@zalosai/zalos-cli 0.2.13

package/dist/commands/workflow.js

@@ -0,0 +1,245 @@
+import { writeFile, stat } from 'node:fs/promises';
+import { resolve, join } from 'node:path';
+import { client } from '../client.js';
+import { readWorkflowFile, serializeWorkflow } from '../workflow-file.js';
+import { ValidationError } from '../utils/errors.js';
+import { filterSingle, printJson } from '../utils/output.js';
+import { action, dataRow, dataRows, fields, isRow, printPage, resourceId, } from '../utils/product-api.js';
+import { parseJson } from '../utils/validate.js';
+function publicationStatus(workflow, publishedNow = false) {
+    const draftVersionId = typeof workflow.versionId === 'string' ? workflow.versionId : undefined;
+    const publishedVersionId = typeof workflow.publishedVersionId === 'string' ? workflow.publishedVersionId : undefined;
+    const published = publishedVersionId === undefined ||
+        draftVersionId === undefined ||
+        draftVersionId === publishedVersionId;
+    return {
+        published,
+        ...(draftVersionId === undefined ? {} : { draftVersionId }),
+        ...(publishedVersionId === undefined ? {} : { publishedVersionId }),
+        message: published
+            ? publishedNow
+                ? `Published draft ${draftVersionId}. Runs now use this version.`
+                : 'Runs use this workflow version.'
+            : `Saved draft ${draftVersionId}. Runs still use published ${publishedVersionId}; publish the workflow to make this change live.`,
+    };
+}
+function warnIfWorkflowDraftIsUnpublished(workflow) {
+    const workflowId = typeof workflow.id === 'string' ? workflow.id : undefined;
+    const draftVersionId = typeof workflow.versionId === 'string' ? workflow.versionId : undefined;
+    const publishedVersionId = typeof workflow.publishedVersionId === 'string' ? workflow.publishedVersionId : undefined;
+    if (workflowId === undefined ||
+        draftVersionId === undefined ||
+        publishedVersionId === undefined ||
+        draftVersionId === publishedVersionId)
+        return;
+    process.stderr.write(`${JSON.stringify({
+        warning: {
+            code: 'WORKFLOW_DRAFT_NOT_PUBLISHED',
+            workflowId,
+            draftVersionId,
+            publishedVersionId,
+            message: `Exported draft ${draftVersionId}. Runs still use published ${publishedVersionId}; run \`zl workflow publish ${workflowId} --apply\` to make this change live.`,
+        },
+    })}\n`);
+}
+export async function listWorkflowsAction(options) {
+    const path = options.allTeams ? '/developer/workflows' : '/workflows';
+    printPage(dataRows(await client.get(path)), options);
+}
+export async function viewWorkflowAction(id, options) {
+    printJson(filterSingle(dataRow(await client.get(`/workflows/${resourceId(id)}`)), options.fields));
+}
+export async function exportWorkflowAction(id, options) {
+    const selections = [Boolean(id), Boolean(options.all), Boolean(options.allTeams)].filter(Boolean).length;
+    if (selections !== 1)
+        throw new ValidationError('id', 'Choose a workflow ID, --all, or --all-teams');
+    if (id)
+        resourceId(id);
+    const output = options.output ? resolve(options.output) : undefined;
+    if (options.separate && (!output || !(await stat(output)).isDirectory()))
+        throw new ValidationError('output', '--separate requires an existing output directory');
+    let rows;
+    let ids;
+    if (options.allTeams) {
+        const regionalRows = dataRows(await client.get('/developer/workflows/export'));
+        ids = regionalRows.map((row) => {
+            if (typeof row.id !== 'string')
+                throw new ValidationError('id', 'Workflow response is missing ID');
+            return resourceId(row.id);
+        });
+        rows = regionalRows.map((row) => filterSingle(row, options.fields));
+    }
+    else {
+        ids = id
+            ? [id]
+            : dataRows(await client.get('/workflows')).map((row) => {
+                if (typeof row.id !== 'string')
+                    throw new ValidationError('id', 'Workflow response is missing ID');
+                return resourceId(row.id);
+            });
+        rows = [];
+        for (const workflowId of ids)
+            rows.push(filterSingle(dataRow(await client.get(`/workflows/${workflowId}`)), options.fields));
