@asteroidai/cli 1.9.12 → 1.9.28

package/dist/asteroid.js

@@ -4616,8 +4616,8 @@ var HIDDEN = /^agent[A-Z]|Url$/;
 var MAX_COLUMNS = 6;
 var MAX_CELL = 60;
 var CONTROL = /\x1b\[[0-?]*[ -/]*[@-~]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)?|\x1b[@-_]?|[\x00-\x08\x0b-\x1f\x7f-\x9f]/g;
-function clean(text2) {
-  return text2.replace(CONTROL, "");
+function clean(text3) {
+  return text3.replace(CONTROL, "");
 }
 function isObject(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
@@ -4625,8 +4625,8 @@ function isObject(value2) {
 function isScalar(value2) {
   return value2 === null || ["string", "number", "boolean"].includes(typeof value2);
 }
-function indent(text2) {
-  return text2.split("\n").map((line2) => `  ${line2}`).join("\n");
+function indent(text3) {
+  return text3.split("\n").map((line2) => `  ${line2}`).join("\n");
 }
 function text(value2) {
   return clean(isScalar(value2) ? String(value2) : JSON.stringify(value2));
@@ -4807,7 +4807,7 @@ function orgLabel(org) {
 }
 
 // src/program.ts
-import { Command, CommanderError } from "commander";
+import { Command, CommanderError, Option as Flag } from "commander";
 
 // src/args.ts
 var UsageError = class extends Error {
@@ -4838,7 +4838,17 @@ var BUILTINS = [
     usage: "asteroid use [org]",
     arg: "org",
     description: "Make an organization, by id or name, the default for later commands. Without one, pick from a list.",
-    args: 1
+    args: 1,
+    hiddenOptions: [
+      [
+        "--reason <why>",
+        "Staff only. Why you need access to an organization you are not a member of, such as a ticket id. It is audited. Asked for in a terminal."
+      ],
+      [
+        "--exit",
+        "Staff only. Revoke every staff token now and go back to your own organization."
+      ]
+    ]
   },
   {
     command: "complete",
@@ -4875,8 +4885,8 @@ function collect(value2, previous) {
   return [...previous ?? [], value2];
 }
 function optionText(option2) {
-  const text2 = option2.description?.replace(/\s+/g, " ").trim() ?? "";
-  const parts = [text2 && !/[.!?]$/.test(text2) ? `${text2}.` : text2];
+  const text3 = option2.description?.replace(/\s+/g, " ").trim() ?? "";
+  const parts = [text3 && !/[.!?]$/.test(text3) ? `${text3}.` : text3];
   if (option2.enum) parts.push(`One of: ${option2.enum.join(", ")}.`);
   if (option2.type.endsWith("[]")) parts.push("Repeatable.");
   if (option2.required) parts.push("Required.");
@@ -4961,12 +4971,14 @@ function defineCommands(root, options, dotted = /* @__PURE__ */ new Map(), onInv
       "after",
       "\nRun `asteroid --version` to print the CLI version."
