@workflow-code/cli 0.1.0

package/dist/workspace-WJOCEGA6.js

@@ -0,0 +1,1044 @@
+#!/usr/bin/env node
+
+// src/workspace.ts
+import { spawn } from "child_process";
+import { randomUUID } from "crypto";
+import { existsSync as existsSync2 } from "fs";
+import { cp, mkdir as mkdir2, readFile as readFile2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
+import path3 from "path";
+import { fileURLToPath, pathToFileURL } from "url";
+
+// ../../shared/auth-config/index.ts
+var WORKFLOW_AUTH_FILE_NAME = "workflow-auth.json";
+var DEFAULT_MAC_PLATFORM = "darwin";
+var DEFAULT_WINDOWS_PLATFORM = "win32";
+var DEFAULT_OTHER_PLATFORM = "linux";
+function createEmptyWorkflowAuthConfig() {
+  return {
+    serverUrl: "",
+    apiKey: ""
+  };
+}
+function normalizeWorkflowAuthConfig(value) {
+  if (!isRecord(value)) {
+    return createEmptyWorkflowAuthConfig();
+  }
+  return {
+    // issue #90 Accept legacy field names (remoteUrl, token) from pre-migration
+    // config files so existing users don't lose their credentials on upgrade.
+    serverUrl: readString(value.serverUrl) ?? readString(value.remoteUrl) ?? "",
+    apiKey: readString(value.apiKey) ?? readString(value.token) ?? "",
+    expiresAt: readString(value.expiresAt),
+    user: isRecord(value.user) ? {
+      userId: readString(value.user.userId) ?? "",
+      email: readString(value.user.email) ?? "",
+      displayName: readString(value.user.displayName) ?? "",
+      avatarUrl: readString(value.user.avatarUrl)
+    } : void 0,
+    source: value.source === "device_flow" || value.source === "manual" || value.source === "password" ? value.source : void 0
+  };
+}
+function isWorkflowAuthExpiringSoon(expiresAt, options = {}) {
+  if (!expiresAt) {
+    return false;
+  }
+  const expiresAtMs = new Date(expiresAt).getTime();
+  if (!Number.isFinite(expiresAtMs)) {
+    return false;
+  }
+  const now = options.now ?? Date.now();
+  const thresholdMs = options.thresholdMs ?? 1e3 * 60 * 60 * 24 * 3;
+  return expiresAtMs - now <= thresholdMs;
+}
+function resolveWorkflowCliAuthDir(env = readProcessEnv()) {
+  if (readString(env.WORKFLOW_CLI_AUTH_DIR)) {
+    return normalizePath(env.WORKFLOW_CLI_AUTH_DIR);
+  }
+  if (readPlatform(env) === DEFAULT_WINDOWS_PLATFORM) {
+    return joinPath(
+      env.APPDATA ?? joinPath(resolveHomeDir(env), "AppData", "Roaming"),
+      "workflow-code"
+    );
+  }
+  if (readPlatform(env) === DEFAULT_MAC_PLATFORM) {
+    return joinPath(resolveHomeDir(env), "Library", "Application Support", "workflow-code");
+  }
+  return joinPath(
+    env.XDG_CONFIG_HOME ?? joinPath(resolveHomeDir(env), ".config"),
+    "workflow-code"
+  );
+}
+function resolveWorkflowCliAuthFilePath(env = readProcessEnv()) {
+  return joinPath(resolveWorkflowCliAuthDir(env), WORKFLOW_AUTH_FILE_NAME);
+}
+function resolveHomeDir(env) {
+  return env.HOME ?? "";
+}
+function readPlatform(env) {
+  return env.platform ?? readProcessPlatform();
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function readString(value) {
+  return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
+}
+function joinPath(...parts) {
+  return normalizePath(parts.filter((part) => part !== "").join("/"));
+}
+function normalizePath(value) {
+  const normalized = value.replaceAll("\\", "/");
+  if (/^[A-Za-z]:\//.test(normalized)) {
+    const drive = normalized.slice(0, 2);
+    const rest = normalized.slice(2).replace(/\/+/g, "/");
+    return `${drive}${rest.startsWith("/") ? rest : `/${rest}`}`;
+  }
+  return normalized.replace(/\/+/g, "/");
+}
+function readProcessEnv() {
+  const processValue = readGlobalProcess();
+  return {
+    ...processValue?.env ?? {},
+    platform: processValue?.platform ?? DEFAULT_OTHER_PLATFORM
+  };
+}
+function readProcessPlatform() {
+  return readGlobalProcess()?.platform ?? DEFAULT_OTHER_PLATFORM;
+}
+function readGlobalProcess() {
+  const processValue = Reflect.get(globalThis, "process");
+  if (typeof processValue !== "object" || processValue === null) {
+    return void 0;
+  }
+  return processValue;
+}
+
+// ../../shared/workflow-ids/index.ts
+import path from "path";
+var WORKFLOW_UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function isWorkflowUuid(value) {
+  return WORKFLOW_UUID_PATTERN.test(value.trim());
+}
+
+// src/auth-config.ts
+import { readFileSync } from "fs";
