@runalabs/rill-cli 0.1.11 → 0.1.12

package/README.md

@@ -288,3 +288,7 @@ Progress runs through `uploading` → `queued` → `encoding` → `processing`
 Run `rill connect --email you@example.com` to authorize account access or keep your anonymous recordings. Open the displayed link, sign in, and enter the code yourself. Approval allows creation and reading of your existing and new recordings for 90 days, with automatic renewal of one-hour access tokens. Revoke the connection in Rill's Credentials page to stop access and renewal. Deletion and changes to existing sharing settings are not included.
 
 Use `rill record list` to list accessible recordings and `rill inspect <recording-id>` for private recording details. `rill inspect <share-url>` continues to work without account access. The existing `rill login` and `RILL_TOKEN` flows remain supported. Local credential storage requires macOS Keychain or Linux Secret Service.
+
+### Check the connected account
+
+Run `rill whoami` (or `rill --pretty whoami`) to verify your current identity. JSON output includes status, account email when available, workspace, scopes, and access expiry. It uses RILL_TOKEN when set, otherwise the saved OS credential. Existing access can renew automatically; it never creates an identity or opens an approval flow. Missing credentials return `not_connected` and exit 1. Invalid or revoked credentials return an error.

package/dist/cli.js

@@ -5,9 +5,389 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/agent-session.ts
+import { hostname, homedir } from "os";
+import { mkdir, rm, stat } from "fs/promises";
+import { join } from "path";
+import { createHash, randomBytes } from "crypto";
+var JWT_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+var CLAIM_GRANT = "urn:workos:agent-auth:grant-type:claim";
+var AgentAuthError = class extends Error {
+  constructor(code, message) {
+    super(`${code}: ${message}`);
+    this.code = code;
+  }
+};
+function parseAuthorization(value) {
+  if (!value?.startsWith("{")) return null;
+  const saved = JSON.parse(value);
+  if (saved.version !== 1 || typeof saved.anonymous !== "boolean") throw new Error("Saved Rill authorization is invalid. Run rill connect --email <your-email>.");
+  return saved;
+}
+async function request(apiUrl, path, body, form = false) {
+  const url2 = new URL(apiUrl);
+  if (url2.protocol !== "https:" && !["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname)) throw new Error("Agent authentication requires HTTPS.");
+  const response = await fetch(`${apiUrl}${path}`, {
+    method: "POST",
+    redirect: "error",
+    signal: AbortSignal.timeout(15e3),
+    headers: { "Content-Type": form ? "application/x-www-form-urlencoded" : "application/json" },
+    body: form ? new URLSearchParams(Object.entries(body).map(([key, value2]) => [key, String(value2)])) : JSON.stringify(body)
+  });
+  const value = await response.json();
+  if (!response.ok) throw new AgentAuthError(value.error ?? "authentication_failed", value.error_description ?? "Could not authorize Rill.");
+  return value;
+}
+function withTokens(saved, tokens) {
+  return {
+    ...saved,
+    accessToken: tokens.access_token,
+    accessExpiresAt: Date.now() + tokens.expires_in * 1e3,
+    ...tokens.identity_assertion ? { identityAssertion: tokens.identity_assertion, assertionExpires: tokens.assertion_expires } : {}
+  };
+}
+var save = (apiUrl, value) => saveCredential(apiUrl, JSON.stringify(value));
+var pending = /* @__PURE__ */ new Map();
+async function loadAgentCredential(apiUrl) {
+  if (process.env.RILL_TOKEN) return process.env.RILL_TOKEN;
+  const inFlight = pending.get(apiUrl);
+  if (inFlight) return inFlight;
+  const promise2 = (async () => {
+    const raw = await loadStoredCredential(apiUrl);
+    const saved = parseAuthorization(raw);
+    if (!saved) return raw;
+    if (saved.accessToken && (saved.accessExpiresAt ?? 0) > Date.now() + 6e4) return saved.accessToken;
+    if (!saved.identityAssertion && saved.anonymous && saved.registrationToken) return null;
+    if (!saved.identityAssertion) throw new Error("Connection is awaiting approval. Run rill connect --email <your-email>.");
+    const tokens = await request(apiUrl, "/oauth2/token", { grant_type: JWT_GRANT, assertion: saved.identityAssertion }, true);
+    await save(apiUrl, withTokens(saved, tokens));
+    return tokens.access_token;
+  })();
+  pending.set(apiUrl, promise2);
+  try {
+    return await promise2;
+  } finally {
+    pending.delete(apiUrl);
+  }
+}
+async function ensureAnonymousCredential(apiUrl) {
+  const root = join(homedir(), ".rill", "auth-locks");
+  await mkdir(root, { recursive: true, mode: 448 });
+  const lock = join(root, createHash("sha256").update(apiUrl).digest("hex"));
+  const deadline = Date.now() + 3e4;
+  while (true) {
+    try {
+      await mkdir(lock, { mode: 448 });
+      break;
+    } catch (error51) {
+      if (error51.code !== "EEXIST") throw error51;
+      const info = await stat(lock).catch(() => null);
+      if (info && Date.now() - info.mtimeMs > 12e4) {
+        await rm(lock, { recursive: true, force: true });
+        continue;
+      }
+      if (Date.now() > deadline) throw new Error("Another Rill process is setting up authorization. Retry shortly.");
+      await new Promise((resolve) => setTimeout(resolve, 200));
+    }
+  }
+  try {
+    return await createAnonymousCredential(apiUrl);
+  } finally {
+    await rm(lock, { recursive: true, force: true });
+  }
+}
+async function createAnonymousCredential(apiUrl) {
+  const existing = await loadAgentCredential(apiUrl);
+  if (existing) return existing;
+  const stored = parseAuthorization(await loadStoredCredential(apiUrl));
+  const initial = stored?.registrationToken ? stored : { version: 1, anonymous: true, registrationToken: randomBytes(32).toString("hex") };
+  await save(apiUrl, initial);
+  const registered = await request(apiUrl, "/agent/identity", { type: "anonymous", analytics_enabled: process.env.RILL_ANONYMOUS_ANALYTICS !== "0" && process.env.DO_NOT_TRACK !== "1", registration_token: initial.registrationToken, name: `${hostname()} \xB7 ${process.platform}` });
+  const saved = { ...initial, registrationToken: void 0, identityAssertion: registered.identity_assertion, assertionExpires: registered.assertion_expires, claimToken: registered.claim_token };
+  await save(apiUrl, saved);
+  process.stderr.write("Recording anonymously: three recordings, up to five minutes each. Recordings and share links expire after seven days. Run rill connect --email <your-email> to keep them.\n");
+  return await loadAgentCredential(apiUrl);
+}
+async function connectAgent(apiUrl, email3) {
+  if (process.env.RILL_TOKEN) throw new Error("Unset RILL_TOKEN before connecting a local identity.");
+  let saved = parseAuthorization(await loadStoredCredential(apiUrl));
+  let claim;
+  if (saved?.claimToken && saved.anonymous) {
+    try {
+      const result = await request(apiUrl, "/agent/identity/claim", { claim_token: saved.claimToken, email: email3 });
+      claim = result.claim_attempt;
+    } catch (error51) {
+      if (!(error51 instanceof AgentAuthError) || error51.code !== "claim_expired") throw error51;
+    }
+  }
+  if (!claim) {
+    await save(apiUrl, saved ?? { version: 1, anonymous: true });
+    const result = await request(apiUrl, "/agent/identity", { type: "service_auth", login_hint: email3, name: `${hostname()} \xB7 ${process.platform}` });
+    saved = { version: 1, anonymous: true, claimToken: result.claim_token };
+    await save(apiUrl, saved);
+    claim = result.claim;
+  }
+  process.stderr.write(`Open ${claim.verification_uri}
+Sign in as ${email3} and enter ${claim.user_code}. Approve only the request you started.
+`);
+  const deadline = Date.now() + claim.expires_in * 1e3;
+  let interval = claim.interval;
+  while (Date.now() < deadline) {
+    await new Promise((resolve) => setTimeout(resolve, interval * 1e3));
+    try {
+      const tokens = await request(apiUrl, "/oauth2/token", { grant_type: CLAIM_GRANT, claim_token: saved.claimToken }, true);
+      const connected = withTokens({ version: 1, anonymous: false }, tokens);
+      await save(apiUrl, connected);
+      return { status: "authenticated", expiresAt: connected.assertionExpires, apiUrl };
+    } catch (error51) {
+      if (error51 instanceof AgentAuthError && error51.code === "expired_token") throw new AgentAuthError("expired_token", "The approval attempt expired. Run rill connect again to request a fresh code using the same saved claim token.");
+      if (error51 instanceof AgentAuthError && error51.code === "authorization_pending") continue;
+      if (error51 instanceof AgentAuthError && error51.code === "slow_down") {
+        interval += 5;
+        continue;
+      }
+      throw error51;
+    }
+  }
+  throw new AgentAuthError("expired_token", "Connection request expired. Run rill connect again to restart the approval attempt using the same saved claim token.");
+}
+
+// src/keychain.ts
+import { spawn } from "child_process";
+var service = "rill";
+async function saveCredential(apiUrl, token) {
+  if (process.platform === "darwin") {
+    await run("security", ["add-generic-password", "-U", "-a", apiUrl, "-s", service, "-w", token]);
+    return;
+  }
+  if (process.platform === "linux") {
+    await run("secret-tool", ["store", "--label=Rill agent credential", "service", service, "api-url", apiUrl], token);
+    return;
+  }
+  throw new Error("OS keychain storage is not supported on this platform yet. Use RILL_TOKEN.");
+}
+function loadCredential(apiUrl) {
+  return loadAgentCredential(apiUrl);
+}
+async function loadStoredCredential(apiUrl) {
+  try {
+    if (process.platform === "darwin") return (await run("security", ["find-generic-password", "-a", apiUrl, "-s", service, "-w"])).trim() || null;