     );
-  for (const [flags, text2] of GLOBAL_FLAGS) {
-    if (!flags.startsWith("-h")) root.option(flags, text2);
+  for (const [flags, text3] of GLOBAL_FLAGS) {
+    if (!flags.startsWith("-h")) root.option(flags, text3);
   }
   for (const builtin of options.builtins ?? []) {
     const leaf = root.command(builtin.command).description(builtin.description);
     if (builtin.arg) leaf.argument(`[${builtin.arg}]`);
+    for (const [flags, text3] of builtin.hiddenOptions ?? [])
+      leaf.addOption(new Flag(flags, text3).hideHelp());
     leaf.action((...args) => {
       const cmd = args.at(-1);
       onInvocation({
@@ -5055,8 +5067,8 @@ async function parseInvocation(argv2, options) {
   }
   const { argv: rest, dotted } = splitDotted(argv2);
   const root = new Command("asteroid").exitOverride().helpCommand(false).configureOutput({
-    writeOut: (text2) => stdout += text2,
-    writeErr: (text2) => stderr += text2
+    writeOut: (text3) => stdout += text3,
+    writeErr: (text3) => stderr += text3
   });
   defineCommands(root, options, dotted, (invocation) => {
     result = invocation;
@@ -5210,11 +5222,12 @@ function tokenClaims(token) {
 var SERVICE = "asteroid-cli";
 var LOCK_STALE_MS = 3e4;
 var ACCOUNT = "refresh-token";
-async function keyring() {
+var STAFF_ACCOUNT = "staff-tokens";
+async function keyring(account = ACCOUNT) {
   if (process.env.ASTEROID_NO_KEYCHAIN) return void 0;
   try {
     const { Entry } = await import("@napi-rs/keyring");
-    const entry = new Entry(SERVICE, ACCOUNT);
+    const entry = new Entry(SERVICE, account);
     entry.getPassword();
     return {
       get: () => entry.getPassword() ?? null,
@@ -5254,6 +5267,9 @@ var CredentialStore = class {
   get tokenFile() {
     return join2(this.env.configDir, "tokens.json");
   }
+  get staffFile() {
+    return join2(this.env.configDir, "staff-tokens.json");
+  }
   async readLogin() {
     const ring = await keyring();
     const raw = ring ? tryGet(ring).value : null;
@@ -5282,22 +5298,95 @@ var CredentialStore = class {
     const cleared = current.ok && (!current.value || trySet(ring, null));
     rmSync(this.loginFile, { force: true });
     rmSync(this.tokenFile, { force: true });
-    return cleared;
+    const staffCleared = await this.withStaffLock(
+      () => this.writeStaffTokens({})
+    );
+    return staffCleared && cleared;
+  }
+  /** Every staff token held, expired ones included. */
+  async staffTokens() {
+    const ring = await keyring(STAFF_ACCOUNT);
+    const raw = ring ? tryGet(ring).value : null;
+    const tokens = raw ? JSON.parse(raw) : readJson(this.staffFile, {});
+    return Object.values(tokens);
+  }
+  /** The staff token for an org, matched by WorkOS id, id or name. */
+  async staffToken(ref) {
+    const lower = ref.toLowerCase();
+    return (await this.staffTokens()).find(
+      ({ org }) => org.workosId.toLowerCase() === lower || org.id?.toLowerCase() === lower || org.name?.toLowerCase() === lower
+    );
+  }
+  /** Saves a staff token and drops expired ones. `replaces` is dropped too. */
+  async saveStaffToken(token, replaces) {
+    await this.withStaffLock(async () => {
+      const tokens = {};
+      for (const held of await this.staffTokens())
+        if (held.expiresAt > Date.now() && held.grantId !== replaces)
+          tokens[held.org.workosId] = held;
+      tokens[token.org.workosId] = token;
+      if (!await this.writeStaffTokens(tokens))
+        throw new WorkosError(
+          "keychain",
+          "could not save the staff token in the OS keychain. Unlock it and try again."
+        );
+    });
+  }
+  async dropStaffToken(grantId) {
+    await this.withStaffLock(async () => {
+      const tokens = {};
+      for (const held of await this.staffTokens())
+        if (held.grantId !== grantId) tokens[held.org.workosId] = held;
+      if (!await this.writeStaffTokens(tokens))
+        throw new WorkosError(
+          "keychain",
+          "could not remove the staff token from the OS keychain. Unlock it and try again."
