@zergai/cyberdeck 0.1.0-beta.1

package/dist/client.js

@@ -0,0 +1,493 @@
+/**
+ * DeckClient — thin HTTP wrapper over the ZergCyberDeck API + a Socket.IO probe
+ * for a running zerg. Authenticated deck calls send the CLI's bearer token;
+ * catalog discovery is intentionally public and never sends a credential.
+ */
+import { io } from 'socket.io-client';
+import { loadConfig } from './config.js';
+import { parseCloneCredential, parseCloneRuntime, } from './runtime.js';
+import { parseDeckPortfolio } from './portfolio.js';
+const FLEET_REQUEST_TIMEOUT_MS = 300_000;
+/** Raw HTTP GET/POST to any URL (used for clone SOC endpoints + /__sim/seed). */
+export async function hit(method, url, opts = {}) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? 15000);
+    try {
+        const res = await fetch(url, {
+            method,
+            headers: opts.headers,
+            body: opts.body,
+            signal: controller.signal,
+        });
+        const text = await res.text();
+        let json = null;
+        try {
+            json = JSON.parse(text);
+        }
+        catch {
+            json = null;
+        }
+        return { status: res.status, json, text };
+    }
+    catch (err) {
+        return { status: 0, json: null, text: String(err instanceof Error ? err.message : err) };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+export class DeckClient {
+    baseUrl;
+    token;
+    constructor(baseUrl, token) {
+        this.baseUrl = baseUrl;
+        this.token = token;
+    }
+    static fromConfig() {
+        const cfg = loadConfig();
+        return new DeckClient(cfg.baseUrl, cfg.token);
+    }
+    async req(method, path, body, authenticated = true, timeoutMs = 30_000, redactedError, extraHeaders = {}) {
+        const token = this.token;
+        if (authenticated && !token) {
+            throw new Error('Not authenticated — run `zcd login` first.');
+        }
+        const headers = { ...extraHeaders };
+        if (authenticated)
+            headers.Authorization = `Bearer ${token}`;
+        if (body !== undefined)
+            headers['Content-Type'] = 'application/json';
+        const res = await fetch(`${this.baseUrl}${path}`, {
+            method,
+            headers,
+            body: body !== undefined ? JSON.stringify(body) : undefined,
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        const text = await res.text();
+        let json;
+        try {
+            json = JSON.parse(text);
+        }
+        catch {
+            json = text;
+        }
+        if (!res.ok) {
+            if (redactedError) {
+                throw new Error(`${method} ${path} → ${res.status}: ${redactedError}`);
+            }
+            const detail = typeof json === 'string' ? json : JSON.stringify(json);
+            throw new Error(`${method} ${path} → ${res.status}: ${detail.slice(0, 300)}`);
+        }
+        return json;
+    }
+    async getCatalog() {
+        const response = await this.req('GET', '/api/catalog', undefined, false);
+        if (!isCloneCatalog(response)) {
+            throw new Error(`GET /api/catalog returned an invalid schema from ${this.baseUrl}`);
+        }
+        return response;
+    }
+    getIdentity() {
+        return this.req('GET', '/api/me');
+    }
+    revokeToken() {
+        return this.req('DELETE', '/api/auth/cli-token');
+    }
+    listScenarioDefinitions(kind = 'scenario', includeDeleted = false) {
+        const query = new URLSearchParams({ kind });
+        if (includeDeleted)
+            query.set('includeDeleted', 'true');
+        return this.req('GET', `/api/scenarios?${query.toString()}`);
+    }
+    getScenarioDefinition(id, includeDeleted = false) {
+        const suffix = includeDeleted ? '?includeDeleted=true' : '';
+        return this.req('GET', `/api/scenarios/${id}${suffix}`);