+    if (process.platform === "linux") return (await run("secret-tool", ["lookup", "service", service, "api-url", apiUrl])).trim() || null;
+  } catch (error51) {
+    const code = error51.exitCode;
+    if (process.platform === "darwin" && code === 44) return null;
+    if (process.platform === "linux" && code === 1 && !error51.message.trim()) return null;
+    throw new Error("Cannot read the OS credential store. Unlock your keychain or enable Secret Service; your identity has not been replaced.");
+  }
+  throw new Error("Local authorization requires macOS Keychain or Linux Secret Service.");
+}
+function run(command, args, input) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, { stdio: ["pipe", "pipe", "pipe"] });
+    const stdout = [];
+    const stderr = [];
+    child.stdout.on("data", (chunk) => stdout.push(Buffer.from(chunk)));
+    child.stderr.on("data", (chunk) => stderr.push(Buffer.from(chunk)));
+    child.once("error", reject);
+    child.once("exit", (code) => code === 0 ? resolve(Buffer.concat(stdout).toString("utf8")) : reject(Object.assign(new Error(Buffer.concat(stderr).toString("utf8").trim()), { exitCode: code })));
+    if (input) child.stdin.end(input);
+    else child.stdin.end();
+  });
+}
+
+// src/control-plane.ts
+import { createReadStream } from "fs";
+import { readFile, stat as stat2 } from "fs/promises";
+import { Upload } from "tus-js-client";
+var ControlPlaneError = class extends Error {
+  constructor(code, message, recovery, details, httpStatus) {
+    super(`${code}: ${message}${recovery ? `: ${recovery}` : ""}`);
+    this.code = code;
+    this.recovery = recovery;
+    this.details = details;
+    this.httpStatus = httpStatus;
+    this.name = "ControlPlaneError";
+  }
+};
+var ControlPlaneHttpError = class extends Error {
+  constructor(httpStatus) {
+    super(`Request failed (${httpStatus}).`);
+    this.httpStatus = httpStatus;
+    this.name = "ControlPlaneHttpError";
+  }
+};
+var ControlPlaneClient = class {
+  constructor(apiUrl, token) {
+    this.apiUrl = apiUrl;
+    this.token = token;
+  }
+  encodingCapabilities() {
+    return this.request("/api/encoding/capabilities");
+  }
+  beginEncoding(id, manifest) {
+    return this.request(`/api/encoding/${encodeURIComponent(id)}`, { method: "POST", body: JSON.stringify(manifest) });
+  }
+  encodingStatus(id) {
+    return this.request(`/api/encoding/${encodeURIComponent(id)}`);
+  }
+  uploadEncodingPart(id, part, bytes) {
+    return this.request(`/api/encoding/${encodeURIComponent(id)}/parts/${part}`, { method: "PUT", headers: { "Content-Type": "application/octet-stream", "Content-Length": String(bytes.length) }, body: new Uint8Array(bytes), signal: AbortSignal.timeout(12e4) });
+  }
+  completeEncoding(id) {
+    return this.request(`/api/encoding/${encodeURIComponent(id)}/complete`, { method: "POST" });
+  }
+  retryEncoding(id) {
+    return this.request(`/api/encoding/${encodeURIComponent(id)}/retry`, { method: "POST" });
+  }
+  createCloudRun(input) {
+    return this.request("/api/cloud/runs", { method: "POST", body: JSON.stringify(input) });
+  }
+  cloudRun(id) {
+    return this.request(`/api/cloud/runs/${encodeURIComponent(id)}`);
+  }
+  cancelCloudRun(id) {
+    return this.request(`/api/cloud/runs/${encodeURIComponent(id)}/cancel`, { method: "POST" });
+  }
+  health() {
+    return this.request("/api/health", {}, false);
+  }
+  agentSession() {
+    return this.request("/api/agent/session", { signal: AbortSignal.timeout(5e3) });
+  }
+  reportCliCommand(input) {
+    return this.request("/api/analytics/cli-command", { method: "POST", body: JSON.stringify(input) });
+  }
+  createRecording(input) {
+    return this.request("/api/recordings", { method: "POST", body: JSON.stringify(input) });
+  }
+  markRecordingStarted(recordingId, input) {
+    return this.request(`/api/recordings/${recordingId}/local-started`, {
+      method: "POST",
+      body: JSON.stringify(input)
+    });
+  }
+  markRecordingStopped(recordingId, input) {
+    return this.request(`/api/recordings/${recordingId}/local-stopped`, {
+      method: "POST",
+      body: JSON.stringify(input)
+    });
+  }
+  submitRecordingFeedback(recordingId, input) {
+    return this.request(recordingId ? `/api/recordings/${recordingId}/feedback` : "/api/feedback", {
+      method: "POST",
+      body: JSON.stringify(input)
+    });
+  }
+  provisionVideo(recordingId, input) {
+    return this.request(`/api/recordings/${recordingId}/video-upload`, { method: "POST", body: JSON.stringify(input) });
+  }
+  recordingStatus(recordingId) {
+    return this.request(`/api/recordings/${recordingId}`);
+  }
+  cancelRecording(recordingId, reason = "cancelled_by_agent") {
+    return this.request(`/api/recordings/${recordingId}/cancel`, {
+      method: "POST",
+      body: JSON.stringify({ reason })
+    });
+  }
+  async waitUntilPlayable(recordingId, timeoutMs = 10 * 6e4) {
+    const deadline = Date.now() + timeoutMs;
+    let intervalMs = 1e3;
+    while (Date.now() < deadline) {
+      const recording = await this.recordingStatus(recordingId);
+      if (recording.status === "ready" && recording.shareUrl) {
+        return { ...recording, shareUrl: new URL(recording.shareUrl, this.apiUrl).toString() };
+      }
+      if (recording.status === "failed") throw new Error(`processing_failed: ${recording.failure_message ?? "Cloudflare Stream could not process the recording."}`);
+      process.stderr.write(`\rprocessing ${recording.status.padEnd(12)}`);
+      await new Promise((resolve) => setTimeout(resolve, intervalMs));
+      intervalMs = Math.min(5e3, Math.round(intervalMs * 1.4));
+    }
+    throw new Error("processing_failed: Timed out waiting for the recording to become playable. Run `rill record status <recording-id>` to continue checking.");
+  }
+  async uploadVideo(uploadUrl, filePath) {
+    const file2 = await stat2(filePath);
+    if (uploadUrl.startsWith(this.apiUrl)) {
+      const response = await fetch(uploadUrl, { method: "PUT", headers: { "Content-Length": String(file2.size) }, body: createReadStream(filePath), duplex: "half" });
+      if (!response.ok) throw new Error(`Video upload failed (${response.status}).`);
+      return;
+    }
+    await new Promise((resolve, reject) => {
+      const upload = new Upload(createReadStream(filePath), {
+        uploadUrl,
+        uploadSize: file2.size,
+        retryDelays: [0, 1e3, 3e3, 5e3, 1e4],
+        removeFingerprintOnSuccess: true,
+        onError: reject,
+        onSuccess: () => resolve(),
+        onProgress: (sent, total) => process.stderr.write(`\ruploading ${Math.round(sent / total * 100)}%`)
+      });
+      upload.start();
+    });
+    process.stderr.write("\n");
+  }
+  async uploadDiagnostics(recordingId, filePath, summary) {
+    const body = await readFile(filePath);
+    return this.request(`/api/recordings/${recordingId}/diagnostics`, { method: "PUT", headers: { "Content-Encoding": "gzip", "Content-Type": "application/x-ndjson", "Content-Length": String(body.length), "X-Rill-Summary": JSON.stringify(summary) }, body });
+  }
+  listRecordings() {
+    return this.request("/api/recordings");
+  }
+  createDeviceAuthorization(input) {
+    return this.request("/api/device/authorizations", { method: "POST", body: JSON.stringify(input) }, false);
+  }
+  pollDeviceAuthorization(deviceCode) {
+    return this.request("/api/device/token", { method: "POST", body: JSON.stringify({ deviceCode }) }, false);
+  }
+  inspect(shareUrl) {
+    if (/^rec_[a-zA-Z0-9_-]+$/.test(shareUrl)) return this.request(`/api/recordings/${encodeURIComponent(shareUrl)}`);
+    const url2 = new URL(shareUrl);
+    const slug = url2.pathname.split("/").filter(Boolean).at(-1);
+    if (!slug) throw new Error("The share URL does not contain a slug.");
+    return fetch(`${url2.origin}/api/public/shares/${encodeURIComponent(slug)}/context`, { headers: { Accept: "application/json" } }).then(async (response) => {
+      if (!response.ok) throw new Error(`Could not inspect the share link (${response.status}).`);
+      return response.json();
+    });
+  }
+  async request(path, init = {}, authenticated = true) {
+    const headers = new Headers(init.headers);
+    if (init.body && !headers.has("Content-Type")) headers.set("Content-Type", "application/json");
+    if (authenticated) {
+      const token = typeof this.token === "function" ? await this.token() : this.token;
+      if (!token) throw new Error("authentication_required: Run `rill login` or set RILL_TOKEN.");
+      headers.set("Authorization", `Bearer ${token}`);
+    }
+    const response = await fetch(`${this.apiUrl}${path}`, { ...init, headers });
+    const value = await response.json().catch(() => null);
+    if (!response.ok && value?.error?.code && value.error.message) {
+      throw new ControlPlaneError(value.error.code, value.error.message, value.error.recovery, value.error.details, response.status);
+    }
+    if (!response.ok) throw new ControlPlaneHttpError(response.status);
+    return value;
+  }
+};
+
+// src/whoami.ts
+async function whoami(apiUrl) {
+  const token = await loadCredential(apiUrl);
+  if (!token) return { schemaVersion: 1, status: "not_connected", authenticated: false, apiUrl };
+  const session = await new ControlPlaneClient(apiUrl, token).agentSession();
+  return {
+    schemaVersion: 1,
+    status: session.anonymous ? "anonymous" : "connected",
+    authenticated: true,
+    apiUrl,
+    anonymous: Boolean(session.anonymous),
+    email: session.email ?? null,
+    workspaceId: session.workspaceId ?? null,
+    scopes: session.scopes,
+    expiresAt: session.expiresAt
+  };
+}
+
 // src/remote-encoding.ts
 import { open, readFile as readFile2 } from "fs/promises";
-import { join } from "path";
+import { join as join2 } from "path";
 
