@aexol/spectral 0.9.229 → 0.9.231

package/CHANGELOG.md

@@ -5,6 +5,8 @@ All notable changes to `@aexol/spectral` are documented here. Format follows
 
 ## [Unreleased]
 
+## [0.9.231] - 2026-09-23
+
 ### Added
 
 - Added built-in `web_fetch` tool for fetching public web pages as text,

package/dist/auth-helper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-helper.d.ts","sourceRoot":"","sources":["../src/auth-helper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,aAAa,CAAC;AAOrB,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,eAAO,MAAM,YAAY;IACvB,4DAA4D;;IAE5D,6EAA6E;;IAE7E,2DAA2D;;IAE3D,uCAAuC;;CAE/B,CAAC;AACX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AA8F3E;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,MAAM,CAAC,EAAE,MAAM,EACf,SAAS,GAAE,MAAyB,EACpC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,WAAW,CAAC,CAmEtB;AAMD,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAUjD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAgErE"}
+{"version":3,"file":"auth-helper.d.ts","sourceRoot":"","sources":["../src/auth-helper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,aAAa,CAAC;AAOrB,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,eAAO,MAAM,YAAY;IACvB,4DAA4D;;IAE5D,6EAA6E;;IAE7E,2DAA2D;;IAE3D,uCAAuC;;CAE/B,CAAC;AACX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AA8F3E;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,MAAM,CAAC,EAAE,MAAM,EACf,SAAS,GAAE,MAAyB,EACpC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,WAAW,CAAC,CAmEtB;AAMD,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAUjD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAuErE"}

package/dist/auth-helper.js

@@ -208,15 +208,21 @@ export async function ensureAuthenticated() {
     }
     const existingCfg = await readConfig();
     const apiUrl = existingCfg?.apiUrl ?? process.env.SPECTRAL_MCP_URL ?? DEFAULT_API_URL;
-    const token = existingCfg?.teamApiKey || existingCfg?.userJwt || "";
+    // Chain: team key, then user key, then the OAuth JWT.
+    const token = existingCfg?.teamApiKey || existingCfg?.userApiKey || existingCfg?.userJwt || "";
     // If we have a token, verify it still works
     if (token) {
-        // If the stored user JWT is locally known to be expired, skip the network roundtrip
-        if (existingCfg?.userJwt && isJwtExpired(existingCfg.userJwt)) {
-            // userJwt expired — if we have a teamApiKey, try that before re-auth
-            if (existingCfg?.teamApiKey) {
+        // The stored user JWT is locally known to be expired and it is the token
+        // we'd use (no team/user API key ahead of it in the chain) — skip the
+        // network roundtrip for the JWT itself, but try the API-key fallbacks
+        // before triggering the OAuth browser flow.
+        const tokenIsExpiredUserJwt = token === existingCfg?.userJwt && isJwtExpired(existingCfg.userJwt);
+        if (tokenIsExpiredUserJwt) {
+            // userJwt expired — if we have an API key, try that before re-auth
+            const fallbackToken = existingCfg?.teamApiKey ?? existingCfg?.userApiKey;
+            if (fallbackToken) {
                 try {
-                    const client = new AexolMcpClient(apiUrl, existingCfg.teamApiKey);
+                    const client = new AexolMcpClient(apiUrl, fallbackToken);
                     await client.listTools();
                     return { ok: true, config: existingCfg };
                 }
@@ -225,10 +231,10 @@ export async function ensureAuthenticated() {
                         const msg = err instanceof Error ? err.message : String(err);
                         return { ok: false, config: existingCfg, reason: `Backend unreachable: ${msg}` };
                     }
-                    // teamApiKey also failed — fall through to OAuth
+                    // API key also failed — fall through to OAuth
                 }
             }
-            // no teamApiKey — fall through to OAuth
+            // no API key — fall through to OAuth
         }
         else {
             try {

