@mondaydotcomorg/z2h-cli 0.1.1 → 0.3.0

package/dist/commands/build.d.ts

@@ -1,5 +1,6 @@
 export interface BuildOptions {
     json?: boolean;
+    publicUrl?: string;
 }
 export declare function buildCommand(opts: BuildOptions): Promise<void>;
 //# sourceMappingURL=build.d.ts.map

package/dist/commands/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/commands/build.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAgCpE"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/commands/build.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCpE"}

package/dist/commands/build.js

@@ -22,7 +22,11 @@ async function buildCommand(opts) {
         stdio: 'inherit',
     });
     util_logger.info(`building "${ctx.appName}" via trident`);
-    await execa.execa('yarn', ['build'], { cwd: ctx.paths.shadowDir, stdio: 'inherit' });
+    await execa.execa('yarn', ['build'], {
+        cwd: ctx.paths.shadowDir,
+        stdio: 'inherit',
+        env: { ...process.env, ...(opts.publicUrl ? { PUBLIC_URL: opts.publicUrl } : {}) },
+    });
     if (!(await fsExtra.pathExists(ctx.paths.shadowBuild))) {
         throw new Error(`Expected build output at ${ctx.paths.shadowBuild} — not found.`);
     }

package/dist/commands/create-workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-workspace.d.ts","sourceRoot":"","sources":["../../src/commands/create-workspace.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAiBD,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyDxF"}
+{"version":3,"file":"create-workspace.d.ts","sourceRoot":"","sources":["../../src/commands/create-workspace.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAiBD,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0DxF"}

package/dist/commands/create-workspace.js

@@ -60,6 +60,7 @@ async function createWorkspaceCommand(opts) {
         fsExtra.writeFile(path__default.default.join(home, 'package.json'), util_templates.renderTemplate(pkgRaw, { __Z2H_CLI_VERSION__: cliVersion })),
         fsExtra.copy(path__default.default.join(wsTemplatesDir, 'gitignore'), path__default.default.join(home, '.gitignore')),
         fsExtra.copy(path__default.default.join(wsTemplatesDir, 'yarnrc.yml'), path__default.default.join(home, '.yarnrc.yml')),
+        fsExtra.copy(path__default.default.join(wsTemplatesDir, 'yarnlock'), path__default.default.join(home, 'yarn.lock')),
         fsExtra.copy(path__default.default.join(wsTemplatesDir, 'nvmrc'), path__default.default.join(home, '.nvmrc')),
         fsExtra.copy(path__default.default.join(wsTemplatesDir, 'npmrc'), path__default.default.join(home, '.npmrc')),
         fsExtra.copy(path__default.default.join(wsTemplatesDir, 'README.md'), path__default.default.join(home, 'README.md')),

package/dist/commands/create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../src/commands/create.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AA0BD,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA0EvF"}
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../src/commands/create.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AA6BD,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAqFvF"}

package/dist/commands/create.js

@@ -7,12 +7,18 @@ const execa = require('execa');
 const util_logger = require('../util/logger.js');
 const util_workspace = require('../util/workspace.js');
 const util_templates = require('../util/templates.js');
+const util_manifest = require('../util/manifest.js');
+const util_appName = require('../util/app-name.js');
+const constants = require('../constants.js');
 
 const _interopDefault = e => e && e.__esModule ? e : { default: e };
 
 const path__default = /*#__PURE__*/_interopDefault(path);
 