 // ../../node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -142,7 +522,7 @@ __export(external_exports, {
   guid: () => guid2,
   hash: () => hash,
   hex: () => hex2,
-  hostname: () => hostname2,
+  hostname: () => hostname3,
   httpUrl: () => httpUrl,
   includes: () => _includes,
   instanceof: () => _instanceof,
@@ -1553,7 +1933,7 @@ __export(regexes_exports, {
   extendedDuration: () => extendedDuration,
   guid: () => guid,
   hex: () => hex,
-  hostname: () => hostname,
+  hostname: () => hostname2,
   html5Email: () => html5Email,
   httpProtocol: () => httpProtocol,
   idnEmail: () => idnEmail,
@@ -1631,7 +2011,7 @@ var cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]
 var cidrv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/;
 var base64 = /^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/;
 var base64url = /^[A-Za-z0-9_-]*$/;
-var hostname = /^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/;
+var hostname2 = /^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/;
 var domain = /^([a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/;
 var httpProtocol = /^https?$/;
 var e164 = /^\+[1-9]\d{6,14}$/;
@@ -12503,7 +12883,7 @@ __export(schemas_exports2, {
   guid: () => guid2,
   hash: () => hash,
   hex: () => hex2,
-  hostname: () => hostname2,
+  hostname: () => hostname3,
   httpUrl: () => httpUrl,
   instanceof: () => _instanceof,
   int: () => int,
@@ -13123,7 +13503,7 @@ var ZodCustomStringFormat = /* @__PURE__ */ $constructor("ZodCustomStringFormat"
 function stringFormat(format, fnOrRegex, _params = {}) {
   return _stringFormat(ZodCustomStringFormat, format, fnOrRegex, _params);
 }
-function hostname2(_params) {
+function hostname3(_params) {
   return _stringFormat(ZodCustomStringFormat, "hostname", regexes_exports.hostname, _params);
 }
 function hex2(_params) {
@@ -14471,244 +14851,72 @@ function convertSchema(schema, ctx) {
     baseSchema = baseSchema.describe(schema.description);
   }
   return baseSchema;
-}
-function fromJSONSchema(schema, params) {
-  if (typeof schema === "boolean") {
-    return schema ? z.any() : z.never();
-  }
-  let normalized;
-  try {
-    normalized = JSON.parse(JSON.stringify(schema));
-  } catch {
-    throw new Error("fromJSONSchema input is not valid JSON (possibly cyclic); use $defs/$ref for recursive schemas");
-  }
-  const version2 = detectVersion(normalized, params?.defaultTarget);
-  const defs = normalized.$defs || normalized.definitions || {};
-  const ctx = {
-    version: version2,
-    defs,
-    refs: /* @__PURE__ */ new Map(),
-    processing: /* @__PURE__ */ new Set(),
-    rootSchema: normalized,
-    registry: params?.registry ?? globalRegistry
-  };
-  return convertSchema(normalized, ctx);
-}
-
-// ../../node_modules/zod/v4/classic/coerce.js
-var coerce_exports = {};
-__export(coerce_exports, {
-  bigint: () => bigint3,
-  boolean: () => boolean3,
-  date: () => date4,
-  number: () => number3,
-  string: () => string3
-});
-function string3(params) {
-  return _coercedString(ZodString, params);
-}
-function number3(params) {
-  return _coercedNumber(ZodNumber, params);
-}
-function boolean3(params) {
-  return _coercedBoolean(ZodBoolean, params);
-}
-function bigint3(params) {
-  return _coercedBigint(ZodBigInt, params);
-}
-function date4(params) {
-  return _coercedDate(ZodDate, params);
-}
-
-// ../../node_modules/zod/v4/classic/external.js
-config(en_default());
-
-// ../contracts/src/encoding.ts
-var ENCODING_PART_BYTES = 4 * 1024 * 1024;
-var ENCODING_MAX_BYTES = 1024 * 1024 * 1024;
-var frameManifestSchema = external_exports.object({
-  version: external_exports.literal(1),
-  durationSeconds: external_exports.number().positive().max(600),
-  width: external_exports.number().int().min(320).max(3840),
-  height: external_exports.number().int().min(240).max(2160),
-  frames: external_exports.array(external_exports.object({ timestamp: external_exports.number().nonnegative().finite(), size: external_exports.number().int().positive().max(ENCODING_PART_BYTES) }).strict()).min(1).max(36e3)
-}).strict().superRefine((m, ctx) => {
-  if (m.frames.reduce((n, f) => n + f.size, 0) > ENCODING_MAX_BYTES) ctx.addIssue({ code: "custom", message: "Frame upload exceeds the trial byte limit." });
-  for (let i = 1; i < m.frames.length; i++) if (m.frames[i].timestamp < m.frames[i - 1].timestamp) ctx.addIssue({ code: "custom", message: "Frame timestamps must be ordered." });
-  if (m.frames.at(-1).timestamp - m.frames[0].timestamp > m.durationSeconds + 1) ctx.addIssue({ code: "custom", message: "Frame timestamps exceed capture duration." });
-});
-
-// src/control-plane.ts
-import { createReadStream } from "fs";
-import { readFile, stat } from "fs/promises";
-import { Upload } from "tus-js-client";
-var ControlPlaneError = class extends Error {
-  constructor(code, message, recovery, details, httpStatus) {
-    super(`${code}: ${message}${recovery ? `: ${recovery}` : ""}`);
-    this.code = code;
-    this.recovery = recovery;
-    this.details = details;
-    this.httpStatus = httpStatus;
-    this.name = "ControlPlaneError";
-  }
-};
-var ControlPlaneHttpError = class extends Error {
-  constructor(httpStatus) {
-    super(`Request failed (${httpStatus}).`);
-    this.httpStatus = httpStatus;
-    this.name = "ControlPlaneHttpError";
-  }
-};
-var ControlPlaneClient = class {
-  constructor(apiUrl, token) {
-    this.apiUrl = apiUrl;
-    this.token = token;
-  }
-  encodingCapabilities() {
-    return this.request("/api/encoding/capabilities");
-  }
-  beginEncoding(id, manifest) {
-    return this.request(`/api/encoding/${encodeURIComponent(id)}`, { method: "POST", body: JSON.stringify(manifest) });
-  }
-  encodingStatus(id) {
-    return this.request(`/api/encoding/${encodeURIComponent(id)}`);
-  }
-  uploadEncodingPart(id, part, bytes) {
-    return this.request(`/api/encoding/${encodeURIComponent(id)}/parts/${part}`, { method: "PUT", headers: { "Content-Type": "application/octet-stream", "Content-Length": String(bytes.length) }, body: new Uint8Array(bytes), signal: AbortSignal.timeout(12e4) });
-  }
-  completeEncoding(id) {
-    return this.request(`/api/encoding/${encodeURIComponent(id)}/complete`, { method: "POST" });
-  }
-  retryEncoding(id) {
-    return this.request(`/api/encoding/${encodeURIComponent(id)}/retry`, { method: "POST" });
-  }
-  createCloudRun(input) {
-    return this.request("/api/cloud/runs", { method: "POST", body: JSON.stringify(input) });
-  }
-  cloudRun(id) {
-    return this.request(`/api/cloud/runs/${encodeURIComponent(id)}`);
-  }
-  cancelCloudRun(id) {
-    return this.request(`/api/cloud/runs/${encodeURIComponent(id)}/cancel`, { method: "POST" });
-  }
-  health() {
-    return this.request("/api/health", {}, false);
-  }
-  agentSession() {
-    return this.request("/api/agent/session", { signal: AbortSignal.timeout(5e3) });
-  }
-  reportCliCommand(input) {
-    return this.request("/api/analytics/cli-command", { method: "POST", body: JSON.stringify(input) });
-  }
-  createRecording(input) {
-    return this.request("/api/recordings", { method: "POST", body: JSON.stringify(input) });
-  }
-  markRecordingStarted(recordingId, input) {
-    return this.request(`/api/recordings/${recordingId}/local-started`, {
-      method: "POST",
-      body: JSON.stringify(input)
-    });
-  }
-  markRecordingStopped(recordingId, input) {
-    return this.request(`/api/recordings/${recordingId}/local-stopped`, {
-      method: "POST",
-      body: JSON.stringify(input)
-    });
-  }
-  submitRecordingFeedback(recordingId, input) {
-    return this.request(recordingId ? `/api/recordings/${recordingId}/feedback` : "/api/feedback", {
-      method: "POST",
-      body: JSON.stringify(input)
-    });
-  }
-  provisionVideo(recordingId, input) {
-    return this.request(`/api/recordings/${recordingId}/video-upload`, { method: "POST", body: JSON.stringify(input) });
-  }
-  recordingStatus(recordingId) {
-    return this.request(`/api/recordings/${recordingId}`);
-  }
-  cancelRecording(recordingId, reason = "cancelled_by_agent") {
-    return this.request(`/api/recordings/${recordingId}/cancel`, {
-      method: "POST",
-      body: JSON.stringify({ reason })
-    });
-  }
-  async waitUntilPlayable(recordingId, timeoutMs = 10 * 6e4) {
-    const deadline = Date.now() + timeoutMs;
-    let intervalMs = 1e3;
-    while (Date.now() < deadline) {
-      const recording = await this.recordingStatus(recordingId);
-      if (recording.status === "ready" && recording.shareUrl) {
-        return { ...recording, shareUrl: new URL(recording.shareUrl, this.apiUrl).toString() };
-      }
-      if (recording.status === "failed") throw new Error(`processing_failed: ${recording.failure_message ?? "Cloudflare Stream could not process the recording."}`);
-      process.stderr.write(`\rprocessing ${recording.status.padEnd(12)}`);
-      await new Promise((resolve) => setTimeout(resolve, intervalMs));
-      intervalMs = Math.min(5e3, Math.round(intervalMs * 1.4));
-    }
-    throw new Error("processing_failed: Timed out waiting for the recording to become playable. Run `rill record status <recording-id>` to continue checking.");
-  }
-  async uploadVideo(uploadUrl, filePath) {
-    const file2 = await stat(filePath);
-    if (uploadUrl.startsWith(this.apiUrl)) {
-      const response = await fetch(uploadUrl, { method: "PUT", headers: { "Content-Length": String(file2.size) }, body: createReadStream(filePath), duplex: "half" });
-      if (!response.ok) throw new Error(`Video upload failed (${response.status}).`);
-      return;
-    }
-    await new Promise((resolve, reject) => {
-      const upload = new Upload(createReadStream(filePath), {
-        uploadUrl,
-        uploadSize: file2.size,
-        retryDelays: [0, 1e3, 3e3, 5e3, 1e4],
-        removeFingerprintOnSuccess: true,
-        onError: reject,
-        onSuccess: () => resolve(),
-        onProgress: (sent, total) => process.stderr.write(`\ruploading ${Math.round(sent / total * 100)}%`)
-      });
-      upload.start();
-    });
-    process.stderr.write("\n");
-  }
-  async uploadDiagnostics(recordingId, filePath, summary) {
-    const body = await readFile(filePath);
-    return this.request(`/api/recordings/${recordingId}/diagnostics`, { method: "PUT", headers: { "Content-Encoding": "gzip", "Content-Type": "application/x-ndjson", "Content-Length": String(body.length), "X-Rill-Summary": JSON.stringify(summary) }, body });
-  }
-  listRecordings() {
-    return this.request("/api/recordings");
-  }
-  createDeviceAuthorization(input) {
-    return this.request("/api/device/authorizations", { method: "POST", body: JSON.stringify(input) }, false);
-  }
-  pollDeviceAuthorization(deviceCode) {
-    return this.request("/api/device/token", { method: "POST", body: JSON.stringify({ deviceCode }) }, false);
-  }
-  inspect(shareUrl) {
-    if (/^rec_[a-zA-Z0-9_-]+$/.test(shareUrl)) return this.request(`/api/recordings/${encodeURIComponent(shareUrl)}`);
-    const url2 = new URL(shareUrl);
-    const slug = url2.pathname.split("/").filter(Boolean).at(-1);
-    if (!slug) throw new Error("The share URL does not contain a slug.");
-    return fetch(`${url2.origin}/api/public/shares/${encodeURIComponent(slug)}/context`, { headers: { Accept: "application/json" } }).then(async (response) => {
-      if (!response.ok) throw new Error(`Could not inspect the share link (${response.status}).`);
-      return response.json();
-    });
-  }
-  async request(path, init = {}, authenticated = true) {
-    const headers = new Headers(init.headers);
-    if (init.body && !headers.has("Content-Type")) headers.set("Content-Type", "application/json");
-    if (authenticated) {
-      const token = typeof this.token === "function" ? await this.token() : this.token;
-      if (!token) throw new Error("authentication_required: Run `rill login` or set RILL_TOKEN.");
-      headers.set("Authorization", `Bearer ${token}`);
-    }
-    const response = await fetch(`${this.apiUrl}${path}`, { ...init, headers });
-    const value = await response.json().catch(() => null);
-    if (!response.ok && value?.error?.code && value.error.message) {
-      throw new ControlPlaneError(value.error.code, value.error.message, value.error.recovery, value.error.details, response.status);
-    }
-    if (!response.ok) throw new ControlPlaneHttpError(response.status);
-    return value;
+}
+function fromJSONSchema(schema, params) {
+  if (typeof schema === "boolean") {
+    return schema ? z.any() : z.never();
   }
-};
+  let normalized;
+  try {
+    normalized = JSON.parse(JSON.stringify(schema));
+  } catch {
+    throw new Error("fromJSONSchema input is not valid JSON (possibly cyclic); use $defs/$ref for recursive schemas");
+  }
+  const version2 = detectVersion(normalized, params?.defaultTarget);
+  const defs = normalized.$defs || normalized.definitions || {};
+  const ctx = {
+    version: version2,
+    defs,
+    refs: /* @__PURE__ */ new Map(),
+    processing: /* @__PURE__ */ new Set(),
+    rootSchema: normalized,
+    registry: params?.registry ?? globalRegistry
+  };
+  return convertSchema(normalized, ctx);
+}
+
+// ../../node_modules/zod/v4/classic/coerce.js
+var coerce_exports = {};
+__export(coerce_exports, {
+  bigint: () => bigint3,
+  boolean: () => boolean3,
+  date: () => date4,
+  number: () => number3,
+  string: () => string3
+});
+function string3(params) {
+  return _coercedString(ZodString, params);
+}
+function number3(params) {
+  return _coercedNumber(ZodNumber, params);
+}
+function boolean3(params) {
+  return _coercedBoolean(ZodBoolean, params);
+}
+function bigint3(params) {
+  return _coercedBigint(ZodBigInt, params);
+}
+function date4(params) {
+  return _coercedDate(ZodDate, params);
+}
+
+// ../../node_modules/zod/v4/classic/external.js
+config(en_default());
+
+// ../contracts/src/encoding.ts
+var ENCODING_PART_BYTES = 4 * 1024 * 1024;
+var ENCODING_MAX_BYTES = 1024 * 1024 * 1024;
+var frameManifestSchema = external_exports.object({
+  version: external_exports.literal(1),
+  durationSeconds: external_exports.number().positive().max(600),
+  width: external_exports.number().int().min(320).max(3840),
+  height: external_exports.number().int().min(240).max(2160),
+  frames: external_exports.array(external_exports.object({ timestamp: external_exports.number().nonnegative().finite(), size: external_exports.number().int().positive().max(ENCODING_PART_BYTES) }).strict()).min(1).max(36e3)
+}).strict().superRefine((m, ctx) => {
+  if (m.frames.reduce((n, f) => n + f.size, 0) > ENCODING_MAX_BYTES) ctx.addIssue({ code: "custom", message: "Frame upload exceeds the trial byte limit." });
+  for (let i = 1; i < m.frames.length; i++) if (m.frames[i].timestamp < m.frames[i - 1].timestamp) ctx.addIssue({ code: "custom", message: "Frame timestamps must be ordered." });
+  if (m.frames.at(-1).timestamp - m.frames[0].timestamp > m.durationSeconds + 1) ctx.addIssue({ code: "custom", message: "Frame timestamps exceed capture duration." });
+});
 