+    }
+    rows.forEach(warnIfWorkflowDraftIsUnpublished);
+    if (options.separate && output) {
+        const outputs = [];
+        for (let index = 0; index < rows.length; index++) {
+            const path = join(output, `${ids[index]}.json`);
+            await writeFile(path, serializeWorkflow(rows[index], options.pretty), {
+                flag: 'wx',
+                mode: 0o600,
+            });
+            outputs.push(path);
+        }
+        printJson({ outputs, count: rows.length });
+        return;
+    }
+    const serialized = options.all || options.allTeams
+        ? JSON.stringify(rows, null, options.pretty ? 2 : undefined) + '\n'
+        : serializeWorkflow(rows[0], options.pretty);
+    if (output) {
+        await writeFile(output, serialized, { flag: 'wx', mode: 0o600 });
+        printJson({ output, count: rows.length });
+    }
+    else
+        process.stdout.write(serialized);
+}
+export async function validateWorkflowAction(path) {
+    const value = await readWorkflowFile(path);
+    printJson({
+        valid: true,
+        id: value.id,
+        nodeCount: value.nodes.length,
+    });
+}
+export async function importWorkflowAction(path, options) {
+    const payload = await readWorkflowFile(path);
+    if (payload.id !== undefined)
+        throw new ValidationError('id', 'Import creates a new workflow; remove id or use workflow update');
+    if (!options.apply || options.dryRun) {
+        printJson({ dryRun: true, method: 'POST', path: '/workflows', payload });
+        return;
+    }
+    printJson(dataRow(await client.post('/workflows', payload)));
+}
+export async function updateWorkflowAction(id, options) {
+    const path = `/workflows/${resourceId(id)}`;
+    const { checksum, expectedChecksum, versionId: _versionId, publishedVersionId: _publishedVersionId, ...workflow } = await readWorkflowFile(options.input, id);
+    for (const value of [checksum, expectedChecksum]) {
+        if (value !== undefined && (typeof value !== 'string' || !value.trim())) {
+            throw new ValidationError('checksum', 'Workflow checksum must be a nonempty string');
+        }
+    }
+    if (checksum !== undefined && expectedChecksum !== undefined && checksum !== expectedChecksum) {
+        throw new ValidationError('checksum', 'expectedChecksum does not match the exported checksum');
+    }
+    const baseline = expectedChecksum ?? checksum;
+    if (options.apply && !options.dryRun && baseline === undefined) {
+        throw new ValidationError('checksum', 'Update requires checksum or expectedChecksum; export the current workflow before editing');
+    }
+    const payload = {
+        ...workflow,
+        ...(baseline !== undefined ? { expectedChecksum: baseline } : {}),
+    };
+    if (!options.apply || options.dryRun) {
+        printJson({ dryRun: true, method: 'PUT', path, payload });
+        return;
+    }
+    const saved = dataRow(await client.put(path, payload));
+    printJson({ workflow: saved, publication: publicationStatus(saved) });
+}
+export async function publishWorkflowAction(id, options) {
+    const path = `/workflows/${resourceId(id)}/publish`;
+    if (!options.apply || options.dryRun) {
+        printJson({ dryRun: true, method: 'POST', path });
+        return;
+    }
+    const published = dataRow(await client.post(path));
+    printJson({ workflow: published, publication: publicationStatus(published, true) });
+}
+export async function deactivateWorkflowAction(id, options) {
+    const path = `/workflows/${resourceId(id)}/deactivate`;
+    if (!options.apply || options.dryRun) {
+        printJson({ dryRun: true, method: 'PATCH', path });
+        return;
+    }
+    printJson(dataRow(await client.patch(path, {})));
+}
+export async function deleteWorkflowAction(id, options) {
+    const workflowId = resourceId(id);
+    const path = `/workflows/${workflowId}`;
+    if (!options.apply || options.dryRun) {
+        printJson({ dryRun: true, method: 'DELETE', path });
+        return;
+    }
+    await client.delete(path);
+    printJson({ deleted: true, workflowId });
+}
+export async function runWorkflowAction(id, options) {
+    const path = `/workflows/${resourceId(id)}/run`;
+    const triggerData = parseJson(options.json ?? '{}');
