@zeegme/cli 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Zeeg GmbH
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,106 @@
+# @zeegme/cli
+
+`zeeg` works with your Zeeg account from the terminal: event types, available times, bookings, notes, CRM records, routing forms and AI phone calls. It calls the public [Zeeg API v2](https://developer.zeeg.me), so it can do exactly what an API token can do, with your own dashboard permissions.
+
+The CLI needs a plan that includes API access. Finding available times and booking meetings need a paid plan; a trial can use everything else. If your API access comes from AI minutes alone, the CLI can only read your AI phone agents and their calls, and start calls.
+
+## Install
+
+Node.js 20 or later:
+
+```sh
+npm install -g @zeegme/cli
+zeeg --help
+```
+
+## Log in
+
+```sh
+zeeg login
+```
+
+The CLI prints a one-time code and opens `https://api.zeeg.me/oauth/device` in your browser. Sign in to Zeeg if you are not signed in already, check that the code on the page matches the one in your terminal, and allow access. On a machine without a browser, run `zeeg login --no-browser` and open the printed link anywhere.
+
+Only approve a code you started yourself. Anyone holding a code you approve gets access to your account.
+
+- `zeeg whoami` shows the account and the permissions the login carries.
+- `zeeg logout` revokes the login on Zeeg's side and removes it from this machine.
+
+The access token lasts an hour and renews itself; a login you do not use for 30 days ends, and `zeeg login` starts a new one.
+
+### Where the login is stored
+
+In the system keychain: Keychain on macOS, Credential Manager on Windows, and the Secret Service (GNOME Keyring, KWallet) on Linux. A machine without one, such as a server you reach over SSH, keeps it in `~/.config/zeeg/credentials.json` (or under `$XDG_CONFIG_HOME`), readable only by you; the CLI says so the first time. Set `ZEEG_TOKEN_STORE=file` to use the file everywhere.
+
+### Other environments
+
+`--base-url` or `ZEEG_API_URL` points the CLI at another API origin, for example a local backend:
+
+```sh
+ZEEG_API_URL=http://localhost:8000 zeeg login
+```
+
+Plain `http` is accepted for `localhost` only. Each origin keeps its own login.
+
+## Commands
+
+| Command | What it does |
+|---|---|
+| `zeeg event-types list` / `get <uuid>` | Your event types (scheduling pages) |
+| `zeeg availability <eventTypeUuid> [--from --to --tz]` | Open start times, by day |
+| `zeeg schedules list [--email]` | Availability schedules |
+| `zeeg time-off add --start --end --title [--type]` | Block days as time off |
+| `zeeg bookings list [--status --from --to --invitee-email ...]` | Bookings you can see |
+| `zeeg bookings get <uuid>` | One booking |
+| `zeeg bookings create <eventTypeUuid> --date --time --name --email` | Book a meeting for an invitee |
+| `zeeg bookings cancel <uuid> [--reason]` | Cancel a booking |
+| `zeeg bookings reschedule <uuid> --date --time` | Move a booking |
+| `zeeg bookings hand-over <uuid> [--to]` | Hand a round-robin booking to another host |
+| `zeeg notes list <bookingUuid>` / `add <bookingUuid> <text>` | Notes on a booking |
+| `zeeg crm list <people\|companies\|slug> [--search <text>]` | CRM records |
+| `zeeg crm get <object> <id>` | One CRM record |
+| `zeeg crm upsert <object> --match <attribute> --data <json>` | Create a record, or update the one that matches |
+| `zeeg forms list` / `submissions [--form]` | Routing forms and their submissions |
+| `zeeg calls start <agentUuid> --phone [--name --email --data --at]` | Have an AI phone agent call someone |
+| `zeeg agents list`, `zeeg agents calls <agentUuid>`, `zeeg agents call <callId>` | AI phone agents, their calls, and one call with its transcript |
+
+`zeeg <command> --help` lists every option. Times are in your machine's time zone unless you pass `--tz`.
+
+Commands that reach other people or spend AI minutes (`bookings create`, `cancel`, `reschedule`, `hand-over`, `calls start`) ask before they act. Pass `--yes` to skip the question, which scripts must do: without a terminal to ask in, they stop instead.
+
+```sh
+zeeg availability 5c7e… --from 2026-10-05 --to 2026-10-09 --tz Europe/Berlin
+zeeg bookings create 5c7e… --date 2026-10-06 --time 14:30 --tz Europe/Berlin \
+  --name "Sophie Laurent" --email sophie@northwind.io
+zeeg crm upsert people --match emails --data '{"firstName":"Sophie","emails":["sophie@northwind.io"]}'
+```
+
+## JSON output
+
+In a terminal the CLI prints tables. When its output goes to a pipe or a file, or with `--json`, it prints the API's JSON unchanged, so you can hand it to `jq` or an agent:
+
+```sh
+zeeg bookings list --status confirmed | jq -r '.collection[].uuid'
+```
+
+Messages meant for you (the login code, questions, notices) go to stderr and never mix with the JSON.
+
+## Exit codes
+
+| Code | Meaning |
+|---|---|
+| 0 | Done |
+| 1 | Wrong usage, or you answered no |
+| 2 | Not logged in, or the login ended: run `zeeg login` |
+| 3 | The API refused the request or could not be reached; the message says why |
+
+## Development
+
+```sh
+pnpm install --filter @zeegme/cli...
+pnpm --filter @zeegme/cli build
+pnpm --filter @zeegme/cli test
+pnpm --filter @zeegme/cli generate:api   # after apps/backend/tools/api-docs/openapi.yaml changes
+```
+
+`src/api/schema.d.ts` is generated from the API spec and committed; regenerate it rather than editing it.