 // src/remote-encoding.ts
 async function withFrameUploadRetry(upload, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))) {
@@ -14728,14 +14936,14 @@ Frame upload interrupted; retrying in ${delay / 1e3}s.
   }
 }
 async function submitFrameCapture(client, id, directory) {
-  const manifest = frameManifestSchema.parse(JSON.parse(await readFile2(join(directory, "capture-manifest.json"), "utf8")));
+  const manifest = frameManifestSchema.parse(JSON.parse(await readFile2(join2(directory, "capture-manifest.json"), "utf8")));
   let status = await client.beginEncoding(id, manifest);
   if (status.status === "failed") status = await client.retryEncoding(id);
   if (status.status !== "uploading") {
     if (["expired", "cancelled"].includes(status.status)) throw new Error(`Capture ${status.status}; it cannot be retried.`);
     return status;
   }
-  const file2 = await open(join(directory, "frames.bin"), "r");
+  const file2 = await open(join2(directory, "frames.bin"), "r");
   try {
     const total = manifest.frames.reduce((n, f) => n + f.size, 0);
     if ((await file2.stat()).size !== total) throw new Error("Capture bytes do not match the manifest.");
@@ -14777,16 +14985,16 @@ import { basename, dirname as dirname2 } from "path";
 import { readdir as readdir2, rm as rm5, stat as stat4 } from "fs/promises";
 