+import { mkdir, readFile, rm, writeFile } from "fs/promises";
+async function readCliAuthConfig(env = process.env) {
+  try {
+    const raw = await readFile(resolveWorkflowCliAuthFilePath(env), "utf8");
+    return normalizeWorkflowAuthConfig(JSON.parse(raw));
+  } catch {
+    return createEmptyWorkflowAuthConfig();
+  }
+}
+function readCliAuthConfigSync(env = process.env) {
+  try {
+    const raw = readFileSync(resolveWorkflowCliAuthFilePath(env), "utf8");
+    return normalizeWorkflowAuthConfig(JSON.parse(raw));
+  } catch {
+    return createEmptyWorkflowAuthConfig();
+  }
+}
+async function writeCliAuthConfig(config, env = process.env) {
+  await mkdir(resolveWorkflowCliAuthDir(env), { recursive: true });
+  await writeFile(
+    resolveWorkflowCliAuthFilePath(env),
+    `${JSON.stringify(normalizeWorkflowAuthConfig(config), null, 2)}
+`,
+    "utf8"
+  );
+}
+async function clearCliAuthConfig(env = process.env) {
+  await rm(resolveWorkflowCliAuthFilePath(env), { force: true });
+}
+
+// src/env.ts
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+import path2 from "path";
+import { parse } from "dotenv";
+function loadCliEnv() {
+  const cliRoot = process.cwd();
+  const defaultRepoRoot = findRepoRoot(cliRoot) ?? cliRoot;
+  const initialRepoRoot = process.env.WORKFLOW_REPO_ROOT ? path2.resolve(process.env.WORKFLOW_REPO_ROOT) : defaultRepoRoot;
+  loadEnvFiles([
+    path2.join(cliRoot, ".env"),
+    path2.join(initialRepoRoot, ".env")
+  ]);
+  const resolvedRepoRoot = process.env.WORKFLOW_REPO_ROOT ? path2.resolve(process.env.WORKFLOW_REPO_ROOT) : initialRepoRoot;
+  if (resolvedRepoRoot !== initialRepoRoot) {
+    loadEnvFiles([path2.join(resolvedRepoRoot, ".env")]);
+  }
+}
+function findRepoRoot(startDir) {
+  let current = path2.resolve(startDir);
+  while (true) {
+    if (existsSync(path2.join(current, "pnpm-workspace.yaml")) && existsSync(path2.join(current, "packages", "cli", "package.json"))) {
+      return current;
+    }
+    const parent = path2.dirname(current);
+    if (parent === current) return void 0;
+    current = parent;
+  }
+}
+function loadEnvFiles(filePaths) {
+  for (const filePath of unique(filePaths)) {
+    if (!existsSync(filePath)) {
+      continue;
+    }
+    const values = parse(readFileSync2(filePath));
+    for (const [key, value] of Object.entries(values)) {
+      if (process.env[key] === void 0) {
+        process.env[key] = value;
+      }
+    }
+  }
+}
+function unique(values) {
+  return [...new Set(values)];
+}
+
+// src/workspace.ts
+var DEFAULT_SERVER_URL = "http://localhost:7125";
+var CLI_MODULE_DIR = path3.dirname(fileURLToPath(import.meta.url));
+var DEFAULT_DEVICE_FLOW_CLIENT_NAME = "Workflow Workspace CLI";
+loadCliEnv();
+async function main(argv = process.argv.slice(2)) {
+  const parsed = parseArgs(argv);
+  switch (parsed.command) {
+    case "login":
+      await commandLogin(parsed);
+      return;
+    case "logout":
+      await commandLogout();
+      return;
+    case "status":
+      await commandStatus();
+      return;
+    case "pack":
+      await commandPack(parsed);
+      return;
+    case "upload":
+      await commandUpload(parsed);
+      return;
+    case "preparation":
+      await commandPreparation(parsed);
+      return;
+    case "run":
+      await commandRun(parsed);
+      return;
+    case "debug-node":
+      await commandDebugNode(parsed);
+      return;
+    case "download":
+      await commandDownload(parsed);
+      return;
+    case "publish":
+      await commandPublish(parsed);
+      return;
+    case "versions":
+      await commandVersions(parsed);
+      return;
+    case "health":
+      await commandHealth(parsed);
+      return;
+    case "":
+    case "help":
+    case "--help":
+    case "-h":
+      printUsage();
+      return;
+    default:
+      throw new Error(`Unknown command: ${parsed.command}`);
+  }
+}
+async function commandLogin(parsed) {
+  const server = parsed.options.server.trim();
+  if (server === "") {
+    throw new Error("login requires --server.");
+  }
+  const started = await fetchApi({
+    server,
+    token: "",
+    path: "/api/auth/device/start",
+    method: "POST",
+    body: {
+      // issue #93 phase 1 moves workspace login to device flow and stores a
+      // dedicated CLI auth file instead of sharing the App config.
