@zalify/cli 0.1.4 → 0.2.0

package/README.md

@@ -12,14 +12,42 @@ npm i -g @zalify/cli@latest
 
 ## Usage
 
+### Authentication
+
 ```bash
-zalify version    # Print version and check for updates
-zalify -v         # Same as --version (built-in)
-zalify --version  # Output current version only
+zalify login                                   # opens the browser: pick a workspace, authorize
+zalify login --app-url http://localhost:3000   # against a local app.zalify.com
+zalify whoami                                  # show the authorized workspace
+zalify logout                                  # delete local credentials
 ```
 
+`login` runs a loopback flow (like `gh auth login`): the CLI listens on a
+random localhost port, the browser opens `app.zalify.com/cli/auth`, and on
+approval a **workspace-scoped API key** is handed back to the CLI and stored
+in `~/.zalify/config.json` (0600). Keys are ordinary Zalify Public API keys —
+list and revoke them in **Settings → Developer**.
+
+### Assets
+
+Sync a directory's `images/*.png` with the workspace asset library
+(the same storage that backs Assets in the Zalify app):
+
+```bash
+zalify assets push <dir>      # upload new/changed files (sha256 dedup)
+zalify assets pull <dir>      # download files listed in images/assets.json
+```
+
+`push` writes `<dir>/images/assets.json` — a committed index mapping each
+file to its asset id, public URL, and checksum. `pull` restores the binaries
+on a fresh clone, so image masters stay out of git.
+
 ## Commands
 
+- **login** `[--app-url <url>]` – Browser-based authorization; stores a workspace API key locally.
+- **logout** – Deletes `~/.zalify/config.json` (revoke the key itself in Settings → Developer).
+- **whoami** – Shows the authorized workspace, app origin, and key prefix.
+- **assets push `<dir>`** – Uploads `<dir>/images/*.png` via presigned R2 PUTs; sha256 dedup; updates `assets.json`.
+- **assets pull `<dir>`** – Downloads files listed in `<dir>/images/assets.json` that are missing locally.
 - **version** – Prints `Zalify CLI version: x.x.x` and, if a newer version exists on npm, suggests running `npm i -g @zalify/cli@latest` to update.
 
 ## Development
@@ -35,17 +63,21 @@ bun run typecheck     # Type-check only
 
 ## Publishing
 
-Publishing requires `NODE_AUTH_TOKEN`. Copy `.env.example` to `.env` and set your token (do not commit `.env`). You can also set `NODE_AUTH_TOKEN` in your shell.
+CI publishes automatically (`.github/workflows/publish.yml`): pushing to
+`main` with a `package.json` version that isn't on npm yet typechecks,
+builds, publishes `@zalify/cli`, and tags the commit `v<version>`. The
+`zalify/` wrapper (for `npm i -g zalify`) is published in the same run
+whenever its own version is new. Auth is npm **Trusted Publishing** (OIDC,
+no token secret): one-time setup per package on npmjs.com — package →
+Settings → Publishing access → Add trusted publisher → GitHub Actions →
+repo `zalify/zalify-cli`, workflow `publish.yml`.
 
-Release only bumps the version in `package.json` (no git commit or tag). Commit and tag the version bump yourself if desired. Bun loads `.env` so `NODE_AUTH_TOKEN` is available.
+Release flow:
 
 ```bash
-bun run release        # Default: patch (x.x.X)
-bun run release -- -pa # Patch
-bun run release -- -mi # Minor (x.X.0)
-bun run release -- -ma # Major (X.0.0)
+npm version minor --no-git-tag-version   # or patch/major
+git commit -am "chore: release v0.x.0" && git push
 ```
 
-The release scripts load `.env` and fail with a clear error if `NODE_AUTH_TOKEN` is missing.
-
-To allow `npm i -g zalify`, publish the wrapper package after releasing `@zalify/cli`: from the repo root run `npm publish --access public` in the `zalify/` folder (it depends on `@zalify/cli` and exposes the same binary).
+`bun run release` (bump + local `npm publish`, needs `NODE_AUTH_TOKEN` in
+`.env`) remains as a manual fallback if CI is unavailable.

