@mondaydotcomorg/z2h-cli 0.2.0 → 0.3.0

package/dist/util/auth/loopback-server.d.ts

@@ -0,0 +1,12 @@
+export interface LoopbackHandle {
+    /** Fully-qualified URL the browser should POST to (e.g. http://127.0.0.1:53811/token). */
+    callbackUrl: string;
+    /**
+     * Resolves with the token once the page POSTs it back. Rejects on timeout
+     * or if the server is closed before a token arrives.
+     */
+    waitForToken(timeoutMs: number): Promise<string>;
+    close(): void;
+}
+export declare function startLoopbackServer(): Promise<LoopbackHandle>;
+//# sourceMappingURL=loopback-server.d.ts.map

package/dist/util/auth/loopback-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback-server.d.ts","sourceRoot":"","sources":["../../../src/util/auth/loopback-server.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,cAAc;IAC7B,0FAA0F;IAC1F,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,KAAK,IAAI,IAAI,CAAC;CACf;AAED,wBAAgB,mBAAmB,IAAI,OAAO,CAAC,cAAc,CAAC,CAkF7D"}

package/dist/util/auth/loopback-server.js

@@ -0,0 +1,94 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+
+const cors = require('cors');
+const express = require('express');
+
+const _interopDefault = e => e && e.__esModule ? e : { default: e };
+
+const cors__default = /*#__PURE__*/_interopDefault(cors);
+const express__default = /*#__PURE__*/_interopDefault(express);
+
+const ALLOWED_ORIGINS = new Set(['https://bigbrain.me', 'https://bigbrainstaging.me']);
+const CALLBACK_PATH = '/token';
+const REQUEST_BODY_LIMIT = '16kb';
+const PREFLIGHT_MAX_AGE_SECONDS = 600;
+function startLoopbackServer() {
+    return new Promise((resolve, reject) => {
+        let resolveToken = null;
+        let rejectToken = null;
+        const app = express__default.default();
+        // Reflect the origin if it's one of ours; otherwise wildcard. The
+        // endpoint is loopback-bound and single-shot, so the CORS surface is
+        // moot — we keep allowlist behavior so the test contract stays exact.
+        app.use(cors__default.default({
+            origin: (origin, cb) => {
+                if (origin && ALLOWED_ORIGINS.has(origin)) {
+                    cb(null, origin);
+                }
+                else {
+                    cb(null, '*');
+                }
+            },
+            methods: ['POST', 'OPTIONS'],
+            allowedHeaders: ['Content-Type'],
+            maxAge: PREFLIGHT_MAX_AGE_SECONDS,
+        }));
+        app.use(express.json({ limit: REQUEST_BODY_LIMIT }));
+        app.post(CALLBACK_PATH, (req, res) => {
+            const body = req.body;
+            const token = typeof body?.token === 'string' ? body.token.trim() : '';
+            if (!token) {
+                res.status(400).json({ error: 'missing token' });
+                return;
+            }
+            // Ack the page so it can transition to "Token sent ✓" and auto-close.
+            // The bigbrain.me page never displays this body — it just inspects res.ok.
+            res.status(200).json({ ok: true });
+            if (resolveToken) {
+                const fn = resolveToken;
+                resolveToken = null;
+                rejectToken = null;
+                fn(token);
+            }
+        });
+        const server = app.listen(0, '127.0.0.1', () => {
+            const address = server.address();
+            if (!address || typeof address === 'string') {
+                server.close();
+                reject(new Error('Failed to determine loopback port'));
+                return;
+            }
+            resolve({
+                callbackUrl: `http://127.0.0.1:${address.port}${CALLBACK_PATH}`,
+                waitForToken(timeoutMs) {
+                    return new Promise((res, rej) => {
+                        resolveToken = res;
+                        rejectToken = rej;
+                        const timer = setTimeout(() => {
+                            if (rejectToken) {
+                                const reject = rejectToken;
+                                resolveToken = null;
+                                rejectToken = null;
+                                reject(new Error('Loopback callback timed out'));
+                            }
+                        }, timeoutMs);
+                        // Don't keep the event loop alive on the timer alone.
+                        timer.unref?.();
+                    });
+                },
+                close() {
+                    if (rejectToken) {
+                        const reject = rejectToken;
+                        resolveToken = null;
+                        rejectToken = null;
+                        reject(new Error('Loopback server closed before token arrived'));
+                    }
+                    server.close();
+                },
+            });
+        });
+        server.on('error', reject);
+    });
+}
+
+exports.startLoopbackServer = startLoopbackServer;

