@antasphere/slideless 0.2.2 → 0.2.4

package/dist/bin.js

@@ -3042,7 +3042,7 @@ var {
   Help
 } = import_index.default;
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.2.0/node_modules/@antasphere/cli-core/dist/config.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.4.0/node_modules/@antasphere/cli-core/dist/config.js
 import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 var HUB_TOOL = "hub";
@@ -3109,50 +3109,43 @@ function redactKey(key) {
     return "****";
   return `${key.slice(0, 13)}\u2026${key.slice(-4)}`;
 }
-function lookupWorkspaceKey(profile, workspaceId) {
-  if (!profile)
-    return void 0;
-  const entry = profile.workspaceKeys?.[workspaceId];
-  if (entry?.apiKey)
-    return entry.apiKey;
-  if (profile.apiKey && profile.workspaceId === workspaceId)
-    return profile.apiKey;
-  return void 0;
+function lookupConnectKey(profile, hubProfileName) {
+  return profile?.connectKeys?.[hubProfileName]?.apiKey;
 }
-function storeWorkspaceKey(env, tool, profileName, workspaceId, entry) {
+function storeConnectKey(env, tool, profileName, hubProfileName, entry) {
   const config = loadConfig(env, tool);
   const profile = config.profiles[profileName] ?? {};
   config.profiles[profileName] = {
     ...profile,
-    workspaceKeys: { ...profile.workspaceKeys, [workspaceId]: entry }
+    connectKeys: { ...profile.connectKeys, [hubProfileName]: entry }
   };
   if (!config.activeProfile)
     config.activeProfile = profileName;
   return saveConfig(env, tool, config);
 }
-function removeWorkspaceKey(env, tool, profileName, workspaceId) {
+function removeConnectKey(env, tool, profileName, hubProfileName) {
   const config = loadConfig(env, tool);
   const profile = config.profiles[profileName];
-  if (!profile?.workspaceKeys || !(workspaceId in profile.workspaceKeys))
+  if (!profile?.connectKeys || !(hubProfileName in profile.connectKeys))
     return false;
-  const { [workspaceId]: _dropped, ...rest } = profile.workspaceKeys;
+  const { [hubProfileName]: _dropped, ...rest } = profile.connectKeys;
   if (Object.keys(rest).length === 0) {
-    const { workspaceKeys: _empty, ...bare } = profile;
+    const { connectKeys: _empty, ...bare } = profile;
     config.profiles[profileName] = bare;
   } else {
-    config.profiles[profileName] = { ...profile, workspaceKeys: rest };
+    config.profiles[profileName] = { ...profile, connectKeys: rest };
   }
   saveConfig(env, tool, config);
   return true;
 }
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.2.0/node_modules/@antasphere/cli-core/dist/io.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.4.0/node_modules/@antasphere/cli-core/dist/io.js
 function printJson(io, value) {
   io.out.write(`${JSON.stringify(value, null, 2)}
 `);
 }
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.2.0/node_modules/@antasphere/cli-core/dist/resolve.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.4.0/node_modules/@antasphere/cli-core/dist/resolve.js
 var CliUsageError = class extends Error {
 };
 var DEFAULT_PROFILE = "default";
@@ -3179,7 +3172,7 @@ function resolveApiKey(opts) {
   return opts.flag ?? opts.env[opts.envVar] ?? opts.profile?.apiKey;
 }
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.2.0/node_modules/@antasphere/cli-core/dist/auth.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.4.0/node_modules/@antasphere/cli-core/dist/auth.js
 var CliAuthError = class extends Error {
   status;
   code;
@@ -3234,7 +3227,7 @@ var CliAuthClient = class {
   }
 };
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.2.0/node_modules/@antasphere/cli-core/dist/connect.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.4.0/node_modules/@antasphere/cli-core/dist/connect.js
 var CliConnectError = class extends CliAuthError {
   stage;
   constructor(stage, status, code, message, details) {
@@ -3268,19 +3261,27 @@ var CliConnectClient = class {
   toolToken(hubApiKey, body) {
     return this.call("hub", `${this.hubBaseUrl}/api/v1/sso/tool-token`, body, hubApiKey);
   }
-  /** Step 2 — the tool verifies the JWT (its only credential) and mints its key. */
-  cliConnect(token) {
-    return this.call("tool", `${this.toolBaseUrl}/api/v1/sso/cli-connect`, { token });
+  /**
+   * Step 2 — the tool verifies the JWT (its only credential) and mints its
+   * key. `hubRefreshToken` is the SAME response's offline grant, relayed so
+   * the tool can store it (a grant-less connect is refused for users with
+   * none already stored — `hub_grant_missing`).
