epismo 1.3.0 → 1.4.0

package/dist/auth.js

@@ -1,658 +0,0 @@
-import { createServer } from "node:http";
-import { randomBytes, createHash, timingSafeEqual } from "node:crypto";
-import { spawn } from "node:child_process";
-import { once } from "node:events";
-import { createInterface } from "node:readline/promises";
-import { stdin as input, stderr as output } from "node:process";
-import { clearCredentials, readCliConfig, readCredentials, resolveApiUrl, resolveWebUrl, writeCliConfig, writeCredentials } from "./config.js";
-import { requestJson } from "./api.js";
-import { CliError } from "./errors.js";
-import { printWarning } from "./output.js";
-import { resolveWorkspaceSelection } from "./workspace.js";
-import { analytics } from "./analytics.js";
-const CLI_CLIENT_ID = "epismo-cli";
-const TOKEN_REFRESH_THRESHOLD_MS = 5 * 60 * 1000;
-// #8: common hint strings — defined once so wording is consistent everywhere
-const HINT_RUN_LOGIN = "Set EPISMO_TOKEN or run `epismo login`.";
-const HINT_RUN_LOGIN_BROWSER = "Run `epismo login` in an interactive terminal, or use a pre-issued EPISMO_TOKEN.";
-const REFRESH_RACE_RETRY_DELAYS_MS = [100, 200, 400, 800];
-// #9: browser login progress warning codes — defined once so wording is consistent everywhere
-const WARNING_BROWSER_OPENING = "BROWSER_OPENING";
-const WARNING_BROWSER_FALLBACK_URL = "BROWSER_FALLBACK_URL";
-const WARNING_BROWSER_WAITING = "BROWSER_WAITING";
-const WARNING_BROWSER_AUTHORIZED = "BROWSER_AUTHORIZED";
-const WARNING_OTP_SENT = "OTP_SENT";
-export function hasEnvTokenAuthentication() {
-    return Boolean(process.env.EPISMO_TOKEN?.trim());
-}
-async function prompt(question) {
-    if (input.isTTY !== true || output.isTTY !== true) {
-        throw new CliError({
-            code: "NON_INTERACTIVE_INPUT_REQUIRED",
-            message: "This login requires interactive input, but no TTY is available.",
-            hint: "Run the command in a terminal, or use a pre-issued EPISMO_TOKEN."
-        });
-    }
-    const readline = createInterface({ input, output });
-    try {
-        return (await readline.question(question)).trim();
-    }
-    finally {
-        readline.close();
-    }
-}
-function generatePkce() {
-    const verifier = randomBytes(32).toString("base64url");
-    const challenge = createHash("sha256").update(verifier).digest("base64url");
-    return { verifier, challenge };
-}
-function generateState() {
-    return randomBytes(32).toString("base64url");
-}
-async function openBrowser(url) {
-    const platform = process.platform;
-    const command = platform === "darwin"
-        ? { file: "open", args: [url] }
-        : platform === "win32"
-            ? { file: "cmd", args: ["/c", "start", "", url] }
-            : { file: "xdg-open", args: [url] };
-    await new Promise((resolve, reject) => {
-        const child = spawn(command.file, command.args, { detached: true, stdio: "ignore" });
-        child.once("error", (error) => {
-            reject(new CliError({
-                code: "BROWSER_OPEN_FAILED",
-                message: error.message,
-                hint: `Open this URL manually in your browser: ${url}`
-            }));
-        });
-        child.once("spawn", () => {
-            child.unref();
-            resolve();
-        });
-    });
-}
-function respondCallbackHtml(res, message) {
-    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-    res.end(`<html><body><p>${message}</p></body></html>`);
-}
-// Constant-time comparison so the callback state cannot be probed via timing.
-function isExpectedState(received, expected) {
-    if (received === null) {
-        return false;
-    }
-    const a = Buffer.from(received);
-    const b = Buffer.from(expected);
-    return a.length === b.length && timingSafeEqual(a, b);
-}
-async function startOAuthCallbackServer(expectedState) {
-    const server = createServer();
-    server.listen(0, "127.0.0.1");
-    await once(server, "listening");
-    const address = server.address();
-    if (!address || typeof address === "string") {
-        server.close();
-        throw new CliError({
-            code: "OAUTH_CALLBACK_FAILED",
-            message: "Failed to bind a local callback port for browser login."
