@antasphere/slideless 0.2.1 → 0.2.2

package/dist/bin.js

@@ -3109,6 +3109,42 @@ function redactKey(key) {
     return "****";
   return `${key.slice(0, 13)}\u2026${key.slice(-4)}`;
 }
+function lookupWorkspaceKey(profile, workspaceId) {
+  if (!profile)
+    return void 0;
+  const entry = profile.workspaceKeys?.[workspaceId];
+  if (entry?.apiKey)
+    return entry.apiKey;
+  if (profile.apiKey && profile.workspaceId === workspaceId)
+    return profile.apiKey;
+  return void 0;
+}
+function storeWorkspaceKey(env, tool, profileName, workspaceId, entry) {
+  const config = loadConfig(env, tool);
+  const profile = config.profiles[profileName] ?? {};
+  config.profiles[profileName] = {
+    ...profile,
+    workspaceKeys: { ...profile.workspaceKeys, [workspaceId]: entry }
+  };
+  if (!config.activeProfile)
+    config.activeProfile = profileName;
+  return saveConfig(env, tool, config);
+}
+function removeWorkspaceKey(env, tool, profileName, workspaceId) {
+  const config = loadConfig(env, tool);
+  const profile = config.profiles[profileName];
+  if (!profile?.workspaceKeys || !(workspaceId in profile.workspaceKeys))
+    return false;
+  const { [workspaceId]: _dropped, ...rest } = profile.workspaceKeys;
+  if (Object.keys(rest).length === 0) {
+    const { workspaceKeys: _empty, ...bare } = profile;
+    config.profiles[profileName] = bare;
+  } else {
+    config.profiles[profileName] = { ...profile, workspaceKeys: rest };
+  }
+  saveConfig(env, tool, config);
+  return true;
+}
 
 // ../../node_modules/.pnpm/@antasphere+cli-core@0.2.0/node_modules/@antasphere/cli-core/dist/io.js
 function printJson(io, value) {
@@ -3119,6 +3155,7 @@ function printJson(io, value) {
 // ../../node_modules/.pnpm/@antasphere+cli-core@0.2.0/node_modules/@antasphere/cli-core/dist/resolve.js
 var CliUsageError = class extends Error {
 };
+var DEFAULT_PROFILE = "default";
 function resolveProfile(config, requested, opts = {}) {
   if (requested) {
     const profile2 = config.profiles[requested];
@@ -3197,6 +3234,80 @@ var CliAuthClient = class {
   }
 };
 
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.2.0/node_modules/@antasphere/cli-core/dist/connect.js
+var CliConnectError = class extends CliAuthError {
+  stage;
+  constructor(stage, status, code, message, details) {
+    super(status, code, message, details);
+    this.stage = stage;
+    this.name = "CliConnectError";
+  }
+  /**
+   * The hub rejected the key itself: invalid/revoked (401), or a key
+   * minted before the `sso:exchange` scope existed (403 insufficient_scope
+   * — old keys simply lack it). The fix is a fresh `antasphere login`.
+   */
+  get needsHubLogin() {
+    return this.stage === "hub" && (this.status === 401 || this.status === 403 && this.code === "insufficient_scope");
+  }
+  /** The tool rejected the JWT (expired/replayed) — run the exchange again. */
+  get needsReExchange() {
+    return this.stage === "tool" && this.status === 401;
+  }
+};
+var CliConnectClient = class {
+  hubBaseUrl;
+  toolBaseUrl;
+  fetchImpl;
+  constructor(options) {
+    this.hubBaseUrl = options.hubBaseUrl.replace(/\/+$/, "");
+    this.toolBaseUrl = options.toolBaseUrl.replace(/\/+$/, "");
+    this.fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);
+  }
+  /** Step 1 — the hub mints the 120 s single-org JWT for the tool's resource. */
+  toolToken(hubApiKey, body) {
+    return this.call("hub", `${this.hubBaseUrl}/api/v1/sso/tool-token`, body, hubApiKey);
+  }
+  /** Step 2 — the tool verifies the JWT (its only credential) and mints its key. */
+  cliConnect(token) {
+    return this.call("tool", `${this.toolBaseUrl}/api/v1/sso/cli-connect`, { token });
+  }
+  /** The full two-call exchange. The hub key goes to the hub ONLY. */
+  async exchange(hubApiKey, body) {
+    const minted = await this.toolToken(hubApiKey, body);
+    const connected = await this.cliConnect(minted.token);
+    return {
+      key: connected.key,
+      apiKey: connected.apiKey,