-const APP_NAME_RE = /^[a-z][a-z0-9-]{1,49}$/;
+// Names reserved by the host MF (mf-bigbrain-zth) for platform pages under
+// /bigbrain-vibe/<name>. Creating an app with one of these would shadow the
+// platform page in the URL, so we refuse upfront.
+const RESERVED_APP_NAMES = new Set(['generate-z2h-token']);
 /**
  * Convert kebab-case to PascalCase. `demo-app` → `DemoApp`.
  */
@@ -40,7 +46,10 @@ async function createCommand(appName, opts) {
     // Validate workspace.
     const workspace = await util_workspace.assertWorkspace();
     // Validate app name.
-    if (!APP_NAME_RE.test(appName)) {
+    if (RESERVED_APP_NAMES.has(appName)) {
+        throw new Error(`App name "${appName}" is reserved by the Z2H host for a platform page under /bigbrain-vibe/${appName}. Pick a different name.`);
+    }
+    if (!constants.APP_NAME_PATTERN.test(appName)) {
         throw new Error(`App name "${appName}" is invalid. Use lowercase kebab-case (a-z, 0-9, -), ` +
             `2-50 chars, starting with a letter.`);
     }
@@ -58,6 +67,11 @@ async function createCommand(appName, opts) {
     if (!(await isDirEmpty(appDir))) {
         throw new Error(`${appDir} is non-empty. Pick a different name or wipe it first.`);
     }
+    // Check for manifest collision (network call — after all local checks).
+    const manifest = await util_manifest.readManifest();
+    if (manifest[util_appName.mfAppName(appName)]) {
+        throw new Error(`An app named "${appName}" already exists in the Z2H registry. Pick a different name.`);
+    }
     // Compute substitutions.
     const vars = {
         __APP_NAME__: appName,

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAaD,wBAAsB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA6EtE"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA+EtE"}

package/dist/commands/deploy.js

@@ -1,41 +1,44 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 
 const path = require('node:path');
+const os = require('node:os');
 const fsExtra = require('fs-extra');
-require('execa');
 const util_logger = require('../util/logger.js');
 const shadow_paths = require('../shadow/paths.js');
 const util_manifest = require('../util/manifest.js');
 const util_s3_upload = require('../util/s3/upload.js');
+const constants = require('../constants.js');
 const util_s3_client = require('../util/s3/client.js');
+const util_auth_authStore = require('../util/auth/auth-store.js');
 const util_appName = require('../util/app-name.js');
 const commands_build = require('./build.js');
 
 const _interopDefault = e => e && e.__esModule ? e : { default: e };
 
 const path__default = /*#__PURE__*/_interopDefault(path);
+const os__default = /*#__PURE__*/_interopDefault(os);
 
