@skhema/cli 0.3.1

package/dist/lib/api/transfer.d.ts

@@ -0,0 +1,57 @@
+import type { SkhemaClient } from '@skhema/sdk';
+/** Best-effort content type from a filename extension. */
+export declare function guessContentType(fileName: string): string;
+/**
+ * Upload a local file as a resource on an element: sign an upload URL, stream
+ * the bytes to it, then confirm. A failure at any step throws (the confirm step
+ * surfaces the gateway `requestId`); the command layer therefore never emits a
+ * partial-success envelope.
+ */
+export declare function uploadResource(opts: {
+    client: SkhemaClient;
+    workspaceId: string;
+    elementId: string;
+    filePath: string;
+    attribution?: string;
+    fetchImpl?: typeof fetch;
+}): Promise<unknown>;
+/**
+ * Resolve a resource's signed download URL and stream it to `out` (a path, `-`
+ * for stdout, or — when omitted — the original filename in the cwd). External
+ * link resources (no stored file) are reported as a usage error.
+ */
+export declare function downloadResource(opts: {
+    client: SkhemaClient;
+    workspaceId: string;
+    resourceId: string;
+    out?: string;
+    fetchImpl?: typeof fetch;
+}): Promise<{
+    path: string;
+    bytes: number;
+}>;
+/** Fetch `href` and stream it to a path or stdout. Returns bytes written. */
+export declare function streamUrlTo(doFetch: typeof fetch, href: string, target: string): Promise<{
+    path: string;
+    bytes: number;
+}>;
+export interface ExportResult {
+    delivered: 'download' | 'email';
+    documentId: string;
+    format: string;
+    filename?: string;
+    path?: string;
+    recipient?: string;
+}
+/**
+ * Run an export: `exec` performs the SDK call that returns the export job
+ * payload; for a download delivery we fetch the signed URL and stream it to
+ * `out` (default: the server-supplied filename in the cwd); for an email
+ * delivery we just report it. `out === '-'` streams to stdout.
+ */
+export declare function performExport(opts: {
+    exec: () => Promise<unknown>;
+    out?: string;
+    fetchImpl?: typeof fetch;
+}): Promise<ExportResult>;
+//# sourceMappingURL=transfer.d.ts.map

package/dist/lib/api/transfer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transfer.d.ts","sourceRoot":"","sources":["../../../src/lib/api/transfer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAkC/C,0DAA0D;AAC1D,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGzD;AASD;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,MAAM,EAAE,YAAY,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB,GAAG,OAAO,CAAC,OAAO,CAAC,CA6CnB;AAkBD;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,MAAM,EAAE,YAAY,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAyB3C;AAED,6EAA6E;AAC7E,wBAAsB,WAAW,CAC/B,OAAO,EAAE,OAAO,KAAK,EACrB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAkB1C;AAqBD,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,UAAU,GAAG,OAAO,CAAA;IAC/B,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB,GAAG,OAAO,CAAC,YAAY,CAAC,CA2BxB"}