+   */
+  cliConnect(token, hubRefreshToken) {
+    return this.call("tool", `${this.toolBaseUrl}/api/v1/sso/cli-connect`, {
+      token,
+      ...hubRefreshToken ? { hubRefreshToken } : {}
+    });
   }
-  /** The full two-call exchange. The hub key goes to the hub ONLY. */
+  /** The full two-call exchange. The hub key goes to the hub ONLY; the
+   *  offline grant goes to the TOOL only — neither is ever persisted here. */
   async exchange(hubApiKey, body) {
     const minted = await this.toolToken(hubApiKey, body);
-    const connected = await this.cliConnect(minted.token);
+    const connected = await this.cliConnect(minted.token, minted.hubRefreshToken);
     return {
       key: connected.key,
       apiKey: connected.apiKey,
       user: connected.user,
-      hubWorkspaceId: minted.workspaceId,
       toolWorkspaceId: connected.workspaceId
     };
   }
@@ -3299,16 +3300,106 @@ var CliConnectClient = class {
   }
 };
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.2.0/node_modules/@antasphere/cli-core/dist/org.js
-function getActiveWorkspace(env, opts = {}) {
-  const { profile } = resolveProfile(loadConfig(env, HUB_TOOL), opts.profile);
-  return profile?.activeWorkspaceId ?? profile?.workspaceId;
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.4.0/node_modules/@antasphere/cli-core/dist/connect-on-demand.js
+async function probeToolInstance(toolBaseUrl, fetchImpl) {
+  const f = fetchImpl ?? globalThis.fetch.bind(globalThis);
+  try {
+    const res = await f(`${toolBaseUrl.replace(/\/+$/, "")}/api/v1/instance`, {
+      method: "GET",
+      // Discovery is served cacheable for CLI/MCP clients, but the probe
+      // must see live state (mirrors the tool SDKs' discovery call).
+      cache: "no-store"
+    });
+    if (!res.ok)
+      return null;
+    const info = await res.json().catch(() => null);
+    const methods = info?.auth?.methods;
+    if (!Array.isArray(methods))
+      return null;
+    const authMethods = methods.filter((m) => typeof m === "string");
+    const edition = typeof info?.edition === "string" ? info.edition : void 0;
+    return { cloud: authMethods.includes("antasphere") || edition === "cloud", edition, authMethods };
+  } catch {
+    return null;
+  }
+}
+function activeHubProfile(env) {
+  return resolveProfile(loadConfig(env, HUB_TOOL), void 0);
+}
+function defaultMissingHubLogin(tool) {
+  const envVar = `${tool.replace(/-/g, "_").toUpperCase()}_API_KEY`;
+  return `This ${tool} instance signs in through the Antasphere hub. Run \`antasphere login\` once, then retry \u2014 or pass --api-key / set ${envVar}.`;
 }
-function resolveTargetWorkspace(env, opts = {}) {
-  return opts.override ?? getActiveWorkspace(env, opts);
+var DEFAULT_HUB_LOGIN_REJECTED = "The stored Antasphere hub credential was rejected \u2014 run `antasphere login` again, then retry.";
+function defaultConnected(facts) {
+  return `Connected to ${facts.toolBaseUrl} as ${facts.email} via Antasphere` + (facts.stored ? "" : ` \u2014 key NOT cached: profile '${facts.profileName}' points at ${facts.profileBaseUrl}`) + ".\n";
+}
+async function connectOnDemand(opts) {
+  assertToolNamespace(opts.tool);
+  const toolBaseUrl = opts.toolBaseUrl.replace(/\/+$/, "");
+  const messages = opts.messages ?? {};
+  const profileName = opts.profileName ?? DEFAULT_PROFILE;
+  const hub = activeHubProfile(opts.env);
+  const existing = loadConfig(opts.env, opts.tool).profiles[profileName];