-const APONO_BUNDLE = '<APONO_BUNDLE_NAME>'; // TODO: replace with actual bundle name once infra setup is complete
-async function requestAponoAccess() {
-    {
-        util_logger.warn(`skipping Apono request — APONO_BUNDLE is still a placeholder ("${APONO_BUNDLE}"). Set it in deploy.ts before relying on auto-grant.`);
-        return;
-    }
-}
 async function deployCommand(opts) {
     if (opts.json) {
         util_logger.setOutputMode('json');
     }
-    util_logger.info('checking S3 bucket');
-    await util_s3_client.assertBucketExists();
-    util_logger.info('building');
-    await commands_build.buildCommand({ json: opts.json });
     const paths = shadow_paths.resolveConsumerPaths(process.cwd());
     const consumerPkg = (await fsExtra.readJson(paths.consumerPkg));
     if (!consumerPkg.name) {
         throw new Error('Consumer package.json must have a "name" field');
     }
     const appName = util_appName.mfAppName(consumerPkg.name);
+    // Validate the user's deploy token is on disk before doing any expensive
+    // work. Throws Z2hAuthMissingError with a remediation hint if not.
+    await util_auth_authStore.readZthAuth();
+    util_s3_client.setupS3Client({ appName });
+    util_logger.info('reading current Z2H manifest');
+    const manifest = await util_manifest.readManifest();
+    const version = util_manifest.nextVersion(manifest, appName);
+    const keyPrefix = `${appName}/${version}`;
+    const url = `${constants.BUCKET_READ_DNS_URL}/${keyPrefix}`;
+    util_logger.info('building');
+    await commands_build.buildCommand({ json: opts.json, publicUrl: url });
     if (!(await fsExtra.pathExists(paths.shadowBuild))) {
         throw new Error(`No build output at ${paths.shadowBuild} after build step.`);
     }
@@ -45,32 +48,28 @@ async function deployCommand(opts) {
         throw new Error(`Missing asset-manifest.json at ${assetManifestPath}.`);
     }
     const assetManifest = (await fsExtra.readJson(assetManifestPath));
-    util_logger.info('reading current Z2H manifest');
-    const manifest = await util_manifest.readManifest();
-    const version = util_manifest.nextVersion(manifest, appName);
-    const keyPrefix = `${appName}/${version}`;
-    const url = `${util_s3_client.BUCKET_READ_DNS_URL}/${keyPrefix}`;
+    const deployedBy = os__default.default.userInfo().username;
+    const entry = {
+        ...assetManifest,
+        version,
+        url,
+        deployedBy,
+    };
     if (opts.dryRun) {
-        util_logger.output(`[z2h-cli] dry-run: would upload to s3://${util_s3_client.BUCKET_WRITE_NAME}/${keyPrefix}/ as v${version}`, {
+        util_logger.output(`[z2h-cli] dry-run: would upload to s3://${constants.BUCKET_WRITE_NAME}/${keyPrefix}/ as v${version}`, {
             ok: true,
             dryRun: true,
             appName,
             version,
-            bucket: util_s3_client.BUCKET_WRITE_NAME,
+            bucket: constants.BUCKET_WRITE_NAME,
             keyPrefix,
             url,
-            entry: { ...assetManifest, version, url },
+            entry,
         });
         return;
     }
-    await requestAponoAccess();
-    util_logger.info(`uploading build → s3://${util_s3_client.BUCKET_WRITE_NAME}/${keyPrefix}/`);
+    util_logger.info(`uploading build → s3://${constants.BUCKET_WRITE_NAME}/${keyPrefix}/`);
     await util_s3_upload.uploadDir(paths.shadowBuild, keyPrefix);
-    const entry = {
-        ...assetManifest,
-        version,
-        url,
-    };
     util_logger.info(`updating manifest entry "${appName}" → v${version}`);
     await util_manifest.writeManifest(util_manifest.upsertEntry(manifest, appName, entry));
     // The host MF parses the app name from the URL and prepends `mf-` itself
@@ -81,7 +80,7 @@ async function deployCommand(opts) {
         ok: true,
         appName,
         version,
-        bucket: util_s3_client.BUCKET_WRITE_NAME,
+        bucket: constants.BUCKET_WRITE_NAME,
         keyPrefix,
         url,
         liveUrl,

package/dist/commands/dev.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev.d.ts","sourceRoot":"","sources":["../../src/commands/dev.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAID,wBAAsB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAgDhE"}
+{"version":3,"file":"dev.d.ts","sourceRoot":"","sources":["../../src/commands/dev.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAID,wBAAsB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAuEhE"}

package/dist/commands/dev.js

@@ -1,5 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 
+const path = require('node:path');
+const fs = require('node:fs');
 const fsExtra = require('fs-extra');
 const chokidar = require('chokidar');
 const execa = require('execa');
@@ -8,6 +10,11 @@ const shadow_prepare = require('../shadow/prepare.js');
 const shadow_consumerPkg = require('../shadow/consumer-pkg.js');
 const shadow_sync = require('../shadow/sync.js');
 
+const _interopDefault = e => e && e.__esModule ? e : { default: e };
+
+const path__default = /*#__PURE__*/_interopDefault(path);
+const fs__default = /*#__PURE__*/_interopDefault(fs);
+
 const TRIDENT_READY_PATTERN = /Server started at/i;
 async function devCommand(opts) {
     if (opts.json) {
@@ -24,6 +31,28 @@ async function devCommand(opts) {
         cwd: ctx.paths.shadowDir,
         stdio: ['inherit', 'pipe', 'inherit'],
     });
+    const pidFile = path__default.default.join(ctx.paths.shadowDir, 'dev.pid');
+    if (server.pid) {
+        await fsExtra.writeFile(pidFile, String(server.pid));
+    }
+    const cleanupPid = () => {
+        try {
+            fs__default.default.unlinkSync(pidFile);
+        }
+        catch (_) {
+            // file already gone — ignore
+        }
+    };
+    server.on('exit', cleanupPid);
+    process.on('exit', cleanupPid);
+    process.on('SIGINT', () => {
+        server.kill();
+        process.exit(0);
+    });
+    process.on('SIGTERM', () => {
+        server.kill();
+        process.exit(0);
+    });
     let readyPrinted = false;
     server.stdout?.on('data', (chunk) => {
         process.stdout.write(chunk);

