sofia-post 0.0.0-stage → 0.1.0

package/main.js

@@ -0,0 +1,1336 @@
+#!/usr/bin/env node
+"use strict";
+
+// libs/sophia-cli/feature-cli/src/lib/cli/compose-cli.ts
+var import_node_os = require("node:os");
+
+// libs/sophia-cli/feature-cli/src/lib/cli/cli-error.ts
+var CliError = class extends Error {
+  constructor(code, message, details) {
+    super(message);
+    this.code = code;
+    this.details = details;
+    this.name = "CliError";
+  }
+  toEnvelope() {
+    const base = { code: this.code, message: this.message };
+    return { error: this.details === void 0 ? base : { ...base, details: this.details } };
+  }
+};
+
+// libs/sophia-cli/feature-cli/src/lib/cli/catalog/help-text.ts
+function generalHelp(commands, version2) {
+  const width = Math.max(...commands.map((command) => command.name.length));
+  const rows = commands.map((command) => `  ${command.name.padEnd(width)}  ${command.summary}`);
+  return [
+    `sofia ${version2} \u2014 command line for the Sofia API (https://www.sofia-post.com/developers/cli)`,
+    "",
+    "Usage: sofia <command> [arguments] [options]",
+    "",
+    "Commands:",
+    ...rows,
+    "",
+    'Authentication: run "sofia auth:login", or set SOFIA_API_KEY.',
+    "Environment: SOFIA_API_KEY, SOFIA_API_URL, SOFIA_CLIENT_ID.",
+    "Every command prints JSON on stdout; errors are JSON on stderr with exit code 1.",
+    'Run "sofia <command> --help" for the options of a command.'
+  ].join("\n");
+}
+function commandHelp(command) {
+  const positional = command.positional === void 0 ? "" : ` <${command.positional}>`;
+  const options = Object.entries(command.options).map(([name, spec]) => optionLine(name, spec));
+  return [
+    `${command.summary}`,
+    "",
+    `Usage: sofia ${command.name}${positional} [options]`,
+    ...options.length > 0 ? ["", "Options:", ...options] : []
+  ].join("\n");
+}
+function optionLine(name, spec) {
+  const short = spec.short === void 0 ? "    " : `-${spec.short}, `;
+  const value = spec.type === "string" ? " <value>" : "";
+  const required = spec.required === true ? " (required)" : "";
+  return `  ${short}--${name}${value}  ${spec.description}${required}`;
+}
+
+// libs/sophia-cli/feature-cli/src/lib/cli/parse-command-line.ts
+var import_node_util = require("node:util");
+var HELP_FLAGS = ["--help", "-h"];
+var VERSION_FLAGS = ["--version", "-v"];
+function parseCommandLine(argv, commands) {
+  const [name, ...rest] = argv;
+  const control = controlInvocation(name);
+  if (control !== void 0) {
+    return control;
+  }
+  const command = commands.find((candidate) => candidate.name === name);
+  if (command === void 0) {
+    throw new CliError(
+      "unknown_command",
+      `Unknown command "${name}". Run "sofia --help" to list the commands.`
+    );
+  }
+  if (rest.some((argument) => HELP_FLAGS.includes(argument))) {
+    return { kind: "help", command };
+  }
+  return { kind: "run", command, args: readArguments(command, rest) };
+}
+function controlInvocation(name) {
+  if (name === void 0 || name === "help" || HELP_FLAGS.includes(name)) {
+    return { kind: "help" };
+  }
+  return VERSION_FLAGS.includes(name) ? { kind: "version" } : void 0;
+}
+function readArguments(command, rest) {
+  const parsed = tokenize(command, rest);
+  assertPositionals(command, parsed);
+  assertRequiredOptions(command, parsed);
+  return parsed;
+}
+function tokenize(command, rest) {
+  try {
+    const { values, positionals } = (0, import_node_util.parseArgs)({
+      args: [...rest],
+      options: command.options,
+      allowPositionals: true,
+      strict: true
+    });
+    return { positionals, options: values };
+  } catch (error) {
+    throw new CliError("invalid_arguments", error instanceof Error ? error.message : String(error));
+  }
+}
+function assertPositionals(command, parsed) {
+  const expected = command.positional === void 0 ? 0 : 1;
+  if (parsed.positionals.length < expected) {
+    throw new CliError("missing_argument", `Missing required argument <${command.positional}>.`);
+  }
+  if (parsed.positionals.length > expected) {
+    throw new CliError(
+      "invalid_arguments",
+      `Unexpected argument "${parsed.positionals[expected]}".`
+    );
+  }
+}
+function assertRequiredOptions(command, parsed) {
+  const missing = Object.entries(command.options).find(
+    ([name, spec]) => spec.required === true && parsed.options[name] === void 0
+  );
+  if (missing !== void 0) {
+    throw new CliError("missing_option", `Missing required option --${missing[0]}.`);
+  }
+}
+
+// libs/sophia-cli/feature-cli/src/lib/cli/sofia-cli.ts
+var SofiaCli = class {
+  constructor(dependencies) {
+    this.dependencies = dependencies;
+  }
+  /** Runs one invocation and returns the process exit code. */
+  async run(argv) {
+    try {
+      await this.execute(parseCommandLine(argv, this.dependencies.commands));
+      return 0;
+    } catch (error) {
+      this.dependencies.terminal.err(JSON.stringify(toCliError(error).toEnvelope(), void 0, 2));
+      return 1;
+    }
+  }
+  async execute(invocation) {
+    const { terminal, commands, version: version2 } = this.dependencies;
+    if (invocation.kind === "version") {
+      terminal.out(version2);
+    } else if (invocation.kind === "help") {
+      terminal.out(
+        invocation.command === void 0 ? generalHelp(commands, version2) : commandHelp(invocation.command)
+      );
+    } else {
+      const result = await invocation.command.run(invocation.args);
+      terminal.out(JSON.stringify(result, void 0, 2));
+    }
+  }
+};
+function toCliError(error) {
+  if (error instanceof CliError) {