+    if (!isRow(triggerData))
+        throw new ValidationError('json', 'Trigger inputs must be an object');
+    const payload = { triggerData };
+    if (options.dryRun) {
+        printJson({ dryRun: true, method: 'POST', path, payload });
+        return;
+    }
+    printJson(dataRow(await client.post(path, payload)));
+}
+export function registerWorkflowCommand(program) {
+    const cmd = program.command('workflow').description('Manage workflows through the regional API');
+    cmd
+        .command('list')
+        .option('--all-teams', 'List workflows across every team in the selected region')
+        .option('--limit <n>', 'Maximum results', '100')
+        .option('--offset <n>', 'Result offset', '0')
+        .action(async (o) => action(() => listWorkflowsAction({ ...o, ...fields(program) })));
+    cmd
+        .command('view <id>')
+        .action(async (id) => action(() => viewWorkflowAction(id, fields(program))));
+    cmd
+        .command('export [id]')
+        .option('--all', 'Export every accessible workflow')
+        .option('--all-teams', 'Export workflows across every team in the selected region')
+        .option('--output <path>', 'Output file (must not exist)')
+        .option('--pretty', 'Indent JSON')
+        .option('--separate', 'Write ID-named JSON in output directory')
+        .action(async (id, o) => action(() => exportWorkflowAction(id, { ...o, ...fields(program) })));
+    cmd
+        .command('validate <file>')
+        .action(async (file) => action(() => validateWorkflowAction(file)));
+    cmd
+        .command('import <file>')
+        .option('--apply', 'Create workflow')
+        .option('--dry-run', 'Preview creation')
+        .action(async (file, o) => action(() => importWorkflowAction(file, o)));
+    cmd
+        .command('update <id>')
+        .requiredOption('--input <file>', 'Workflow JSON')
+        .option('--apply', 'Apply update')
+        .option('--dry-run', 'Preview update')
+        .action(async (id, o) => action(() => updateWorkflowAction(id, o)));
+    cmd
+        .command('publish <id>')
+        .option('--apply', 'Publish workflow')
+        .option('--dry-run', 'Preview publish')
+        .action(async (id, o) => action(() => publishWorkflowAction(id, o)));
+    cmd
+        .command('deactivate <id>')
+        .option('--apply', 'Deactivate workflow')
+        .option('--dry-run', 'Preview deactivation')
+        .action(async (id, o) => action(() => deactivateWorkflowAction(id, o)));
+    cmd
+        .command('delete <id>')
+        .option('--apply', 'Delete workflow')
+        .option('--dry-run', 'Preview deletion')
+        .action(async (id, o) => action(() => deleteWorkflowAction(id, o)));
+    cmd
+        .command('run <id>')
+        .option('--json <inputs>', 'Trigger inputs as JSON')
+        .option('--dry-run', 'Preview execution')
+        .action(async (id, o) => action(() => runWorkflowAction(id, o)));
+}
+//# sourceMappingURL=workflow.js.map

package/dist/credentials.js

@@ -0,0 +1,123 @@
+import { chmodSync, constants, closeSync, fchmodSync, lstatSync, mkdirSync, openSync, readFileSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { currentEnvironment } from './environments.js';
+import { AuthError } from './utils/errors.js';
+function credentialsPath() {
+    const dir = join(process.env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'zalos');
+    for (const path of [dir, join(dir, 'credentials.json')]) {
+        try {
+            if (lstatSync(path).isSymbolicLink())
+                throw new AuthError('Credentials path must not be a symbolic link');
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+    }
+    return join(dir, 'credentials.json');
+}
+function isObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+export function validateProfile(value) {
+    if (!isObject(value) ||
+        typeof value.token !== 'string' ||
+        !value.token ||
+        typeof value.apiUrl !== 'string' ||
+        !['staging', 'us-prod', 'eu-prod'].includes(String(value.environment)) ||
+        typeof value.tokenId !== 'string' ||
+        !value.tokenId ||
+        typeof value.expiresAt !== 'string' ||
+        !Number.isFinite(Date.parse(value.expiresAt)))
+        throw new AuthError('Invalid credential profile; run zl --environment <name> auth login');
