@assethub/cli 0.1.20 → 0.1.21

package/README.md

@@ -4,7 +4,7 @@ Command line interface for AssetHub.
 
 ## Personal API keys
 
-Log in once with a personal key (`ah_pat_`), then select its workspace:
+Log in once with a personal key, then select its workspace:
 
 ```sh
 assethub auth login --api-key-stdin --profile personal
@@ -19,6 +19,13 @@ Login verifies account identity through workspace discovery, including when
 in the same profile with the same key. It does not issue keys or change browser
 sessions. Pass `--cursor <nextCursor>` for another workspace list page.
 
+CLI 0.1.21 also discovers existing `sk_` keys enabled for personal access by the
+server. Run `workspace list --profile <saved-profile>` to discover a saved key
+without logging in again. Verified personal identity is saved in that profile;
+workspace selection keeps its original key. The `assethub-UUID` format is not
+eligible for this discovery. Unregistered workspace keys retain the existing
+user-token flow; rejected personal keys never fall back to another identity.
+
 `--workspace` overrides the saved selection for one command, including diagnostics,
 MCP discovery, history, and run recovery. Recovery still rejects an operation saved
 in another workspace. Personal profiles take precedence over environment API

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AA4BA,OAAO,EAIL,KAAK,wBAAwB,EAO7B,KAAK,YAAY,EAEjB,KAAK,UAAU,EAgBhB,MAAM,sBAAsB,CAAA;AAc7B,OAAO,EAAC,kBAAkB,EAAc,MAAM,gCAAgC,CAAA;AAI9E,KAAK,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC,CAAA;AAyJxD,eAAO,MAAM,KAAK,s3aAkIjB,CAAA;AA8pFD;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,GACxC,OAAO,KAAK,KACX,wBA0BF,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAChC,OAAO,KAAK,KACX,IAAI,CAAC,UAAU,EAAE,QAAQ,CAM1B,CAAA;AA6fF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,uBAAuB,GAClC,MAAM,SAAS,MAAM,EAAE,KACtB,YAAY,EAuGd,CAAA;AAgsCD,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5B,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,MAAM,EAAE,OAAO,CAAA;IACf,YAAY,EAAE,OAAO,CAAA;CACtB,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC9B,YAAY,MAAM,GAAG,SAAS,EAC9B,aAAa,MAAM,EAAE,EACrB,OAAO,KAAK,KACX,cAoBF,CAAA;AAED,KAAK,iBAAiB,GAAG,IAAI,CAC3B,OAAO,CAAC,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC,EAC5C,SAAS,GACT,UAAU,GACV,KAAK,GACL,WAAW,GACX,QAAQ,GACR,OAAO,GACP,OAAO,GACP,UAAU,CACb,CAAA;AAED,eAAO,MAAM,iBAAiB,GAC5B,WAAW,MAAM,EACjB,MAAM,iBAAiB;;;;;;;;;;;;;;CAUvB,CAAA;AAEF,eAAO,MAAM,sBAAsB,GACjC,SAAS,UAAU,CAAC,OAAO,iBAAiB,CAAC,EAC7C,MAAM,iBAAiB,EACvB,SAAS,MAAM;;;;;;;;;;;;;;;;;;;;;;;CAYf,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AA4BA,OAAO,EAIL,KAAK,wBAAwB,EAO7B,KAAK,YAAY,EAEjB,KAAK,UAAU,EAgBhB,MAAM,sBAAsB,CAAA;AAc7B,OAAO,EAAC,kBAAkB,EAAc,MAAM,gCAAgC,CAAA;AAI9E,KAAK,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC,CAAA;AA2JxD,eAAO,MAAM,KAAK,s3aAkIjB,CAAA;AA4sFD;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,GACxC,OAAO,KAAK,KACX,wBA0BF,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAChC,OAAO,KAAK,KACX,IAAI,CAAC,UAAU,EAAE,QAAQ,CAM1B,CAAA;AA6fF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,uBAAuB,GAClC,MAAM,SAAS,MAAM,EAAE,KACtB,YAAY,EAuGd,CAAA;AAgsCD,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5B,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,MAAM,EAAE,OAAO,CAAA;IACf,YAAY,EAAE,OAAO,CAAA;CACtB,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC9B,YAAY,MAAM,GAAG,SAAS,EAC9B,aAAa,MAAM,EAAE,EACrB,OAAO,KAAK,KACX,cAoBF,CAAA;AAED,KAAK,iBAAiB,GAAG,IAAI,CAC3B,OAAO,CAAC,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC,EAC5C,SAAS,GACT,UAAU,GACV,KAAK,GACL,WAAW,GACX,QAAQ,GACR,OAAO,GACP,OAAO,GACP,UAAU,CACb,CAAA;AAED,eAAO,MAAM,iBAAiB,GAC5B,WAAW,MAAM,EACjB,MAAM,iBAAiB;;;;;;;;;;;;;;CAUvB,CAAA;AAEF,eAAO,MAAM,sBAAsB,GACjC,SAAS,UAAU,CAAC,OAAO,iBAAiB,CAAC,EAC7C,MAAM,iBAAiB,EACvB,SAAS,MAAM;;;;;;;;;;;;;;;;;;;;;;;CAYf,CAAA"}

package/dist/index.js

@@ -444,6 +444,39 @@ const readStdinBlob = async (type) => await new Promise((resolve, reject) => {
     });
     stdin.on('error', reject);
 });
+const isPersonalProfile = (profile) => profile?.authentication === 'personal' || Boolean(profile?.apiKey?.startsWith('ah_pat_'));
+const personalProfileAuthentication = (apiKey, baseUrl, profile) => profile?.apiKey === apiKey && new URL(profile.baseUrl).origin === new URL(baseUrl).origin
+    ? profile.authentication : undefined;
+const canDiscoverPersonalKey = (key) => Boolean(key && (key.startsWith('ah_pat_') || /^sk_[a-f0-9]{64}$/i.test(key)));
+const preferredApiKey = (flags, stored) => getFlag(flags, 'api-key') ??