+    }
+    createScenarioDefinition(input) {
+        return this.req('POST', '/api/scenarios', input);
+    }
+    updateScenarioDefinition(id, input) {
+        return this.req('PATCH', `/api/scenarios/${id}/draft`, input);
+    }
+    publishScenarioDefinition(id, expectedVersion) {
+        return this.req('POST', `/api/scenarios/${id}/publish`, { expectedVersion });
+    }
+    deleteScenarioDefinition(id) {
+        return this.req('DELETE', `/api/scenarios/${id}`);
+    }
+    restoreScenarioDefinition(id) {
+        return this.req('POST', `/api/scenarios/${id}/restore`, {});
+    }
+    launchScenarioRun(deckId, input) {
+        return this.req('POST', `/api/decks/${encodeURIComponent(deckId)}/runs`, input, true, 120_000);
+    }
+    listScenarioRuns(deckId) {
+        return this.req('GET', `/api/decks/${encodeURIComponent(deckId)}/runs`);
+    }
+    getScenarioRun(deckId, runId) {
+        return this.req('GET', `/api/decks/${encodeURIComponent(deckId)}/runs/${encodeURIComponent(runId)}`);
+    }
+    controlScenarioRun(deckId, runId, desired) {
+        return this.req('POST', `/api/decks/${encodeURIComponent(deckId)}/runs/${encodeURIComponent(runId)}/control`, { desired });
+    }
+    listDecks() {
+        return this.req('GET', '/api/decks');
+    }
+    createDeck(name) {
+        return this.req('POST', '/api/decks', { name });
+    }
+    getDeck(id) {
+        return this.req('GET', `/api/decks/${id}`);
+    }
+    deleteDeck(id) {
+        return this.req('DELETE', `/api/decks/${id}`);
+    }
+    addClone(deckId, vendor) {
+        return this.req('POST', `/api/decks/${deckId}/clones`, { vendor });
+    }
+    setClone(deckId, cloneId, status) {
+        return this.req('PATCH', `/api/decks/${deckId}/clones/${cloneId}`, { status });
+    }
+    resetClone(deckId, cloneId) {
+        return this.req('POST', `/api/decks/${deckId}/clones/${cloneId}/reset`, {});
+    }
+    deleteClone(deckId, cloneId) {
+        return this.req('DELETE', `/api/decks/${deckId}/clones/${cloneId}`);
+    }
+    async getRuntime(deckId, cloneId) {
+        const path = `/api/decks/${deckId}/clones/${cloneId}/runtime`;
+        const response = await this.req('GET', path, undefined, true, 30_000, 'runtime request failed');
+        return parseCloneRuntime(response, `GET ${path}`);
+    }
+    getWorkbench(deckId, cloneId) {
+        return this.req('GET', `/api/decks/${deckId}/clones/${cloneId}/workbench`, undefined, true, 60_000, 'clone workbench request failed');
+    }
+    async getCloneDataDump(deckId, cloneId) {
+        const path = `/api/decks/${deckId}/clones/${cloneId}/data-dump`;
+        const response = await this.req('GET', path, undefined, true, 60_000, 'clone data dump request failed');
+        return parseCloneDataDump(response, `GET ${path}`);
+    }
+    async listOracleSets(deckId, limit = 50) {
+        if (!Number.isSafeInteger(limit) || limit < 1 || limit > 100) {
+            throw new Error('Oracle set list limit must be an integer between 1 and 100.');
+        }
+        const path = `/api/decks/${deckId}/oracle-sets?limit=${limit}`;
+        const response = await this.req('GET', path);
+        if (!isRecord(response) || !Array.isArray(response.oracleSets)) {
+            throw new Error(`GET ${path} returned an invalid oracle set list schema`);
+        }
+        return response.oracleSets.map((value, index) => parseOracleSetRecord(value, `GET ${path} oracleSets[${index}]`));
+    }
+    async getOracleSet(deckId, oracleId) {
+        const path = `/api/decks/${deckId}/oracle-sets/${oracleId}`;
+        return parseOracleSetDetail(await this.req('GET', path), `GET ${path}`);
+    }
+    async createOracleSet(deckId, input) {
+        const path = `/api/decks/${deckId}/oracle-sets`;
