@mondaydotcomorg/z2h-cli 0.10.0 → 0.11.0

package/dist/esm/commands/create.mjs

@@ -4,14 +4,15 @@ import { pathExists, ensureDir, writeFile, copy, readdir } from 'fs-extra';
 import { setOutputMode, info, warn, output } from '../util/logger.mjs';
 import { assertWorkspace } from '../util/workspace.mjs';
 import { APP_TEMPLATES, getTemplatesDir, renderTemplate } from '../util/templates.mjs';
-import { readManifest } from '../util/manifest.mjs';
-import { mfAppName } from '../util/app-name.mjs';
 import { APP_NAME_PATTERN } from '../constants.mjs';
 import { runYarnInstall } from '../util/npm/install.mjs';
-import { defaultS3Remote, initRepo } from '../util/git/repo.mjs';
-import { buildCommand } from './build.mjs';
+import { initRepo } from '../util/git/repo.mjs';
+import { validateRemoteOptions, resolveRemoteUrl } from '../util/git/remote-options.mjs';
+export { REMOTE_TYPES } from '../util/git/remote-options.mjs';
+import { fetchApp } from '../util/broker/app.mjs';
+import { mfAppName } from '../util/app-name.mjs';
+import { prepareShadow } from '../shadow/prepare.mjs';
 
-const REMOTE_TYPES = ['s3', 'github'];
 // Names reserved by the host MF (mf-bigbrain-zth) for platform pages under
 // /bigbrain-vibe/<name>. Creating an app with one of these would shadow the
 // platform page in the URL, so we refuse upfront.
@@ -51,15 +52,7 @@ async function createCommand(appName, opts = {}) {
             `2-50 chars, starting with a letter.`);
     }
     // Validate --remote up front before any file I/O.
-    if (!opts.remote) {
-        throw new Error('--remote is required. Use --remote=s3 (shared storage) or --remote=github (your GitHub repo).');
-    }
-    if (!REMOTE_TYPES.includes(opts.remote)) {
-        throw new Error(`Unknown remote "${opts.remote}". Use ${REMOTE_TYPES.join(' or ')}.`);
-    }
-    if (opts.remote === 'github' && !opts.repoUrl) {
-        throw new Error('--repo-url is required when using --remote=github.');
-    }
+    validateRemoteOptions(opts, true);
     // Resolve template.
     // `--html-file` implies `--template html-embed` unless the user already picked one.
     const template = (opts.template ?? (opts.htmlFile ? 'html-embed' : 'default'));
@@ -74,9 +67,9 @@ async function createCommand(appName, opts = {}) {
     if (!(await isDirEmpty(appDir))) {
         throw new Error(`${appDir} is non-empty. Pick a different name or wipe it first.`);
     }
-    // Check for manifest collision (network call — after all local checks).
-    const manifest = await readManifest();
-    if (manifest[mfAppName(appName)]) {
+    // Check the broker — fail fast if the app is already registered.
+    const existing = await fetchApp(mfAppName(appName));
+    if (existing) {
         throw new Error(`An app named "${appName}" already exists in the Z2H registry. Pick a different name.`);
     }
     // Compute substitutions.
@@ -103,28 +96,16 @@ async function createCommand(appName, opts = {}) {
         await copy(opts.htmlFile, path.join(appDir, 'src', 'page.html'));
     }
     info(`initializing git repo for ${appName}...`);
-    let gitRemote;
-    if (opts.remote === 's3') {
-        gitRemote = defaultS3Remote(appName);
-    }
-    else {
-        gitRemote = opts.repoUrl;
-    }
+    const gitRemote = resolveRemoteUrl(opts.remote, appName, opts.repoUrl);
     await initRepo(appDir, gitRemote);
     info(`installing dependencies for ${appName}...`);
     await runYarnInstall({ cwd: workspace });
-    // build/dev/deploy all locate the consumer via process.cwd() — chdir before calling them.
-    const prevCwd = process.cwd();
+    // Best-effort workspace wiring (.zth shadow). Non-fatal — dev/deploy re-run it.
     try {
-        info(`pre-building ${appName}`);
-        process.chdir(appDir);
-        await buildCommand();
-    }
-    catch {
-        warn(`pre-build failed. No worries — it will run again when needed.`);
+        await prepareShadow(appDir);
     }
-    finally {
-        process.chdir(prevCwd);
+    catch (err) {
+        warn(`prepare shadow failed: ${err.message} — it will run again when needed.`);
     }
     output(`[z2h-cli] app ready at ${appDir}`, {
         ok: true,
@@ -136,4 +117,4 @@ async function createCommand(appName, opts = {}) {
     });
 }
 