package/dist/commands/generate-z2h-token.d.ts

@@ -0,0 +1,16 @@
+export declare const DEFAULT_TOKEN_PAGE_URL = "https://bigbrain.me/bigbrain-vibe/generate-z2h-token";
+export declare const LOOPBACK_TIMEOUT_MS = 120000;
+export interface GenerateZ2HTokenOptions {
+    /**
+     * Skip browser auto-open AND skip the loopback callback. Prints the URL
+     * for the user to open manually, then waits for them to paste the token
+     * into the prompt. Use for SSH sessions, CI, or when the loopback can't
+     * reach the CLI for any reason.
+     */
+    noBrowser?: boolean;
+    /** Override the page URL — useful when pointing at staging. */
+    url?: string;
+    json?: boolean;
+}
+export declare function generateZ2HTokenCommand(opts?: GenerateZ2HTokenOptions): Promise<void>;
+//# sourceMappingURL=generate-z2h-token.d.ts.map

package/dist/commands/generate-z2h-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-z2h-token.d.ts","sourceRoot":"","sources":["../../src/commands/generate-z2h-token.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,sBAAsB,yDAAyD,CAAC;AAC7F,eAAO,MAAM,mBAAmB,SAAU,CAAC;AAE3C,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAuED,wBAAsB,uBAAuB,CAAC,IAAI,GAAE,uBAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B/F"}

package/dist/commands/generate-z2h-token.js

@@ -0,0 +1,107 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+
+const readline = require('node:readline/promises');
+const node_process = require('node:process');
+const execa = require('execa');
+const util_logger = require('../util/logger.js');
+const util_auth_writeAuth = require('../util/auth/write-auth.js');
+const util_auth_loopbackServer = require('../util/auth/loopback-server.js');
+
+const _interopDefault = e => e && e.__esModule ? e : { default: e };
+
+const readline__default = /*#__PURE__*/_interopDefault(readline);
+
+const DEFAULT_TOKEN_PAGE_URL = 'https://bigbrain.me/bigbrain-vibe/generate-z2h-token';
+const LOOPBACK_TIMEOUT_MS = 120_000;
+function browserOpenCommand() {
+    switch (process.platform) {
+        case 'darwin':
+            return 'open';
+        case 'win32':
+            return 'start';
+        default:
+            return 'xdg-open';
+    }
+}
+async function openInBrowser(url) {
+    await execa.execa(browserOpenCommand(), [url], { stdio: 'ignore' });
+}
+async function promptForToken() {
+    const rl = readline__default.default.createInterface({ input: node_process.stdin, output: node_process.stdout });
+    try {
+        const raw = await rl.question('Paste your token here, then press Enter:\n> ');
+        return raw.trim();
+    }
+    finally {
+        rl.close();
+    }
+}
+function withQueryParam(url, key, value) {
+    const sep = url.includes('?') ? '&' : '?';
+    return `${url}${sep}${key}=${encodeURIComponent(value)}`;
+}
+async function runManualFlow(pageUrl) {
+    util_logger.info(`open this URL in your browser to mint a Z2H deploy token:\n` +
+        `  ${pageUrl}\n\n` +
+        `1. Click "Generate token" on the page.\n` +
+        `2. Copy the token shown.\n` +
+        `3. Paste it below and press Enter.\n`);
+    const token = await promptForToken();
+    if (!token) {
+        throw new Error('No token entered.');
+    }
+    return token;
+}
+async function runLoopbackFlow(pageUrl) {
+    const loopback = await util_auth_loopbackServer.startLoopbackServer();
+    const fullUrl = withQueryParam(pageUrl, 'cli_callback', loopback.callbackUrl);
+    util_logger.info('opening your browser to mint a Z2H deploy token');
+    util_logger.info(`  ${fullUrl}`);
+    try {
+        await openInBrowser(fullUrl);
+    }
+    catch {
+        util_logger.warn('could not auto-open the browser. please visit the URL above manually.');
+    }
+    util_logger.info('waiting for the page to send the token (Ctrl+C to fall back to manual paste)…');
+    try {
+        return await loopback.waitForToken(LOOPBACK_TIMEOUT_MS);
+    }
+    catch {
+        return null;
+    }
+    finally {
+        loopback.close();
+    }
+}
+async function generateZ2HTokenCommand(opts = {}) {
+    if (opts.json) {
+        util_logger.setOutputMode('json');
+    }
+    const pageUrl = opts.url ?? process.env.Z2H_TOKEN_PAGE_URL ?? DEFAULT_TOKEN_PAGE_URL;
+    // --no-browser bypasses both auto-open and the loopback round-trip — the
+    // user opens the URL themselves and pastes the token. Useful when the
+    // loopback can't be reached (SSH, CI, locked-down browsers).
+    let token = null;
+    if (!opts.noBrowser) {
+        token = await runLoopbackFlow(pageUrl);
+        if (!token) {
+            util_logger.warn('loopback flow timed out or was cancelled — falling back to manual paste.');
+        }
+    }
+    if (!token) {
+        token = await runManualFlow(pageUrl);
+    }
+    if (!util_auth_writeAuth.validateJwtPattern(token)) {
+        throw new Error('That does not look like a JWT (expected three dot-separated segments).');
+    }
+    const { filePath } = await util_auth_writeAuth.writeZthAuth({ token });
+    util_logger.output(`[z2h-cli] token saved ✅ ${filePath}`, {
+        ok: true,
+        filePath,
+    });
+}
+
+exports.DEFAULT_TOKEN_PAGE_URL = DEFAULT_TOKEN_PAGE_URL;
+exports.LOOPBACK_TIMEOUT_MS = LOOPBACK_TIMEOUT_MS;
+exports.generateZ2HTokenCommand = generateZ2HTokenCommand;