+    return error;
+  }
+  return new CliError("unexpected_error", error instanceof Error ? error.message : String(error));
+}
+
+// libs/sophia-cli/feature-cli/src/lib/cli/terminal/process-terminal.ts
+var ProcessTerminal = class {
+  out(text) {
+    process.stdout.write(`${text}
+`);
+  }
+  err(text) {
+    process.stderr.write(`${text}
+`);
+  }
+};
+
+// libs/sophia-cli/feature-cli/src/lib/auth/login/browser/system-browser-opener.ts
+var import_node_child_process = require("node:child_process");
+var COMMANDS = {
+  darwin: (url) => ["open", url],
+  win32: (url) => ["rundll32", "url.dll,FileProtocolHandler", url]
+};
+var SystemBrowserOpener = class {
+  open(url) {
+    const build = COMMANDS[process.platform] ?? ((target) => ["xdg-open", target]);
+    const [command, ...args] = build(url);
+    return new Promise((resolve, reject) => {
+      const child = (0, import_node_child_process.spawn)(command, args, { detached: true, stdio: "ignore" });
+      child.once("error", reject);
+      child.once("spawn", () => {
+        child.unref();
+        resolve();
+      });
+    });
+  }
+};
+
+// libs/sophia-cli/feature-cli/src/lib/auth/session/auth-session.ts
+var EXPIRY_MARGIN_MS = 3e4;
+var AuthSession = class {
+  constructor(dependencies) {
+    this.dependencies = dependencies;
+  }
+  async bearerToken() {
+    const stored = await this.storedForThisApi();
+    if (stored !== void 0) {
+      const token = await this.tokenOf(stored);
+      if (token !== void 0) {
+        return token;
+      }
+    }
+    const { apiKey } = this.dependencies.config;
+    if (apiKey !== void 0) {
+      return apiKey;
+    }
+    throw new CliError(
+      stored === void 0 ? "not_authenticated" : "session_expired",
+      stored === void 0 ? 'Not authenticated. Run "sofia auth:login", or set SOFIA_API_KEY.' : 'The session has expired. Run "sofia auth:login" again, or set SOFIA_API_KEY.'
+    );
+  }
+  async storedForThisApi() {
+    const stored = await this.dependencies.store.read();
+    return stored?.apiUrl === this.dependencies.config.apiUrl ? stored : void 0;
+  }
+  async tokenOf(stored) {
+    if (this.isFresh(stored)) {
+      return stored.accessToken;
+    }
+    return stored.refreshToken === void 0 ? void 0 : this.refreshedToken();
+  }
+  /** Under the lock the file is read again: another process may have refreshed while we waited. */
+  refreshedToken() {
+    return this.dependencies.store.withRefreshLock(async () => {
+      const current = await this.storedForThisApi();
+      if (current === void 0) {
+        return void 0;
+      }
+      if (this.isFresh(current)) {
+        return current.accessToken;
+      }
+      return current.refreshToken === void 0 ? void 0 : (await this.refreshed(current, current.refreshToken)).accessToken;
+    });
+  }
+  isFresh(stored) {
+    const expiresAt = Date.parse(stored.expiresAt);
+    return expiresAt - EXPIRY_MARGIN_MS > this.dependencies.clock.now().getTime();
+  }
+  async refreshed(stored, refreshToken) {
+    const { tokens, store, clock } = this.dependencies;
+    const grant = await tokens.refresh({
+      apiUrl: stored.apiUrl,
+      clientId: stored.clientId,
+      refreshToken
+    });
+    const credentials = credentialsFrom(stored, grant, clock.now());
+    await store.write(credentials);
+    return credentials;
+  }
+};
+function credentialsFrom(base, grant, now) {
+  return {
+    apiUrl: base.apiUrl,
+    clientId: base.clientId,
+    accessToken: grant.accessToken,
+    ...grant.refreshToken === void 0 ? {} : { refreshToken: grant.refreshToken },
+    expiresAt: new Date(now.getTime() + grant.expiresIn * 1e3).toISOString(),
+    scope: grant.scope
+  };
+}
+
+// libs/sophia-cli/feature-cli/src/lib/auth/login/authorize-url.ts
+function authorizeUrl(input) {
+  const url = new URL(`${input.apiUrl}/api/v1/oauth/authorize`);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", input.clientId);
+  url.searchParams.set("redirect_uri", input.redirectUri);
+  url.searchParams.set("scope", input.scope);
+  url.searchParams.set("state", input.state);
+  url.searchParams.set("code_challenge", input.codeChallenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  return url.toString();
+}
+
+// libs/sophia-cli/feature-cli/src/lib/auth/login/pkce.ts
+var import_node_crypto = require("node:crypto");
+function challengeOf(verifier) {
+  return (0, import_node_crypto.createHash)("sha256").update(verifier).digest("base64url");
+}
+function createPkcePair() {
+  const verifier = (0, import_node_crypto.randomBytes)(32).toString("base64url");
+  return { verifier, challenge: challengeOf(verifier) };
+}
+function createState() {
+  return (0, import_node_crypto.randomBytes)(16).toString("base64url");
+}
+
+// libs/sophia-cli/feature-cli/src/lib/auth/login/login-flow.ts
+var LoginFlow = class {
+  constructor(dependencies) {
+    this.dependencies = dependencies;
+  }
+  async execute(input) {
+    const { config, receiver, tokens, store, clock } = this.dependencies;
+    const { clientId } = config;
+    const pkce = createPkcePair();
+    const listener = await receiver.listen();
+    try {
+      const code = await this.authorize(listener, input, { clientId, challenge: pkce.challenge });
+      const grant = await tokens.exchangeCode({
+        apiUrl: config.apiUrl,
+        clientId,
+        code,
+        codeVerifier: pkce.verifier,
+        redirectUri: listener.redirectUri
+      });
+      const credentials = credentialsFrom({ apiUrl: config.apiUrl, clientId }, grant, clock.now());
+      await store.write(credentials);
+      return {