+        );
+    });
+  }
+  async writeStaffTokens(tokens) {
+    const empty = Object.keys(tokens).length === 0;
+    const ring = await keyring(STAFF_ACCOUNT);
+    if (ring && trySet(ring, empty ? null : JSON.stringify(tokens))) {
+      rmSync(this.staffFile, { force: true });
+      return true;
+    }
+    const stale = ring ? tryGet(ring) : { ok: true, value: null };
+    if (!stale.ok || stale.value && !trySet(ring, null)) return false;
+    if (empty) rmSync(this.staffFile, { force: true });
+    else writePrivateJson(this.staffFile, tokens);
+    return true;
   }
   async withRefreshLock(work) {
+    return this.withLock(
+      "refresh",
+      "another asteroid command is refreshing the sign-in.",
+      work
+    );
+  }
+  /** Two commands at once must not lose a grant they could still revoke. */
+  async withStaffLock(work) {
+    return this.withLock(
+      "staff",
+      "another asteroid command is saving staff access.",
+      work
+    );
+  }
+  async withLock(name, busy, work) {
     mkdirSync2(this.env.configDir, { recursive: true, mode: 448 });
-    const lockfilePath = join2(this.env.configDir, "refresh.lock");
+    const lockfilePath = join2(this.env.configDir, `${name}.lock`);
     let release;
     try {
-      release = await lockfile.lock(this.env.configDir, {
+      release = await lockfile.lock(join2(this.env.configDir, name), {
         lockfilePath,
+        realpath: false,
         stale: LOCK_STALE_MS,
         retries: { retries: 60, minTimeout: 100, maxTimeout: 500 }
       });
     } catch {
       throw new WorkosError(
         "locked",
-        `another asteroid command is refreshing the sign-in. Try again, or delete ${lockfilePath} if none is running.`
+        `${busy} Try again, or delete ${lockfilePath} if none is running.`
       );
     }
     try {
@@ -5324,8 +5413,25 @@ var CredentialStore = class {
 // src/auth/credentials.ts
 var AuthError = class extends Error {
 };
+var NotMemberError = class extends AuthError {
+};
 var API_KEY_OVERRIDES = "ASTEROID_API_KEY is set, so the CLI uses that key and ignores `asteroid login`.";
 var UNSET_API_KEY = "Run `unset ASTEROID_API_KEY` to use your login instead.";
+function isStaffLogin(login2) {
+  return login2?.email?.toLowerCase().endsWith("@asteroid.ai") ?? false;
+}
+function staffHint(ref, staff) {
+  return staff ? ` Asteroid staff: run \`asteroid use ${clean(ref)} --reason <why>\`.` : "";
+}
+function staffAuth(held) {
+  return {
+    kind: "bearer",
+    headers: { Authorization: `Bearer ${held.token}` },
+    org: held.org,
+    expiresAt: held.expiresAt,
+    staff: { grantId: held.grantId, reason: held.reason }
+  };
+}
 function orgFromToken(token) {
   const claims = tokenClaims(token);
   if (!claims.org_id) return void 0;
@@ -5352,7 +5458,7 @@ function bearer(token, expiresAt) {
   };
 }
 var SSO_OR_MFA = /^(sso_required|mfa_.*|organization_authentication_methods_required)$/;
-function refreshError(error, org) {
+function refreshError(error, org, login2) {
   if (error.code === "invalid_grant") {
     return new AuthError("your sign-in has expired. Run `asteroid login`.");
   }
@@ -5362,8 +5468,8 @@ function refreshError(error, org) {
     );
   }
   if (error.code === "organization_membership_not_found") {
-    return new AuthError(
-      `you are not a member of ${orgLabel(org)}. Staff access to other organizations is not available yet.`
+    return new NotMemberError(
+      `you are not a member of ${orgLabel(org)}.${staffHint(org.id ?? org.workosId, isStaffLogin(login2))}`
     );
   }
   return new AuthError(
@@ -5374,15 +5480,24 @@ async function resolveAuth(env, config, orgRef, fetchImpl = fetch) {
   if (env.apiKey)
     return { kind: "api-key", headers: { "X-Api-Key": env.apiKey } };
   const store = new CredentialStore(env);
-  if (!await store.readLogin()) {
+  const login2 = await store.readLogin();
+  if (!login2) {
     throw new AuthError(
       "not signed in. Run `asteroid login`, or set ASTEROID_API_KEY."