-        });
-    }
-    const redirectUri = `http://127.0.0.1:${address.port}/callback`;
-    let resolveCallback;
-    let rejectCallback;
-    const callbackPromise = new Promise((resolve, reject) => {
-        resolveCallback = resolve;
-        rejectCallback = reject;
-    });
-    let timeoutId;
-    let settled = false;
-    const finish = (settle) => {
-        if (settled) {
-            return;
-        }
-        settled = true;
-        clearTimeout(timeoutId);
-        server.close();
-        settle();
-    };
-    // Attach handlers immediately — before the browser is opened — so a fast
-    // callback can never arrive in the window between listen() and the listener
-    // being registered. Requests that land before waitForCallback() simply settle
-    // the promise it returns.
-    server.on("request", (req, res) => {
-        const url = new URL(req.url ?? "/", redirectUri);
-        if (url.pathname !== "/callback") {
-            res.writeHead(404);
-            res.end();
-            return;
-        }
-        const code = url.searchParams.get("code");
-        const error = url.searchParams.get("error");
-        const state = url.searchParams.get("state");
-        const workspaceId = url.searchParams.get("workspace_id") ?? undefined;
-        if (!isExpectedState(state, expectedState)) {
-            respondCallbackHtml(res, "Authorization failed. Please close this tab and try again.");
-            finish(() => rejectCallback(new CliError({
-                code: "INVALID_OAUTH_STATE",
-                message: "OAuth callback state did not match the login request.",
-                retryable: true,
-                hint: HINT_RUN_LOGIN_BROWSER
-            })));
-            return;
-        }
-        if (error) {
-            respondCallbackHtml(res, "Authorization denied. You may close this tab.");
-            finish(() => rejectCallback(new CliError({
-                code: "AUTHORIZATION_DENIED",
-                message: `Authorization denied: ${error}`,
-                retryable: false
-            })));
-            return;
-        }
-        if (!code) {
-            respondCallbackHtml(res, "Authorization failed. Please close this tab and try again.");
-            finish(() => rejectCallback(new CliError({
-                code: "AUTHORIZATION_CODE_MISSING",
-                message: "No authorization code received from the browser callback.",
-                retryable: true
-            })));
-            return;
-        }
-        respondCallbackHtml(res, "Authorization complete. Return to your terminal to continue.");
-        finish(() => resolveCallback({ code, workspaceId }));
-    });
-    server.on("error", (err) => {
-        finish(() => rejectCallback(err instanceof Error
-            ? new CliError({
-                code: "OAUTH_CALLBACK_FAILED",
-                message: err.message,
-                retryable: true
-            })
-            : err));
-    });
-    const waitForCallback = () => {
-        if (settled || timeoutId !== undefined) {
-            return callbackPromise;
-        }
-        timeoutId = setTimeout(() => {
-            finish(() => rejectCallback(new CliError({
-                code: "AUTHORIZATION_TIMED_OUT",
-                message: "Authorization timed out after 5 minutes.",
-                retryable: true,
-                hint: HINT_RUN_LOGIN_BROWSER
-            })));
-        }, 5 * 60 * 1000);
-        return callbackPromise;
-    };
-    return { redirectUri, waitForCallback };
-}
-async function postOAuthToken(apiUrl, body) {
-    return requestJson(apiUrl, "/oauth/token", {
-        method: "POST",
-        body
-    });
-}
-async function resolveLoginMethod(apiUrl, email) {
-    const response = await requestJson(apiUrl, "/v1/login-options", {
-        method: "POST",
-        body: { email }
-    });
-    if (response.method !== "sso" && response.method !== "otp") {
-        throw new CliError({
-            code: "LOGIN_METHOD_INVALID",
-            message: "The server returned an unsupported login method.",
-            retryable: true
-        });
-    }
-    return response.method;
-}
-async function loginWithOtp(apiUrl, email) {
-    if (input.isTTY !== true || output.isTTY !== true) {
-        throw new CliError({
-            code: "NON_INTERACTIVE_INPUT_REQUIRED",
-            message: "Email-code login requires an interactive terminal.",
-            hint: "Run the command in a terminal, or use a pre-issued EPISMO_TOKEN."
