@aexol/spectral 0.9.229 → 0.9.230

package/dist/auth-helper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-helper.d.ts","sourceRoot":"","sources":["../src/auth-helper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,aAAa,CAAC;AAOrB,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,eAAO,MAAM,YAAY;IACvB,4DAA4D;;IAE5D,6EAA6E;;IAE7E,2DAA2D;;IAE3D,uCAAuC;;CAE/B,CAAC;AACX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AA8F3E;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,MAAM,CAAC,EAAE,MAAM,EACf,SAAS,GAAE,MAAyB,EACpC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,WAAW,CAAC,CAmEtB;AAMD,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAUjD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAgErE"}
+{"version":3,"file":"auth-helper.d.ts","sourceRoot":"","sources":["../src/auth-helper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,aAAa,CAAC;AAOrB,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,eAAO,MAAM,YAAY;IACvB,4DAA4D;;IAE5D,6EAA6E;;IAE7E,2DAA2D;;IAE3D,uCAAuC;;CAE/B,CAAC;AACX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AA8F3E;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,MAAM,CAAC,EAAE,MAAM,EACf,SAAS,GAAE,MAAyB,EACpC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,WAAW,CAAC,CAmEtB;AAMD,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAUjD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAuErE"}

package/dist/auth-helper.js

@@ -208,15 +208,21 @@ export async function ensureAuthenticated() {
     }
     const existingCfg = await readConfig();
     const apiUrl = existingCfg?.apiUrl ?? process.env.SPECTRAL_MCP_URL ?? DEFAULT_API_URL;
-    const token = existingCfg?.teamApiKey || existingCfg?.userJwt || "";
+    // Chain: team key, then user key, then the OAuth JWT.
+    const token = existingCfg?.teamApiKey || existingCfg?.userApiKey || existingCfg?.userJwt || "";
     // If we have a token, verify it still works
     if (token) {
-        // If the stored user JWT is locally known to be expired, skip the network roundtrip
-        if (existingCfg?.userJwt && isJwtExpired(existingCfg.userJwt)) {
-            // userJwt expired — if we have a teamApiKey, try that before re-auth
-            if (existingCfg?.teamApiKey) {
+        // The stored user JWT is locally known to be expired and it is the token
+        // we'd use (no team/user API key ahead of it in the chain) — skip the
+        // network roundtrip for the JWT itself, but try the API-key fallbacks
+        // before triggering the OAuth browser flow.
+        const tokenIsExpiredUserJwt = token === existingCfg?.userJwt && isJwtExpired(existingCfg.userJwt);
+        if (tokenIsExpiredUserJwt) {
+            // userJwt expired — if we have an API key, try that before re-auth
+            const fallbackToken = existingCfg?.teamApiKey ?? existingCfg?.userApiKey;
+            if (fallbackToken) {
                 try {
-                    const client = new AexolMcpClient(apiUrl, existingCfg.teamApiKey);
+                    const client = new AexolMcpClient(apiUrl, fallbackToken);
                     await client.listTools();
                     return { ok: true, config: existingCfg };
                 }
@@ -225,10 +231,10 @@ export async function ensureAuthenticated() {
                         const msg = err instanceof Error ? err.message : String(err);
                         return { ok: false, config: existingCfg, reason: `Backend unreachable: ${msg}` };
                     }
-                    // teamApiKey also failed — fall through to OAuth
+                    // API key also failed — fall through to OAuth
                 }
             }
-            // no teamApiKey — fall through to OAuth
+            // no API key — fall through to OAuth
         }
         else {
             try {

