@mondaydotcomorg/z2h-cli 0.34.1 → 0.34.2

package/dist/esm/backend/rules/snowflake-static-sql.mjs

@@ -0,0 +1,73 @@
+import { simple } from 'acorn-walk';
+import { lineOf } from '../ast.mjs';
+
+const SNOWFLAKE_QUERY = 'ctx.api.v1.snowflake.query';
+const message = (file, line) => `${file}${line ? `:${line}` : ''}: ${SNOWFLAKE_QUERY} must receive SQL written in the handler — a string literal, ` +
+    `or a variable bound to one. Client-supplied values go through params (\`:name\` bindings) and options, never into the SQL text.`;
+/**
+ * True when every possible value of `node` is text authored in this file:
+ * string literals, templates whose holes are themselves static, `+`
+ * concatenation, either branch of a conditional, and identifiers that resolve
+ * (within the file) to such values. Anything reaching outside the file —
+ * `ctx.input`, calls, member reads, destructuring — is not static.
+ */
+function isStaticSql(node, bindings, resolving) {
+    if (!node) {
+        return false;
+    }
+    const staticChild = (child) => isStaticSql(child, bindings, resolving);
+    switch (node.type) {
+        case 'Literal':
+            return typeof node.value === 'string';
+        case 'TemplateLiteral':
+            return node.expressions.every(staticChild);
+        case 'BinaryExpression':
+            return node.operator === '+' && staticChild(node.left) && staticChild(node.right);
+        case 'ConditionalExpression':
+            return staticChild(node.consequent) && staticChild(node.alternate);
+        case 'LogicalExpression':
+            return staticChild(node.left) && staticChild(node.right);
+        case 'Identifier': {
+            const { name } = node;
+            if (bindings.unpinnable.has(name) || resolving.has(name)) {
+                return false;
+            }
+            const decls = bindings.declarations.get(name);
+            if (!decls || decls.length === 0) {
+                return false;
+            }
+            const next = new Set(resolving).add(name);
+            return decls.every(d => d.path?.length === 0 && isStaticSql(d.init, bindings, next));
+        }
+        default:
+            return false;
+    }
+}
+/**
+ * `ctx.api.v1.snowflake.query(sql, params?, options?)` — the SQL text must live
+ * in the handler. The frontend chooses *which* handler to call and supplies
+ * `params` / `options`; it never ships SQL. Binding placeholders (`:name`) are
+ * how client values reach the query.
+ *
+ * The call is matched through `const` aliases of the channel
+ * (`const sf = ctx.api.v1.snowflake; sf.query(…)`), see `PathResolver`.
+ */
+class SnowflakeStaticSqlRule {
+    name = 'snowflake/static-sql';
+    check({ file, program, bindings, paths }) {
+        const violations = [];
+        simple(program, {
+            CallExpression(node) {
+                if (paths.pathOf(node.callee) !== SNOWFLAKE_QUERY) {
+                    return;
+                }
+                if (!isStaticSql(node.arguments[0], bindings, new Set())) {
+                    violations.push(message(file, lineOf(node)));
+                }
+            },
+        });
+        return violations;
+    }
+}
+
+export { SnowflakeStaticSqlRule };

package/dist/esm/backend/rules/types.d.ts

@@ -0,0 +1,29 @@
+import type { Program } from 'acorn';
+import type { Bindings, PathResolver } from '../ast';
+export interface RuleContext {
+    /** Handler file name, used to prefix messages. */
+    file: string;
+    /** Parsed with `locations: true`, so rules can point at a line. */
+    program: Program;
+    /** Every variable binding in the file — see `collectBindings`. */
+    bindings: Bindings;
+    /** Resolves member chains through `const` aliases — see `createPathResolver`. */
+    paths: PathResolver;
+}
+/**
+ * A capability-specific check that runs once the handler is structurally valid
+ * (parses as a script, defines `handler`, imports nothing).
+ *
+ * Rules return human-readable violations rather than throwing so the validator
+ * can report every problem in one pass — agent-generated handlers are fixed in
+ * a loop, and one round-trip per violation is slow.
+ *
+ * Implement as a class (see `SnowflakeStaticSqlRule`) and add an instance to
+ * `HANDLER_RULES` in `./index.ts` — keeps every rule the same shape to read.
+ */
+export interface HandlerRule {
+    /** Stable identifier, e.g. `snowflake/static-sql`. */
+    name: string;
+    check(ctx: RuleContext): string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/esm/backend/rules/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/backend/rules/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AACrC,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAErD,MAAM,WAAW,WAAW;IAC1B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,OAAO,EAAE,OAAO,CAAC;IACjB,kEAAkE;IAClE,QAAQ,EAAE,QAAQ,CAAC;IACnB,iFAAiF;IACjF,KAAK,EAAE,YAAY,CAAC;CACrB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,WAAW;IAC1B,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,EAAE,CAAC;CACnC"}