package/dist/commands/login.d.ts

@@ -2,10 +2,12 @@
  * `spectral login` — interactive authentication against the Aexol MCP backend.
  *
  * Flow:
- *   1. Choose auth method: Team API key or OAuth (browser).
- *   2a. API key: prompt for team API key (masked input). Verify the
- *       sk-aexol-team- prefix locally so we don't send obviously-wrong
- *       credentials. The API URL is taken from env or the hard default.
+ *   1. Choose auth method: Team API key, User API key, or OAuth (browser).
+ *   2a. API keys: prompt for the key (masked input). Verify the
+ *       sk-aexol-team- / sk-aexol-user- prefix locally so we don't send
+ *       obviously-wrong credentials. The API URL is taken from env or the
+ *       hard default. A user key (sk-aexol-user-) is pinned to a team but
+ *       owned by a single user — machines registered with it are PRIVATE.
  *   2b. OAuth: open browser for Aexol Studio authorization.
  *   3. Verify reachability + auth by calling tools/list against the URL.
  *   4. On success: persist to ~/.spectral/config.json (mode 0600).
@@ -19,6 +21,12 @@
  */
 export interface PerformLoginOptions {
     apiUrl: string;
+    /**
+     * API key to verify. Accepts both the team prefix ("sk-aexol-team-") and
+     * the user prefix ("sk-aexol-user-"). The key kind determines how it is
+     * persisted: a team key sets `teamApiKey` (clearing any stale `userApiKey`),
+     * a user key sets `userApiKey`.
+     */
     teamApiKey: string;
 }
 export interface PerformLoginResult {

package/dist/commands/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAiBH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAqCzF;AAED,wBAAsB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAqF9C"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAoBH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAoDzF;AAED,wBAAsB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAyF9C"}

package/dist/commands/login.js

@@ -2,10 +2,12 @@
  * `spectral login` — interactive authentication against the Aexol MCP backend.
  *
  * Flow:
- *   1. Choose auth method: Team API key or OAuth (browser).
- *   2a. API key: prompt for team API key (masked input). Verify the
- *       sk-aexol-team- prefix locally so we don't send obviously-wrong
- *       credentials. The API URL is taken from env or the hard default.
+ *   1. Choose auth method: Team API key, User API key, or OAuth (browser).
+ *   2a. API keys: prompt for the key (masked input). Verify the
+ *       sk-aexol-team- / sk-aexol-user- prefix locally so we don't send
+ *       obviously-wrong credentials. The API URL is taken from env or the
+ *       hard default. A user key (sk-aexol-user-) is pinned to a team but
+ *       owned by a single user — machines registered with it are PRIVATE.
  *   2b. OAuth: open browser for Aexol Studio authorization.
  *   3. Verify reachability + auth by calling tools/list against the URL.
  *   4. On success: persist to ~/.spectral/config.json (mode 0600).
@@ -19,7 +21,7 @@
  */
 import { password, select } from "@inquirer/prompts";
 import pc from "picocolors";
-import { TEAM_API_KEY_PREFIX, getApiUrl, getConfigFile, validateTeamApiKey, writeConfig, } from "../config.js";
+import { TEAM_API_KEY_PREFIX, USER_API_KEY_PREFIX, getApiUrl, getConfigFile, readConfig, validateTeamApiKey, validateUserApiKey, writeConfig, } from "../config.js";
 import { AexolMcpClient, AexolMcpError } from "../mcp-client.js";
 import { runOAuthFlow, OAUTH_REASON } from "../auth-helper.js";
 /**
@@ -37,8 +39,10 @@ export async function performLogin(opts) {
     if (!apiUrl) {
         throw new Error("API URL is required");
     }
-    if (!validateTeamApiKey(teamApiKey)) {
-        throw new Error(`Invalid API key prefix: token must start with "${TEAM_API_KEY_PREFIX}"`);
+    const isTeamKey = validateTeamApiKey(teamApiKey);
+    const isUserKey = validateUserApiKey(teamApiKey);
+    if (!isTeamKey && !isUserKey) {
+        throw new Error(`Invalid API key prefix: token must start with "${TEAM_API_KEY_PREFIX}" or "${USER_API_KEY_PREFIX}"`);
     }
     const client = new AexolMcpClient(apiUrl, teamApiKey);
     let toolCount;
@@ -59,7 +63,20 @@ export async function performLogin(opts) {
         const msg = err instanceof Error ? err.message : String(err);
         throw new Error(`Could not reach ${apiUrl}: ${msg}`);
     }
-    const cfg = { apiUrl, teamApiKey };
+    // Preserve credentials we didn't just verify — most importantly the user JWT
+    // from a previous OAuth login (previously overwritten here, silently dropping
+    // Studio auth). A team-key login clears any stale userApiKey so the explicit
+    // choice of team auth isn't later overridden by registration priority; a
+    // user-key login keeps the team key (both stay valid for the team).
+    const existing = await readConfig();
+    const cfg = isTeamKey
+        ? { apiUrl, teamApiKey, userJwt: existing?.userJwt }
+        : {
+            apiUrl,
+            teamApiKey: existing?.teamApiKey ?? "",
+            userApiKey: teamApiKey,
+            userJwt: existing?.userJwt,
+        };
     await writeConfig(cfg);
     return { toolCount };
 }
@@ -73,6 +90,7 @@ export async function runLogin() {
             message: "How would you like to authenticate?",
             choices: [
                 { name: "Team API key", value: "apikey" },
+                { name: "User API key", value: "userkey" },
                 { name: "OAuth (browser)", value: "oauth" },
             ],
         });
@@ -90,19 +108,22 @@ export async function runLogin() {
         await runLoginOAuth();
         return;
     }
-    // Team API key flow: no URL prompt — use env or default.
+    // API key flow: no URL prompt — use env or default.
     const apiUrl = getApiUrl();
-    let teamApiKey;
+    const isUserKey = authMethod === "userkey";
+    const keyPrefix = isUserKey ? USER_API_KEY_PREFIX : TEAM_API_KEY_PREFIX;
+    let apiKey;
     try {
-        teamApiKey = (await password({
-            message: `Team API key (starts with "${TEAM_API_KEY_PREFIX}")`,
+        apiKey = (await password({
+            message: `${isUserKey ? "User" : "Team"} API key (starts with "${keyPrefix}")`,
             mask: "*",
             validate: (v) => {
                 const trimmed = v.trim();
                 if (trimmed.length === 0)
                     return "Token is required";
-                if (!validateTeamApiKey(trimmed)) {
-                    return `Token must start with "${TEAM_API_KEY_PREFIX}"`;
+                const valid = isUserKey ? validateUserApiKey(trimmed) : validateTeamApiKey(trimmed);
+                if (!valid) {
+                    return `Token must start with "${keyPrefix}"`;
                 }
                 return true;
             },
@@ -119,7 +140,7 @@ export async function runLogin() {
     process.stdout.write(pc.dim(`\nVerifying credentials against ${apiUrl} ...\n`));
     let result;
     try {
-        result = await performLogin({ apiUrl, teamApiKey });
+        result = await performLogin({ apiUrl, teamApiKey: apiKey });
     }
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);

