@mondaydotcomorg/z2h-cli 0.2.0 → 0.3.1

package/dist/commands/create-workspace.js

@@ -37,7 +37,7 @@ async function createWorkspaceCommand(opts) {
     if (await fsExtra.pathExists(home)) {
         const entries = await fsExtra.readdir(home);
         if (entries.length > 0) {
-            throw new Error(`${home} is non-empty. Wipe it before running create-workspace.`);
+            throw new Error(`Workspace already exists at ${home}. Remove it and try again.`);
         }
     }
     else {
@@ -66,12 +66,12 @@ async function createWorkspaceCommand(opts) {
         fsExtra.copy(path__default.default.join(wsTemplatesDir, 'README.md'), path__default.default.join(home, 'README.md')),
         fsExtra.copy(path__default.default.join(wsTemplatesDir, 'yarn-releases', 'yarn-4.5.1.cjs'), path__default.default.join(home, '.yarn', 'releases', 'yarn-4.5.1.cjs')),
     ]);
-    util_logger.info(`bootstrapping workspace at ${home}`);
+    util_logger.info(`setting up your Z2H workspace — this may take a minute...`);
     await execa.execa('yarn', ['install'], {
         cwd: home,
         stdio: 'inherit',
     });
-    util_logger.output(`[z2h-cli] workspace ready at ${home}`, {
+    util_logger.output(`Your workspace is ready! 🚀 Apps will live at ${home}`, {
         ok: true,
         workspace: home,
         z2hCliVersion: cliVersion,

package/dist/commands/create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../src/commands/create.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AA0BD,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAgFvF"}
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../src/commands/create.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AA6BD,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAqFvF"}

package/dist/commands/create.js

@@ -9,12 +9,16 @@ const util_workspace = require('../util/workspace.js');
 const util_templates = require('../util/templates.js');
 const util_manifest = require('../util/manifest.js');
 const util_appName = require('../util/app-name.js');
+const constants = require('../constants.js');
 
 const _interopDefault = e => e && e.__esModule ? e : { default: e };
 
 const path__default = /*#__PURE__*/_interopDefault(path);
 
-const APP_NAME_RE = /^[a-z][a-z0-9-]{1,49}$/;
+// Names reserved by the host MF (mf-bigbrain-zth) for platform pages under
+// /bigbrain-vibe/<name>. Creating an app with one of these would shadow the
+// platform page in the URL, so we refuse upfront.
+const RESERVED_APP_NAMES = new Set(['generate-z2h-token']);
 /**
  * Convert kebab-case to PascalCase. `demo-app` → `DemoApp`.
  */
@@ -42,7 +46,10 @@ async function createCommand(appName, opts) {
     // Validate workspace.
     const workspace = await util_workspace.assertWorkspace();
     // Validate app name.
-    if (!APP_NAME_RE.test(appName)) {
+    if (RESERVED_APP_NAMES.has(appName)) {
+        throw new Error(`App name "${appName}" is reserved by the Z2H host for a platform page under /bigbrain-vibe/${appName}. Pick a different name.`);
+    }
+    if (!constants.APP_NAME_PATTERN.test(appName)) {
         throw new Error(`App name "${appName}" is invalid. Use lowercase kebab-case (a-z, 0-9, -), ` +
             `2-50 chars, starting with a letter.`);
     }
@@ -88,7 +95,7 @@ async function createCommand(appName, opts) {
     if (template === 'html-embed' && opts.htmlFile) {
         await fsExtra.copy(opts.htmlFile, path__default.default.join(appDir, 'src', 'page.html'));
     }
-    util_logger.info(`installing into workspace at ${workspace}`);
+    util_logger.info(`installing dependencies for ${appName}...`);
     await execa.execa('yarn', ['install'], {
         cwd: workspace,
         stdio: 'inherit',

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAaD,wBAAsB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAgFtE"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA+EtE"}

package/dist/commands/deploy.js

@@ -3,12 +3,13 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const path = require('node:path');
 const os = require('node:os');
 const fsExtra = require('fs-extra');
-require('execa');
 const util_logger = require('../util/logger.js');
 const shadow_paths = require('../shadow/paths.js');
 const util_manifest = require('../util/manifest.js');
 const util_s3_upload = require('../util/s3/upload.js');
+const constants = require('../constants.js');
 const util_s3_client = require('../util/s3/client.js');
+const util_auth_authStore = require('../util/auth/auth-store.js');
 const util_appName = require('../util/app-name.js');
 const commands_build = require('./build.js');
 