package/dist/esm/backend/rules/types.mjs

@@ -0,0 +1 @@
+

package/dist/esm/commands/__tests__/delete.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=delete.test.d.ts.map

package/dist/esm/commands/__tests__/delete.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.test.d.ts","sourceRoot":"","sources":["../../../../src/commands/__tests__/delete.test.ts"],"names":[],"mappings":""}

package/dist/esm/commands/backend.d.ts

@@ -1,7 +1,6 @@
 export interface ReadDetectAndUploadResult {
     integrations: string[];
     handlerNames: string[];
-    apiUsages: Record<string, unknown>;
 }
 /**
  * Integration sync note: the returned set is re-derived from the CURRENT backend

package/dist/esm/commands/backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../../../src/commands/backend.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AA+BD;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;CACpB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CASrC;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,MAAM,GAAE,MAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAe1F;AAsBD;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,EAC5C,MAAM,GAAE,MAAsB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAqBf"}
+{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../../../src/commands/backend.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AA+BD;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;CACpB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CASrC;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,MAAM,GAAE,MAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAe1F;AAsBD;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,EAC5C,MAAM,GAAE,MAAsB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAqBf"}

package/dist/esm/commands/backend.mjs

@@ -24,14 +24,14 @@ function currentAppName() {
 }
 async function readDetectAndUpload(appDir, prefix, appName, version, deployedBy, logLabel) {
     if (!hasHandlers(appDir)) {
-        return { integrations: [], handlerNames: [], apiUsages: {} };
+        return { integrations: [], handlerNames: [] };
     }
     info(`reading backend handlers ${logLabel}`);
-    const { handlers, apiDomains, apiUsages } = await readHandlers(appDir);
+    const { handlers, apiDomains } = await readHandlers(appDir);
     const integrations = detectIntegrations(apiDomains);
     const handlerNames = Object.keys(handlers);
     if (Object.keys(handlers).length === 0) {
-        return { integrations, handlerNames, apiUsages };
+        return { integrations, handlerNames };
     }
     const s3 = getS3Client();
     const meta = JSON.stringify({ version, deployedBy, handlers: Object.keys(handlers) });
@@ -40,7 +40,7 @@ async function readDetectAndUpload(appDir, prefix, appName, version, deployedBy,
         ...Object.entries(handlers).map(([name, code]) => put(`${prefix}/${name}.js`, code, 'application/javascript')),
         put(`${prefix}/meta.json`, meta, 'application/json'),
     ]);
-    return { integrations, handlerNames, apiUsages };
+    return { integrations, handlerNames };
 }
 /**
  * Integration sync note: the returned set is re-derived from the CURRENT backend

package/dist/esm/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../../src/commands/deploy.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,KAAK,UAAU,EAA2C,MAAM,4BAA4B,CAAC;AAatG,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IAIrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAWD,wBAAsB,aAAa,CAAC,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyB3E"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../../src/commands/deploy.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,KAAK,UAAU,EAA2C,MAAM,4BAA4B,CAAC;AAatG,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IAIrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAWD,wBAAsB,aAAa,CAAC,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyB3E"}