     );
   }
+  const target = orgRef ?? config.org?.workosId;
+  const held = target ? await store.staffToken(target) : void 0;
+  if (held) {
+    if (held.expiresAt - 3e4 > Date.now()) return staffAuth(held);
+    throw new AuthError(
+      `your staff access to ${orgLabel(held.org)} has expired.${staffHint(held.org.id ?? held.org.workosId, true)}`
+    );
+  }
   const org = orgRef ? findOrg(orgRef, config.orgs ?? []) : config.org;
   if (orgRef && !org) {
     throw new AuthError(
-      `unknown organization ${orgRef}. Run \`asteroid orgs\` to list yours.`
+      `unknown organization ${clean(orgRef)}. Run \`asteroid orgs\` to list yours.${staffHint(orgRef, isStaffLogin(login2))}`
     );
   }
   if (!org) {
@@ -5395,8 +5510,8 @@ async function resolveAuth(env, config, orgRef, fetchImpl = fetch) {
   return store.withRefreshLock(async () => {
     const fresh = store.cachedToken(org.workosId);
     if (fresh) return bearer(fresh.accessToken, fresh.expiresAt);
-    const login2 = await store.readLogin();
-    if (!login2) {
+    const login3 = await store.readLogin();
+    if (!login3) {
       throw new AuthError("not signed in. Run `asteroid login`.");
     }
     try {
@@ -5406,10 +5521,10 @@ async function resolveAuth(env, config, orgRef, fetchImpl = fetch) {
           apiUrl: env.workosApiUrl,
           fetch: fetchImpl
         },
-        login2.refreshToken,
+        login3.refreshToken,
         org.workosId
       );
-      await store.writeLogin({ ...login2, refreshToken: session2.refreshToken });
+      await store.writeLogin({ ...login3, refreshToken: session2.refreshToken });
       const expiresAt = (tokenClaims(session2.accessToken).exp ?? 0) * 1e3 || Date.now() + 6e4;
       const auth = bearer(session2.accessToken, expiresAt);
       store.cacheToken(auth.org?.workosId ?? org.workosId, {
@@ -5419,7 +5534,7 @@ async function resolveAuth(env, config, orgRef, fetchImpl = fetch) {
       rememberOrg(env, config, auth.org);
       return auth;
     } catch (error) {
-      if (error instanceof WorkosError) throw refreshError(error, org);
+      if (error instanceof WorkosError) throw refreshError(error, org, login3);
       throw error;
     }
   });
@@ -5435,7 +5550,7 @@ var ApiError = class extends Error {
   status;
   body;
 };
-var VERSION = "1.9.12";
+var VERSION = "1.9.28";
 function problem(status, body, fallback) {
   if (body && typeof body === "object") {
     const record2 = body;
@@ -5495,14 +5610,14 @@ async function send(apiUrl, auth, request, binary, fetchImpl = fetch) {
   }
   const contentType = response.headers.get("content-type") ?? "";
   if (!response.ok) {
-    const text2 = await response.text();
-    let parsed = text2;
+    const text3 = await response.text();
+    let parsed = text3;
     try {
-      parsed = JSON.parse(text2);
+      parsed = JSON.parse(text3);
     } catch {
-      parsed = text2;
+      parsed = text3;
     }
-    let message = problem(response.status, parsed, text2.slice(0, 200));
+    let message = problem(response.status, parsed, text3.slice(0, 200));
     const sentKey = "X-Api-Key" in hopHeaders;
     if (sentKey && response.status === 401)
       message = `ASTEROID_API_KEY was rejected: ${message}. Check the key. ${UNSET_API_KEY}`;
@@ -5614,11 +5729,21 @@ async function orgs(deps, flagOrg, json) {
     deps.fetch
   );
   const list = loadConfig(deps.env).orgs ?? [];
+  const staff = (await new CredentialStore(deps.env).staffTokens()).filter(
+    (held) => held.expiresAt > Date.now()
+  );
   const active = auth.org?.workosId;
   if (json) {
     deps.stdout(
       `${JSON.stringify(
-        list.map((org) => ({ ...org, active: org.workosId === active })),
+        [
+          ...list.map((org) => ({ ...org, active: org.workosId === active })),
+          ...staff.map((held) => ({
+            ...held.org,
+            active: held.org.workosId === active,
+            staff: { reason: held.reason, expiresAt: held.expiresAt }
+          }))
+        ],
         null,
         2
       )}
@@ -5629,13 +5754,204 @@ async function orgs(deps, flagOrg, json) {
   for (const org of list)
     deps.stdout(`${org.workosId === active ? "*" : " "} ${orgLabel(org)}
 `);
+  for (const held of staff)
+    deps.stdout(
+      `${held.org.workosId === active ? "*" : " "} ${orgLabel(held.org)}  staff access, ${timeLeft(held.expiresAt)} left
+`
+    );
+  return 0;
+}
+function timeLeft(expiresAt) {
+  const minutes = Math.max(0, Math.round((expiresAt - Date.now()) / 6e4));
+  return minutes >= 60 ? `${Math.floor(minutes / 60)}h${String(minutes % 60).padStart(2, "0")}m` : `${minutes}m`;
+}
+function isMember(config, org) {
+  return (config.orgs ?? []).some((o) => o.workosId === org.workosId);
+}
+function homeOrg(config) {
+  const org = config.org && isMember(config, config.org) ? config.org : config.orgs?.[0];
+  if (!org)
+    throw new AuthError(
+      "staff access needs a sign-in to one of your own organizations. Run `asteroid login`."
