@zalosai/zalos-cli 0.2.13

package/PUBLISHING.md

@@ -0,0 +1,97 @@
+# Releasing `@zalosai/zalos-cli`
+
+Releases are published to the public npm registry by the `Publish Zalos CLI`
+GitHub Actions workflow. The package remains API-only: installing it grants no
+Zalos product access.
+
+## Prerequisites
+
+- The release commit must be merged into `develop`.
+- The package version must not already exist in npm.
+- The repository `NPM_TOKEN` secret must have publish access to
+  `@zalosai/zalos-cli` on npm.
+
+## Release
+
+1. Bump the version without creating a Git tag:
+
+   ```bash
+   pnpm --filter @zalosai/zalos-cli exec npm version patch --no-git-tag-version
+   ```
+
+   Use `minor` or `major` instead of `patch` when appropriate.
+
+2. Run the package checks at the new version:
+
+   ```bash
+   pnpm --filter @zalosai/zalos-cli test
+   pnpm --filter @zalosai/zalos-cli typecheck
+   pnpm --filter @zalosai/zalos-cli build
+   pnpm --filter @zalosai/zalos-cli smoke:package
+   ```
+
+   Commit the version and release changes through the normal pull-request process.
+
+3. From the merged release commit, inspect the tarball:
+
+   ```bash
+   pnpm --filter @zalosai/zalos-cli exec npm pack --dry-run
+   ```
+
+   Only `package.json`, `README.md`, `PUBLISHING.md`, and runtime JavaScript under `dist/`
+   should be included.
+
+4. In GitHub, open **Actions → Publish Zalos CLI → Run workflow**.
+   Select `develop` and enter the exact version from `package.json`. The workflow rejects
+   non-`develop` refs, mismatched versions, and versions that already exist.
+
+5. Verify from a clean machine or isolated environment:
+
+   ```bash
+   npm install --global @zalosai/zalos-cli@<version>
+   zl --version
+   zl --help
+   zl schema task
+   ```
+
+Do not publish with uncommitted package changes or reuse an existing version.
+
+## Central developer access release
+
+Version 0.2.13 adds revision-safe Markdown import and export for team Pages. It converts common
+Tiptap process-document structures while rejecting unsupported stored nodes during export, and uses
+the `pages:read` and `pages:write` scopes for least-privilege API access.
+Version 0.2.12 exposes immutable team public IDs and accepts them for team switching and trusted
+cross-team Team Files operations while retaining internal UUID compatibility.
+Version 0.2.11 adds authenticated immutable execution-artifact downloads. The command resolves a
+short-lived URL through the execution-artifact API, writes a new private file, and never prints the
+signed URL. Version 0.2.10 lets `file seed` explicitly read prior agent results from the source team's
+`generated-outputs` folder scope while continuing to write normal Team Files in the destination.
+Version 0.2.9 makes Team Files seeding checksum-bound and resumable, and prevents retries from
+reusing object keys that may have a queued deletion. Version 0.2.8 adds preview-first, server-side
+Team Files seeding from an explicit source team into the selected destination team, with collision
+refusal and preserved subtree paths.
+Version 0.2.7 adds browser-authorized, scope- and expiry-bound API token provisioning through
+`zl api-token create`, without database credentials or a database tunnel.
+Version 0.2.6 excludes archived projects from `project list` by default and adds
+`--include-archived` for historical lookup.
+Version 0.2.5 preserves the server's expiry and membership errors for `team switch` while
+other commands retain generic authentication failures. Version 0.2.4 adds authenticated
+team selection without reopening browser login.
+Version 0.2.3 adds authenticated Team Files downloads and removes direct S3 access from the
+operator retrieval path. Version 0.2.2 adds internal cross-team workflow, team, and Team Files
+metadata commands.
+Deploy the corresponding regional API routes before publishing or advertising these commands.
+Version 0.2.1 requires the corresponding scoped-token API deployment and database
+scope-version migration before human login. Keep `@zalos-io/developer-db` as a separately
+versioned private npm package; the Zalos CLI tarball must not bundle its AWS/database
+dependencies. Publish database-tool releases through the `Publish Developer DB` workflow.