package/dist/esm/commands/deploy.mjs

@@ -10,6 +10,7 @@ import { readZthAuth } from '../util/auth/auth-store.mjs';
 import { validateAppName, cleanAppName, mfAppName, buildPreviewSlug } from '../util/app-name.mjs';
 import { getRemoteUrl, initRepo, guardCleanTree, pullAndResolve, pushToRemote } from '../util/git/repo.mjs';
 import { updateOrCreateUsageJson } from '../util/usage-json.mjs';
+import { putAppUsage } from '../util/usage-upload.mjs';
 import { resolveGitEnv } from '../util/git/git-env.mjs';
 import { validateRemoteOptions, resolveRemoteUrl } from '../util/git/remote-options.mjs';
 import { setupS3Client } from '../util/s3/client.mjs';
@@ -83,7 +84,7 @@ async function uploadAndRegister(opts) {
     const { paths, keyPrefix, appName, token, nextVersion, entry, gitRemote, isPreview, description, masterAppName } = opts;
     // Runs before the frontend upload so a `deployBackend` failure can't leave a
     // preview's unversioned `MF` dir overwritten with no rollback.
-    const { integrations, handlerNames, apiUsages } = await deployBackend({
+    const { integrations, handlerNames } = await deployBackend({
         appDir: process.cwd(),
         appName,
         mfKeyPrefix: keyPrefix,
@@ -102,7 +103,6 @@ async function uploadAndRegister(opts) {
             gitRemote,
             integrations,
             handlerNames,
-            apiUsages,
             description,
             masterAppName,
         });
@@ -136,7 +136,7 @@ async function deployPreview({ paths, consumerName, appName, token, opts }) {
     const url = `${BUCKET_READ_DNS_URL}/${keyPrefix}`;
     // No catch-all: every stage below tags its own DeployError reason at the throw site,
     // and anything unclassified reports as `unknown` via reasonOf() in runCommand.
-    const nextVersion = (await fetchDeployVersion(previewAppName)) + 1;
+    const nextVersion = (await fetchDeployVersion(previewAppName)).version + 1;
     info('building');
     const entry = await buildAndStamp({
         paths,
@@ -201,9 +201,10 @@ async function deployLive({ paths, consumerName, appName, token, opts }) {
         await initRepo(process.cwd(), remote);
         gitRemote = remote;
     }
-    const version = await fetchDeployVersion(appName);
+    const { version, id: appId } = await fetchDeployVersion(appName);
     const nextVersion = version + 1;
     const gitEnv = await resolveGitEnv(appName, gitRemote);
+    let usage = {};
     // Sync git first so a divergence (GitConflictError) stops us.
     // The skill commits the working tree (with an LLM-authored message) before
     // invoking deploy, so the tree should be clean here.
@@ -212,7 +213,7 @@ async function deployLive({ paths, consumerName, appName, token, opts }) {
             await guardCleanTree(process.cwd());
             info('syncing with git remote');
             await pullAndResolve(process.cwd(), gitEnv);
-            await updateOrCreateUsageJson(process.cwd(), appName, whoAmI());
+            usage = await updateOrCreateUsageJson(process.cwd(), appName, whoAmI());
         }
         catch (err) {
             throw tagDeployError('git_error', err);
@@ -269,6 +270,7 @@ async function deployLive({ paths, consumerName, appName, token, opts }) {
         info('releasing deploy lock');
         await releaseLockBestEffort(appName, token);
     }
+    await putAppUsage(appName, appId, usage, nextVersion);
     // Tags are a post-deploy concern: the S3 upload has already succeeded, so a
     // tag failure never fails the deploy (handled inside).
     await handleDeployTags(appName);

package/dist/esm/constants.d.ts

@@ -8,7 +8,7 @@ export declare const SHADOW_DEV_DEPS: Record<string, string>;
 export declare const MIN_PORT = 13000;
 export declare const MAX_PORT = 19999;
 export declare const GITIGNORE_ENTRIES: string[];
-export { ALWAYS_ON_CHANNELS, APP_NAME_PATTERN, BUCKET_READ_DNS_NAME, BUCKET_READ_DNS_URL, BUCKET_WRITE_NAME, BUCKET_WRITE_URL, DATAVIZ_SKILLS_PREFIX, DECLARED_INTEGRATIONS, MANIFEST_KEY, MANIFEST_READ_URL, PREVIEW_APP_NAME_PREFIX, REGION, S3_PREVIEWS_FOLDER, S3_SKILLS_BUCKET_NAME, type DeclaredIntegration, } from '@mondaydotcomorg/z2h-shared-utils';
+export { ALWAYS_ON_CHANNELS, APP_USAGE_BUCKET_NAME, appUsageFolder, APP_NAME_PATTERN, BUCKET_READ_DNS_NAME, BUCKET_READ_DNS_URL, BUCKET_WRITE_NAME, BUCKET_WRITE_URL, DATAVIZ_SKILLS_PREFIX, DECLARED_INTEGRATIONS, MANIFEST_KEY, MANIFEST_READ_URL, PREVIEW_APP_NAME_PREFIX, REGION, S3_PREVIEWS_FOLDER, S3_SKILLS_BUCKET_NAME, type DeclaredIntegration, } from '@mondaydotcomorg/z2h-shared-utils';
 export declare const DEFAULT_BROKER_BASE_URL = "https://bigbrain-zth.bigbrain.me";
 /**
  * Resolves the broker origin (no trailing slash). Honors
@@ -16,6 +16,7 @@ export declare const DEFAULT_BROKER_BASE_URL = "https://bigbrain-zth.bigbrain.me
  * STS credential provider and the npm-broker registry URL.
  */
 export declare function brokerBaseUrl(): string;
+export declare function isProdBroker(): boolean;
 export declare function routingHeaders(): Record<string, string>;
 export declare const NPM_BROKER_PATH = "/z2h-cli/npm";
 export declare const BROKER_NPM_SCOPE = "@mondaydotcomorg";