+      clientName: DEFAULT_DEVICE_FLOW_CLIENT_NAME,
+      source: "cli"
+    },
+    auth: false
+  });
+  if (started.errCode !== 0 || started.data === void 0) {
+    printApiResponse(started);
+    assertApiOk(started);
+    return;
+  }
+  const verificationUrl = started.data.verificationUriComplete || started.data.verificationUri;
+  void openExternalBrowser(verificationUrl);
+  console.error(`Open the verification page to approve this login:
+${verificationUrl}
+User code: ${started.data.userCode}`);
+  const completed = await waitForDeviceToken({
+    server,
+    deviceCode: started.data.deviceCode,
+    intervalSeconds: started.data.intervalSeconds,
+    expiresAt: started.data.expiresAt
+  });
+  if (completed.errCode !== 0 || completed.data === void 0) {
+    printApiResponse(completed);
+    assertApiOk(completed);
+    return;
+  }
+  await writeCliAuthConfig({
+    serverUrl: server,
+    apiKey: completed.data.accessToken,
+    expiresAt: completed.data.expiresAt ?? completed.data.apiKey.expiresAt,
+    user: completed.data.user,
+    source: "device_flow"
+  });
+  printApiResponse({
+    errCode: 0,
+    errMessage: "",
+    data: {
+      loggedIn: true,
+      serverUrl: server,
+      user: completed.data.user,
+      expiresAt: completed.data.expiresAt ?? completed.data.apiKey.expiresAt,
+      apiKeyPrefix: completed.data.apiKey.prefix
+    }
+  });
+}
+async function commandLogout() {
+  await clearCliAuthConfig();
+  printApiResponse({ errCode: 0, errMessage: "", data: { loggedIn: false } });
+}
+async function commandStatus() {
+  const authConfig = await readCliAuthConfig();
+  printApiResponse({
+    errCode: 0,
+    errMessage: "",
+    data: {
+      loggedIn: authConfig.serverUrl.trim() !== "" && authConfig.apiKey.trim() !== "",
+      serverUrl: authConfig.serverUrl,
+      user: authConfig.user,
+      expiresAt: authConfig.expiresAt,
+      expiringSoon: isWorkflowAuthExpiringSoon(authConfig.expiresAt),
+      source: authConfig.source ?? null
+    }
+  });
+}
+async function commandPack(parsed) {
+  const workflowName = requirePositional(parsed, 0, "workflow");
+  const archivePath = await packWorkflow(workflowName, parsed.options.output, parsed.options.path);
+  console.log(JSON.stringify({ archivePath }, null, 2));
+}
+async function commandUpload(parsed) {
+  requireLogin(parsed);
+  const workflowArg = requirePositional(parsed, 0, "workflow");
+  const packageContext = await readWorkflowPackageContext(workflowArg, parsed.options.path);
+  let workflowId = packageContext.workflowId;
+  if (parsed.options.create === true) {
+    const created = await ensureWorkflowProjectCreated({
+      packageContext,
+      server: parsed.options.server,
+      token: parsed.options.token
+    });
+    workflowId = created.workflowId;
+  }
+  if (!workflowId) {
+    throw new Error("Workflow package.json must include a UUID id. Use `workflow-code workspace upload <workflow> --create` after login to create and bind a server project.");
+  }
+  const archivePath = parsed.options.file ? path3.resolve(parsed.options.file) : await packWorkflow(workflowArg, parsed.options.output, parsed.options.path);
+  const uploadResult = await uploadPackage({
+    workflowId,
+    archivePath,
+    server: parsed.options.server,
+    token: parsed.options.token
+  });
+  if (uploadResult.errCode !== 0 || uploadResult.data === void 0) {
+    printApiResponse(uploadResult);
+    assertApiOk(uploadResult);
+    return;
+  }
+  if (parsed.options.noWait === true) {
+    printApiResponse(uploadResult);
+    return;
+  }
+  const preparationResult = await waitForPreparation({
+    workflowId,
+    jobId: uploadResult.data.jobId,
+    server: parsed.options.server,
+    token: parsed.options.token
+  });
+  printApiResponse(preparationResult);
+  assertApiOk(preparationResult);
+  if (preparationResult.errCode !== 0) {
+    return;
+  }
+  if (parsed.options.releaseLog !== void 0) {
+    const publishResult = await fetchApi({
+      server: parsed.options.server,
+      token: parsed.options.token,
+      path: `/api/workflows/${encodeURIComponent(workflowId)}/publish`,
+      method: "POST",
+      body: {
+        releaseLog: parsed.options.releaseLog,
+        sourceMode: parsed.options.sourceMode ?? "bundled"
+      }
+    });
+    printApiResponse(publishResult);
+    assertApiOk(publishResult);
+  }
+}
+async function commandPreparation(parsed) {
+  requireLogin(parsed);
+  const workflowId = requirePositional(parsed, 0, "workflow");
+  const jobId = requirePositional(parsed, 1, "jobId");
+  const result = await getPreparation({
+    workflowId,
+    jobId,