package/dist/cli.js

@@ -5,15 +5,29 @@ var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toESMCache_node;
+var __toESMCache_esm;
 var __toESM = (mod, isNodeMode, target) => {
+  var canCache = mod != null && typeof mod === "object";
+  if (canCache) {
+    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
+    var cached = cache.get(mod);
+    if (cached)
+      return cached;
+  }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
   for (let key of __getOwnPropNames(mod))
     if (!__hasOwnProp.call(to, key))
       __defProp(to, key, {
-        get: () => mod[key],
+        get: __accessProp.bind(mod, key),
         enumerable: true
       });
+  if (canCache)
+    cache.set(mod, to);
   return to;
 };
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
@@ -991,7 +1005,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         this._exitCallback = (err) => {
           if (err.code !== "commander.executeSubCommandAsync") {
             throw err;
-          } else {}
+          }
         };
       }
       return this;
@@ -5154,7 +5168,7 @@ var require_ini2 = __commonJS((exports) => {
 
 // node_modules/config-chain/index.js
 var require_config_chain = __commonJS((exports, module) => {
-  var __dirname = "/Users/zourenyuan/workspaces/Zalify/Eng/zalify-cli/node_modules/config-chain";
+  var __dirname = "/home/runner/work/zalify-cli/zalify-cli/node_modules/config-chain";
   var ProtoList = require_proto_list();
   var path5 = __require("path");
   var fs3 = __require("fs");
@@ -11279,22 +11293,307 @@ function updateNotifier(options) {
 