-export { REMOTE_TYPES, createCommand };
+export { createCommand };

package/dist/esm/commands/deploy.d.ts

@@ -1,6 +1,9 @@
+import { type RemoteType } from '../util/git/remote-options';
 export interface DeployOptions {
     dryRun?: boolean;
     json?: boolean;
+    remote?: RemoteType;
+    repoUrl?: string;
 }
 export declare function deployCommand(opts?: DeployOptions): Promise<void>;
 //# sourceMappingURL=deploy.d.ts.map

package/dist/esm/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../../src/commands/deploy.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAGD,wBAAsB,aAAa,CAAC,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0F3E"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../../src/commands/deploy.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,KAAK,UAAU,EAA2C,MAAM,4BAA4B,CAAC;AAItG,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAGD,wBAAsB,aAAa,CAAC,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmJ3E"}

package/dist/esm/commands/deploy.mjs

@@ -1,16 +1,20 @@
 import path from 'node:path';
 import os from 'node:os';
+import { createInterface } from 'node:readline';
 import { readJson, pathExists } from 'fs-extra';
 import { setOutputMode, info, output, warn } from '../util/logger.mjs';
 import { resolveConsumerPaths } from '../shadow/paths.mjs';
-import { readManifest, nextVersion, writeManifest, upsertEntry } from '../util/manifest.mjs';
 import { uploadDir } from '../util/s3/upload.mjs';
-import { BUCKET_WRITE_NAME, brokerBaseUrl, BUCKET_READ_DNS_URL } from '../constants.mjs';
-import { setupS3Client } from '../util/s3/client.mjs';
+import { BUCKET_WRITE_NAME, brokerBaseUrl, routingHeaders, BUCKET_READ_DNS_URL } from '../constants.mjs';
+import { fetchDeployVersion, brokerCredentialProvider } from '../util/auth/broker-credential-provider.mjs';
 import { readZthAuth } from '../util/auth/auth-store.mjs';
 import { mfAppName, cleanAppName } from '../util/app-name.mjs';
+import { getMachineAppName } from '../util/machine-identity.mjs';
+import { getRemoteUrl, initRepo, guardCleanTree, pullAndResolve, pushToRemote } from '../util/git/repo.mjs';
+import { resolveGitEnv } from '../util/git/git-env.mjs';
+import { validateRemoteOptions, resolveRemoteUrl } from '../util/git/remote-options.mjs';
+import { setupS3Client } from '../util/s3/client.mjs';
 import { buildCommand } from './build.mjs';
-import { getRemoteUrl } from '../util/git/repo.mjs';
 