+    for (const key of ['user', 'team', 'organization']) {
+        const metadata = value[key];
+        if (metadata !== undefined &&
+            (!isObject(metadata) ||
+                typeof metadata.id !== 'string' ||
+                (key === 'team' &&
+                    metadata.publicId !== undefined &&
+                    typeof metadata.publicId !== 'string') ||
+                (typeof metadata.name !== 'string' && !(key === 'user' && metadata.name === null)) ||
+                (key === 'user' && typeof metadata.email !== 'string')))
+            throw new AuthError('Invalid credential metadata');
+    }
+    return value;
+}
+function readFile() {
+    try {
+        const data = JSON.parse(readFileSync(credentialsPath(), 'utf8'));
+        if (!isObject(data) || !isObject(data.profiles))
+            throw new AuthError('Invalid credentials file');
+        const profiles = Object.create(null);
+        for (const [name, value] of Object.entries(data.profiles))
+            profiles[name] = value;
+        return { profiles };
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { profiles: Object.create(null) };
+        if (error instanceof SyntaxError)
+            throw new AuthError('Invalid credentials file');
+        throw error;
+    }
+}
+function writeFile(data) {
+    const path = credentialsPath();
+    const dir = join(path, '..');
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    chmodSync(dir, 0o700);
+    const fd = openSync(path, constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | constants.O_NOFOLLOW, 0o600);
+    try {
+        fchmodSync(fd, 0o600);
+        writeFileSync(fd, JSON.stringify(data, null, 2) + '\n');
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+export function readProfile(name) {
+    const { profiles } = readFile();
+    return Object.hasOwn(profiles, name) ? validateProfile(profiles[name]) : null;
+}
+export function writeProfile(name, entry) {
+    const file = readFile();
+    file.profiles[name] = validateProfile(entry);
+    writeFile(file);
+}
+export function clearProfile(name) {
+    const file = readFile();
+    delete file.profiles[name];
+    if (Object.keys(file.profiles).length === 0) {
+        try {
+            unlinkSync(credentialsPath());
+        }
+        catch {
+            /* already gone */
+        }
+    }
+    else {
+        writeFile(file);
+    }
+}
+export function resolveToken() {
+    const environment = currentEnvironment();
+    const envToken = process.env.ZL_API_TOKEN;
+    if (envToken)
+        return envToken;
+    const defaultProfile = readProfile(process.env.ZL_PROFILE ?? 'default');
+    if (defaultProfile?.token) {
+        currentEnvironment(defaultProfile.environment);
+        if (defaultProfile.apiUrl !== environment.apiUrl)
+            throw new AuthError('Profile API origin mismatch; log in to this origin again');
+        const remaining = Date.parse(defaultProfile.expiresAt) - Date.now();
+        if (remaining <= 0)
+            throw new AuthError(`Session expired. Run zl --environment ${environment.name} auth login`);
+        if (remaining <= 15 * 60 * 1000)
+            process.stderr.write(`Warning: session will expire soon. Run zl --environment ${environment.name} auth login\n`);
+        return defaultProfile.token;
+    }
+    throw new AuthError('Not authenticated. Run: zl auth login or set ZL_API_TOKEN');
+}
+//# sourceMappingURL=credentials.js.map

package/dist/environments.js

@@ -0,0 +1,42 @@
+import { AuthError } from './utils/errors.js';
+export const ENVIRONMENTS = {
+    staging: 'https://dev.app.zalos.ai',
+    'us-prod': 'https://app.zalos.ai',
+    'eu-prod': 'https://app.eu.zalos.ai',
+};
+let localOverride;
+export function configureApiUrlOverride(url) {
+    localOverride = url;
+}
+export function resolveEnvironment(input) {
+    const name = input.flag ?? input.env;
+    if (!name)
+        throw new AuthError('Choose --environment staging|us-prod|eu-prod or set ZL_ENVIRONMENT');
+    if (!Object.hasOwn(ENVIRONMENTS, name))
+        throw new AuthError('Unknown environment');
+    if (input.profileEnvironment && input.profileEnvironment !== name)
+        throw new AuthError('Profile environment mismatch; choose a matching profile or log in again');
+    let apiUrl = ENVIRONMENTS[name];