+    (hasFlag(flags, 'profile') || stored?.workspaceId || isPersonalProfile(stored)
+        ? stored?.apiKey
+        : env.ASSETHUB_API_KEY?.trim() || stored?.apiKey);
+const personalAccount = async (auth) => {
+    const knownPersonal = isPersonalProfile(auth);
+    if (!knownPersonal && !canDiscoverPersonalKey(auth.apiKey))
+        return undefined;
+    try {
+        const account = await createWorkspaceClient({ accessToken: auth.apiKey, baseUrl: auth.baseUrl, workspaceId: auth.workspaceId }).list();
+        if (account.authentication !== 'personal')
+            throw new Error('Workspace API did not verify personal authentication');
+        return account;
+    }
+    catch (error) {
+        if (!knownPersonal && error instanceof WorkspaceClientError && error.status === 401 && error.code === 'PERSONAL_KEY_NOT_REGISTERED')
+            return undefined;
+        throw error;
+    }
+};
+const rememberPersonalProfile = async (auth, configPath, config, userId) => {
+    if (auth.source !== 'profile')
+        return;
+    config.profiles = { ...config.profiles, [auth.profile]: {
+            apiKey: auth.apiKey, authentication: 'personal', userId,
+            workspaceId: config.profiles?.[auth.profile]?.workspaceId, baseUrl: auth.baseUrl, updatedAt: new Date().toISOString(),
+        } };
+    await writeAuthConfig(configPath, config);
+};
 const resolveAuth = async (flags) => {
     const explicitProfile = hasFlag(flags, 'profile') ? requireFlag(flags, 'profile') : undefined;
     const overrideKey = hasFlag(flags, 'api-key') ? requireFlag(flags, 'api-key') : undefined;
@@ -452,7 +485,7 @@ const resolveAuth = async (flags) => {
         : undefined;
     const profile = explicitProfile ?? config?.defaultProfile ?? defaultProfileName;
     const storedProfile = config?.profiles?.[profile];
-    const selected = Boolean(explicitProfile || storedProfile?.workspaceId || storedProfile?.apiKey?.startsWith('ah_pat_'));
+    const selected = Boolean(explicitProfile || storedProfile?.workspaceId || isPersonalProfile(storedProfile));
     if (selected && (!storedProfile || (!storedProfile.apiKey && !overrideKey)))
         throw new Error('Selected profile has no workspace API key. Use workspace use <id> or auth login --api-key-stdin --profile <name>.');
     const baseUrl = getFlag(flags, 'base-url') ??