package/dist/util/auth/write-auth.d.ts

@@ -0,0 +1,11 @@
+import { type ZthAuth } from './auth-store';
+export declare function writeZthAuth(auth: ZthAuth): Promise<{
+    filePath: string;
+}>;
+/**
+ * Three base64url segments separated by dots — a structural sanity check,
+ * not a real verification. Server-side validation happens at the STS broker.
+ */
+export declare function validateJwtPattern(token: string): boolean;
+export { Z2H_AUTH_FILE } from './auth-store';
+//# sourceMappingURL=write-auth.d.ts.map

package/dist/util/auth/write-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-auth.d.ts","sourceRoot":"","sources":["../../../src/util/auth/write-auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAA+B,KAAK,OAAO,EAAE,MAAM,cAAc,CAAC;AAMzE,wBAAsB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAK/E;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC"}

package/dist/util/auth/write-auth.js

@@ -0,0 +1,26 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+
+const promises = require('node:fs/promises');
+const fsExtra = require('fs-extra');
+const util_auth_authStore = require('./auth-store.js');
+
+// 0o600 — owner read/write only. The file holds a long-lived bearer token,
+// so other local users on the machine must not be able to read it.
+const OWNER_READ_WRITE_FILE_MODE = 0o600;
+async function writeZthAuth(auth) {
+    await fsExtra.ensureDir(util_auth_authStore.Z2H_AUTH_DIR);
+    await fsExtra.writeFile(util_auth_authStore.Z2H_AUTH_FILE, `${JSON.stringify(auth, null, 2)}\n`);
+    await promises.chmod(util_auth_authStore.Z2H_AUTH_FILE, OWNER_READ_WRITE_FILE_MODE);
+    return { filePath: util_auth_authStore.Z2H_AUTH_FILE };
+}
+/**
+ * Three base64url segments separated by dots — a structural sanity check,
+ * not a real verification. Server-side validation happens at the STS broker.
+ */
+function validateJwtPattern(token) {
+    return /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(token);
+}
+
+exports.Z2H_AUTH_FILE = util_auth_authStore.Z2H_AUTH_FILE;
+exports.validateJwtPattern = validateJwtPattern;
+exports.writeZthAuth = writeZthAuth;

package/dist/util/manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/util/manifest.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,OAAO,CAAC;IACpB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;IACnC,UAAU,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,aAAc,SAAQ,iBAAiB;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAErD,wBAAsB,YAAY,IAAI,OAAO,CAAC,QAAQ,CAAC,CAQtD;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,UAI1D;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,QAAQ,CAE3F;AAED,wBAAsB,aAAa,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAWrE"}
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/util/manifest.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,OAAO,CAAC;IACpB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;IACnC,UAAU,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,aAAc,SAAQ,iBAAiB;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAErD,wBAAsB,YAAY,IAAI,OAAO,CAAC,QAAQ,CAAC,CAQtD;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,UAI1D;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,QAAQ,CAE3F;AAED,wBAAsB,aAAa,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAWrE"}

package/dist/util/manifest.js

@@ -1,13 +1,14 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 
 const clientS3 = require('@aws-sdk/client-s3');
+const constants = require('../constants.js');
 const util_s3_client = require('./s3/client.js');
 
 async function readManifest() {
     // Read via the public CDN endpoint, no AWS auth required.
-    const res = await fetch(util_s3_client.MANIFEST_READ_URL);
+    const res = await fetch(constants.MANIFEST_READ_URL);
     if (!res.ok) {
-        throw new Error(`failed to read manifest from ${util_s3_client.MANIFEST_READ_URL}: HTTP ${res.status}`);
+        throw new Error(`failed to read manifest from ${constants.MANIFEST_READ_URL}: HTTP ${res.status}`);
     }
     return (await res.json());
 }
@@ -22,8 +23,8 @@ function upsertEntry(manifest, app, entry) {
 async function writeManifest(manifest) {
     const s3 = util_s3_client.getS3Client();
     await s3.send(new clientS3.PutObjectCommand({
-        Bucket: util_s3_client.BUCKET_WRITE_NAME,
-        Key: util_s3_client.MANIFEST_KEY,
+        Bucket: constants.BUCKET_WRITE_NAME,
+        Key: constants.MANIFEST_KEY,
         Body: JSON.stringify(manifest, null, 2),
         ContentType: 'application/json',
         CacheControl: 'no-cache',