-        });
-    }
-    const issued = await requestJson(apiUrl, "/v1/otp-tokens", {
-        method: "POST",
-        body: { email }
-    });
-    const otpId = issued.otpId?.trim();
-    if (!otpId) {
-        throw new CliError({
-            code: "OTP_ID_MISSING",
-            message: "Failed to obtain an OTP id from the server.",
-            retryable: true
-        });
-    }
-    printWarning({
-        warning: { code: WARNING_OTP_SENT, message: `A sign-in code was sent to ${email}.` }
-    });
-    const otp = await prompt("Code: ");
-    if (!otp) {
-        throw new CliError({
-            code: "OTP_CODE_REQUIRED",
-            message: "A sign-in code is required.",
-            hint: `Run \`epismo login --email ${email}\` to request a new code.`
-        });
-    }
-    const tokenResponse = await postOAuthToken(apiUrl, {
-        grant_type: "otp",
-        otp_id: otpId,
-        otp,
-        client_id: CLI_CLIENT_ID
-    });
-    return toVerifiedLogin(tokenResponse, await fetchUserInfo(apiUrl, tokenResponse.access_token));
-}
-async function fetchUserInfo(apiUrl, accessToken) {
-    return requestJson(apiUrl, "/oauth/userinfo", {
-        authToken: accessToken
-    });
-}
-export async function resolvePersonalAccountId(auth) {
-    const cached = auth.accountId?.trim();
-    if (cached)
-        return cached;
-    const userInfo = await fetchUserInfo(resolveApiUrl(), auth.accessToken);
-    const accountId = userInfo.account_id?.trim();
-    if (!accountId) {
-        throw new CliError({
-            code: "ACCOUNT_ID_UNAVAILABLE",
-            message: "The authenticated user does not have a personal Account ID.",
-            hint: "Pass --owner-id explicitly, or run `epismo login` again."
-        });
-    }
-    return accountId;
-}
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}
-function shouldRefreshCredentials(credentials) {
-    const expiresAt = new Date(credentials.expiresAt).getTime();
-    return !Number.isFinite(expiresAt) || expiresAt - Date.now() < TOKEN_REFRESH_THRESHOLD_MS;
-}
-async function fetchWorkspaces(apiUrl, accessToken) {
-    const response = await requestJson(apiUrl, "/v1/workspaces", {
-        authToken: accessToken
-    });
-    return response.workspaces;
-}
-function toSavedWorkspace(workspace) {
-    if (!workspace) {
-        return undefined;
-    }
-    return {
-        id: workspace.id,
-        handle: workspace.handle,
-        accountId: workspace.accountId,
-        role: workspace.role
-    };
-}
-export function buildCliAuthorizationUrl(input) {
-    const authorizeUrl = new URL(`${input.webUrl}/oauth/authorize`);
-    authorizeUrl.searchParams.set("response_type", "code");
-    authorizeUrl.searchParams.set("client_id", CLI_CLIENT_ID);
-    authorizeUrl.searchParams.set("redirect_uri", input.redirectUri);
-    authorizeUrl.searchParams.set("scope", "read write offline_access");
-    authorizeUrl.searchParams.set("code_challenge", input.challenge);
-    authorizeUrl.searchParams.set("code_challenge_method", "S256");
-    authorizeUrl.searchParams.set("state", input.state);
-    const email = input.email?.trim();
-    if (email)
-        authorizeUrl.searchParams.set("login_hint", email);
-    return authorizeUrl;
-}
-async function loginWithBrowser(apiUrl, webUrl, email) {
-    if (output.isTTY !== true) {
-        throw new CliError({
-            code: "NON_INTERACTIVE_BROWSER_LOGIN",
-            message: "Browser login requires an interactive terminal.",
-            hint: HINT_RUN_LOGIN_BROWSER
-        });
-    }
-    const { verifier, challenge } = generatePkce();
-    const state = generateState();
-    const { redirectUri, waitForCallback } = await startOAuthCallbackServer(state);
-    const authorizeUrl = buildCliAuthorizationUrl({ webUrl, redirectUri, challenge, state, email });
-    const authorizeUrlString = authorizeUrl.toString();
-    printWarning({
-        warning: { code: WARNING_BROWSER_OPENING, message: "Opening browser for authorization..." }
-    });
-    printWarning({
-        warning: {
-            code: WARNING_BROWSER_FALLBACK_URL,
-            message: `If the browser does not open, visit: ${authorizeUrlString}`
-        }
-    });
-    try {
-        await openBrowser(authorizeUrlString);
-    }
-    catch (cause) {
-        if (!(cause instanceof CliError) || cause.code !== "BROWSER_OPEN_FAILED") {
-            throw cause;
-        }
-        // The callback server is already listening and the URL was printed above,
-        // so manual browser navigation can complete the same authorization flow.