+        return parseOracleSetDetail(await this.req('POST', path, input), `POST ${path}`);
+    }
+    async materializeOracleSet(deckId, oracleId) {
+        const path = `/api/decks/${deckId}/oracle-sets/${oracleId}/materialize`;
+        return parseOracleSetDetail(await this.req('POST', path, {}), `POST ${path}`);
+    }
+    async transitionOracleSet(deckId, oracleId, input) {
+        const path = `/api/decks/${deckId}/oracle-sets/${oracleId}/transition`;
+        return parseOracleSetDetail(await this.req('POST', path, input), `POST ${path}`);
+    }
+    submitWorkbenchRequirement(deckId, cloneId, requirement) {
+        return this.req('POST', `/api/decks/${deckId}/clones/${cloneId}/workbench/requirements`, { requirement }, true, 60_000, 'clone requirement request failed');
+    }
+    runWorkbenchAction(deckId, cloneId, action, body = {}) {
+        return this.req('POST', `/api/decks/${deckId}/clones/${cloneId}/workbench/actions`, { action, ...body }, true, action === 'hot_apply' ? 660_000 : 60_000, 'clone workbench action failed');
+    }
+    getCloneFileContent(deckId, cloneId, path) {
+        return this.req('GET', `/api/decks/${deckId}/clones/${cloneId}/files/content?path=${encodeURIComponent(path)}`, undefined, true, 60_000, 'clone source read failed');
+    }
+    async revealCredentials(deckId, cloneId) {
+        const path = `/api/decks/${deckId}/clones/${cloneId}/sdk-credentials`;
+        const response = await this.req('POST', path, undefined, true, 30_000, 'credential request failed');
+        return parseCloneCredential(response, `POST ${path}`);
+    }
+    seedClone(deckId, cloneId, reset) {
+        return this.req('POST', `/api/decks/${deckId}/clones/${cloneId}/seed`, { reset });
+    }
+    getDiagnostics(deckId, options = {}) {
+        const query = new URLSearchParams();
+        if (options.cloneId)
+            query.set('cloneId', options.cloneId);
+        if (options.tail !== undefined)
+            query.set('tail', String(options.tail));
+        const suffix = query.size > 0 ? `?${query.toString()}` : '';
+        return this.req('GET', `/api/decks/${deckId}/diagnostics${suffix}`, undefined, true, options.cloneId ? 30_000 : FLEET_REQUEST_TIMEOUT_MS);
+    }
+    async getPortfolio(deckId) {
+        const path = `/api/decks/${deckId}/portfolio`;
+        return parseDeckPortfolio(await this.req('GET', path), `GET ${path}`);
+    }
+    preflightClones(deckId, cloneIds) {
+        return this.req('POST', `/api/decks/${deckId}/clones/preflight`, { cloneIds }, true, FLEET_REQUEST_TIMEOUT_MS);
+    }
+    createCloneStartRun(deckId, cloneIds, idempotencyKey) {
+        return this.req('POST', `/api/decks/${deckId}/clone-start-runs`, { cloneIds }, true, FLEET_REQUEST_TIMEOUT_MS, undefined, { 'Idempotency-Key': idempotencyKey });
+    }
+    getCloneStartRun(deckId, runId) {
+        return this.req('GET', `/api/decks/${deckId}/clone-start-runs/${runId}`);
+    }
+    listCloneStartRuns(deckId, limit) {
+        return this.req('GET', `/api/decks/${deckId}/clone-start-runs?limit=${limit}`);
+    }
+    retryFailedCloneStartRun(deckId, runId) {
+        return this.req('POST', `/api/decks/${deckId}/clone-start-runs/${runId}/retry-failed`, {}, true, FLEET_REQUEST_TIMEOUT_MS);
+    }
+    getCloneLogs(deckId, cloneId, options = {}) {
+        const query = new URLSearchParams();
+        if (options.tail !== undefined)
+            query.set('tail', String(options.tail));
+        if (options.since)
+            query.set('since', options.since);
+        const suffix = query.size > 0 ? `?${query.toString()}` : '';
+        return this.req('GET', `/api/decks/${deckId}/clones/${cloneId}/logs${suffix}`, undefined, true, 30_000, 'log request failed');
+    }
+    startConformance(deckId, cloneId, seed) {
+        return this.req('POST', `/api/decks/${deckId}/clones/${cloneId}/conformance`, { seed });