@@ -17,30 +18,25 @@ const _interopDefault = e => e && e.__esModule ? e : { default: e };
 const path__default = /*#__PURE__*/_interopDefault(path);
 const os__default = /*#__PURE__*/_interopDefault(os);
 
-const APONO_BUNDLE = '<APONO_BUNDLE_NAME>'; // TODO: replace with actual bundle name once infra setup is complete
-async function requestAponoAccess() {
-    {
-        util_logger.warn(`skipping Apono request — APONO_BUNDLE is still a placeholder ("${APONO_BUNDLE}"). Set it in deploy.ts before relying on auto-grant.`);
-        return;
-    }
-}
 async function deployCommand(opts) {
     if (opts.json) {
         util_logger.setOutputMode('json');
     }
-    util_logger.info('checking S3 bucket');
-    await util_s3_client.assertBucketExists();
     const paths = shadow_paths.resolveConsumerPaths(process.cwd());
     const consumerPkg = (await fsExtra.readJson(paths.consumerPkg));
     if (!consumerPkg.name) {
         throw new Error('Consumer package.json must have a "name" field');
     }
     const appName = util_appName.mfAppName(consumerPkg.name);
+    // Validate the user's deploy token is on disk before doing any expensive
+    // work. Throws Z2hAuthMissingError with a remediation hint if not.
+    await util_auth_authStore.readZthAuth();
+    util_s3_client.setupS3Client({ appName });
     util_logger.info('reading current Z2H manifest');
     const manifest = await util_manifest.readManifest();
     const version = util_manifest.nextVersion(manifest, appName);
     const keyPrefix = `${appName}/${version}`;
-    const url = `${util_s3_client.BUCKET_READ_DNS_URL}/${keyPrefix}`;
+    const url = `${constants.BUCKET_READ_DNS_URL}/${keyPrefix}`;
     util_logger.info('building');
     await commands_build.buildCommand({ json: opts.json, publicUrl: url });
     if (!(await fsExtra.pathExists(paths.shadowBuild))) {
@@ -52,28 +48,27 @@ async function deployCommand(opts) {
         throw new Error(`Missing asset-manifest.json at ${assetManifestPath}.`);
     }
     const assetManifest = (await fsExtra.readJson(assetManifestPath));
+    const deployedBy = os__default.default.userInfo().username;
+    const entry = {
+        ...assetManifest,
+        version,
+        url,
+        deployedBy,
+    };
     if (opts.dryRun) {
-        util_logger.output(`[z2h-cli] dry-run: would upload to s3://${util_s3_client.BUCKET_WRITE_NAME}/${keyPrefix}/ as v${version}`, {
+        util_logger.output(`[z2h-cli] dry-run: would upload to s3://${constants.BUCKET_WRITE_NAME}/${keyPrefix}/ as v${version}`, {
             ok: true,
             dryRun: true,
             appName,
             version,
-            bucket: util_s3_client.BUCKET_WRITE_NAME,
+            bucket: constants.BUCKET_WRITE_NAME,
             keyPrefix,
             url,
-            entry: { ...assetManifest, version, url },
+            entry,
         });
         return;
     }
-    await requestAponoAccess();
-    const deployedBy = os__default.default.userInfo().username;
-    const entry = {
-        ...assetManifest,
-        version,
-        url,
-        deployedBy,
-    };
-    util_logger.info(`uploading build → s3://${util_s3_client.BUCKET_WRITE_NAME}/${keyPrefix}/`);
+    util_logger.info(`uploading build → s3://${constants.BUCKET_WRITE_NAME}/${keyPrefix}/`);
     await util_s3_upload.uploadDir(paths.shadowBuild, keyPrefix);
     util_logger.info(`updating manifest entry "${appName}" → v${version}`);
     await util_manifest.writeManifest(util_manifest.upsertEntry(manifest, appName, entry));
@@ -85,7 +80,7 @@ async function deployCommand(opts) {
         ok: true,
         appName,
         version,
-        bucket: util_s3_client.BUCKET_WRITE_NAME,
+        bucket: constants.BUCKET_WRITE_NAME,
         keyPrefix,
         url,
         liveUrl,