 // ../recorder/src/client.ts
-import { request } from "http";
-import { spawn } from "child_process";
+import { request as request2 } from "http";
+import { spawn as spawn2 } from "child_process";
 
 // ../recorder/src/paths.ts
-import { homedir, tmpdir } from "os";
-import { join as join2 } from "path";
-var rillDirectory = () => process.env.RILL_HOME ?? join2(homedir(), ".rill");
-var daemonSocketPath = () => process.env.RILL_SOCKET ?? join2(rillDirectory(), "recorder-v2.sock");
-var daemonStatePath = () => join2(rillDirectory(), "sessions-v2.json");
-var recordingTempRoot = () => process.env.RILL_TEMP ?? join2(tmpdir(), "rill-recordings");
+import { homedir as homedir2, tmpdir } from "os";
+import { join as join3 } from "path";
+var rillDirectory = () => process.env.RILL_HOME ?? join3(homedir2(), ".rill");
+var daemonSocketPath = () => process.env.RILL_SOCKET ?? join3(rillDirectory(), "recorder-v2.sock");
+var daemonStatePath = () => join3(rillDirectory(), "sessions-v2.json");
+var recordingTempRoot = () => process.env.RILL_TEMP ?? join3(tmpdir(), "rill-recordings");
 
 // ../recorder/src/client.ts
 async function ensureDaemon(cliEntryPath) {
@@ -14795,7 +15003,7 @@ async function ensureDaemon(cliEntryPath) {
     return;
   } catch {
   }
-  const child = spawn(process.execPath, [cliEntryPath, "daemon"], { detached: true, stdio: "ignore", env: process.env });
+  const child = spawn2(process.execPath, [cliEntryPath, "daemon"], { detached: true, stdio: "ignore", env: process.env });
   child.unref();
   const deadline = Date.now() + 1e4;
   while (Date.now() < deadline) {
@@ -14820,7 +15028,7 @@ function recordingStatus(recordingId) {
 function callDaemon(method, path, body) {
   return new Promise((resolve, reject) => {
     const payload = body === void 0 ? void 0 : Buffer.from(JSON.stringify(body));
-    const outgoing = request({ socketPath: daemonSocketPath(), method, path, headers: payload ? { "Content-Type": "application/json", "Content-Length": payload.length } : void 0 }, (incoming) => {
+    const outgoing = request2({ socketPath: daemonSocketPath(), method, path, headers: payload ? { "Content-Type": "application/json", "Content-Length": payload.length } : void 0 }, (incoming) => {
       const chunks = [];
       incoming.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
       incoming.on("end", () => {
@@ -14840,17 +15048,17 @@ function callDaemon(method, path, body) {
 }
 
 // ../recorder/src/retention.ts
-import { readdir, readFile as readFile3, rm } from "fs/promises";
-import { join as join3 } from "path";
+import { readdir, readFile as readFile3, rm as rm2 } from "fs/promises";
+import { join as join4 } from "path";
 async function purgeExpiredRemoteCaptures(root, now = Date.now()) {
   const removed = [];
   for (const id of await readdir(root).catch(() => [])) {
     if (!/^rec_[a-zA-Z0-9_-]+$/.test(id)) continue;
-    const directory = join3(root, id);
+    const directory = join4(root, id);
     try {
-      const marker = JSON.parse(await readFile3(join3(directory, "remote-capture.json"), "utf8"));
+      const marker = JSON.parse(await readFile3(join4(directory, "remote-capture.json"), "utf8"));
       if (typeof marker.expiresAt !== "number" || marker.expiresAt > now) continue;
-      await rm(directory, { recursive: true, force: true });
+      await rm2(directory, { recursive: true, force: true });
       removed.push(id);
     } catch {
     }
@@ -14861,7 +15069,7 @@ async function hasRetainedRemoteCaptures(root) {
   for (const id of await readdir(root).catch(() => [])) {
     if (!/^rec_[a-zA-Z0-9_-]+$/.test(id)) continue;
     try {
-      const marker = JSON.parse(await readFile3(join3(root, id, "remote-capture.json"), "utf8"));
+      const marker = JSON.parse(await readFile3(join4(root, id, "remote-capture.json"), "utf8"));
       if (typeof marker.expiresAt === "number" && Number.isFinite(marker.expiresAt)) return true;
     } catch {
     }
@@ -14871,8 +15079,8 @@ async function hasRetainedRemoteCaptures(root) {
 