+        authenticated: true,
+        apiUrl: credentials.apiUrl,
+        scope: credentials.scope,
+        expiresAt: credentials.expiresAt
+      };
+    } finally {
+      await listener.close();
+    }
+  }
+  async authorize(listener, input, pkce) {
+    const state = createState();
+    const code = listener.waitForCode(state);
+    code.catch(() => void 0);
+    await this.announce(
+      authorizeUrl({
+        apiUrl: this.dependencies.config.apiUrl,
+        clientId: pkce.clientId,
+        redirectUri: listener.redirectUri,
+        scope: input.scope,
+        state,
+        codeChallenge: pkce.challenge
+      }),
+      input.openBrowser
+    );
+    return code;
+  }
+  async announce(url, openBrowser) {
+    this.dependencies.terminal.err(
+      JSON.stringify({ notice: "Open this address in your browser to authorize the CLI", url })
+    );
+    if (openBrowser) {
+      await this.dependencies.browser.open(url).catch(() => void 0);
+    }
+  }
+};
+
+// libs/sophia-cli/feature-cli/src/lib/auth/login/loopback/node-loopback-receiver.ts
+var import_node_http = require("node:http");
+
+// libs/sophia-cli/feature-cli/src/lib/auth/login/loopback/callback-page.ts
+function callbackPage(title, message) {
+  const escape = (text) => text.replace(/[&<>"]/g, (char) => `&#${char.charCodeAt(0)};`);
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><title>${escape(title)}</title><meta name="viewport" content="width=device-width, initial-scale=1"></head><body style="font-family: system-ui, sans-serif; text-align: center; margin-top: 20vh"><h1>${escape(title)}</h1><p>${escape(message)}</p></body></html>`;
+}
+
+// libs/sophia-cli/feature-cli/src/lib/auth/login/loopback/node-loopback-receiver.ts
+var FIVE_MINUTES_MS = 5 * 60 * 1e3;
+var NodeLoopbackReceiver = class {
+  constructor(timeoutMs = FIVE_MINUTES_MS) {
+    this.timeoutMs = timeoutMs;
+  }
+  async listen() {
+    let waiting;
+    const server = (0, import_node_http.createServer)((request, response) => {
+      const decision = decide(request, waiting);
+      answer(response, decision);
+      if (waiting !== void 0) {
+        decision.settle?.(waiting);
+      }
+    });
+    await new Promise((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(0, "127.0.0.1", resolve);
+    });
+    const port = server.address().port;
+    return {
+      redirectUri: `http://127.0.0.1:${port}/callback`,
+      waitForCode: (state) => new Promise((resolve, reject) => {
+        waiting = withTimeout({ state, resolve, reject }, this.timeoutMs);
+      }),
+      close: () => closeServer(server)
+    };
+  }
+};
+function withTimeout(waiting, timeoutMs) {
+  const timer = setTimeout(
+    () => waiting.reject(new CliError("login_timeout", "Nobody authorized the CLI in 5 minutes.")),
+    timeoutMs
+  );
+  return {
+    state: waiting.state,
+    resolve: (code) => {
+      clearTimeout(timer);
+      waiting.resolve(code);
+    },
+    reject: (error) => {
+      clearTimeout(timer);
+      waiting.reject(error);
+    }
+  };
+}
+function parseCallback(rawUrl) {
+  const url = new URL(rawUrl ?? "/", "http://127.0.0.1");
+  if (url.pathname !== "/callback") {
+    return void 0;
+  }
+  const param = (name) => url.searchParams.get(name) ?? void 0;
+  return {
+    state: param("state"),
+    error: param("error"),
+    errorDescription: param("error_description") ?? "Authorization refused.",
+    code: param("code")
+  };
+}
+function decide(request, waiting) {
+  const callback = parseCallback(request.url);
+  if (callback === void 0 || waiting === void 0) {
+    return { status: 404, title: "Not found", message: "Nothing to see here." };
+  }
+  if (callback.state !== waiting.state) {
+    return {
+      status: 400,
+      title: "Not this login",
+      message: "This answer does not belong to the login in progress."
+    };
+  }
+  if (callback.error !== void 0) {
+    return refusal(callback.error, callback.errorDescription);
+  }
+  if (callback.code === void 0) {
+    return refusal("missing_code", "The authorization answer carries no code.");
+  }
+  const { code } = callback;
+  return {
+    status: 200,
+    title: "Sofia CLI authorized",
+    message: "You can close this tab and go back to your terminal.",
+    settle: (target) => target.resolve(code)
+  };
+}
+function refusal(code, message) {
+  return {
+    status: 400,
+    title: "Authorization refused",
+    message: "You can close this tab and go back to your terminal.",
+    settle: (target) => target.reject(new CliError(code, message))
+  };
+}
+function answer(response, decision) {
+  response.writeHead(decision.status, {
+    "Content-Type": "text/html; charset=utf-8",
+    "Cache-Control": "no-store"
+  });
+  response.end(callbackPage(decision.title, decision.message));
+}
+function closeServer(server) {
+  return new Promise((resolve) => {
+    server.close(() => resolve());
+    server.closeAllConnections();
+  });
+}
+
+// libs/sophia-cli/feature-cli/src/lib/auth/session/cli-config.ts
+var SOFIA_CLI_CLIENT_ID = "sofia_cli";
+var DEFAULT_API_URL = "https://api.sofia-post.com";
+function present(value) {
+  return value === void 0 || value.trim() === "" ? void 0 : value.trim();
+}
+function readCliConfig(env) {
+  const apiUrl = present(env["SOFIA_API_URL"]) ?? DEFAULT_API_URL;
+  return {
+    apiUrl: apiUrl.replace(/\/+$/, ""),
+    apiKey: present(env["SOFIA_API_KEY"]),
+    clientId: present(env["SOFIA_CLIENT_ID"]) ?? SOFIA_CLI_CLIENT_ID
+  };
+}
+
+// libs/sophia-cli/feature-cli/src/lib/auth/session/clock.ts
+var SystemClock = class {
+  now() {
+    return /* @__PURE__ */ new Date();