+    }
+    getConformanceRun(deckId, cloneId, runId, timeoutMs) {
+        return this.req('GET', `/api/decks/${deckId}/clones/${cloneId}/conformance/${runId}`, undefined, true, timeoutMs);
+    }
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+const ORACLE_SET_STATUSES = new Set([
+    'draft',
+    'materializing',
+    'awaiting_parameter_review',
+    'parameters_approved',
+    'executing',
+    'awaiting_answer_review',
+    'answers_approved',
+    'sealing',
+    'ready',
+    'rejected',
+    'failed',
+    'stale',
+]);
+function isOracleSetStatus(value) {
+    return typeof value === 'string' && ORACLE_SET_STATUSES.has(value);
+}
+function isNullableString(value) {
+    return value === null || typeof value === 'string';
+}
+function isSha256OrNull(value) {
+    return value === null || (typeof value === 'string' && /^[a-f0-9]{64}$/.test(value));
+}
+function parseOracleSetRecord(value, label) {
+    if (!isRecord(value)
+        || typeof value.id !== 'string'
+        || typeof value.workspaceId !== 'string'
+        || typeof value.deckId !== 'string'
+        || (value.subjectKind !== 'scenario-run' && value.subjectKind !== 'clone-dump')
+        || typeof value.subjectId !== 'string'
+        || !isOracleSetStatus(value.status)
+        || !Number.isSafeInteger(value.currentVersion)
+        || Number(value.currentVersion) < 1
+        || !isSha256OrNull(value.planHash)
+        || !isSha256OrNull(value.executionHash)
+        || !isSha256OrNull(value.baselineHash)
+        || !isRecord(value.artifact)
+        || !Number.isSafeInteger(value.artifact.sizeBytes)
+        || Number(value.artifact.sizeBytes) < 1
+        || typeof value.artifact.sha256 !== 'string'
+        || !/^[a-f0-9]{64}$/.test(value.artifact.sha256)
+        || typeof value.artifact.contentType !== 'string'
+        || !isNullableString(value.createdByEmail)
+        || !isNullableString(value.updatedByEmail)
+        || !isNullableString(value.failureCode)
+        || !isNullableString(value.failureMessage)
+        || typeof value.createdAt !== 'string'
+        || !Number.isFinite(Date.parse(value.createdAt))
+        || typeof value.updatedAt !== 'string'
+        || !Number.isFinite(Date.parse(value.updatedAt))) {
+        throw new Error(`${label} returned an invalid oracle set schema`);
+    }
+    return value;
+}
+function parseOracleSetDocument(value, label) {
+    if (!isRecord(value)
+        || value.schemaVersion !== 1
+        || value.kind !== 'cybersim/oracle-set'
+        || typeof value.oracleSetId !== 'string'
+        || !Number.isSafeInteger(value.version)
+        || Number(value.version) < 1
+        || !isOracleSetStatus(value.status)
+        || typeof value.draftHash !== 'string'
+        || !/^[a-f0-9]{64}$/.test(value.draftHash)
+        || !isRecord(value.subject)
+        || !Array.isArray(value.questions)) {
+        throw new Error(`${label} returned an invalid oracle document schema`);
+    }
+    return value;
+}
+function parseOracleSetDetail(value, label) {
+    if (!isRecord(value)) {
+        throw new Error(`${label} returned an invalid oracle set detail schema`);
+    }
+    const oracleSet = parseOracleSetRecord(value.oracleSet, `${label} oracleSet`);
+    const document = parseOracleSetDocument(value.document, `${label} document`);
+    if (document.oracleSetId !== oracleSet.id
+        || document.version !== oracleSet.currentVersion
+        || document.status !== oracleSet.status) {
+        throw new Error(`${label} returned inconsistent oracle set projections`);
+    }
+    return { oracleSet, document };
+}
+function parseCloneDataDump(value, label) {
+    if (!isRecord(value)
+        || (value.schemaVersion !== 1 && value.schemaVersion !== 2)
+        || typeof value.capturedAt !== 'string'
+        || typeof value.dataHash !== 'string'