+    server: parsed.options.server,
+    token: parsed.options.token
+  });
+  printApiResponse(result);
+  assertApiOk(result);
+}
+async function commandRun(parsed) {
+  requireLogin(parsed);
+  const workflowId = await resolveRemoteWorkflowId(parsed);
+  const workflowArgs = parsed.positional.slice(1);
+  const result = await fetchApi({
+    server: parsed.options.server,
+    token: parsed.options.token,
+    path: `/api/workflows/${encodeURIComponent(workflowId)}/run`,
+    method: "POST",
+    body: {
+      target: parsed.options.target ?? "latest",
+      args: workflowArgs
+    }
+  });
+  printApiResponse(result);
+  assertApiOk(result);
+}
+async function commandDebugNode(parsed) {
+  requireLogin(parsed);
+  const workflowId = await resolveRemoteWorkflowId(parsed);
+  const nodeName = requirePositional(parsed, 1, "node");
+  const workflowArgs = parsed.positional.slice(2);
+  const result = await fetchApi({
+    server: parsed.options.server,
+    token: parsed.options.token,
+    path: `/api/workflows/${encodeURIComponent(workflowId)}/debug/nodes/${encodeURIComponent(nodeName)}`,
+    method: "POST",
+    body: {
+      target: parsed.options.target ?? "latest",
+      args: workflowArgs
+    }
+  });
+  printApiResponse(result);
+  assertApiOk(result);
+}
+async function commandVersions(parsed) {
+  requireLogin(parsed);
+  const workflowId = await resolveRemoteWorkflowId(parsed);
+  const result = await fetchApi({
+    server: parsed.options.server,
+    token: parsed.options.token,
+    path: `/api/workflows/${encodeURIComponent(workflowId)}/versions`
+  });
+  printApiResponse(result);
+  assertApiOk(result);
+}
+async function commandDownload(parsed) {
+  requireLogin(parsed);
+  const workflowArg = requirePositional(parsed, 0, "workflow");
+  const workflowId = await resolveRemoteWorkflowId(parsed);
+  const target = parsed.options.target ?? "draft";
+  const result = await fetchApi({
+    server: parsed.options.server,
+    token: parsed.options.token,
+    path: `/api/workflows/${encodeURIComponent(workflowId)}/files?target=${encodeURIComponent(target)}`
+  });
+  printApiResponse(result);
+  assertApiOk(result);
+  if (result.errCode !== 0 || result.data === void 0) {
+    return;
+  }
+  const repoRoot = resolveRepoRoot();
+  const targetDir = parsed.options.path ? path3.resolve(parsed.options.path) : path3.join(repoRoot, "workspace", "workflow", workflowArg);
+  await rm2(targetDir, { recursive: true, force: true });
+  await mkdir2(targetDir, { recursive: true });
+  for (const file of result.data.files) {
+    const safePath = normalizeWorkflowFilePath(file.path);
+    const targetPath = path3.join(targetDir, safePath);
+    await mkdir2(path3.dirname(targetPath), { recursive: true });
+    await writeFile2(targetPath, file.content);
+  }
+}
+async function commandPublish(parsed) {
+  requireLogin(parsed);
+  const workflowId = await resolveRemoteWorkflowId(parsed);
+  const publishResult = await fetchApi({
+    server: parsed.options.server,
+    token: parsed.options.token,
+    path: `/api/workflows/${encodeURIComponent(workflowId)}/publish`,
+    method: "POST",
+    body: {
+      releaseLog: parsed.options.releaseLog,
+      sourceMode: parsed.options.sourceMode ?? "bundled"
+    }
+  });
+  printApiResponse(publishResult);
+  assertApiOk(publishResult);
+}
+async function commandHealth(parsed) {
+  const result = await fetchApi({
+    server: parsed.options.server,
+    token: "",
+    path: "/health",
+    auth: false
+  });
+  printApiResponse(result);
+  assertApiOk(result);
+}
+async function packWorkflow(workflowName, outputPath, sourcePath) {
+  const repoRoot = resolveRepoRoot();
+  const workflowDir = sourcePath === void 0 ? path3.join(repoRoot, "workspace", "workflow", workflowName) : path3.resolve(sourcePath);
+  if (!existsSync2(path3.join(workflowDir, "README.md"))) {
+    throw new Error(`Workflow project "${workflowDir}" must contain README.md before upload.`);
+  }
+  const packsDir = process.env.WORKFLOW_WORKSPACE_PACKS_DIR ? path3.resolve(process.env.WORKFLOW_WORKSPACE_PACKS_DIR) : path3.join(repoRoot, "workspace", ".packs");
+  const stagingDir = path3.join(packsDir, "tmp", randomUUID(), workflowName);
+  const archivePath = outputPath ? path3.resolve(outputPath) : path3.join(packsDir, `${workflowName}-${createTimestamp()}.tgz`);
+  const workspaceRoot = sourcePath === void 0 ? path3.join(repoRoot, "workspace", "workflow") : path3.dirname(workflowDir);
+  await rm2(path3.dirname(stagingDir), { recursive: true, force: true });
+  await mkdir2(path3.join(stagingDir, "workspace", "workflow"), { recursive: true });