+  }
+};
+
+// libs/sophia-cli/feature-cli/src/lib/auth/session/credentials/file-credentials-store.ts
+var import_promises3 = require("node:fs/promises");
+var import_node_path2 = require("node:path");
+
+// libs/sophia-cli/feature-cli/src/lib/auth/session/credentials/file-lock.ts
+var import_promises = require("node:fs/promises");
+var import_node_path = require("node:path");
+var import_promises2 = require("node:timers/promises");
+var DEFAULT_TIMINGS = { waitMs: 1e4, staleMs: 3e4, retryMs: 50 };
+var FileLock = class {
+  constructor(path, timings = DEFAULT_TIMINGS) {
+    this.path = path;
+    this.timings = timings;
+  }
+  async run(task) {
+    await this.acquire();
+    try {
+      return await task();
+    } finally {
+      await (0, import_promises.rm)(this.path, { force: true });
+    }
+  }
+  async acquire() {
+    await (0, import_promises.mkdir)((0, import_node_path.dirname)(this.path), { recursive: true, mode: 448 });
+    const deadline = Date.now() + this.timings.waitMs;
+    while (!await this.tryCreate()) {
+      await this.removeIfStale();
+      if (Date.now() >= deadline) {
+        throw new CliError(
+          "credentials_locked",
+          `Another sofia process holds ${this.path}. Remove it if no sofia is running.`
+        );
+      }
+      await (0, import_promises2.setTimeout)(this.timings.retryMs);
+    }
+  }
+  async tryCreate() {
+    try {
+      const handle = await (0, import_promises.open)(this.path, "wx", 384);
+      await handle.close();
+      return true;
+    } catch (error) {
+      if (error.code === "EEXIST") {
+        return false;
+      }
+      throw error;
+    }
+  }
+  async removeIfStale() {
+    try {
+      const { mtimeMs } = await (0, import_promises.stat)(this.path);
+      if (Date.now() - mtimeMs > this.timings.staleMs) {
+        await (0, import_promises.rm)(this.path, { force: true });
+      }
+    } catch {
+    }
+  }
+};
+
+// libs/sophia-cli/feature-cli/src/lib/auth/session/credentials/file-credentials-store.ts
+function defaultCredentialsPath(home) {
+  return (0, import_node_path2.join)(home, ".sofia", "credentials.json");
+}
+var REQUIRED_TEXT_FIELDS = ["apiUrl", "clientId", "accessToken", "expiresAt", "scope"];
+function isStoredCredentials(value) {
+  if (typeof value !== "object" || !value) {
+    return false;
+  }
+  const fields = value;
+  return REQUIRED_TEXT_FIELDS.every((name) => typeof fields[name] === "string");
+}
+var FileCredentialsStore = class {
+  constructor(path) {
+    this.path = path;
+    this.lock = new FileLock(`${path}.lock`);
+  }
+  withRefreshLock(task) {
+    return this.lock.run(task);
+  }
+  async read() {
+    const text = await this.readText();
+    if (text === void 0) {
+      return void 0;
+    }
+    const parsed = parseJson(text);
+    if (!isStoredCredentials(parsed)) {
+      throw new CliError(
+        "credentials_unreadable",
+        `${this.path} is not valid: run "sofia auth:logout", then "sofia auth:login".`
+      );
+    }
+    return parsed;
+  }
+  /** Written aside then renamed: a refresh token is single-use, a torn file would lose the login. */
+  async write(credentials) {
+    const directory = (0, import_node_path2.dirname)(this.path);
+    await (0, import_promises3.mkdir)(directory, { recursive: true, mode: 448 });
+    await (0, import_promises3.chmod)(directory, 448);
+    const aside = `${this.path}.tmp`;
+    await (0, import_promises3.writeFile)(aside, JSON.stringify(credentials, void 0, 2), { mode: 384 });
+    await (0, import_promises3.chmod)(aside, 384);
+    await (0, import_promises3.rename)(aside, this.path);
+  }
+  async clear() {
+    await (0, import_promises3.rm)(this.path, { force: true });
+  }
+  async readText() {
+    try {
+      return await (0, import_promises3.readFile)(this.path, "utf8");
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        return void 0;
+      }
+      throw new CliError("credentials_unreadable", `Cannot read ${this.path}.`);
+    }
+  }
+};
+function parseJson(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+
+// libs/sophia-cli/feature-cli/src/lib/gateway/error-from-response.ts
+function asFields(value) {
+  return typeof value === "object" && value ? value : {};
+}
+var isText = (value) => typeof value === "string";
+function errorFromResponse(status, body) {
+  const fields = asFields(body);
+  const envelope = asFields(fields["error"]);
+  if (isText(envelope["code"]) && isText(envelope["message"])) {
+    return new CliError(envelope["code"], envelope["message"], envelope["details"]);
+  }
+  const code = fields["error"];
+  if (isText(code)) {
+    const description = fields["error_description"];
+    return new CliError(code, isText(description) ? description : code);
+  }
+  return new CliError(`http_${status}`, `Sofia API answered ${status}.`, body);
+}
+
+// libs/sophia-cli/feature-cli/src/lib/gateway/http-sofia-api-gateway.ts
+var HttpSofiaApiGateway = class {
+  constructor(options) {
+    this.options = options;
+  }
+  async send(request) {
+    const token = await this.options.auth.bearerToken();
+    const response = await this.dispatch(request, token);
+    const body = await readBody(response);
+    if (!response.ok) {
+      throw errorFromResponse(response.status, body);
+    }
+    return { status: response.status, body };
+  }
+  async dispatch(request, token) {
+    try {
+      return await this.options.fetch(this.urlOf(request), {
+        method: request.method,
+        headers: this.headersOf(request, token),
+        body: bodyOf(request)
+      });
+    } catch (error) {