package/dist/commands/generate-z2h-token.d.ts

@@ -0,0 +1,16 @@
+export declare const DEFAULT_TOKEN_PAGE_URL = "https://bigbrain.me/bigbrain-vibe/generate-z2h-token";
+export declare const LOOPBACK_TIMEOUT_MS = 120000;
+export interface GenerateZ2HTokenOptions {
+    /**
+     * Skip browser auto-open AND skip the loopback callback. Prints the URL
+     * for the user to open manually, then waits for them to paste the token
+     * into the prompt. Use for SSH sessions, CI, or when the loopback can't
+     * reach the CLI for any reason.
+     */
+    noBrowser?: boolean;
+    /** Override the page URL — useful when pointing at staging. */
+    url?: string;
+    json?: boolean;
+}
+export declare function generateZ2HTokenCommand(opts?: GenerateZ2HTokenOptions): Promise<void>;
+//# sourceMappingURL=generate-z2h-token.d.ts.map

package/dist/commands/generate-z2h-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-z2h-token.d.ts","sourceRoot":"","sources":["../../src/commands/generate-z2h-token.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,sBAAsB,yDAAyD,CAAC;AAC7F,eAAO,MAAM,mBAAmB,SAAU,CAAC;AAE3C,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAuED,wBAAsB,uBAAuB,CAAC,IAAI,GAAE,uBAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B/F"}

package/dist/commands/generate-z2h-token.js

@@ -0,0 +1,107 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+
+const readline = require('node:readline/promises');
+const node_process = require('node:process');
+const execa = require('execa');
+const util_logger = require('../util/logger.js');
+const util_auth_writeAuth = require('../util/auth/write-auth.js');
+const util_auth_loopbackServer = require('../util/auth/loopback-server.js');
+
+const _interopDefault = e => e && e.__esModule ? e : { default: e };
+
+const readline__default = /*#__PURE__*/_interopDefault(readline);
+
+const DEFAULT_TOKEN_PAGE_URL = 'https://bigbrain.me/bigbrain-vibe/generate-z2h-token';
+const LOOPBACK_TIMEOUT_MS = 120_000;
+function browserOpenCommand() {
+    switch (process.platform) {
+        case 'darwin':
+            return 'open';
+        case 'win32':
+            return 'start';
+        default:
+            return 'xdg-open';
+    }
+}
+async function openInBrowser(url) {
+    await execa.execa(browserOpenCommand(), [url], { stdio: 'ignore' });
+}
+async function promptForToken() {
+    const rl = readline__default.default.createInterface({ input: node_process.stdin, output: node_process.stdout });
+    try {
+        const raw = await rl.question('Paste your token here, then press Enter:\n> ');
+        return raw.trim();
+    }
+    finally {
+        rl.close();
+    }
+}
+function withQueryParam(url, key, value) {
+    const sep = url.includes('?') ? '&' : '?';
+    return `${url}${sep}${key}=${encodeURIComponent(value)}`;
+}
+async function runManualFlow(pageUrl) {
+    util_logger.info(`open this URL in your browser to mint a Z2H deploy token:\n` +
+        `  ${pageUrl}\n\n` +
+        `1. Click "Generate token" on the page.\n` +
+        `2. Copy the token shown.\n` +
+        `3. Paste it below and press Enter.\n`);
+    const token = await promptForToken();
+    if (!token) {
+        throw new Error('No token entered.');
+    }
+    return token;
+}
+async function runLoopbackFlow(pageUrl) {
+    const loopback = await util_auth_loopbackServer.startLoopbackServer();
+    const fullUrl = withQueryParam(pageUrl, 'cli_callback', loopback.callbackUrl);
+    util_logger.info('opening your browser to mint a Z2H deploy token');
+    util_logger.info(`  ${fullUrl}`);
+    try {
+        await openInBrowser(fullUrl);
+    }
+    catch {
+        util_logger.warn('could not auto-open the browser. please visit the URL above manually.');
+    }
+    util_logger.info('waiting for the page to send the token (Ctrl+C to fall back to manual paste)…');
+    try {
+        return await loopback.waitForToken(LOOPBACK_TIMEOUT_MS);
+    }
+    catch {
+        return null;
+    }
+    finally {
+        loopback.close();
+    }
+}
+async function generateZ2HTokenCommand(opts = {}) {
+    if (opts.json) {
+        util_logger.setOutputMode('json');
+    }
+    const pageUrl = opts.url ?? process.env.Z2H_TOKEN_PAGE_URL ?? DEFAULT_TOKEN_PAGE_URL;
+    // --no-browser bypasses both auto-open and the loopback round-trip — the
+    // user opens the URL themselves and pastes the token. Useful when the
+    // loopback can't be reached (SSH, CI, locked-down browsers).
+    let token = null;
+    if (!opts.noBrowser) {
+        token = await runLoopbackFlow(pageUrl);
+        if (!token) {
+            util_logger.warn('loopback flow timed out or was cancelled — falling back to manual paste.');
+        }
+    }
+    if (!token) {
+        token = await runManualFlow(pageUrl);
+    }
+    if (!util_auth_writeAuth.validateJwtPattern(token)) {
+        throw new Error('That does not look like a JWT (expected three dot-separated segments).');
+    }
+    const { filePath } = await util_auth_writeAuth.writeZthAuth({ token });
+    util_logger.output(`[z2h-cli] token saved ✅ ${filePath}`, {
+        ok: true,
+        filePath,
+    });
+}
+
+exports.DEFAULT_TOKEN_PAGE_URL = DEFAULT_TOKEN_PAGE_URL;
+exports.LOOPBACK_TIMEOUT_MS = LOOPBACK_TIMEOUT_MS;
+exports.generateZ2HTokenCommand = generateZ2HTokenCommand;