+        || !/^sha256:[a-f0-9]{64}$/.test(value.dataHash)
+        || !Number.isSafeInteger(value.sizeBytes)
+        || value.sizeBytes < 0
+        || !isRecord(value.deck)
+        || typeof value.deck.id !== 'string'
+        || typeof value.deck.name !== 'string'
+        || !isRecord(value.clone)
+        || typeof value.clone.id !== 'string'
+        || typeof value.clone.vendor !== 'string'
+        || typeof value.clone.name !== 'string'
+        || !isRecord(value.snapshot)) {
+        throw new Error(`${label} returned an invalid clone data dump schema`);
+    }
+    if (value.schemaVersion === 2) {
+        const deployment = value.deployment;
+        if (typeof value.subjectHash !== 'string'
+            || !/^sha256:[a-f0-9]{64}$/.test(value.subjectHash)
+            || !isRecord(deployment)
+            || deployment.bindingStatus !== 'bound'
+            || !Number.isSafeInteger(deployment.generation)
+            || deployment.generation < 1
+            || typeof deployment.operationRunId !== 'string'
+            || typeof deployment.operationItemId !== 'string'
+            || !['app', 'zerg'].includes(String(deployment.runtimeMode))
+            || typeof deployment.imageId !== 'string'
+            || typeof deployment.imageDigest !== 'string'
+            || !/^sha256:[a-f0-9]{64}$/.test(deployment.imageDigest)
+            || typeof deployment.sourceCommit !== 'string'
+            || !/^[a-f0-9]{40}$/.test(deployment.sourceCommit)
+            || typeof deployment.inventorySha256 !== 'string'
+            || !/^sha256:[a-f0-9]{64}$/.test(deployment.inventorySha256)) {
+            throw new Error(`${label} returned an invalid clone data dump schema`);
+        }
+    }
+    return value;
+}
+function isCloneTarget(value) {
+    if (!isRecord(value) || !isRecord(value.capabilities))
+        return false;
+    const capabilities = value.capabilities;
+    return (typeof value.id === 'string'
+        && (typeof value.connectorId === 'string' || value.connectorId === null)
+        && typeof value.displayName === 'string'
+        && typeof value.vendorEvokes === 'string'
+        && typeof value.category === 'string'
+        && typeof value.port === 'number'
+        && typeof value.protocol === 'string'
+        && (value.managedCredential === undefined
+            || value.managedCredential === null
+            || isManagedCloneCredential(value.managedCredential))
+        && typeof value.maturity === 'string'
+        && typeof value.conformanceAvailable === 'boolean'
+        && typeof capabilities.query === 'boolean'
+        && typeof capabilities.mutate === 'boolean'
+        && typeof capabilities.ingest === 'boolean'
+        && typeof capabilities.export === 'boolean'
+        && typeof capabilities.ui === 'boolean');
+}
+function isSafeDescriptorText(value) {
+    return (typeof value === 'string'
+        && value.trim().length > 0
+        && value.length <= 160
+        && !/[\u0000-\u001f\u007f]/u.test(value));
+}
+function isManagedCloneCredential(value) {
+    return (isRecord(value)
+        && ((value.kind === 'sdk-token' && value.purpose === 'sdk')
+            || (value.kind === 'api-token' && value.purpose === 'api')
+            || (value.kind === 'console-token' && value.purpose === 'app'))
+        && isSafeDescriptorText(value.label)
+        && isSafeDescriptorText(value.scheme)
+        && isSafeDescriptorText(value.header));
+}
+function isCloneCatalog(value) {
+    return (isRecord(value)
+        && value.schemaVersion === 1
+        && Array.isArray(value.targets)
+        && value.targets.every(isCloneTarget));
+}
+/**
+ * Connect to a running zerg's Socket.IO service (:3333) and report whether it
+ * speaks the zerg contract + which manifest it's running. Mirrors what ZDE does
+ * on attach.