 // src/cli.ts
 import { createRequire as createRequire2 } from "node:module";
-import { dirname, join } from "node:path";
+import { dirname, join as join3 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
+
+// src/auth.ts
+import { randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { hostname } from "node:os";
+import { spawn as spawn2 } from "node:child_process";
+
+// src/config.ts
+import { readFileSync, writeFileSync as writeFileSync2, mkdirSync, rmSync, existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+var dir = join(homedir(), ".zalify");
+var file = join(dir, "config.json");
+function readConfig() {
+  if (!existsSync(file))
+    return null;
+  try {
+    return JSON.parse(readFileSync(file, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writeConfig(config) {
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  writeFileSync2(file, JSON.stringify(config, null, 2) + `
+`, { mode: 384 });
+}
+function deleteConfig() {
+  rmSync(file, { force: true });
+}
+function requireConfig() {
+  const config = readConfig();
+  if (!config?.key) {
+    throw new Error("Not logged in. Run `zalify login` first.");
+  }
+  return config;
+}
+
+// src/auth.ts
+var DEFAULT_APP_URL = "https://app.zalify.com";
+var LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+function openBrowser(url) {
+  if (process.env.ZALIFY_NO_BROWSER)
+    return;
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+  spawn2(cmd, [url], {
+    shell: process.platform === "win32",
+    stdio: "ignore",
+    detached: true
+  }).unref();
+}
+async function login(options) {
+  const base = (options.appUrl || readConfig()?.appUrl || DEFAULT_APP_URL).replace(/\/$/, "");
+  const state = randomBytes(32).toString("hex");
+  const result = await new Promise((resolvePromise, reject) => {
+    const timer = setTimeout(() => {
+      server.close();
+      reject(new Error("Login timed out after 5 minutes."));
+    }, LOGIN_TIMEOUT_MS);
+    const server = createServer((req, res) => {
+      const url = new URL(req.url ?? "/", "http://localhost");
+      if (url.pathname !== "/callback") {
+        res.writeHead(404).end();
+        return;
+      }
+      const done = (message) => {
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(`<!doctype html><meta charset="utf-8"><title>Zalify CLI</title>
+           <body style="font-family:system-ui;display:grid;place-items:center;height:100vh;margin:0">
+           <p>${message} You can close this tab.</p></body>`);
+      };
+      if (url.searchParams.get("state") !== state) {
+        done("Login failed: state mismatch.");
+        return;
+      }
+      clearTimeout(timer);
+      const error = url.searchParams.get("error");
+      if (error) {
+        done("Authorization was denied.");
+        server.close();
+        reject(new Error(`Authorization denied (${error}).`));
+        return;
+      }
+      const key = url.searchParams.get("key");
+      if (!key) {
+        done("Login failed: no key in callback.");
+        server.close();
+        reject(new Error("Callback did not include a key."));
+        return;
+      }
+      done("Logged in!");
+      server.close();
+      resolvePromise({
+        key,
+        workspaceId: url.searchParams.get("workspace_id") ?? "",
+        workspaceName: url.searchParams.get("workspace_name") ?? "",
+        workspaceSlug: url.searchParams.get("workspace_slug") ?? ""
+      });
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const { port } = server.address();
+      const authUrl = `${base}/cli/auth?port=${port}&state=${state}&host=${encodeURIComponent(hostname())}`;
+      console.log(`Opening browser to authorize the Zalify CLI…
+  ${authUrl}
+`);
+      console.log("If the browser doesn't open, visit the URL above manually.");
+      openBrowser(authUrl);
+    });
+    server.on("error", reject);
+  });
+  writeConfig({ appUrl: base, ...result, createdAt: new Date().toISOString() });
+  console.log(`✓ Logged in to workspace "${result.workspaceName || result.workspaceId}" (key stored in ~/.zalify/config.json)`);
+}
+function logout() {
+  deleteConfig();
+  console.log("✓ Logged out (local credentials deleted).");
+  console.log("  To revoke the key itself: app.zalify.com → Settings → Developer.");
+}
+function whoami() {
+  const config = requireConfig();
+  console.log(`workspace  ${config.workspaceName || "(unknown)"} [${config.workspaceId}]`);
+  console.log(`app        ${config.appUrl}`);
+  console.log(`key        ${config.key.slice(0, 16)}…`);
+}
+
+// src/assets.ts
+import { createHash } from "node:crypto";
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync3, existsSync as existsSync2, readdirSync } from "node:fs";
+import { join as join2, resolve } from "node:path";
+var BATCH = 10;
+function imagesDirFor(storeDir) {
+  const dir2 = join2(resolve(storeDir), "images");
+  if (!existsSync2(dir2))
+    throw new Error(`No images/ directory in ${storeDir}`);
+  return dir2;
+}
+function readIndex(imagesDir) {
+  const path9 = join2(imagesDir, "assets.json");
+  return existsSync2(path9) ? JSON.parse(readFileSync2(path9, "utf8")) : {};
+}
+function pngDims(buf) {
+  if (buf.length > 24 && buf.readUInt32BE(12) === 1229472850) {
+    return { width: buf.readUInt32BE(16), height: buf.readUInt32BE(20) };
+  }
+  return {};
+}
+async function assetsPull(storeDir) {
+  const imagesDir = imagesDirFor(storeDir);
+  const index = readIndex(imagesDir);
+  let pulled = 0;
+  for (const [file2, meta] of Object.entries(index)) {
+    const path9 = join2(imagesDir, file2);
+    if (existsSync2(path9))
+      continue;
+    const res = await fetch(meta.url);
+    if (!res.ok) {
+      console.error(`  ✗ ${file2}: ${res.status} from ${meta.url}`);
+      continue;
+    }
+    writeFileSync3(path9, Buffer.from(await res.arrayBuffer()));
+    pulled++;
+    console.log(`  ✓ pulled ${file2}`);
+  }
+  console.log(`Done: ${pulled} downloaded, ${Object.keys(index).length - pulled} already local.`);
+}
+async function assetsPush(storeDir) {