package/dist/lib/api/transfer.js

@@ -0,0 +1,153 @@
+import fs from 'fs';
+import path from 'path';
+import { Readable } from 'stream';
+import { pipeline } from 'stream/promises';
+import { UsageError } from './run-command.js';
+/**
+ * File transfer + export orchestration. These helpers hold the multi-step
+ * client flows (upload = sign → PUT → confirm; export = generate → fetch signed
+ * URL → write) so they are unit-testable against a mocked SDK client and a
+ * mocked `fetch`, independently of the Commander wiring. Bytes are streamed, not
+ * buffered, so large files do not sit in memory.
+ */
+const CONTENT_TYPES = {
+    pdf: 'application/pdf',
+    png: 'image/png',
+    jpg: 'image/jpeg',
+    jpeg: 'image/jpeg',
+    gif: 'image/gif',
+    svg: 'image/svg+xml',
+    txt: 'text/plain',
+    md: 'text/markdown',
+    csv: 'text/csv',
+    json: 'application/json',
+    html: 'text/html',
+    doc: 'application/msword',
+    docx: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+    xls: 'application/vnd.ms-excel',
+    xlsx: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+    zip: 'application/zip',
+};
+/** Best-effort content type from a filename extension. */
+export function guessContentType(fileName) {
+    const ext = path.extname(fileName).slice(1).toLowerCase();
+    return CONTENT_TYPES[ext] ?? 'application/octet-stream';
+}
+/**
+ * Upload a local file as a resource on an element: sign an upload URL, stream
+ * the bytes to it, then confirm. A failure at any step throws (the confirm step
+ * surfaces the gateway `requestId`); the command layer therefore never emits a
+ * partial-success envelope.
+ */
+export async function uploadResource(opts) {
+    const doFetch = opts.fetchImpl ?? globalThis.fetch;
+    let size;
+    try {
+        size = fs.statSync(opts.filePath).size;
+    }
+    catch {
+        throw new UsageError(`Cannot read file: ${opts.filePath}`);
+    }
+    const fileName = path.basename(opts.filePath);
+    const contentType = guessContentType(fileName);
+    const signed = await opts.client.elements.resources.createUploadUrl(opts.workspaceId, opts.elementId, { fileName, contentType });
+    const putResponse = await doFetch(signed.signedUrl, {
+        method: 'PUT',
+        headers: {
+            'Content-Type': contentType,
+            'Content-Length': String(size),
+        },
+        body: Readable.toWeb(fs.createReadStream(opts.filePath)),
+        // Node/undici require duplex when streaming a request body.
+        duplex: 'half',
+    });
+    if (!putResponse.ok) {
+        throw new Error(`Uploading file bytes failed (HTTP ${putResponse.status}). The resource was not created.`);
+    }
+    return opts.client.elements.resources.confirm(opts.workspaceId, opts.elementId, {
+        path: signed.path,
+        ...(opts.attribution ? { attribution: opts.attribution } : {}),
+    });
+}
+/** Filename embedded in a resource storage path: `…/<ts>_<original-name>`. */
+function fileNameFromUrl(href, fallback) {
+    try {
+        const base = path.basename(new URL(href).pathname);
+        const decoded = decodeURIComponent(base);
+        return decoded.replace(/^\d+_/, '') || fallback;
+    }
+    catch {
+        return fallback;
+    }
+}
+/**
+ * Resolve a resource's signed download URL and stream it to `out` (a path, `-`
+ * for stdout, or — when omitted — the original filename in the cwd). External
+ * link resources (no stored file) are reported as a usage error.
+ */
+export async function downloadResource(opts) {
+    const doFetch = opts.fetchImpl ?? globalThis.fetch;
+    const resolved = await opts.client.elements.resources.getDownloadUrl(opts.workspaceId, opts.resourceId);
+    const href = resolved.signedUrl ?? resolved.url;
+    if (!href) {
+        throw new UsageError('Resource has no downloadable file or URL.');
+    }
+    if (!resolved.signedUrl && resolved.url) {
+        throw new UsageError(`Resource is an external link, not a stored file: ${resolved.url}`);
+    }
+    const target = opts.out && opts.out !== '-'
+        ? opts.out
+        : opts.out === '-'
+            ? '-'
+            : fileNameFromUrl(href, `${opts.resourceId}.bin`);
+    return streamUrlTo(doFetch, href, target);
+}
+/** Fetch `href` and stream it to a path or stdout. Returns bytes written. */
+export async function streamUrlTo(doFetch, href, target) {
+    const response = await doFetch(href);
+    if (!response.ok || !response.body) {
+        throw new Error(`Download failed (HTTP ${response.status}).`);
+    }
+    const source = Readable.fromWeb(response.body);
+    let bytes = 0;
+    source.on('data', (chunk) => {
+        bytes += chunk.length;
+    });
+    if (target === '-') {
+        await pipeline(source, process.stdout);
+        return { path: '(stdout)', bytes };
+    }
+    await pipeline(source, fs.createWriteStream(target));
+    return { path: path.resolve(target), bytes };
+}
+/**
+ * Run an export: `exec` performs the SDK call that returns the export job
+ * payload; for a download delivery we fetch the signed URL and stream it to
+ * `out` (default: the server-supplied filename in the cwd); for an email
+ * delivery we just report it. `out === '-'` streams to stdout.
+ */
+export async function performExport(opts) {
+    const doFetch = opts.fetchImpl ?? globalThis.fetch;
+    const res = (await opts.exec());
+    if (res.delivered === 'email') {
+        return {
+            delivered: 'email',
+            documentId: res.documentId,
+            format: res.format,
+            recipient: res.recipient,
+        };
+    }
+    const target = opts.out && opts.out !== '-'
+        ? opts.out
+        : opts.out === '-'
+            ? '-'
+            : res.filename;
+    const written = await streamUrlTo(doFetch, res.url, target);
+    return {
+        delivered: 'download',
+        documentId: res.documentId,
+        format: res.format,
+        filename: res.filename,
+        path: written.path,
+    };
+}

