@antasphere/slideless 0.2.1 → 0.2.4

package/dist/bin.js

@@ -3042,7 +3042,7 @@ var {
   Help
 } = import_index.default;
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.2.0/node_modules/@antasphere/cli-core/dist/config.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.4.0/node_modules/@antasphere/cli-core/dist/config.js
 import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 var HUB_TOOL = "hub";
@@ -3109,16 +3109,46 @@ function redactKey(key) {
     return "****";
   return `${key.slice(0, 13)}\u2026${key.slice(-4)}`;
 }
+function lookupConnectKey(profile, hubProfileName) {
+  return profile?.connectKeys?.[hubProfileName]?.apiKey;
+}
+function storeConnectKey(env, tool, profileName, hubProfileName, entry) {
+  const config = loadConfig(env, tool);
+  const profile = config.profiles[profileName] ?? {};
+  config.profiles[profileName] = {
+    ...profile,
+    connectKeys: { ...profile.connectKeys, [hubProfileName]: entry }
+  };
+  if (!config.activeProfile)
+    config.activeProfile = profileName;
+  return saveConfig(env, tool, config);
+}
+function removeConnectKey(env, tool, profileName, hubProfileName) {
+  const config = loadConfig(env, tool);
+  const profile = config.profiles[profileName];
+  if (!profile?.connectKeys || !(hubProfileName in profile.connectKeys))
+    return false;
+  const { [hubProfileName]: _dropped, ...rest } = profile.connectKeys;
+  if (Object.keys(rest).length === 0) {
+    const { connectKeys: _empty, ...bare } = profile;
+    config.profiles[profileName] = bare;
+  } else {
+    config.profiles[profileName] = { ...profile, connectKeys: rest };
+  }
+  saveConfig(env, tool, config);
+  return true;
+}
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.2.0/node_modules/@antasphere/cli-core/dist/io.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.4.0/node_modules/@antasphere/cli-core/dist/io.js
 function printJson(io, value) {
   io.out.write(`${JSON.stringify(value, null, 2)}
 `);
 }
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.2.0/node_modules/@antasphere/cli-core/dist/resolve.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.4.0/node_modules/@antasphere/cli-core/dist/resolve.js
 var CliUsageError = class extends Error {
 };
+var DEFAULT_PROFILE = "default";
 function resolveProfile(config, requested, opts = {}) {
   if (requested) {
     const profile2 = config.profiles[requested];
@@ -3142,7 +3172,7 @@ function resolveApiKey(opts) {
   return opts.flag ?? opts.env[opts.envVar] ?? opts.profile?.apiKey;
 }
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.2.0/node_modules/@antasphere/cli-core/dist/auth.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.4.0/node_modules/@antasphere/cli-core/dist/auth.js
 var CliAuthError = class extends Error {
   status;
   code;
@@ -3197,7 +3227,179 @@ var CliAuthClient = class {
   }
 };
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.2.0/node_modules/@antasphere/cli-core/dist/migrate.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.4.0/node_modules/@antasphere/cli-core/dist/connect.js
+var CliConnectError = class extends CliAuthError {
+  stage;
+  constructor(stage, status, code, message, details) {
+    super(status, code, message, details);
+    this.stage = stage;
+    this.name = "CliConnectError";
+  }
+  /**
+   * The hub rejected the key itself: invalid/revoked (401), or a key
+   * minted before the `sso:exchange` scope existed (403 insufficient_scope
+   * — old keys simply lack it). The fix is a fresh `antasphere login`.
+   */
+  get needsHubLogin() {
+    return this.stage === "hub" && (this.status === 401 || this.status === 403 && this.code === "insufficient_scope");
+  }
+  /** The tool rejected the JWT (expired/replayed) — run the exchange again. */
+  get needsReExchange() {
+    return this.stage === "tool" && this.status === 401;
+  }
+};
+var CliConnectClient = class {
+  hubBaseUrl;
+  toolBaseUrl;
+  fetchImpl;
+  constructor(options) {
+    this.hubBaseUrl = options.hubBaseUrl.replace(/\/+$/, "");
+    this.toolBaseUrl = options.toolBaseUrl.replace(/\/+$/, "");
+    this.fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);
+  }
+  /** Step 1 — the hub mints the 120 s single-org JWT for the tool's resource. */
+  toolToken(hubApiKey, body) {
+    return this.call("hub", `${this.hubBaseUrl}/api/v1/sso/tool-token`, body, hubApiKey);
+  }
+  /**
+   * Step 2 — the tool verifies the JWT (its only credential) and mints its
+   * key. `hubRefreshToken` is the SAME response's offline grant, relayed so
+   * the tool can store it (a grant-less connect is refused for users with
+   * none already stored — `hub_grant_missing`).