 // ../recorder/src/daemon.ts
 import { createServer as createServer2 } from "http";
-import { mkdir as mkdir4, readFile as readFile5, unlink, writeFile as writeFile4, rename, stat as stat2 } from "fs/promises";
-import { dirname, join as join7 } from "path";
+import { mkdir as mkdir5, readFile as readFile5, unlink, writeFile as writeFile4, rename, stat as stat3 } from "fs/promises";
+import { dirname, join as join8 } from "path";
 
 // ../contracts/src/recording.ts
 var cursorAppearanceSchema = external_exports.object({
@@ -15033,10 +15241,10 @@ async function attachCursorOverlay(page, cdp, input) {
 
 // ../recorder/src/session.ts
 import { chromium } from "playwright-core";
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 import { createServer } from "net";
-import { mkdir as mkdir3, mkdtemp, rm as rm2, writeFile as writeFile3 } from "fs/promises";
-import { join as join6 } from "path";
+import { mkdir as mkdir4, mkdtemp, rm as rm3, writeFile as writeFile3 } from "fs/promises";
+import { join as join7 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 
 // ../recorder/src/bundle.ts
@@ -15116,9 +15324,9 @@ function redactJson(value, depth = 0) {
 }
 
 // ../recorder/src/encoding.ts
-import { open as open2, writeFile, mkdir } from "fs/promises";
-import { spawn as spawn2 } from "child_process";
-import { join as join4 } from "path";
+import { open as open2, writeFile, mkdir as mkdir2 } from "fs/promises";
+import { spawn as spawn3 } from "child_process";
+import { join as join5 } from "path";
 var active = 0;
 var waiting = [];
 function encodingConcurrency() {
@@ -15148,11 +15356,11 @@ async function encodeFrames(directory, manifest, output, signal) {
       lines.push(`file 'frame-${String(i).padStart(6, "0")}.jpg'`, `duration ${Math.max(1 / 60, duration3).toFixed(6)}`);
     }
     lines.push(`file 'frame-${String(manifest.frames.length - 1).padStart(6, "0")}.jpg'`);
-    await writeFile(join4(directory, "frames.ffconcat"), lines.join("\n") + "\n", { mode: 384 });
+    await writeFile(join5(directory, "frames.ffconcat"), lines.join("\n") + "\n", { mode: 384 });
     const threads = Number(process.env.RILL_FFMPEG_THREADS ?? 1);
     if (!Number.isInteger(threads) || threads < 1 || threads > 16) throw new Error("Invalid RILL_FFMPEG_THREADS");
     await new Promise((resolve, reject) => {
-      const child = spawn2(process.env.RILL_FFMPEG ?? "ffmpeg", ["-hide_banner", "-loglevel", "error", "-protocol_whitelist", "file", "-f", "concat", "-safe", "1", "-i", "frames.ffconcat", "-vsync", "vfr", "-pix_fmt", "yuv420p", "-c:v", "libvpx-vp9", "-deadline", "good", "-cpu-used", "4", "-threads", String(threads), "-b:v", "0", "-crf", "32", "-y", output], { cwd: directory, stdio: ["ignore", "ignore", "pipe"] });
+      const child = spawn3(process.env.RILL_FFMPEG ?? "ffmpeg", ["-hide_banner", "-loglevel", "error", "-protocol_whitelist", "file", "-f", "concat", "-safe", "1", "-i", "frames.ffconcat", "-vsync", "vfr", "-pix_fmt", "yuv420p", "-c:v", "libvpx-vp9", "-deadline", "good", "-cpu-used", "4", "-threads", String(threads), "-b:v", "0", "-crf", "32", "-y", output], { cwd: directory, stdio: ["ignore", "ignore", "pipe"] });
       let stderr = "";
       child.stderr.on("data", (chunk) => {
         stderr = (stderr + String(chunk)).slice(-2e3);
@@ -15177,8 +15385,8 @@ async function encodeFrames(directory, manifest, output, signal) {
 }
 