package/dist/commands/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/commands/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAwBH,OAAO,EAAE,WAAW,EAAmB,MAAM,oBAAoB,CAAC;AAYlE,OAAO,KAAK,EAAE,aAAa,EAAc,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAGnE,OAAO,EAAmB,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAarE;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAazD;AAED,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,CA6B9D;AAED,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,uCAAuC;IACvC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4CAA4C;IAC5C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,qBAAqB,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;CAC/E;AAED,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,KAAK,EAAE,YAAY,CAAC;IACpB,wDAAwD;IACxD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,4CAA4C;IAC5C,KAAK,EAAE,WAAW,CAAC;IACnB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAsB,QAAQ,CAAC,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CA4kBlF;AAmFD;;;GAGG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAc5E"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/commands/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAwBH,OAAO,EAAE,WAAW,EAAmB,MAAM,oBAAoB,CAAC;AAYlE,OAAO,KAAK,EAAE,aAAa,EAAc,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAGnE,OAAO,EAAmB,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAarE;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAazD;AAED,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,CA6B9D;AAED,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,uCAAuC;IACvC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4CAA4C;IAC5C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,qBAAqB,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;CAC/E;AAED,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,KAAK,EAAE,YAAY,CAAC;IACpB,wDAAwD;IACxD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,4CAA4C;IAC5C,KAAK,EAAE,WAAW,CAAC;IACnB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAsB,QAAQ,CAAC,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CA+kBlF;AAmFD;;;GAGG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAc5E"}

package/dist/commands/serve.js

@@ -172,6 +172,7 @@ export async function runServe(opts = {}) {
         registration = await ensureMachineRegistered({
             backendUrl,
             apiKey: cfg.teamApiKey,
+            userApiKey: cfg.userApiKey,
             userJwt: cfg.userJwt,
             machineNameOverride: opts.machineName,
             version,
@@ -213,6 +214,7 @@ export async function runServe(opts = {}) {
             const newReg = await ensureMachineRegistered({
                 backendUrl,
                 apiKey: cfg.teamApiKey,
+                userApiKey: cfg.userApiKey,
                 userJwt: cfg.userJwt,
                 machineNameOverride: opts.machineName,
                 version,
@@ -476,6 +478,7 @@ export async function runServe(opts = {}) {
                     const newReg = await ensureMachineRegistered({
                         backendUrl,
                         apiKey: cfg.teamApiKey,
+                        userApiKey: cfg.userApiKey,
                         userJwt: cfg.userJwt,
                         machineNameOverride: opts.machineName,
                         version,