+
+After merge and publication, use an isolated installation for staging setup/doctor,
+workflow/execution reads, and a dedicated staging workflow mutation. Verify US and EU
+reads independently; do not run production mutation smoke tests. Record the release
+SHA, package version, and regional results before advertising the release.
+
+Owner-managed bot rotation and the one-release compatibility observation window are
+required before removing legacy Mesh product commands. Pin the previous immutable npm
+versions for rollback, retaining the Mesh compatibility release.

package/README.md

@@ -0,0 +1,231 @@
+# Zalos CLI
+
+`zl` is the globally installed, API-only product CLI. Use it from any repository.
+It emits JSON on stdout, structured errors on stderr, and nonzero exit codes on failure.
+`zalos-db` separately owns query-only database and stdio MCP access through AWS Identity Center.
+`mesh` remains the repository-local operator and runtime CLI.
+
+## Install
+
+Requires Node.js 22 or newer. The product CLI is public on npm and does not
+require GitHub CLI or GitHub Packages access.
+
+```bash
+npm install --global @zalosai/zalos-cli@0.2.13
+```
+
+Installing the CLI does not grant access.
+
+## First run
+
+```bash
+zl --environment staging auth login
+# Equivalent regional choices:
+zl --environment us-prod auth login
+zl --environment eu-prod auth login
+```
+
+`auth login` opens the existing browser sign-in and stores the scoped human session.
+It never changes access-group membership. Database access remains an optional,
+separately distributed developer capability:
+
+```bash
+npm login --scope=@zalos-io --auth-type=legacy --registry=https://npm.pkg.github.com
+npm install --global @zalos-io/developer-db@0.3.2
+zalos-db login --environment staging
+```
+
+Every remote command requires `--environment staging|us-prod|eu-prod` or an explicit
+`ZL_ENVIRONMENT`. The origins are respectively `dev.app.zalos.ai`, `app.zalos.ai`,
+and `app.eu.zalos.ai`. There is no regional fallback. `--api-url` accepts an explicit
+loopback origin for local development only; `ZL_API_URL` is not an override.
+
+Human browser tokens are team-scoped and expire after seven days. `team list` shows
+the active teams and immutable public IDs available to the signed-in user, and
+`team switch <team-ref>` changes
+the selected profile to one of those teams without another browser login. The switch
+preserves the session's original expiry and token scopes. Profiles live at
+`$XDG_CONFIG_HOME/zalos/credentials.json` (default `~/.config/zalos/credentials.json`),
+with directory mode 0700 and file mode 0600. Symbolic links are rejected. There is no
+Keychain integration. Use `--profile` for multiple teams/environments. Legacy profiles
+must be renewed with `auth login`. `auth logout` attempts server revocation and clears
+the local profile even if the server cannot be reached, reporting that failure.
+
+AWS portal sessions and permission-set credentials have independent expiry policies.
+When AWS access expires, rerun `zalos-db login --environment <name>`; this does not renew
+your Mesh token. Database reader groups are `zalos-db-staging-readers`,
+`zalos-db-us-prod-readers`, and `zalos-db-eu-prod-readers`.
+
+## Product operations
+
+```bash
+export ZL_ENVIRONMENT=staging
+zl workflow list --fields id,name
+zl workflow list --all-teams --limit 100
+zl workflow view <id>
+zl workflow export --all-teams --pretty --output /tmp/mesh-staging-workflows.json
+zl workflow publish <workflow-id> --apply
+zl execution list --limit 1
+zl execution view <id>
+zl execution summary <id>
+zl execution artifact download <artifact-id> --output /tmp/artifact
+zl page list --fields id,title,updatedAt
+zl page export <page-id> --output /tmp/month-end-close.md
+zl page create --input /tmp/month-end-close.md --apply
+zl page update <page-id> --input /tmp/month-end-close.md --apply
+zl workflow run <id> --dry-run
+zl workflow run <id>
+zl template list
+zl credential list
+zl file list
+zl team list
+zl team switch <team-ref>
+zl team list --all-teams
+zl file tree --team-id <team-ref>
+zl file find <query> --team-id <team-ref>
+zl file inspect <file-id> --team-id <team-ref>
+zl file download <file-id> --team-id <team-ref> --output /tmp/file
+zl file snapshot --team-id <team-ref> --output /tmp/team-files.json
+zl file seed --source-team-id <team-ref> --source-path /Fixtures --target-path /Rehearsal
+zl file seed --source-team-id <team-ref> --source-scope generated-outputs --source-path /__mesh/outputs/<execution-id> --target-path /Priors
+zl file seed --source-team-id <team-ref> --source-path /Fixtures --target-path /Rehearsal --apply --expected-checksum <sha256>
+```
+
+Workflow import/update/publish require `--apply`; without it they validate and print a preview.