package/dist/api/client.js

@@ -0,0 +1,24 @@
+import createClient from 'openapi-fetch';
+import { apiErrorFrom, fetchFrom } from '../errors.js';
+export function createApi(baseUrl, session, userAgent, fetchImpl = fetch) {
+    const api = createClient({
+        baseUrl: `${baseUrl}/v2`,
+        headers: { Accept: 'application/json', 'User-Agent': userAgent },
+        fetch: (request) => fetchFrom(fetchImpl, baseUrl, request),
+    });
+    api.use({
+        async onRequest({ request }) {
+            request.headers.set('Authorization', `Bearer ${await session.accessToken()}`);
+            return request;
+        },
+    });
+    return api;
+}
+/** The body of a successful answer; any other status becomes a CliError with the API's message. */
+export async function unwrap(call) {
+    const { data, error, response } = await call;
+    if (!response.ok) {
+        throw apiErrorFrom(response.status, error);
+    }
+    return data;
+}

package/dist/auth/deviceLogin.js

@@ -0,0 +1,44 @@
+import { AuthError } from '../errors.js';
+import { OAuthError } from './oauth.js';
+/** RFC 8628 §3.5: a `slow_down` answer adds five seconds to the polling interval. */
+const SLOW_DOWN_SECONDS = 5;
+function formatCode(userCode) {
+    return userCode.length === 8 ? `${userCode.slice(0, 4)}-${userCode.slice(4)}` : userCode;
+}
+export async function deviceLogin(oauth, scopes, io) {
+    const code = await oauth.requestDeviceCode(scopes);
+    const url = code.verificationUriComplete ?? code.verificationUri;
+    io.say(`Your one-time code: ${formatCode(code.userCode)}`);
+    const opened = await io.openBrowser(url);
+    io.say(opened
+        ? `A browser window is open at ${code.verificationUri}. Check the code matches, then allow access.`
+        : `Open ${code.verificationUri} in a browser and enter the code above.`);
+    io.say('Waiting for you to allow access…');
+    const deadline = io.now() + code.expiresIn * 1000;
+    let interval = Math.max(code.interval, 1);
+    while (io.now() < deadline) {
+        await io.sleep(interval * 1000);
+        try {
+            return await oauth.pollDeviceToken(code.deviceCode);
+        }
+        catch (error) {
+            if (!(error instanceof OAuthError)) {
+                throw error;
+            }
+            switch (error.code) {
+                case 'authorization_pending':
+                    continue;
+                case 'slow_down':
+                    interval += SLOW_DOWN_SECONDS;
+                    continue;
+                case 'access_denied':
+                    throw new AuthError(`Access was not granted. ${error.description ?? ''}`.trim());
+                case 'expired_token':
+                    throw new AuthError('The code expired before access was allowed. Run `zeeg login` again.');
+                default:
+                    throw new AuthError(`Login failed: ${error.message}`);
+            }
+        }
+    }
+    throw new AuthError('The code expired before access was allowed. Run `zeeg login` again.');
+}