package/dist/util/s3/client.d.ts

@@ -1,11 +1,10 @@
 import { S3Client } from '@aws-sdk/client-s3';
-export declare const BUCKET_WRITE_NAME = "prod-use1-bigbrain-zth-mf-assets";
-export declare const REGION = "us-east-1";
-export declare const BUCKET_WRITE_URL = "https://prod-use1-bigbrain-zth-mf-assets.s3.us-east-1.amazonaws.com";
-export declare const BUCKET_READ_DNS_NAME = "bigbrain-zth-mf-assets";
-export declare const BUCKET_READ_DNS_URL = "https://bigbrain-zth-mf-assets.bigbrain.me";
-export declare const MANIFEST_KEY = "mf-assets";
-export declare const MANIFEST_READ_URL = "https://bigbrain-zth-mf-assets.bigbrain.me/mf-assets";
+/**
+ * Initialize the per-process S3 client with broker-issued credentials scoped
+ * to the given app's S3 prefix. Must be called once before any `getS3Client`.
+ */
+export declare function setupS3Client({ appName }: {
+    appName: string;
+}): void;
 export declare function getS3Client(): S3Client;
-export declare function assertBucketExists(): Promise<void>;
 //# sourceMappingURL=client.d.ts.map

package/dist/util/s3/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/util/s3/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,QAAQ,EAAsB,MAAM,oBAAoB,CAAC;AAErF,eAAO,MAAM,iBAAiB,qCAAqC,CAAC;AACpE,eAAO,MAAM,MAAM,cAAc,CAAC;AAClC,eAAO,MAAM,gBAAgB,wEAA4D,CAAC;AAE1F,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,mBAAmB,+CAAgD,CAAC;AAKjF,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,iBAAiB,yDAA2C,CAAC;AAI1E,wBAAgB,WAAW,IAAI,QAAQ,CAKtC;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAexD"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/util/s3/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAM9C;;;GAGG;AACH,wBAAgB,aAAa,CAAC,EAAE,OAAO,EAAE,EAAE;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAKpE;AAED,wBAAgB,WAAW,IAAI,QAAQ,CAKtC"}

package/dist/util/s3/client.js

@@ -1,48 +1,26 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 
 const clientS3 = require('@aws-sdk/client-s3');
+const util_auth_brokerCredentialProvider = require('../auth/broker-credential-provider.js');
+const constants = require('../../constants.js');
 
-const BUCKET_WRITE_NAME = 'prod-use1-bigbrain-zth-mf-assets';
-const REGION = 'us-east-1';
-const BUCKET_WRITE_URL = `https://${BUCKET_WRITE_NAME}.s3.${REGION}.amazonaws.com`;
-const BUCKET_READ_DNS_NAME = 'bigbrain-zth-mf-assets';
-const BUCKET_READ_DNS_URL = `https://${BUCKET_READ_DNS_NAME}.bigbrain.me`;
-// No `.json` extension — TridentSkeleton's `mfUrl` API appends `/mf-assets`
-// to the bucket base when fetching, so the manifest must live at this exact
-// key. See microfrontends/mf-bigbrain-zth/.../ZeroToHeroHost.tsx.
-const MANIFEST_KEY = 'mf-assets';
-const MANIFEST_READ_URL = `${BUCKET_READ_DNS_URL}/${MANIFEST_KEY}`;
 let client = null;
+/**
+ * Initialize the per-process S3 client with broker-issued credentials scoped
+ * to the given app's S3 prefix. Must be called once before any `getS3Client`.
+ */
+function setupS3Client({ appName }) {
+    client = new clientS3.S3Client({
+        region: constants.REGION,
+        credentials: util_auth_brokerCredentialProvider.brokerCredentialProvider({ appName }),
+    });
+}
 function getS3Client() {
     if (!client) {
-        client = new clientS3.S3Client({ region: REGION });
+        throw new Error('S3 client not initialized — call setupS3Client({ appName }) first.');
     }
     return client;
 }
-async function assertBucketExists() {
-    try {
-        await getS3Client().send(new clientS3.HeadBucketCommand({ Bucket: BUCKET_WRITE_NAME }));
-    }
-    catch (err) {
-        if (err instanceof clientS3.S3ServiceException) {
-            const status = err.$metadata.httpStatusCode;
-            if (status === 404 || err.name === 'NotFound' || err.name === 'NoSuchBucket') {
-                throw new Error(`S3 bucket "${BUCKET_WRITE_NAME}" does not exist (region: ${REGION}).`);
-            }
-            if (status === 403) {
-                throw new Error(`No access to S3 bucket "${BUCKET_WRITE_NAME}" (region: ${REGION}). Check AWS credentials.`);
-            }
-        }
-        throw err;
-    }
-}
 