package/dist/config.d.ts

@@ -12,9 +12,22 @@
  */
 export declare const DEFAULT_API_URL = "https://api.aexol.ai/mcp";
 export declare const TEAM_API_KEY_PREFIX = "sk-aexol-team-";
+export declare const USER_API_KEY_PREFIX = "sk-aexol-user-";
 export interface SpectralConfig {
     apiUrl: string;
+    /**
+     * Team API key ("sk-aexol-team-"). Normalized to "" when absent — e.g. an
+     * OAuth-only login stores no team key. At least one of `teamApiKey`,
+     * `userApiKey`, or `userJwt` must be present for the config to be valid.
+     */
     teamApiKey: string;
+    /**
+     * User API key ("sk-aexol-user-"), pinned to a team but owned by a single
+     * user. Machines registered with it are PRIVATE with `ownerId` derived from
+     * the key. Takes priority over `teamApiKey` for machine registration
+     * (see `relay/registration.ts`).
+     */
+    userApiKey?: string;
     /** User JWT from OAuth login. When present, used for machine registration (owns the machine). */
     userJwt?: string;
 }
@@ -40,6 +53,8 @@ export declare const CONFIG_FILE: string;
 export declare function getApiUrl(stored?: string): string;
 /** Validate the team API key prefix. The full token check happens server-side. */
 export declare function validateTeamApiKey(key: unknown): key is string;
+/** Validate the user API key prefix. The full token check happens server-side. */
+export declare function validateUserApiKey(key: unknown): key is string;
 /** Read config; returns null if missing or malformed. Never throws. */
 export declare function readConfig(): Promise<SpectralConfig | null>;
 /** Persist config with restrictive permissions (dir 0700, file 0600). */

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAC1D,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,iGAAiG;IACjG,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED;;;;;GAKG;AACH,eAAO,MAAM,UAAU,QAAiB,CAAC;AACzC,eAAO,MAAM,WAAW,QAAkB,CAAC;AAE3C,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,kFAAkF;AAClF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,MAAM,CAE9D;AAED,uEAAuE;AACvE,wBAAsB,UAAU,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA2BjE;AAED,yEAAyE;AACzE,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAQpE;AAED,+FAA+F;AAC/F,wBAAsB,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CASrD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAC1D,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AACpD,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED;;;;;GAKG;AACH,eAAO,MAAM,UAAU,QAAiB,CAAC;AACzC,eAAO,MAAM,WAAW,QAAkB,CAAC;AAE3C,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,kFAAkF;AAClF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,MAAM,CAE9D;AAED,kFAAkF;AAClF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,MAAM,CAE9D;AAED,uEAAuE;AACvE,wBAAsB,UAAU,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAgCjE;AAED,yEAAyE;AACzE,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAQpE;AAED,+FAA+F;AAC/F,wBAAsB,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CASrD"}

package/dist/config.js

@@ -15,6 +15,7 @@ import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 export const DEFAULT_API_URL = "https://api.aexol.ai/mcp";
 export const TEAM_API_KEY_PREFIX = "sk-aexol-team-";
+export const USER_API_KEY_PREFIX = "sk-aexol-user-";
 /**
  * Resolve the directory used to store Spectral configuration.
  *
@@ -45,6 +46,10 @@ export function getApiUrl(stored) {
 export function validateTeamApiKey(key) {
     return typeof key === "string" && key.startsWith(TEAM_API_KEY_PREFIX);
 }
+/** Validate the user API key prefix. The full token check happens server-side. */
+export function validateUserApiKey(key) {
+    return typeof key === "string" && key.startsWith(USER_API_KEY_PREFIX);
+}
 /** Read config; returns null if missing or malformed. Never throws. */
 export async function readConfig() {
     let raw;
@@ -64,11 +69,15 @@ export async function readConfig() {
         const userJwt = typeof parsed.userJwt === "string" && parsed.userJwt.length > 0
             ? parsed.userJwt
             : undefined;
-        if (!teamApiKey && !userJwt)
+        const userApiKey = typeof parsed.userApiKey === "string" && parsed.userApiKey.length > 0
+            ? parsed.userApiKey
+            : undefined;
+        if (!teamApiKey && !userApiKey && !userJwt)
             return null;
         return {
             apiUrl: parsed.apiUrl,
             teamApiKey,
+            userApiKey,
             userJwt,
         };
     }