+`workflow run` executes unless `--dry-run` is supplied. Product authorization comes
+from the signed-in human's team membership, role, and token scopes. Credential reads
+return metadata only. No product command loads database credentials.
+
+For protected workflows, `workflow update --apply` saves a draft. Its response reports
+whether runs use that version and names the live version when they do not. Use
+`workflow publish <workflow-id> --apply` to promote the current draft. `workflow export`
+keeps stdout as reusable workflow JSON and writes a structured stderr warning when the
+exported draft differs from the version used by runs.
+
+`workflow list --all-teams` and `workflow export --all-teams` read every workflow in
+the selected regional database. They require an internal Zalos human CLI token with
+`workflows:read`; external users and automation tokens are rejected. `workflow export --all`
+remains scoped to the selected profile's team. Run cross-team reads separately
+for `us-prod` and `eu-prod` when both production regions are needed. Cross-team exports
+include each workflow's server checksum so the file can be used with `workflow update`,
+including a content-derived baseline for legacy rows that predate stored checksums.
+
+All human users can discover their active memberships with `team list` and select one
+with `team switch <team-ref>`. Prefer the listed immutable `publicId`, such as
+`tm_4ERk9QxW`; legacy internal UUIDs remain accepted. Treat public IDs as opaque strings—
+their suffix length is not an API contract, and they are not database foreign keys.
+Mutating commands then use that selected team context.
+Internal human developers can also discover regional team IDs with `team list --all-teams`
+and use an explicit ID with `file tree`, `find`, `inspect`, `download`, or `snapshot`.
+Downloads request a short-lived URL through the authenticated API and write to a new private
+file; they do not require direct S3 access. File moves remain scoped to the selected team profile.
+Execution artifact downloads use the same private-file and no-overwrite guarantees. Select the
+artifact's team before downloading; the immutable artifact API enforces that team boundary.
+`page export` writes a Markdown process document with a non-rendered revision marker. Edit the
+Markdown, then use `page update --apply`; it refuses an update when the Page changed after export.
+`page create` and `page update` both preview by default and preserve common Tiptap process-document
+structures such as headings, lists, checklists, quotes, code blocks, links, and emphasis.
+Exports reject unsupported inline content, combined marks, and nested or multi-block list items so a
+Markdown edit cannot silently discard Page content.
+`file seed` copies a source file or subtree into the selected team with server-side storage copies.
+Use `--source-scope generated-outputs` to carry prior-period agent outputs into normal Team Files;
+the default source scope is `files`.
+It previews the complete path mapping and checksum by default. Apply the reviewed checksum with
+`--apply --expected-checksum <sha256>`; changed inventories are rejected. The command preserves
+paths below the selected source, creates independent destination files, resumes files already
+copied by the same plan, and blocks on unrelated destination collisions. Switch to the rehearsal
+team before applying the plan.
+
+```bash
+printf 'SELECT current_database()' | zalos-db query --environment staging
+zalos-db mcp --environment eu-prod
+```
+
+Database queries retain the 500-row ceiling, read-only transaction, five-second
+statement timeout, and rollback. Each MCP process is pinned to one environment.
+
+## Automation
+
+Use scoped bot tokens injected into `ZL_API_TOKEN` and set `ZL_ENVIRONMENT` explicitly.