+  const pinnedHere = existing?.baseUrl?.replace(/\/+$/, "") === toolBaseUrl;
+  if (pinnedHere && hub.name) {
+    const cachedKey = lookupConnectKey(existing, hub.name);
+    if (cachedKey)
+      return { outcome: "connected", key: cachedKey, cached: true };
+  }
+  const probe = await probeToolInstance(toolBaseUrl, opts.fetch);
+  if (!probe?.cloud)
+    return { outcome: "not_cloud" };
+  const hubKey = hub.profile?.apiKey;
+  const hubBaseUrl = hub.profile?.baseUrl;
+  if (!hubKey || !hubBaseUrl || !hub.name) {
+    throw new CliUsageError(messages.missingHubLogin ?? defaultMissingHubLogin(opts.tool));
+  }
+  const resource = opts.resource ?? `${toolBaseUrl}/mcp`;
+  const connect = new CliConnectClient({
+    hubBaseUrl,
+    toolBaseUrl,
+    ...opts.fetch ? { fetch: opts.fetch } : {}
+  });
+  const body = { resource };
+  let result;
+  try {
+    result = await connect.exchange(hubKey, body);
+  } catch (e) {
+    if (e instanceof CliConnectError && e.needsReExchange) {
+      result = await connect.exchange(hubKey, body);
+    } else if (e instanceof CliConnectError && e.needsHubLogin) {
+      throw new CliUsageError(messages.hubLoginRejected ?? DEFAULT_HUB_LOGIN_REJECTED);
+    } else {
+      throw e;
+    }
+  }
+  const stored = !existing?.baseUrl || pinnedHere;
+  if (stored) {
+    storeConnectKey(opts.env, opts.tool, profileName, hub.name, {
+      apiKey: result.key,
+      email: result.user.email,
+      mintedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    if (!existing?.baseUrl) {
+      const cfg = loadConfig(opts.env, opts.tool);
+      cfg.profiles[profileName] = { ...cfg.profiles[profileName], baseUrl: toolBaseUrl };
+      saveConfig(opts.env, opts.tool, cfg);
+    }
+  }
+  const facts = {
+    toolBaseUrl,
+    email: result.user.email,
+    stored,
+    profileName,
+    // `stored` is false only when the profile names another instance.
+    ...stored ? {} : { profileBaseUrl: existing?.baseUrl }
+  };
+  opts.notify?.((messages.connected ?? defaultConnected)(facts));
+  return { outcome: "connected", key: result.key, result, cached: false, stored };
 }
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.2.0/node_modules/@antasphere/cli-core/dist/migrate.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.4.0/node_modules/@antasphere/cli-core/dist/migrate.js
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
 import { join as join2 } from "node:path";
 function migrateLegacyConfig(env, spec) {
@@ -3426,6 +3517,14 @@ var PlatformClient = class {
   me() {
     return this.request("GET", "/me");
   }
+  /**
+   * CLOUD EDITION only (404 on oss); sessions only (machines 403): record
+   * the explicit first-run-welcome dismissal — flips /me's
+   * `firstRunPending` to false, permanently. Idempotent.
+   */
+  dismissOnboarding() {
+    return this.request("POST", "/me/onboarding/dismiss");
+  }
   /** Better Auth session probe — null when signed out. */
   async session() {
     return this.request("GET", "/auth/get-session");
@@ -3448,6 +3547,15 @@ var PlatformClient = class {
   cliAuthComplete(req) {
     return this.request("POST", "/cli/auth/complete", req);
   }
+  /**
+   * Revoke the PRESENTING API key (CLI logout). Self-revocation only: the
+   * route names no key, so the credential can kill exactly itself. Requires
+   * an API-key credential with presentations:write (sessions and OAuth
+   * bearers are refused — the dashboard is their key-management surface).