package/dist/auth/oauth.js

@@ -0,0 +1,102 @@
+import { ApiError, fetchFrom } from '../errors.js';
+/** An OAuth error answer (`error`, and the server's explanation when it gives one). */
+export class OAuthError extends Error {
+    code;
+    description;
+    constructor(code, description) {
+        super(description ?? code);
+        this.code = code;
+        this.description = description;
+        this.name = 'OAuthError';
+    }
+}
+/** Reads the `scopes` claim of a Passport JWT; the token response itself does not list them. */
+export function scopesOf(accessToken) {
+    try {
+        const payload = JSON.parse(Buffer.from(accessToken.split('.')[1] ?? '', 'base64url').toString('utf8'));
+        return Array.isArray(payload.scopes) ? payload.scopes.filter((scope) => typeof scope === 'string') : [];
+    }
+    catch {
+        return [];
+    }
+}
+export class HttpOAuthClient {
+    baseUrl;
+    clientId;
+    userAgent;
+    fetchImpl;
+    now;
+    constructor(baseUrl, clientId, userAgent, fetchImpl = fetch, now = Date.now) {
+        this.baseUrl = baseUrl;
+        this.clientId = clientId;
+        this.userAgent = userAgent;
+        this.fetchImpl = fetchImpl;
+        this.now = now;
+    }
+    async requestDeviceCode(scopes) {
+        const body = await this.post('/oauth/device/code', {
+            client_id: this.clientId,
+            scope: scopes.join(' '),
+        });
+        return {
+            deviceCode: String(body.device_code),
+            userCode: String(body.user_code),
+            verificationUri: String(body.verification_uri),
+            verificationUriComplete: typeof body.verification_uri_complete === 'string' ? body.verification_uri_complete : undefined,
+            expiresIn: Number(body.expires_in),
+            interval: Number(body.interval ?? 5),
+        };
+    }
+    async pollDeviceToken(deviceCode) {
+        return this.tokens(await this.post('/oauth/token', {
+            grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+            client_id: this.clientId,
+            device_code: deviceCode,
+        }));
+    }
+    async refresh(refreshToken) {
+        return this.tokens(await this.post('/oauth/token', {
+            grant_type: 'refresh_token',
+            client_id: this.clientId,
+            refresh_token: refreshToken,
+        }));
+    }
+    async logout(accessToken) {
+        const response = await this.send('/oauth/device/logout', {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${accessToken}`, Accept: 'application/json', 'User-Agent': this.userAgent },
+        });
+        if (!response.ok && response.status !== 401) {
+            throw new ApiError(`Zeeg could not end the session (HTTP ${response.status}).`);
+        }
+    }
+    tokens(body) {
+        return {
+            accessToken: body.access_token,
+            refreshToken: body.refresh_token,
+            expiresAt: this.now() + body.expires_in * 1000,
+            scopes: scopesOf(body.access_token),
+        };
+    }
+    async post(path, form) {
+        const response = await this.send(path, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                Accept: 'application/json',
+                'User-Agent': this.userAgent,
+            },
+            body: new URLSearchParams(form).toString(),
+        });
+        const body = (await response.json().catch(() => ({})));
+        if (!response.ok) {
+            // League puts the useful sentence in `hint` (e.g. why access was denied).
+            const description = [body.hint, body.error_description].find((text) => typeof text === 'string' && text !== '');
+            throw new OAuthError(typeof body.error === 'string' ? body.error : `http_${response.status}`, description);
+        }
+        return body;
+    }
+    send(path, init) {
+        return fetchFrom(this.fetchImpl, this.baseUrl, `${this.baseUrl}${path}`, init);
+    }
+}

package/dist/auth/session.js

@@ -0,0 +1,51 @@
+import { AuthError } from '../errors.js';
+import { OAuthError } from './oauth.js';
+/** Refresh this long before the access token expires, so a request never races the expiry. */
+export const REFRESH_MARGIN_MS = 60_000;
+const NOT_LOGGED_IN = 'You are not logged in. Run `zeeg login` first.';
+const SESSION_ENDED = 'Your Zeeg session has ended. Run `zeeg login` to sign in again.';
+/** OAuth answers that mean the refresh token is gone for good. */
+const DEAD_GRANT = new Set(['invalid_grant', 'invalid_client', 'access_denied', 'unauthorized_client']);
+export class Session {
+    store;
+    oauth;
+    now;
+    constructor(store, oauth, now = Date.now) {
+        this.store = store;
+        this.oauth = oauth;
+        this.now = now;
+    }
+    /**
+     * A valid access token, refreshed when it is about to expire. Refresh tokens rotate: a second
+     * `zeeg` process that refreshed first leaves this one holding a spent token, so an
+     * `invalid_grant` is checked against the store before the session is declared over.
+     */
+    async accessToken() {
+        const tokens = await this.store.load();
+        if (tokens === null) {
+            throw new AuthError(NOT_LOGGED_IN);
+        }
+        if (tokens.expiresAt - this.now() > REFRESH_MARGIN_MS) {
+            return tokens.accessToken;
+        }
+        return (await this.refresh(tokens)).accessToken;
+    }
+    async refresh(tokens) {
+        try {
+            const fresh = await this.oauth.refresh(tokens.refreshToken);
+            await this.store.save(fresh);
+            return fresh;
+        }
+        catch (error) {
+            if (!(error instanceof OAuthError) || !DEAD_GRANT.has(error.code)) {
+                throw error;
+            }
+            const current = await this.store.load();
+            if (current !== null && current.refreshToken !== tokens.refreshToken && current.expiresAt - this.now() > REFRESH_MARGIN_MS) {
+                return current;
+            }
+            await this.store.clear();
+            throw new AuthError(SESSION_ENDED);
+        }
+    }
+}