+   */
+  cliConnect(token, hubRefreshToken) {
+    return this.call("tool", `${this.toolBaseUrl}/api/v1/sso/cli-connect`, {
+      token,
+      ...hubRefreshToken ? { hubRefreshToken } : {}
+    });
+  }
+  /** The full two-call exchange. The hub key goes to the hub ONLY; the
+   *  offline grant goes to the TOOL only — neither is ever persisted here. */
+  async exchange(hubApiKey, body) {
+    const minted = await this.toolToken(hubApiKey, body);
+    const connected = await this.cliConnect(minted.token, minted.hubRefreshToken);
+    return {
+      key: connected.key,
+      apiKey: connected.apiKey,
+      user: connected.user,
+      toolWorkspaceId: connected.workspaceId
+    };
+  }
+  /** Mirrors CliAuthClient's parse: `{ error: { code, message, details } }` envelopes. */
+  async call(stage, url, body, apiKey) {
+    const headers = { "content-type": "application/json" };
+    if (apiKey)
+      headers["authorization"] = `Bearer ${apiKey}`;
+    const res = await this.fetchImpl(url, { method: "POST", headers, body: JSON.stringify(body) });
+    const json = await res.json().catch(() => null);
+    if (!res.ok) {
+      const errBody = json ?? {};
+      throw new CliConnectError(stage, res.status, errBody.error?.code ?? "unknown_error", errBody.error?.message ?? `Request failed with ${res.status}`, errBody.error?.details);
+    }
+    return json;
+  }
+};
+
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.4.0/node_modules/@antasphere/cli-core/dist/connect-on-demand.js
+async function probeToolInstance(toolBaseUrl, fetchImpl) {
+  const f = fetchImpl ?? globalThis.fetch.bind(globalThis);
+  try {
+    const res = await f(`${toolBaseUrl.replace(/\/+$/, "")}/api/v1/instance`, {
+      method: "GET",
+      // Discovery is served cacheable for CLI/MCP clients, but the probe
+      // must see live state (mirrors the tool SDKs' discovery call).
+      cache: "no-store"
+    });
+    if (!res.ok)
+      return null;
+    const info = await res.json().catch(() => null);
+    const methods = info?.auth?.methods;
+    if (!Array.isArray(methods))
+      return null;
+    const authMethods = methods.filter((m) => typeof m === "string");
+    const edition = typeof info?.edition === "string" ? info.edition : void 0;
+    return { cloud: authMethods.includes("antasphere") || edition === "cloud", edition, authMethods };
+  } catch {
+    return null;
+  }
+}
+function activeHubProfile(env) {
+  return resolveProfile(loadConfig(env, HUB_TOOL), void 0);
+}
+function defaultMissingHubLogin(tool) {
+  const envVar = `${tool.replace(/-/g, "_").toUpperCase()}_API_KEY`;
+  return `This ${tool} instance signs in through the Antasphere hub. Run \`antasphere login\` once, then retry \u2014 or pass --api-key / set ${envVar}.`;
+}
+var DEFAULT_HUB_LOGIN_REJECTED = "The stored Antasphere hub credential was rejected \u2014 run `antasphere login` again, then retry.";
+function defaultConnected(facts) {
+  return `Connected to ${facts.toolBaseUrl} as ${facts.email} via Antasphere` + (facts.stored ? "" : ` \u2014 key NOT cached: profile '${facts.profileName}' points at ${facts.profileBaseUrl}`) + ".\n";
+}
+async function connectOnDemand(opts) {
+  assertToolNamespace(opts.tool);
+  const toolBaseUrl = opts.toolBaseUrl.replace(/\/+$/, "");
+  const messages = opts.messages ?? {};
+  const profileName = opts.profileName ?? DEFAULT_PROFILE;
+  const hub = activeHubProfile(opts.env);
+  const existing = loadConfig(opts.env, opts.tool).profiles[profileName];
+  const pinnedHere = existing?.baseUrl?.replace(/\/+$/, "") === toolBaseUrl;
+  if (pinnedHere && hub.name) {
+    const cachedKey = lookupConnectKey(existing, hub.name);
+    if (cachedKey)
+      return { outcome: "connected", key: cachedKey, cached: true };
+  }
+  const probe = await probeToolInstance(toolBaseUrl, opts.fetch);
+  if (!probe?.cloud)
+    return { outcome: "not_cloud" };
+  const hubKey = hub.profile?.apiKey;
+  const hubBaseUrl = hub.profile?.baseUrl;
+  if (!hubKey || !hubBaseUrl || !hub.name) {
+    throw new CliUsageError(messages.missingHubLogin ?? defaultMissingHubLogin(opts.tool));
+  }
+  const resource = opts.resource ?? `${toolBaseUrl}/mcp`;
+  const connect = new CliConnectClient({
+    hubBaseUrl,
+    toolBaseUrl,
+    ...opts.fetch ? { fetch: opts.fetch } : {}
+  });
+  const body = { resource };
+  let result;
+  try {
+    result = await connect.exchange(hubKey, body);
+  } catch (e) {
+    if (e instanceof CliConnectError && e.needsReExchange) {
+      result = await connect.exchange(hubKey, body);
+    } else if (e instanceof CliConnectError && e.needsHubLogin) {
+      throw new CliUsageError(messages.hubLoginRejected ?? DEFAULT_HUB_LOGIN_REJECTED);
+    } else {
+      throw e;
+    }
+  }
+  const stored = !existing?.baseUrl || pinnedHere;
+  if (stored) {
+    storeConnectKey(opts.env, opts.tool, profileName, hub.name, {
+      apiKey: result.key,
+      email: result.user.email,
+      mintedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    if (!existing?.baseUrl) {
+      const cfg = loadConfig(opts.env, opts.tool);
+      cfg.profiles[profileName] = { ...cfg.profiles[profileName], baseUrl: toolBaseUrl };
+      saveConfig(opts.env, opts.tool, cfg);
+    }
+  }
+  const facts = {
+    toolBaseUrl,
+    email: result.user.email,
+    stored,
+    profileName,
+    // `stored` is false only when the profile names another instance.