package/dist/lib/auth/api-key-admin.d.ts

@@ -0,0 +1,39 @@
+export type ApiKeyPermission = 'read' | 'write' | 'read-write';
+export type ApiKeyScope = 'org' | 'user';
+export interface ApiKeySummary {
+    id: string;
+    keyPrefix: string;
+    name: string;
+    organizationId: string;
+    userId: string | null;
+    permission: ApiKeyPermission;
+    scope: ApiKeyScope;
+    createdBy: string;
+    createdAt: string;
+    lastUsedAt: string | null;
+    revokedAt: string | null;
+}
+export interface CreatedApiKey extends ApiKeySummary {
+    /** The raw key — returned once, never retrievable again. */
+    rawKey: string;
+    warning?: string;
+}
+export interface ListApiKeysResult {
+    keys: ApiKeySummary[];
+    limits: {
+        used: number;
+        max: number;
+    };
+}
+export declare function createApiKey(accessToken: string, input: {
+    organizationId: string;
+    name: string;
+    permission: ApiKeyPermission;
+    scope: ApiKeyScope;
+}): Promise<CreatedApiKey>;
+export declare function listApiKeys(accessToken: string, organizationId: string): Promise<ListApiKeysResult>;
+export declare function revokeApiKey(accessToken: string, keyId: string): Promise<{
+    revoked: boolean;
+    keyId: string;
+}>;
+//# sourceMappingURL=api-key-admin.d.ts.map

package/dist/lib/auth/api-key-admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-admin.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/api-key-admin.ts"],"names":[],"mappings":"AAaA,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,OAAO,GAAG,YAAY,CAAA;AAC9D,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,CAAA;AAExC,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,cAAc,EAAE,MAAM,CAAA;IACtB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,UAAU,EAAE,gBAAgB,CAAA;IAC5B,KAAK,EAAE,WAAW,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,aAAc,SAAQ,aAAa;IAClD,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,aAAa,EAAE,CAAA;IACrB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;CACtC;AAsDD,wBAAsB,YAAY,CAChC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE;IACL,cAAc,EAAE,MAAM,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,gBAAgB,CAAA;IAC5B,KAAK,EAAE,WAAW,CAAA;CACnB,GACA,OAAO,CAAC,aAAa,CAAC,CAKxB;AAED,wBAAsB,WAAW,CAC/B,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,iBAAiB,CAAC,CAK5B;AAED,wBAAsB,YAAY,CAChC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAK9C"}