+      throw new CliError(
+        "network_error",
+        `Could not reach ${this.options.apiUrl}: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
+  urlOf(request) {
+    const url = new URL(`${this.options.apiUrl}${request.path}`);
+    Object.entries(request.query ?? {}).forEach(([name, value]) => {
+      if (value !== void 0) {
+        url.searchParams.set(name, value);
+      }
+    });
+    return url.toString();
+  }
+  headersOf(request, token) {
+    return {
+      Authorization: `Bearer ${token}`,
+      Accept: "application/json",
+      "User-Agent": this.options.userAgent,
+      ...request.body?.kind === "json" ? { "Content-Type": "application/json" } : {},
+      ...request.idempotencyKey === void 0 ? {} : { "Idempotency-Key": request.idempotencyKey }
+    };
+  }
+};
+function bodyOf(request) {
+  const body = request.body;
+  if (body === void 0) {
+    return void 0;
+  }
+  if (body.kind === "json") {
+    return JSON.stringify(body.value);
+  }
+  const form = new FormData();
+  Object.entries(body.fields).forEach(([name, value]) => form.append(name, value));
+  form.append(body.file.field, new Blob([new Uint8Array(body.file.bytes)]), body.file.name);
+  return form;
+}
+async function readBody(response) {
+  const text = await response.text();
+  if (text === "") {
+    return void 0;
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+
+// libs/sophia-cli/feature-cli/src/lib/auth/session/token/http-oauth-token-gateway.ts
+var TOKEN_REQUEST_TIMEOUT_MS = 15e3;
+var HttpOAuthTokenGateway = class {
+  constructor(fetchFn) {
+    this.fetchFn = fetchFn;
+  }
+  exchangeCode(input) {
+    return this.post(input.apiUrl, {
+      grant_type: "authorization_code",
+      client_id: input.clientId,
+      code: input.code,
+      code_verifier: input.codeVerifier,
+      redirect_uri: input.redirectUri
+    });
+  }
+  refresh(input) {
+    return this.post(input.apiUrl, {
+      grant_type: "refresh_token",
+      client_id: input.clientId,
+      refresh_token: input.refreshToken
+    });
+  }
+  async post(apiUrl, form) {
+    const response = await this.request(apiUrl, form);
+    const body = await readBody(response);
+    if (!response.ok) {
+      throw errorFromResponse(response.status, body);
+    }
+    return toGrant(body);
+  }
+  async request(apiUrl, form) {
+    try {
+      return await this.fetchFn(`${apiUrl}/api/v1/oauth/token`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          Accept: "application/json"
+        },
+        body: new URLSearchParams(form).toString(),
+        signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)
+      });
+    } catch (error) {
+      throw new CliError(
+        "network_error",
+        `Could not reach ${apiUrl}: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
+};
+function toGrant(body) {
+  const fields = body ?? {};
+  if (typeof fields["access_token"] !== "string" || typeof fields["expires_in"] !== "number") {
+    throw new CliError("invalid_token_response", "The token endpoint answered without a token.");
+  }
+  return {
+    accessToken: fields["access_token"],
+    refreshToken: typeof fields["refresh_token"] === "string" ? fields["refresh_token"] : void 0,
+    expiresIn: fields["expires_in"],
+    scope: typeof fields["scope"] === "string" ? fields["scope"] : ""
+  };
+}
+
+// libs/sophia-cli/feature-cli/src/lib/cli/arguments.ts
+function optionText(args, name) {
+  const value = args.options[name];
+  return typeof value === "string" && value !== "" ? value : void 0;
+}
+function optionFlag(args, name) {
+  return args.options[name] === true;
+}
+function requiredOption(args, name) {
+  const value = optionText(args, name);
+  if (value === void 0) {
+    throw new CliError("missing_option", `Missing required option --${name}.`);
+  }
+  return value;
+}
+function firstPositional(args) {
+  const [value] = args.positionals;
+  if (value === void 0) {
+    throw new CliError("missing_argument", "Missing required argument.");
+  }
+  return value;
+}
+function splitList(text) {
+  return (text ?? "").split(",").map((item) => item.trim()).filter((item) => item !== "");
+}
+
+// libs/sophia-cli/feature-cli/src/lib/gateway/api-command.ts
+function apiCommand(api, spec) {
+  const { toRequest, ...definition } = spec;
+  return { ...definition, run: async (args) => callApi(api, toRequest(args)) };
+}
+async function callApi(api, request) {
+  const response = await api.send(request);
+  if (response.status === 204) {
+    return request.method === "DELETE" ? { deleted: true, id: request.path.split("/").pop() } : { ok: true };
+  }
+  return response.body;
+}
+
+// libs/sophia-cli/feature-cli/src/lib/gateway/api-path.ts
+function apiPath(...segments) {
+  return `/api/v1/${segments.map(encodeURIComponent).join("/")}`;
+}
+
+// libs/sophia-cli/feature-cli/src/lib/accounts/accounts-commands.ts
+function accountsCommands(api) {
+  return [listPlatforms(api), listEstablishments(api), listAccounts(api), connectAccount(api)];
+}
+var listPlatforms = (api) => apiCommand(api, {
+  name: "platforms:list",
+  summary: "List the platforms Sofia publishes to",
+  options: {},
+  toRequest: () => ({ method: "GET", path: apiPath("platforms") })
+});
+var listEstablishments = (api) => apiCommand(api, {
+  name: "establishments:list",
+  summary: "List your establishments",
+  options: {},
+  toRequest: () => ({ method: "GET", path: apiPath("establishments") })
+});
+var listAccounts = (api) => apiCommand(api, {
+  name: "accounts:list",
+  summary: "List the connected accounts of an establishment",
+  positional: "establishmentId",