+    if (input.apiUrlOverride) {
+        const url = new URL(input.apiUrlOverride);
+        if (!['localhost', '127.0.0.1', '[::1]'].includes(url.hostname) ||
+            !['http:', 'https:'].includes(url.protocol) ||
+            url.username ||
+            url.password ||
+            url.search ||
+            url.hash ||
+            url.pathname !== '/')
+            throw new AuthError('--api-url is only allowed for a local development origin');
+        apiUrl = url.origin;
+    }
+    return { name: name, apiUrl };
+}
+export function currentEnvironment(profileEnvironment, flag) {
+    return resolveEnvironment({
+        flag,
+        env: process.env.ZL_ENVIRONMENT,
+        profileEnvironment,
+        apiUrlOverride: localOverride,
+    });
+}
+//# sourceMappingURL=environments.js.map

package/dist/main.js

@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+import { Command } from 'commander';
+import { readFileSync } from 'node:fs';
+import { registerSetupCommand } from './commands/setup.js';
+import { registerDoctorCommand } from './commands/doctor.js';
+import { registerWorkflowCommand } from './commands/workflow.js';
+import { registerExecutionCommand } from './commands/execution.js';
+import { registerTemplateCommand } from './commands/template.js';
+import { registerCredentialCommand } from './commands/credential.js';
+import { registerFileCommand } from './commands/file.js';
+import { registerAuthCommand } from './commands/auth.js';
+import { registerApiTokenCommand } from './commands/api-token.js';
+import { registerCycleCommand } from './commands/cycle.js';
+import { registerLabelCommand } from './commands/label.js';
+import { registerMemberCommand } from './commands/member.js';
+import { registerProjectCommand } from './commands/project.js';
+import { registerSchemaCommand } from './commands/schema.js';
+import { registerStateCommand } from './commands/state.js';
+import { registerTaskCommentCommand } from './commands/task-comment.js';
+import { registerTaskCommand } from './commands/task.js';
+import { registerTeamCommand } from './commands/team.js';
+import { registerPageCommand } from './commands/page.js';
+import { configureApiUrlOverride, currentEnvironment } from './environments.js';
+import { handleError } from './utils/errors.js';
+const program = new Command();
+const packageJson = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+program
+    .name('zl')
+    .description('CLI for Zalos')
+    .version(packageJson.version)
+    .option('--fields <list>', 'Comma-separated field names to include in output')
+    .option('--environment <name>', 'staging, us-prod, or eu-prod (or ZL_ENVIRONMENT)')
+    .option('--api-url <url>', 'Explicit local development origin override')
+    .option('--profile <name>', 'Named human profile (or ZL_PROFILE)')
+    .hook('preAction', (_thisCommand, actionCommand) => {
+    const opts = actionCommand.optsWithGlobals();
+    if (opts.environment)
+        process.env.ZL_ENVIRONMENT = opts.environment;
+    if (opts.profile)
+        process.env.ZL_PROFILE = opts.profile;
+    configureApiUrlOverride(opts.apiUrl);
+    if (actionCommand.name() === 'zl' ||
+        actionCommand.name() === 'schema' ||
+        (actionCommand.name() === 'validate' && actionCommand.parent?.name() === 'workflow') ||
+        actionCommand.parent?.name() === 'schema')
+        return;
+    try {
+        currentEnvironment();
+    }
+    catch (error) {
+        handleError(error);
+    }
+});
+program.action(() => {
+    program.help();
+});
+registerAuthCommand(program);
+registerApiTokenCommand(program);
+registerSetupCommand(program);
+registerDoctorCommand(program);
+registerWorkflowCommand(program);
+registerExecutionCommand(program);
+registerTemplateCommand(program);
+registerCredentialCommand(program);
+registerFileCommand(program);
+registerTeamCommand(program);
+registerPageCommand(program);
+registerSchemaCommand(program);
+registerStateCommand(program);
+registerLabelCommand(program);
+registerCycleCommand(program);
+registerProjectCommand(program);
+registerMemberCommand(program);
+registerTaskCommand(program);
+const taskCmd = program.commands.find((c) => c.name() === 'task');
+if (!taskCmd)
+    throw new Error('task command not registered — check registration order in main.ts');