@@ -462,15 +495,18 @@ const resolveAuth = async (flags) => {
     if (overrideKey)
         return { apiKey: overrideKey, baseUrl, profile, source: 'flag', workspaceId: getFlag(flags, 'workspace') };
     if (selected && storedProfile?.apiKey) {
-        if ((storedProfile.workspaceId || storedProfile.apiKey.startsWith('ah_pat_')) &&
+        if ((storedProfile.workspaceId || isPersonalProfile(storedProfile) || canDiscoverPersonalKey(storedProfile.apiKey)) &&
             new URL(baseUrl).origin !== new URL(storedProfile.baseUrl).origin)
             throw new Error('Selected workspace belongs to another API origin; select a workspace for this origin or supply an explicit API key');
-        return { apiKey: storedProfile.apiKey, baseUrl, profile, source: 'profile', workspaceId: getFlag(flags, 'workspace') ?? storedProfile.workspaceId };
+        return { apiKey: storedProfile.apiKey, authentication: storedProfile.authentication, baseUrl, profile, source: 'profile', workspaceId: getFlag(flags, 'workspace') ?? storedProfile.workspaceId };
     }
     if (env.ASSETHUB_API_KEY?.trim())
         return { apiKey: env.ASSETHUB_API_KEY, baseUrl, profile, source: 'env', workspaceId: getFlag(flags, 'workspace') };
-    if (storedProfile?.apiKey)
+    if (storedProfile?.apiKey) {
+        if (canDiscoverPersonalKey(storedProfile.apiKey) && new URL(baseUrl).origin !== new URL(storedProfile.baseUrl).origin)
+            throw new Error('Saved API key belongs to another API origin; supply an explicit API key for this origin');
         return { apiKey: storedProfile.apiKey, baseUrl, profile, source: 'profile', workspaceId: getFlag(flags, 'workspace') ?? storedProfile.workspaceId };
+    }
     throw new Error('Missing workspace API key. Use "workspace use <id>" after user login, "auth login --api-key-stdin", or ASSETHUB_API_KEY.');
 };
 const createContext = async (flags, args) => {
@@ -1268,18 +1304,22 @@ const workspaceAuth = async (flags, allowPersonal = false) => {
     const explicitProfile = hasFlag(flags, 'profile') ? requireFlag(flags, 'profile') : undefined;
     const profile = explicitProfile ?? config.defaultProfile ?? defaultProfileName;
     const stored = config.profiles?.[profile];
-    const preferredKey = getFlag(flags, 'api-key') ??
-        (explicitProfile || stored?.workspaceId || stored?.apiKey?.startsWith('ah_pat_')
-            ? stored?.apiKey
-            : env.ASSETHUB_API_KEY?.trim() || stored?.apiKey);
-    if (allowPersonal && preferredKey?.startsWith('ah_pat_')) {
+    const preferredKey = preferredApiKey(flags, stored);
+    if (allowPersonal && (canDiscoverPersonalKey(preferredKey) || (preferredKey === stored?.apiKey && isPersonalProfile(stored)))) {
         const auth = await resolveAuth(flags);
-        return {
-            configPath, config, profile, accessToken: auth.apiKey,
-            workspaceMfaToken: undefined, baseUrl: auth.baseUrl,
-            selectedWorkspaceId: auth.workspaceId, personal: true,
-            client: createWorkspaceClient({ accessToken: auth.apiKey, baseUrl: auth.baseUrl, workspaceId: auth.workspaceId }),
-        };
+        auth.authentication = personalProfileAuthentication(auth.apiKey, auth.baseUrl, stored);
+        const knownPersonal = isPersonalProfile(auth);
+        const account = knownPersonal ? undefined : await personalAccount(auth);
+        if (knownPersonal || account) {
+            if (account)
+                await rememberPersonalProfile(auth, configPath, config, account.userId);
+            return {
+                configPath, config, profile, accessToken: auth.apiKey,
+                workspaceMfaToken: undefined, baseUrl: auth.baseUrl,
+                selectedWorkspaceId: auth.workspaceId, personal: true,
+                client: createWorkspaceClient({ accessToken: auth.apiKey, baseUrl: auth.baseUrl, workspaceId: auth.workspaceId }),
+            };
+        }
     }
     const environmentToken = explicitProfile ? undefined : env.ASSETHUB_ACCESS_TOKEN?.trim();
     const accessToken = environmentToken || stored?.accessToken;
@@ -1392,6 +1432,7 @@ const commandWorkspace = async (subcommand, positionals, flags) => {
             throw new Error('Workspace API did not verify personal authentication');
         profiles[auth.profile] = {
             apiKey: auth.accessToken,
+            authentication: 'personal',
             userId: account.userId,
             workspaceId,
             baseUrl: auth.baseUrl,
@@ -1404,7 +1445,7 @@ const commandWorkspace = async (subcommand, positionals, flags) => {
     const cached = Object.entries(profiles).find(([, entry]) => entry.userId === account.userId &&
         entry.workspaceId === workspaceId &&
         new URL(entry.baseUrl).origin === new URL(auth.baseUrl).origin &&
-        entry.apiKey && !entry.apiKey.startsWith('ah_pat_'));
+        entry.apiKey && !isPersonalProfile(entry));
     let apiKey;
     for (const candidate of new Set([cached?.[1].apiKey, suppliedKey])) {
         if (!candidate)
@@ -1507,22 +1548,19 @@ const commandAuth = async (subcommand, flags) => {
             throw new Error('API key is empty. Pass --api-key, use --api-key-stdin, or set ASSETHUB_API_KEY.');