+      user: connected.user,
+      hubWorkspaceId: minted.workspaceId,
+      toolWorkspaceId: connected.workspaceId
+    };
+  }
+  /** Mirrors CliAuthClient's parse: `{ error: { code, message, details } }` envelopes. */
+  async call(stage, url, body, apiKey) {
+    const headers = { "content-type": "application/json" };
+    if (apiKey)
+      headers["authorization"] = `Bearer ${apiKey}`;
+    const res = await this.fetchImpl(url, { method: "POST", headers, body: JSON.stringify(body) });
+    const json = await res.json().catch(() => null);
+    if (!res.ok) {
+      const errBody = json ?? {};
+      throw new CliConnectError(stage, res.status, errBody.error?.code ?? "unknown_error", errBody.error?.message ?? `Request failed with ${res.status}`, errBody.error?.details);
+    }
+    return json;
+  }
+};
+
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.2.0/node_modules/@antasphere/cli-core/dist/org.js
+function getActiveWorkspace(env, opts = {}) {
+  const { profile } = resolveProfile(loadConfig(env, HUB_TOOL), opts.profile);
+  return profile?.activeWorkspaceId ?? profile?.workspaceId;
+}
+function resolveTargetWorkspace(env, opts = {}) {
+  return opts.override ?? getActiveWorkspace(env, opts);
+}
+
 // ../../node_modules/.pnpm/@antasphere+cli-core@0.2.0/node_modules/@antasphere/cli-core/dist/migrate.js
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
 import { join as join2 } from "node:path";
@@ -3657,6 +3768,12 @@ function saveConfig2(env, config) {
 function clearConfig2(env) {
   clearConfig(env, TOOL);
 }
+function storeWorkspaceKey2(env, profileName, workspaceId, entry) {
+  return storeWorkspaceKey(env, TOOL, profileName, workspaceId, entry);
+}
+function removeWorkspaceKey2(env, profileName, workspaceId) {
+  return removeWorkspaceKey(env, TOOL, profileName, workspaceId);
+}
 
 // src/context.ts
 function resolveProfile2(config, requested) {
@@ -3676,25 +3793,95 @@ function resolveContext(cmd, io) {
     profile,
     missingMessage: "No instance configured. Pass --api-url <url>, set SLIDELESS_URL, or sign in once with `slideless auth login-request --api-url <url> --email <you>` to save a profile."
   });
-  const apiKey = resolveApiKey({ flag: opts.apiKey, env: io.env, envVar: "SLIDELESS_API_KEY", profile });
+  let apiKey = resolveApiKey({ flag: opts.apiKey, env: io.env, envVar: "SLIDELESS_API_KEY", profile });
+  let org;
+  if (!apiKey) {
+    org = resolveTargetWorkspace(io.env, opts.org ? { override: opts.org } : {});
+    if (org && profile?.baseUrl?.replace(/\/+$/, "") === baseUrl) {
+      apiKey = lookupWorkspaceKey(profile, org);
+    }
+  }
   const fetchImpl = io.fetch ?? globalThis.fetch.bind(globalThis);
   return {
     client: new PlatformClient({ baseUrl, ...apiKey ? { apiKey } : {}, fetch: fetchImpl }),
     baseUrl,
     apiKey,
+    org,
     json: Boolean(opts.json),
     io,
     profileName,
     config
   };
 }
-function requireApiKey(ctx) {
-  if (!ctx.apiKey) {
+var NO_KEY_MESSAGE = "An API key is required. Sign in (`slideless auth login-request --email <you>`), paste one (`slideless login`), pass --api-key, or set SLIDELESS_API_KEY.";
+async function requireApiKey(ctx) {
+  if (ctx.apiKey) return ctx.apiKey;
+  const key = await connectViaHub(ctx);
+  if (!key) throw new CliUsageError(NO_KEY_MESSAGE);
+  return key;
+}
+async function connectViaHub(ctx) {
+  const { io } = ctx;
+  let cloud = false;
+  try {
+    const info = await ctx.client.instance();
+    cloud = info.auth.methods.includes("antasphere") || info.edition === "cloud";
+  } catch {
+    return void 0;
+  }
+  if (!cloud) return void 0;
+  const { profile: hubProfile } = resolveProfile(loadConfig(io.env, HUB_TOOL), void 0);
+  const hubKey = hubProfile?.apiKey;
+  const hubBaseUrl = hubProfile?.baseUrl;
+  if (!hubKey || !hubBaseUrl) {
     throw new CliUsageError(
-      "An API key is required. Sign in (`slideless auth login-request --email <you>`), paste one (`slideless login`), pass --api-key, or set SLIDELESS_API_KEY."