+    ...stored ? {} : { profileBaseUrl: existing?.baseUrl }
+  };
+  opts.notify?.((messages.connected ?? defaultConnected)(facts));
+  return { outcome: "connected", key: result.key, result, cached: false, stored };
+}
+
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.4.0/node_modules/@antasphere/cli-core/dist/migrate.js
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
 import { join as join2 } from "node:path";
 function migrateLegacyConfig(env, spec) {
@@ -3315,6 +3517,14 @@ var PlatformClient = class {
   me() {
     return this.request("GET", "/me");
   }
+  /**
+   * CLOUD EDITION only (404 on oss); sessions only (machines 403): record
+   * the explicit first-run-welcome dismissal — flips /me's
+   * `firstRunPending` to false, permanently. Idempotent.
+   */
+  dismissOnboarding() {
+    return this.request("POST", "/me/onboarding/dismiss");
+  }
   /** Better Auth session probe — null when signed out. */
   async session() {
     return this.request("GET", "/auth/get-session");
@@ -3337,6 +3547,15 @@ var PlatformClient = class {
   cliAuthComplete(req) {
     return this.request("POST", "/cli/auth/complete", req);
   }
+  /**
+   * Revoke the PRESENTING API key (CLI logout). Self-revocation only: the
+   * route names no key, so the credential can kill exactly itself. Requires
+   * an API-key credential with presentations:write (sessions and OAuth
+   * bearers are refused — the dashboard is their key-management surface).
+   */
+  cliAuthRevoke() {
+    return this.request("DELETE", "/cli/auth/key");
+  }
   /**
    * Public, CLOUD EDITION only (404 on oss): exchange a hub-minted 120 s
    * connect JWT (the hub's /sso/tool-token response) for an `slk_` API key
@@ -3346,6 +3565,17 @@ var PlatformClient = class {
   ssoCliConnect(req) {
     return this.request("POST", "/sso/cli-connect", req);
   }
+  /**
+   * CLOUD EDITION only (404 on oss); sessions only (machines 403 — the
+   * path is unlisted in the scope allowlist): single logout. The server
+   * revokes the local session and clears the SSO hint cookie in this very
+   * response; `url` is the hub end-session URL the browser must then VISIT
+   * to end the hub anchor session (null = local signout only — go straight
+   * to /login?signed_out=1).
+   */
+  ssoLogout() {
+    return this.request("POST", "/sso/logout");
+  }
   // ── Members ───────────────────────────────────────────────────────────────
   members(params = {}) {
     return this.request("GET", this.pathWithQuery("/members", params));
@@ -3418,15 +3648,6 @@ var PlatformClient = class {
   acceptInvitation(req) {
     return this.request("POST", "/invitations/accept", req);
   }
-  // ── OAuth consent ─────────────────────────────────────────────────────────
-  /**
-   * Park the workspace the upcoming OAuth consent should bind (ADR 014).
-   * Sessions only; the consent page calls it right before approving when
-   * the user picked a non-default workspace.
-   */
-  oauthConsentWorkspace(workspaceId) {
-    return this.request("POST", "/oauth/consent-workspace", { workspaceId });
-  }
   // ── Audit ─────────────────────────────────────────────────────────────────
   audit(params = {}) {
     return this.request("GET", this.pathWithQuery("/audit", params));
@@ -3657,6 +3878,9 @@ function saveConfig2(env, config) {
 function clearConfig2(env) {
   clearConfig(env, TOOL);
 }
+function removeConnectKey2(env, profileName, hubProfileName) {
+  return removeConnectKey(env, TOOL, profileName, hubProfileName);
+}
 
 // src/context.ts
 function resolveProfile2(config, requested) {
@@ -3676,7 +3900,11 @@ function resolveContext(cmd, io) {
     profile,
     missingMessage: "No instance configured. Pass --api-url <url>, set SLIDELESS_URL, or sign in once with `slideless auth login-request --api-url <url> --email <you>` to save a profile."