+   */
+  cliAuthRevoke() {
+    return this.request("DELETE", "/cli/auth/key");
+  }
   /**
    * Public, CLOUD EDITION only (404 on oss): exchange a hub-minted 120 s
    * connect JWT (the hub's /sso/tool-token response) for an `slk_` API key
@@ -3457,6 +3565,17 @@ var PlatformClient = class {
   ssoCliConnect(req) {
     return this.request("POST", "/sso/cli-connect", req);
   }
+  /**
+   * CLOUD EDITION only (404 on oss); sessions only (machines 403 — the
+   * path is unlisted in the scope allowlist): single logout. The server
+   * revokes the local session and clears the SSO hint cookie in this very
+   * response; `url` is the hub end-session URL the browser must then VISIT
+   * to end the hub anchor session (null = local signout only — go straight
+   * to /login?signed_out=1).
+   */
+  ssoLogout() {
+    return this.request("POST", "/sso/logout");
+  }
   // ── Members ───────────────────────────────────────────────────────────────
   members(params = {}) {
     return this.request("GET", this.pathWithQuery("/members", params));
@@ -3529,15 +3648,6 @@ var PlatformClient = class {
   acceptInvitation(req) {
     return this.request("POST", "/invitations/accept", req);
   }
-  // ── OAuth consent ─────────────────────────────────────────────────────────
-  /**
-   * Park the workspace the upcoming OAuth consent should bind (ADR 014).
-   * Sessions only; the consent page calls it right before approving when
-   * the user picked a non-default workspace.
-   */
-  oauthConsentWorkspace(workspaceId) {
-    return this.request("POST", "/oauth/consent-workspace", { workspaceId });
-  }
   // ── Audit ─────────────────────────────────────────────────────────────────
   audit(params = {}) {
     return this.request("GET", this.pathWithQuery("/audit", params));
@@ -3768,11 +3878,8 @@ function saveConfig2(env, config) {
 function clearConfig2(env) {
   clearConfig(env, TOOL);
 }
-function storeWorkspaceKey2(env, profileName, workspaceId, entry) {
-  return storeWorkspaceKey(env, TOOL, profileName, workspaceId, entry);
-}
-function removeWorkspaceKey2(env, profileName, workspaceId) {
-  return removeWorkspaceKey(env, TOOL, profileName, workspaceId);
+function removeConnectKey2(env, profileName, hubProfileName) {
+  return removeConnectKey(env, TOOL, profileName, hubProfileName);
 }
 
 // src/context.ts
@@ -3794,19 +3901,15 @@ function resolveContext(cmd, io) {
     missingMessage: "No instance configured. Pass --api-url <url>, set SLIDELESS_URL, or sign in once with `slideless auth login-request --api-url <url> --email <you>` to save a profile."