package/dist/commands/login.d.ts

@@ -2,10 +2,12 @@
  * `spectral login` — interactive authentication against the Aexol MCP backend.
  *
  * Flow:
- *   1. Choose auth method: Team API key or OAuth (browser).
- *   2a. API key: prompt for team API key (masked input). Verify the
- *       sk-aexol-team- prefix locally so we don't send obviously-wrong
- *       credentials. The API URL is taken from env or the hard default.
+ *   1. Choose auth method: Team API key, User API key, or OAuth (browser).
+ *   2a. API keys: prompt for the key (masked input). Verify the
+ *       sk-aexol-team- / sk-aexol-user- prefix locally so we don't send
+ *       obviously-wrong credentials. The API URL is taken from env or the
+ *       hard default. A user key (sk-aexol-user-) is pinned to a team but
+ *       owned by a single user — machines registered with it are PRIVATE.
  *   2b. OAuth: open browser for Aexol Studio authorization.
  *   3. Verify reachability + auth by calling tools/list against the URL.
  *   4. On success: persist to ~/.spectral/config.json (mode 0600).
@@ -19,6 +21,12 @@
  */
 export interface PerformLoginOptions {
     apiUrl: string;
+    /**
+     * API key to verify. Accepts both the team prefix ("sk-aexol-team-") and
+     * the user prefix ("sk-aexol-user-"). The key kind determines how it is
+     * persisted: a team key sets `teamApiKey` (clearing any stale `userApiKey`),
+     * a user key sets `userApiKey`.
+     */
     teamApiKey: string;
 }
 export interface PerformLoginResult {

package/dist/commands/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAiBH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAqCzF;AAED,wBAAsB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAqF9C"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAoBH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAoDzF;AAED,wBAAsB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAyF9C"}

package/dist/commands/login.js

@@ -2,10 +2,12 @@
  * `spectral login` — interactive authentication against the Aexol MCP backend.
  *
  * Flow:
- *   1. Choose auth method: Team API key or OAuth (browser).
- *   2a. API key: prompt for team API key (masked input). Verify the
- *       sk-aexol-team- prefix locally so we don't send obviously-wrong
- *       credentials. The API URL is taken from env or the hard default.
+ *   1. Choose auth method: Team API key, User API key, or OAuth (browser).
+ *   2a. API keys: prompt for the key (masked input). Verify the
+ *       sk-aexol-team- / sk-aexol-user- prefix locally so we don't send
+ *       obviously-wrong credentials. The API URL is taken from env or the
+ *       hard default. A user key (sk-aexol-user-) is pinned to a team but
+ *       owned by a single user — machines registered with it are PRIVATE.
  *   2b. OAuth: open browser for Aexol Studio authorization.
  *   3. Verify reachability + auth by calling tools/list against the URL.
  *   4. On success: persist to ~/.spectral/config.json (mode 0600).
@@ -19,7 +21,7 @@
  */
 import { password, select } from "@inquirer/prompts";
 import pc from "picocolors";
-import { TEAM_API_KEY_PREFIX, getApiUrl, getConfigFile, validateTeamApiKey, writeConfig, } from "../config.js";
+import { TEAM_API_KEY_PREFIX, USER_API_KEY_PREFIX, getApiUrl, getConfigFile, readConfig, validateTeamApiKey, validateUserApiKey, writeConfig, } from "../config.js";
 import { AexolMcpClient, AexolMcpError } from "../mcp-client.js";
 import { runOAuthFlow, OAUTH_REASON } from "../auth-helper.js";
 /**
@@ -37,8 +39,10 @@ export async function performLogin(opts) {
     if (!apiUrl) {
         throw new Error("API URL is required");
     }
-    if (!validateTeamApiKey(teamApiKey)) {
-        throw new Error(`Invalid API key prefix: token must start with "${TEAM_API_KEY_PREFIX}"`);
+    const isTeamKey = validateTeamApiKey(teamApiKey);
+    const isUserKey = validateUserApiKey(teamApiKey);
+    if (!isTeamKey && !isUserKey) {
+        throw new Error(`Invalid API key prefix: token must start with "${TEAM_API_KEY_PREFIX}" or "${USER_API_KEY_PREFIX}"`);
     }
     const client = new AexolMcpClient(apiUrl, teamApiKey);
     let toolCount;
@@ -59,7 +63,20 @@ export async function performLogin(opts) {
         const msg = err instanceof Error ? err.message : String(err);
         throw new Error(`Could not reach ${apiUrl}: ${msg}`);
     }
-    const cfg = { apiUrl, teamApiKey };
+    // Preserve credentials we didn't just verify — most importantly the user JWT
+    // from a previous OAuth login (previously overwritten here, silently dropping
+    // Studio auth). A team-key login clears any stale userApiKey so the explicit
+    // choice of team auth isn't later overridden by registration priority; a
+    // user-key login keeps the team key (both stay valid for the team).
+    const existing = await readConfig();
+    const cfg = isTeamKey
+        ? { apiUrl, teamApiKey, userJwt: existing?.userJwt }
+        : {
+            apiUrl,
+            teamApiKey: existing?.teamApiKey ?? "",
+            userApiKey: teamApiKey,
+            userJwt: existing?.userJwt,
+        };
     await writeConfig(cfg);
     return { toolCount };
 }
@@ -73,6 +90,7 @@ export async function runLogin() {
             message: "How would you like to authenticate?",
             choices: [
                 { name: "Team API key", value: "apikey" },
+                { name: "User API key", value: "userkey" },
                 { name: "OAuth (browser)", value: "oauth" },
             ],
         });
@@ -90,19 +108,22 @@ export async function runLogin() {
         await runLoginOAuth();
         return;
     }
-    // Team API key flow: no URL prompt — use env or default.
+    // API key flow: no URL prompt — use env or default.
     const apiUrl = getApiUrl();
-    let teamApiKey;
+    const isUserKey = authMethod === "userkey";
+    const keyPrefix = isUserKey ? USER_API_KEY_PREFIX : TEAM_API_KEY_PREFIX;
+    let apiKey;
     try {
-        teamApiKey = (await password({
-            message: `Team API key (starts with "${TEAM_API_KEY_PREFIX}")`,
+        apiKey = (await password({
+            message: `${isUserKey ? "User" : "Team"} API key (starts with "${keyPrefix}")`,
             mask: "*",
             validate: (v) => {
                 const trimmed = v.trim();
                 if (trimmed.length === 0)
                     return "Token is required";
-                if (!validateTeamApiKey(trimmed)) {
-                    return `Token must start with "${TEAM_API_KEY_PREFIX}"`;
+                const valid = isUserKey ? validateUserApiKey(trimmed) : validateTeamApiKey(trimmed);
+                if (!valid) {
+                    return `Token must start with "${keyPrefix}"`;
                 }
                 return true;
             },
@@ -119,7 +140,7 @@ export async function runLogin() {
     process.stdout.write(pc.dim(`\nVerifying credentials against ${apiUrl} ...\n`));
     let result;
     try {
-        result = await performLogin({ apiUrl, teamApiKey });
+        result = await performLogin({ apiUrl, teamApiKey: apiKey });
     }
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);