package/dist/lib/auth/api-key-admin.js

@@ -0,0 +1,66 @@
+import { SkhemaApiError } from '@skhema/sdk';
+import { SUPABASE_PUBLISHABLE_KEY, SUPABASE_URL } from '../config.js';
+/**
+ * Client for the `api-key-manage` edge function — the same function the web
+ * dashboard uses to create/list/revoke API keys. It authenticates with the
+ * caller's OAuth bearer (`verifyAuth` + `requireUser`), so issuance authorization
+ * (org owner/admin, plan limits, one-time key display, security emails) is
+ * enforced server-side and unchanged. This is NOT the public gateway.
+ */
+const API_KEY_MANAGE_URL = `${SUPABASE_URL}/functions/v1/api-key-manage`;
+async function callApiKeyManage(accessToken, body) {
+    const response = await fetch(API_KEY_MANAGE_URL, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            Authorization: `Bearer ${accessToken}`,
+            apikey: SUPABASE_PUBLISHABLE_KEY,
+        },
+        body: JSON.stringify(body),
+    });
+    const requestId = response.headers.get('x-request-id') ?? undefined;
+    const text = await response.text();
+    const parsed = text ? JSON.parse(text) : {};
+    if (!response.ok) {
+        // api-key-manage returns `{ error: "message" }`; normalize to the SDK's
+        // error taxonomy so runCommand maps 402/403 to the right exit codes.
+        const message = parsed.error ??
+            `api-key-manage failed with status ${response.status}`;
+        throw new SkhemaApiError(response.status, statusToCode(response.status), message, requestId);
+    }
+    return parsed;
+}
+function statusToCode(status) {
+    switch (status) {
+        case 400:
+            return 'bad_request';
+        case 401:
+            return 'unauthorized';
+        case 402:
+            return 'payment_required';
+        case 403:
+            return 'forbidden';
+        case 404:
+            return 'not_found';
+        default:
+            return 'error';
+    }
+}
+export async function createApiKey(accessToken, input) {
+    return (await callApiKeyManage(accessToken, {
+        action: 'create',
+        ...input,
+    }));
+}
+export async function listApiKeys(accessToken, organizationId) {
+    return (await callApiKeyManage(accessToken, {
+        action: 'list',
+        organizationId,
+    }));
+}
+export async function revokeApiKey(accessToken, keyId) {
+    return (await callApiKeyManage(accessToken, {
+        action: 'revoke',
+        keyId,
+    }));
+}

package/dist/lib/auth/api-key-store.d.ts

@@ -0,0 +1,8 @@
+/** Persist an API key (keychain preferred, file fallback). */
+export declare function storeApiKey(rawKey: string): void;
+/** Return the stored API key, or null when none is stored. */
+export declare function getStoredApiKey(): string | null;
+/** Remove the stored API key from both keychain and file. */
+export declare function clearApiKey(): void;
+export declare function getApiKeyStorageLocation(): string;
+//# sourceMappingURL=api-key-store.d.ts.map

package/dist/lib/auth/api-key-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-store.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/api-key-store.ts"],"names":[],"mappings":"AA4FA,8DAA8D;AAC9D,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAKhD;AAED,8DAA8D;AAC9D,wBAAgB,eAAe,IAAI,MAAM,GAAG,IAAI,CAS/C;AAED,6DAA6D;AAC7D,wBAAgB,WAAW,IAAI,IAAI,CAGlC;AAED,wBAAgB,wBAAwB,IAAI,MAAM,CAMjD"}