package/dist/esm/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAEjD,CAAC;AAKF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAI3C,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,YAAY,EACZ,iBAAiB,EACjB,uBAAuB,EACvB,MAAM,EACN,kBAAkB,EAClB,qBAAqB,EACrB,KAAK,mBAAmB,GACzB,MAAM,mCAAmC,CAAC;AAK3C,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAID,wBAAgB,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGvD;AAKD,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAG9C,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAGnD,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AAMrE,eAAO,MAAM,iBAAiB,EAAG,eAAwB,CAAC;AAE1D;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,eAAO,MAAM,eAAe,SAAS,CAAC;AAGtC,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAEjD,CAAC;AAKF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAMF,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAC9B,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAG9B,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAI3C,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,YAAY,EACZ,iBAAiB,EACjB,uBAAuB,EACvB,MAAM,EACN,kBAAkB,EAClB,qBAAqB,EACrB,KAAK,mBAAmB,GACzB,MAAM,mCAAmC,CAAC;AAK3C,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAgB,YAAY,IAAI,OAAO,CAEtC;AAID,wBAAgB,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGvD;AAKD,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAG9C,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAGnD,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AAMrE,eAAO,MAAM,iBAAiB,EAAG,eAAwB,CAAC;AAE1D;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}

package/dist/esm/constants.mjs

@@ -1,4 +1,4 @@
-export { ALWAYS_ON_CHANNELS, APP_NAME_PATTERN, BUCKET_READ_DNS_NAME, BUCKET_READ_DNS_URL, BUCKET_WRITE_NAME, BUCKET_WRITE_URL, DATAVIZ_SKILLS_PREFIX, DECLARED_INTEGRATIONS, MANIFEST_KEY, MANIFEST_READ_URL, PREVIEW_APP_NAME_PREFIX, REGION, S3_PREVIEWS_FOLDER, S3_SKILLS_BUCKET_NAME } from '@mondaydotcomorg/z2h-shared-utils';
+export { ALWAYS_ON_CHANNELS, APP_NAME_PATTERN, APP_USAGE_BUCKET_NAME, BUCKET_READ_DNS_NAME, BUCKET_READ_DNS_URL, BUCKET_WRITE_NAME, BUCKET_WRITE_URL, DATAVIZ_SKILLS_PREFIX, DECLARED_INTEGRATIONS, MANIFEST_KEY, MANIFEST_READ_URL, PREVIEW_APP_NAME_PREFIX, REGION, S3_PREVIEWS_FOLDER, S3_SKILLS_BUCKET_NAME, appUsageFolder } from '@mondaydotcomorg/z2h-shared-utils';
 
 /**
  * Cross-file constants. Narrowly-used literals (templates, prefixes used in
@@ -36,6 +36,9 @@ const DEFAULT_BROKER_BASE_URL = 'https://bigbrain-zth.bigbrain.me';
 function brokerBaseUrl() {
     return process.env.Z2H_BROKER_BASE_URL || DEFAULT_BROKER_BASE_URL;
 }
+function isProdBroker() {
+    return brokerBaseUrl() === DEFAULT_BROKER_BASE_URL;
+}
 // Returns Baggage header for monday-mirror routing when Z2H_ROUTING_KEY is set.
 // No-op in production (returns {}) — only activates when the env var is set.
 function routingHeaders() {
@@ -65,4 +68,4 @@ function brokerNpmRegistryUrl() {
     return `${brokerBaseUrl()}${NPM_BROKER_PATH}`;
 }
 