+  options: {},
+  toRequest: (args) => ({
+    method: "GET",
+    path: apiPath("establishments", firstPositional(args), "accounts")
+  })
+});
+var connectAccount = (api) => apiCommand(api, {
+  name: "accounts:connect",
+  summary: "Open a link that connects a platform account to an establishment",
+  positional: "establishmentId",
+  options: {
+    platform: {
+      type: "string",
+      short: "p",
+      description: "instagram, facebook, tiktok, linkedin or x",
+      required: true
+    },
+    "redirect-url": { type: "string", description: "Where to send the person afterwards" }
+  },
+  toRequest: (args) => ({
+    method: "POST",
+    path: apiPath("establishments", firstPositional(args), "connection-links"),
+    body: {
+      kind: "json",
+      value: {
+        platform: requiredOption(args, "platform"),
+        redirectUrl: optionText(args, "redirect-url")
+      }
+    }
+  })
+});
+
+// libs/sophia-cli/feature-cli/src/lib/auth/login/scopes.ts
+var RESOURCE_SCOPES = [
+  "establishments:read",
+  "accounts:read",
+  "accounts:write",
+  "media:read",
+  "media:write",
+  "posts:read",
+  "posts:write",
+  "insights:read",
+  "webhooks:read",
+  "webhooks:write"
+];
+var DEFAULT_LOGIN_SCOPES = [
+  ...RESOURCE_SCOPES.filter((scope) => !scope.startsWith("webhooks:")),
+  "offline_access"
+].join(" ");
+
+// libs/sophia-cli/feature-cli/src/lib/auth/auth-commands.ts
+function authCommands(api, login, store) {
+  return [loginCommand(login), authStatus(api), logoutCommand(store), me(api)];
+}
+var loginCommand = (login) => ({
+  name: "auth:login",
+  summary: "Sign in with your browser (stores credentials in ~/.sofia/credentials.json)",
+  options: {
+    scopes: {
+      type: "string",
+      description: "Space-separated scopes (default: every resource scope but webhooks:*, + offline_access)"
+    },
+    "no-browser": { type: "boolean", description: "Print the address instead of opening it" }
+  },
+  run: (args) => login.execute({
+    scope: optionText(args, "scopes") ?? DEFAULT_LOGIN_SCOPES,
+    openBrowser: !optionFlag(args, "no-browser")
+  })
+});
+var authStatus = (api) => apiCommand(api, {
+  name: "auth:status",
+  summary: "Show who the CLI acts as",
+  options: {},
+  toRequest: () => ({ method: "GET", path: apiPath("me") })
+});
+var logoutCommand = (store) => ({
+  name: "auth:logout",
+  summary: "Delete the stored browser credentials",
+  options: {},
+  run: async () => {
+    await store.clear();
+    return {
+      loggedOut: true,
+      note: "Local credentials removed. Sofia API has no revocation endpoint: revoke the access in Sofia \u203A Settings \u203A Connected apps to end it server-side."
+    };
+  }
+});
+var me = (api) => apiCommand(api, {
+  name: "me",
+  summary: "Show the token, the application and the workspaces behind the credentials",
+  options: {},
+  toRequest: () => ({ method: "GET", path: apiPath("me") })
+});
+
+// libs/sophia-cli/feature-cli/src/lib/insights/insights-commands.ts
+function insightsCommands(api) {
+  return [
+    apiCommand(api, {
+      name: "insights:get",
+      summary: "Read the statistics of an establishment",
+      positional: "establishmentId",
+      options: {
+        period: {
+          type: "string",
+          description: "last24Hours, last7Days or last28Days (API default: last28Days)"
+        }
+      },
+      toRequest: (args) => ({
+        method: "GET",
+        path: apiPath("establishments", firstPositional(args), "insights"),
+        query: { period: optionText(args, "period") }
+      })
+    })
+  ];
+}
+
+// libs/sophia-cli/feature-cli/src/lib/publishing/media/upload-media.ts
+var import_node_path3 = require("node:path");
+
+// libs/sophia-cli/feature-cli/src/lib/publishing/media/media-reference.ts
+var VIDEO_EXTENSIONS = [".mp4", ".mov", ".webm", ".m4v"];
+function isRemoteUrl(value) {
+  return /^https?:\/\//i.test(value);
+}
+function inferMediaType(url) {
+  const pathname = new URL(url).pathname.toLowerCase();
+  return VIDEO_EXTENSIONS.some((extension) => pathname.endsWith(extension)) ? "video" : "image";
+}
+function toPostMedia(value) {
+  return isRemoteUrl(value) ? { url: value, type: inferMediaType(value) } : { id: value };
+}
+
+// libs/sophia-cli/feature-cli/src/lib/publishing/media/upload-media.ts
+async function buildUploadRequest(files, input) {
+  const { source, establishmentId, idempotencyKey } = input;
+  if (isRemoteUrl(source)) {
+    return {
+      method: "POST",
+      path: apiPath("media"),
+      body: { kind: "json", value: { establishmentId, url: source } },
+      idempotencyKey
+    };
+  }
+  return {
+    method: "POST",
+    path: apiPath("media"),
+    body: {
+      kind: "multipart",
+      fields: { establishmentId },
+      file: { field: "file", name: (0, import_node_path3.basename)(source), bytes: await files.readBytes(source) }
+    },
+    idempotencyKey
+  };
+}
+
+// libs/sophia-cli/feature-cli/src/lib/publishing/media/media-commands.ts
+var ESTABLISHMENT = {
+  type: "string",
+  short: "e",
+  description: "Establishment id",
+  required: true
+};
+var IDEMPOTENCY_KEY = {
+  type: "string",
+  description: "Replays the same upload as one"
+};
+var PAGING = {
+  limit: { type: "string", description: "Page size (1-100)" },
+  cursor: { type: "string", description: "Cursor of the next page" }
+};
+function mediaCommands(api, files) {
+  return [uploadMedia(api, files), listMedia(api), getMedia(api), deleteMedia(api)];
+}
+var uploadMedia = (api, files) => ({
+  name: "media:upload",
+  summary: "Add a media to the library from a local file or an https address",