   });
   let apiKey = resolveApiKey({ flag: opts.apiKey, env: io.env, envVar: "SLIDELESS_API_KEY", profile });
-  let org;
-  if (!apiKey) {
-    org = resolveTargetWorkspace(io.env, opts.org ? { override: opts.org } : {});
-    if (org && profile?.baseUrl?.replace(/\/+$/, "") === baseUrl) {
-      apiKey = lookupWorkspaceKey(profile, org);
-    }
+  if (!apiKey && profile?.baseUrl?.replace(/\/+$/, "") === baseUrl) {
+    const hub = activeHubProfile(io.env);
+    if (hub.name) apiKey = lookupConnectKey(profile, hub.name);
   }
   const fetchImpl = io.fetch ?? globalThis.fetch.bind(globalThis);
   return {
     client: new PlatformClient({ baseUrl, ...apiKey ? { apiKey } : {}, fetch: fetchImpl }),
     baseUrl,
     apiKey,
-    org,
     json: Boolean(opts.json),
     io,
     profileName,
@@ -3814,74 +3917,28 @@ function resolveContext(cmd, io) {
   };
 }
 var NO_KEY_MESSAGE = "An API key is required. Sign in (`slideless auth login-request --email <you>`), paste one (`slideless login`), pass --api-key, or set SLIDELESS_API_KEY.";
+var MISSING_HUB_LOGIN_MESSAGE = "This Slideless instance signs in through the Antasphere hub. Run `antasphere login` once, then retry \u2014 or pass --api-key <slk_\u2026> / set SLIDELESS_API_KEY.";
 async function requireApiKey(ctx) {
   if (ctx.apiKey) return ctx.apiKey;
-  const key = await connectViaHub(ctx);
-  if (!key) throw new CliUsageError(NO_KEY_MESSAGE);
-  return key;
-}
-async function connectViaHub(ctx) {
   const { io } = ctx;
-  let cloud = false;
-  try {
-    const info = await ctx.client.instance();
-    cloud = info.auth.methods.includes("antasphere") || info.edition === "cloud";
-  } catch {
-    return void 0;
-  }
-  if (!cloud) return void 0;
-  const { profile: hubProfile } = resolveProfile(loadConfig(io.env, HUB_TOOL), void 0);
-  const hubKey = hubProfile?.apiKey;
-  const hubBaseUrl = hubProfile?.baseUrl;
-  if (!hubKey || !hubBaseUrl) {
-    throw new CliUsageError(
-      "This Slideless instance signs in through the Antasphere hub. Run `antasphere login` once, then retry \u2014 or pass --api-key <slk_\u2026> / set SLIDELESS_API_KEY."
-    );
-  }
-  const resource = `${ctx.baseUrl}/mcp`;
-  const connect = new CliConnectClient({
-    hubBaseUrl,
+  const outcome = await connectOnDemand({
+    tool: "slideless",
     toolBaseUrl: ctx.baseUrl,
-    ...io.fetch ? { fetch: io.fetch } : {}
+    ...ctx.profileName !== void 0 ? { profileName: ctx.profileName } : {},
+    env: io.env,
+    // Thread the injected fetch so the probe + exchange stay on the test
+    // harness wire (and any proxying the runner set up).
+    ...io.fetch ? { fetch: io.fetch } : {},
+    notify: (line) => io.err.write(line),
+    messages: { missingHubLogin: MISSING_HUB_LOGIN_MESSAGE }
   });
-  const body = { resource, ...ctx.org ? { workspaceId: ctx.org } : {} };
-  let result;
-  try {
-    result = await connect.exchange(hubKey, body);
-  } catch (e) {
-    if (e instanceof CliConnectError && e.needsReExchange) {
-      result = await connect.exchange(hubKey, body);
-    } else if (e instanceof CliConnectError && e.needsHubLogin) {
-      throw new CliUsageError(
-        "The stored Antasphere hub credential was rejected \u2014 run `antasphere login` again, then retry."