-    }
-    printWarning({
-        warning: {
-            code: WARNING_BROWSER_WAITING,
-            message: "Waiting for authorization in your browser (times out in 5 minutes)..."
-        }
-    });
-    const { code, workspaceId } = await waitForCallback();
-    printWarning({
-        warning: {
-            code: WARNING_BROWSER_AUTHORIZED,
-            message: "Authorization received. Completing sign-in..."
-        }
-    });
-    const tokenResponse = await postOAuthToken(apiUrl, {
-        grant_type: "authorization_code",
-        code,
-        client_id: CLI_CLIENT_ID,
-        redirect_uri: redirectUri,
-        code_verifier: verifier
-    });
-    const verified = toVerifiedLogin(tokenResponse, await fetchUserInfo(apiUrl, tokenResponse.access_token));
-    return { ...verified, workspaceId };
-}
-// Compare and store canonical lowercased addresses so the same account typed
-// with different casing does not trigger an unnecessary browser login.
-export function normalizeEmail(email) {
-    return email.trim().toLowerCase();
-}
-function toVerifiedLogin(tokenResponse, userInfo) {
-    const expiresAt = new Date(Date.now() + tokenResponse.expires_in * 1000).toISOString();
-    return {
-        credentials: {
-            accessToken: tokenResponse.access_token,
-            refreshToken: tokenResponse.refresh_token,
-            expiresAt,
-            clientId: CLI_CLIENT_ID,
-            userId: userInfo.sub,
-            accountId: userInfo.account_id
-        },
-        email: userInfo.email ? normalizeEmail(userInfo.email) : undefined
-    };
-}
-// A workspace_id chosen on the browser consent screen that matches the caller's own
-// user id is their personal account, not an org workspace — nothing to look up or
-// adopt as a default. Otherwise, resolve it against the accessible workspace list so
-// the CLI can adopt the same workspace the user just authorized in the browser.
-async function resolveLoginWorkspace(apiUrl, accessToken, userId, workspaceId) {
-    if (workspaceId === userId) {
-        return undefined;
-    }
-    const workspaces = await fetchWorkspaces(apiUrl, accessToken);
-    return toSavedWorkspace(workspaces.find((workspace) => workspace.id === workspaceId));
-}
-// Persist tokens, remember the verified email, and identify.
-async function persistLogin(credentials, config, lastLoginEmail) {
-    await writeCredentials(credentials);
-    await writeCliConfig({
-        ...config,
-        lastLoginEmail: lastLoginEmail ?? config.lastLoginEmail
-    });
-    // auth.signed_in is emitted server-side by the API at /oauth/token.
-    analytics.identify({ userId: credentials.userId }, config.defaultWorkspace?.id);
-}
-function toLoggedIn(credentials, lastLoginEmail, config, alreadyLoggedIn) {
-    // The default-workspace nudge only applies to a fresh sign-in; the
-    // already-logged-in case carries its own hint in the CLI layer.
-    const hint = !alreadyLoggedIn && !config.defaultWorkspace
-        ? "No default workspace set. Run `epismo workspace use --workspace-id <id>` to set a default workspace."
-        : undefined;
-    return {
-        kind: "logged_in",
-        alreadyLoggedIn,
-        userId: credentials.userId,
-        expiresAt: credentials.expiresAt,
-        lastLoginEmail: lastLoginEmail ?? config.lastLoginEmail,
-        ...(hint ? { hint } : {})
-    };
-}
-// Without an email, Web browser OAuth owns login-method selection. With an
-// email, the API performs the same domain discovery: SSO continues in the
-// browser while OTP completes interactively here in the terminal.
-export async function login(options) {
-    const apiUrl = resolveApiUrl();
-    const webUrl = resolveWebUrl();
-    const config = await readCliConfig();
-    const requestedEmail = options.email?.trim() ? normalizeEmail(options.email) : undefined;
-    // Reuse a fresh credential only when the requested account matches.