+  await mkdir2(path3.dirname(archivePath), { recursive: true });
+  await stageWorkflowWithLocalDependencies({
+    workspaceRoot,
+    workflowDir,
+    workflowName,
+    stagingRoot: path3.join(stagingDir, "workspace", "workflow")
+  });
+  const result = await runCommand("tar", ["-czf", archivePath, "-C", stagingDir, "."], {
+    cwd: repoRoot
+  });
+  await rm2(path3.dirname(stagingDir), { recursive: true, force: true });
+  if (result.exitCode !== 0) {
+    throw new Error(`Failed to create archive: ${result.stderr || result.stdout}`);
+  }
+  return archivePath;
+}
+async function resolveRemoteWorkflowId(parsed) {
+  const workflowArg = requirePositional(parsed, 0, "workflow");
+  if (isWorkflowUuid(workflowArg)) {
+    return workflowArg;
+  }
+  const packageContext = await readWorkflowPackageContext(workflowArg, parsed.options.path);
+  if (packageContext.workflowId) {
+    return packageContext.workflowId;
+  }
+  throw new Error(`Workflow "${workflowArg}" is not bound to a server UUID. Create or bind it first with \`workflow-code workspace upload ${workflowArg} --create\`.`);
+}
+async function readWorkflowPackageContext(workflowArg, sourcePath) {
+  const repoRoot = resolveRepoRoot();
+  const workflowDir = sourcePath === void 0 ? path3.join(repoRoot, "workspace", "workflow", workflowArg) : path3.resolve(sourcePath);
+  const packageJsonPath = path3.join(workflowDir, "package.json");
+  const packageJson = await readPackageJsonFile(packageJsonPath);
+  const workflowId = typeof packageJson.id === "string" && isWorkflowUuid(packageJson.id) ? packageJson.id.trim() : void 0;
+  const workflowName = readRequiredPackageString(packageJson, "name");
+  return {
+    workflowArg,
+    workflowDir,
+    packageJsonPath,
+    workflowId,
+    workflowName,
+    packageJson
+  };
+}
+async function ensureWorkflowProjectCreated(options) {
+  const created = await fetchApi({
+    server: options.server,
+    token: options.token,
+    path: "/api/workflows",
+    method: "POST",
+    body: {
+      name: options.packageContext.workflowName,
+      ...options.packageContext.workflowId ? { workflowId: options.packageContext.workflowId } : {}
+    }
+  });
+  if (created.errCode !== 0 || created.data === void 0) {
+    printApiResponse(created);
+    assertApiOk(created);
+    throw new Error("Workflow project creation failed.");
+  }
+  if (!options.packageContext.workflowId || options.packageContext.workflowId !== created.data.workflowId) {
+    await writeWorkflowPackageId(options.packageContext.packageJsonPath, created.data.workflowId);
+  }
+  return created.data;
+}
+async function readPackageJsonFile(packageJsonPath) {
+  try {
+    const raw = JSON.parse(await readFile2(packageJsonPath, "utf8"));
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+      throw new Error(`Workflow package "${packageJsonPath}" must contain a JSON object.`);
+    }
+    return raw;
+  } catch (error) {
+    if (error instanceof Error) {
+      throw error;
+    }
+    throw new Error(`Unable to read workflow package "${packageJsonPath}".`);
+  }
+}
+function readRequiredPackageString(packageJson, key) {
+  const value = packageJson[key];
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new Error(`Workflow package.json must include string "${key}".`);
+  }
+  return value.trim();
+}
+async function writeWorkflowPackageId(packageJsonPath, workflowId) {
+  const packageJson = await readPackageJsonFile(packageJsonPath);
+  await writeFile2(
+    packageJsonPath,
+    `${JSON.stringify({
+      ...packageJson,
+      id: workflowId
+    }, null, 2)}
+`
+  );
+}
+async function uploadPackage(options) {
+  const archiveBuffer = await readFile2(options.archivePath);
+  const archiveName = path3.basename(options.archivePath);
+  const response = await fetch(
+    `${trimTrailingSlash(options.server)}/api/workflows/${encodeURIComponent(options.workflowId)}/package?fileName=${encodeURIComponent(archiveName)}`,
+    {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${options.token}`,
+        "content-type": "application/octet-stream",
+        "x-workflow-package-name": archiveName
+      },
+      body: new Blob([archiveBuffer])
+    }
+  );
+  return response.json();
+}
+async function waitForPreparation(options) {
+  let previousStage = "";
+  while (true) {
+    const response = await fetchApi({
+      server: options.server,
+      token: options.token,
+      path: `/api/workflows/${encodeURIComponent(options.workflowId)}/preparations/${encodeURIComponent(options.jobId)}`
+    });
+    if (response.errCode !== 0 || response.data === void 0) {
+      return response;
+    }