 // Should be run from the consumer app directory — uses process.cwd() to locate it.
 async function deployCommand(opts = {}) {
@@ -26,11 +30,42 @@ async function deployCommand(opts = {}) {
     // Validate the user's deploy token is on disk before doing any expensive
     // work. Throws Z2hAuthMissingError with a remediation hint if not.
     const { token } = await readZthAuth();
-    setupS3Client({ appName });
+    let gitRemote = await getRemoteUrl(process.cwd());
+    if (gitRemote) {
+        if (opts.remote || opts.repoUrl) {
+            throw new Error(`--remote and --repo-url only apply on the first deploy of an app with no git remote.\n` +
+                `This app already tracks source at: ${gitRemote}`);
+        }
+    }
+    else {
+        if (!opts.remote) {
+            throw new Error(`This app has no git remote. On first deploy, tell Z2H how to track source:\n\n` +
+                `  z2h-cli deploy --remote s3 (default)\n` +
+                `      Stores source history in S3 alongside your app. No extra setup.\n\n` +
+                `  z2h-cli deploy --remote github --repo-url https://github.com/org/repo.git\n` +
+                `      Uses an existing GitHub repo (must exist before deploying).`);
+        }
+        validateRemoteOptions(opts);
+        // Pass the raw consumer name (not the mf-prefixed appName) so defaultS3Remote
+        // produces the correct s3://bucket/mf-<name>/git path without double prefix.
+        const remote = resolveRemoteUrl(opts.remote, consumerPkg.name, opts.repoUrl);
+        info(`initializing git repo with ${opts.remote} remote...`);
+        await initRepo(process.cwd(), remote);
+        gitRemote = remote;
+    }
+    const version = await fetchDeployVersion(appName);
+    const nextVersion = version + 1;
+    const gitEnv = await resolveGitEnv(appName, gitRemote);
+    // Sync git first so a divergence (GitConflictError) stops us.
+    // The skill commits the working tree (with an LLM-authored message) before
+    // invoking deploy, so the tree should be clean here.
+    if (gitRemote) {
+        await guardCleanTree(process.cwd());
+        info('syncing with git remote');
+        await pullAndResolve(process.cwd(), gitEnv);
+    }
     info('reading current Z2H manifest');
-    const manifest = await readManifest();
-    const version = nextVersion(manifest, appName);
-    const keyPrefix = `${appName}/${version}`;
+    const keyPrefix = `${appName}/${nextVersion}`;
     const url = `${BUCKET_READ_DNS_URL}/${keyPrefix}`;
     info('building');
     await buildCommand({ json: opts.json, publicUrl: url });
@@ -43,11 +78,10 @@ async function deployCommand(opts = {}) {
         throw new Error(`Missing asset-manifest.json at ${assetManifestPath}.`);
     }
     const assetManifest = (await readJson(assetManifestPath));
-    const deployedBy = os.userInfo().username;
-    const gitRemote = await getRemoteUrl(process.cwd());
+    const deployedBy = getMachineAppName() ?? os.userInfo().username;
     const entry = {
         ...assetManifest,
-        version,
+        version: nextVersion,
         url,
         deployedBy,
         gitRemote,
@@ -65,14 +99,34 @@ async function deployCommand(opts = {}) {
         });
         return;
     }
+    // lock → git push → bundle upload → manifest PUT (the manifest write is the single commit point).
     try {
-        // Lock is acquired here — uploadDir triggers the STS credential provider on first S3 call
+        // Acquire the deploy lock explicitly. Done after the build
+        // so the lock hold stays tiny — it wraps only push → upload → manifest.
+        // A 409 here means someone else is mid-deploy;
+        const creds = await brokerCredentialProvider({ appName })();
+        setupS3Client(creds);
+        await acquireDeployLock(appName, token);
+        // Push before any S3 write so a rejected push (someone deployed during our
+        // build) stops the deploy before the bundle/manifest go live
+        if (gitRemote) {
+            info('pushing to git remote');
+            await pushToRemote(process.cwd(), gitEnv);
+        }
         info(`uploading build → s3://${BUCKET_WRITE_NAME}/${keyPrefix}/`);
         await uploadDir(paths.shadowBuild, keyPrefix);
-        info(`updating manifest entry "${appName}" → v${version}`);
-        await writeManifest(upsertEntry(manifest, appName, entry));
-        info(`registering app "${appName}" → v${version}`);
-        await registerApp(appName, token, version, entry);
+        // v1 creates the app row (+ owner grant); later versions release onto it.
+        // The two are separate endpoints, so the CLI picks based on the version it