+    );
+  return org;
+}
+var STAFF_TOKEN_PATH = "/users/v2/staff-tokens";
+async function mintStaffToken(deps, config, ref, reason) {
+  const home = await resolveAuth(
+    deps.env,
+    config,
+    homeOrg(config).workosId,
+    deps.fetch
+  );
+  let minted;
+  try {
+    const response = await send(
+      deps.env.apiUrl,
+      home,
+      {
+        method: "POST",
+        path: STAFF_TOKEN_PATH,
+        query: new URLSearchParams(),
+        json: { organization: ref, reason }
+      },
+      false,
+      deps.fetch
+    );
+    minted = response.json;
+  } catch (error) {
+    if (error instanceof ApiError && error.status === 403)
+      throw new AuthError(
+        `you are not a member of ${clean(ref)}, and staff access is for Asteroid staff only.`
+      );
+    if (error instanceof ApiError && error.status === 404)
+      throw new UsageError(
+        `unknown organization ${clean(ref)}. Pass its id or its WorkOS id (org_...).`
+      );
+    throw error;
+  }
+  return {
+    token: minted.token,
+    grantId: minted.grantId,
+    org: {
+      workosId: minted.workosOrganizationId ?? minted.organizationId,
+      id: minted.organizationId,
+      name: minted.organizationName
+    },
+    reason: minted.reason,
+    expiresAt: Date.parse(minted.expiresAt)
+  };
+}
+async function revokeStaffToken(deps, home, held) {
+  try {
+    await send(
+      deps.env.apiUrl,
+      home,
+      {
+        method: "DELETE",
+        path: `${STAFF_TOKEN_PATH}/${encodeURIComponent(held.grantId)}`,
+        query: new URLSearchParams()
+      },
+      false,
+      deps.fetch
+    );
+    return true;
+  } catch (error) {
+    if (error instanceof ApiError && error.status === 404) return true;
+    deps.stderr(
+      `Could not revoke staff access to ${orgLabel(held.org)}: ${clean(error instanceof Error ? error.message : String(error))}. It ends at ${new Date(held.expiresAt).toISOString()}.
+`
+    );
+    return false;
+  }
+}
+async function exitStaff(deps) {
+  const store = new CredentialStore(deps.env);
+  const held = await store.staffTokens();
+  const config = loadConfig(deps.env);
+  if (held.length === 0) {
+    deps.stderr("No staff access to leave.\n");
+    return 0;
+  }
+  const home = await resolveAuth(
+    deps.env,
+    config,
+    homeOrg(config).workosId,
+    deps.fetch
+  );
+  const left = [];
+  const kept = [];
+  for (const token of held) {
+    const ended = token.expiresAt <= Date.now() || await revokeStaffToken(deps, home, token);
+    if (!ended) {
+      kept.push(token);
+      continue;
+    }
+    await store.dropStaffToken(token.grantId);
+    left.push(token);
+  }
+  const back = held.find((t) => t.from)?.from ?? homeOrg(config);
+  saveConfig(deps.env, { ...loadConfig(deps.env), org: back });
+  if (left.length > 0)
+    deps.stderr(
+      `Left staff access to ${left.map((t) => orgLabel(t.org)).join(", ")}.
+`
+    );
+  if (kept.length > 0)
+    deps.stderr(
+      `Still holding staff access to ${kept.map((t) => orgLabel(t.org)).join(", ")}. Run \`asteroid use --exit\` again to retry.
+`
+    );
+  deps.stderr(`Now using ${orgLabel(back)}.