-exports.BUCKET_READ_DNS_NAME = BUCKET_READ_DNS_NAME;
-exports.BUCKET_READ_DNS_URL = BUCKET_READ_DNS_URL;
-exports.BUCKET_WRITE_NAME = BUCKET_WRITE_NAME;
-exports.BUCKET_WRITE_URL = BUCKET_WRITE_URL;
-exports.MANIFEST_KEY = MANIFEST_KEY;
-exports.MANIFEST_READ_URL = MANIFEST_READ_URL;
-exports.REGION = REGION;
-exports.assertBucketExists = assertBucketExists;
 exports.getS3Client = getS3Client;
+exports.setupS3Client = setupS3Client;

package/dist/util/s3/upload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../../src/util/s3/upload.ts"],"names":[],"mappings":"AAcA,wBAAsB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA0BtF"}
+{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../../src/util/s3/upload.ts"],"names":[],"mappings":"AAeA,wBAAsB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA0BtF"}

package/dist/util/s3/upload.js

@@ -6,6 +6,7 @@ const fsExtra = require('fs-extra');
 const mimeTypes = require('mime-types');
 const pMap = require('p-map');
 const clientS3 = require('@aws-sdk/client-s3');
+const constants = require('../../constants.js');
 const util_s3_client = require('./client.js');
 
 const _interopDefault = e => e && e.__esModule ? e : { default: e };
@@ -26,7 +27,7 @@ async function uploadDir(localDir, keyPrefix) {
         const contentType = mimeTypes.lookup(rel) || 'application/octet-stream';
         const key = `${keyPrefix}/${rel.split(path__default.default.sep).join('/')}`;
         await s3.send(new clientS3.PutObjectCommand({
-            Bucket: util_s3_client.BUCKET_WRITE_NAME,
+            Bucket: constants.BUCKET_WRITE_NAME,
             Key: key,
             Body: body,
             ContentType: contentType,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mondaydotcomorg/z2h-cli",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "bin": "./bin/z2h-cli.js",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -10,6 +10,11 @@
       "require": "./dist/index.js",
       "types": "./dist/index.d.ts"
     },
+    "./constants": {
+      "import": "./dist/esm/constants.mjs",
+      "require": "./dist/constants.js",
+      "types": "./dist/constants.d.ts"
+    },
     "./package.json": "./package.json"
   },
   "nx": {
@@ -35,7 +40,9 @@
     "@aws-sdk/client-s3": "^3.706.0",
     "chokidar": "^3.6.0",
     "commander": "^12.1.0",
+    "cors": "^2.8.6",
     "execa": "^9.5.1",
+    "express": "^5.2.1",
     "fs-extra": "^11.2.0",
     "mime-types": "^2.1.35",
     "p-map": "^7.0.2",
@@ -44,6 +51,8 @@
   },
   "devDependencies": {
     "@mondaydotcomorg/trident-library": "^1.2.7",
+    "@types/cors": "^2.8.19",
+    "@types/express": "^5.0.6",
     "@types/fs-extra": "^11.0.4",
     "@types/mime-types": "^2.1.4",
     "@types/node": "^22.19.0",

package/src/commands/create.ts

@@ -7,6 +7,7 @@ import { assertWorkspace } from '../util/workspace';
 import { getTemplatesDir, renderTemplate, APP_TEMPLATES, type AppTemplate } from '../util/templates';
 import { readManifest } from '../util/manifest';
 import { mfAppName } from '../util/app-name';
+import { APP_NAME_PATTERN } from '../constants';
 
 export interface CreateOptions {
   template?: string;
@@ -14,7 +15,10 @@ export interface CreateOptions {
   json?: boolean;
 }
 