+        // was handed.
+        if (nextVersion === 1) {
+            const visibility = await resolveFirstDeployVisibility(appName, opts.json);
+            info(`registering app "${appName}" → v${nextVersion} (${visibility})`);
+            await registerApp(appName, token, nextVersion, entry, visibility, gitRemote);
+        }
+        else {
+            info(`releasing "${appName}" → v${nextVersion}`);
+            await updateApp(appName, token, nextVersion, entry);
+        }
     }
     finally {
         await releaseLockBestEffort(appName, token);
@@ -81,10 +135,10 @@ async function deployCommand(opts = {}) {
     // before looking it up in the manifest. So the user-facing URL must use
     // the consumer's de-scoped package name (no `mf-` prefix, no `@scope/`).
     const liveUrl = `https://bigbrain.me/bigbrain-vibe/${cleanAppName(consumerPkg.name)}`;
-    output(`[z2h-cli] deployed ✅\n  app:     ${appName}\n  version: ${version}\n  open:    ${liveUrl}`, {
+    output(`[z2h-cli] deployed ✅\n  app:     ${appName}\n  version: ${nextVersion}\n  open:    ${liveUrl}`, {
         ok: true,
         appName,
-        version,
+        version: nextVersion,
         bucket: BUCKET_WRITE_NAME,
         keyPrefix,
         url,
@@ -92,25 +146,71 @@ async function deployCommand(opts = {}) {
         entry,
     });
 }
-async function registerApp(appName, token, version, entry) {
+async function registerApp(appName, token, version, entry, visibility, gitRemote) {
     const res = await fetch(`${brokerBaseUrl()}/z2h-cli/apps/register`, {
         method: 'POST',
-        headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
-        body: JSON.stringify({ appName, version, entry }),
+        headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json', ...routingHeaders() },
+        body: JSON.stringify({ appName, version, entry, visibility, gitRemote }),
     });
     if (!res.ok) {
         const text = await res.text();
         throw new Error(`App registration failed (${res.status}): ${text.slice(0, 1024)}`);
     }
 }
-// best-effort — the 5-min TTL backstop handles failures
+// Acquire the per-app deploy lock. Throws a friendly error on 409 (someone else is deploying)
+// so the deploy stops and the caller can retry; the backend TTL backstops a crashed holder.
+async function acquireDeployLock(appName, token) {
+    const res = await fetch(`${brokerBaseUrl()}/z2h-cli/lock/acquire`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json', ...routingHeaders() },
+        body: JSON.stringify({ appName }),
+    });
+    if (res.status === 409) {
+        throw new Error(`Someone is deploying "${appName}" right now — try again in a moment.`);
+    }
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`Failed to acquire deploy lock (${res.status}): ${text.slice(0, 512)}`);
+    }
+    info(`deploy lock acquired for ${appName}`);
+}
+async function updateApp(appName, token, version, entry) {
+    const res = await fetch(`${brokerBaseUrl()}/z2h-cli/apps/update`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json', ...routingHeaders() },
+        body: JSON.stringify({ appName, version, entry }),
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`App update failed (${res.status}): ${text.slice(0, 1024)}`);
+    }
+}
+// First deploy only: decide whether the app is born public or private. The
+// choice is passed to the register endpoint (default private). Non-interactive
+// runs (--json or no TTY) always default to private.
+async function resolveFirstDeployVisibility(appName, json) {
+    if (json || !process.stdout.isTTY) {
+        return 'private';
+    }
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    const answer = await new Promise(resolve => {
+        rl.question(`Make "${appName}" public to all monday.com employees? (y/N) `, resolve);
+    });
+    rl.close();
+    return answer.trim().toLowerCase() === 'y' ? 'public' : 'private';
+}
+// best-effort — the 2-min TTL backstop handles failures
 async function releaseLockBestEffort(appName, token) {
     try {
-        await fetch(`${brokerBaseUrl()}/z2h-cli/lock/release`, {
+        const res = await fetch(`${brokerBaseUrl()}/z2h-cli/lock/release`, {
             method: 'POST',
-            headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+            headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json', ...routingHeaders() },
             body: JSON.stringify({ appName }),
         });
+        if (!res.ok) {
+            warn(`failed to release lock for ${appName} (${res.status})`);
+            return;
+        }
         info(`lock released for ${appName}`);
     }
     catch {