package/dist/commands/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/commands/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAwBH,OAAO,EAAE,WAAW,EAAmB,MAAM,oBAAoB,CAAC;AAYlE,OAAO,KAAK,EAAE,aAAa,EAAc,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAGnE,OAAO,EAAmB,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAarE;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAazD;AAED,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,CA6B9D;AAED,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,uCAAuC;IACvC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4CAA4C;IAC5C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,qBAAqB,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;CAC/E;AAED,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,KAAK,EAAE,YAAY,CAAC;IACpB,wDAAwD;IACxD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,4CAA4C;IAC5C,KAAK,EAAE,WAAW,CAAC;IACnB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAsB,QAAQ,CAAC,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CA4kBlF;AAmFD;;;GAGG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAc5E"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/commands/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAwBH,OAAO,EAAE,WAAW,EAAmB,MAAM,oBAAoB,CAAC;AAYlE,OAAO,KAAK,EAAE,aAAa,EAAc,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAGnE,OAAO,EAAmB,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAarE;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAazD;AAED,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,CA6B9D;AAED,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,uCAAuC;IACvC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4CAA4C;IAC5C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,qBAAqB,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;CAC/E;AAED,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,KAAK,EAAE,YAAY,CAAC;IACpB,wDAAwD;IACxD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,4CAA4C;IAC5C,KAAK,EAAE,WAAW,CAAC;IACnB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAsB,QAAQ,CAAC,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CA+kBlF;AAmFD;;;GAGG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAc5E"}