-const APP_NAME_RE = /^[a-z][a-z0-9-]{1,49}$/;
+// Names reserved by the host MF (mf-bigbrain-zth) for platform pages under
+// /bigbrain-vibe/<name>. Creating an app with one of these would shadow the
+// platform page in the URL, so we refuse upfront.
+const RESERVED_APP_NAMES = new Set(['generate-z2h-token']);
 
 /**
  * Convert kebab-case to PascalCase. `demo-app` → `DemoApp`.
@@ -47,7 +51,12 @@ export async function createCommand(appName: string, opts: CreateOptions): Promi
   const workspace = await assertWorkspace();
 
   // Validate app name.
-  if (!APP_NAME_RE.test(appName)) {
+  if (RESERVED_APP_NAMES.has(appName)) {
+    throw new Error(
+      `App name "${appName}" is reserved by the Z2H host for a platform page under /bigbrain-vibe/${appName}. Pick a different name.`
+    );
+  }
+  if (!APP_NAME_PATTERN.test(appName)) {
     throw new Error(
       `App name "${appName}" is invalid. Use lowercase kebab-case (a-z, 0-9, -), ` +
         `2-50 chars, starting with a letter.`

package/src/commands/deploy.ts

@@ -1,8 +1,7 @@
 import path from 'node:path';
 import os from 'node:os';
 import { pathExists, readJson } from 'fs-extra';
-import { execa } from 'execa';
-import { info, warn, output, setOutputMode } from '../util/logger';
+import { info, output, setOutputMode } from '../util/logger';
 import { resolveConsumerPaths } from '../shadow/paths';
 import {
   nextVersion,
@@ -13,36 +12,22 @@ import {
   type ManifestEntry,
 } from '../util/manifest';
 import { uploadDir } from '../util/s3/upload';
-import { assertBucketExists, BUCKET_WRITE_NAME, BUCKET_READ_DNS_URL } from '../util/s3/client';
+import { BUCKET_WRITE_NAME, BUCKET_READ_DNS_URL } from '../constants';
+import { setupS3Client } from '../util/s3/client';
+import { readZthAuth } from '../util/auth/auth-store';
 import { cleanAppName, mfAppName } from '../util/app-name';
 import { buildCommand } from './build';
 
-const APONO_BUNDLE = '<APONO_BUNDLE_NAME>'; // TODO: replace with actual bundle name once infra setup is complete
-
 export interface DeployOptions {
   dryRun?: boolean;
   json?: boolean;
 }
 
-async function requestAponoAccess(): Promise<void> {
-  if (APONO_BUNDLE === '<APONO_BUNDLE_NAME>') {
-    warn(
-      `skipping Apono request — APONO_BUNDLE is still a placeholder ("${APONO_BUNDLE}"). Set it in deploy.ts before relying on auto-grant.`
-    );
-    return;
-  }
-  info(`requesting Apono access for bundle "${APONO_BUNDLE}"`);
-  await execa('apono', ['bundles', 'grant', APONO_BUNDLE], { stdio: 'inherit' });
-}
-
 export async function deployCommand(opts: DeployOptions): Promise<void> {
   if (opts.json) {
     setOutputMode('json');
   }
 
-  info('checking S3 bucket');
-  await assertBucketExists();
-
   const paths = resolveConsumerPaths(process.cwd());
   const consumerPkg = (await readJson(paths.consumerPkg)) as { name?: string };
   if (!consumerPkg.name) {
@@ -50,6 +35,11 @@ export async function deployCommand(opts: DeployOptions): Promise<void> {
   }
   const appName = mfAppName(consumerPkg.name);
 
+  // Validate the user's deploy token is on disk before doing any expensive
+  // work. Throws Z2hAuthMissingError with a remediation hint if not.
+  await readZthAuth();
+  setupS3Client({ appName });
+
   info('reading current Z2H manifest');
   const manifest = await readManifest();
   const version = nextVersion(manifest, appName);
@@ -70,6 +60,14 @@ export async function deployCommand(opts: DeployOptions): Promise<void> {
   }
   const assetManifest = (await readJson(assetManifestPath)) as AssetManifestFile;
 