         }
         const baseUrl = getFlag(flags, 'base-url') ?? env.ASSETHUB_API_BASE_URL ?? defaultBaseUrl;
-        const personal = apiKey.startsWith('ah_pat_');
-        const account = personal
-            ? await createWorkspaceClient({ accessToken: apiKey, baseUrl }).list()
-            : undefined;
-        if (personal && account?.authentication !== 'personal')
-            throw new Error('Workspace API did not verify personal authentication');
+        const config = await readAuthConfig(configPath);
+        const authentication = personalProfileAuthentication(apiKey, baseUrl, config.profiles?.[profile]);
+        const account = await personalAccount({ apiKey, baseUrl, authentication });
+        const personal = account !== undefined;
         if (!personal && !hasFlag(flags, 'skip-verify')) {
             const client = createAssetHubClient({ apiKey, baseUrl });
             await client.v2.listModels();
         }
-        const config = await readAuthConfig(configPath);
         const profiles = config.profiles ?? {};
         profiles[profile] = {
             apiKey,
             baseUrl,
-            ...(account ? { userId: account.userId } : {}),
+            ...(account ? { authentication: 'personal', userId: account.userId } : {}),
             updatedAt: new Date().toISOString(),
         };
         await writeAuthConfig(configPath, {
@@ -1543,9 +1581,22 @@ const commandAuth = async (subcommand, flags) => {
     if (subcommand === 'status') {
         const config = await readAuthConfig(configPath);
         const current = config.profiles?.[getFlag(flags, 'profile') ?? config.defaultProfile ?? profile];
+        let apiAuth;
+        const preferredKey = preferredApiKey(flags, current);
+        if (canDiscoverPersonalKey(preferredKey) || (preferredKey === current?.apiKey && isPersonalProfile(current))) {
+            apiAuth = await resolveAuth(flags);
+            apiAuth.authentication = personalProfileAuthentication(apiAuth.apiKey, apiAuth.baseUrl, current);
+            const account = await personalAccount(apiAuth);
+            if (account) {
+                if (apiAuth.workspaceId)
+                    await createAssetHubClient(apiAuth).v2.getCapabilities();
+                await rememberPersonalProfile(apiAuth, configPath, config, account.userId);
+                print({ authenticated: true, authentication: 'personal', userId: account.userId, workspaceId: apiAuth.workspaceId,
+                    profile: apiAuth.profile, source: apiAuth.source, baseUrl: apiAuth.baseUrl });
+                return;
+            }
+        }
         if (!hasFlag(flags, 'api-key') &&
-            !current?.apiKey?.startsWith('ah_pat_') &&
-            (hasFlag(flags, 'profile') || !env.ASSETHUB_API_KEY?.startsWith('ah_pat_')) &&
             ((!hasFlag(flags, 'profile') && env.ASSETHUB_ACCESS_TOKEN?.trim()) ||
                 (current?.accessToken && !current.apiKey))) {
             const auth = await workspaceAuth(flags);
@@ -1560,22 +1611,12 @@ const commandAuth = async (subcommand, flags) => {
             });
             return;
         }
-        const auth = await resolveAuth(flags);
+        const auth = apiAuth ?? await resolveAuth(flags);
         const client = createAssetHubClient({
             apiKey: auth.apiKey,
             baseUrl: auth.baseUrl,
             workspaceId: auth.workspaceId,
         });
-        if (auth.apiKey.startsWith('ah_pat_')) {
-            const account = await createWorkspaceClient({ accessToken: auth.apiKey, baseUrl: auth.baseUrl, workspaceId: auth.workspaceId }).list();
-            if (account.authentication !== 'personal')
-                throw new Error('Workspace API did not verify personal authentication');
-            if (auth.workspaceId)
-                await client.v2.getCapabilities();
-            print({ authenticated: true, authentication: 'personal', userId: account.userId, workspaceId: auth.workspaceId,
-                profile: auth.profile, source: auth.source, baseUrl: auth.baseUrl });
-            return;
-        }
         const models = await client.v2.listModels();
         print({
             authenticated: true,
@@ -3810,7 +3851,7 @@ const run = async () => {
         const stored = config.profiles?.[explicitProfile ?? config.defaultProfile ?? defaultProfileName];
         if (explicitProfile && !stored)
             throw new Error('Selected profile does not exist');
-        const selected = explicitProfile || stored?.workspaceId || stored?.apiKey?.startsWith('ah_pat_');
+        const selected = explicitProfile || stored?.workspaceId || isPersonalProfile(stored);
         const baseUrl = getFlag(parsed.flags, 'base-url') ??
             (selected ? stored?.baseUrl : env.ASSETHUB_API_BASE_URL ?? stored?.baseUrl) ?? defaultBaseUrl;
         const workspaceId = getFlag(parsed.flags, 'workspace') ??

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assethub/cli",
-  "version": "0.1.20",
+  "version": "0.1.21",
   "description": "Command line interface for AssetHub.",
   "type": "module",
   "bin": {