+    if (response.data.stage !== previousStage) {
+      previousStage = response.data.stage;
+      process.stderr.write(`Preparation ${response.data.status}: ${response.data.stage}
+`);
+    }
+    if (response.data.status === "success") {
+      return {
+        errCode: 0,
+        errMessage: "",
+        data: response.data.result
+      };
+    }
+    if (response.data.status === "failed") {
+      return {
+        errCode: 500,
+        errMessage: response.data.failureReason ?? `Preparation failed during ${response.data.stage}.`,
+        data: response.data
+      };
+    }
+    await delay(options.pollIntervalMs ?? 1e3);
+  }
+}
+async function getPreparation(options) {
+  return fetchApi({
+    server: options.server,
+    token: options.token,
+    path: `/api/workflows/${encodeURIComponent(options.workflowId)}/preparations/${encodeURIComponent(options.jobId)}`
+  });
+}
+async function fetchApi(options) {
+  const headers = {};
+  if (options.auth !== false) {
+    headers.authorization = `Bearer ${options.token}`;
+  }
+  if (options.body !== void 0) {
+    headers["content-type"] = "application/json";
+  }
+  const response = await fetch(`${trimTrailingSlash(options.server)}${options.path}`, {
+    method: options.method ?? "GET",
+    headers,
+    body: options.body === void 0 ? void 0 : JSON.stringify(options.body)
+  });
+  return response.json();
+}
+async function copyWorkflowSource(sourceDir, targetDir) {
+  await cp(sourceDir, targetDir, {
+    recursive: true,
+    filter(source) {
+      const relative = path3.relative(sourceDir, source);
+      return relative === "" || !shouldExcludePackagePath(relative);
+    }
+  });
+}
+async function stageWorkflowWithLocalDependencies(options) {
+  const queue = [options.workflowName];
+  const visited = /* @__PURE__ */ new Set();
+  while (queue.length > 0) {
+    const currentWorkflowName = queue.shift();
+    if (!currentWorkflowName || visited.has(currentWorkflowName)) {
+      continue;
+    }
+    visited.add(currentWorkflowName);
+    const sourceDir = currentWorkflowName === options.workflowName ? options.workflowDir : path3.join(options.workspaceRoot, currentWorkflowName);
+    if (!existsSync2(path3.join(sourceDir, "package.json"))) {
+      throw new Error(
+        `Workflow "${options.workflowName}" references local workflow "${currentWorkflowName}", but ${sourceDir} is missing package.json.`
+      );
+    }
+    await copyWorkflowSource(sourceDir, path3.join(options.stagingRoot, currentWorkflowName));
+    for (const dependency of await findLocalWorkflowDependencies(sourceDir)) {
+      if (!visited.has(dependency)) {
+        queue.push(dependency);
+      }
+    }
+  }
+}
+async function findLocalWorkflowDependencies(sourceDir) {
+  const discovered = /* @__PURE__ */ new Set();
+  for (const fileName of ["index.ts", "interface.ts", "globals.d.ts"]) {
+    const filePath = path3.join(sourceDir, fileName);
+    if (!existsSync2(filePath)) {
+      continue;
+    }
+    const source = await readFile2(filePath, "utf8");
+    for (const match of source.matchAll(/(?:from\s+|reference path=)\"(\.\.\/([^/\"']+)(?:\/[^\"']*)?)\"/g)) {
+      const workflowName = match[2]?.trim();
+      if (workflowName) {
+        discovered.add(workflowName);
+      }
+    }
+    for (const match of source.matchAll(/(?:from\s+|reference path=)'(\.\.\/([^/'"]+)(?:\/[^'"]*)?)'/g)) {
+      const workflowName = match[2]?.trim();
+      if (workflowName) {
+        discovered.add(workflowName);
+      }
+    }
+  }
+  return [...discovered].sort((left, right) => left.localeCompare(right));
+}
+function shouldExcludePackagePath(relativePath) {
+  const parts = relativePath.split(/[\\/]/);
+  const name = parts.at(-1) ?? "";
+  const excludedDirectories = /* @__PURE__ */ new Set([
+    "node_modules",
+    "dist",
+    "build",
+    "out",
+    "coverage",
+    ".git",
+    ".hg",
+    ".svn",
+    ".cache",
+    ".turbo",
+    ".next",
+    ".nuxt",
+    ".pnpm-store"
+  ]);
+  if (parts.some((part) => excludedDirectories.has(part))) {
+    return true;
+  }
+  if (name === ".env" || name.startsWith(".env.")) {
+    return name !== ".env.example";
+  }
+  return name === ".DS_Store" || name === "Thumbs.db" || name.endsWith(".tmp") || name.endsWith(".log") || name.endsWith(".tsbuildinfo") || name.endsWith("~");
+}
+function normalizeWorkflowFilePath(filePath) {
+  const normalized = filePath.replaceAll("\\", "/").replace(/^\.\/+/, "");
+  if (normalized === "" || normalized.startsWith("/") || /^[a-zA-Z]:/.test(normalized) || normalized.split("/").some((part) => part === "" || part === "." || part === "..") || shouldExcludePackagePath(normalized)) {