package/dist/designer/data/skills/blog-post.d.ts

@@ -0,0 +1,3 @@
+import type { DesignSkill } from "./design-skill.js";
+export declare const blogPost: DesignSkill;
+//# sourceMappingURL=blog-post.d.ts.map

package/dist/designer/data/skills/blog-post.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blog-post.d.ts","sourceRoot":"","sources":["../../../../src/designer/data/skills/blog-post.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,eAAO,MAAM,QAAQ,EAAE,WAoFpB,CAAC"}

package/dist/designer/data/skills/blog-post.js

@@ -0,0 +1,84 @@
+export const blogPost = {
+    name: "blog-post",
+    scenario: "content",
+    description: "Blog article layout — title, author metadata, featured image, prose body with headings/images/quotes, related posts. Single-page, reading-optimized typography with comfortable measure.",
+    outputKind: "html",
+    workflow: `# Blog Post Skill
+
+Produce a single blog article page with reading-optimized typography.
+
+## Phase 1 — Structure
+
+\`\`\`html
+<article class="blog-post">
+  <header class="post-header">
+    <div class="post-category">Category</div>
+    <h1>Article Title That Is Specific and Engaging</h1>
+    <div class="post-meta">
+      <span class="post-author">Author Name</span>
+      <span class="post-date">Month DD, YYYY</span>
+      <span class="post-read-time">N min read</span>
+    </div>
+  </header>
+  <figure class="post-hero">
+    <img src="..." alt="...">
+    <figcaption>Image caption (optional)</figcaption>
+  </figure>
+  <div class="post-content">
+    <!-- prose -->
+  </div>
+  <footer class="post-footer">
+    <div class="post-tags"><!-- tag pills --></div>
+    <section class="related-posts"><!-- 3 related cards --></section>
+  </footer>
+</article>
+\`\`\`
+
+## Phase 2 — Typography
+
+\`\`\`css
+.blog-post { max-width: 680px; margin: 0 auto; padding: 64px 24px; }
+
+.post-header { margin-bottom: 32px; }
+.post-category { font-size: 13px; font-weight: 600; color: var(--accent); text-transform: uppercase; letter-spacing: 0.05em; margin-bottom: 12px; }
+.post-header h1 { font-size: 40px; font-weight: 700; line-height: 1.2; letter-spacing: -0.02em; margin-bottom: 16px; }
+.post-meta { display: flex; gap: 16px; font-size: 14px; color: var(--muted); }
+
+.post-hero { margin: 0 -24px 40px; }
+.post-hero img { width: 100%; height: 400px; object-fit: cover; border-radius: 12px; }
+.post-hero figcaption { font-size: 13px; color: var(--muted); text-align: center; margin-top: 8px; }
+
+/* Prose — comfortable reading measure */
+.post-content { font-size: 18px; line-height: 1.8; color: var(--fg); }
+.post-content p { margin: 24px 0; }
+.post-content h2 { font-size: 28px; font-weight: 600; margin: 48px 0 16px; }
+.post-content h3 { font-size: 22px; font-weight: 600; margin: 36px 0 12px; }
+.post-content blockquote { border-left: 3px solid var(--accent); padding: 8px 20px; margin: 32px 0; font-style: italic; color: var(--muted); }
+.post-content ul, .post-content ol { padding-left: 24px; margin: 16px 0; }
+.post-content li { margin: 8px 0; }
+.post-content img { max-width: 100%; border-radius: 8px; margin: 24px 0; }
+.post-content code { font-family: var(--font-mono); font-size: 0.9em; background: var(--surface); padding: 2px 6px; border-radius: 4px; }
+.post-content pre { background: var(--surface); border: 1px solid var(--border); border-radius: 8px; padding: 20px 24px; overflow-x: auto; font-family: var(--font-mono); font-size: 15px; line-height: 1.6; margin: 24px 0; }
+
+/* Tags */
+.post-tags { display: flex; flex-wrap: wrap; gap: 8px; margin: 48px 0; padding-top: 32px; border-top: 1px solid var(--border); }
+.post-tag { padding: 4px 12px; background: var(--surface); border-radius: 999px; font-size: 13px; color: var(--muted); }
+
+/* Related posts */
+.related-posts { margin-top: 48px; }
+.related-posts h3 { font-size: 20px; font-weight: 600; margin-bottom: 16px; }
+.related-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(200px, 1fr)); gap: 16px; }
+.related-card { border: 1px solid var(--border); border-radius: 8px; overflow: hidden; }
+.related-card img { width: 100%; height: 140px; object-fit: cover; }
+.related-card-content { padding: 16px; }
+.related-card-content h4 { font-size: 15px; font-weight: 600; margin-bottom: 4px; }
+.related-card-content time { font-size: 12px; color: var(--muted); }
+\`\`\`
+
+## Phase 3 — Content Rules
+- Article body: 800-2000 words of meaningful content (no lorem ipsum)
+- Every heading is specific and informative
+- Include at least one blockquote and one code block
+- Feature image is a gradient shape if no real image
+- Author bio is not generic — use a plausible name and role`,
+};