-      );
-    } else {
-      throw e;
-    }
-  }
-  const profileName = ctx.profileName ?? DEFAULT_PROFILE;
-  const existing = ctx.config.profiles[profileName];
-  const cacheable = !existing?.baseUrl || existing.baseUrl.replace(/\/+$/, "") === ctx.baseUrl;
-  if (cacheable) {
-    storeWorkspaceKey2(io.env, profileName, result.hubWorkspaceId, {
-      apiKey: result.key,
-      toolWorkspaceId: result.toolWorkspaceId,
-      email: result.user.email,
-      mintedAt: (/* @__PURE__ */ new Date()).toISOString()
-    });
-    if (!existing?.baseUrl) {
-      const cfg = loadConfig2(io.env);
-      cfg.profiles[profileName] = { ...cfg.profiles[profileName], baseUrl: ctx.baseUrl };
-      saveConfig2(io.env, cfg);
-    }
+  if (outcome.outcome === "not_cloud") {
+    throw new CliUsageError(NO_KEY_MESSAGE);
   }
-  io.err.write(
-    `Connected to ${ctx.baseUrl} as ${result.user.email} via Antasphere (org ${result.hubWorkspaceId})` + (cacheable ? "" : ` \u2014 key NOT cached: profile '${profileName}' points at ${existing?.baseUrl}`) + ".\n"
-  );
-  ctx.apiKey = result.key;
+  ctx.apiKey = outcome.key;
   const fetchImpl = io.fetch ?? globalThis.fetch.bind(globalThis);
-  ctx.client = new PlatformClient({ baseUrl: ctx.baseUrl, apiKey: result.key, fetch: fetchImpl });
-  return result.key;
+  ctx.client = new PlatformClient({ baseUrl: ctx.baseUrl, apiKey: outcome.key, fetch: fetchImpl });
+  return outcome.key;
 }
 function table(rows) {
   if (rows.length === 0) return "";
@@ -3917,10 +3974,26 @@ async function readLineFromStdin() {
   for await (const chunk of process.stdin) chunks.push(chunk);
   return Buffer.concat(chunks).toString("utf8").split("\n")[0]?.trim() ?? "";
 }
+async function refuseOtpLoginOnCloud(baseUrl, io) {
+  let cloud = false;
+  try {
+    const fetchImpl = io.fetch ?? globalThis.fetch.bind(globalThis);
+    const info = await new PlatformClient({ baseUrl, fetch: fetchImpl }).instance();
+    cloud = info.auth.methods.includes("antasphere") || info.edition === "cloud";
+  } catch {
+    return;
+  }
+  if (cloud) {
+    throw new CliUsageError(
+      `${baseUrl} is an Antasphere-cloud instance \u2014 it signs in at the hub, not with its own email codes. Run \`antasphere login\` once; \`slideless\` then connects automatically (or pass --api-key <slk_\u2026> / set SLIDELESS_API_KEY).`
+    );
+  }
+}
 function registerAuthCommands(program2, io) {
   const auth = program2.command("auth").description("Sign in over email OTP (mints an API key)");
   auth.command("login-request").description("Email a 6-digit sign-in code (existing accounts only \u2014 sign-up stays closed)").requiredOption("--email <email>", "account email on the instance").action(async (opts, cmd) => {
     const baseUrl = resolveAuthUrl(cmd, io);
+    await refuseOtpLoginOnCloud(baseUrl, io);
     const client = new CliAuthClient({ baseUrl, ...io.fetch ? { fetch: io.fetch } : {} });
     const result = await client.request({ email: opts.email });
     const json = Boolean(cmd.optsWithGlobals().json);
@@ -3939,6 +4012,7 @@ Complete with: slideless auth login-complete --email ${opts.email} --code <code>
     async (opts, cmd) => {
       const globals = cmd.optsWithGlobals();
       const baseUrl = resolveAuthUrl(cmd, io);
+      await refuseOtpLoginOnCloud(baseUrl, io);
       const client = new CliAuthClient({ baseUrl, ...io.fetch ? { fetch: io.fetch } : {} });
       const result = await client.complete({
         email: opts.email,
@@ -3988,7 +4062,7 @@ API key "${result.apiKey.name}" (${redactKey(result.key)}) saved to profile "${p
     );
   });
   program2.command("logout").description(
-    "Forget the stored API key of the active (or named) profile; --org logs one connected hub org out instead"
+    "Forget the stored API key of the active (or named) profile; a hub-connected profile disconnects from Antasphere (revokes + evicts the cached user-scoped key)"
   ).action(async (_opts, cmd) => {
     const globals = cmd.optsWithGlobals();
     const config2 = loadConfig2(io.env);
@@ -3997,49 +4071,46 @@ API key "${result.apiKey.name}" (${redactKey(result.key)}) saved to profile "${p
     if (!profileName || !profile) {
       throw new CliUsageError("No profile to log out of.");
     }
-    const hubKeys = profile.workspaceKeys ?? {};
-    const perOrg = globals.org !== void 0 || !profile.apiKey && Object.keys(hubKeys).length > 0;
-    if (perOrg) {
-      const org = globals.org ?? resolveTargetWorkspace(io.env, {});
-      if (!org) {
-        throw new CliUsageError(
-          "Pass --org <id> to say which hub org to log out of (or set one with `antasphere org use`)."