package/dist/constants.d.ts

@@ -9,4 +9,12 @@ export declare const MIN_PORT = 13000;
 export declare const MAX_PORT = 19999;
 export declare const GITIGNORE_ENTRIES: string[];
 export declare const YARNRC_LINES: string[];
+export declare const BUCKET_WRITE_NAME = "prod-use1-bigbrain-zth-mf-assets";
+export declare const REGION = "us-east-1";
+export declare const BUCKET_WRITE_URL = "https://prod-use1-bigbrain-zth-mf-assets.s3.us-east-1.amazonaws.com";
+export declare const BUCKET_READ_DNS_NAME = "bigbrain-zth-mf-assets";
+export declare const BUCKET_READ_DNS_URL = "https://bigbrain-zth-mf-assets.bigbrain.me";
+export declare const MANIFEST_KEY = "mf-assets";
+export declare const MANIFEST_READ_URL = "https://bigbrain-zth-mf-assets.bigbrain.me/mf-assets";
+export declare const APP_NAME_PATTERN: RegExp;
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGjD,CAAC;AAQF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAG3C,eAAO,MAAM,YAAY,UAIxB,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGjD,CAAC;AAQF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAG3C,eAAO,MAAM,YAAY,UAIxB,CAAC;AAQF,eAAO,MAAM,iBAAiB,qCAAqC,CAAC;AACpE,eAAO,MAAM,MAAM,cAAc,CAAC;AAClC,eAAO,MAAM,gBAAgB,wEAA4D,CAAC;AAE1F,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,mBAAmB,+CAAgD,CAAC;AAKjF,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,iBAAiB,yDAA2C,CAAC;AAM1E,eAAO,MAAM,gBAAgB,QAA2B,CAAC"}