+    throw new Error(`Invalid workflow file path "${filePath}".`);
+  }
+  return normalized;
+}
+function parseArgs(argv) {
+  const [command = "", ...rest] = argv;
+  const positional = [];
+  const authConfig = readCliAuthConfigSync();
+  const options = {
+    server: process.env.WORKFLOW_SERVER_URL ?? authConfig.serverUrl ?? DEFAULT_SERVER_URL,
+    token: process.env.WORKFLOW_SERVER_ADMIN_KEY ?? authConfig.apiKey ?? ""
+  };
+  for (let index = 0; index < rest.length; index += 1) {
+    const arg = rest[index];
+    switch (arg) {
+      case "--server":
+        options.server = requireValue(rest, index += 1, "--server");
+        break;
+      case "--token":
+        options.token = requireValue(rest, index += 1, "--token");
+        break;
+      case "--target":
+        options.target = requireValue(rest, index += 1, "--target");
+        break;
+      case "--version":
+        throw new Error("--version is no longer supported. Publish versions are managed by the system.");
+      case "--release-log":
+        options.releaseLog = requireValue(rest, index += 1, "--release-log");
+        break;
+      case "--file":
+        options.file = requireValue(rest, index += 1, "--file");
+        break;
+      case "--output":
+        options.output = requireValue(rest, index += 1, "--output");
+        break;
+      case "--path":
+        options.path = requireValue(rest, index += 1, "--path");
+        break;
+      case "--create":
+        options.create = true;
+        break;
+      case "--no-wait":
+        options.noWait = true;
+        break;
+      case "--source-mode": {
+        const value = requireValue(rest, index += 1, "--source-mode");
+        if (value !== "bundled" && value !== "source") {
+          throw new Error('--source-mode must be "bundled" or "source".');
+        }
+        options.sourceMode = value;
+        break;
+      }
+      default:
+        positional.push(arg);
+        break;
+    }
+  }
+  if (command === "upload" && options.noWait === true && options.releaseLog !== void 0) {
+    throw new Error("--no-wait cannot be combined with --release-log because publishing requires a prepared draft.");
+  }
+  return {
+    command,
+    positional,
+    options
+  };
+}
+function requireLogin(parsed) {
+  if (parsed.options.server.trim() === "" || parsed.options.token.trim() === "") {
+    throw new Error("Not logged in. Run: workspace login --server <url> or pass --token / WORKFLOW_SERVER_ADMIN_KEY.");
+  }
+}
+function requirePositional(parsed, index, name) {
+  const value = parsed.positional[index];
+  if (value === void 0 || value.trim() === "") {
+    throw new Error(`Missing ${name}.`);
+  }
+  return value;
+}
+function requireValue(argv, index, name) {
+  const value = argv[index];
+  if (value === void 0 || value.trim() === "") {
+    throw new Error(`Missing value for ${name}.`);
+  }
+  return value;
+}
+function runCommand(command, args, options = {}) {
+  return new Promise((resolve) => {
+    const child = spawn(command, args, {
+      cwd: options.cwd,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const stdout = [];
+    const stderr = [];
+    child.stdout.on("data", (chunk) => stdout.push(chunk));
+    child.stderr.on("data", (chunk) => stderr.push(chunk));
+    child.on("error", (error) => {
+      resolve({
+        exitCode: 1,
+        stdout: Buffer.concat(stdout).toString("utf8"),
+        stderr: `${Buffer.concat(stderr).toString("utf8")}${error.message}`
+      });
+    });
+    child.on("close", (exitCode) => {
+      resolve({
+        exitCode: exitCode ?? 1,
+        stdout: Buffer.concat(stdout).toString("utf8"),
+        stderr: Buffer.concat(stderr).toString("utf8")
+      });
+    });
+  });
+}
+function printApiResponse(response) {
+  console.log(JSON.stringify(response, null, 2));
+}
+function assertApiOk(response) {
+  if (response.errCode !== 0) {
+    if (response.errCode === 403) {
+      process.stderr.write(`${formatForbiddenMessage(response)}
+`);
+    }
+    process.exitCode = 1;
+  }
+}
+function formatForbiddenMessage(response) {
+  const message = response.errMessage.toLowerCase();
+  if (message.includes("blocked from running")) {
+    return "403: \u5F53\u524D\u8D26\u53F7\u5DF2\u88AB\u8BE5\u9879\u76EE\u7981\u6B62\u8FD0\u884C\u3002";
+  }
+  if (message.includes("permission denied")) {
+    return "403: \u5F53\u524D\u8D26\u53F7\u5BF9\u8BE5\u9879\u76EE\u6CA1\u6709\u8DB3\u591F\u6743\u9650\u3002";
+  }
+  return `403: ${response.errMessage}`;
+}
+function printUsage() {
+  console.log([
+    "Usage: workflow-code workspace <command> [args]",
+    "",