package/dist/commands/serve.js

@@ -172,6 +172,7 @@ export async function runServe(opts = {}) {
         registration = await ensureMachineRegistered({
             backendUrl,
             apiKey: cfg.teamApiKey,
+            userApiKey: cfg.userApiKey,
             userJwt: cfg.userJwt,
             machineNameOverride: opts.machineName,
             version,
@@ -213,6 +214,7 @@ export async function runServe(opts = {}) {
             const newReg = await ensureMachineRegistered({
                 backendUrl,
                 apiKey: cfg.teamApiKey,
+                userApiKey: cfg.userApiKey,
                 userJwt: cfg.userJwt,
                 machineNameOverride: opts.machineName,
                 version,
@@ -476,6 +478,7 @@ export async function runServe(opts = {}) {
                     const newReg = await ensureMachineRegistered({
                         backendUrl,
                         apiKey: cfg.teamApiKey,
+                        userApiKey: cfg.userApiKey,
                         userJwt: cfg.userJwt,
                         machineNameOverride: opts.machineName,
                         version,

package/dist/config.d.ts

@@ -12,9 +12,22 @@
  */
 export declare const DEFAULT_API_URL = "https://api.aexol.ai/mcp";
 export declare const TEAM_API_KEY_PREFIX = "sk-aexol-team-";
+export declare const USER_API_KEY_PREFIX = "sk-aexol-user-";
 export interface SpectralConfig {
     apiUrl: string;
+    /**
+     * Team API key ("sk-aexol-team-"). Normalized to "" when absent — e.g. an
+     * OAuth-only login stores no team key. At least one of `teamApiKey`,
+     * `userApiKey`, or `userJwt` must be present for the config to be valid.
+     */
     teamApiKey: string;
+    /**
+     * User API key ("sk-aexol-user-"), pinned to a team but owned by a single
+     * user. Machines registered with it are PRIVATE with `ownerId` derived from
+     * the key. Takes priority over `teamApiKey` for machine registration
+     * (see `relay/registration.ts`).
+     */
+    userApiKey?: string;
     /** User JWT from OAuth login. When present, used for machine registration (owns the machine). */
     userJwt?: string;
 }
@@ -40,6 +53,8 @@ export declare const CONFIG_FILE: string;
 export declare function getApiUrl(stored?: string): string;
 /** Validate the team API key prefix. The full token check happens server-side. */
 export declare function validateTeamApiKey(key: unknown): key is string;
+/** Validate the user API key prefix. The full token check happens server-side. */
+export declare function validateUserApiKey(key: unknown): key is string;
 /** Read config; returns null if missing or malformed. Never throws. */
 export declare function readConfig(): Promise<SpectralConfig | null>;
 /** Persist config with restrictive permissions (dir 0700, file 0600). */

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAC1D,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,iGAAiG;IACjG,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED;;;;;GAKG;AACH,eAAO,MAAM,UAAU,QAAiB,CAAC;AACzC,eAAO,MAAM,WAAW,QAAkB,CAAC;AAE3C,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,kFAAkF;AAClF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,MAAM,CAE9D;AAED,uEAAuE;AACvE,wBAAsB,UAAU,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA2BjE;AAED,yEAAyE;AACzE,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAQpE;AAED,+FAA+F;AAC/F,wBAAsB,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CASrD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAC1D,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AACpD,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED;;;;;GAKG;AACH,eAAO,MAAM,UAAU,QAAiB,CAAC;AACzC,eAAO,MAAM,WAAW,QAAkB,CAAC;AAE3C,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,kFAAkF;AAClF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,MAAM,CAE9D;AAED,kFAAkF;AAClF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,MAAM,CAE9D;AAED,uEAAuE;AACvE,wBAAsB,UAAU,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAgCjE;AAED,yEAAyE;AACzE,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAQpE;AAED,+FAA+F;AAC/F,wBAAsB,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CASrD"}