 // ../recorder/src/screencast.ts
-import { mkdir as mkdir2, writeFile as writeFile2, readFile as readFile4, open as open3 } from "fs/promises";
-import { join as join5 } from "path";
+import { mkdir as mkdir3, writeFile as writeFile2, readFile as readFile4, open as open3 } from "fs/promises";
+import { join as join6 } from "path";
 var ScreencastRecorder = class {
   constructor(session, directory, width, height) {
     this.session = session;
@@ -15193,7 +15401,7 @@ var ScreencastRecorder = class {
   frameBytes = 0;
   captureError;
   async start() {
-    await mkdir2(this.directory, { recursive: true, mode: 448 });
+    await mkdir3(this.directory, { recursive: true, mode: 448 });
     this.session.on("Page.screencastFrame", (payload) => {
       const bytes = Buffer.from(payload.data, "base64");
       if (this.frameCounter >= 36e3 || this.frameBytes + bytes.length > ENCODING_MAX_BYTES || bytes.length > ENCODING_PART_BYTES) {
@@ -15202,7 +15410,7 @@ var ScreencastRecorder = class {
         return;
       }
       this.frameBytes += bytes.length;
-      const path = join5(this.directory, `frame-${String(this.frameCounter).padStart(6, "0")}.jpg`);
+      const path = join6(this.directory, `frame-${String(this.frameCounter).padStart(6, "0")}.jpg`);
       this.frameCounter += 1;
       const write = writeFile2(path, bytes, { mode: 384 }).then(() => {
         this.frames.push({ path, timestamp: payload.metadata.timestamp ?? Date.now() / 1e3 });
@@ -15226,7 +15434,7 @@ var ScreencastRecorder = class {
     if (!this.frames.length) throw new Error("No video frames were captured.");
     const ordered = this.frames.toSorted((a, b) => a.timestamp - b.timestamp);
     const frames = [];
-    const bundle = await open3(join5(this.directory, "frames.bin"), "w", 384);
+    const bundle = await open3(join6(this.directory, "frames.bin"), "w", 384);
     try {
       for (const frame of ordered) {
         const bytes = await readFile4(frame.path);
@@ -15237,7 +15445,7 @@ var ScreencastRecorder = class {
       await bundle.close();
     }
     const manifest = frameManifestSchema.parse({ version: 1, durationSeconds: Math.min(600, expectedDurationSeconds), width: this.width, height: this.height, frames });
-    await writeFile2(join5(this.directory, "capture-manifest.json"), JSON.stringify(manifest), { mode: 384 });
+    await writeFile2(join6(this.directory, "capture-manifest.json"), JSON.stringify(manifest), { mode: 384 });
     if (!captureOnly) await encodeFrames(this.directory, manifest, outputPath);
     return { frameCount: this.frames.length, outputPath };
   }
@@ -15286,11 +15494,11 @@ var RecordingSession = class _RecordingSession {
   static async start(options) {
     const width = options.width ?? 1280;
     const height = options.height ?? 720;
-    await mkdir3(options.outputDirectory, { recursive: true, mode: 448 });
-    if (options.encoding === "remote") await writeFile3(join6(options.outputDirectory, "remote-capture.json"), JSON.stringify({ expiresAt: Date.now() + 864e5 }), { mode: 384 });
+    await mkdir4(options.outputDirectory, { recursive: true, mode: 448 });
+    if (options.encoding === "remote") await writeFile3(join7(options.outputDirectory, "remote-capture.json"), JSON.stringify({ expiresAt: Date.now() + 864e5 }), { mode: 384 });
     const runtime = options.cdpUrl ? await connectAttached(options.cdpUrl, options.outputDirectory) : await launchManaged({ headed: options.headed ?? false, width, height, outputDirectory: options.outputDirectory, proxyServer: options.proxyServer });
     const cdpSession = await runtime.context.newCDPSession(runtime.page);
-    const screencast = new ScreencastRecorder(cdpSession, join6(options.outputDirectory, "frames"), width, height);
+    const screencast = new ScreencastRecorder(cdpSession, join7(options.outputDirectory, "frames"), width, height);
     const session = new _RecordingSession(options, { ...runtime, screencast });
     try {
       await session.attachDiagnostics(options.captureNetworkBodies ?? false);
@@ -15322,8 +15530,8 @@ var RecordingSession = class _RecordingSession {
     if (this.maxTimer) clearTimeout(this.maxTimer);
     const durationSeconds = Math.max(0.1, (Date.now() - this.startedAt.getTime()) / 1e3);
     const outputDirectory = this.outputDirectory;
-    const videoPath = join6(outputDirectory, "recording.webm");
-    const diagnosticsPath = join6(outputDirectory, "diagnostics-v1.ndjson.gz");
+    const videoPath = join7(outputDirectory, "recording.webm");
+    const diagnosticsPath = join7(outputDirectory, "diagnostics-v1.ndjson.gz");
     const bundle = {
       schemaVersion: 1,
       capturePolicyVersion: "safe-default-v1",
@@ -15346,13 +15554,13 @@ var RecordingSession = class _RecordingSession {
       if (this.browserProcess) {
         await this.browser.close().catch(() => void 0);
         await terminateBrowser(this.browserProcess);
-        if (this.profileDirectory) await rm2(this.profileDirectory, { recursive: true, force: true }).catch(() => void 0);
+        if (this.profileDirectory) await rm3(this.profileDirectory, { recursive: true, force: true }).catch(() => void 0);
       }
     }
     const consoleErrors = this.consoleEvents.filter((event) => event.severity === "error").length;
     const failedRequests = this.networkEvents.filter((event) => event.failureReason).length;
     const httpErrors = this.networkEvents.filter((event) => (event.status ?? 0) >= 400).length;
-    return { recordingId: this.recordingId, videoPath, ...this.encoding === "remote" ? { frameDirectory: join6(outputDirectory, "frames") } : {}, diagnosticsPath, durationSeconds, stoppedReason: reason, diagnostics: { consoleErrors, failedRequests, httpErrors, truncated: this.truncated, bodyCaptureEnabled: this.captureNetworkBodies } };
+    return { recordingId: this.recordingId, videoPath, ...this.encoding === "remote" ? { frameDirectory: join7(outputDirectory, "frames") } : {}, diagnosticsPath, durationSeconds, stoppedReason: reason, diagnostics: { consoleErrors, failedRequests, httpErrors, truncated: this.truncated, bodyCaptureEnabled: this.captureNetworkBodies } };
   }
   captureNetworkBodies = false;
   encoding = "local";
@@ -15464,7 +15672,7 @@ var RecordingSession = class _RecordingSession {
 };
 async function launchManaged(options) {
   const port = await getAvailablePort();
-  const profileDirectory = await mkdtemp(join6(tmpdir2(), "rill-chrome-"));
+  const profileDirectory = await mkdtemp(join7(tmpdir2(), "rill-chrome-"));
   const executable = findChromeExecutable();
   const args = [
     `--remote-debugging-port=${port}`,
@@ -15482,7 +15690,7 @@ async function launchManaged(options) {
     "about:blank"
   ];
   const env = options.proxyServer ? Object.fromEntries(Object.entries(process.env).filter(([key]) => ["PATH", "HOME", "TMPDIR", "DISPLAY", "LANG", "LD_LIBRARY_PATH", "XDG_RUNTIME_DIR"].includes(key))) : process.env;
-  const browserProcess = spawn3(executable, args, { stdio: ["ignore", "ignore", "pipe"], detached: false, env });
+  const browserProcess = spawn4(executable, args, { stdio: ["ignore", "ignore", "pipe"], detached: false, env });
   const cdpUrl = `http://127.0.0.1:${port}`;
   try {
     await waitForCdp(cdpUrl, browserProcess);
@@ -15493,7 +15701,7 @@ async function launchManaged(options) {
     return { cdpUrl, browser, context, page, browserProcess, profileDirectory };
   } catch (error51) {
     await terminateBrowser(browserProcess);
-    await rm2(profileDirectory, { recursive: true, force: true }).catch(() => void 0);
+    await rm3(profileDirectory, { recursive: true, force: true }).catch(() => void 0);
     throw error51;
   }
 }
@@ -15544,8 +15752,8 @@ var sessions = /* @__PURE__ */ new Map();
 var lastActivity = Date.now();
 async function runDaemon() {
   const socketPath = daemonSocketPath();
-  await mkdir4(dirname(socketPath), { recursive: true, mode: 448 });
-  await mkdir4(recordingTempRoot(), { recursive: true, mode: 448 });
+  await mkdir5(dirname(socketPath), { recursive: true, mode: 448 });
+  await mkdir5(recordingTempRoot(), { recursive: true, mode: 448 });
   await restoreRecoverableSessions();
   await purgeExpiredCaptures();
   await unlink(socketPath).catch((error51) => {
@@ -15579,7 +15787,7 @@ async function route(request3, response) {
     try {
       const input = await readJson(request3);
       if (!/^rec_[a-zA-Z0-9_-]+$/.test(input.recordingId)) return json2(response, 400, { error: { code: "validation_failed", message: "recordingId is required." } });
-      const outputDirectory = join7(recordingTempRoot(), input.recordingId);
+      const outputDirectory = join8(recordingTempRoot(), input.recordingId);
       const session = await RecordingSession.start({ ...input, outputDirectory });
       const status = session.status();
       const entry = { session, base: { recordingId: status.recordingId, cdpUrl: status.cdpUrl, startedAt: status.startedAt }, state: "recording" };
@@ -15657,7 +15865,7 @@ async function purgeExpiredCaptures() {
   const removed = await purgeExpiredRemoteCaptures(recordingTempRoot());
   for (const id of removed) sessions.delete(id);
   let changed = removed.length > 0;
-  for (const [id, entry] of sessions) if (entry.result?.frameDirectory && !await stat2(entry.result.frameDirectory).catch(() => null)) {
+  for (const [id, entry] of sessions) if (entry.result?.frameDirectory && !await stat3(entry.result.frameDirectory).catch(() => null)) {
     sessions.delete(id);
     changed = true;
   }
@@ -15694,196 +15902,6 @@ function cliFailureCode(error51) {
   return message.match(/^([a-z][a-z0-9_]{0,79}):/)?.[1] ?? "unexpected_error";
 }
 