-export { BROKER_NPM_SCOPE, DEFAULT_BROKER_BASE_URL, GITIGNORE_ENTRIES, MAX_PORT, MIN_PORT, NPM_BROKER_PATH, PUBLIC_NPM_REGISTRY_URL, SHADOW_DEV_DEPS, SHADOW_DIR_NAME, SHADOW_SCRIPTS, Z2H_NPM_TOKEN_ENV, brokerBaseUrl, brokerNpmRegistryUrl, routingHeaders };
+export { BROKER_NPM_SCOPE, DEFAULT_BROKER_BASE_URL, GITIGNORE_ENTRIES, MAX_PORT, MIN_PORT, NPM_BROKER_PATH, PUBLIC_NPM_REGISTRY_URL, SHADOW_DEV_DEPS, SHADOW_DIR_NAME, SHADOW_SCRIPTS, Z2H_NPM_TOKEN_ENV, brokerBaseUrl, brokerNpmRegistryUrl, isProdBroker, routingHeaders };

package/dist/esm/util/__tests__/usage-upload.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=usage-upload.test.d.ts.map

package/dist/esm/util/__tests__/usage-upload.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage-upload.test.d.ts","sourceRoot":"","sources":["../../../../src/util/__tests__/usage-upload.test.ts"],"names":[],"mappings":""}

package/dist/esm/util/auth/__tests__/index.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.test.d.ts.map

package/dist/esm/util/auth/__tests__/index.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.test.d.ts","sourceRoot":"","sources":["../../../../../src/util/auth/__tests__/index.test.ts"],"names":[],"mappings":""}

package/dist/esm/util/auth/broker-credential-provider.d.ts

@@ -1,12 +1,16 @@
 import type { AwsCredentialIdentityProvider } from '@aws-sdk/types';
 export declare const STS_BROKER_PATH = "/z2h-cli/sts/credentials";
 export declare const DEPLOY_VERSION_PATH = "/z2h-cli/apps/version";
+interface VersionResponse {
+    version?: number;
+    id?: number | null;
+}
 /**
  * Reserve the version this deploy will write to. Split out of the STS
  * credentials call so version derivation lives on its own endpoint — the CLI
  * asks for the version first, then requests credentials scoped to it.
  */
-export declare function fetchDeployVersion(appName: string): Promise<number>;
+export declare function fetchDeployVersion(appName: string): Promise<Required<VersionResponse>>;
 /**
  * AWS SDK credential provider that fetches short-lived credentials from the
  * bigbrain-zth STS broker, scoped to `appName` — or, when `previewId` is
@@ -19,4 +23,5 @@ export declare function brokerCredentialProvider({ appName, previewId, }: {
     appName: string;
     previewId?: string;
 }): AwsCredentialIdentityProvider;
+export {};
 //# sourceMappingURL=broker-credential-provider.d.ts.map

package/dist/esm/util/auth/broker-credential-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"broker-credential-provider.d.ts","sourceRoot":"","sources":["../../../../src/util/auth/broker-credential-provider.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAyB,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAE3F,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAC1D,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AA0D3D;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMzE;AAwDD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,OAAO,EACP,SAAS,GACV,EAAE;IACD,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,6BAA6B,CAIhC"}
+{"version":3,"file":"broker-credential-provider.d.ts","sourceRoot":"","sources":["../../../../src/util/auth/broker-credential-provider.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAyB,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAE3F,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAC1D,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAa3D,UAAU,eAAe;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AA2CD;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAK5F;AAwDD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,OAAO,EACP,SAAS,GACV,EAAE;IACD,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,6BAA6B,CAIhC"}

package/dist/esm/util/auth/broker-credential-provider.mjs

@@ -49,8 +49,8 @@ async function assertBrokerOk(res, errorLabel) {
 async function fetchDeployVersion(appName) {
     const res = await postToBroker(DEPLOY_VERSION_PATH, { appName });
     await assertBrokerOk(res, 'deploy');
-    const body = (await res.json());
-    return body.version ?? 0;
+    const { version = 0, id = null } = (await res.json());
+    return { version, id };
 }
 async function requestSts(path, body, errorLabel) {
     const res = await postToBroker(path, body);

package/dist/esm/util/auth/index.d.ts

@@ -0,0 +1,3 @@
+export { ensureZ2hToken, type EnsureZ2hTokenOptions } from '../npm/ensure-token';
+export { readZthAuth, tryReadAuthTokenSync, Z2hAuthMissingError, type ZthAuth } from './auth-store';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/util/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/util/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,KAAK,OAAO,EAAE,MAAM,cAAc,CAAC"}

package/dist/esm/util/auth/index.mjs

@@ -0,0 +1,2 @@
+export { ensureZ2hToken } from '../npm/ensure-token.mjs';
+export { Z2hAuthMissingError, readZthAuth, tryReadAuthTokenSync } from './auth-store.mjs';