+Automation never reads or writes human profiles. Do not save bot tokens with browser
+login or reuse human credentials for unattended work. Existing legacy bot tokens retain
+compatibility during deliberate owner-managed rotation; new tokens use explicit scopes.
+Server-provisioned team bots retain their existing runtime API access through a reserved
+`automation:internal` scope. Only internal team provisioning can issue it; browser CLI
+login and public token creation cannot request it. Team/resource authorization still applies.
+
+## Manage Motion
+
+Resolve IDs before creating or updating tasks:
+
+```bash
+zl project list --fields id,name
+zl state list --project-id <project-id> --fields id,name,type
+zl task list --project-id <project-id> --fields id,title,stateId
+```
+
+Inspect accepted fields, preview a mutation, and then apply it:
+
+```bash
+zl schema task
+
+zl task create --project-id <project-id> \
+  --json '{"title":"Fix login bug","priority":"high"}' \
+  --dry-run
+
+zl task create --project-id <project-id> \
+  --json '{"title":"Fix login bug","priority":"high"}'
+```
+
+`zl task view`, `create`, `update`, and `move` include a canonical `url` in their response.
+Move a task without manually reconstructing its project state or link:
+
+```bash
+zl task move <task-id> --project-id <target-project-id> --dry-run
+zl task move <task-id> --project-id <target-project-id>
+```
+
+## API tokens
+
+Use browser authorization to provision a least-privilege token for any team where the signed-in
+user has an active membership. The browser selects the team and authorizes automatically when its
+session is already active. This uses the product API; it does not require database access, a
+tunnel, or an RDS certificate.
+
+```bash
+zl --environment us-prod api-token create \
+  --label "CI investigation" \
+  --scopes workflows:read,executions:read \
+  --expires-at 2026-10-01T00:00:00Z
+```
+
+Creation returns the plaintext token once. Store it in the approved secret manager immediately;
+the CLI does not persist it as a human profile.
+
+Resolve an assignee from the current team, then upload a screenshot as an image attachment:
+
+```bash
+zl member list --fields id,name,email
+zl task attachment upload <task-id> ./workflow-unpublished-changes.png
+```
+
+Task attachments support `png`, `jpeg`, `gif`, `webp`, `avif`, and `svg` images (up to 10 MB).
+`zl project list` excludes archived projects by default; pass `--include-archived` for historical lookup.
+
+Run `zl --help` or `zl <resource> --help` for the complete command surface. The available
+resources are `workflow`, `execution`, `template`, `credential`, `file`, `team`, `page`, `task`,
+`project`, `state`, `label`, `cycle`, and `member`; task comments and
+attachments are managed under `zl task`.
+
+## Automation contract
+
+- Successful output is JSON on stdout.
+- Errors are JSON on stderr and exit with status 1.
+- `--fields id,title,...` limits list and view payloads.
+- `--dry-run` previews supported writes without making an HTTP request.
+- `zl schema [resource]` is local and does not require authentication.
+- `ZL_API_URL` takes precedence over a profile URL, which takes precedence over the
+  production default.
+- `ZL_API_TOKEN` takes precedence over the token in the selected profile.
+
+Never print tokens in logs or commit `~/.config/zalos/credentials.json`.

package/dist/client.js

@@ -0,0 +1,79 @@
+import { resolveToken } from './credentials.js';
+import { ApiError, AuthError, NotFoundError } from './utils/errors.js';
+import { currentEnvironment } from './environments.js';
+function isFormData(value) {
+    return typeof FormData !== 'undefined' && value instanceof FormData;
+}
+async function responseErrorMessage(response) {
+    try {
+        const json = (await response.json());
+        if (typeof json.message === 'string' && json.message)
+            return json.message;
+        if (typeof json.error === 'string' && json.error)
+            return json.error;
+        if (json.error !== null &&
+            typeof json.error === 'object' &&
+            'message' in json.error &&
+            typeof json.error.message === 'string' &&
+            json.error.message)
+            return json.error.message;
+    }
+    catch {
+        // Fall back to the HTTP status text when the response has no JSON message.