package/dist/config.js

@@ -15,6 +15,7 @@ import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 export const DEFAULT_API_URL = "https://api.aexol.ai/mcp";
 export const TEAM_API_KEY_PREFIX = "sk-aexol-team-";
+export const USER_API_KEY_PREFIX = "sk-aexol-user-";
 /**
  * Resolve the directory used to store Spectral configuration.
  *
@@ -45,6 +46,10 @@ export function getApiUrl(stored) {
 export function validateTeamApiKey(key) {
     return typeof key === "string" && key.startsWith(TEAM_API_KEY_PREFIX);
 }
+/** Validate the user API key prefix. The full token check happens server-side. */
+export function validateUserApiKey(key) {
+    return typeof key === "string" && key.startsWith(USER_API_KEY_PREFIX);
+}
 /** Read config; returns null if missing or malformed. Never throws. */
 export async function readConfig() {
     let raw;
@@ -64,11 +69,15 @@ export async function readConfig() {
         const userJwt = typeof parsed.userJwt === "string" && parsed.userJwt.length > 0
             ? parsed.userJwt
             : undefined;
-        if (!teamApiKey && !userJwt)
+        const userApiKey = typeof parsed.userApiKey === "string" && parsed.userApiKey.length > 0
+            ? parsed.userApiKey
+            : undefined;
+        if (!teamApiKey && !userApiKey && !userJwt)
             return null;
         return {
             apiUrl: parsed.apiUrl,
             teamApiKey,
+            userApiKey,
             userJwt,
         };
     }

package/dist/generated/zeus/const.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"const.d.ts","sourceRoot":"","sources":["../../../src/generated/zeus/const.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAC,GAAG,CAwyB5C,CAAA;AAED,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAC,GAAG,CA0lC1C,CAAA;AAED,eAAO,MAAM,GAAG;;;;CAIf,CAAA"}
+{"version":3,"file":"const.d.ts","sourceRoot":"","sources":["../../../src/generated/zeus/const.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAC,GAAG,CA0zB5C,CAAA;AAED,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAC,GAAG,CAumC1C,CAAA;AAED,eAAO,MAAM,GAAG;;;;CAIf,CAAA"}

package/dist/generated/zeus/const.js

@@ -4,6 +4,7 @@ export const AllTypesProps = {
     TeamRole: "enum",
     TeamUsageTaskType: "enum",
     CreateTeamApiKeyInput: {},
+    CreateUserApiKeyInput: {},
     TeamInviteStatus: "enum",
     CreateReferralCampaignInput: {
         expiresAt: "DateTime"
@@ -103,6 +104,7 @@ export const AllTypesProps = {
             filter: "TeamUsageFilterInput"
         },
         teamApiKeys: {},
+        myApiKeys: {},
         teamInvites: {},
         validateTeamInvite: {},
         teamReferralCampaigns: {},
@@ -260,6 +262,11 @@ export const AllTypesProps = {
         },
         revokeTeamApiKey: {},
         regenerateTeamApiKey: {},
+        createUserApiKey: {
+            input: "CreateUserApiKeyInput"
+        },
+        revokeUserApiKey: {},
+        regenerateUserApiKey: {},
         createTeamMcpServer: {
             input: "CreateTeamMcpServerInput"
         },
@@ -315,6 +322,7 @@ export const AllTypesProps = {
             input: "UpdateAgentInput"
         },
         deleteAgent: {},
+        duplicateAgent: {},
         refineFromTask: {
             input: "RefineFromTaskInput"
         },
@@ -536,6 +544,14 @@ export const ReturnTypes = {
         lastUsedAt: "DateTime",
         createdAt: "DateTime"
     },
+    UserApiKey: {
+        id: "ID",
+        name: "String",
+        apiKey: "String",
+        teamId: "ID",
+        lastUsedAt: "DateTime",
+        createdAt: "DateTime"
+    },
     TeamInvite: {
         id: "ID",
         teamId: "ID",
@@ -947,6 +963,7 @@ export const ReturnTypes = {
         team: "Team",
         teamUsage: "TeamUsage",
         teamApiKeys: "TeamApiKey",
+        myApiKeys: "UserApiKey",
         teamInvites: "TeamInvite",
         validateTeamInvite: "TeamInviteValidation",
         teamReferralCampaigns: "ReferralCampaign",
@@ -1052,6 +1069,9 @@ export const ReturnTypes = {
         createTeamApiKey: "TeamApiKey",
         revokeTeamApiKey: "Boolean",
         regenerateTeamApiKey: "TeamApiKey",
+        createUserApiKey: "UserApiKey",
+        revokeUserApiKey: "Boolean",
+        regenerateUserApiKey: "UserApiKey",
         createTeamMcpServer: "TeamMcpServer",
         updateTeamMcpServer: "TeamMcpServer",
         deleteTeamMcpServer: "Boolean",
@@ -1079,6 +1099,7 @@ export const ReturnTypes = {
         createAgent: "Agent",
         updateAgent: "Agent",
         deleteAgent: "Boolean",
+        duplicateAgent: "Agent",
         refineFromTask: "FromTask",
         refineAexolContent: "FromTask",
         evaluatePromptQuality: "PromptQualityResult",

