. No business data.",
+    readOnly: false,
+    anonymizeAllowed: false,
+    escalationTtlSeconds: DAY
+  },
+  "data:read": {
+    title: "Read business data",
+    description: "Look at contacts, opportunities, orders, files, messages and other business data. No configuration changes.",
+    readOnly: true,
+    anonymizeAllowed: true,
+    escalationTtlSeconds: 7 * DAY
+  },
+  "data:write": {
+    title: "Change business data",
+    description: "Create and change contacts, opportunities, orders, files, messages and other business data. No configuration changes.",
+    readOnly: false,
+    anonymizeAllowed: false,
+    escalationTtlSeconds: DAY
+  },
+  full: {
+    title: "Everything you can do",
+    description: "Everything your own account can do, including changing data and configuration.",
+    readOnly: false,
+    anonymizeAllowed: false,
+    escalationTtlSeconds: DAY
+  }
+};
+var isAccessProfile = (value) => typeof value === "string" && ACCESS_PROFILES.includes(value);
+var isReadProfile = (profile) => ACCESS_PROFILE_INFO[profile].readOnly;
+var PROFILE_RANK = {
+  read: 0,
+  "config:read": 1,
+  "data:read": 2,
+  "config:write": 3,
+  "data:write": 4,
+  full: 5
+};
+var mostPermissiveProfile = (profiles) => profiles.length ? [...profiles].sort((a, b) => PROFILE_RANK[b] - PROFILE_RANK[a])[0] : void 0;
+var REASON_MIN_LENGTH = 10;
+var REASON_MAX_LENGTH = 200;
+var organizationAccessCapability = (options = {}) => {
+  if (options.anonymize === true && options.profile && !ACCESS_PROFILE_INFO[options.profile].anonymizeAllowed) {
+    throw new AgentAuthError(400, "invalid_capabilities", "anonymize is only available with read profiles", {
+      access_profile: options.profile
+    });
+  }
+  const constraints = {
+    ...options.organizationId !== void 0 ? { organization_id: options.organizationId } : {},
+    ...options.profile !== void 0 ? { access_profile: options.profile } : {},
+    ...options.readOnly !== void 0 ? { read_only: options.readOnly } : {},
+    ...options.anonymize !== void 0 ? { anonymize: options.anonymize } : {}
+  };
+  return Object.keys(constraints).length ? { name: EPILOT_CAPABILITIES.accessTokenIssue, constraints } : { name: EPILOT_CAPABILITIES.accessTokenIssue };
+};
+var listEpilotOrganizations = (client, identity) => client.execute(identity, {
+  capability: EPILOT_CAPABILITIES.organizationsList
+});
+var issueEpilotAccessToken = (client, identity, args) => client.execute(identity, {
+  capability: EPILOT_CAPABILITIES.accessTokenIssue,
+  arguments: { ...args }
+});
+var validateReason = (profile, reason) => {
+  const trimmed = reason?.trim() || void 0;
+  if (profile !== "read" && (!trimmed || trimmed.length < REASON_MIN_LENGTH)) {
+    throw new AgentAuthError(
+      400,
+      "reason_required",
+      `A reason of at least ${REASON_MIN_LENGTH} characters is required when requesting the ${profile} profile.`,
+      { access_profile: profile }
+    );
+  }
+  if (trimmed && trimmed.length > REASON_MAX_LENGTH) {
+    throw new AgentAuthError(400, "invalid_request", `The reason must not exceed ${REASON_MAX_LENGTH} characters.`);
+  }
+  return trimmed;
+};
+var requestOrganizationAccess = async (client, identity, options) => {
+  const profile = options.profile ?? "read";
+  const anonymize = options.anonymize ?? ACCESS_PROFILE_INFO[profile].anonymizeAllowed;
+  const reason = validateReason(profile, options.reason);
+  const capability = organizationAccessCapability({ organizationId: options.organizationId, profile, anonymize });
+  return client.requestCapability(identity, {
+    capabilities: [capability],
+    ...reason ? { reason } : {},
+    ...options.approvalReturnUri ? { approval_return_uri: options.approvalReturnUri } : {}
+  });
+};
+var organizationGrants = (grants) => grants.filter((grant) => grant.capability === EPILOT_CAPABILITIES.accessTokenIssue).map((grant) => {
+  const organizationId = grant.constraints?.organization_id;
+  const rawProfile = grant.constraints?.access_profile;