-        );
-      }
-      const entry = hubKeys[org];
-      if (!entry) {
-        const cached = Object.keys(hubKeys).join(", ") || "(none)";
-        throw new CliUsageError(
-          `No connected key for hub org ${org} on profile "${profileName}". Connected orgs: ${cached}.`
-        );
-      }
+    const connectKeys = profile.connectKeys ?? {};
+    const slots = Object.entries(connectKeys);
+    if (!profile.apiKey && slots.length > 0) {
       const rawUrl = profile.baseUrl;
-      let revoked = false;
-      if (rawUrl) {
-        const baseUrl = rawUrl.replace(/\/+$/, "");
-        try {
-          const client = new CliAuthClient({ baseUrl, ...io.fetch ? { fetch: io.fetch } : {} });
-          await client.revoke(entry.apiKey);
-          revoked = true;
-        } catch (e) {
-          if (e instanceof CliAuthError && e.status === 401) {
-            io.err.write("The cached key was already unusable \u2014 evicting it anyway.\n");
-          } else if (e instanceof CliAuthError && e.status === 403) {
-            io.err.write(
-              `This instance refused the self-revoke (${e.code}) \u2014 the key STAYS VALID server-side; revoke it from the dashboard. Evicting the cached copy.
+      let revoked = true;
+      for (const [slot, entry] of slots) {
+        if (rawUrl) {
+          const baseUrl = rawUrl.replace(/\/+$/, "");
+          try {
+            const client = new CliAuthClient({ baseUrl, ...io.fetch ? { fetch: io.fetch } : {} });
+            await client.revoke(entry.apiKey);
+          } catch (e) {
+            revoked = false;
+            if (e instanceof CliAuthError && e.status === 401) {
+              io.err.write("The cached key was already unusable \u2014 evicting it anyway.\n");
+            } else if (e instanceof CliAuthError && e.status === 403) {
+              io.err.write(
+                `This instance refused the self-revoke (${e.code}) \u2014 the key STAYS VALID server-side; revoke it from the dashboard. Evicting the cached copy.
 `
-            );
-          } else {
-            throw e;
+              );
+            } else {
+              throw e;
+            }
           }
+        } else {
+          revoked = false;
+          io.err.write("No instance URL known for this profile \u2014 evicting the cached key locally only.\n");
         }
-      } else {
-        io.err.write("No instance URL known for this profile \u2014 evicting the cached key locally only.\n");
+        removeConnectKey2(io.env, profileName, slot);
+      }
+      if (globals.json) {
+        return printJson(io, {
+          profile: profileName,
+          hubProfiles: slots.map(([slot]) => slot),
+          revoked,
+          evicted: true
+        });
       }
-      removeWorkspaceKey2(io.env, profileName, org);
-      if (globals.json) return printJson(io, { profile: profileName, org, revoked, evicted: true });
       io.out.write(
-        `Logged out of hub org ${org} on profile "${profileName}"${revoked ? " (key revoked server-side)" : ""}.
+        `Disconnected from Antasphere on profile "${profileName}"${revoked ? " (key revoked server-side)" : ""}.
 `
       );
       return;
@@ -4061,8 +4132,8 @@ API key "${result.apiKey.name}" (${redactKey(result.key)}) saved to profile "${p
     io.out.write(
       `${me.user.name} <${me.user.email}>
   instance:  ${ctx.baseUrl}
-  workspace: ${me.workspace.name}
-  role:      ${me.role} (via ${me.via})
+  workspace: ${me.workspace?.name ?? "(none)"}
+  role:      ${me.role ?? "(none)"} (via ${me.via})
   scopes:    ${me.scopes ? me.scopes.join(", ") : "full (session)"}
 ` + (me.via === "api_key" ? `  key expires: ${me.apiKeyExpiresAt ?? "never"}
 ` : "")
@@ -4103,7 +4174,9 @@ API key "${result.apiKey.name}" (${redactKey(result.key)}) saved to profile "${p
               {
                 baseUrl: p.baseUrl ?? null,
                 apiKey: p.apiKey ? redactKey(p.apiKey) : null,
-                hubOrgs: Object.keys(p.workspaceKeys ?? {})
+                // Hub profiles this tool profile is connected through
+                // (one user-scoped key each, valid for every org).