   });
-  const apiKey = resolveApiKey({ flag: opts.apiKey, env: io.env, envVar: "SLIDELESS_API_KEY", profile });
+  let apiKey = resolveApiKey({ flag: opts.apiKey, env: io.env, envVar: "SLIDELESS_API_KEY", profile });
+  if (!apiKey && profile?.baseUrl?.replace(/\/+$/, "") === baseUrl) {
+    const hub = activeHubProfile(io.env);
+    if (hub.name) apiKey = lookupConnectKey(profile, hub.name);
+  }
   const fetchImpl = io.fetch ?? globalThis.fetch.bind(globalThis);
   return {
     client: new PlatformClient({ baseUrl, ...apiKey ? { apiKey } : {}, fetch: fetchImpl }),
@@ -3688,13 +3916,29 @@ function resolveContext(cmd, io) {
     config
   };
 }
-function requireApiKey(ctx) {
-  if (!ctx.apiKey) {
-    throw new CliUsageError(
-      "An API key is required. Sign in (`slideless auth login-request --email <you>`), paste one (`slideless login`), pass --api-key, or set SLIDELESS_API_KEY."
-    );
+var NO_KEY_MESSAGE = "An API key is required. Sign in (`slideless auth login-request --email <you>`), paste one (`slideless login`), pass --api-key, or set SLIDELESS_API_KEY.";
+var MISSING_HUB_LOGIN_MESSAGE = "This Slideless instance signs in through the Antasphere hub. Run `antasphere login` once, then retry \u2014 or pass --api-key <slk_\u2026> / set SLIDELESS_API_KEY.";
+async function requireApiKey(ctx) {
+  if (ctx.apiKey) return ctx.apiKey;
+  const { io } = ctx;
+  const outcome = await connectOnDemand({
+    tool: "slideless",
+    toolBaseUrl: ctx.baseUrl,
+    ...ctx.profileName !== void 0 ? { profileName: ctx.profileName } : {},
+    env: io.env,
+    // Thread the injected fetch so the probe + exchange stay on the test
+    // harness wire (and any proxying the runner set up).
+    ...io.fetch ? { fetch: io.fetch } : {},
+    notify: (line) => io.err.write(line),
+    messages: { missingHubLogin: MISSING_HUB_LOGIN_MESSAGE }
+  });
+  if (outcome.outcome === "not_cloud") {
+    throw new CliUsageError(NO_KEY_MESSAGE);
   }
-  return ctx.apiKey;
+  ctx.apiKey = outcome.key;
+  const fetchImpl = io.fetch ?? globalThis.fetch.bind(globalThis);
+  ctx.client = new PlatformClient({ baseUrl: ctx.baseUrl, apiKey: outcome.key, fetch: fetchImpl });
+  return outcome.key;
 }
 function table(rows) {
   if (rows.length === 0) return "";
@@ -3730,10 +3974,26 @@ async function readLineFromStdin() {
   for await (const chunk of process.stdin) chunks.push(chunk);
   return Buffer.concat(chunks).toString("utf8").split("\n")[0]?.trim() ?? "";
 }
+async function refuseOtpLoginOnCloud(baseUrl, io) {
+  let cloud = false;
+  try {
+    const fetchImpl = io.fetch ?? globalThis.fetch.bind(globalThis);
+    const info = await new PlatformClient({ baseUrl, fetch: fetchImpl }).instance();
+    cloud = info.auth.methods.includes("antasphere") || info.edition === "cloud";
+  } catch {
+    return;
+  }
+  if (cloud) {
+    throw new CliUsageError(
+      `${baseUrl} is an Antasphere-cloud instance \u2014 it signs in at the hub, not with its own email codes. Run \`antasphere login\` once; \`slideless\` then connects automatically (or pass --api-key <slk_\u2026> / set SLIDELESS_API_KEY).`
+    );
+  }
+}
 function registerAuthCommands(program2, io) {
   const auth = program2.command("auth").description("Sign in over email OTP (mints an API key)");
   auth.command("login-request").description("Email a 6-digit sign-in code (existing accounts only \u2014 sign-up stays closed)").requiredOption("--email <email>", "account email on the instance").action(async (opts, cmd) => {
     const baseUrl = resolveAuthUrl(cmd, io);
+    await refuseOtpLoginOnCloud(baseUrl, io);
     const client = new CliAuthClient({ baseUrl, ...io.fetch ? { fetch: io.fetch } : {} });
     const result = await client.request({ email: opts.email });
     const json = Boolean(cmd.optsWithGlobals().json);
@@ -3752,6 +4012,7 @@ Complete with: slideless auth login-complete --email ${opts.email} --code <code>
     async (opts, cmd) => {
       const globals = cmd.optsWithGlobals();
       const baseUrl = resolveAuthUrl(cmd, io);
+      await refuseOtpLoginOnCloud(baseUrl, io);
       const client = new CliAuthClient({ baseUrl, ...io.fetch ? { fetch: io.fetch } : {} });
       const result = await client.complete({
         email: opts.email,
@@ -3800,7 +4061,9 @@ API key "${result.apiKey.name}" (${redactKey(result.key)}) saved to profile "${p
 `
     );
   });
-  program2.command("logout").description("Forget the stored API key of the active (or named) profile").action(async (_opts, cmd) => {