package/dist/esm/commands/edit.d.ts

@@ -0,0 +1,5 @@
+export interface EditOptions {
+    json?: boolean;
+}
+export declare function editCommand(appName: string, opts?: EditOptions): Promise<void>;
+//# sourceMappingURL=edit.d.ts.map

package/dist/esm/commands/edit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"edit.d.ts","sourceRoot":"","sources":["../../../src/commands/edit.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+CxF"}

package/dist/esm/commands/edit.mjs

@@ -0,0 +1,55 @@
+import path from 'node:path';
+import { pathExists } from 'fs-extra';
+import { setOutputMode, output, info, warn } from '../util/logger.mjs';
+import { assertWorkspace } from '../util/workspace.mjs';
+import { mfAppName } from '../util/app-name.mjs';
+import { fetchApp } from '../util/broker/app.mjs';
+import { resolveGitEnv } from '../util/git/git-env.mjs';
+import { cloneRepo, pullAndResolve } from '../util/git/repo.mjs';
+import { runYarnInstall } from '../util/npm/install.mjs';
+import { prepareShadow } from '../shadow/prepare.mjs';
+
+async function editCommand(appName, opts = {}) {
+    if (opts.json) {
+        setOutputMode('json');
+    }
+    const workspace = await assertWorkspace();
+    const mfName = mfAppName(appName);
+    const app = await fetchApp(mfName);
+    if (!app?.gitRemote) {
+        output(`[z2h-cli] ${appName} was deployed without git tracking — run "z2h-cli deploy" to set up a git remote`, {
+            ok: true,
+            appName,
+        });
+        return;
+    }
+    const { gitRemote } = app;
+    const gitEnv = await resolveGitEnv(mfName, gitRemote);
+    const appDir = path.join(workspace, appName);
+    const hasLocal = await pathExists(appDir);
+    if (!hasLocal) {
+        info(`cloning ${appName}...`);
+        await cloneRepo(gitRemote, appDir, gitEnv);
+        info(`installing dependencies for ${appName}...`);
+        await runYarnInstall({ cwd: workspace });
+        // Best-effort workspace wiring (.zth shadow). Non-fatal — dev/deploy re-run it.
+        try {
+            await prepareShadow(appDir);
+        }
+        catch (err) {
+            warn(`prepare shadow failed: ${err.message} — it will run again when needed.`);
+        }
+    }
+    else {
+        info(`pulling latest ${appName}...`);
+        await pullAndResolve(appDir, gitEnv);
+    }
+    output(`[z2h-cli] ${appName} is ready at ${appDir}`, {
+        ok: true,
+        appDir,
+        appName,
+        gitRemote,
+    });
+}
+
+export { editCommand };

package/dist/esm/commands/grant.d.ts

@@ -0,0 +1,12 @@
+export interface GrantOptions {
+    public?: boolean;
+    level?: 'owner' | 'editor' | 'viewer';
+    json?: boolean;
+}
+export declare function grantCommand(email: string | undefined, opts: GrantOptions): Promise<void>;
+export declare function revokeCommand(email: string | undefined, opts: GrantOptions): Promise<void>;
+export interface TransferOwnerOptions {
+    json?: boolean;
+}
+export declare function transferOwnerCommand(email: string | undefined, opts: TransferOwnerOptions): Promise<void>;
+//# sourceMappingURL=grant.d.ts.map

package/dist/esm/commands/grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant.d.ts","sourceRoot":"","sources":["../../../src/commands/grant.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACtC,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAkBD,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B/F;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BhG;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB/G"}