+ */
+export function probeZerg(socketUrl, timeoutMs = 15000) {
+    const origin = socketUrl.replace(/\/socket\.io\/?$/, '');
+    return new Promise((resolve) => {
+        const sock = io(origin, {
+            path: '/socket.io/',
+            transports: ['websocket'],
+            reconnection: false,
+            timeout: timeoutMs,
+        });
+        const finish = (r) => {
+            try {
+                sock.close();
+            }
+            catch {
+                // ignore
+            }
+            resolve(r);
+        };
+        const timer = setTimeout(() => finish({ connected: false, error: 'connect timeout' }), timeoutMs + 3000);
+        const ack = (event, data) => new Promise((res) => {
+            let settled = false;
+            const t = setTimeout(() => {
+                if (!settled) {
+                    settled = true;
+                    res({});
+                }
+            }, 10000);
+            sock.emit(event, data, (resp) => {
+                if (!settled) {
+                    settled = true;
+                    clearTimeout(t);
+                    res(resp ?? {});
+                }
+            });
+        });
+        sock.on('connect_error', (e) => {
+            clearTimeout(timer);
+            finish({ connected: false, error: String(e?.message || e) });
+        });
+        sock.on('connect', () => {
+            void (async () => {
+                const cmds = await ack('fetch_zerg_commands', {});
+                const upd = await ack('request_zerg_update', { tail: 1 });
+                const probe = await ack('probe_status', {});
+                clearTimeout(timer);
+                const snap = upd.snapshot ?? {};
+                const manifest = snap.manifest;
+                finish({
+                    connected: true,
+                    contractVersion: cmds.contract_version,
+                    supportedEvents: Array.isArray(cmds.supported_events) ? cmds.supported_events.length : undefined,
+                    manifest: manifest?.name ?? probe.manifest_name,
+                    serviceStatus: snap.service_status,
+                    zergInitialized: snap.zerg_initialized,
+                    available: probe.available,
+                });
+            })();
+        });
+    });
+}
+//# sourceMappingURL=client.js.map

package/dist/commands/auth.js

@@ -0,0 +1,193 @@
+import { DeckClient } from '../client.js';
+import { configFilePath, loadConfig, saveConfig } from '../config.js';
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+async function readJsonResponse(response) {
+    const text = await response.text();
+    try {
+        const value = JSON.parse(text);
+        if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+            return value;
+        }
+    }
+    catch {
+        // The status and bounded response text below are more useful than a JSON parse error.
+    }
+    return { detail: text.slice(0, 200) };
+}
+function responseDetail(payload) {
+    for (const key of ['error_description', 'statusMessage', 'detail', 'error']) {
+        if (typeof payload[key] === 'string')
+            return payload[key];
+    }
+    return JSON.stringify(payload).slice(0, 200);
+}
+async function openBrowser(url) {
+    const { spawn } = await import('node:child_process');
+    const command = process.platform === 'darwin'
+        ? 'open'
+        : process.platform === 'win32'
+            ? 'cmd'
+            : 'xdg-open';
+    const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
+    await new Promise((resolve) => {
+        const child = spawn(command, args, { detached: true, stdio: 'ignore' });
+        let settled = false;
+        const finish = () => {
+            if (settled)
+                return;
+            settled = true;
+            resolve();
+        };
+        child.once('spawn', () => {
+            child.unref();
+            finish();
+        });
+        child.once('error', (error) => {
+            console.warn(`Could not open a browser automatically: ${error.message}`);
+            finish();
+        });
+    });
+}
+async function startDeviceAuthorization(baseUrl, workspace) {
+    const response = await fetch(`${baseUrl}/api/auth/cli-device/start`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(workspace ? { workspace } : {}),
+        signal: AbortSignal.timeout(30_000),
+    });
+    const payload = await readJsonResponse(response);
+    if (!response.ok) {
+        throw new Error(`login failed: ${response.status} ${responseDetail(payload)}`);
+    }
+    if (typeof payload.device_code !== 'string'
+        || typeof payload.user_code !== 'string'
+        || typeof payload.verification_uri !== 'string'
+        || typeof payload.verification_uri_complete !== 'string'
+        || typeof payload.expires_in !== 'number'
+        || typeof payload.interval !== 'number') {
+        throw new Error('login failed: device authorization server returned an invalid response');
+    }
+    return payload;
+}
+async function pollDeviceAuthorization(baseUrl, start) {
+    const deadline = Date.now() + Math.max(1, start.expires_in) * 1000;
+    let intervalMs = Math.max(0, start.interval) * 1000;
+    while (Date.now() < deadline) {
+        const response = await fetch(`${baseUrl}/api/auth/cli-device/token`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ device_code: start.device_code }),