+    }
+    return response.statusText;
+}
+async function request(options, tokenOverride) {
+    const { method, path, body, query } = options;
+    const baseUrl = currentEnvironment().apiUrl;
+    const token = tokenOverride ?? resolveToken();
+    const url = new URL(`${baseUrl}/api${path}`);
+    if (query) {
+        for (const [k, v] of Object.entries(query)) {
+            url.searchParams.set(k, v);
+        }
+    }
+    const headers = {
+        'X-Mesh-API-Key': token,
+    };
+    if (body != null && !isFormData(body))
+        headers['Content-Type'] = 'application/json';
+    const response = await fetch(url.toString(), {
+        method,
+        signal: AbortSignal.timeout(30_000),
+        redirect: 'error',
+        headers,
+        body: body != null ? (isFormData(body) ? body : JSON.stringify(body)) : undefined,
+    });
+    if (response.status === 401 || response.status === 403) {
+        if (options.detailedAuthErrors) {
+            const message = await responseErrorMessage(response);
+            if (response.status === 401)
+                throw new AuthError(message || 'Unauthorized');
+            throw new ApiError(response.status, message || 'Forbidden');
+        }
+        throw new AuthError('Unauthorized. Check your API token.');
+    }
+    if (response.status === 404) {
+        throw new NotFoundError('resource', path);
+    }
+    if (!response.ok) {
+        const message = await responseErrorMessage(response);
+        throw new ApiError(response.status, message);
+    }
+    if (response.status === 204)
+        return undefined;
+    return response.json();
+}
+export const client = {
+    get: (path, query) => request({ method: 'GET', path, query }),
+    post: (path, body, options) => request({ method: 'POST', path, body, ...options }),
+    postForm: (path, body) => request({ method: 'POST', path, body }),
+    put: (path, body) => request({ method: 'PUT', path, body }),
+    patch: (path, body) => request({ method: 'PATCH', path, body }),
+    delete: (path) => request({ method: 'DELETE', path }),
+};
+export async function revokeCurrentHumanToken(token) {
+    await request({ method: 'DELETE', path: '/auth/cli-token/current' }, token);
+}
+//# sourceMappingURL=client.js.map

package/dist/commands/api-token.js

@@ -0,0 +1,74 @@
+import { requestBrowserAuthorization } from './auth.js';
+import { currentEnvironment } from '../environments.js';
+import { AuthError, ValidationError, handleError } from '../utils/errors.js';
+import { revokeBrowserAuthorizedToken } from '../utils/cli-auth.js';
+import { printJson } from '../utils/output.js';
+function parseScopes(raw) {
+    const scopes = raw.split(',').map((scope) => scope.trim());
+    if (scopes.length === 0 || scopes.some((scope) => !scope))
+        throw new ValidationError('scopes', 'Expected a comma-separated list of scopes');
+    return scopes;
+}
+function parseExpiry(raw) {
+    const expiresAt = raw.trim();
+    const time = Date.parse(expiresAt);
+    if (!expiresAt || Number.isNaN(time) || time <= Date.now())
+        throw new ValidationError('expires-at', 'Expected a future ISO 8601 datetime');
+    return new Date(time).toISOString();
+}
+function sameScopes(expected, actual) {
+    return (actual !== undefined &&
+        expected.length === actual.length &&
+        expected.every((scope, index) => scope === actual[index]));
+}
+export async function createApiTokenAction(options) {
+    if (process.env.ZL_API_TOKEN)
+        throw new AuthError('Unset ZL_API_TOKEN before provisioning a browser-authorized API token');
+    const label = options.label.trim();
+    if (!label || label.length > 64)
+        throw new ValidationError('label', 'Expected a label from 1 to 64 characters');
+    const scopes = parseScopes(options.scopes);
+    const expiresAt = parseExpiry(options.expiresAt);
+    const environment = currentEnvironment();
+    const result = await requestBrowserAuthorization({
+        tokenName: label,
+        scopes,
+        expiresAt,
+        provisioning: true,
+    });
+    const confirmed = result.environment === environment.name &&
+        result.expiresAt === expiresAt &&
+        sameScopes(scopes, result.scopes);
+    if (!confirmed) {
+        try {
+            await revokeBrowserAuthorizedToken(environment.apiUrl, result.token);
+        }
+        catch {