+registerTaskCommentCommand(taskCmd, program);
+program.parseAsync(process.argv).catch((err) => {
+    process.stderr.write(JSON.stringify({
+        error: err instanceof Error ? err.message : 'Unknown error',
+        code: 'UNKNOWN_ERROR',
+    }) + '\n');
+    process.exit(1);
+});
+//# sourceMappingURL=main.js.map

package/dist/utils/cli-auth.js

@@ -0,0 +1,186 @@
+import { spawn } from 'node:child_process';
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import { createServer } from 'node:http';
+import { validateProfile } from '../credentials.js';
+import { AuthError } from './errors.js';
+const { subtle } = globalThis.crypto;
+export async function generateSession() {
+    const keyPair = await subtle.generateKey({ name: 'ECDH', namedCurve: 'P-256' }, true, [
+        'deriveKey',
+        'deriveBits',
+    ]);
+    const rawPub = await subtle.exportKey('raw', keyPair.publicKey);
+    return {
+        sessionId: randomUUID(),
+        publicKey: Buffer.from(rawPub).toString('hex'),
+        privateKey: keyPair.privateKey,
+    };
+}
+function closeServer(server) {
+    return new Promise((resolve, reject) => {
+        server.close((error) => {
+            if (error) {
+                reject(error);
+                return;
+            }
+            resolve();
+        });
+    });
+}
+export async function createBrowserProofServer(sessionId, uiOrigin) {
+    const browserProof = randomBytes(32).toString('base64url');
+    const browserProofHash = createHash('sha256').update(browserProof).digest('hex');
+    const server = createServer((request, response) => {
+        const url = new URL(request.url ?? '/', 'http://127.0.0.1');
+        const matchesProofRequest = url.pathname === '/cli-proof' && url.searchParams.get('session_id') === sessionId;
+        if (request.method === 'OPTIONS' &&
+            matchesProofRequest &&
+            request.headers.origin === uiOrigin &&
+            request.headers['access-control-request-method'] === 'GET') {
+            response.writeHead(204, {
+                'Access-Control-Allow-Methods': 'GET',
+                'Access-Control-Allow-Origin': uiOrigin,
+                'Access-Control-Allow-Private-Network': 'true',
+                'Access-Control-Max-Age': '600',
+                Vary: 'Origin, Access-Control-Request-Method, Access-Control-Request-Private-Network',
+            });
+            response.end();
+            return;
+        }
+        if (request.method !== 'GET' || !matchesProofRequest || request.headers.origin !== uiOrigin) {
+            response.writeHead(403).end();
+            return;
+        }
+        response.writeHead(200, {
+            'Access-Control-Allow-Origin': uiOrigin,
+            'Cache-Control': 'no-store',
+            'Content-Type': 'application/json',
+            Vary: 'Origin',
+        });
+        response.end(JSON.stringify({ proof: browserProof }));
+    });
+    try {
+        await new Promise((resolve, reject) => {
+            const onError = (error) => reject(error);
+            server.once('error', onError);
+            server.listen(0, '127.0.0.1', () => {
+                server.off('error', onError);
+                resolve();
+            });
+        });
+    }
+    catch {
+        throw new AuthError('Could not start the local browser authorization service');
+    }
+    const address = server.address();
+    if (!address || typeof address === 'string') {
+        await closeServer(server);
+        throw new AuthError('Could not determine the local browser authorization port');
+    }
+    return {
+        browserProofHash,
+        callbackPort: address.port,
+        close: () => closeServer(server),
+    };
+}
+async function fetchCliAuthConfig(apiUrl, environment) {
+    const url = new URL('/api/auth/cli-auth-config', apiUrl);
+    url.searchParams.set('environment', environment);
+    let response;
+    try {
+        response = await fetch(url, { redirect: 'error', signal: AbortSignal.timeout(10_000) });
+    }
+    catch {
+        throw new AuthError('Could not determine the browser authorization origin');
+    }
+    if (!response.ok)
+        throw new AuthError('Could not determine the browser authorization origin');
+    const body = await response.json();
+    if (typeof body !== 'object' || body === null || !('uiOrigin' in body)) {