-    const existing = await readCredentials();
-    if (existing && !shouldRefreshCredentials(existing)) {
-        const sameAccount = !requestedEmail ||
-            (!!config.lastLoginEmail && requestedEmail === normalizeEmail(config.lastLoginEmail));
-        if (sameAccount) {
-            return toLoggedIn(existing, config.lastLoginEmail, config, true);
-        }
-    }
-    const verified = requestedEmail && (await resolveLoginMethod(apiUrl, requestedEmail)) === "otp"
-        ? await loginWithOtp(apiUrl, requestedEmail)
-        : await loginWithBrowser(apiUrl, webUrl, requestedEmail);
-    const lastLoginEmail = verified.email ?? config.lastLoginEmail;
-    const { credentials } = verified;
-    // Adopt the workspace chosen on the browser consent screen (if any) as the local
-    // default, so a fresh browser login into an org workspace doesn't also require a
-    // separate `epismo workspace use`.
-    const selectedWorkspace = verified.workspaceId
-        ? await resolveLoginWorkspace(apiUrl, credentials.accessToken, credentials.userId, verified.workspaceId)
-        : undefined;
-    const updatedConfig = selectedWorkspace
-        ? { ...config, defaultWorkspace: selectedWorkspace }
-        : config;
-    await persistLogin(credentials, updatedConfig, lastLoginEmail);
-    return toLoggedIn(credentials, lastLoginEmail, updatedConfig, false);
-}
-export async function logout() {
-    const credentials = await readCredentials();
-    const hadCredentials = Boolean(credentials?.accessToken);
-    if (credentials?.refreshToken) {
-        try {
-            await requestJson(resolveApiUrl(), "/oauth/revoke", {
-                method: "POST",
-                authToken: credentials.accessToken,
-                body: { token: credentials.refreshToken, client_id: credentials.clientId }
-            });
-        }
-        catch {
-            // Clear local state even when server-side revocation fails.
-        }
-    }
-    await clearCredentials();
-    // auth.signed_out is emitted server-side by the API at /oauth/revoke.
-    return { cleared: true, hadCredentials };
-}
-async function refreshAccessToken(credentials, apiUrl) {
-    const tokenResponse = await postOAuthToken(apiUrl, {
-        grant_type: "refresh_token",
-        refresh_token: credentials.refreshToken,
-        client_id: credentials.clientId
-    });
-    const expiresAt = new Date(Date.now() + tokenResponse.expires_in * 1000).toISOString();
-    const updated = {
-        ...credentials,
-        accessToken: tokenResponse.access_token,
-        refreshToken: tokenResponse.refresh_token,
-        expiresAt
-    };
-    await writeCredentials(updated);
-    return updated;
-}
-async function readCredentialsRefreshedByAnotherProcess(original) {
-    for (const delayMs of REFRESH_RACE_RETRY_DELAYS_MS) {
-        const latest = await readCredentials();
-        if (latest?.userId === original.userId &&
-            latest.accessToken !== original.accessToken &&
-            !shouldRefreshCredentials(latest)) {
-            return latest;
-        }
-        await sleep(delayMs);
-    }
-    return undefined;
-}
-export async function resolveAuthentication() {
-    const envToken = process.env.EPISMO_TOKEN?.trim();
-    if (envToken) {
-        // EPISMO_TOKEN is a pre-issued token (CI/CD). Skip the /oauth/userinfo
-        // round-trip on every command: userId here is only consumed by the no-op
-        // analytics.identify(), and `whoami` fetches identity itself when needed.
-        return {
-            mode: "oauth",
-            userId: "",
-            accessToken: envToken
-        };
-    }
-    const credentials = await readCredentials();
-    if (!credentials?.accessToken || !credentials.userId) {
-        throw new CliError({
-            code: "NOT_AUTHENTICATED",
-            message: "Not authenticated.",
-            hint: HINT_RUN_LOGIN
-        });
-    }
-    const apiUrl = resolveApiUrl();
-    if (shouldRefreshCredentials(credentials)) {
-        if (!credentials.refreshToken) {
-            throw new CliError({
-                code: "TOKEN_EXPIRED",
-                message: "Token expired and no refresh token is available.",
-                hint: HINT_RUN_LOGIN
-            });
-        }
-        try {
-            const refreshed = await refreshAccessToken(credentials, apiUrl);
-            return {
-                mode: "oauth",
-                userId: refreshed.userId,
-                accessToken: refreshed.accessToken,
-                expiresAt: refreshed.expiresAt,
-                accountId: refreshed.accountId
-            };
-        }
-        catch (refreshError) {
-            const refreshedByAnotherProcess = await readCredentialsRefreshedByAnotherProcess(credentials);
-            if (refreshedByAnotherProcess) {
-                return {
-                    mode: "oauth",
-                    userId: refreshedByAnotherProcess.userId,
-                    accessToken: refreshedByAnotherProcess.accessToken,
-                    expiresAt: refreshedByAnotherProcess.expiresAt,
-                    accountId: refreshedByAnotherProcess.accountId
-                };
-            }
-            const isRetryable = refreshError instanceof CliError ? refreshError.retryable : true;
-            throw new CliError({
-                code: "TOKEN_REFRESH_FAILED",
-                message: isRetryable
-                    ? "Token refresh failed due to a network or server error."