+  program2.command("logout").description(
+    "Forget the stored API key of the active (or named) profile; a hub-connected profile disconnects from Antasphere (revokes + evicts the cached user-scoped key)"
+  ).action(async (_opts, cmd) => {
     const globals = cmd.optsWithGlobals();
     const config2 = loadConfig2(io.env);
     const profileName = globals.profile ?? config2.activeProfile;
@@ -3808,6 +4071,50 @@ API key "${result.apiKey.name}" (${redactKey(result.key)}) saved to profile "${p
     if (!profileName || !profile) {
       throw new CliUsageError("No profile to log out of.");
     }
+    const connectKeys = profile.connectKeys ?? {};
+    const slots = Object.entries(connectKeys);
+    if (!profile.apiKey && slots.length > 0) {
+      const rawUrl = profile.baseUrl;
+      let revoked = true;
+      for (const [slot, entry] of slots) {
+        if (rawUrl) {
+          const baseUrl = rawUrl.replace(/\/+$/, "");
+          try {
+            const client = new CliAuthClient({ baseUrl, ...io.fetch ? { fetch: io.fetch } : {} });
+            await client.revoke(entry.apiKey);
+          } catch (e) {
+            revoked = false;
+            if (e instanceof CliAuthError && e.status === 401) {
+              io.err.write("The cached key was already unusable \u2014 evicting it anyway.\n");
+            } else if (e instanceof CliAuthError && e.status === 403) {
+              io.err.write(
+                `This instance refused the self-revoke (${e.code}) \u2014 the key STAYS VALID server-side; revoke it from the dashboard. Evicting the cached copy.
+`
+              );
+            } else {
+              throw e;
+            }
+          }
+        } else {
+          revoked = false;
+          io.err.write("No instance URL known for this profile \u2014 evicting the cached key locally only.\n");
+        }
+        removeConnectKey2(io.env, profileName, slot);
+      }
+      if (globals.json) {
+        return printJson(io, {
+          profile: profileName,
+          hubProfiles: slots.map(([slot]) => slot),
+          revoked,
+          evicted: true
+        });
+      }
+      io.out.write(
+        `Disconnected from Antasphere on profile "${profileName}"${revoked ? " (key revoked server-side)" : ""}.
+`
+      );
+      return;
+    }
     delete profile.apiKey;
     if (!profile.baseUrl) delete config2.profiles[profileName];
     saveConfig2(io.env, config2);
@@ -3819,14 +4126,14 @@ API key "${result.apiKey.name}" (${redactKey(result.key)}) saved to profile "${p
   });
   program2.command("whoami").description("Show the identity behind the resolved API key").action(async (_opts, cmd) => {
     const ctx = resolveContext(cmd, io);
-    requireApiKey(ctx);
+    await requireApiKey(ctx);
     const me = await ctx.client.me();
     if (ctx.json) return printJson(io, me);
     io.out.write(
       `${me.user.name} <${me.user.email}>
   instance:  ${ctx.baseUrl}
-  workspace: ${me.workspace.name}
-  role:      ${me.role} (via ${me.via})
+  workspace: ${me.workspace?.name ?? "(none)"}
+  role:      ${me.role ?? "(none)"} (via ${me.via})
   scopes:    ${me.scopes ? me.scopes.join(", ") : "full (session)"}
 ` + (me.via === "api_key" ? `  key expires: ${me.apiKeyExpiresAt ?? "never"}
 ` : "")
@@ -3834,7 +4141,7 @@ API key "${result.apiKey.name}" (${redactKey(result.key)}) saved to profile "${p
   });
   program2.command("verify").description("Check that the resolved instance + key work (exit 0 = ok)").action(async (_opts, cmd) => {
     const ctx = resolveContext(cmd, io);
-    requireApiKey(ctx);
+    await requireApiKey(ctx);
     const me = await ctx.client.me();
     if (ctx.json) return printJson(io, { ok: true, baseUrl: ctx.baseUrl, user: me.user });
     io.out.write(`ok \u2014 ${me.user.email} (${me.role}) @ ${ctx.baseUrl}
@@ -3862,7 +4169,16 @@ API key "${result.apiKey.name}" (${redactKey(result.key)}) saved to profile "${p
         profiles: Object.fromEntries(
           names.map((n) => {
             const p = config2.profiles[n];
-            return [n, { baseUrl: p.baseUrl ?? null, apiKey: p.apiKey ? redactKey(p.apiKey) : null }];
+            return [
+              n,
+              {
+                baseUrl: p.baseUrl ?? null,
+                apiKey: p.apiKey ? redactKey(p.apiKey) : null,
+                // Hub profiles this tool profile is connected through
+                // (one user-scoped key each, valid for every org).