package/dist/designer/data/skills/blog-post.ts

@@ -0,0 +1,87 @@
+import type { DesignSkill } from "./design-skill.js";
+
+export const blogPost: DesignSkill = {
+    name: "blog-post",
+    scenario: "content",
+    description:
+      "Blog article layout — title, author metadata, featured image, prose body with headings/images/quotes, related posts. Single-page, reading-optimized typography with comfortable measure.",
+    outputKind: "html",
+    workflow: `# Blog Post Skill
+
+Produce a single blog article page with reading-optimized typography.
+
+## Phase 1 — Structure
+
+\`\`\`html
+<article class="blog-post">
+  <header class="post-header">
+    <div class="post-category">Category</div>
+    <h1>Article Title That Is Specific and Engaging</h1>
+    <div class="post-meta">
+      <span class="post-author">Author Name</span>
+      <span class="post-date">Month DD, YYYY</span>
+      <span class="post-read-time">N min read</span>
+    </div>
+  </header>
+  <figure class="post-hero">
+    <img src="..." alt="...">
+    <figcaption>Image caption (optional)</figcaption>
+  </figure>
+  <div class="post-content">
+    <!-- prose -->
+  </div>
+  <footer class="post-footer">
+    <div class="post-tags"><!-- tag pills --></div>
+    <section class="related-posts"><!-- 3 related cards --></section>
+  </footer>
+</article>
+\`\`\`
+
+## Phase 2 — Typography
+
+\`\`\`css
+.blog-post { max-width: 680px; margin: 0 auto; padding: 64px 24px; }
+
+.post-header { margin-bottom: 32px; }
+.post-category { font-size: 13px; font-weight: 600; color: var(--accent); text-transform: uppercase; letter-spacing: 0.05em; margin-bottom: 12px; }
+.post-header h1 { font-size: 40px; font-weight: 700; line-height: 1.2; letter-spacing: -0.02em; margin-bottom: 16px; }
+.post-meta { display: flex; gap: 16px; font-size: 14px; color: var(--muted); }
+
+.post-hero { margin: 0 -24px 40px; }
+.post-hero img { width: 100%; height: 400px; object-fit: cover; border-radius: 12px; }
+.post-hero figcaption { font-size: 13px; color: var(--muted); text-align: center; margin-top: 8px; }
+
+/* Prose — comfortable reading measure */
+.post-content { font-size: 18px; line-height: 1.8; color: var(--fg); }
+.post-content p { margin: 24px 0; }
+.post-content h2 { font-size: 28px; font-weight: 600; margin: 48px 0 16px; }
+.post-content h3 { font-size: 22px; font-weight: 600; margin: 36px 0 12px; }
+.post-content blockquote { border-left: 3px solid var(--accent); padding: 8px 20px; margin: 32px 0; font-style: italic; color: var(--muted); }
+.post-content ul, .post-content ol { padding-left: 24px; margin: 16px 0; }
+.post-content li { margin: 8px 0; }
+.post-content img { max-width: 100%; border-radius: 8px; margin: 24px 0; }
+.post-content code { font-family: var(--font-mono); font-size: 0.9em; background: var(--surface); padding: 2px 6px; border-radius: 4px; }
+.post-content pre { background: var(--surface); border: 1px solid var(--border); border-radius: 8px; padding: 20px 24px; overflow-x: auto; font-family: var(--font-mono); font-size: 15px; line-height: 1.6; margin: 24px 0; }
+
+/* Tags */
+.post-tags { display: flex; flex-wrap: wrap; gap: 8px; margin: 48px 0; padding-top: 32px; border-top: 1px solid var(--border); }
+.post-tag { padding: 4px 12px; background: var(--surface); border-radius: 999px; font-size: 13px; color: var(--muted); }
+
+/* Related posts */
+.related-posts { margin-top: 48px; }
+.related-posts h3 { font-size: 20px; font-weight: 600; margin-bottom: 16px; }
+.related-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(200px, 1fr)); gap: 16px; }
+.related-card { border: 1px solid var(--border); border-radius: 8px; overflow: hidden; }
+.related-card img { width: 100%; height: 140px; object-fit: cover; }
+.related-card-content { padding: 16px; }
+.related-card-content h4 { font-size: 15px; font-weight: 600; margin-bottom: 4px; }
+.related-card-content time { font-size: 12px; color: var(--muted); }
+\`\`\`
+
+## Phase 3 — Content Rules
+- Article body: 800-2000 words of meaningful content (no lorem ipsum)
+- Every heading is specific and informative
+- Include at least one blockquote and one code block
+- Feature image is a gradient shape if no real image
+- Author bio is not generic — use a plausible name and role`,
+  };