+  positional: "file|url",
+  options: { establishment: ESTABLISHMENT, "idempotency-key": IDEMPOTENCY_KEY },
+  run: async (args) => callApi(
+    api,
+    await buildUploadRequest(files, {
+      source: firstPositional(args),
+      establishmentId: requiredOption(args, "establishment"),
+      idempotencyKey: optionText(args, "idempotency-key")
+    })
+  )
+});
+var listMedia = (api) => apiCommand(api, {
+  name: "media:list",
+  summary: "List the media of an establishment library",
+  options: { establishment: ESTABLISHMENT, ...PAGING },
+  toRequest: (args) => ({
+    method: "GET",
+    path: apiPath("media"),
+    query: {
+      establishmentId: requiredOption(args, "establishment"),
+      limit: optionText(args, "limit"),
+      cursor: optionText(args, "cursor")
+    }
+  })
+});
+var getMedia = (api) => apiCommand(api, {
+  name: "media:get",
+  summary: "Read one media",
+  positional: "id",
+  options: {},
+  toRequest: (args) => ({ method: "GET", path: apiPath("media", firstPositional(args)) })
+});
+var deleteMedia = (api) => apiCommand(api, {
+  name: "media:delete",
+  summary: "Remove a media from the library",
+  positional: "id",
+  options: {},
+  toRequest: (args) => ({ method: "DELETE", path: apiPath("media", firstPositional(args)) })
+});
+
+// libs/sophia-cli/feature-cli/src/lib/files/read-json-file.ts
+async function readJsonFile(files, path) {
+  const text = await files.readText(path);
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new CliError("invalid_json_file", `The file "${path}" does not hold valid JSON.`);
+  }
+}
+
+// libs/sophia-cli/feature-cli/src/lib/publishing/posts/post-targets.ts
+function buildTargets(input) {
+  const media = input.media.map(toPostMedia);
+  return input.platforms.map((platform) => ({
+    platform,
+    text: input.content,
+    ...media.length > 0 ? { media } : {},
+    ...input.format === void 0 ? {} : { format: input.format },
+    ...input.account === void 0 ? {} : { accountId: input.account }
+  }));
+}
+
+// libs/sophia-cli/feature-cli/src/lib/publishing/posts/create-post.ts
+var CREATE_OPTIONS = {
+  establishment: { type: "string", short: "e", description: "Establishment id" },
+  platforms: {
+    type: "string",
+    short: "p",
+    description: "Comma-separated platforms (instagram,facebook,x,linkedin,tiktok)"
+  },
+  content: { type: "string", short: "c", description: "Text of the post" },
+  media: {
+    type: "string",
+    short: "m",
+    description: "Comma-separated media ids or https addresses"
+  },
+  format: { type: "string", short: "f", description: "Format (post, reel, story...)" },
+  account: { type: "string", short: "a", description: "Connected account id" },
+  date: {
+    type: "string",
+    short: "s",
+    description: "ISO 8601 date to schedule at; absent: publish now"
+  },
+  draft: { type: "boolean", description: "Save a draft that nothing sends" },
+  "dry-run": { type: "boolean", description: "Run the checks, write nothing" },
+  "idempotency-key": { type: "string", description: "Replays the same request as one" },
+  json: {
+    type: "string",
+    short: "j",
+    description: "File holding the full request body (replaces the content options)"
+  }
+};
+function createPostCommand(api, files) {
+  return {
+    name: "posts:create",
+    summary: "Publish, schedule or draft a post",
+    options: CREATE_OPTIONS,
+    run: async (args) => callApi(api, {
+      method: "POST",
+      path: apiPath("posts"),
+      query: { dry_run: optionFlag(args, "dry-run") ? "true" : void 0 },
+      body: { kind: "json", value: await postBody(files, args) },
+      idempotencyKey: optionText(args, "idempotency-key")
+    })
+  };
+}
+async function postBody(files, args) {
+  const file = optionText(args, "json");
+  if (file !== void 0) {
+    return readJsonFile(files, file);
+  }
+  const platforms = splitList(requiredOption(args, "platforms"));
+  return {
+    establishmentId: requiredOption(args, "establishment"),
+    targets: buildTargets({
+      platforms,
+      content: requiredText(args),
+      media: splitList(optionText(args, "media")),
+      format: optionText(args, "format"),
+      account: optionText(args, "account")
+    }),
+    ...optionText(args, "date") === void 0 ? {} : { scheduledAt: optionText(args, "date") },
+    ...optionFlag(args, "draft") ? { status: "draft" } : {}
+  };
+}
+function requiredText(args) {
+  const content = optionText(args, "content");
+  if (content === void 0) {
+    throw new CliError("missing_option", "Missing required option --content (or use --json).");
+  }
+  return content;
+}
+
+// libs/sophia-cli/feature-cli/src/lib/publishing/posts/posts-commands.ts
+var LIST_OPTIONS = {
+  establishment: { type: "string", short: "e", description: "Only this establishment" },
+  status: {
+    type: "string",
+    description: "draft, scheduled, publishing, published, sent_to_inbox or failed"
+  },
+  from: { type: "string", description: "Earliest date (ISO 8601)" },
+  to: { type: "string", description: "Latest date (ISO 8601)" },
+  "created-by": { type: "string", description: "me or app" },
+  limit: { type: "string", description: "Page size (1-100)" },
+  cursor: { type: "string", description: "Cursor of the next page" }
+};
+var UPDATE_OPTIONS = {
+  date: { type: "string", short: "s", description: "New ISO 8601 date" },
+  status: { type: "string", description: "draft or scheduled" },
+  json: { type: "string", short: "j", description: "File holding the full request body" }
+};
+function postsCommands(api, files) {
+  return [
+    createPostCommand(api, files),
+    listPosts(api),