package/dist/lib/auth/api-key-store.js

@@ -0,0 +1,109 @@
+import { execSync } from 'child_process';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { API_KEY_FILE, CREDENTIALS_DIR, KEYCHAIN_ACCOUNT_API_KEY, KEYCHAIN_SERVICE, } from '../config.js';
+/**
+ * Storage for the `sk_live_…` API key credential lane. Mirrors the OAuth
+ * token-store pattern: macOS Keychain first (under a distinct account so it
+ * never collides with the OAuth session), plain-file fallback at
+ * `~/.skhema/api-key.json` (mode 0600) elsewhere. The raw key is never logged.
+ */
+function getApiKeyFilePath() {
+    return path.join(os.homedir(), CREDENTIALS_DIR, API_KEY_FILE);
+}
+function tryKeychainStore(data) {
+    if (process.platform !== 'darwin')
+        return false;
+    try {
+        try {
+            execSync(`security delete-generic-password -s "${KEYCHAIN_SERVICE}" -a "${KEYCHAIN_ACCOUNT_API_KEY}" 2>/dev/null`, { stdio: 'ignore' });
+        }
+        catch {
+            /* ignore if it doesn't exist */
+        }
+        execSync(`security add-generic-password -s "${KEYCHAIN_SERVICE}" -a "${KEYCHAIN_ACCOUNT_API_KEY}" -w "${data.replace(/"/g, '\\"')}"`, { stdio: 'ignore' });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function tryKeychainLoad() {
+    if (process.platform !== 'darwin')
+        return null;
+    try {
+        const result = execSync(`security find-generic-password -s "${KEYCHAIN_SERVICE}" -a "${KEYCHAIN_ACCOUNT_API_KEY}" -w 2>/dev/null`, { encoding: 'utf-8' });
+        return result.trim();
+    }
+    catch {
+        return null;
+    }
+}
+function tryKeychainDelete() {
+    if (process.platform !== 'darwin')
+        return false;
+    try {
+        execSync(`security delete-generic-password -s "${KEYCHAIN_SERVICE}" -a "${KEYCHAIN_ACCOUNT_API_KEY}" 2>/dev/null`, { stdio: 'ignore' });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function storeToFile(data) {
+    const dir = path.join(os.homedir(), CREDENTIALS_DIR);
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    fs.writeFileSync(getApiKeyFilePath(), data, { mode: 0o600 });
+}
+function loadFromFile() {
+    try {
+        return fs.readFileSync(getApiKeyFilePath(), 'utf-8');
+    }
+    catch {
+        return null;
+    }
+}
+function deleteFile() {
+    try {
+        const filePath = getApiKeyFilePath();
+        if (fs.existsSync(filePath))
+            fs.unlinkSync(filePath);
+    }
+    catch {
+        /* ignore */
+    }
+}
+/** Persist an API key (keychain preferred, file fallback). */
+export function storeApiKey(rawKey) {
+    const data = JSON.stringify({ apiKey: rawKey });
+    if (!tryKeychainStore(data)) {
+        storeToFile(data);
+    }
+}
+/** Return the stored API key, or null when none is stored. */
+export function getStoredApiKey() {
+    const data = tryKeychainLoad() ?? loadFromFile();
+    if (!data)
+        return null;
+    try {
+        const parsed = JSON.parse(data);
+        return parsed.apiKey ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Remove the stored API key from both keychain and file. */
+export function clearApiKey() {
+    tryKeychainDelete();
+    deleteFile();
+}
+export function getApiKeyStorageLocation() {
+    if (process.platform === 'darwin' && tryKeychainLoad()) {
+        return `macOS Keychain (${KEYCHAIN_SERVICE}/${KEYCHAIN_ACCOUNT_API_KEY})`;
+    }
+    if (fs.existsSync(getApiKeyFilePath()))
+        return getApiKeyFilePath();
+    return 'Not stored';
+}

package/dist/lib/auth/device-flow.d.ts

@@ -0,0 +1,4 @@
+export declare function startDeviceFlow(options?: {
+    organizationId?: string;
+}): Promise<void>;
+//# sourceMappingURL=device-flow.d.ts.map

package/dist/lib/auth/device-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/device-flow.ts"],"names":[],"mappings":"AA4FA,wBAAsB,eAAe,CAAC,OAAO,CAAC,EAAE;IAC9C,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8DhB"}