+      "This Slideless instance signs in through the Antasphere hub. Run `antasphere login` once, then retry \u2014 or pass --api-key <slk_\u2026> / set SLIDELESS_API_KEY."
     );
   }
-  return ctx.apiKey;
+  const resource = `${ctx.baseUrl}/mcp`;
+  const connect = new CliConnectClient({
+    hubBaseUrl,
+    toolBaseUrl: ctx.baseUrl,
+    ...io.fetch ? { fetch: io.fetch } : {}
+  });
+  const body = { resource, ...ctx.org ? { workspaceId: ctx.org } : {} };
+  let result;
+  try {
+    result = await connect.exchange(hubKey, body);
+  } catch (e) {
+    if (e instanceof CliConnectError && e.needsReExchange) {
+      result = await connect.exchange(hubKey, body);
+    } else if (e instanceof CliConnectError && e.needsHubLogin) {
+      throw new CliUsageError(
+        "The stored Antasphere hub credential was rejected \u2014 run `antasphere login` again, then retry."
+      );
+    } else {
+      throw e;
+    }
+  }
+  const profileName = ctx.profileName ?? DEFAULT_PROFILE;
+  const existing = ctx.config.profiles[profileName];
+  const cacheable = !existing?.baseUrl || existing.baseUrl.replace(/\/+$/, "") === ctx.baseUrl;
+  if (cacheable) {
+    storeWorkspaceKey2(io.env, profileName, result.hubWorkspaceId, {
+      apiKey: result.key,
+      toolWorkspaceId: result.toolWorkspaceId,
+      email: result.user.email,
+      mintedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    if (!existing?.baseUrl) {
+      const cfg = loadConfig2(io.env);
+      cfg.profiles[profileName] = { ...cfg.profiles[profileName], baseUrl: ctx.baseUrl };
+      saveConfig2(io.env, cfg);
+    }
+  }
+  io.err.write(
+    `Connected to ${ctx.baseUrl} as ${result.user.email} via Antasphere (org ${result.hubWorkspaceId})` + (cacheable ? "" : ` \u2014 key NOT cached: profile '${profileName}' points at ${existing?.baseUrl}`) + ".\n"
+  );
+  ctx.apiKey = result.key;
+  const fetchImpl = io.fetch ?? globalThis.fetch.bind(globalThis);
+  ctx.client = new PlatformClient({ baseUrl: ctx.baseUrl, apiKey: result.key, fetch: fetchImpl });
+  return result.key;
 }
 function table(rows) {
   if (rows.length === 0) return "";
@@ -3800,7 +3987,9 @@ API key "${result.apiKey.name}" (${redactKey(result.key)}) saved to profile "${p
 `
     );
   });
-  program2.command("logout").description("Forget the stored API key of the active (or named) profile").action(async (_opts, cmd) => {
+  program2.command("logout").description(
+    "Forget the stored API key of the active (or named) profile; --org logs one connected hub org out instead"
+  ).action(async (_opts, cmd) => {
     const globals = cmd.optsWithGlobals();
     const config2 = loadConfig2(io.env);
     const profileName = globals.profile ?? config2.activeProfile;
@@ -3808,6 +3997,53 @@ API key "${result.apiKey.name}" (${redactKey(result.key)}) saved to profile "${p
     if (!profileName || !profile) {
       throw new CliUsageError("No profile to log out of.");
     }
+    const hubKeys = profile.workspaceKeys ?? {};
+    const perOrg = globals.org !== void 0 || !profile.apiKey && Object.keys(hubKeys).length > 0;
+    if (perOrg) {
+      const org = globals.org ?? resolveTargetWorkspace(io.env, {});
+      if (!org) {
+        throw new CliUsageError(
+          "Pass --org <id> to say which hub org to log out of (or set one with `antasphere org use`)."