package/dist/esm/util/broker/app.d.ts

@@ -30,7 +30,6 @@ export interface RegisterOrUpdateOptions {
     gitRemote: string;
     integrations?: string[];
     handlerNames?: string[];
-    apiUsages?: Record<string, unknown>;
     description?: string;
     /**
      * The base app a preview is for, sent only on first registration — the link

package/dist/esm/util/broker/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../../../src/util/broker/app.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACtC,uGAAuG;IACvG,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAsBvE;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhF;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AA8DD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBtF"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../../../src/util/broker/app.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACtC,uGAAuG;IACvG,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAsBvE;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhF;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAkDD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBtF"}

package/dist/esm/util/broker/app.mjs

@@ -48,7 +48,7 @@ async function claimApp(appName, gitRemote) {
     }
 }
 async function registerApp(params) {
-    const { appName, token, nextVersion: version, entry, visibility, gitRemote, integrations, handlerNames, apiUsages, description, masterAppName, } = params;
+    const { appName, token, nextVersion: version, entry, visibility, gitRemote, integrations, handlerNames, description, masterAppName, } = params;
     const res = await fetch(`${brokerBaseUrl()}/z2h-cli/apps/register`, {
         method: 'POST',
         headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json', ...routingHeaders() },
@@ -60,7 +60,6 @@ async function registerApp(params) {
             gitRemote,
             integrations,
             handlerNames,
-            apiUsages,
             description,
             masterAppName,
         }),
@@ -72,11 +71,11 @@ async function registerApp(params) {
 }
 /** Releases a new version onto an app that already exists. */
 async function updateApp(params) {
-    const { appName, token, nextVersion: version, entry, gitRemote, integrations, handlerNames, apiUsages, description, } = params;
+    const { appName, token, nextVersion: version, entry, gitRemote, integrations, handlerNames, description } = params;
     const res = await fetch(`${brokerBaseUrl()}/z2h-cli/apps/update`, {
         method: 'POST',
         headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json', ...routingHeaders() },
-        body: JSON.stringify({ appName, version, entry, gitRemote, integrations, handlerNames, apiUsages, description }),
+        body: JSON.stringify({ appName, version, entry, gitRemote, integrations, handlerNames, description }),
     });
     if (!res.ok) {
         const text = await res.text();

package/dist/esm/util/usage-json.d.ts

@@ -1,6 +1,6 @@
 export declare function hasHandlers(appDir: string): boolean;
 /** Other features may add top-level fields, so writes merge into the existing file instead of replacing it. */
-export declare function writeUsageJson(appDir: string, patch: Record<string, unknown>): Promise<void>;
+export declare function writeUsageJson(appDir: string, patch: Record<string, unknown>): Promise<Record<string, unknown>>;
 /** Refreshes the git-tracked `usage.json` and commits it if it changed, so a deploy's push carries it. */
-export declare function updateOrCreateUsageJson(appDir: string, appName: string, deployedBy: string): Promise<void>;
+export declare function updateOrCreateUsageJson(appDir: string, appName: string, deployedBy: string): Promise<Record<string, unknown>>;
 //# sourceMappingURL=usage-json.d.ts.map

package/dist/esm/util/usage-json.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"usage-json.d.ts","sourceRoot":"","sources":["../../../src/util/usage-json.ts"],"names":[],"mappings":"AAOA,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,+GAA+G;AAC/G,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAWlG;AAED,0GAA0G;AAC1G,wBAAsB,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhH"}
+{"version":3,"file":"usage-json.d.ts","sourceRoot":"","sources":["../../../src/util/usage-json.ts"],"names":[],"mappings":"AAOA,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,+GAA+G;AAC/G,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAarH;AAED,0GAA0G;AAC1G,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CASlC"}

package/dist/esm/util/usage-json.mjs

@@ -20,17 +20,20 @@ async function writeUsageJson(appDir, patch) {
             throw err;
         }
     }
-    await writeJson(file, { ...existing, ...patch }, { spaces: 2 });
+    const merged = { ...existing, ...patch };
+    await writeJson(file, merged, { spaces: 2 });
+    return merged;
 }
 /** Refreshes the git-tracked `usage.json` and commits it if it changed, so a deploy's push carries it. */
 async function updateOrCreateUsageJson(appDir, appName, deployedBy) {
     const apiUsages = hasHandlers(appDir) ? (await readHandlers(appDir)).apiUsages : {};
-    await writeUsageJson(appDir, { appName, deployedBy, apiUsages });
+    const usage = await writeUsageJson(appDir, { appName, deployedBy, apiUsages });
     await execGit(['add', 'usage.json'], appDir);
     const { exitCode } = await execa('git', ['diff', '--cached', '--quiet'], { cwd: appDir, reject: false });
     if (exitCode !== 0) {
         await execGit(['commit', '-m', 'Update usage.json'], appDir);
     }
+    return usage;
 }
 