package/dist/generated/zeus/index.d.ts

@@ -340,6 +340,20 @@ export type ValueTypes = {
         teamId: ValueTypes["ID"] | Variable<any, string>;
         name: string | Variable<any, string>;
     };
+    ["UserApiKey"]: AliasType<{
+        id?: boolean | `@${string}`;
+        name?: boolean | `@${string}`;
+        apiKey?: boolean | `@${string}`;
+        teamId?: boolean | `@${string}`;
+        lastUsedAt?: boolean | `@${string}`;
+        createdAt?: boolean | `@${string}`;
+        __typename?: boolean | `@${string}`;
+        ['...on UserApiKey']?: Omit<ValueTypes["UserApiKey"], "...on UserApiKey">;
+    }>;
+    ["CreateUserApiKeyInput"]: {
+        teamId: ValueTypes["ID"] | Variable<any, string>;
+        name: string | Variable<any, string>;
+    };
     ["TeamInvite"]: AliasType<{
         id?: boolean | `@${string}`;
         teamId?: boolean | `@${string}`;
@@ -1101,6 +1115,9 @@ export type ValueTypes = {
         teamApiKeys?: [{
             teamId: ValueTypes["ID"] | Variable<any, string>;
         }, ValueTypes["TeamApiKey"]];
+        myApiKeys?: [{
+            teamId?: ValueTypes["ID"] | undefined | null | Variable<any, string>;
+        }, ValueTypes["UserApiKey"]];
         teamInvites?: [{
             teamId: ValueTypes["ID"] | Variable<any, string>;
         }, ValueTypes["TeamInvite"]];
@@ -1480,6 +1497,15 @@ export type ValueTypes = {
         regenerateTeamApiKey?: [{
             id: ValueTypes["ID"] | Variable<any, string>;
         }, ValueTypes["TeamApiKey"]];
+        createUserApiKey?: [{
+            input: ValueTypes["CreateUserApiKeyInput"] | Variable<any, string>;
+        }, ValueTypes["UserApiKey"]];
+        revokeUserApiKey?: [{
+            id: ValueTypes["ID"] | Variable<any, string>;
+        }, boolean | `@${string}`];
+        regenerateUserApiKey?: [{
+            id: ValueTypes["ID"] | Variable<any, string>;
+        }, ValueTypes["UserApiKey"]];
         createTeamMcpServer?: [{
             input: ValueTypes["CreateTeamMcpServerInput"] | Variable<any, string>;
         }, ValueTypes["TeamMcpServer"]];
@@ -1581,6 +1607,11 @@ export type ValueTypes = {
             id: ValueTypes["ID"] | Variable<any, string>;
             teamId: ValueTypes["ID"] | Variable<any, string>;
         }, boolean | `@${string}`];
+        duplicateAgent?: [{
+            id: ValueTypes["ID"] | Variable<any, string>;
+            teamId: ValueTypes["ID"] | Variable<any, string>;
+            name?: string | undefined | null | Variable<any, string>;
+        }, ValueTypes["Agent"]];
         refineFromTask?: [{
             input: ValueTypes["RefineFromTaskInput"] | Variable<any, string>;
         }, ValueTypes["FromTask"]];
@@ -2654,6 +2685,19 @@ export type ResolverInputTypes = {
         teamId: ResolverInputTypes["ID"];
         name: string;
     };
+    ["UserApiKey"]: AliasType<{
+        id?: boolean | `@${string}`;
+        name?: boolean | `@${string}`;
+        apiKey?: boolean | `@${string}`;
+        teamId?: boolean | `@${string}`;
+        lastUsedAt?: boolean | `@${string}`;
+        createdAt?: boolean | `@${string}`;
+        __typename?: boolean | `@${string}`;
+    }>;