+        );
+      }
+      const entry = hubKeys[org];
+      if (!entry) {
+        const cached = Object.keys(hubKeys).join(", ") || "(none)";
+        throw new CliUsageError(
+          `No connected key for hub org ${org} on profile "${profileName}". Connected orgs: ${cached}.`
+        );
+      }
+      const rawUrl = profile.baseUrl;
+      let revoked = false;
+      if (rawUrl) {
+        const baseUrl = rawUrl.replace(/\/+$/, "");
+        try {
+          const client = new CliAuthClient({ baseUrl, ...io.fetch ? { fetch: io.fetch } : {} });
+          await client.revoke(entry.apiKey);
+          revoked = true;
+        } catch (e) {
+          if (e instanceof CliAuthError && e.status === 401) {
+            io.err.write("The cached key was already unusable \u2014 evicting it anyway.\n");
+          } else if (e instanceof CliAuthError && e.status === 403) {
+            io.err.write(
+              `This instance refused the self-revoke (${e.code}) \u2014 the key STAYS VALID server-side; revoke it from the dashboard. Evicting the cached copy.
+`
+            );
+          } else {
+            throw e;
+          }
+        }
+      } else {
+        io.err.write("No instance URL known for this profile \u2014 evicting the cached key locally only.\n");
+      }
+      removeWorkspaceKey2(io.env, profileName, org);
+      if (globals.json) return printJson(io, { profile: profileName, org, revoked, evicted: true });
+      io.out.write(
+        `Logged out of hub org ${org} on profile "${profileName}"${revoked ? " (key revoked server-side)" : ""}.
+`
+      );
+      return;
+    }
     delete profile.apiKey;
     if (!profile.baseUrl) delete config2.profiles[profileName];
     saveConfig2(io.env, config2);
@@ -3819,7 +4055,7 @@ API key "${result.apiKey.name}" (${redactKey(result.key)}) saved to profile "${p
   });
   program2.command("whoami").description("Show the identity behind the resolved API key").action(async (_opts, cmd) => {
     const ctx = resolveContext(cmd, io);
-    requireApiKey(ctx);
+    await requireApiKey(ctx);
     const me = await ctx.client.me();
     if (ctx.json) return printJson(io, me);
     io.out.write(
@@ -3834,7 +4070,7 @@ API key "${result.apiKey.name}" (${redactKey(result.key)}) saved to profile "${p
   });
   program2.command("verify").description("Check that the resolved instance + key work (exit 0 = ok)").action(async (_opts, cmd) => {
     const ctx = resolveContext(cmd, io);
-    requireApiKey(ctx);
+    await requireApiKey(ctx);
     const me = await ctx.client.me();
     if (ctx.json) return printJson(io, { ok: true, baseUrl: ctx.baseUrl, user: me.user });
     io.out.write(`ok \u2014 ${me.user.email} (${me.role}) @ ${ctx.baseUrl}
@@ -3862,7 +4098,14 @@ API key "${result.apiKey.name}" (${redactKey(result.key)}) saved to profile "${p
         profiles: Object.fromEntries(
           names.map((n) => {
             const p = config2.profiles[n];
-            return [n, { baseUrl: p.baseUrl ?? null, apiKey: p.apiKey ? redactKey(p.apiKey) : null }];
+            return [
+              n,
+              {
+                baseUrl: p.baseUrl ?? null,
+                apiKey: p.apiKey ? redactKey(p.apiKey) : null,
+                hubOrgs: Object.keys(p.workspaceKeys ?? {})
+              }
+            ];
           })
         )
       });
@@ -3877,11 +4120,12 @@ API key "${result.apiKey.name}" (${redactKey(result.key)}) saved to profile "${p
       table(
         names.map((n) => {
           const p = config2.profiles[n];
+          const hubOrgs = Object.keys(p.workspaceKeys ?? {});
           return [
             config2.activeProfile === n ? "*" : " ",
             n,
             p.baseUrl ?? "(no url)",
-            p.apiKey ? redactKey(p.apiKey) : "(no key)"
+            p.apiKey ? redactKey(p.apiKey) : hubOrgs.length > 0 ? `(hub: ${hubOrgs.join(", ")})` : "(no key)"
           ];
         })
       )
@@ -3898,7 +4142,14 @@ API key "${result.apiKey.name}" (${redactKey(result.key)}) saved to profile "${p
       profiles: Object.fromEntries(
         Object.entries(cfg.profiles).map(([n, p]) => [
           n,
-          { baseUrl: p.baseUrl ?? null, apiKey: p.apiKey ? redactKey(p.apiKey) : null }
+          {
+            baseUrl: p.baseUrl ?? null,
+            apiKey: p.apiKey ? redactKey(p.apiKey) : null,
+            // Hub-connected orgs: cached exchange keys, redacted like the rest.