+`);
+  return kept.length === 0 ? 0 : 1;
+}
+async function askReason(deps, org) {
+  if (!deps.ui) return void 0;
+  const reason = await deps.ui.text(
+    `You are not a member of ${clean(org)}. Why do you need staff access? This is audited.`
+  );
+  return reason?.trim() || void 0;
+}
+async function useAsStaff(deps, config, ref, reason, staff) {
+  const store = new CredentialStore(deps.env);
+  const held = await store.staffToken(ref);
+  if (held && held.expiresAt - 3e4 > Date.now() && !reason) {
+    saveConfig(deps.env, { ...config, org: held.org });
+    deps.stderr(
+      `Now using ${orgLabel(held.org)} with staff access, ${timeLeft(held.expiresAt)} left.
+`
+    );
+    return 0;
+  }
+  if (!reason && staff) reason = await askReason(deps, ref);
+  if (!reason)
+    throw new UsageError(
+      `you are not a member of ${clean(ref)}.${staffHint(ref, staff)}${staff ? " The reason is audited." : ""}`
+    );
+  const minted = await mintStaffToken(
+    deps,
+    config,
+    held?.org.id ?? ref,
+    reason
+  );
+  const previous = config.org ? isMember(config, config.org) ? config.org : (await store.staffToken(config.org.workosId))?.from : void 0;
+  try {
+    await store.saveStaffToken(
+      { ...minted, from: previous ?? held?.from },
+      held?.grantId
+    );
+  } catch (error) {
+    const home = await resolveAuth(
+      deps.env,
+      config,
+      homeOrg(config).workosId,
+      deps.fetch
+    );
+    await revokeStaffToken(deps, home, minted);
+    throw error;
+  }
+  saveConfig(deps.env, { ...loadConfig(deps.env), org: minted.org });
+  deps.stderr(
+    `Staff access to ${orgLabel(minted.org)} for ${timeLeft(minted.expiresAt)}, until ${new Date(minted.expiresAt).toLocaleTimeString()}. Reason: ${clean(minted.reason)}. This is audited. Run \`asteroid use --exit\` to leave.
+`
+  );
   return 0;
 }
-async function use(deps, ref) {
+async function use(deps, ref, options = {}) {
   if (deps.env.apiKey)
     throw new UsageError(
       `${API_KEY_OVERRIDES} \`use\` only switches the login's organization. ${UNSET_API_KEY}`
     );
+  if (options.exit) {
+    if (ref || options.reason)
+      throw new UsageError("usage: asteroid use --exit");
+    return exitStaff(deps);
+  }
+  if (options.reason?.startsWith("-"))
+    throw new UsageError(
+      `--reason needs a value, not ${clean(options.reason)}. Give the reason without a leading -.`
+    );
   const config = loadConfig(deps.env);
   if (!ref && deps.ui && (config.orgs?.length ?? 0) > 0) {
     ref = await deps.ui.select(
@@ -5648,12 +5964,20 @@ async function use(deps, ref) {
     if (!ref) return 1;
   }
   if (!ref) throw new UsageError("usage: asteroid use <org>");
+  const login2 = await new CredentialStore(deps.env).readLogin();
+  if (!login2) throw new AuthError("not signed in. Run `asteroid login`.");
+  const staff = isStaffLogin(login2);
   const org = findOrg(ref, config.orgs ?? []);
-  if (!org)
-    throw new UsageError(
-      `unknown organization ${ref}. Run \`asteroid orgs\` to list yours.`
-    );
-  const auth = await resolveAuth(deps.env, config, org.workosId, deps.fetch);
+  if (!org || !isMember(config, org) && options.reason)
+    return useAsStaff(deps, config, ref, options.reason, staff);
+  let auth;
+  try {
+    auth = await resolveAuth(deps.env, config, org.workosId, deps.fetch);
+  } catch (error) {
+    if (error instanceof NotMemberError)
+      return useAsStaff(deps, config, ref, options.reason, staff);
+    throw error;
+  }
   const updated = loadConfig(deps.env);
   updated.org = updated.orgs?.find((o) => o.workosId === org.workosId) ?? auth.org ?? org;
   saveConfig(deps.env, updated);
@@ -5685,6 +6009,7 @@ async function whoami(deps, flagOrg, json) {
     );
     return 0;
   }
+  const grant = body.staffGrant;
   const person = body.person;
   const orgId = body.organizationId;