+    ["CreateUserApiKeyInput"]: {
+        teamId: ResolverInputTypes["ID"];
+        name: string;
+    };
     ["TeamInvite"]: AliasType<{
         id?: boolean | `@${string}`;
         teamId?: boolean | `@${string}`;
@@ -3369,6 +3413,9 @@ export type ResolverInputTypes = {
         teamApiKeys?: [{
             teamId: ResolverInputTypes["ID"];
         }, ResolverInputTypes["TeamApiKey"]];
+        myApiKeys?: [{
+            teamId?: ResolverInputTypes["ID"] | undefined | null;
+        }, ResolverInputTypes["UserApiKey"]];
         teamInvites?: [{
             teamId: ResolverInputTypes["ID"];
         }, ResolverInputTypes["TeamInvite"]];
@@ -3747,6 +3794,15 @@ export type ResolverInputTypes = {
         regenerateTeamApiKey?: [{
             id: ResolverInputTypes["ID"];
         }, ResolverInputTypes["TeamApiKey"]];
+        createUserApiKey?: [{
+            input: ResolverInputTypes["CreateUserApiKeyInput"];
+        }, ResolverInputTypes["UserApiKey"]];
+        revokeUserApiKey?: [{
+            id: ResolverInputTypes["ID"];
+        }, boolean | `@${string}`];
+        regenerateUserApiKey?: [{
+            id: ResolverInputTypes["ID"];
+        }, ResolverInputTypes["UserApiKey"]];
         createTeamMcpServer?: [{
             input: ResolverInputTypes["CreateTeamMcpServerInput"];
         }, ResolverInputTypes["TeamMcpServer"]];
@@ -3848,6 +3904,11 @@ export type ResolverInputTypes = {
             id: ResolverInputTypes["ID"];
             teamId: ResolverInputTypes["ID"];
         }, boolean | `@${string}`];
+        duplicateAgent?: [{
+            id: ResolverInputTypes["ID"];
+            teamId: ResolverInputTypes["ID"];
+            name?: string | undefined | null;
+        }, ResolverInputTypes["Agent"]];
         refineFromTask?: [{
             input: ResolverInputTypes["RefineFromTaskInput"];
         }, ResolverInputTypes["FromTask"]];
@@ -4881,6 +4942,18 @@ export type ModelTypes = {
         teamId: ModelTypes["ID"];
         name: string;
     };
+    ["UserApiKey"]: {
+        id: ModelTypes["ID"];
+        name: string;
+        apiKey: string;
+        teamId: ModelTypes["ID"];
+        lastUsedAt?: ModelTypes["DateTime"] | undefined | null;
+        createdAt: ModelTypes["DateTime"];
+    };
+    ["CreateUserApiKeyInput"]: {
+        teamId: ModelTypes["ID"];
+        name: string;
+    };
     ["TeamInvite"]: {
         id: ModelTypes["ID"];
         teamId: ModelTypes["ID"];
@@ -5540,6 +5613,7 @@ export type ModelTypes = {
         team?: ModelTypes["Team"] | undefined | null;
         teamUsage: ModelTypes["TeamUsage"];
         teamApiKeys: Array<ModelTypes["TeamApiKey"]>;
+        myApiKeys: Array<ModelTypes["UserApiKey"]>;
         teamInvites: Array<ModelTypes["TeamInvite"]>;
         validateTeamInvite: ModelTypes["TeamInviteValidation"];
         teamReferralCampaigns: Array<ModelTypes["ReferralCampaign"]>;
@@ -5645,6 +5719,9 @@ export type ModelTypes = {
         createTeamApiKey: ModelTypes["TeamApiKey"];
         revokeTeamApiKey: boolean;
         regenerateTeamApiKey: ModelTypes["TeamApiKey"];
+        createUserApiKey: ModelTypes["UserApiKey"];
+        revokeUserApiKey: boolean;