package/dist/lib/auth/device-flow.js

@@ -0,0 +1,109 @@
+import chalk from 'chalk';
+import ora from 'ora';
+import { AUTH_BASE_URL, CLI_CLIENT_ID, OAUTH_SCOPES } from '../config.js';
+import { log } from '../output.js';
+import { fetchUserInfo } from './oauth-client.js';
+import { storeCredentials } from './token-store.js';
+async function requestDeviceCode(options) {
+    const body = {
+        client_id: CLI_CLIENT_ID,
+        scope: OAUTH_SCOPES,
+    };
+    if (options?.organizationId) {
+        body.organization_id = options.organizationId;
+    }
+    const response = await fetch(`${AUTH_BASE_URL}/api/auth/oauth/device/authorize`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+    });
+    if (!response.ok) {
+        const error = await response.json().catch(() => ({}));
+        throw new Error(`Failed to request device code: ${error.error || response.statusText}`);
+    }
+    return response.json();
+}
+async function pollForToken(deviceCode, interval, expiresIn) {
+    const deadline = Date.now() + expiresIn * 1000;
+    let pollInterval = interval * 1000;
+    while (Date.now() < deadline) {
+        await new Promise((resolve) => setTimeout(resolve, pollInterval));
+        const response = await fetch(`${AUTH_BASE_URL}/api/auth/oauth/token`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                client_id: CLI_CLIENT_ID,
+                device_code: deviceCode,
+            }),
+        });
+        if (response.ok) {
+            return response.json();
+        }
+        const error = (await response
+            .json()
+            .catch(() => ({ error: 'unknown' })));
+        switch (error.error) {
+            case 'authorization_pending':
+                // Continue polling
+                break;
+            case 'slow_down':
+                pollInterval += 5000;
+                break;
+            case 'expired_token':
+                throw new Error('Device code expired. Please try again.');
+            case 'access_denied':
+                throw new Error('Authorization was denied.');
+            default:
+                throw new Error(`Unexpected error: ${error.error}`);
+        }
+    }
+    throw new Error('Device code expired. Please try again.');
+}
+export async function startDeviceFlow(options) {
+    const spinner = ora('Requesting device code...').start();
+    const deviceCode = await requestDeviceCode(options);
+    spinner.stop();
+    // Display the user code prominently
+    log('');
+    log(chalk.bold('  To authenticate, visit:'));
+    log(`  ${chalk.cyan(deviceCode.verification_uri)}`);
+    log('');
+    log(chalk.bold('  And enter the code:'));
+    log(`  ${chalk.bold.yellow(deviceCode.user_code)}`);
+    log('');
+    log(chalk.dim(`  Or visit: ${deviceCode.verification_uri_complete}`));
+    log(chalk.dim(`  Code expires in ${Math.floor(deviceCode.expires_in / 60)} minutes.`));
+    log('');
+    const pollSpinner = ora('Waiting for authorization...').start();
+    try {
+        const tokens = await pollForToken(deviceCode.device_code, deviceCode.interval, deviceCode.expires_in);
+        pollSpinner.text = 'Fetching user info...';
+        const userInfo = await fetchUserInfo(tokens.access_token);
+        const credentials = {
+            access_token: tokens.access_token,
+            refresh_token: tokens.refresh_token,
+            token_type: tokens.token_type,
+            expires_at: Date.now() + tokens.expires_in * 1000,
+            scope: tokens.scope,
+            user: {
+                id: userInfo.sub,
+                email: userInfo.email,
+                name: userInfo.name,
+            },
+            organization: userInfo.organizations?.[0]
+                ? {
+                    id: userInfo.organizations[0].id,
+                    name: userInfo.organizations[0].name,
+                    slug: userInfo.organizations[0].slug,
+                }
+                : undefined,
+        };
+        await storeCredentials(credentials);
+        pollSpinner.succeed(`Logged in as ${chalk.cyan(userInfo.name)} (${userInfo.email})`);
+    }
+    catch (error) {
+        pollSpinner.fail('Authentication failed');
+        throw error;
+    }
+}