package/dist/designer/data/skills/critique.d.ts

@@ -0,0 +1,3 @@
+import type { DesignSkill } from "./design-skill.js";
+export declare const critique: DesignSkill;
+//# sourceMappingURL=critique.d.ts.map

package/dist/designer/data/skills/critique.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"critique.d.ts","sourceRoot":"","sources":["../../../../src/designer/data/skills/critique.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,eAAO,MAAM,QAAQ,EAAE,WA6GpB,CAAC"}

package/dist/designer/data/skills/critique.js

@@ -0,0 +1,109 @@
+export const critique = {
+    name: "critique",
+    scenario: "design",
+    description: "5-dimension expert design review. Scores any HTML artifact on Philosophy Consistency, Visual Hierarchy, Detail Execution, Functionality, and Innovation (each 0-10). Outputs an HTML report with a radar chart, evidence-backed scores, and three action lists: Keep / Fix / Quick-wins.",
+    outputKind: "html",
+    workflow: `# Critique Skill · 5-Dimension Expert Review
+
+Produce a single-file HTML design review report that scores any artifact across 5 dimensions and proposes actionable fixes.
+
+## When to use
+- After generating an artifact (deck, prototype, landing page) and the user asks "what's wrong with this?" or "review this"
+- As a self-check loop before emitting output
+- For comparing two variants of the same design
+
+## The 5 Dimensions
+
+### 1. Philosophy Consistency
+> Does the artifact pick a clear direction and stick to it through every micro-decision?
+
+Look for: one declared design direction vs three styles fighting; chrome/kicker vocabulary in one register; accent/serif/mono used by the same rule throughout.
+0-4: Three styles fighting. 5-6: One direction but elements drift. 7-8: Coherent, occasional drift. 9-10: Every element argues for the same thesis.
+
+### 2. Visual Hierarchy
+> Can a stranger figure out what to read first, second, third — without being told?
+
+Look for: largest type = most important thing; mono/serif/sans roles match information roles; clear primary/secondary/tertiary tiers.
+0-4: Everything shouts. 5-6: Works on hero pages but breaks on body. 7-8: Clear tiers, occasional collision. 9-10: Eye moves with zero friction.
+
+### 3. Detail Execution
+> Alignment, leading, kerning at large sizes, image framing, edge-case spacing.
+
+Look for: big numbers on baseline or floating; left/right column tops aligned; proportions consistent across pages; orphaned <br> causing single-character lines.
+0-4: Visible tape and string. 5-6: Most pages clean, 1-2 ragged. 7-8: Polished, expert eye finds 2-3 misses. 9-10: Magazine-grade polish.
+
+### 4. Functionality
+> Does the artifact work for its intended use?
+
+Look for: keyboard/wheel/touch nav working in decks; CTAs above the fold; phone numbers tappable on mobile; code blocks copyable; critical info readable from 4m away.
+0-4: Visually fine but doesn't accomplish its job. 5-6: Core flow works, edge cases broken. 7-8: Robust through normal use. 9-10: Defensively engineered — handles iframe / fullscreen / paste / print.
+
+### 5. Innovation
+> Does this push past the median? Is there one element that makes people lean in?
+
+Look for: one unexpected layout/motion/typographic move not required; or 100% safe generic output; innovation earned (matches direction) or grafted on.
+0-4: Generic AI-slop median. 5-6: Competent and unmemorable. 7-8: One memorable moment, the rest solid. 9-10: Multiple moves you'd steal — each serving the thesis.
+
+## Scoring Discipline
+- **Always cite evidence** — "scored 4 because hero page mixes Playfair display with Inter sans on the same line" beats "feels inconsistent"