package/dist/constants.d.ts

@@ -9,4 +9,12 @@ export declare const MIN_PORT = 13000;
 export declare const MAX_PORT = 19999;
 export declare const GITIGNORE_ENTRIES: string[];
 export declare const YARNRC_LINES: string[];
+export declare const BUCKET_WRITE_NAME = "prod-use1-bigbrain-zth-mf-assets";
+export declare const REGION = "us-east-1";
+export declare const BUCKET_WRITE_URL = "https://prod-use1-bigbrain-zth-mf-assets.s3.us-east-1.amazonaws.com";
+export declare const BUCKET_READ_DNS_NAME = "bigbrain-zth-mf-assets";
+export declare const BUCKET_READ_DNS_URL = "https://bigbrain-zth-mf-assets.bigbrain.me";
+export declare const MANIFEST_KEY = "mf-assets";
+export declare const MANIFEST_READ_URL = "https://bigbrain-zth-mf-assets.bigbrain.me/mf-assets";
+export declare const APP_NAME_PATTERN: RegExp;
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGjD,CAAC;AAQF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAG3C,eAAO,MAAM,YAAY,UAIxB,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGjD,CAAC;AAQF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAG3C,eAAO,MAAM,YAAY,UAIxB,CAAC;AAQF,eAAO,MAAM,iBAAiB,qCAAqC,CAAC;AACpE,eAAO,MAAM,MAAM,cAAc,CAAC;AAClC,eAAO,MAAM,gBAAgB,wEAA4D,CAAC;AAE1F,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,mBAAmB,+CAAgD,CAAC;AAKjF,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,iBAAiB,yDAA2C,CAAC;AAM1E,eAAO,MAAM,gBAAgB,QAA2B,CAAC"}