package/dist/esm/commands/grant.mjs

@@ -0,0 +1,90 @@
+import { setOutputMode, output } from '../util/logger.mjs';
+import { mfAppName, getCwdAppName } from '../util/app-name.mjs';
+import { brokerBaseUrl, routingHeaders } from '../constants.mjs';
+import { readZthAuth } from '../util/auth/auth-store.mjs';
+
+async function postGrant(appName, token, body) {
+    const res = await fetch(`${brokerBaseUrl()}/z2h-apps/${appName}/grants`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json', ...routingHeaders() },
+        body: JSON.stringify(body),
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`Grant failed (${res.status}): ${text.slice(0, 1024)}`);
+    }
+}
+async function grantCommand(email, opts) {
+    if (opts.json) {
+        setOutputMode('json');
+    }
+    if (!opts.public && !email) {
+        throw new Error('Specify what to grant — e.g. --public or provide an email');
+    }
+    const level = opts.level ?? 'viewer';
+    if (!['owner', 'editor', 'viewer'].includes(level)) {
+        throw new Error(`Invalid --level "${level}". Must be owner, editor, or viewer`);
+    }
+    const appName = mfAppName(getCwdAppName());
+    const { token } = await readZthAuth();
+    if (email) {
+        await postGrant(appName, token, { type: 'user', value: email, accessLevel: level });
+    }
+    if (opts.public) {
+        await postGrant(appName, token, { type: 'global', accessLevel: 'viewer' });
+    }
+    const parts = [];
+    if (email) {
+        parts.push(`${email} (${level})`);
+    }
+    if (opts.public) {
+        parts.push('public');
+    }
+    output(`[z2h-cli] "${appName}" granted to: ${parts.join(', ')}`, { ok: true, appName, granted: parts });
+}
+async function revokeCommand(email, opts) {
+    if (opts.json) {
+        setOutputMode('json');
+    }
+    if (!opts.public && !email) {
+        throw new Error('Specify what to revoke — e.g. --public or provide an email');
+    }
+    const appName = mfAppName(getCwdAppName());
+    const { token } = await readZthAuth();
+    const target = email ? `user/${encodeURIComponent(email)}` : 'global';
+    const res = await fetch(`${brokerBaseUrl()}/z2h-apps/${appName}/grants/${target}`, {
+        method: 'DELETE',
+        headers: { Authorization: `Bearer ${token}`, ...routingHeaders() },
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`Revoke failed (${res.status}): ${text.slice(0, 1024)}`);
+    }
+    const revoked = email ?? 'public';
+    const msg = email
+        ? `[z2h-cli] "${appName}" access revoked from ${email}`
+        : `[z2h-cli] "${appName}" is now private (owners/admins only)`;
+    output(msg, { ok: true, appName, revoked });
+}
+async function transferOwnerCommand(email, opts) {
+    if (opts.json) {
+        setOutputMode('json');
+    }
+    if (!email) {
+        throw new Error('Specify the new owner — e.g. z2h-cli transfer-owner someone@monday.com');
+    }
+    const appName = mfAppName(getCwdAppName());
+    const { token } = await readZthAuth();
+    const res = await fetch(`${brokerBaseUrl()}/z2h-apps/${appName}/transfer-owner`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json', ...routingHeaders() },
+        body: JSON.stringify({ email }),
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`Transfer owner failed (${res.status}): ${text.slice(0, 1024)}`);
+    }
+    output(`[z2h-cli] "${appName}" ownership transferred to ${email}`, { ok: true, appName, newOwner: email });
+}
+
+export { grantCommand, revokeCommand, transferOwnerCommand };

package/dist/esm/constants.d.ts

@@ -23,6 +23,7 @@ export declare const DEFAULT_BROKER_BASE_URL = "https://bigbrain-zth.bigbrain.me
  * STS credential provider and the npm-broker registry URL.
  */
 export declare function brokerBaseUrl(): string;
+export declare function routingHeaders(): Record<string, string>;
 export declare const NPM_BROKER_PATH = "/z2h-cli/npm";
 export declare const BROKER_NPM_SCOPE = "@mondaydotcomorg";
 export declare const PUBLIC_NPM_REGISTRY_URL = "https://registry.npmjs.org/";