+            workspaceKeys: Object.fromEntries(
+              Object.entries(p.workspaceKeys ?? {}).map(([org, entry]) => [org, redactKey(entry.apiKey)])
+            )
+          }
         ])
       )
     };
@@ -3920,7 +4171,7 @@ API key "${result.apiKey.name}" (${redactKey(result.key)}) saved to profile "${p
 function registerDeckCommands(program2, io) {
   program2.command("list").description("List presentations (newest first, cursor-paginated)").option("--cursor <cursor>", "resume from a previous nextCursor").option("--limit <n>", "page size (1-100)", (v) => parseInt(v, 10)).option("--all", "follow nextCursor until every page is fetched", false).action(async (opts, cmd) => {
     const ctx = resolveContext(cmd, io);
-    requireApiKey(ctx);
+    await requireApiKey(ctx);
     const params = {};
     if (opts.cursor) params.cursor = opts.cursor;
     if (opts.limit !== void 0) params.limit = opts.limit;
@@ -3948,7 +4199,7 @@ function registerDeckCommands(program2, io) {
   });
   program2.command("get <id>").description("Show one presentation (metadata + latest version)").action(async (id, _opts, cmd) => {
     const ctx = resolveContext(cmd, io);
-    requireApiKey(ctx);
+    await requireApiKey(ctx);
     const deck = await ctx.client.presentation(id);
     if (ctx.json) return printJson(io, deck);
     io.out.write(
@@ -3965,7 +4216,7 @@ function registerDeckCommands(program2, io) {
   });
   program2.command("delete <id>").description("Delete a presentation (soft delete; versions and share links stop resolving)").action(async (id, _opts, cmd) => {
     const ctx = resolveContext(cmd, io);
-    requireApiKey(ctx);
+    await requireApiKey(ctx);
     const deck = await ctx.client.deletePresentation(id);
     if (ctx.json) return printJson(io, deck);
     io.out.write(`Deleted "${deck.title}" (${deck.id}).
@@ -4316,7 +4567,7 @@ function registerContentCommands(program2, io) {
   ).option("--title <title>", "deck title (default: existing title, or the folder name)").option("--entry <path>", "entry document (default: index.html, or the only .html)").option("--kind <kind>", "presentation | app | plan (new decks only)", "presentation").option("--interactive", "mark the deck as embedding interactive content (new decks only)", false).option("--id <deckId>", "push a new version of this existing deck").option("--new", `force a NEW deck even when ${LINK_FILENAME} links one`, false).action(
     async (path, opts, cmd) => {
       const ctx = resolveContext(cmd, io);
-      requireApiKey(ctx);
+      await requireApiKey(ctx);
       const target = path ?? ".";
       const scan = await scanDeck(target);
       const entryPath = detectEntry(scan, opts.entry);
@@ -4392,7 +4643,7 @@ function registerContentCommands(program2, io) {
     `Download a deck version to a folder (id defaults to the ${LINK_FILENAME} link in the target)`
   ).option("--at <version>", "pull this version instead of the latest", (v) => parseInt(v, 10)).action(async (id, path, opts, cmd) => {
     const ctx = resolveContext(cmd, io);
-    requireApiKey(ctx);
+    await requireApiKey(ctx);
     let deckId = id ?? null;
     let dest = path ?? null;
     if (!deckId) {
@@ -4437,7 +4688,7 @@ function registerContentCommands(program2, io) {
   program2.command("pull-annotations [id]").description(`List a deck's annotations (id defaults to the ${LINK_FILENAME} link in .)`).option("--version <n>", "only notes anchored to this version", (v) => parseInt(v, 10)).option("--status <status>", "open | resolved").option("--out <file>", "write the annotations as JSON to this file").action(
     async (id, opts, cmd) => {
       const ctx = resolveContext(cmd, io);
-      requireApiKey(ctx);
+      await requireApiKey(ctx);
       let deckId = id ?? null;
       if (!deckId) {
         const link = await readLink(resolve3("."));
@@ -4550,7 +4801,7 @@ function registerSharingCommands(program2, io) {