package/dist/constants.js

@@ -34,10 +34,38 @@ const YARNRC_LINES = [
     "npmAuthToken: '${NPM_TOKEN}'",
     "npmRegistryServer: 'https://registry.npmjs.org/'",
 ];
+// ─────────── Z2H deploy bucket / contract ─────────
+// Source of truth for the bucket layout. The CLI uses these when configuring
+// the S3 client + uploading; bigbrain-zth's STS broker imports them via
+// `@mondaydotcomorg/z2h-cli/constants` to scope the per-deploy session
+// policy to the same bucket + manifest key.
+const BUCKET_WRITE_NAME = 'prod-use1-bigbrain-zth-mf-assets';
+const REGION = 'us-east-1';
+const BUCKET_WRITE_URL = `https://${BUCKET_WRITE_NAME}.s3.${REGION}.amazonaws.com`;
+const BUCKET_READ_DNS_NAME = 'bigbrain-zth-mf-assets';
+const BUCKET_READ_DNS_URL = `https://${BUCKET_READ_DNS_NAME}.bigbrain.me`;
+// No `.json` extension — TridentSkeleton's `mfUrl` API appends `/mf-assets`
+// to the bucket base when fetching, so the manifest must live at this exact
+// key. See microfrontends/mf-bigbrain-zth/.../ZeroToHeroHost.tsx.
+const MANIFEST_KEY = 'mf-assets';
+const MANIFEST_READ_URL = `${BUCKET_READ_DNS_URL}/${MANIFEST_KEY}`;
+// ─────────── App-name slug — backend & CLI both honor this ─────
+// Lowercase kebab-case, must start with a letter, 2-50 chars total. The
+// backend STS broker rejects anything else with 400; the CLI can validate
+// upfront for friendlier errors.
+const APP_NAME_PATTERN = /^[a-z][a-z0-9-]{1,49}$/;
 
+exports.APP_NAME_PATTERN = APP_NAME_PATTERN;
+exports.BUCKET_READ_DNS_NAME = BUCKET_READ_DNS_NAME;
+exports.BUCKET_READ_DNS_URL = BUCKET_READ_DNS_URL;
+exports.BUCKET_WRITE_NAME = BUCKET_WRITE_NAME;
+exports.BUCKET_WRITE_URL = BUCKET_WRITE_URL;
 exports.GITIGNORE_ENTRIES = GITIGNORE_ENTRIES;
+exports.MANIFEST_KEY = MANIFEST_KEY;
+exports.MANIFEST_READ_URL = MANIFEST_READ_URL;
 exports.MAX_PORT = MAX_PORT;
 exports.MIN_PORT = MIN_PORT;
+exports.REGION = REGION;
 exports.SHADOW_DEV_DEPS = SHADOW_DEV_DEPS;
 exports.SHADOW_DIR_NAME = SHADOW_DIR_NAME;
 exports.SHADOW_SCRIPTS = SHADOW_SCRIPTS;

package/dist/esm/commands/create-workspace.mjs

@@ -31,7 +31,7 @@ async function createWorkspaceCommand(opts) {
     if (await pathExists(home)) {
         const entries = await readdir(home);
         if (entries.length > 0) {
-            throw new Error(`${home} is non-empty. Wipe it before running create-workspace.`);
+            throw new Error(`Workspace already exists at ${home}. Remove it and try again.`);
         }
     }
     else {
@@ -60,12 +60,12 @@ async function createWorkspaceCommand(opts) {
         copy(path.join(wsTemplatesDir, 'README.md'), path.join(home, 'README.md')),
         copy(path.join(wsTemplatesDir, 'yarn-releases', 'yarn-4.5.1.cjs'), path.join(home, '.yarn', 'releases', 'yarn-4.5.1.cjs')),
     ]);
-    info(`bootstrapping workspace at ${home}`);
+    info(`setting up your Z2H workspace — this may take a minute...`);
     await execa('yarn', ['install'], {
         cwd: home,
         stdio: 'inherit',
     });
-    output(`[z2h-cli] workspace ready at ${home}`, {
+    output(`Your workspace is ready! 🚀 Apps will live at ${home}`, {
         ok: true,
         workspace: home,
         z2hCliVersion: cliVersion,

package/dist/esm/commands/create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../src/commands/create.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AA0BD,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAgFvF"}
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../src/commands/create.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AA6BD,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAqFvF"}

package/dist/esm/commands/create.mjs

@@ -7,8 +7,12 @@ import { assertWorkspace } from '../util/workspace.mjs';
 import { APP_TEMPLATES, getTemplatesDir, renderTemplate } from '../util/templates.mjs';
 import { readManifest } from '../util/manifest.mjs';
 import { mfAppName } from '../util/app-name.mjs';
+import { APP_NAME_PATTERN } from '../constants.mjs';
 