   const organization = auth.org ? orgLabel(auth.org) : orgId ?? "none";
@@ -5693,9 +6018,10 @@ async function whoami(deps, flagOrg, json) {
       as: person?.email ?? body.id,
       kind: body.kind,
       credential: body.credential,
-      source: auth.kind === "api-key" ? "ASTEROID_API_KEY" : "asteroid login",
+      source: auth.kind === "api-key" ? "ASTEROID_API_KEY" : auth.staff ? "asteroid use (staff access)" : "asteroid login",
       organization,
-      ...minutes === void 0 ? {} : { tokenExpiresIn: `${minutes}m` }
+      ...grant ? { staffReason: grant.reason } : {},
+      ...auth.expiresAt === void 0 ? {} : { tokenExpiresIn: timeLeft(auth.expiresAt) }
     })}
 `
   );
@@ -6089,8 +6415,8 @@ function executionDir(options, execution) {
   );
   return join3(root, "executions", executionDirName(execution.id));
 }
-async function writeText(sync, path, text2) {
-  await sync.files.write(path, Buffer.from(text2, "utf8"));
+async function writeText(sync, path, text3) {
+  await sync.files.write(path, Buffer.from(text3, "utf8"));
 }
 async function writeActivities(sync, dir, execution) {
   try {
@@ -6338,9 +6664,9 @@ async function removeStale(sync, dir, keep) {
   }
 }
 async function writeManifest(sync, dir, manifest) {
-  const text2 = `${JSON.stringify(manifest, null, 2)}
+  const text3 = `${JSON.stringify(manifest, null, 2)}
 `;
-  await sync.files.write(join3(dir, MANIFEST), Buffer.from(text2, "utf8"));
+  await sync.files.write(join3(dir, MANIFEST), Buffer.from(text3, "utf8"));
 }
 async function pullWorkflow(sync, options) {
   const request = {
@@ -6595,8 +6921,8 @@ async function runSync(command, parsed, deps) {
     remote: deps.remote,
     files: deps.files ?? nodeFiles(deps.cwd)
   };
-  const { result, text: text2 } = await execute(command, parsed, sync, deps);
-  deps.stdout(`${parsed.json ? JSON.stringify(result, null, 2) : text2}
+  const { result, text: text3 } = await execute(command, parsed, sync, deps);
+  deps.stdout(`${parsed.json ? JSON.stringify(result, null, 2) : text3}
 `);
   return 0;
 }
@@ -6624,7 +6950,10 @@ async function runBuiltin(name, parsed, deps) {
         "run `asteroid complete <shell>` to print a completion script"
       );
     case "use":
-      return use(deps, parsed.positionals[0]);
+      return use(deps, parsed.positionals[0], {
+        reason: parsed.flags.get("reason")?.[0],
+        exit: parsed.flags.has("exit")
+      });
     default:
       return whoami(deps, parsed.org, parsed.json);
   }
@@ -6653,7 +6982,8 @@ async function authFor(parsed, deps) {
 function announce(command, auth, deps) {
   if (command.readOnly) return;
   const org = auth.kind === "api-key" ? "the API key's organization" : auth.org ? orgLabel(auth.org) : "your default organization";
-  deps.stderr(`Acting in ${org}.
+  const staff = auth.staff ? ` with staff access (${clean(auth.staff.reason)})` : "";
+  deps.stderr(`Acting in ${org}${staff}.
 `);
 }
 async function runCommand(command, parsed, deps) {
@@ -6769,6 +7099,10 @@ var clackUi = {
     const value2 = await clack.select({ message, options: choices });
     return clack.isCancel(value2) ? void 0 : value2;
   },
+  async text(message) {
+    const value2 = await clack.text({ message });
+    return clack.isCancel(value2) ? void 0 : value2;
+  },
   async wait(message, done, work) {
     const spinner2 = clack.spinner();
     spinner2.start(message);
@@ -6803,8 +7137,8 @@ var code = await run(argv, {
   env: readEnv(),
   cwd: process.cwd(),
   fetch,
-  stdout: (text2) => process.stdout.write(text2),
-  stderr: (text2) => process.stderr.write(text2),
+  stdout: (text3) => process.stdout.write(text3),
+  stderr: (text3) => process.stderr.write(text3),
   writeBytes: (bytes) => process.stdout.write(bytes),
   ui: process.stdin.isTTY && process.stderr.isTTY ? clackUi : void 0,
   stdoutIsTTY: process.stdout.isTTY === true,