+  const config = requireConfig();
+  const imagesDir = imagesDirFor(storeDir);
+  const indexPath = join2(imagesDir, "assets.json");
+  const index = readIndex(imagesDir);
+  async function api(path9, body) {
+    const res = await fetch(`${config.appUrl}${path9}`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${config.key}`
+      },
+      body: JSON.stringify(body)
+    });
+    const json = await res.json().catch(() => ({}));
+    if (!res.ok)
+      throw new Error(`${path9} ${res.status}: ${JSON.stringify(json)}`);
+    return json;
+  }
+  const files = readdirSync(imagesDir).filter((f) => f.endsWith(".png")).map((name) => {
+    const bytes = readFileSync2(join2(imagesDir, name));
+    return { name, bytes, checksum: createHash("sha256").update(bytes).digest("hex") };
+  }).filter((f) => index[f.name]?.checksum !== f.checksum);
+  if (!files.length) {
+    console.log("Everything already pushed.");
+    return;
+  }
+  console.log(`Pushing ${files.length} file(s) to "${config.workspaceName || config.workspaceId}"`);
+  for (let i = 0;i < files.length; i += BATCH) {
+    const batch = files.slice(i, i + BATCH);
+    const { uploads } = await api("/api/assets/presign", {
+      workspaceId: config.workspaceId,
+      folderId: process.env.ZALIFY_FOLDER_ID ?? null,
+      files: batch.map((f) => ({
+        id: f.name,
+        name: f.name,
+        contentType: "image/png",
+        size: f.bytes.length,
+        checksum: f.checksum
+      }))
+    });
+    const toFinalize = [];
+    for (const up of uploads) {
+      const file2 = batch.find((f) => f.name === up.id);
+      if (!file2)
+        continue;
+      if (up.reused) {
+        index[file2.name] = { assetId: up.assetId, url: up.publicUrl, checksum: file2.checksum };
+        console.log(`  - ${file2.name}: deduped (already in library)`);
+        continue;
+      }
+      if (!up.uploadUrl) {
+        console.error(`  ✗ ${file2.name}: presign returned no uploadUrl`);
+        continue;
+      }
+      const put = await fetch(up.uploadUrl, {
+        method: "PUT",
+        headers: {
+          "Content-Type": "image/png",
+          "Cache-Control": "public, max-age=31536000, immutable"
+        },
+        body: new Uint8Array(file2.bytes)
+      });
+      if (!put.ok) {
+        console.error(`  ✗ ${file2.name}: R2 PUT ${put.status}`);
+        continue;
+      }
+      toFinalize.push({ file: file2, up });
+    }
+    if (toFinalize.length) {
+      const { assets, pending } = await api("/api/assets/finalize", {
+        workspaceId: config.workspaceId,
+        items: toFinalize.map(({ file: file2, up }) => ({
+          assetId: up.assetId,
+          checksum: file2.checksum,
+          ...pngDims(file2.bytes)
+        }))
+      });
+      for (const asset of assets) {
+        const hit = toFinalize.find(({ up }) => up.assetId === asset.id);
+        if (!hit)
+          continue;
+        index[hit.file.name] = { assetId: asset.id, url: asset.url, checksum: hit.file.checksum };
+        console.log(`  ✓ ${hit.file.name}`);
+      }
+      for (const id of pending ?? []) {
+        console.error(`  ✗ finalize pending (PUT missing?) assetId=${id}`);
+      }
+    }
+    writeFileSync3(indexPath, JSON.stringify(index, null, 2) + `
+`);
+  }
+  console.log("Done.");
+}
+
+// src/cli.ts
 var __dirname4 = dirname(fileURLToPath3(import.meta.url));
 var require2 = createRequire2(import.meta.url);
-var pkg = require2(join(__dirname4, "..", "package.json"));
+var pkg = require2(join3(__dirname4, "..", "package.json"));
 var program2 = new Command;
 program2.name("zalify").description("Zalify CLI - command-line interface for Zalify").version(pkg.version, "-v, --version", "output the current version");
 program2.command("version").description("Print Zalify CLI version and check for updates").action(async () => {
   console.log(`Zalify CLI version: ${pkg.version}`);
+  const isNewer = (a, b) => {
+    const pa = a.split("-")[0].split(".").map(Number);
+    const pb = b.split("-")[0].split(".").map(Number);
+    for (let i = 0;i < 3; i++) {
+      if ((pa[i] ?? 0) !== (pb[i] ?? 0))
+        return (pa[i] ?? 0) > (pb[i] ?? 0);
+    }
+    return false;
+  };
   try {
     const notifier = updateNotifier({ pkg });
     const update = await notifier.fetchInfo();
-    if (update && update.type !== "latest" && update.latest !== update.current) {
+    if (update && isNewer(update.latest, update.current)) {
       console.log(`
 A new version (${update.latest}) is available. Run "npm i -g @zalify/cli@latest" to update.`);
     }
   } catch {}
 });
-program2.parse();
+program2.command("login").description("Authenticate via the browser and store a workspace API key").option("--app-url <url>", "Zalify app origin (default: https://app.zalify.com)").action(async (options) => {
+  await login(options);
+});
+program2.command("logout").description("Delete the stored CLI credentials").action(() => logout());
+program2.command("whoami").description("Show the authorized workspace and key prefix").action(() => whoami());
+var assets = program2.command("assets").description("Sync images with the Zalify asset library");
+assets.command("push <store-dir>").description("Upload <store-dir>/images/*.png (sha256 dedup, writes assets.json)").action(async (storeDir) => {
+  await assetsPush(storeDir);
+});
+assets.command("pull <store-dir>").description("Download files listed in <store-dir>/images/assets.json").action(async (storeDir) => {
+  await assetsPull(storeDir);
+});
+program2.parseAsync().catch((err) => {
+  console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+  process.exit(1);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zalify/cli",
-  "version": "0.1.4",
+  "version": "0.2.0",
   "description": "Zalify CLI - command-line interface for Zalify",
   "type": "module",
   "main": "dist/cli.js",
@@ -16,7 +16,7 @@
   },
   "engines": {
     "node": ">=20",
-    "bun": ">=1.0"
+    "bun": ">=1.3"
   },
   "keywords": [
     "zalify",