-const APP_NAME_RE = /^[a-z][a-z0-9-]{1,49}$/;
+// Names reserved by the host MF (mf-bigbrain-zth) for platform pages under
+// /bigbrain-vibe/<name>. Creating an app with one of these would shadow the
+// platform page in the URL, so we refuse upfront.
+const RESERVED_APP_NAMES = new Set(['generate-z2h-token']);
 /**
  * Convert kebab-case to PascalCase. `demo-app` → `DemoApp`.
  */
@@ -36,7 +40,10 @@ async function createCommand(appName, opts) {
     // Validate workspace.
     const workspace = await assertWorkspace();
     // Validate app name.
-    if (!APP_NAME_RE.test(appName)) {
+    if (RESERVED_APP_NAMES.has(appName)) {
+        throw new Error(`App name "${appName}" is reserved by the Z2H host for a platform page under /bigbrain-vibe/${appName}. Pick a different name.`);
+    }
+    if (!APP_NAME_PATTERN.test(appName)) {
         throw new Error(`App name "${appName}" is invalid. Use lowercase kebab-case (a-z, 0-9, -), ` +
             `2-50 chars, starting with a letter.`);
     }
@@ -82,7 +89,7 @@ async function createCommand(appName, opts) {
     if (template === 'html-embed' && opts.htmlFile) {
         await copy(opts.htmlFile, path.join(appDir, 'src', 'page.html'));
     }
-    info(`installing into workspace at ${workspace}`);
+    info(`installing dependencies for ${appName}...`);
     await execa('yarn', ['install'], {
         cwd: workspace,
         stdio: 'inherit',

package/dist/esm/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../../src/commands/deploy.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAaD,wBAAsB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAgFtE"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../../src/commands/deploy.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA+EtE"}

package/dist/esm/commands/deploy.mjs

@@ -1,34 +1,30 @@
 import path from 'node:path';
 import os from 'node:os';
 import { readJson, pathExists } from 'fs-extra';
-import 'execa';
-import { setOutputMode, info, output, warn } from '../util/logger.mjs';
+import { setOutputMode, info, output } from '../util/logger.mjs';
 import { resolveConsumerPaths } from '../shadow/paths.mjs';
 import { readManifest, nextVersion, writeManifest, upsertEntry } from '../util/manifest.mjs';
 import { uploadDir } from '../util/s3/upload.mjs';
-import { assertBucketExists, BUCKET_WRITE_NAME, BUCKET_READ_DNS_URL } from '../util/s3/client.mjs';
+import { BUCKET_WRITE_NAME, BUCKET_READ_DNS_URL } from '../constants.mjs';
+import { setupS3Client } from '../util/s3/client.mjs';
+import { readZthAuth } from '../util/auth/auth-store.mjs';
 import { mfAppName, cleanAppName } from '../util/app-name.mjs';
 import { buildCommand } from './build.mjs';
 
-const APONO_BUNDLE = '<APONO_BUNDLE_NAME>'; // TODO: replace with actual bundle name once infra setup is complete
-async function requestAponoAccess() {
-    {
-        warn(`skipping Apono request — APONO_BUNDLE is still a placeholder ("${APONO_BUNDLE}"). Set it in deploy.ts before relying on auto-grant.`);
-        return;
-    }
-}
 async function deployCommand(opts) {
     if (opts.json) {
         setOutputMode('json');
     }
-    info('checking S3 bucket');
-    await assertBucketExists();
     const paths = resolveConsumerPaths(process.cwd());
     const consumerPkg = (await readJson(paths.consumerPkg));
     if (!consumerPkg.name) {
         throw new Error('Consumer package.json must have a "name" field');
     }
     const appName = mfAppName(consumerPkg.name);
+    // Validate the user's deploy token is on disk before doing any expensive
+    // work. Throws Z2hAuthMissingError with a remediation hint if not.
+    await readZthAuth();
+    setupS3Client({ appName });
     info('reading current Z2H manifest');
     const manifest = await readManifest();
     const version = nextVersion(manifest, appName);
@@ -45,6 +41,13 @@ async function deployCommand(opts) {
         throw new Error(`Missing asset-manifest.json at ${assetManifestPath}.`);
     }
     const assetManifest = (await readJson(assetManifestPath));
+    const deployedBy = os.userInfo().username;
+    const entry = {
+        ...assetManifest,
+        version,
+        url,
+        deployedBy,
+    };
     if (opts.dryRun) {
         output(`[z2h-cli] dry-run: would upload to s3://${BUCKET_WRITE_NAME}/${keyPrefix}/ as v${version}`, {
             ok: true,
@@ -54,18 +57,10 @@ async function deployCommand(opts) {
             bucket: BUCKET_WRITE_NAME,
             keyPrefix,
             url,
-            entry: { ...assetManifest, version, url },
+            entry,
         });
         return;
     }
-    await requestAponoAccess();
-    const deployedBy = os.userInfo().username;
-    const entry = {
-        ...assetManifest,
-        version,
-        url,
-        deployedBy,
-    };
     info(`uploading build → s3://${BUCKET_WRITE_NAME}/${keyPrefix}/`);
     await uploadDir(paths.shadowBuild, keyPrefix);
     info(`updating manifest entry "${appName}" → v${version}`);