-                    : "Session expired. Please log in again.",
-                retryable: isRetryable,
-                hint: isRetryable
-                    ? `Check your network connection and try again, or run \`epismo login\`.`
-                    : HINT_RUN_LOGIN
-            });
-        }
-    }
-    return {
-        mode: "oauth",
-        userId: credentials.userId,
-        accessToken: credentials.accessToken,
-        expiresAt: credentials.expiresAt,
-        accountId: credentials.accountId
-    };
-}
-export async function whoami(options) {
-    const workspace = await resolveWorkspaceSelection();
-    const auth = options.auth ?? (await resolveAuthentication());
-    const apiUrl = resolveApiUrl();
-    const [user, workspaces] = await Promise.all([
-        fetchUserInfo(apiUrl, auth.accessToken),
-        fetchWorkspaces(apiUrl, auth.accessToken)
-    ]);
-    return {
-        auth: {
-            mode: auth.mode,
-            expiresAt: auth.expiresAt
-        },
-        user: {
-            id: user.sub,
-            email: user.email,
-            // Free-text display name, not unique and not addressable.
-            username: user.username,
-            // Public identifier: the <handle> in pb:<handle>/<alias>. Null until
-            // the user claims one.
-            handle: user.handle ?? null,
-            // Immutable; the default --owner-id for `epismo playbook create`.
-            accountId: user.account_id ?? null
-        },
-        defaultWorkspaceId: workspace.defaultWorkspace?.id ?? null,
-        defaultWorkspaceApplied: workspace.envTokenActive === false,
-        effectiveWorkspaceId: workspace.effectiveWorkspaceId ?? null,
-        workspaces
-    };
-}
-export async function listAvailableWorkspaces() {
-    const workspaceSelection = await resolveWorkspaceSelection();
-    const auth = await resolveAuthentication();
-    const workspaces = await fetchWorkspaces(resolveApiUrl(), auth.accessToken);
-    const defaultWorkspaceId = workspaceSelection.defaultWorkspace?.id ?? null;
-    return {
-        workspaces: workspaces.map((item) => ({
-            ...item,
-            isDefault: item.id === defaultWorkspaceId
-        }))
-    };
-}
-export async function getCurrentWorkspace() {
-    const config = await readCliConfig();
-    const currentWorkspace = config.defaultWorkspace;
-    return {
-        currentWorkspace: currentWorkspace
-            ? {
-                ...currentWorkspace,
-                isDefault: true,
-                source: "local-config"
-            }
-            : null
-    };
-}
-export async function useWorkspace(options) {
-    const requestedWorkspaceId = options.workspaceId?.trim();
-    if (!requestedWorkspaceId) {
-        throw new CliError({
-            code: "WORKSPACE_ID_REQUIRED",
-            message: "--workspace-id is required.",
-            hint: "Run `epismo workspace use --workspace-id <workspace-id>`."
-        });
-    }
-    const config = await readCliConfig();
-    const listed = await listAvailableWorkspaces();
-    const matched = listed.workspaces.find((workspace) => workspace.id === requestedWorkspaceId);
-    if (!matched) {
-        throw new CliError({
-            code: "WORKSPACE_NOT_FOUND",
-            message: `Workspace not found or not accessible: ${requestedWorkspaceId}`,
-            hint: "Run `epismo workspace list` to see accessible workspaces."
-        });
-    }
-    await writeCliConfig({
-        ...config,
-        defaultWorkspace: toSavedWorkspace(matched)
-    });
-    return {
-        workspace: { ...matched, isDefault: true }
-    };
-}
-export async function clearWorkspace() {
-    const config = await readCliConfig();
-    const previousWorkspace = config.defaultWorkspace ?? null;
-    await writeCliConfig({
-        ...config,
-        defaultWorkspace: undefined
-    });
-    return { cleared: true, previousWorkspace };
-}
-//# sourceMappingURL=auth.js.map