package/dist/esm/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGjD,CAAC;AAQF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAQ3C,eAAO,MAAM,iBAAiB,qCAAqC,CAAC;AACpE,eAAO,MAAM,MAAM,cAAc,CAAC;AAClC,eAAO,MAAM,gBAAgB,wEAA4D,CAAC;AAE1F,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,mBAAmB,+CAAgD,CAAC;AAKjF,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,iBAAiB,yDAA2C,CAAC;AAM1E,eAAO,MAAM,gBAAgB,QAA2B,CAAC;AAKzD,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAKD,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAG9C,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAGnD,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AAMrE,eAAO,MAAM,iBAAiB,EAAG,eAAwB,CAAC;AAE1D;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGjD,CAAC;AAQF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAQ3C,eAAO,MAAM,iBAAiB,qCAAqC,CAAC;AACpE,eAAO,MAAM,MAAM,cAAc,CAAC;AAClC,eAAO,MAAM,gBAAgB,wEAA4D,CAAC;AAE1F,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,mBAAmB,+CAAgD,CAAC;AAKjF,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,iBAAiB,yDAA2C,CAAC;AAM1E,eAAO,MAAM,gBAAgB,QAA2B,CAAC;AAKzD,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAID,wBAAgB,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGvD;AAKD,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAG9C,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAGnD,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AAMrE,eAAO,MAAM,iBAAiB,EAAG,eAAwB,CAAC;AAE1D;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}

package/dist/esm/constants.mjs

@@ -58,6 +58,12 @@ const DEFAULT_BROKER_BASE_URL = 'https://bigbrain-zth.bigbrain.me';
 function brokerBaseUrl() {
     return process.env.Z2H_BROKER_BASE_URL || DEFAULT_BROKER_BASE_URL;
 }
+// Returns Baggage header for monday-mirror routing when Z2H_ROUTING_KEY is set.
+// No-op in production (returns {}) — only activates when the env var is set.
+function routingHeaders() {
+    const key = process.env.Z2H_ROUTING_KEY;
+    return key ? { Baggage: `routingKey=${key}` } : {};
+}
 // The authenticated npm reverse-proxy is mounted here on the broker. Only the
 // `@mondaydotcomorg` scope is served; everything else resolves from npmjs
 // directly. See docs/superpowers/specs/2026-06-03-npm-brokering-design.md §3.
@@ -81,4 +87,4 @@ function brokerNpmRegistryUrl() {
     return `${brokerBaseUrl()}${NPM_BROKER_PATH}`;
 }
 
-export { APP_NAME_PATTERN, BROKER_NPM_SCOPE, BUCKET_READ_DNS_NAME, BUCKET_READ_DNS_URL, BUCKET_WRITE_NAME, BUCKET_WRITE_URL, DEFAULT_BROKER_BASE_URL, GITIGNORE_ENTRIES, MANIFEST_KEY, MANIFEST_READ_URL, MAX_PORT, MIN_PORT, NPM_BROKER_PATH, PUBLIC_NPM_REGISTRY_URL, REGION, SHADOW_DEV_DEPS, SHADOW_DIR_NAME, SHADOW_SCRIPTS, Z2H_NPM_TOKEN_ENV, brokerBaseUrl, brokerNpmRegistryUrl };
+export { APP_NAME_PATTERN, BROKER_NPM_SCOPE, BUCKET_READ_DNS_NAME, BUCKET_READ_DNS_URL, BUCKET_WRITE_NAME, BUCKET_WRITE_URL, DEFAULT_BROKER_BASE_URL, GITIGNORE_ENTRIES, MANIFEST_KEY, MANIFEST_READ_URL, MAX_PORT, MIN_PORT, NPM_BROKER_PATH, PUBLIC_NPM_REGISTRY_URL, REGION, SHADOW_DEV_DEPS, SHADOW_DIR_NAME, SHADOW_SCRIPTS, Z2H_NPM_TOKEN_ENV, brokerBaseUrl, brokerNpmRegistryUrl, routingHeaders };