-// src/agent-session.ts
-import { hostname as hostname3, homedir as homedir2 } from "os";
-import { mkdir as mkdir5, rm as rm4, stat as stat3 } from "fs/promises";
-import { join as join8 } from "path";
-import { createHash, randomBytes } from "crypto";
-var JWT_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
-var CLAIM_GRANT = "urn:workos:agent-auth:grant-type:claim";
-var AgentAuthError = class extends Error {
-  constructor(code, message) {
-    super(`${code}: ${message}`);
-    this.code = code;
-  }
-};
-function parseAuthorization(value) {
-  if (!value?.startsWith("{")) return null;
-  const saved = JSON.parse(value);
-  if (saved.version !== 1 || typeof saved.anonymous !== "boolean") throw new Error("Saved Rill authorization is invalid. Run rill connect --email <your-email>.");
-  return saved;
-}
-async function request2(apiUrl, path, body, form = false) {
-  const url2 = new URL(apiUrl);
-  if (url2.protocol !== "https:" && !["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname)) throw new Error("Agent authentication requires HTTPS.");
-  const response = await fetch(`${apiUrl}${path}`, {
-    method: "POST",
-    redirect: "error",
-    signal: AbortSignal.timeout(15e3),
-    headers: { "Content-Type": form ? "application/x-www-form-urlencoded" : "application/json" },
-    body: form ? new URLSearchParams(Object.entries(body).map(([key, value2]) => [key, String(value2)])) : JSON.stringify(body)
-  });
-  const value = await response.json();
-  if (!response.ok) throw new AgentAuthError(value.error ?? "authentication_failed", value.error_description ?? "Could not authorize Rill.");
-  return value;
-}
-function withTokens(saved, tokens) {
-  return {
-    ...saved,
-    accessToken: tokens.access_token,
-    accessExpiresAt: Date.now() + tokens.expires_in * 1e3,
-    ...tokens.identity_assertion ? { identityAssertion: tokens.identity_assertion, assertionExpires: tokens.assertion_expires } : {}
-  };
-}
-var save = (apiUrl, value) => saveCredential(apiUrl, JSON.stringify(value));
-var pending = /* @__PURE__ */ new Map();
-async function loadAgentCredential(apiUrl) {
-  if (process.env.RILL_TOKEN) return process.env.RILL_TOKEN;
-  const inFlight = pending.get(apiUrl);
-  if (inFlight) return inFlight;
-  const promise2 = (async () => {
-    const raw = await loadStoredCredential(apiUrl);
-    const saved = parseAuthorization(raw);
-    if (!saved) return raw;
-    if (saved.accessToken && (saved.accessExpiresAt ?? 0) > Date.now() + 6e4) return saved.accessToken;
-    if (!saved.identityAssertion && saved.anonymous && saved.registrationToken) return null;
-    if (!saved.identityAssertion) throw new Error("Connection is awaiting approval. Run rill connect --email <your-email>.");
-    const tokens = await request2(apiUrl, "/oauth2/token", { grant_type: JWT_GRANT, assertion: saved.identityAssertion }, true);
-    await save(apiUrl, withTokens(saved, tokens));
-    return tokens.access_token;
-  })();
-  pending.set(apiUrl, promise2);
-  try {
-    return await promise2;
-  } finally {
-    pending.delete(apiUrl);
-  }
-}
-async function ensureAnonymousCredential(apiUrl) {
-  const root = join8(homedir2(), ".rill", "auth-locks");
-  await mkdir5(root, { recursive: true, mode: 448 });
-  const lock = join8(root, createHash("sha256").update(apiUrl).digest("hex"));
-  const deadline = Date.now() + 3e4;
-  while (true) {
-    try {
-      await mkdir5(lock, { mode: 448 });
-      break;
-    } catch (error51) {
-      if (error51.code !== "EEXIST") throw error51;
-      const info = await stat3(lock).catch(() => null);
-      if (info && Date.now() - info.mtimeMs > 12e4) {
-        await rm4(lock, { recursive: true, force: true });
-        continue;
-      }
-      if (Date.now() > deadline) throw new Error("Another Rill process is setting up authorization. Retry shortly.");
-      await new Promise((resolve) => setTimeout(resolve, 200));
-    }
-  }
-  try {
-    return await createAnonymousCredential(apiUrl);
-  } finally {
-    await rm4(lock, { recursive: true, force: true });
-  }
-}
-async function createAnonymousCredential(apiUrl) {
-  const existing = await loadAgentCredential(apiUrl);
-  if (existing) return existing;
-  const stored = parseAuthorization(await loadStoredCredential(apiUrl));
-  const initial = stored?.registrationToken ? stored : { version: 1, anonymous: true, registrationToken: randomBytes(32).toString("hex") };
-  await save(apiUrl, initial);
-  const registered = await request2(apiUrl, "/agent/identity", { type: "anonymous", analytics_enabled: process.env.RILL_ANONYMOUS_ANALYTICS !== "0" && process.env.DO_NOT_TRACK !== "1", registration_token: initial.registrationToken, name: `${hostname3()} \xB7 ${process.platform}` });
-  const saved = { ...initial, registrationToken: void 0, identityAssertion: registered.identity_assertion, assertionExpires: registered.assertion_expires, claimToken: registered.claim_token };
-  await save(apiUrl, saved);
-  process.stderr.write("Recording anonymously: three recordings, up to five minutes each. Recordings and share links expire after seven days. Run rill connect --email <your-email> to keep them.\n");
-  return await loadAgentCredential(apiUrl);
-}
-async function connectAgent(apiUrl, email3) {
-  if (process.env.RILL_TOKEN) throw new Error("Unset RILL_TOKEN before connecting a local identity.");
-  let saved = parseAuthorization(await loadStoredCredential(apiUrl));
-  let claim;
-  if (saved?.claimToken && saved.anonymous) {
-    try {
-      const result = await request2(apiUrl, "/agent/identity/claim", { claim_token: saved.claimToken, email: email3 });
-      claim = result.claim_attempt;
-    } catch (error51) {
-      if (!(error51 instanceof AgentAuthError) || error51.code !== "claim_expired") throw error51;
-    }
-  }
-  if (!claim) {
-    await save(apiUrl, saved ?? { version: 1, anonymous: true });
-    const result = await request2(apiUrl, "/agent/identity", { type: "service_auth", login_hint: email3, name: `${hostname3()} \xB7 ${process.platform}` });
-    saved = { version: 1, anonymous: true, claimToken: result.claim_token };
-    await save(apiUrl, saved);
-    claim = result.claim;
-  }
-  process.stderr.write(`Open ${claim.verification_uri}
-Sign in as ${email3} and enter ${claim.user_code}. Approve only the request you started.
-`);
-  const deadline = Date.now() + claim.expires_in * 1e3;
-  let interval = claim.interval;
-  while (Date.now() < deadline) {
-    await new Promise((resolve) => setTimeout(resolve, interval * 1e3));
-    try {
-      const tokens = await request2(apiUrl, "/oauth2/token", { grant_type: CLAIM_GRANT, claim_token: saved.claimToken }, true);
-      const connected = withTokens({ version: 1, anonymous: false }, tokens);
-      await save(apiUrl, connected);
-      return { status: "authenticated", expiresAt: connected.assertionExpires, apiUrl };
-    } catch (error51) {
-      if (error51 instanceof AgentAuthError && error51.code === "expired_token") throw new AgentAuthError("expired_token", "The approval attempt expired. Run rill connect again to request a fresh code using the same saved claim token.");
-      if (error51 instanceof AgentAuthError && error51.code === "authorization_pending") continue;
-      if (error51 instanceof AgentAuthError && error51.code === "slow_down") {
-        interval += 5;
-        continue;
-      }
-      throw error51;
-    }
-  }
-  throw new AgentAuthError("expired_token", "Connection request expired. Run rill connect again to restart the approval attempt using the same saved claim token.");
-}
-
-// src/keychain.ts
-import { spawn as spawn4 } from "child_process";
-var service = "rill";
-async function saveCredential(apiUrl, token) {
-  if (process.platform === "darwin") {
-    await run("security", ["add-generic-password", "-U", "-a", apiUrl, "-s", service, "-w", token]);
-    return;
-  }
-  if (process.platform === "linux") {
-    await run("secret-tool", ["store", "--label=Rill agent credential", "service", service, "api-url", apiUrl], token);
-    return;
-  }
-  throw new Error("OS keychain storage is not supported on this platform yet. Use RILL_TOKEN.");
-}
-function loadCredential(apiUrl) {
-  return loadAgentCredential(apiUrl);
-}
-async function loadStoredCredential(apiUrl) {
-  try {
-    if (process.platform === "darwin") return (await run("security", ["find-generic-password", "-a", apiUrl, "-s", service, "-w"])).trim() || null;
-    if (process.platform === "linux") return (await run("secret-tool", ["lookup", "service", service, "api-url", apiUrl])).trim() || null;
-  } catch (error51) {
-    const code = error51.exitCode;
-    if (process.platform === "darwin" && code === 44) return null;
-    if (process.platform === "linux" && code === 1 && !error51.message.trim()) return null;
-    throw new Error("Cannot read the OS credential store. Unlock your keychain or enable Secret Service; your identity has not been replaced.");
-  }
-  throw new Error("Local authorization requires macOS Keychain or Linux Secret Service.");
-}
-function run(command, args, input) {
-  return new Promise((resolve, reject) => {
-    const child = spawn4(command, args, { stdio: ["pipe", "pipe", "pipe"] });
-    const stdout = [];
-    const stderr = [];
-    child.stdout.on("data", (chunk) => stdout.push(Buffer.from(chunk)));
-    child.stderr.on("data", (chunk) => stderr.push(Buffer.from(chunk)));
-    child.once("error", reject);
-    child.once("exit", (code) => code === 0 ? resolve(Buffer.concat(stdout).toString("utf8")) : reject(Object.assign(new Error(Buffer.concat(stderr).toString("utf8").trim()), { exitCode: code })));
-    if (input) child.stdin.end(input);
-    else child.stdin.end();
-  });
-}
-
 // src/output.ts
 function emit(value, pretty = false) {
   process.stdout.write(`${JSON.stringify(value, null, pretty ? 2 : void 0)}
@@ -16187,6 +16205,12 @@ async function authorize(quiet = false) {
   }
   throw new Error("Device authorization expired.");
 }
+program.command("whoami").description("Show the current verified agent identity without starting sign-in.").action(async () => {
+  const options = program.opts();
+  const identity = await whoami(options.apiUrl);
+  emit(identity, options.pretty);
+  if (!identity.authenticated) process.exitCode = 1;
+});
 program.command("connect").description("Connect this agent once, with renewable account access.").requiredOption("--email <email>", "Email of the Rill account approving access").action(async (input) => {
   const options = program.opts();
   emit({ schemaVersion: 1, ...await connectAgent(options.apiUrl, input.email) }, options.pretty);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runalabs/rill-cli",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "Record, inspect, and share agent-controlled browser runs with Rill.",
   "license": "Apache-2.0",
   "repository": {