+            throw new AuthError(`Server did not confirm the requested token scopes and expiry; automatic revocation failed for token ${result.tokenId}`);
+        }
+        throw new AuthError('Server did not confirm the requested token scopes and expiry');
+    }
+    printJson({
+        token: result.token,
+        tokenId: result.tokenId,
+        expiresAt: result.expiresAt,
+        environment: result.environment,
+        scopes: result.scopes,
+        profile: result.profile,
+    });
+}
+export function registerApiTokenCommand(program) {
+    const command = program
+        .command('api-token')
+        .description('Provision an API token through browser authorization');
+    command
+        .command('create')
+        .description('Create a least-privilege token for the browser-selected accessible team')
+        .requiredOption('--label <name>', 'Human-readable token label (1-64 characters)')
+        .requiredOption('--scopes <list>', 'Comma-separated API token scopes')
+        .requiredOption('--expires-at <iso-datetime>', 'Future ISO 8601 expiry')
+        .action((options) => {
+        void createApiTokenAction(options).catch(handleError);
+    });
+}
+//# sourceMappingURL=api-token.js.map

package/dist/commands/auth.js

@@ -0,0 +1,196 @@
+import { client } from '../client.js';
+import { clearProfile, readProfile, writeProfile } from '../credentials.js';
+import { currentEnvironment } from '../environments.js';
+import { createBrowserProofServer, fetchCliBrowserAuthorizationConfig, generateSession, openBrowser, pollForToken, } from '../utils/cli-auth.js';
+import { AuthError, handleError } from '../utils/errors.js';
+import { printJson } from '../utils/output.js';
+import { dataRow } from '../utils/product-api.js';
+export async function requestBrowserAuthorization(options) {
+    const environment = currentEnvironment();
+    if (process.env.ZL_API_TOKEN)
+        throw new AuthError('Unset ZL_API_TOKEN before browser authorization; automation tokens are never persisted');
+    const authConfig = await fetchCliBrowserAuthorizationConfig(environment.apiUrl, environment.name);
+    if (options.provisioning) {
+        if (!authConfig.capabilities.includes('api-token-provisioning-v1'))
+            throw new AuthError('Selected environment does not support browser API token provisioning');
+        const invalidScopes = (options.scopes ?? []).filter((scope) => !authConfig.apiTokenScopes.includes(scope));
+        if (invalidScopes.length > 0)
+            throw new AuthError(`Invalid API token scopes: ${invalidScopes.join(', ')}`);
+    }
+    const session = await generateSession();
+    const proofServer = await createBrowserProofServer(session.sessionId, authConfig.uiOrigin);
+    const query = new URLSearchParams({
+        session_id: session.sessionId,
+        public_key: session.publicKey,
+        token_name: options.tokenName,
+        environment: environment.name,
+        proof_hash: proofServer.browserProofHash,
+        callback_port: String(proofServer.callbackPort),
+    });
+    if (options.scopes) {
+        query.set('provision', 'api-token');
+        query.set('scopes', options.scopes.join(','));
+    }
+    if (options.expiresAt)
+        query.set('expires_at', options.expiresAt);
+    const url = `${environment.apiUrl}/api/auth/cli-login?${query}`;
+    try {
+        openBrowser(url);
+        process.stderr.write(`Open this URL to authorize: ${url}\nWaiting for browser authorization...\n`);
+        return await pollForToken(environment.apiUrl, session.sessionId, session.privateKey, 300000);
+    }
+    finally {
+        await proofServer.close();
+    }
+}
+export async function whoamiAction() {
+    printJson(await client.get('/user/profile'));
+}
+export async function loginAction(profileName = process.env.ZL_PROFILE ?? 'default') {
+    const environment = currentEnvironment();
+    const result = await requestBrowserAuthorization({ tokenName: 'zl-cli' });
+    if (result.environment !== environment.name)
+        throw new AuthError('Login environment mismatch');
+    writeProfile(profileName, {
+        ...result.profile,
+        token: result.token,
+        tokenId: result.tokenId,
+        expiresAt: result.expiresAt,
+        environment: environment.name,
+        apiUrl: environment.apiUrl,
+    });
+}
+async function verifiedIdentity() {