package/dist/auth/tokenStore.js

@@ -0,0 +1,125 @@
+import { chmod, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+const SERVICE = 'zeeg-cli';
+/**
+ * On Linux the library otherwise falls back to the kernel keyring, which is emptied at logout
+ * or reboot; pinned to the Secret Service, a headless host throws and gets the file instead.
+ */
+const loadKeychainEntry = async (service, account) => {
+    const { Entry } = await import('@napi-rs/keyring');
+    return new Entry(service, account, { linux: { store: 'secret-service' } });
+};
+function parse(raw) {
+    if (!raw) {
+        return null;
+    }
+    try {
+        const value = JSON.parse(raw);
+        return typeof value.accessToken === 'string' && typeof value.refreshToken === 'string' && typeof value.expiresAt === 'number'
+            ? { accessToken: value.accessToken, refreshToken: value.refreshToken, expiresAt: value.expiresAt, scopes: value.scopes ?? [] }
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+class KeychainStore {
+    entry;
+    location = 'the system keychain';
+    constructor(entry) {
+        this.entry = entry;
+    }
+    async load() {
+        return parse(this.entry.getPassword());
+    }
+    async save(tokens) {
+        this.entry.setPassword(JSON.stringify(tokens));
+    }
+    async clear() {
+        try {
+            this.entry.deletePassword();
+        }
+        catch {
+            // Nothing stored under this account.
+        }
+    }
+}
+/**
+ * One JSON file holding every API origin's tokens, readable by the owner only (0600 in a 0700
+ * directory). Written through a temporary file and a rename, so a crash never leaves half a file.
+ */
+class FileStore {
+    location;
+    account;
+    announce;
+    constructor(location, account, announce) {
+        this.location = location;
+        this.account = account;
+        this.announce = announce;
+    }
+    async readAll() {
+        try {
+            return JSON.parse(await readFile(this.location, 'utf8'));
+        }
+        catch {
+            return {};
+        }
+    }
+    async writeAll(all) {
+        await mkdir(dirname(this.location), { recursive: true, mode: 0o700 });
+        const temporary = `${this.location}.${process.pid}.tmp`;
+        await writeFile(temporary, JSON.stringify(all, null, 2), { mode: 0o600 });
+        await chmod(temporary, 0o600);
+        await rename(temporary, this.location);
+    }
+    async load() {
+        const all = await this.readAll();
+        return parse(all[this.account] ? JSON.stringify(all[this.account]) : null);
+    }
+    async save(tokens) {
+        const all = await this.readAll();
+        if (Object.keys(all).length === 0) {
+            this.announce(`No system keychain is available, so your Zeeg login is stored in ${this.location} (readable only by you).`);
+        }
+        all[this.account] = tokens;
+        await this.writeAll(all);
+    }
+    async clear() {
+        const all = await this.readAll();
+        delete all[this.account];
+        if (Object.keys(all).length === 0) {
+            await rm(this.location, { force: true });
+        }
+        else {
+            await this.writeAll(all);
+        }
+    }
+}
+export function credentialsFile(env = process.env) {
+    const base = env.XDG_CONFIG_HOME && env.XDG_CONFIG_HOME !== '' ? env.XDG_CONFIG_HOME : join(homedir(), '.config');
+    return join(base, 'zeeg', 'credentials.json');
+}
+/**
+ * Tokens live in the OS keychain (macOS Keychain, Windows Credential Manager, the Secret
+ * Service on Linux), one entry per API origin so local, staging and production logins coexist.
+ * A host without a usable keychain (a headless Linux box has no Secret Service) falls back to
+ * a 0600 file, and says so the first time it writes one. `ZEEG_TOKEN_STORE=file` forces the file.
+ */
+export async function openTokenStore(baseUrl, options = {}) {
+    const env = options.env ?? process.env;
+    const announce = options.announce ?? ((message) => process.stderr.write(`${message}\n`));
+    const fileStore = () => new FileStore(credentialsFile(env), baseUrl, announce);
+    if (env.ZEEG_TOKEN_STORE === 'file') {
+        return fileStore();
+    }
+    try {
+        const entry = await (options.keychain ?? loadKeychainEntry)(SERVICE, baseUrl);
+        // The probe fails here, not at save time, when no keychain backend is running.
+        entry.getPassword();
+        return new KeychainStore(entry);
+    }
+    catch {
+        return fileStore();
+    }
+}