+  const deployedBy = os.userInfo().username;
+  const entry: ManifestEntry = {
+    ...assetManifest,
+    version,
+    url,
+    deployedBy,
+  };
+
   if (opts.dryRun) {
     output(`[z2h-cli] dry-run: would upload to s3://${BUCKET_WRITE_NAME}/${keyPrefix}/ as v${version}`, {
       ok: true,
@@ -79,22 +77,11 @@ export async function deployCommand(opts: DeployOptions): Promise<void> {
       bucket: BUCKET_WRITE_NAME,
       keyPrefix,
       url,
-      entry: { ...assetManifest, version, url },
+      entry,
     });
     return;
   }
 
-  await requestAponoAccess();
-
-  const deployedBy = os.userInfo().username;
-
-  const entry: ManifestEntry = {
-    ...assetManifest,
-    version,
-    url,
-    deployedBy,
-  };
-
   info(`uploading build → s3://${BUCKET_WRITE_NAME}/${keyPrefix}/`);
   await uploadDir(paths.shadowBuild, keyPrefix);
 

package/src/commands/generate-z2h-token.ts

@@ -0,0 +1,124 @@
+import readline from 'node:readline/promises';
+import { stdin, stdout } from 'node:process';
+import { execa } from 'execa';
+import { info, warn, output, setOutputMode } from '../util/logger';
+import { writeZthAuth, validateJwtPattern } from '../util/auth/write-auth';
+import { startLoopbackServer } from '../util/auth/loopback-server';
+
+export const DEFAULT_TOKEN_PAGE_URL = 'https://bigbrain.me/bigbrain-vibe/generate-z2h-token';
+export const LOOPBACK_TIMEOUT_MS = 120_000;
+
+export interface GenerateZ2HTokenOptions {
+  /**
+   * Skip browser auto-open AND skip the loopback callback. Prints the URL
+   * for the user to open manually, then waits for them to paste the token
+   * into the prompt. Use for SSH sessions, CI, or when the loopback can't
+   * reach the CLI for any reason.
+   */
+  noBrowser?: boolean;
+  /** Override the page URL — useful when pointing at staging. */
+  url?: string;
+  json?: boolean;
+}
+
+function browserOpenCommand(): string {
+  switch (process.platform) {
+    case 'darwin':
+      return 'open';
+    case 'win32':
+      return 'start';
+    default:
+      return 'xdg-open';
+  }
+}
+
+async function openInBrowser(url: string): Promise<void> {
+  await execa(browserOpenCommand(), [url], { stdio: 'ignore' });
+}
+
+async function promptForToken(): Promise<string> {
+  const rl = readline.createInterface({ input: stdin, output: stdout });
+  try {
+    const raw = await rl.question('Paste your token here, then press Enter:\n> ');
+    return raw.trim();
+  } finally {
+    rl.close();
+  }
+}
+
+function withQueryParam(url: string, key: string, value: string): string {
+  const sep = url.includes('?') ? '&' : '?';
+  return `${url}${sep}${key}=${encodeURIComponent(value)}`;
+}
+
+async function runManualFlow(pageUrl: string): Promise<string> {
+  info(
+    `open this URL in your browser to mint a Z2H deploy token:\n` +
+      `  ${pageUrl}\n\n` +
+      `1. Click "Generate token" on the page.\n` +
+      `2. Copy the token shown.\n` +
+      `3. Paste it below and press Enter.\n`
+  );
+  const token = await promptForToken();
+  if (!token) {
+    throw new Error('No token entered.');
+  }
+  return token;
+}
+
+async function runLoopbackFlow(pageUrl: string): Promise<string | null> {
+  const loopback = await startLoopbackServer();
+  const fullUrl = withQueryParam(pageUrl, 'cli_callback', loopback.callbackUrl);
+
+  info('opening your browser to mint a Z2H deploy token');
+  info(`  ${fullUrl}`);
+
+  try {
+    await openInBrowser(fullUrl);
+  } catch {
+    warn('could not auto-open the browser. please visit the URL above manually.');
+  }
+
+  info('waiting for the page to send the token (Ctrl+C to fall back to manual paste)…');
+
+  try {
+    return await loopback.waitForToken(LOOPBACK_TIMEOUT_MS);
+  } catch {
+    return null;
+  } finally {
+    loopback.close();
+  }
+}
+
+export async function generateZ2HTokenCommand(opts: GenerateZ2HTokenOptions = {}): Promise<void> {
+  if (opts.json) {
+    setOutputMode('json');
+  }
+
+  const pageUrl = opts.url ?? process.env.Z2H_TOKEN_PAGE_URL ?? DEFAULT_TOKEN_PAGE_URL;
+
+  // --no-browser bypasses both auto-open and the loopback round-trip — the
+  // user opens the URL themselves and pastes the token. Useful when the
+  // loopback can't be reached (SSH, CI, locked-down browsers).
+  let token: string | null = null;
+  if (!opts.noBrowser) {
+    token = await runLoopbackFlow(pageUrl);
+    if (!token) {
+      warn('loopback flow timed out or was cancelled — falling back to manual paste.');
+    }
+  }
+  if (!token) {
+    token = await runManualFlow(pageUrl);
+  }
+
+  if (!validateJwtPattern(token)) {
+    throw new Error('That does not look like a JWT (expected three dot-separated segments).');
+  }
+
+  const { filePath } = await writeZthAuth({ token });
+
+  output(`[z2h-cli] token saved ✅ ${filePath}`, {
+    ok: true,
+    filePath,
+  });
+}

