@antasphere/cli 0.1.0 → 0.1.1

package/dist/bin.js

@@ -3056,7 +3056,7 @@ var {
   Help
 } = import_index.default;
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.1.0/node_modules/@antasphere/cli-core/dist/config.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.2.0/node_modules/@antasphere/cli-core/dist/config.js
 import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 var HUB_TOOL = "hub";
@@ -3119,7 +3119,7 @@ function redactKey(key) {
   return `${key.slice(0, 13)}\u2026${key.slice(-4)}`;
 }
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.1.0/node_modules/@antasphere/cli-core/dist/io.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.2.0/node_modules/@antasphere/cli-core/dist/io.js
 async function ask(io, question) {
   if (!io.prompt) {
     throw new Error("This command is interactive \u2014 no prompt available (pass the value as a flag).");
@@ -3134,7 +3134,7 @@ function printJson(io, value) {
 `);
 }
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.1.0/node_modules/@antasphere/cli-core/dist/resolve.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.2.0/node_modules/@antasphere/cli-core/dist/resolve.js
 var CliUsageError = class extends Error {
 };
 var DEFAULT_PROFILE = "default";
@@ -3149,7 +3149,7 @@ function resolveApiKey(opts) {
   return opts.flag ?? opts.env[opts.envVar] ?? opts.profile?.apiKey;
 }
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.1.0/node_modules/@antasphere/cli-core/dist/auth.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.2.0/node_modules/@antasphere/cli-core/dist/auth.js
 var CliAuthError = class extends Error {
   status;
   code;
@@ -17741,7 +17741,13 @@ var apiErrorSchema = external_exports.object({
   })
 });
 var workspaceRoleSchema = external_exports.enum(["owner", "admin", "member"]);
-var scopeSchema = external_exports.enum(["account:read", "account:write", "data:export", "accounts:status"]);
+var scopeSchema = external_exports.enum([
+  "account:read",
+  "account:write",
+  "data:export",
+  "accounts:status",
+  "sso:exchange"
+]);
 var cursorPageQuerySchema = external_exports.object({
   cursor: external_exports.string().optional(),
   limit: external_exports.coerce.number().int().min(1).max(100).default(50)
@@ -18036,6 +18042,32 @@ var accountMemberStatusSchema = external_exports.object({
   role: workspaceRoleSchema.optional()
 });
 
+// ../contract/dist/schemas/sso.js
+var ssoToolTokenRequestSchema = external_exports.object({
+  /**
+   * The target tool's RFC 8707 resource identifier — MUST equal a registered
+   * tool's `resourceUrl` (the hub tool registry is the source of truth);
+   * anything else is a 400. Becomes the JWT `aud`.
+   */
+  resource: external_exports.url(),
+  /**
+   * Target organization. May be ANY org the key's HOLDER (the user) is a
+   * live ACTIVE member of — the documented gcloud-model deviation (the same
+   * rationale that lets a machine key read GET /orgs). Omit = the key's own
+   * bound workspace. Non-membership, an unknown org, and a deactivated
+   * membership all answer one uniform 403 (no oracle); a suspended org is
+   * refused after the membership check, like every issuance gate.
+   */
+  workspaceId: external_exports.uuid().optional()
+});
+var ssoToolTokenSchema = external_exports.object({
+  token: external_exports.string(),
+  /** Absolute expiry (ISO 8601) — 120 seconds from mint. */
+  expiresAt: external_exports.string(),
+  /** The resolved target organization the token is bound to. */
+  workspaceId: external_exports.string()
+});
+
 // ../contract/dist/schemas/files.js
 var fileSchema = external_exports.object({
   id: external_exports.string(),
@@ -18248,6 +18280,17 @@ var PlatformClient = class {
   accountMemberStatus(workspaceId, userId) {
     return this.request("GET", `/accounts/${encodeURIComponent(workspaceId)}/members/${encodeURIComponent(userId)}/status`);
   }
+  /**
+   * CLI cross-tool token exchange (hub, delta H3): trade the presenting API
+   * key (scope sso:exchange — CLI keys carry it) for a short-lived (120 s)
+   * single-org SSO JWT audienced to a registered tool's `resource` URL. The
+   * tool's /sso/cli-connect verifies it against the hub JWKS and mints a
+   * tool-local key. `workspaceId` may be any org the key's holder is an
+   * active member of (gcloud model); omitted = the key's bound workspace.
+   */
+  ssoToolToken(req) {
+    return this.request("POST", "/sso/tool-token", req);
+  }
   /** Create an organization (session-only; the caller becomes its owner). */
   createOrg(req, opts = {}) {
     return this.request("POST", "/orgs", req, idempotencyHeader(opts));
@@ -18371,7 +18414,7 @@ function requireApiKey(ctx) {
 }
 
 // src/index.ts
-var VERSION = "0.1.0";
+var VERSION = "0.1.1";
 function fmtBytes(n) {
   if (n < 1024) return `${n} B`;
   if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antasphere/cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "The Antasphere account CLI — login, identity, organizations for account.antasphere.com",
   "license": "MIT",
   "type": "module",
@@ -22,19 +22,20 @@
   "files": [
     "dist"
   ],
-  "devDependencies": {
-    "@antasphere/cli-core": "^0.1.0",
-    "@types/node": "^22.15.0",
-    "commander": "^12.1.0",
-    "esbuild": "^0.25.0",
-    "vitest": "^3.2.0",
-    "@antasphere/contract": "0.1.0",
-    "@antasphere/sdk": "0.1.0"
-  },
   "scripts": {
     "build": "rm -rf dist && esbuild src/bin.ts --bundle --platform=node --format=esm --target=node22 --outfile=dist/bin.js --log-level=warning --banner:js=\"import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);\"",
+    "prepack": "npm run build",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "lint": "eslint src",
     "test": "vitest run --passWithNoTests"
+  },
+  "devDependencies": {
+    "@antasphere/cli-core": "^0.2.0",
+    "@antasphere/contract": "workspace:*",
+    "@antasphere/sdk": "workspace:*",
+    "@types/node": "^22.15.0",
+    "commander": "^12.1.0",
+    "esbuild": "^0.25.0",
+    "vitest": "^3.2.0"
   }
-}
+}