 export { hasHandlers, updateOrCreateUsageJson, writeUsageJson };

package/dist/esm/util/usage-upload.d.ts

@@ -0,0 +1,3 @@
+/** Snowpipe ignores re-uploads of an existing key, so the key is unique per app row id and deploy version. */
+export declare function putAppUsage(appName: string, appId: number | null, usage: Record<string, unknown>, uploadVersion: number): Promise<void>;
+//# sourceMappingURL=usage-upload.d.ts.map

package/dist/esm/util/usage-upload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage-upload.d.ts","sourceRoot":"","sources":["../../../src/util/usage-upload.ts"],"names":[],"mappings":"AAKA,8GAA8G;AAC9G,wBAAsB,WAAW,CAC/B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CA0Bf"}

package/dist/esm/util/usage-upload.mjs

@@ -0,0 +1,29 @@
+import { PutObjectCommand } from '@aws-sdk/client-s3';
+import { isProdBroker, brokerBaseUrl } from '../constants.mjs';
+import { warn } from './logger.mjs';
+import { getS3Client } from './s3/client.mjs';
+import { APP_USAGE_BUCKET_NAME, appUsageFolder } from '@mondaydotcomorg/z2h-shared-utils';
+
+/** Snowpipe ignores re-uploads of an existing key, so the key is unique per app row id and deploy version. */
+async function putAppUsage(appName, appId, usage, uploadVersion) {
+    if (!isProdBroker()) {
+        warn(`skipping app usage upload to Snowflake: ${brokerBaseUrl()} is not the production broker, and only production deploys are recorded.`);
+        return;
+    }
+    if (appId === null) {
+        return;
+    }
+    try {
+        await getS3Client().send(new PutObjectCommand({
+            Bucket: APP_USAGE_BUCKET_NAME,
+            Key: `${appUsageFolder(appName, appId)}/${uploadVersion}/usage.json`,
+            Body: JSON.stringify({ ...usage, appName, appId, uploadVersion }),
+            ContentType: 'application/json',
+        }));
+    }
+    catch (err) {
+        warn(`could not record app usage for Snowflake: ${err.message}. Your app is live. To record it, run \`z2h-cli deploy\` again (no changes or commit needed).`);
+    }
+}
+
+export { putAppUsage };

package/dist/util/__tests__/usage-upload.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=usage-upload.test.d.ts.map

package/dist/util/__tests__/usage-upload.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage-upload.test.d.ts","sourceRoot":"","sources":["../../../src/util/__tests__/usage-upload.test.ts"],"names":[],"mappings":""}

package/dist/util/auth/__tests__/index.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.test.d.ts.map

package/dist/util/auth/__tests__/index.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.test.d.ts","sourceRoot":"","sources":["../../../../src/util/auth/__tests__/index.test.ts"],"names":[],"mappings":""}

package/dist/util/auth/broker-credential-provider.d.ts

@@ -1,12 +1,16 @@
 import type { AwsCredentialIdentityProvider } from '@aws-sdk/types';
 export declare const STS_BROKER_PATH = "/z2h-cli/sts/credentials";
 export declare const DEPLOY_VERSION_PATH = "/z2h-cli/apps/version";
+interface VersionResponse {
+    version?: number;
+    id?: number | null;
+}
 /**
  * Reserve the version this deploy will write to. Split out of the STS
  * credentials call so version derivation lives on its own endpoint — the CLI
  * asks for the version first, then requests credentials scoped to it.
  */
-export declare function fetchDeployVersion(appName: string): Promise<number>;
+export declare function fetchDeployVersion(appName: string): Promise<Required<VersionResponse>>;
 /**
  * AWS SDK credential provider that fetches short-lived credentials from the
  * bigbrain-zth STS broker, scoped to `appName` — or, when `previewId` is
@@ -19,4 +23,5 @@ export declare function brokerCredentialProvider({ appName, previewId, }: {
     appName: string;
     previewId?: string;
 }): AwsCredentialIdentityProvider;
+export {};
 //# sourceMappingURL=broker-credential-provider.d.ts.map