package/dist/constants.js

@@ -34,10 +34,38 @@ const YARNRC_LINES = [
     "npmAuthToken: '${NPM_TOKEN}'",
     "npmRegistryServer: 'https://registry.npmjs.org/'",
 ];
+// ─────────── Z2H deploy bucket / contract ─────────
+// Source of truth for the bucket layout. The CLI uses these when configuring
+// the S3 client + uploading; bigbrain-zth's STS broker imports them via
+// `@mondaydotcomorg/z2h-cli/constants` to scope the per-deploy session
+// policy to the same bucket + manifest key.
+const BUCKET_WRITE_NAME = 'prod-use1-bigbrain-zth-mf-assets';
+const REGION = 'us-east-1';
+const BUCKET_WRITE_URL = `https://${BUCKET_WRITE_NAME}.s3.${REGION}.amazonaws.com`;
+const BUCKET_READ_DNS_NAME = 'bigbrain-zth-mf-assets';
+const BUCKET_READ_DNS_URL = `https://${BUCKET_READ_DNS_NAME}.bigbrain.me`;
+// No `.json` extension — TridentSkeleton's `mfUrl` API appends `/mf-assets`
+// to the bucket base when fetching, so the manifest must live at this exact
+// key. See microfrontends/mf-bigbrain-zth/.../ZeroToHeroHost.tsx.
+const MANIFEST_KEY = 'mf-assets';
+const MANIFEST_READ_URL = `${BUCKET_READ_DNS_URL}/${MANIFEST_KEY}`;
+// ─────────── App-name slug — backend & CLI both honor this ─────
+// Lowercase kebab-case, must start with a letter, 2-50 chars total. The
+// backend STS broker rejects anything else with 400; the CLI can validate
+// upfront for friendlier errors.
+const APP_NAME_PATTERN = /^[a-z][a-z0-9-]{1,49}$/;
 
+exports.APP_NAME_PATTERN = APP_NAME_PATTERN;
+exports.BUCKET_READ_DNS_NAME = BUCKET_READ_DNS_NAME;
+exports.BUCKET_READ_DNS_URL = BUCKET_READ_DNS_URL;
+exports.BUCKET_WRITE_NAME = BUCKET_WRITE_NAME;
+exports.BUCKET_WRITE_URL = BUCKET_WRITE_URL;
 exports.GITIGNORE_ENTRIES = GITIGNORE_ENTRIES;
+exports.MANIFEST_KEY = MANIFEST_KEY;
+exports.MANIFEST_READ_URL = MANIFEST_READ_URL;
 exports.MAX_PORT = MAX_PORT;
 exports.MIN_PORT = MIN_PORT;
+exports.REGION = REGION;
 exports.SHADOW_DEV_DEPS = SHADOW_DEV_DEPS;
 exports.SHADOW_DIR_NAME = SHADOW_DIR_NAME;
 exports.SHADOW_SCRIPTS = SHADOW_SCRIPTS;

package/dist/esm/commands/build.d.ts

@@ -1,5 +1,6 @@
 export interface BuildOptions {
     json?: boolean;
+    publicUrl?: string;
 }
 export declare function buildCommand(opts: BuildOptions): Promise<void>;
 //# sourceMappingURL=build.d.ts.map

package/dist/esm/commands/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/commands/build.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAgCpE"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/commands/build.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCpE"}

package/dist/esm/commands/build.mjs

@@ -20,7 +20,11 @@ async function buildCommand(opts) {
         stdio: 'inherit',
     });
     info(`building "${ctx.appName}" via trident`);
-    await execa('yarn', ['build'], { cwd: ctx.paths.shadowDir, stdio: 'inherit' });
+    await execa('yarn', ['build'], {
+        cwd: ctx.paths.shadowDir,
+        stdio: 'inherit',
+        env: { ...process.env, ...(opts.publicUrl ? { PUBLIC_URL: opts.publicUrl } : {}) },
+    });
     if (!(await pathExists(ctx.paths.shadowBuild))) {
         throw new Error(`Expected build output at ${ctx.paths.shadowBuild} — not found.`);
     }

package/dist/esm/commands/create-workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-workspace.d.ts","sourceRoot":"","sources":["../../../src/commands/create-workspace.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAiBD,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyDxF"}
+{"version":3,"file":"create-workspace.d.ts","sourceRoot":"","sources":["../../../src/commands/create-workspace.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAiBD,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0DxF"}