   program2.command("share <id>").description("Create a per-recipient share link (prints the viewer URL \u2014 shown once)").option("--name <name>", "owner-facing recipient label", "cli").option("--to-version <n>", "pin the recipient to this version", (v) => parseInt(v, 10)).option("--annotator", "let the recipient annotate", false).option("--expires <datetime>", "ISO expiry, e.g. 2026-12-31T23:59:59Z").option("--password <password>", "viewer password (min 4 chars)").action(
     async (id, opts, cmd) => {
       const ctx = resolveContext(cmd, io);
-      requireApiKey(ctx);
+      await requireApiKey(ctx);
       const created = await ctx.client.createShareToken(id, shareOptionsOf(opts));
       if (ctx.json) return printJson(io, created);
       io.out.write(
@@ -4563,7 +4814,7 @@ function registerSharingCommands(program2, io) {
   );
   program2.command("unshare <id>").description("Revoke one share token (--token) or ALL active tokens of the deck").option("--token <tokenId>", "revoke only this token").action(async (id, opts, cmd) => {
     const ctx = resolveContext(cmd, io);
-    requireApiKey(ctx);
+    await requireApiKey(ctx);
     if (opts.token) {
       const revoked2 = await ctx.client.revokeShareToken(id, opts.token);
       if (ctx.json) return printJson(io, revoked2);
@@ -4592,7 +4843,7 @@ function registerSharingCommands(program2, io) {
   program2.command("share-email <id>").description("Create a personal share link per recipient and email it (one token per address)").requiredOption("--to <email...>", "recipient email(s)").option("--to-version <n>", "pin recipients to this version", (v) => parseInt(v, 10)).option("--annotator", "let recipients annotate", false).option("--expires <datetime>", "ISO expiry").option("--password <password>", "viewer password (tell recipients separately)").option("--message <text>", "personal note included in the email").action(
     async (id, opts, cmd) => {
       const ctx = resolveContext(cmd, io);
-      requireApiKey(ctx);
+      await requireApiKey(ctx);
       const results = [];
       for (const email of opts.to) {
         const created = await ctx.client.createShareToken(id, shareOptionsOf({ ...opts, name: email }));
@@ -4611,7 +4862,7 @@ function registerSharingCommands(program2, io) {
   program2.command("pin <id> <tokenId>").description("Pin a share token to a version, or set it back to following the latest").option("--to-version <n>", "freeze the recipient on this version", (v) => parseInt(v, 10)).option("--latest", "follow the latest version again", false).action(
     async (id, tokenId, opts, cmd) => {
       const ctx = resolveContext(cmd, io);
-      requireApiKey(ctx);
+      await requireApiKey(ctx);
       if (opts.latest === (opts.toVersion !== void 0)) {
         throw new CliUsageError("Pass exactly one of --to-version <n> or --latest.");
       }
@@ -4627,7 +4878,7 @@ function registerSharingCommands(program2, io) {
   );
   program2.command("invite <id>").description("Invite a dev collaborator to one deck (prints the claim link)").requiredOption("--email <email>", "invitee email").action(async (id, opts, cmd) => {
     const ctx = resolveContext(cmd, io);
-    requireApiKey(ctx);
+    await requireApiKey(ctx);
     const invited = await ctx.client.inviteCollaborator(id, { email: opts.email });
     if (ctx.json) return printJson(io, invited);
     io.out.write(
@@ -4639,7 +4890,7 @@ function registerSharingCommands(program2, io) {
   });
   program2.command("uninvite <id> <collaboratorId>").description("Revoke a collaborator grant (pending or active)").action(async (id, collaboratorId, _opts, cmd) => {
     const ctx = resolveContext(cmd, io);
-    requireApiKey(ctx);
+    await requireApiKey(ctx);
     const revoked = await ctx.client.removeCollaborator(id, collaboratorId);
     if (ctx.json) return printJson(io, revoked);
     io.out.write(`Revoked collaborator grant ${revoked.id} (${revoked.email}).