+            signal: AbortSignal.timeout(Math.max(1, Math.min(30_000, deadline - Date.now()))),
+        });
+        const payload = await readJsonResponse(response);
+        const oauthError = typeof payload.error === 'string' ? payload.error : undefined;
+        if (oauthError === 'authorization_pending') {
+            await sleep(Math.min(intervalMs, Math.max(0, deadline - Date.now())));
+            continue;
+        }
+        if (oauthError === 'slow_down') {
+            intervalMs += 5000;
+            await sleep(Math.min(intervalMs, Math.max(0, deadline - Date.now())));
+            continue;
+        }
+        if (oauthError === 'access_denied')
+            throw new Error('Authorization denied.');
+        if (oauthError === 'expired_token')
+            throw new Error('Authorization expired; run `zcd login` again.');
+        if (!response.ok) {
+            throw new Error(`login failed: ${response.status} ${responseDetail(payload)}`);
+        }
+        if (typeof payload.access_token !== 'string'
+            || payload.token_type !== 'Bearer'
+            || typeof payload.expires_in !== 'number'
+            || typeof payload.scope !== 'string'
+            || typeof payload.workspace !== 'object'
+            || payload.workspace === null
+            || Array.isArray(payload.workspace)) {
+            throw new Error('login failed: token endpoint returned an invalid response');
+        }
+        const workspace = payload.workspace;
+        if (typeof workspace.id !== 'string' || typeof workspace.name !== 'string') {
+            throw new Error('login failed: token endpoint returned an invalid workspace');
+        }
+        return payload;
+    }
+    throw new Error('Authorization expired; run `zcd login` again.');
+}
+export function registerAuthCommands(program) {
+    program
+        .command('login')
+        .description('Authenticate in a browser and mint a workspace-bound personal token')
+        .option('--url <url>', 'Deck base URL (default: from config / ZERGCYBERDECK_BASE_URL)')
+        .option('--workspace <name>', 'request access to this workspace (name or id)')
+        .option('--no-browser', 'print the verification URL without opening a browser')
+        .action(async (opts) => {
+        const cfg = loadConfig();
+        const baseUrl = (opts.url || cfg.baseUrl).replace(/\/+$/, '');
+        const workspace = opts.workspace || process.env.ZERGCYBERDECK_WORKSPACE;
+        const start = await startDeviceAuthorization(baseUrl, workspace);
+        console.log(`Open ${start.verification_uri}`);
+        console.log(`User code: ${start.user_code}`);
+        if (opts.browser)
+            await openBrowser(start.verification_uri_complete);
+        const approved = await pollDeviceAuthorization(baseUrl, start);
+        const expiresAt = Math.floor(Date.now() / 1000) + approved.expires_in;
+        saveConfig({
+            baseUrl,
+            token: approved.access_token,
+            expiresAt,
+            workspace: approved.workspace,
+        });
+        console.log(`Logged in to ${baseUrl} (workspace: ${approved.workspace.name})`);
+        console.log(`Token saved to ${configFilePath()} (expires ${new Date(expiresAt * 1000).toISOString()})`);
+    });
+    program
+        .command('whoami')
+        .description('Show the current CLI identity + target deck')
+        .action(async () => {
+        const cfg = loadConfig();
+        if (!cfg.token) {
+            console.log('Not logged in. Run: zcd login');
+            return;
+        }
+        const identity = await DeckClient.fromConfig().getIdentity();
+        console.log(`deck:      ${cfg.baseUrl}`);
+        console.log(`sub:       ${identity.sub}`);
+        console.log(`email:     ${identity.email}`);
+        console.log(`workspace: ${identity.workspace_name ?? '?'}${identity.workspace_link_id ? ` (${identity.workspace_link_id})` : ''}`);
+        console.log(`role:      ${identity.workspace_role ?? '?'}`);
+        console.log(`superuser: ${identity.is_superuser}`);
+        console.log(`scopes:    ${identity.scopes.join(', ')}`);
+        if (cfg.expiresAt)
+            console.log(`expires:   ${new Date(cfg.expiresAt * 1000).toISOString()}`);
+    });
+    program
+        .command('logout')
+        .description('Revoke the current personal token and remove it from this machine')
+        .action(async () => {
+        const cfg = loadConfig();
+        if (!cfg.token) {
+            console.log('Not logged in.');
+            return;
+        }
+        let revocationError;
+        try {
+            await DeckClient.fromConfig().revokeToken();
+        }
+        catch (error) {
+            revocationError = error;
+        }
+        saveConfig({ baseUrl: cfg.baseUrl });
+        if (process.env.ZERGCYBERDECK_TOKEN) {
+            console.warn('ZERGCYBERDECK_TOKEN is still set in this process environment; remove it at its source.');
+        }
+        if (revocationError) {
+            const detail = revocationError instanceof Error
+                ? revocationError.message
+                : String(revocationError);
+            throw new Error(`Local credential removed, but server revocation failed: ${detail}`);
+        }
+        console.log(`Logged out of ${cfg.baseUrl}.`);
+    });
+}
+//# sourceMappingURL=auth.js.map