+        regenerateUserApiKey: ModelTypes["UserApiKey"];
         createTeamMcpServer: ModelTypes["TeamMcpServer"];
         updateTeamMcpServer: ModelTypes["TeamMcpServer"];
         deleteTeamMcpServer: boolean;
@@ -5672,6 +5749,7 @@ export type ModelTypes = {
         createAgent: ModelTypes["Agent"];
         updateAgent: ModelTypes["Agent"];
         deleteAgent: boolean;
+        duplicateAgent: ModelTypes["Agent"];
         refineFromTask: ModelTypes["FromTask"];
         refineAexolContent: ModelTypes["FromTask"];
         evaluatePromptQuality: ModelTypes["PromptQualityResult"];
@@ -6464,6 +6542,20 @@ export type GraphQLTypes = {
         teamId: GraphQLTypes["ID"];
         name: string;
     };
+    ["UserApiKey"]: {
+        __typename: "UserApiKey";
+        id: GraphQLTypes["ID"];
+        name: string;
+        apiKey: string;
+        teamId: GraphQLTypes["ID"];
+        lastUsedAt?: GraphQLTypes["DateTime"] | undefined | null;
+        createdAt: GraphQLTypes["DateTime"];
+        ['...on UserApiKey']: Omit<GraphQLTypes["UserApiKey"], "...on UserApiKey">;
+    };
+    ["CreateUserApiKeyInput"]: {
+        teamId: GraphQLTypes["ID"];
+        name: string;
+    };
     ["TeamInvite"]: {
         __typename: "TeamInvite";
         id: GraphQLTypes["ID"];
@@ -7216,6 +7308,7 @@ export type GraphQLTypes = {
         team?: GraphQLTypes["Team"] | undefined | null;
         teamUsage: GraphQLTypes["TeamUsage"];
         teamApiKeys: Array<GraphQLTypes["TeamApiKey"]>;
+        myApiKeys: Array<GraphQLTypes["UserApiKey"]>;
         teamInvites: Array<GraphQLTypes["TeamInvite"]>;
         validateTeamInvite: GraphQLTypes["TeamInviteValidation"];
         teamReferralCampaigns: Array<GraphQLTypes["ReferralCampaign"]>;
@@ -7323,6 +7416,9 @@ export type GraphQLTypes = {
         createTeamApiKey: GraphQLTypes["TeamApiKey"];
         revokeTeamApiKey: boolean;
         regenerateTeamApiKey: GraphQLTypes["TeamApiKey"];
+        createUserApiKey: GraphQLTypes["UserApiKey"];
+        revokeUserApiKey: boolean;
+        regenerateUserApiKey: GraphQLTypes["UserApiKey"];
         createTeamMcpServer: GraphQLTypes["TeamMcpServer"];
         updateTeamMcpServer: GraphQLTypes["TeamMcpServer"];
         deleteTeamMcpServer: boolean;
@@ -7350,6 +7446,7 @@ export type GraphQLTypes = {
         createAgent: GraphQLTypes["Agent"];
         updateAgent: GraphQLTypes["Agent"];
         deleteAgent: boolean;
+        duplicateAgent: GraphQLTypes["Agent"];
         refineFromTask: GraphQLTypes["FromTask"];
         refineAexolContent: GraphQLTypes["FromTask"];
         evaluatePromptQuality: GraphQLTypes["PromptQualityResult"];
@@ -8312,6 +8409,7 @@ type ZEUS_VARIABLES = {
     ["TeamRole"]: ValueTypes["TeamRole"];
     ["TeamUsageTaskType"]: ValueTypes["TeamUsageTaskType"];
     ["CreateTeamApiKeyInput"]: ValueTypes["CreateTeamApiKeyInput"];
+    ["CreateUserApiKeyInput"]: ValueTypes["CreateUserApiKeyInput"];
     ["TeamInviteStatus"]: ValueTypes["TeamInviteStatus"];
     ["CreateReferralCampaignInput"]: ValueTypes["CreateReferralCampaignInput"];
     ["UpdateReferralCampaignInput"]: ValueTypes["UpdateReferralCampaignInput"];