+                hubProfiles: Object.keys(p.connectKeys ?? {})
+              }
+            ];
           })
         )
       });
@@ -3877,11 +4193,12 @@ API key "${result.apiKey.name}" (${redactKey(result.key)}) saved to profile "${p
       table(
         names.map((n) => {
           const p = config2.profiles[n];
+          const hubProfiles = Object.keys(p.connectKeys ?? {});
           return [
             config2.activeProfile === n ? "*" : " ",
             n,
             p.baseUrl ?? "(no url)",
-            p.apiKey ? redactKey(p.apiKey) : "(no key)"
+            p.apiKey ? redactKey(p.apiKey) : hubProfiles.length > 0 ? `(hub: ${hubProfiles.join(", ")})` : "(no key)"
           ];
         })
       )
@@ -3898,7 +4215,14 @@ API key "${result.apiKey.name}" (${redactKey(result.key)}) saved to profile "${p
       profiles: Object.fromEntries(
         Object.entries(cfg.profiles).map(([n, p]) => [
           n,
-          { baseUrl: p.baseUrl ?? null, apiKey: p.apiKey ? redactKey(p.apiKey) : null }
+          {
+            baseUrl: p.baseUrl ?? null,
+            apiKey: p.apiKey ? redactKey(p.apiKey) : null,
+            // Hub-connected keys (one per hub profile), redacted like the rest.
+            connectKeys: Object.fromEntries(
+              Object.entries(p.connectKeys ?? {}).map(([slot, entry]) => [slot, redactKey(entry.apiKey)])
+            )
+          }
         ])
       )
     };
@@ -3920,7 +4244,7 @@ API key "${result.apiKey.name}" (${redactKey(result.key)}) saved to profile "${p
 function registerDeckCommands(program2, io) {
   program2.command("list").description("List presentations (newest first, cursor-paginated)").option("--cursor <cursor>", "resume from a previous nextCursor").option("--limit <n>", "page size (1-100)", (v) => parseInt(v, 10)).option("--all", "follow nextCursor until every page is fetched", false).action(async (opts, cmd) => {
     const ctx = resolveContext(cmd, io);
-    requireApiKey(ctx);
+    await requireApiKey(ctx);
     const params = {};
     if (opts.cursor) params.cursor = opts.cursor;
     if (opts.limit !== void 0) params.limit = opts.limit;
@@ -3948,7 +4272,7 @@ function registerDeckCommands(program2, io) {
   });
   program2.command("get <id>").description("Show one presentation (metadata + latest version)").action(async (id, _opts, cmd) => {
     const ctx = resolveContext(cmd, io);
-    requireApiKey(ctx);
+    await requireApiKey(ctx);
     const deck = await ctx.client.presentation(id);
     if (ctx.json) return printJson(io, deck);
     io.out.write(
@@ -3965,7 +4289,7 @@ function registerDeckCommands(program2, io) {
   });
   program2.command("delete <id>").description("Delete a presentation (soft delete; versions and share links stop resolving)").action(async (id, _opts, cmd) => {
     const ctx = resolveContext(cmd, io);
-    requireApiKey(ctx);
+    await requireApiKey(ctx);
     const deck = await ctx.client.deletePresentation(id);
     if (ctx.json) return printJson(io, deck);
     io.out.write(`Deleted "${deck.title}" (${deck.id}).