package/dist/esm/commands/create-workspace.mjs

@@ -54,6 +54,7 @@ async function createWorkspaceCommand(opts) {
         writeFile(path.join(home, 'package.json'), renderTemplate(pkgRaw, { __Z2H_CLI_VERSION__: cliVersion })),
         copy(path.join(wsTemplatesDir, 'gitignore'), path.join(home, '.gitignore')),
         copy(path.join(wsTemplatesDir, 'yarnrc.yml'), path.join(home, '.yarnrc.yml')),
+        copy(path.join(wsTemplatesDir, 'yarnlock'), path.join(home, 'yarn.lock')),
         copy(path.join(wsTemplatesDir, 'nvmrc'), path.join(home, '.nvmrc')),
         copy(path.join(wsTemplatesDir, 'npmrc'), path.join(home, '.npmrc')),
         copy(path.join(wsTemplatesDir, 'README.md'), path.join(home, 'README.md')),

package/dist/esm/commands/create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../src/commands/create.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AA0BD,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA0EvF"}
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../src/commands/create.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AA6BD,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAqFvF"}

package/dist/esm/commands/create.mjs

@@ -5,8 +5,14 @@ import { execa } from 'execa';
 import { setOutputMode, info, output } from '../util/logger.mjs';
 import { assertWorkspace } from '../util/workspace.mjs';
 import { APP_TEMPLATES, getTemplatesDir, renderTemplate } from '../util/templates.mjs';
+import { readManifest } from '../util/manifest.mjs';
+import { mfAppName } from '../util/app-name.mjs';
+import { APP_NAME_PATTERN } from '../constants.mjs';
 
-const APP_NAME_RE = /^[a-z][a-z0-9-]{1,49}$/;
+// Names reserved by the host MF (mf-bigbrain-zth) for platform pages under
+// /bigbrain-vibe/<name>. Creating an app with one of these would shadow the
+// platform page in the URL, so we refuse upfront.
+const RESERVED_APP_NAMES = new Set(['generate-z2h-token']);
 /**
  * Convert kebab-case to PascalCase. `demo-app` → `DemoApp`.
  */
@@ -34,7 +40,10 @@ async function createCommand(appName, opts) {
     // Validate workspace.
     const workspace = await assertWorkspace();
     // Validate app name.
-    if (!APP_NAME_RE.test(appName)) {
+    if (RESERVED_APP_NAMES.has(appName)) {
+        throw new Error(`App name "${appName}" is reserved by the Z2H host for a platform page under /bigbrain-vibe/${appName}. Pick a different name.`);
+    }
+    if (!APP_NAME_PATTERN.test(appName)) {
         throw new Error(`App name "${appName}" is invalid. Use lowercase kebab-case (a-z, 0-9, -), ` +
             `2-50 chars, starting with a letter.`);
     }
@@ -52,6 +61,11 @@ async function createCommand(appName, opts) {
     if (!(await isDirEmpty(appDir))) {
         throw new Error(`${appDir} is non-empty. Pick a different name or wipe it first.`);
     }
+    // Check for manifest collision (network call — after all local checks).
+    const manifest = await readManifest();
+    if (manifest[mfAppName(appName)]) {
+        throw new Error(`An app named "${appName}" already exists in the Z2H registry. Pick a different name.`);
+    }
     // Compute substitutions.
     const vars = {
         __APP_NAME__: appName,

package/dist/esm/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../../src/commands/deploy.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAaD,wBAAsB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA6EtE"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../../src/commands/deploy.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA+EtE"}

package/dist/esm/commands/deploy.mjs

@@ -1,35 +1,37 @@
 import path from 'node:path';
+import os from 'node:os';
 import { readJson, pathExists } from 'fs-extra';
-import 'execa';
-import { setOutputMode, info, output, warn } from '../util/logger.mjs';
+import { setOutputMode, info, output } from '../util/logger.mjs';
 import { resolveConsumerPaths } from '../shadow/paths.mjs';
 import { readManifest, nextVersion, writeManifest, upsertEntry } from '../util/manifest.mjs';
 import { uploadDir } from '../util/s3/upload.mjs';
-import { assertBucketExists, BUCKET_WRITE_NAME, BUCKET_READ_DNS_URL } from '../util/s3/client.mjs';
+import { BUCKET_WRITE_NAME, BUCKET_READ_DNS_URL } from '../constants.mjs';
+import { setupS3Client } from '../util/s3/client.mjs';
+import { readZthAuth } from '../util/auth/auth-store.mjs';
 import { mfAppName, cleanAppName } from '../util/app-name.mjs';
 import { buildCommand } from './build.mjs';
 