package/dist/lib/auth/entitlements.d.ts

@@ -0,0 +1,16 @@
+export declare function clearContributorStatusCache(): void;
+export interface ContributorStatus {
+    isContributor: boolean;
+    approved: boolean;
+    contributorId: string | null;
+}
+/**
+ * Check if the authenticated user is an approved contributor.
+ * Uses a 1-hour local cache to avoid API calls on every invocation.
+ */
+export declare function checkContributorStatus(): Promise<ContributorStatus>;
+/**
+ * Convenience: returns true only if the user is an approved contributor.
+ */
+export declare function isApprovedContributor(): Promise<boolean>;
+//# sourceMappingURL=entitlements.d.ts.map

package/dist/lib/auth/entitlements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlements.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/entitlements.ts"],"names":[],"mappings":"AA0BA,wBAAgB,2BAA2B,IAAI,IAAI,CASlD;AAoBD,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,OAAO,CAAA;IACtB,QAAQ,EAAE,OAAO,CAAA;IACjB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AA2BD;;;GAGG;AACH,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAqBzE;AAED;;GAEG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAG9D"}

package/dist/lib/auth/entitlements.js

@@ -0,0 +1,89 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { CREDENTIALS_DIR, SUPABASE_PUBLISHABLE_KEY, SUPABASE_URL, } from '../config.js';
+import { getStoredCredentials } from './token-store.js';
+const CONTRIBUTOR_MANAGE_URL = `${SUPABASE_URL}/functions/v1/contributor-manage`;
+const CACHE_TTL = 60 * 60 * 1000; // 1 hour
+function getCachePath() {
+    return path.join(os.homedir(), CREDENTIALS_DIR, 'contributor-status.json');
+}
+export function clearContributorStatusCache() {
+    try {
+        const filePath = getCachePath();
+        if (fs.existsSync(filePath)) {
+            fs.unlinkSync(filePath);
+        }
+    }
+    catch {
+        /* ignore */
+    }
+}
+function readCache(userId) {
+    try {
+        const raw = fs.readFileSync(getCachePath(), 'utf-8');
+        const cache = JSON.parse(raw);
+        if (cache.userId !== userId)
+            return null;
+        if (Date.now() - cache.checkedAt > CACHE_TTL)
+            return null;
+        return cache;
+    }
+    catch {
+        return null;
+    }
+}
+function writeCache(entry) {
+    const dir = path.join(os.homedir(), CREDENTIALS_DIR);
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    fs.writeFileSync(getCachePath(), JSON.stringify(entry), { mode: 0o600 });
+}
+async function fetchContributorStatus(accessToken) {
+    const response = await fetch(CONTRIBUTOR_MANAGE_URL, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            Authorization: `Bearer ${accessToken}`,
+            apikey: SUPABASE_PUBLISHABLE_KEY,
+        },
+        body: JSON.stringify({ action: 'check-status' }),
+    });
+    if (!response.ok) {
+        return { isContributor: false, approved: false, contributorId: null };
+    }
+    const data = (await response.json());
+    return {
+        isContributor: data.isContributor === true,
+        approved: data.approved === true,
+        contributorId: data.contributorId ?? null,
+    };
+}
+/**
+ * Check if the authenticated user is an approved contributor.
+ * Uses a 1-hour local cache to avoid API calls on every invocation.
+ */
+export async function checkContributorStatus() {
+    const credentials = await getStoredCredentials();
+    if (!credentials?.access_token) {
+        return { isContributor: false, approved: false, contributorId: null };
+    }
+    const userId = credentials.user.id;
+    const cached = readCache(userId);
+    if (cached) {
+        return {
+            isContributor: cached.isContributor,
+            approved: cached.approved,
+            contributorId: cached.contributorId,
+        };
+    }
+    const status = await fetchContributorStatus(credentials.access_token);
+    writeCache({ userId, ...status, checkedAt: Date.now() });
+    return status;
+}
+/**
+ * Convenience: returns true only if the user is an approved contributor.
+ */
+export async function isApprovedContributor() {
+    const status = await checkContributorStatus();
+    return status.approved;
+}