@@ -4316,7 +4640,7 @@ function registerContentCommands(program2, io) {
   ).option("--title <title>", "deck title (default: existing title, or the folder name)").option("--entry <path>", "entry document (default: index.html, or the only .html)").option("--kind <kind>", "presentation | app | plan (new decks only)", "presentation").option("--interactive", "mark the deck as embedding interactive content (new decks only)", false).option("--id <deckId>", "push a new version of this existing deck").option("--new", `force a NEW deck even when ${LINK_FILENAME} links one`, false).action(
     async (path, opts, cmd) => {
       const ctx = resolveContext(cmd, io);
-      requireApiKey(ctx);
+      await requireApiKey(ctx);
       const target = path ?? ".";
       const scan = await scanDeck(target);
       const entryPath = detectEntry(scan, opts.entry);
@@ -4392,7 +4716,7 @@ function registerContentCommands(program2, io) {
     `Download a deck version to a folder (id defaults to the ${LINK_FILENAME} link in the target)`
   ).option("--at <version>", "pull this version instead of the latest", (v) => parseInt(v, 10)).action(async (id, path, opts, cmd) => {
     const ctx = resolveContext(cmd, io);
-    requireApiKey(ctx);
+    await requireApiKey(ctx);
     let deckId = id ?? null;
     let dest = path ?? null;
     if (!deckId) {
@@ -4437,7 +4761,7 @@ function registerContentCommands(program2, io) {
   program2.command("pull-annotations [id]").description(`List a deck's annotations (id defaults to the ${LINK_FILENAME} link in .)`).option("--version <n>", "only notes anchored to this version", (v) => parseInt(v, 10)).option("--status <status>", "open | resolved").option("--out <file>", "write the annotations as JSON to this file").action(
     async (id, opts, cmd) => {
       const ctx = resolveContext(cmd, io);
-      requireApiKey(ctx);
+      await requireApiKey(ctx);
       let deckId = id ?? null;
       if (!deckId) {
         const link = await readLink(resolve3("."));
@@ -4550,7 +4874,7 @@ function registerSharingCommands(program2, io) {
   program2.command("share <id>").description("Create a per-recipient share link (prints the viewer URL \u2014 shown once)").option("--name <name>", "owner-facing recipient label", "cli").option("--to-version <n>", "pin the recipient to this version", (v) => parseInt(v, 10)).option("--annotator", "let the recipient annotate", false).option("--expires <datetime>", "ISO expiry, e.g. 2026-12-31T23:59:59Z").option("--password <password>", "viewer password (min 4 chars)").action(
     async (id, opts, cmd) => {
       const ctx = resolveContext(cmd, io);
-      requireApiKey(ctx);
+      await requireApiKey(ctx);
       const created = await ctx.client.createShareToken(id, shareOptionsOf(opts));
       if (ctx.json) return printJson(io, created);
       io.out.write(
@@ -4563,7 +4887,7 @@ function registerSharingCommands(program2, io) {
   );
   program2.command("unshare <id>").description("Revoke one share token (--token) or ALL active tokens of the deck").option("--token <tokenId>", "revoke only this token").action(async (id, opts, cmd) => {
     const ctx = resolveContext(cmd, io);
-    requireApiKey(ctx);
+    await requireApiKey(ctx);
     if (opts.token) {
       const revoked2 = await ctx.client.revokeShareToken(id, opts.token);
       if (ctx.json) return printJson(io, revoked2);
@@ -4592,7 +4916,7 @@ function registerSharingCommands(program2, io) {
   program2.command("share-email <id>").description("Create a personal share link per recipient and email it (one token per address)").requiredOption("--to <email...>", "recipient email(s)").option("--to-version <n>", "pin recipients to this version", (v) => parseInt(v, 10)).option("--annotator", "let recipients annotate", false).option("--expires <datetime>", "ISO expiry").option("--password <password>", "viewer password (tell recipients separately)").option("--message <text>", "personal note included in the email").action(
     async (id, opts, cmd) => {
       const ctx = resolveContext(cmd, io);
-      requireApiKey(ctx);
+      await requireApiKey(ctx);
       const results = [];
       for (const email of opts.to) {
         const created = await ctx.client.createShareToken(id, shareOptionsOf({ ...opts, name: email }));
@@ -4611,7 +4935,7 @@ function registerSharingCommands(program2, io) {
   program2.command("pin <id> <tokenId>").description("Pin a share token to a version, or set it back to following the latest").option("--to-version <n>", "freeze the recipient on this version", (v) => parseInt(v, 10)).option("--latest", "follow the latest version again", false).action(
     async (id, tokenId, opts, cmd) => {
       const ctx = resolveContext(cmd, io);
-      requireApiKey(ctx);
+      await requireApiKey(ctx);
       if (opts.latest === (opts.toVersion !== void 0)) {
         throw new CliUsageError("Pass exactly one of --to-version <n> or --latest.");
       }
@@ -4627,7 +4951,7 @@ function registerSharingCommands(program2, io) {
   );
   program2.command("invite <id>").description("Invite a dev collaborator to one deck (prints the claim link)").requiredOption("--email <email>", "invitee email").action(async (id, opts, cmd) => {
     const ctx = resolveContext(cmd, io);
-    requireApiKey(ctx);
+    await requireApiKey(ctx);
     const invited = await ctx.client.inviteCollaborator(id, { email: opts.email });
     if (ctx.json) return printJson(io, invited);
     io.out.write(
@@ -4639,7 +4963,7 @@ function registerSharingCommands(program2, io) {
   });
   program2.command("uninvite <id> <collaboratorId>").description("Revoke a collaborator grant (pending or active)").action(async (id, collaboratorId, _opts, cmd) => {
     const ctx = resolveContext(cmd, io);
-    requireApiKey(ctx);
+    await requireApiKey(ctx);
     const revoked = await ctx.client.removeCollaborator(id, collaboratorId);
     if (ctx.json) return printJson(io, revoked);
     io.out.write(`Revoked collaborator grant ${revoked.id} (${revoked.email}).