-const APONO_BUNDLE = '<APONO_BUNDLE_NAME>'; // TODO: replace with actual bundle name once infra setup is complete
-async function requestAponoAccess() {
-    {
-        warn(`skipping Apono request — APONO_BUNDLE is still a placeholder ("${APONO_BUNDLE}"). Set it in deploy.ts before relying on auto-grant.`);
-        return;
-    }
-}
 async function deployCommand(opts) {
     if (opts.json) {
         setOutputMode('json');
     }
-    info('checking S3 bucket');
-    await assertBucketExists();
-    info('building');
-    await buildCommand({ json: opts.json });
     const paths = resolveConsumerPaths(process.cwd());
     const consumerPkg = (await readJson(paths.consumerPkg));
     if (!consumerPkg.name) {
         throw new Error('Consumer package.json must have a "name" field');
     }
     const appName = mfAppName(consumerPkg.name);
+    // Validate the user's deploy token is on disk before doing any expensive
+    // work. Throws Z2hAuthMissingError with a remediation hint if not.
+    await readZthAuth();
+    setupS3Client({ appName });
+    info('reading current Z2H manifest');
+    const manifest = await readManifest();
+    const version = nextVersion(manifest, appName);
+    const keyPrefix = `${appName}/${version}`;
+    const url = `${BUCKET_READ_DNS_URL}/${keyPrefix}`;
+    info('building');
+    await buildCommand({ json: opts.json, publicUrl: url });
     if (!(await pathExists(paths.shadowBuild))) {
         throw new Error(`No build output at ${paths.shadowBuild} after build step.`);
     }
@@ -39,11 +41,13 @@ async function deployCommand(opts) {
         throw new Error(`Missing asset-manifest.json at ${assetManifestPath}.`);
     }
     const assetManifest = (await readJson(assetManifestPath));
-    info('reading current Z2H manifest');
-    const manifest = await readManifest();
-    const version = nextVersion(manifest, appName);
-    const keyPrefix = `${appName}/${version}`;
-    const url = `${BUCKET_READ_DNS_URL}/${keyPrefix}`;
+    const deployedBy = os.userInfo().username;
+    const entry = {
+        ...assetManifest,
+        version,
+        url,
+        deployedBy,
+    };
     if (opts.dryRun) {
         output(`[z2h-cli] dry-run: would upload to s3://${BUCKET_WRITE_NAME}/${keyPrefix}/ as v${version}`, {
             ok: true,
@@ -53,18 +57,12 @@ async function deployCommand(opts) {
             bucket: BUCKET_WRITE_NAME,
             keyPrefix,
             url,
-            entry: { ...assetManifest, version, url },
+            entry,
         });
         return;
     }
-    await requestAponoAccess();
     info(`uploading build → s3://${BUCKET_WRITE_NAME}/${keyPrefix}/`);
     await uploadDir(paths.shadowBuild, keyPrefix);
-    const entry = {
-        ...assetManifest,
-        version,
-        url,
-    };
     info(`updating manifest entry "${appName}" → v${version}`);
     await writeManifest(upsertEntry(manifest, appName, entry));
     // The host MF parses the app name from the URL and prepends `mf-` itself

package/dist/esm/commands/dev.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev.d.ts","sourceRoot":"","sources":["../../../src/commands/dev.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAID,wBAAsB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAgDhE"}
+{"version":3,"file":"dev.d.ts","sourceRoot":"","sources":["../../../src/commands/dev.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAID,wBAAsB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAuEhE"}