+- **Don't average up** — if Hierarchy is 5 because page 3 is broken, don't bump to 7 because pages 1-2 are fine. The score is the worst sustained band.
+- **Don't grade-inflate** — a 7 means strong, not acceptable. If every score is 7+, you're not reviewing critically.
+- **Innovation is allowed to be low** — 5/10 is fine for production deliverables.
+
+## Workflow
+
+### Step 1 — Acquire the artifact
+1. **Project file** — user said "review the index.html I just made": read it from the project folder.
+2. **Pasted HTML** — user pasted code in chat: read it from the message.
+3. **Self-critique** — you just emitted an artifact and want to self-critique: re-read your own output.
+
+### Step 2 — Read enough to score
+Skim the entire <style>, then read 6-8 representative content blocks. Do not score from intent alone — the score depends on executed design, not declared intent.
+
+### Step 3 — Score with evidence
+For each of the 5 dimensions, write the score and a 30-80 word evidence paragraph naming specific elements. Example:
+\`\`\`
+Dimension: Detail execution
+Score: 6 / 10
+Evidence: Stat-cards on page 3 align cleanly, but on page 8 the right column sits 2vh higher than the left because .callout has 3vh top margin while the figure doesn't. Image captions use mono on page 5 but sans on page 7 — pick one.
+\`\`\`
+
+### Step 4 — Build action lists
+- **Keep** (3-5 bullets) — concrete things working that the user must not break. Cite by class/page/element.
+- **Fix** (3-6 bullets) — must-do, ordered by visual cost saved per minute. Each bullet ≤ 1 sentence.
+- **Quick wins** (3-5 bullets) — 5-15 minutes each, high signal-to-noise.
+
+### Step 5 — Emit the report HTML
+Build a single file with:
+- Header: artifact name + date + reviewer + 1-line verdict
+- Big radar chart (inline SVG, no library)
+- 5 dimension cards in a 1-column or 2-column grid
+- Three action lists at the bottom with checkbox affordance
+
+Use the active design system tokens if one exists; otherwise default to a neutral light theme (white background, near-black text, one accent for radar fill).
+
+## Radar Chart SVG Template
+\`\`\`svg
+<svg viewBox="0 0 400 400" xmlns="http://www.w3.org/2000/svg">
+  <!-- Pentagon grid lines -->
+  <polygon points="200,40 352,152 294,340 106,340 48,152" fill="none" stroke="#e0e0e0" stroke-width="1"/>
+  <polygon points="200,80 314,166 267,306 133,306 86,166" fill="none" stroke="#e0e0e0" stroke-width="1"/>
+  <polygon points="200,120 276,180 240,272 160,272 124,180" fill="none" stroke="#e0e0e0" stroke-width="1"/>
+  <!-- Score polygon (fill with accent at 20% opacity) -->
+  <polygon points="..." fill="var(--accent, #3B82F6)" fill-opacity="0.2" stroke="var(--accent, #3B82F6)" stroke-width="2"/>
+  <!-- Labels at each vertex -->
+  <text x="200" y="30" text-anchor="middle" font-size="11">Philosophy</text>
+  <text x="360" y="155" text-anchor="start" font-size="11">Hierarchy</text>
+  <text x="300" y="355" text-anchor="middle" font-size="11">Detail</text>
+  <text x="100" y="355" text-anchor="middle" font-size="11">Function</text>
+  <text x="40" y="155" text-anchor="end" font-size="11">Innovation</text>
+</svg>
+\`\`\`
+
+## Hard Rules
+- **5 scores, every time** — partial reports are not allowed.
+- **Evidence per score** — no "feels off" / "needs work". If you can't cite an element, the score is not justified.
+- **Don't grade-inflate** — overall mean above 8 is suspicious.
+- **Single-file HTML only** — no external CSS/JS. Inline everything.
+- **Radar chart is mandatory** — gives the report a recognizable silhouette.`,
+};