@@ -4672,7 +4996,7 @@ function registerFileCommands(program2, io) {
   });
   program2.command("export").description("Download the full workspace export as a zip (key needs data:export)").option("-o, --out <path>", "write to this path (defaults to export-<date>.zip)").action(async (opts, cmd) => {
     const ctx = resolveContext(cmd, io);
-    requireApiKey(ctx);
+    await requireApiKey(ctx);
     const res = await ctx.client.downloadExport();
     if (!res.body) {
       throw new Error("The export response carried no body");
@@ -4686,7 +5010,7 @@ function registerFileCommands(program2, io) {
   const files = program2.command("files").description("Manage workspace files");
   files.command("list").description("List files in the workspace (newest first, cursor-paginated)").option("--cursor <cursor>", "resume from a previous nextCursor").option("--limit <n>", "page size (1-100)", (v) => parseInt(v, 10)).option("--all", "follow nextCursor until every page is fetched", false).action(async (opts, cmd) => {
     const ctx = resolveContext(cmd, io);
-    requireApiKey(ctx);
+    await requireApiKey(ctx);
     const params = {};
     if (opts.cursor) params.cursor = opts.cursor;
     if (opts.limit !== void 0) params.limit = opts.limit;
@@ -4717,7 +5041,7 @@ function registerFileCommands(program2, io) {
   });
   files.command("upload <path>").description("Upload a local file").option("--name <name>", "stored file name (defaults to the local basename)").option("--content-type <type>", "content type", "application/octet-stream").action(async (path, opts, cmd) => {
     const ctx = resolveContext(cmd, io);
-    requireApiKey(ctx);
+    await requireApiKey(ctx);
     const bytes = await readFile4(path);
     const name = opts.name ?? basename2(path);
     const result = await ctx.client.uploadFile(name, new Uint8Array(bytes), opts.contentType);
@@ -4730,7 +5054,7 @@ function registerFileCommands(program2, io) {
   });
   files.command("download <id>").description("Download a file by id").option("--out <path>", "write to this path (defaults to the stored name)").action(async (id, opts, cmd) => {
     const ctx = resolveContext(cmd, io);
-    const apiKey = requireApiKey(ctx);
+    const apiKey = await requireApiKey(ctx);
     const meta = await ctx.client.file(id);
     const fetchImpl = io.fetch ?? globalThis.fetch.bind(globalThis);
     const res = await fetchImpl(ctx.client.fileContentUrl(id), {
@@ -4747,7 +5071,7 @@ function registerFileCommands(program2, io) {
   });
   files.command("rm <id>").description("Delete a file by id").action(async (id, _opts, cmd) => {
     const ctx = resolveContext(cmd, io);
-    requireApiKey(ctx);
+    await requireApiKey(ctx);
     await ctx.client.deleteFile(id);
     if (ctx.json) return printJson(io, { deleted: id });
     io.out.write(`Deleted ${id}
@@ -4833,7 +5157,7 @@ function registerCompletionCommand(program2, io) {
 }
 
 // src/index.ts
-var VERSION = "0.2.1";
+var VERSION = "0.2.4";
 function buildProgram(io) {
   const program2 = new Command();
   program2.name("slideless").description("Command-line client for a Slideless instance (push, share, pull, preview)").version(VERSION).option("--api-url <url>", "instance base URL (or SLIDELESS_URL / profile baseUrl)").option("--url <url>", "alias of --api-url").option("--api-key <key>", "API key (or SLIDELESS_API_KEY / profile apiKey)").option("--profile <name>", "use this saved profile instead of the active one").option("--json", "machine-readable JSON output", false);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antasphere/slideless",
-  "version": "0.2.1",
+  "version": "0.2.4",
   "description": "The Slideless CLI — push, share, pull, and preview decks on a Slideless instance",
   "license": "MIT",
   "type": "module",
@@ -30,7 +30,7 @@
     "test": "vitest run --passWithNoTests"
   },
   "devDependencies": {
-    "@antasphere/cli-core": "^0.2.0",
+    "@antasphere/cli-core": "^0.4.0",
     "@slideless/contract": "workspace:*",
     "@slideless/sdk": "workspace:*",
     "@types/node": "^22.15.0",