+                hubProfiles: Object.keys(p.connectKeys ?? {})
               }
             ];
           })
@@ -4120,12 +4193,12 @@ API key "${result.apiKey.name}" (${redactKey(result.key)}) saved to profile "${p
       table(
         names.map((n) => {
           const p = config2.profiles[n];
-          const hubOrgs = Object.keys(p.workspaceKeys ?? {});
+          const hubProfiles = Object.keys(p.connectKeys ?? {});
           return [
             config2.activeProfile === n ? "*" : " ",
             n,
             p.baseUrl ?? "(no url)",
-            p.apiKey ? redactKey(p.apiKey) : hubOrgs.length > 0 ? `(hub: ${hubOrgs.join(", ")})` : "(no key)"
+            p.apiKey ? redactKey(p.apiKey) : hubProfiles.length > 0 ? `(hub: ${hubProfiles.join(", ")})` : "(no key)"
           ];
         })
       )
@@ -4145,9 +4218,9 @@ API key "${result.apiKey.name}" (${redactKey(result.key)}) saved to profile "${p
           {
             baseUrl: p.baseUrl ?? null,
             apiKey: p.apiKey ? redactKey(p.apiKey) : null,
-            // Hub-connected orgs: cached exchange keys, redacted like the rest.
-            workspaceKeys: Object.fromEntries(
-              Object.entries(p.workspaceKeys ?? {}).map(([org, entry]) => [org, redactKey(entry.apiKey)])
+            // Hub-connected keys (one per hub profile), redacted like the rest.
+            connectKeys: Object.fromEntries(
+              Object.entries(p.connectKeys ?? {}).map(([slot, entry]) => [slot, redactKey(entry.apiKey)])
             )
           }
         ])
@@ -5084,13 +5157,10 @@ function registerCompletionCommand(program2, io) {
 }
 
 // src/index.ts
-var VERSION = "0.2.2";
+var VERSION = "0.2.4";
 function buildProgram(io) {
   const program2 = new Command();
-  program2.name("slideless").description("Command-line client for a Slideless instance (push, share, pull, preview)").version(VERSION).option("--api-url <url>", "instance base URL (or SLIDELESS_URL / profile baseUrl)").option("--url <url>", "alias of --api-url").option("--api-key <key>", "API key (or SLIDELESS_API_KEY / profile apiKey)").option(
-    "--org <id>",
-    "hub org to connect as on a cloud instance (default: `antasphere org use`; ignored when a direct API key resolves)"
-  ).option("--profile <name>", "use this saved profile instead of the active one").option("--json", "machine-readable JSON output", false);
+  program2.name("slideless").description("Command-line client for a Slideless instance (push, share, pull, preview)").version(VERSION).option("--api-url <url>", "instance base URL (or SLIDELESS_URL / profile baseUrl)").option("--url <url>", "alias of --api-url").option("--api-key <key>", "API key (or SLIDELESS_API_KEY / profile apiKey)").option("--profile <name>", "use this saved profile instead of the active one").option("--json", "machine-readable JSON output", false);
   registerAuthCommands(program2, io);
   registerDeckCommands(program2, io);
   registerContentCommands(program2, io);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antasphere/slideless",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "The Slideless CLI — push, share, pull, and preview decks on a Slideless instance",
   "license": "MIT",
   "type": "module",
@@ -30,7 +30,7 @@
     "test": "vitest run --passWithNoTests"
   },
   "devDependencies": {
-    "@antasphere/cli-core": "^0.2.0",
+    "@antasphere/cli-core": "^0.4.0",
     "@slideless/contract": "workspace:*",
     "@slideless/sdk": "workspace:*",
     "@types/node": "^22.15.0",