package/src/constants.ts

@@ -38,3 +38,28 @@ export const YARNRC_LINES = [
   "npmAuthToken: '${NPM_TOKEN}'",
   "npmRegistryServer: 'https://registry.npmjs.org/'",
 ];
+
+// ─────────── Z2H deploy bucket / contract ─────────
+// Source of truth for the bucket layout. The CLI uses these when configuring
+// the S3 client + uploading; bigbrain-zth's STS broker imports them via
+// `@mondaydotcomorg/z2h-cli/constants` to scope the per-deploy session
+// policy to the same bucket + manifest key.
+
+export const BUCKET_WRITE_NAME = 'prod-use1-bigbrain-zth-mf-assets';
+export const REGION = 'us-east-1';
+export const BUCKET_WRITE_URL = `https://${BUCKET_WRITE_NAME}.s3.${REGION}.amazonaws.com`;
+
+export const BUCKET_READ_DNS_NAME = 'bigbrain-zth-mf-assets';
+export const BUCKET_READ_DNS_URL = `https://${BUCKET_READ_DNS_NAME}.bigbrain.me`;
+
+// No `.json` extension — TridentSkeleton's `mfUrl` API appends `/mf-assets`
+// to the bucket base when fetching, so the manifest must live at this exact
+// key. See microfrontends/mf-bigbrain-zth/.../ZeroToHeroHost.tsx.
+export const MANIFEST_KEY = 'mf-assets';
+export const MANIFEST_READ_URL = `${BUCKET_READ_DNS_URL}/${MANIFEST_KEY}`;
+
+// ─────────── App-name slug — backend & CLI both honor this ─────
+// Lowercase kebab-case, must start with a letter, 2-50 chars total. The
+// backend STS broker rejects anything else with 400; the CLI can validate
+// upfront for friendlier errors.
+export const APP_NAME_PATTERN = /^[a-z][a-z0-9-]{1,49}$/;

package/src/index.ts

@@ -5,6 +5,7 @@ import { cleanCommand } from './commands/clean';
 import { deployCommand } from './commands/deploy';
 import { createWorkspaceCommand } from './commands/create-workspace';
 import { createCommand } from './commands/create';
+import { generateZ2HTokenCommand } from './commands/generate-z2h-token';
 import { errorLog, fail } from './util/logger';
 
 async function main(): Promise<void> {
@@ -91,6 +92,22 @@ async function main(): Promise<void> {
       }
     });
 
+  program
+    .command('generate-z2h-token')
+    .description(
+      'Open the bigbrain.me token page, capture the token via a loopback callback, and persist it to ~/.zth/auth.json'
+    )
+    .option('--no-browser', "don't auto-open the browser; print the URL and prompt for manual paste")
+    .option('--url <url>', 'Override the token page URL (e.g. for staging)')
+    .option('--json', 'emit structured JSON on stdout')
+    .action(async (opts: { noBrowser?: boolean; url?: string; json?: boolean }) => {
+      try {
+        await generateZ2HTokenCommand(opts);
+      } catch (err) {
+        fail(`generate-z2h-token failed: ${(err as Error).message}`, { command: 'generate-z2h-token' }, 1);
+      }
+    });
+
   program
     .command('create <app-name>')
     .description('Scaffold a new Z2H consumer app inside ~/zth-projects/')