@@ -4672,7 +4923,7 @@ function registerFileCommands(program2, io) {
   });
   program2.command("export").description("Download the full workspace export as a zip (key needs data:export)").option("-o, --out <path>", "write to this path (defaults to export-<date>.zip)").action(async (opts, cmd) => {
     const ctx = resolveContext(cmd, io);
-    requireApiKey(ctx);
+    await requireApiKey(ctx);
     const res = await ctx.client.downloadExport();
     if (!res.body) {
       throw new Error("The export response carried no body");
@@ -4686,7 +4937,7 @@ function registerFileCommands(program2, io) {
   const files = program2.command("files").description("Manage workspace files");
   files.command("list").description("List files in the workspace (newest first, cursor-paginated)").option("--cursor <cursor>", "resume from a previous nextCursor").option("--limit <n>", "page size (1-100)", (v) => parseInt(v, 10)).option("--all", "follow nextCursor until every page is fetched", false).action(async (opts, cmd) => {
     const ctx = resolveContext(cmd, io);
-    requireApiKey(ctx);
+    await requireApiKey(ctx);
     const params = {};
     if (opts.cursor) params.cursor = opts.cursor;
     if (opts.limit !== void 0) params.limit = opts.limit;
@@ -4717,7 +4968,7 @@ function registerFileCommands(program2, io) {
   });
   files.command("upload <path>").description("Upload a local file").option("--name <name>", "stored file name (defaults to the local basename)").option("--content-type <type>", "content type", "application/octet-stream").action(async (path, opts, cmd) => {
     const ctx = resolveContext(cmd, io);
-    requireApiKey(ctx);
+    await requireApiKey(ctx);
     const bytes = await readFile4(path);
     const name = opts.name ?? basename2(path);
     const result = await ctx.client.uploadFile(name, new Uint8Array(bytes), opts.contentType);
@@ -4730,7 +4981,7 @@ function registerFileCommands(program2, io) {
   });
   files.command("download <id>").description("Download a file by id").option("--out <path>", "write to this path (defaults to the stored name)").action(async (id, opts, cmd) => {
     const ctx = resolveContext(cmd, io);
-    const apiKey = requireApiKey(ctx);
+    const apiKey = await requireApiKey(ctx);
     const meta = await ctx.client.file(id);
     const fetchImpl = io.fetch ?? globalThis.fetch.bind(globalThis);
     const res = await fetchImpl(ctx.client.fileContentUrl(id), {
@@ -4747,7 +4998,7 @@ function registerFileCommands(program2, io) {
   });
   files.command("rm <id>").description("Delete a file by id").action(async (id, _opts, cmd) => {
     const ctx = resolveContext(cmd, io);
-    requireApiKey(ctx);
+    await requireApiKey(ctx);
     await ctx.client.deleteFile(id);
     if (ctx.json) return printJson(io, { deleted: id });
     io.out.write(`Deleted ${id}
@@ -4833,10 +5084,13 @@ function registerCompletionCommand(program2, io) {
 }
 
 // src/index.ts
-var VERSION = "0.2.1";
+var VERSION = "0.2.2";
 function buildProgram(io) {
   const program2 = new Command();
-  program2.name("slideless").description("Command-line client for a Slideless instance (push, share, pull, preview)").version(VERSION).option("--api-url <url>", "instance base URL (or SLIDELESS_URL / profile baseUrl)").option("--url <url>", "alias of --api-url").option("--api-key <key>", "API key (or SLIDELESS_API_KEY / profile apiKey)").option("--profile <name>", "use this saved profile instead of the active one").option("--json", "machine-readable JSON output", false);
+  program2.name("slideless").description("Command-line client for a Slideless instance (push, share, pull, preview)").version(VERSION).option("--api-url <url>", "instance base URL (or SLIDELESS_URL / profile baseUrl)").option("--url <url>", "alias of --api-url").option("--api-key <key>", "API key (or SLIDELESS_API_KEY / profile apiKey)").option(
+    "--org <id>",
+    "hub org to connect as on a cloud instance (default: `antasphere org use`; ignored when a direct API key resolves)"
+  ).option("--profile <name>", "use this saved profile instead of the active one").option("--json", "machine-readable JSON output", false);
   registerAuthCommands(program2, io);
   registerDeckCommands(program2, io);
   registerContentCommands(program2, io);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antasphere/slideless",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "The Slideless CLI — push, share, pull, and preview decks on a Slideless instance",
   "license": "MIT",
   "type": "module",