package/dist/esm/commands/generate-z2h-token.d.ts

@@ -0,0 +1,16 @@
+export declare const DEFAULT_TOKEN_PAGE_URL = "https://bigbrain.me/bigbrain-vibe/generate-z2h-token";
+export declare const LOOPBACK_TIMEOUT_MS = 120000;
+export interface GenerateZ2HTokenOptions {
+    /**
+     * Skip browser auto-open AND skip the loopback callback. Prints the URL
+     * for the user to open manually, then waits for them to paste the token
+     * into the prompt. Use for SSH sessions, CI, or when the loopback can't
+     * reach the CLI for any reason.
+     */
+    noBrowser?: boolean;
+    /** Override the page URL — useful when pointing at staging. */
+    url?: string;
+    json?: boolean;
+}
+export declare function generateZ2HTokenCommand(opts?: GenerateZ2HTokenOptions): Promise<void>;
+//# sourceMappingURL=generate-z2h-token.d.ts.map

package/dist/esm/commands/generate-z2h-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-z2h-token.d.ts","sourceRoot":"","sources":["../../../src/commands/generate-z2h-token.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,sBAAsB,yDAAyD,CAAC;AAC7F,eAAO,MAAM,mBAAmB,SAAU,CAAC;AAE3C,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAuED,wBAAsB,uBAAuB,CAAC,IAAI,GAAE,uBAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B/F"}