package/dist/cli.js

@@ -0,0 +1,57 @@
+#!/usr/bin/env node
+import { Command } from 'commander';
+import { registerAgents } from './commands/agents.js';
+import { registerAuth } from './commands/auth.js';
+import { registerBookings } from './commands/bookings.js';
+import { registerCalls } from './commands/calls.js';
+import { registerCrm } from './commands/crm.js';
+import { registerEventTypes } from './commands/eventTypes.js';
+import { registerForms } from './commands/forms.js';
+import { registerNotes } from './commands/notes.js';
+import { registerSchedules } from './commands/schedules.js';
+import { createContext } from './context.js';
+import { CliError, ExitCode, exitCodeFor, isCommanderError } from './errors.js';
+import { VERSION } from './version.js';
+export function buildProgram() {
+    const program = new Command('zeeg')
+        .description('Zeeg from your terminal: bookings, availability, notes, CRM, routing forms and AI phone calls.')
+        .version(VERSION)
+        .option('--base-url <url>', 'API origin (default: $ZEEG_API_URL or https://api.zeeg.me)')
+        .option('--json', 'print JSON (the default when output is piped)')
+        .showHelpAfterError('(run with --help to see the options)')
+        .addHelpText('after', `
+Exit codes: 0 ok, 1 usage, 2 not logged in or session ended, 3 the API refused or failed.
+Start with \`zeeg login\`.`)
+        // Every subcommand inherits this, since each is created through `.command()` after it.
+        .exitOverride();
+    let context;
+    const lazyContext = () => (context ??= createContext(program.opts()));
+    registerAuth(program, lazyContext);
+    registerEventTypes(program, lazyContext);
+    registerSchedules(program, lazyContext);
+    registerBookings(program, lazyContext);
+    registerNotes(program, lazyContext);
+    registerCrm(program, lazyContext);
+    registerForms(program, lazyContext);
+    registerCalls(program, lazyContext);
+    registerAgents(program, lazyContext);
+    return program;
+}
+export async function run(argv) {
+    try {
+        await buildProgram().parseAsync(argv);
+        return ExitCode.Ok;
+    }
+    catch (error) {
+        const code = exitCodeFor(error);
+        // Commander has already printed its own usage errors and help.
+        if (error instanceof CliError) {
+            process.stderr.write(`Error: ${error.message}\n`);
+        }
+        else if (!isCommanderError(error)) {
+            process.stderr.write(`Error: ${error instanceof Error ? error.message : String(error)}\n`);
+        }
+        return code;
+    }
+}
+process.exitCode = await run(process.argv);