+  const profile = isAccessProfile(rawProfile) ? rawProfile : "read";
+  const info = ACCESS_PROFILE_INFO[profile];
+  const readOnly = typeof grant.constraints?.read_only === "boolean" ? grant.constraints.read_only : info.readOnly;
+  return {
+    grant,
+    organizationId: typeof organizationId === "string" ? organizationId : void 0,
+    profile,
+    readOnly,
+    anonymized: info.anonymizeAllowed && grant.constraints?.anonymize !== false,
+    expiresAt: grant.expires_at,
+    reason: grant.reason
+  };
+});
+var isGrantUsable = (grant, now = Date.now()) => grant.grant.status === "active" && (!grant.expiresAt || new Date(grant.expiresAt).getTime() > now);
+var epilotAgentAuthIssuer = (stage = "production") => stage === "production" ? "https://access-token.sls.epilot.io/v1/access-tokens/agent-auth" : `https://access-token.${stage}.sls.epilot.io/v1/access-tokens/agent-auth`;
+
+// src/lib/agent-auth.ts
+var REFRESH_WINDOW_MS = 2 * 60 * 1e3;
+var agentAuthDir = () => join(getConfigDir(), "agent-auth");
+var hostPath = () => join(agentAuthDir(), "host.json");
+var agentsDir = () => join(agentAuthDir(), "agents");
+var agentProfileKey = (profileName) => resolveProfileName(profileName) ?? "default";
+var agentPath = (profileName) => join(agentsDir(), `${agentProfileKey(profileName)}.json`);
+var readJson = (path) => {
+  if (!existsSync(path)) return null;
+  try {
+    return JSON.parse(readFileSync(path, "utf-8"));
+  } catch {
+    return null;
+  }
+};
+var writeSecret = (path, value) => {
+  mkdirSync(join(path, ".."), { recursive: true, mode: 448 });
+  writeFileSync(path, JSON.stringify(value, null, 2), { mode: 384 });
+};
+var loadHostKey = () => {
+  const record = readJson(hostPath());
+  if (!record?.privateKey?.d) return null;
+  try {
+    return keyPairFromPrivateJwk(record.privateKey);
+  } catch {
+    return null;
+  }
+};
+var ensureHostKey = () => {
+  const existing = loadHostKey();
+  if (existing) return existing;
+  const key = generateKeyPair();
+  const record = {
+    privateKey: key.privateKey,
+    thumbprint: key.thumbprint,
+    created_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  writeSecret(hostPath(), record);
+  return key;
+};
+var loadAgentRecord = (profileName) => {
+  const record = readJson(agentPath(profileName));
+  return record?.agent_id && record.privateKey?.d ? record : null;
+};
+var saveAgentRecord = (record, profileName) => {
+  writeSecret(agentPath(profileName), record);
+};
+var deleteAgentRecord = (profileName) => {
+  const path = agentPath(profileName);
+  if (!existsSync(path)) return false;
+  rmSync(path);
+  return true;
+};
+var resolveAgentAuthIssuer = (env = "production") => process.env.EPILOT_AGENT_AUTH_ISSUER || epilotAgentAuthIssuer(env);
+var getAgentAuthClient = (envOrIssuer = "production") => {
+  const baseUrl = /^https?:\/\//.test(envOrIssuer) ? envOrIssuer : resolveAgentAuthIssuer(envOrIssuer);
+  return new AgentAuthClient({ baseUrl });
+};
+var loadAgentIdentity = (profileName) => {
+  const record = loadAgentRecord(profileName);
+  const hostKey = loadHostKey();
+  if (!record || !hostKey) return null;
+  try {
+    const agentKey = keyPairFromPrivateJwk(record.privateKey);
+    return {
+      identity: { hostKey, agentKey, agentId: record.agent_id },
+      record,
+      client: getAgentAuthClient(record.issuer),
+      profileKey: agentProfileKey(profileName)
+    };
+  } catch {
+    return null;
+  }
+};
+var forgetAgentForProfile = async (profileName, out = (s) => process.stdout.write(s)) => {
+  const loaded = loadAgentIdentity(profileName);
+  if (!loaded) return false;
+  try {
+    await loaded.client.revokeAgent(loaded.identity.hostKey, loaded.identity.agentId);
+    out(`${DIM}Agent ${loaded.record.agent_id} from a previous --agent login revoked.${RESET}
+`);
+  } catch (error) {
+    const reason = error instanceof AgentAuthError ? error.code : "error";
+    out(`${DIM}Could not revoke agent ${loaded.record.agent_id} (${reason}); removing it locally.${RESET}
+`);