+    const identity = dataRow(await client.get('/user/profile'));
+    if (typeof identity.id !== 'string' ||
+        !identity.id ||
+        typeof identity.email !== 'string' ||
+        (identity.name !== null && typeof identity.name !== 'string'))
+        throw new AuthError('Invalid identity response');
+    return { id: identity.id, email: identity.email, name: identity.name };
+}
+export async function authStatus() {
+    const environment = currentEnvironment();
+    if (process.env.ZL_API_TOKEN) {
+        const identity = await verifiedIdentity();
+        return {
+            authenticated: true,
+            source: 'environment',
+            environment: environment.name,
+            apiUrl: environment.apiUrl,
+            user: { id: identity.id, email: identity.email, name: identity.name },
+        };
+    }
+    const profile = readProfile(process.env.ZL_PROFILE ?? 'default');
+    if (!profile)
+        return {
+            authenticated: false,
+            environment: environment.name,
+            apiUrl: environment.apiUrl,
+        };
+    currentEnvironment(profile.environment);
+    const identity = await verifiedIdentity();
+    return {
+        authenticated: true,
+        environment: environment.name,
+        apiUrl: environment.apiUrl,
+        tokenId: profile.tokenId,
+        expiresAt: profile.expiresAt,
+        remainingSeconds: Math.max(0, Math.floor((Date.parse(profile.expiresAt) - Date.now()) / 1000)),
+        user: identity,
+        organization: profile.organization,
+        team: profile.team,
+    };
+}
+export async function logoutAction(profileName) {
+    currentEnvironment();
+    if (process.env.ZL_API_TOKEN)
+        throw new AuthError('Unset ZL_API_TOKEN to log out a human profile');
+    let profile;
+    try {
+        profile = readProfile(profileName);
+    }
+    catch {
+        // clearProfile rechecks the path and file shape, so unsafe files still fail closed.
+        clearProfile(profileName);
+        process.stderr.write('Warning: invalid legacy profile removed locally; its remote token could not be revoked. Revoke it in Zalos account settings.\n');
+        printJson({ message: 'logged out', profile: profileName });
+        return;
+    }
+    if (profile) {
+        currentEnvironment(profile.environment);
+        const previous = process.env.ZL_PROFILE;
+        process.env.ZL_PROFILE = profileName;
+        try {
+            await client.delete('/auth/cli-token/current');
+        }
+        catch {
+            process.stderr.write('Warning: remote revocation failed; token may remain valid until expiry.\n');
+        }
+        finally {
+            if (previous === undefined)
+                delete process.env.ZL_PROFILE;
+            else
+                process.env.ZL_PROFILE = previous;
+            clearProfile(profileName);
+        }
+    }
+    printJson({ message: 'logged out', profile: profileName });
+}
+export function registerAuthCommand(program) {
+    const auth = program
+        .command('auth')
+        .description('Manage human authentication; CI uses ZL_API_TOKEN');
+    auth
+        .command('login')
+        .description('Sign in through the browser for seven days')
+        .action(async () => {
+        try {
+            await loginAction();
+            printJson({
+                message: 'Logged in',
+                profile: process.env.ZL_PROFILE ?? 'default',
+            });
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
+    auth
+        .command('logout')
+        .description('Revoke current human token and clear local credentials')
+        .action(async () => {
+        try {
+            await logoutAction(process.env.ZL_PROFILE ?? 'default');
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
+    auth
+        .command('status')
+        .description('Verify identity and report session lifetime')
+        .action(async () => {
+        try {
+            const status = await authStatus();
+            printJson(status);
+            if (!status.authenticated)
+                process.exitCode = 1;
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
+    auth
+        .command('whoami')
+        .description('Print current user profile')
+        .action(async () => {
+        try {
+            await whoamiAction();
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
+}
+//# sourceMappingURL=auth.js.map