package/dist/commands/agents.js

@@ -0,0 +1,53 @@
+import { unwrap } from '../api/client.js';
+import { asJson, pageFooter, positiveInt } from './util.js';
+export function registerAgents(program, context) {
+    const agents = program.command('agents').description('AI phone agents and their calls');
+    agents
+        .command('list')
+        .description('List your AI phone agents')
+        .option('--page <n>', 'page number', positiveInt('--page'))
+        .option('--per-page <n>', 'results per page', positiveInt('--per-page'))
+        .action(async (options) => {
+        const ctx = context();
+        const data = asJson(await unwrap((await ctx.api()).GET('/agents', { params: { query: options } })));
+        ctx.print.list(data, (data.data?.agents ?? []), [
+            { header: 'id', value: (row) => row.id },
+            { header: 'title', value: (row) => row.title },
+            { header: 'active', value: (row) => (row.active ? 'yes' : 'no') },
+            { header: 'phone', value: (row) => row.phoneNumber },
+            { header: 'calls', value: (row) => row.totalCalls },
+        ], pageFooter(data.data?.pagination));
+    });
+    agents
+        .command('calls <agentUuid>')
+        .description('List an agent’s calls, newest first')
+        .option('--from <date>', 'calls on or after this day (YYYY-MM-DD, UTC)')
+        .option('--to <date>', 'calls on or before this day (YYYY-MM-DD, UTC)')
+        .option('--direction <direction>', 'inbound or outbound')
+        .option('--page <n>', 'page number', positiveInt('--page'))
+        .option('--per-page <n>', 'results per page', positiveInt('--per-page'))
+        .action(async (agentUuid, options) => {
+        const ctx = context();
+        const data = asJson(await unwrap((await ctx.api()).GET('/agents/{agentUuid}/calls', {
+            params: { path: { agentUuid }, query: options },
+        })));
+        ctx.print.list(data, (data.data?.calls ?? []), [
+            { header: 'id', value: (row) => row.id },
+            { header: 'started', value: (row) => row.startedAt },
+            { header: 'direction', value: (row) => row.direction },
+            { header: 'status', value: (row) => row.status },
+            { header: 'seconds', value: (row) => row.durationSeconds },
+            { header: 'summary', value: (row) => row.callSummaryTitle },
+        ], pageFooter(data.data?.pagination));
+    });
+    agents
+        .command('call <callId>')
+        .description('Show one call with its transcript and collected data')
+        .action(async (callId) => {
+        const ctx = context();
+        const data = asJson(await unwrap((await ctx.api()).GET('/agent-calls/{callId}', {
+            params: { path: { callId } },
+        })));
+        ctx.print.record(data, asJson(data.call));
+    });
+}

package/dist/commands/auth.js

@@ -0,0 +1,60 @@
+import { unwrap } from '../api/client.js';
+import { deviceLogin } from '../auth/deviceLogin.js';
+import { SCOPES } from '../config.js';
+import { AuthError } from '../errors.js';
+export function registerAuth(program, context) {
+    program
+        .command('login')
+        .description('Sign in through your browser with a one-time code')
+        .option('--no-browser', 'print the sign-in link instead of opening a browser')
+        .action(async (options) => {
+        const ctx = context();
+        const tokens = await deviceLogin(ctx.oauth, SCOPES, {
+            say: ctx.say,
+            openBrowser: (url) => (options.browser ? ctx.openBrowser(url) : Promise.resolve(false)),
+            sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+            now: Date.now,
+        });
+        const store = await ctx.store();
+        await store.save(tokens);
+        const me = await unwrap((await ctx.api()).GET('/whoami'));
+        const missing = SCOPES.filter((scope) => !tokens.scopes.includes(scope));
+        ctx.print.message({ email: me.email, baseUrl: ctx.baseUrl, scopes: tokens.scopes, missingScopes: missing, tokenStore: store.location }, [
+            `Logged in to ${ctx.baseUrl} as ${me.email}.`,
+            missing.length > 0 ? `Your plan does not cover: ${missing.join(', ')}. Commands that need them will be refused.` : '',
+        ].filter(Boolean).join('\n'));
+    });
+    program
+        .command('logout')
+        .description('End the session on this machine and revoke its token')
+        .action(async () => {
+        const ctx = context();
+        const store = await ctx.store();
+        if ((await store.load()) === null) {
+            ctx.print.message({ loggedOut: false }, 'You are not logged in.');
+            return;
+        }
+        let revoked = true;
+        try {
+            await ctx.oauth.logout(await (await ctx.session()).accessToken());
+        }
+        catch (error) {
+            // A session that already ended has nothing left to revoke.
+            revoked = error instanceof AuthError;
+            if (!revoked) {
+                ctx.say(`Zeeg could not be told about the logout (${error.message}). The token is removed here and expires within an hour.`);
+            }
+        }
+        await store.clear();
+        ctx.print.message({ loggedOut: true, revoked }, 'Logged out.');
+    });
+    program
+        .command('whoami')
+        .description('Show which Zeeg account the CLI is signed in to')
+        .action(async () => {
+        const ctx = context();
+        const me = await unwrap((await ctx.api()).GET('/whoami'));
+        const tokens = await (await ctx.store()).load();
+        ctx.print.record({ email: me.email, baseUrl: ctx.baseUrl, scopes: tokens?.scopes ?? [] }, { email: me.email, api: ctx.baseUrl, scopes: tokens?.scopes ?? [] });
+    });
+}