+    "Local repo wrapper:",
+    "  pnpm -C workspace workspace <command> [args]",
+    "",
+    "Commands:",
+    "  login --server <url>",
+    "  logout",
+    "  status",
+    "  health",
+    "  pack <workflow> [--path <workflow-dir>] [--output <file.tgz>]",
+    "  upload <workflow> [--path <workflow-dir>] [--file <archive>] [--release-log <text>] [--source-mode bundled|source] [--no-wait] [--create]",
+    "  preparation <workflow-id> <job-id>",
+    "  download <workflow> [--target draft|latest|version] [--path <dir>]",
+    "  publish <workflow> [--release-log <text>] [--source-mode bundled|source]",
+    "  run <workflow> [...args] [--target draft|latest|version]",
+    "  debug-node <workflow> <node> [...args] [--target draft|latest|version]",
+    "  versions <workflow>",
+    "",
+    "Options:",
+    "  --server <url>   Defaults to WORKFLOW_SERVER_URL, saved CLI auth, or http://localhost:7125",
+    "  --token <token>  Optional manual override. Defaults to WORKFLOW_SERVER_ADMIN_KEY or saved CLI auth API key"
+  ].join("\n"));
+}
+function resolveRepoRoot(startDir = process.cwd()) {
+  if (process.env.WORKFLOW_REPO_ROOT !== void 0) {
+    return path3.resolve(process.env.WORKFLOW_REPO_ROOT);
+  }
+  for (const candidate of [startDir, CLI_MODULE_DIR]) {
+    const repoRoot = findRepoRoot2(candidate);
+    if (repoRoot !== void 0) {
+      return repoRoot;
+    }
+  }
+  return process.cwd();
+}
+function findRepoRoot2(startDir) {
+  let current = path3.resolve(startDir);
+  while (true) {
+    if (isRepoRoot(current)) {
+      return current;
+    }
+    const parent = path3.dirname(current);
+    if (parent === current) {
+      return void 0;
+    }
+    current = parent;
+  }
+}
+function isRepoRoot(candidate) {
+  return existsSync2(path3.join(candidate, "pnpm-workspace.yaml")) && existsSync2(path3.join(candidate, "package.json")) && existsSync2(path3.join(candidate, "workspace", "package.json")) && existsSync2(path3.join(candidate, "packages", "cli", "package.json"));
+}
+function trimTrailingSlash(value) {
+  return value.replace(/\/+$/, "");
+}
+function createTimestamp() {
+  const date = /* @__PURE__ */ new Date();
+  const pad = (value) => String(value).padStart(2, "0");
+  return [
+    date.getUTCFullYear(),
+    pad(date.getUTCMonth() + 1),
+    pad(date.getUTCDate()),
+    "-",
+    pad(date.getUTCHours()),
+    pad(date.getUTCMinutes()),
+    pad(date.getUTCSeconds())
+  ].join("");
+}
+async function waitForDeviceToken(options) {
+  const expiresAtMs = new Date(options.expiresAt).getTime();
+  const pollMs = Math.max(1e3, options.intervalSeconds * 1e3);
+  while (!Number.isFinite(expiresAtMs) || Date.now() < expiresAtMs) {
+    const response = await fetchApi({
+      server: options.server,
+      token: "",
+      path: "/api/auth/device/token",
+      method: "POST",
+      body: { deviceCode: options.deviceCode },
+      auth: false
+    });
+    if (response.errCode === 0) {
+      return response;
+    }
+    if (response.errMessage === "slow_down") {
+      const retryAfterSeconds = readRetryAfterSeconds(response.data) ?? Math.max(options.intervalSeconds * 2, 5);
+      await delay(retryAfterSeconds * 1e3);
+      continue;
+    }
+    if (response.errMessage !== "authorization_pending") {
+      return response;
+    }
+    await delay(pollMs);
+  }
+  return {
+    errCode: 409,
+    errMessage: "expired_token"
+  };
+}
+async function openExternalBrowser(url) {
+  const commands = process.platform === "darwin" ? [["open", url]] : process.platform === "win32" ? [["cmd", "/c", "start", "", url]] : [["xdg-open", url]];
+  for (const [command, ...args] of commands) {
+    const result = await runCommand(command, args);
+    if (result.exitCode === 0) {
+      return;
+    }
+  }
+}
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function readRetryAfterSeconds(data) {
+  if (typeof data !== "object" || data === null) {
+    return void 0;
+  }
+  const value = data.retryAfterSeconds;
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : void 0;
+}
+if (process.argv[1] !== void 0 && import.meta.url === pathToFileURL(path3.resolve(process.argv[1])).href) {
+  main().catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  });
+}
+export {
+  ensureWorkflowProjectCreated,
+  findLocalWorkflowDependencies,
+  formatForbiddenMessage,
+  getPreparation,
+  main,
+  normalizeWorkflowFilePath,
+  packWorkflow,
+  parseArgs,
+  readPackageJsonFile,
+  readWorkflowPackageContext,
+  resolveRemoteWorkflowId,
+  resolveRepoRoot,
+  stageWorkflowWithLocalDependencies,
+  waitForDeviceToken,
+  waitForPreparation,
+  writeWorkflowPackageId
+};