+        throw new AuthError('Invalid browser authorization origin');
+    }
+    if (typeof body.uiOrigin !== 'string')
+        throw new AuthError('Invalid browser authorization origin');
+    const uiOrigin = new URL(body.uiOrigin).origin;
+    if (uiOrigin !== body.uiOrigin)
+        throw new AuthError('Invalid browser authorization origin');
+    const capabilities = 'capabilities' in body && Array.isArray(body.capabilities)
+        ? body.capabilities.filter((capability) => typeof capability === 'string')
+        : [];
+    const apiTokenScopes = 'apiTokenScopes' in body && Array.isArray(body.apiTokenScopes)
+        ? body.apiTokenScopes.filter((scope) => typeof scope === 'string')
+        : [];
+    return { uiOrigin, capabilities, apiTokenScopes };
+}
+export async function fetchCliBrowserAuthorizationConfig(apiUrl, environment) {
+    return fetchCliAuthConfig(apiUrl, environment);
+}
+export async function revokeBrowserAuthorizedToken(apiUrl, token) {
+    let response;
+    try {
+        response = await fetch(`${apiUrl}/api/auth/cli-token/current`, {
+            method: 'DELETE',
+            headers: { 'X-Mesh-API-Key': token },
+            redirect: 'error',
+            signal: AbortSignal.timeout(10_000),
+        });
+    }
+    catch {
+        throw new AuthError('Could not revoke the unconfirmed browser-authorized token');
+    }
+    if (response.status !== 204)
+        throw new AuthError('Could not revoke the unconfirmed browser-authorized token');
+}
+export async function decryptToken(encryptedToken, nonce, senderPublicKey, myPrivateKey) {
+    const senderPubKeyBytes = Buffer.from(senderPublicKey, 'hex');
+    const senderPubKey = await subtle.importKey('raw', senderPubKeyBytes, { name: 'ECDH', namedCurve: 'P-256' }, false, []);
+    /* oxlint-disable @typescript-eslint/no-unsafe-argument */
+    const sharedBits = await subtle.deriveBits({ name: 'ECDH', public: senderPubKey }, myPrivateKey, 256);
+    /* oxlint-enable @typescript-eslint/no-unsafe-argument */
+    const aesKey = await subtle.importKey('raw', sharedBits, { name: 'AES-GCM' }, false, ['decrypt']);
+    const decrypted = await subtle.decrypt({ name: 'AES-GCM', iv: Buffer.from(nonce, 'hex') }, aesKey, Buffer.from(encryptedToken, 'hex'));
+    return new TextDecoder().decode(decrypted);
+}
+export function openBrowser(url) {
+    const [cmd, args] = process.platform === 'darwin'
+        ? ['open', [url]]
+        : process.platform === 'win32'
+            ? ['cmd', ['/c', 'start', '', url]]
+            : ['xdg-open', [url]];
+    const child = spawn(cmd, args, { stdio: 'ignore', detached: true });
+    child.on('error', (err) => {
+        process.stderr.write(`Warning: could not open browser: ${err.message}\n`);
+    });
+    child.unref();
+}
+export async function pollForToken(apiUrl, sessionId, privateKey, timeoutMs, pollIntervalMs = 2000, browserGraceMs = timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    const graceDeadline = Date.now() + browserGraceMs;
+    const pollUrl = `${apiUrl}/api/auth/cli-sessions/${sessionId}`;
+    while (Date.now() < deadline) {
+        const response = await fetch(pollUrl, {
+            redirect: 'error',
+            signal: AbortSignal.timeout(Math.max(1, Math.min(30_000, deadline - Date.now()))),
+        });
+        if (response.status === 200) {
+            const body = (await response.json());
+            const plaintext = await decryptToken(body.encryptedToken, body.nonce, body.senderPublicKey, privateKey);
+            let result;
+            try {
+                result = JSON.parse(plaintext);
+                validateProfile({ ...result.profile, ...result, apiUrl });
+            }
+            catch {
+                throw new AuthError('Invalid login session payload; sign in again');
+            }
+            return result;
+        }
+        if (response.status === 404 && Date.now() > graceDeadline) {
+            throw new AuthError('Session expired — please run zl auth login again');
+        }
+        // 202 pending, or 404 within grace window — wait then retry
+        await new Promise((r) => setTimeout(r, pollIntervalMs));
+    }
+    throw new AuthError('Login timed out — browser window closed?');
+}
+//# sourceMappingURL=cli-auth.js.map