package/dist/esm/commands/generate-z2h-token.mjs

@@ -0,0 +1,99 @@
+import readline from 'node:readline/promises';
+import { stdin, stdout } from 'node:process';
+import { execa } from 'execa';
+import { setOutputMode, warn, output, info } from '../util/logger.mjs';
+import { validateJwtPattern, writeZthAuth } from '../util/auth/write-auth.mjs';
+import { startLoopbackServer } from '../util/auth/loopback-server.mjs';
+
+const DEFAULT_TOKEN_PAGE_URL = 'https://bigbrain.me/bigbrain-vibe/generate-z2h-token';
+const LOOPBACK_TIMEOUT_MS = 120_000;
+function browserOpenCommand() {
+    switch (process.platform) {
+        case 'darwin':
+            return 'open';
+        case 'win32':
+            return 'start';
+        default:
+            return 'xdg-open';
+    }
+}
+async function openInBrowser(url) {
+    await execa(browserOpenCommand(), [url], { stdio: 'ignore' });
+}
+async function promptForToken() {
+    const rl = readline.createInterface({ input: stdin, output: stdout });
+    try {
+        const raw = await rl.question('Paste your token here, then press Enter:\n> ');
+        return raw.trim();
+    }
+    finally {
+        rl.close();
+    }
+}
+function withQueryParam(url, key, value) {
+    const sep = url.includes('?') ? '&' : '?';
+    return `${url}${sep}${key}=${encodeURIComponent(value)}`;
+}
+async function runManualFlow(pageUrl) {
+    info(`open this URL in your browser to mint a Z2H deploy token:\n` +
+        `  ${pageUrl}\n\n` +
+        `1. Click "Generate token" on the page.\n` +
+        `2. Copy the token shown.\n` +
+        `3. Paste it below and press Enter.\n`);
+    const token = await promptForToken();
+    if (!token) {
+        throw new Error('No token entered.');
+    }
+    return token;
+}
+async function runLoopbackFlow(pageUrl) {
+    const loopback = await startLoopbackServer();
+    const fullUrl = withQueryParam(pageUrl, 'cli_callback', loopback.callbackUrl);
+    info('opening your browser to mint a Z2H deploy token');
+    info(`  ${fullUrl}`);
+    try {
+        await openInBrowser(fullUrl);
+    }
+    catch {
+        warn('could not auto-open the browser. please visit the URL above manually.');
+    }
+    info('waiting for the page to send the token (Ctrl+C to fall back to manual paste)…');
+    try {
+        return await loopback.waitForToken(LOOPBACK_TIMEOUT_MS);
+    }
+    catch {
+        return null;
+    }
+    finally {
+        loopback.close();
+    }
+}
+async function generateZ2HTokenCommand(opts = {}) {
+    if (opts.json) {
+        setOutputMode('json');
+    }
+    const pageUrl = opts.url ?? process.env.Z2H_TOKEN_PAGE_URL ?? DEFAULT_TOKEN_PAGE_URL;
+    // --no-browser bypasses both auto-open and the loopback round-trip — the
+    // user opens the URL themselves and pastes the token. Useful when the
+    // loopback can't be reached (SSH, CI, locked-down browsers).
+    let token = null;
+    if (!opts.noBrowser) {
+        token = await runLoopbackFlow(pageUrl);
+        if (!token) {
+            warn('loopback flow timed out or was cancelled — falling back to manual paste.');
+        }
+    }
+    if (!token) {
+        token = await runManualFlow(pageUrl);
+    }
+    if (!validateJwtPattern(token)) {
+        throw new Error('That does not look like a JWT (expected three dot-separated segments).');
+    }
+    const { filePath } = await writeZthAuth({ token });
+    output(`[z2h-cli] token saved ✅ ${filePath}`, {
+        ok: true,
+        filePath,
+    });
+}
+
+export { DEFAULT_TOKEN_PAGE_URL, LOOPBACK_TIMEOUT_MS, generateZ2HTokenCommand };

package/dist/esm/constants.d.ts

@@ -9,4 +9,12 @@ export declare const MIN_PORT = 13000;
 export declare const MAX_PORT = 19999;
 export declare const GITIGNORE_ENTRIES: string[];
 export declare const YARNRC_LINES: string[];
+export declare const BUCKET_WRITE_NAME = "prod-use1-bigbrain-zth-mf-assets";
+export declare const REGION = "us-east-1";
+export declare const BUCKET_WRITE_URL = "https://prod-use1-bigbrain-zth-mf-assets.s3.us-east-1.amazonaws.com";
+export declare const BUCKET_READ_DNS_NAME = "bigbrain-zth-mf-assets";
+export declare const BUCKET_READ_DNS_URL = "https://bigbrain-zth-mf-assets.bigbrain.me";
+export declare const MANIFEST_KEY = "mf-assets";
+export declare const MANIFEST_READ_URL = "https://bigbrain-zth-mf-assets.bigbrain.me/mf-assets";
+export declare const APP_NAME_PATTERN: RegExp;
 //# sourceMappingURL=constants.d.ts.map

package/dist/esm/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGjD,CAAC;AAQF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAG3C,eAAO,MAAM,YAAY,UAIxB,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGjD,CAAC;AAQF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAG3C,eAAO,MAAM,YAAY,UAIxB,CAAC;AAQF,eAAO,MAAM,iBAAiB,qCAAqC,CAAC;AACpE,eAAO,MAAM,MAAM,cAAc,CAAC;AAClC,eAAO,MAAM,gBAAgB,wEAA4D,CAAC;AAE1F,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAC7D,eAAO,MAAM,mBAAmB,+CAAgD,CAAC;AAKjF,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,eAAO,MAAM,iBAAiB,yDAA2C,CAAC;AAM1E,eAAO,MAAM,gBAAgB,QAA2B,CAAC"}