+    getPost(api),
+    updatePostCommand(api, files),
+    deletePost(api)
+  ];
+}
+var listPosts = (api) => apiCommand(api, {
+  name: "posts:list",
+  summary: "List posts",
+  options: LIST_OPTIONS,
+  toRequest: (args) => ({
+    method: "GET",
+    path: apiPath("posts"),
+    query: {
+      establishmentId: optionText(args, "establishment"),
+      status: optionText(args, "status"),
+      from: optionText(args, "from"),
+      to: optionText(args, "to"),
+      createdBy: optionText(args, "created-by"),
+      limit: optionText(args, "limit"),
+      cursor: optionText(args, "cursor")
+    }
+  })
+});
+var getPost = (api) => apiCommand(api, {
+  name: "posts:get",
+  summary: "Read one post",
+  positional: "id",
+  options: {},
+  toRequest: (args) => ({ method: "GET", path: apiPath("posts", firstPositional(args)) })
+});
+var deletePost = (api) => apiCommand(api, {
+  name: "posts:delete",
+  summary: "Delete a post",
+  positional: "id",
+  options: {},
+  toRequest: (args) => ({ method: "DELETE", path: apiPath("posts", firstPositional(args)) })
+});
+function updatePostCommand(api, files) {
+  return {
+    name: "posts:update",
+    summary: "Reschedule a post, or turn it into a draft",
+    positional: "id",
+    options: UPDATE_OPTIONS,
+    run: async (args) => callApi(api, {
+      method: "PATCH",
+      path: apiPath("posts", firstPositional(args)),
+      body: { kind: "json", value: await updateBody(files, args) }
+    })
+  };
+}
+async function updateBody(files, args) {
+  const file = optionText(args, "json");
+  if (file !== void 0) {
+    return readJsonFile(files, file);
+  }
+  const scheduledAt = optionText(args, "date");
+  const status = optionText(args, "status");
+  if (scheduledAt === void 0 && status === void 0) {
+    throw new CliError("missing_option", "Give --date, --status or --json to change the post.");
+  }
+  return {
+    ...scheduledAt === void 0 ? {} : { scheduledAt },
+    ...status === void 0 ? {} : { status }
+  };
+}
+
+// libs/sophia-cli/feature-cli/src/lib/webhooks/webhooks-commands.ts
+var DEFAULT_EVENTS = "post.published,post.failed";
+function webhooksCommands(api) {
+  return [createWebhook(api), listWebhooks(api), deleteWebhook(api), testWebhook(api)];
+}
+var createWebhook = (api) => apiCommand(api, {
+  name: "webhooks:create",
+  summary: "Register a webhook (its signing secret is shown once)",
+  options: {
+    url: { type: "string", short: "u", description: "https address", required: true },
+    events: { type: "string", description: `Comma-separated events (default ${DEFAULT_EVENTS})` }
+  },
+  toRequest: (args) => ({
+    method: "POST",
+    path: apiPath("webhooks"),
+    body: {
+      kind: "json",
+      value: {
+        url: requiredOption(args, "url"),
+        events: splitList(optionText(args, "events") ?? DEFAULT_EVENTS)
+      }
+    }
+  })
+});
+var listWebhooks = (api) => apiCommand(api, {
+  name: "webhooks:list",
+  summary: "List your webhooks",
+  options: {},
+  toRequest: () => ({ method: "GET", path: apiPath("webhooks") })
+});
+var deleteWebhook = (api) => apiCommand(api, {
+  name: "webhooks:delete",
+  summary: "Delete a webhook",
+  positional: "id",
+  options: {},
+  toRequest: (args) => ({ method: "DELETE", path: apiPath("webhooks", firstPositional(args)) })
+});
+var testWebhook = (api) => apiCommand(api, {
+  name: "webhooks:test",
+  summary: "Send a webhook.test event to a webhook",
+  positional: "id",
+  options: {},
+  toRequest: (args) => ({
+    method: "POST",
+    path: apiPath("webhooks", firstPositional(args), "test")
+  })
+});
+
+// libs/sophia-cli/feature-cli/src/lib/cli/catalog/command-catalog.ts
+function buildCommandCatalog(dependencies) {
+  const { api, files, login, store } = dependencies;
+  return [
+    ...authCommands(api, login, store),
+    ...accountsCommands(api),
+    ...postsCommands(api, files),
+    ...mediaCommands(api, files),
+    ...insightsCommands(api),
+    ...webhooksCommands(api)
+  ];
+}
+
+// libs/sophia-cli/feature-cli/src/lib/files/node-local-files.ts
+var import_promises4 = require("node:fs/promises");
+var NodeLocalFiles = class {
+  async readText(path) {
+    return (await this.readBytes(path)).toString();
+  }
+  async readBytes(path) {
+    try {
+      return await (0, import_promises4.readFile)(path);
+    } catch {
+      throw new CliError("file_not_readable", `Cannot read the file "${path}".`);
+    }
+  }
+};
+
+// libs/sophia-cli/feature-cli/src/lib/cli/compose-cli.ts
+function composeCli(options) {
+  const config = readCliConfig(options.env);
+  const terminal = new ProcessTerminal();
+  const clock = new SystemClock();
+  const store = new FileCredentialsStore(defaultCredentialsPath((0, import_node_os.homedir)()));
+  const tokens = new HttpOAuthTokenGateway(fetch);
+  const auth = new AuthSession({ config, store, tokens, clock });
+  const api = new HttpSofiaApiGateway({
+    apiUrl: config.apiUrl,
+    auth,
+    userAgent: `sofia-post/${options.version}`,
+    fetch
+  });
+  const login = new LoginFlow({
+    config,
+    tokens,
+    store,
+    clock,
+    terminal,
+    receiver: new NodeLoopbackReceiver(),
+    browser: new SystemBrowserOpener()
+  });
+  const commands = buildCommandCatalog({ api, files: new NodeLocalFiles(), login, store });
+  return new SofiaCli({ commands, terminal, version: options.version });
+}
+
+// apps/sophia-cli/package.json
+var version = "0.1.0";
+
+// apps/sophia-cli/src/main.ts
+void composeCli({ version, env: process.env }).run(process.argv.slice(2)).then((exitCode) => {
+  process.exitCode = exitCode;
+});