package/dist/util/auth/broker-credential-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"broker-credential-provider.d.ts","sourceRoot":"","sources":["../../../src/util/auth/broker-credential-provider.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAyB,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAE3F,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAC1D,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AA0D3D;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMzE;AAwDD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,OAAO,EACP,SAAS,GACV,EAAE;IACD,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,6BAA6B,CAIhC"}
+{"version":3,"file":"broker-credential-provider.d.ts","sourceRoot":"","sources":["../../../src/util/auth/broker-credential-provider.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAyB,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAE3F,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAC1D,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAa3D,UAAU,eAAe;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AA2CD;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAK5F;AAwDD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,OAAO,EACP,SAAS,GACV,EAAE;IACD,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,6BAA6B,CAIhC"}

package/dist/util/auth/broker-credential-provider.js

@@ -51,8 +51,8 @@ async function assertBrokerOk(res, errorLabel) {
 async function fetchDeployVersion(appName) {
     const res = await postToBroker(DEPLOY_VERSION_PATH, { appName });
     await assertBrokerOk(res, 'deploy');
-    const body = (await res.json());
-    return body.version ?? 0;
+    const { version = 0, id = null } = (await res.json());
+    return { version, id };
 }
 async function requestSts(path, body, errorLabel) {
     const res = await postToBroker(path, body);

package/dist/util/auth/index.d.ts

@@ -0,0 +1,3 @@
+export { ensureZ2hToken, type EnsureZ2hTokenOptions } from '../npm/ensure-token';
+export { readZthAuth, tryReadAuthTokenSync, Z2hAuthMissingError, type ZthAuth } from './auth-store';
+//# sourceMappingURL=index.d.ts.map

package/dist/util/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/util/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,KAAK,OAAO,EAAE,MAAM,cAAc,CAAC"}

package/dist/util/auth/index.js

@@ -0,0 +1,11 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+
+const util_npm_ensureToken = require('../npm/ensure-token.js');
+const util_auth_authStore = require('./auth-store.js');
+
+
+
+exports.ensureZ2hToken = util_npm_ensureToken.ensureZ2hToken;
+exports.Z2hAuthMissingError = util_auth_authStore.Z2hAuthMissingError;
+exports.readZthAuth = util_auth_authStore.readZthAuth;
+exports.tryReadAuthTokenSync = util_auth_authStore.tryReadAuthTokenSync;

package/dist/util/broker/app.d.ts

@@ -30,7 +30,6 @@ export interface RegisterOrUpdateOptions {
     gitRemote: string;
     integrations?: string[];
     handlerNames?: string[];
-    apiUsages?: Record<string, unknown>;
     description?: string;
     /**
      * The base app a preview is for, sent only on first registration — the link

package/dist/util/broker/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../../src/util/broker/app.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACtC,uGAAuG;IACvG,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAsBvE;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhF;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AA8DD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBtF"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../../src/util/broker/app.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACtC,uGAAuG;IACvG,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAsBvE;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhF;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAkDD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBtF"}

package/dist/util/broker/app.js

@@ -50,7 +50,7 @@ async function claimApp(appName, gitRemote) {
     }
 }
 async function registerApp(params) {
-    const { appName, token, nextVersion: version, entry, visibility, gitRemote, integrations, handlerNames, apiUsages, description, masterAppName, } = params;
+    const { appName, token, nextVersion: version, entry, visibility, gitRemote, integrations, handlerNames, description, masterAppName, } = params;
     const res = await fetch(`${constants.brokerBaseUrl()}/z2h-cli/apps/register`, {
         method: 'POST',
         headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json', ...constants.routingHeaders() },
@@ -62,7 +62,6 @@ async function registerApp(params) {
             gitRemote,
             integrations,
             handlerNames,
-            apiUsages,
             description,
             masterAppName,
         }),
@@ -74,11 +73,11 @@ async function registerApp(params) {
 }
 /** Releases a new version onto an app that already exists. */
 async function updateApp(params) {
-    const { appName, token, nextVersion: version, entry, gitRemote, integrations, handlerNames, apiUsages, description, } = params;
+    const { appName, token, nextVersion: version, entry, gitRemote, integrations, handlerNames, description } = params;
     const res = await fetch(`${constants.brokerBaseUrl()}/z2h-cli/apps/update`, {
         method: 'POST',
         headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json', ...constants.routingHeaders() },
-        body: JSON.stringify({ appName, version, entry, gitRemote, integrations, handlerNames, apiUsages, description }),
+        body: JSON.stringify({ appName, version, entry, gitRemote, integrations, handlerNames, description }),
     });
     if (!res.ok) {
         const text = await res.text();