+  }
+  deleteAgentRecord(profileName);
+  return true;
+};
+var issueTokenForOrg = async (loaded, orgId, options = {}) => {
+  const issued = await issueEpilotAccessToken(loaded.client, loaded.identity, {
+    organization_id: orgId,
+    ...options.profile !== void 0 ? { access_profile: options.profile } : {},
+    ...options.readOnly !== void 0 ? { read_only: options.readOnly } : {},
+    ...options.anonymize !== void 0 ? { anonymize: options.anonymize } : {}
+  });
+  const accessProfile = isAccessProfile(issued.access_profile) ? issued.access_profile : options.profile;
+  const creds = {
+    token: issued.token,
+    org_id: issued.organization_id ?? orgId,
+    user_id: issued.user_id,
+    expires_at: issued.expires_at,
+    ...accessProfile ? { access_profile: accessProfile } : {},
+    ...issued.email ? { name: issued.email } : {}
+  };
+  saveCredentials(creds, options.profileName);
+  saveAgentRecord(
+    {
+      ...loaded.record,
+      org_id: creds.org_id,
+      access_profile: accessProfile,
+      read_only: issued.read_only ?? options.readOnly,
+      anonymize: issued.anonymize ?? options.anonymize
+    },
+    options.profileName
+  );
+  return issued;
+};
+var expiresSoon = (expiresAt) => {
+  if (!expiresAt) return false;
+  const expiry = new Date(expiresAt).getTime();
+  return Number.isNaN(expiry) || expiry - Date.now() < REFRESH_WINDOW_MS;
+};
+var refreshTokenIfNeeded = async (flagProfile) => {
+  const loaded = loadAgentIdentity(flagProfile);
+  if (!loaded) return null;
+  const profile = getResolvedProfile(flagProfile);
+  const current = profile?.token ? profile : loadStoredCredentials();
+  if (current?.token && !expiresSoon(current.expires_at)) return current.token;
+  const orgId = current?.org_id ?? loaded.record.org_id;
+  if (!orgId) return null;
+  const issued = await issueTokenForOrg(loaded, orgId, {
+    profile: loaded.record.access_profile,
+    readOnly: loaded.record.read_only,
+    anonymize: loaded.record.anonymize,
+    profileName: flagProfile
+  });
+  return issued.token;
+};
+var loadStoredCredentials = () => readJson(join(getConfigDir(), "credentials.json"));
+var isAgentGoneError = (error) => error instanceof AgentAuthError && ["agent_revoked", "agent_expired", "agent_rejected", "agent_not_found", "host_revoked"].includes(error.code);
+var printLoginAgainHint = (error) => {
+  process.stderr.write(`${YELLOW}Agent session is no longer valid (${error.code}).${RESET} `);
+  process.stderr.write(`Run ${BOLD}epilot auth login --agent${RESET} to authenticate again.
+`);
+};
+var formatExpiresIn = (expiresAt, now = Date.now()) => {
+  if (!expiresAt) return void 0;
+  const diffMs = new Date(expiresAt).getTime() - now;
+  if (Number.isNaN(diffMs)) return void 0;
+  if (diffMs <= 0) return "expired";
+  const minutes = Math.floor(diffMs / 6e4);
+  if (minutes < 60) return `expires in ${Math.max(1, minutes)}m`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 48) return `expires in ${hours}h`;
+  return `expires in ${Math.floor(hours / 24)}d`;
+};
+
+export {
+  AgentAuthError,
+  generateKeyPair,
+  EPILOT_CAPABILITIES,
+  ACCESS_PROFILES,
+  ACCESS_PROFILE_INFO,
+  isAccessProfile,
+  isReadProfile,
+  mostPermissiveProfile,
+  organizationAccessCapability,
+  listEpilotOrganizations,
+  validateReason,
+  requestOrganizationAccess,
+  organizationGrants,
+  isGrantUsable,
+  REFRESH_WINDOW_MS,
+  agentProfileKey,
+  agentPath,
+  loadHostKey,
+  ensureHostKey,
+  loadAgentRecord,
+  saveAgentRecord,
+  deleteAgentRecord,
+  resolveAgentAuthIssuer,
+  getAgentAuthClient,
+  loadAgentIdentity,
+  forgetAgentForProfile,
+  issueTokenForOrg,
+  refreshTokenIfNeeded,
+  isAgentGoneError,
+  printLoginAgainHint,
+  formatExpiresIn
+};

package/dist/{chunk-KTCBDUL2.js → chunk-JQW3WOJB.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/lib/user-agent.ts
-var CLI_USER_AGENT = `epilot-cli/${true ? "0.1.194" : "dev"}`;
+var CLI_USER_AGENT = `epilot-cli/${true ? "0.1.196" : "dev"}`;
 
 export {
   CLI_USER_AGENT