@asteroidai/cli 1.9.27 → 1.9.30

package/dist/asteroid.js

@@ -2637,7 +2637,7 @@ var COMMANDS = [
     command: "secret-request create",
     tool: "secret_requests_create",
     title: "Create request",
-    description: "Create a secret request. The item key is derived from name unless itemKey is given. The share token is returned once and never listed again. The recipient submits values on the public page; that creates the secret.",
+    description: "Create a secret request. The item key is derived from name unless itemKey is given. The recipient URL and its token are returned once and never listed again. Send it to the person who holds the credentials. They submit values on that page, which creates the secret.",
     method: "POST",
     path: "/agents/v2/secret-requests",
     args: [],
@@ -5550,7 +5550,7 @@ var ApiError = class extends Error {
   status;
   body;
 };
-var VERSION = "1.9.27";
+var VERSION = "1.9.30";
 function problem(status, body, fallback) {
   if (body && typeof body === "object") {
     const record2 = body;

package/dist/core.js

@@ -2658,7 +2658,7 @@ var COMMANDS = [
     command: "secret-request create",
     tool: "secret_requests_create",
     title: "Create request",
-    description: "Create a secret request. The item key is derived from name unless itemKey is given. The share token is returned once and never listed again. The recipient submits values on the public page; that creates the secret.",
+    description: "Create a secret request. The item key is derived from name unless itemKey is given. The recipient URL and its token are returned once and never listed again. Send it to the person who holds the credentials. They submit values on that page, which creates the secret.",
     method: "POST",
     path: "/agents/v2/secret-requests",
     args: [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@asteroidai/cli",
-  "version": "1.9.27",
+  "version": "1.9.30",
   "description": "The asteroid command-line interface for the Asteroid platform.",
   "type": "module",
   "license": "MIT",
@@ -8,15 +8,10 @@
     "asteroid": "./dist/asteroid.js"
   },
   "exports": {
-    "./core": {
-      "types": "./src/core.ts",
-      "development": "./src/core.ts",
-      "default": "./dist/core.js"
-    }
+    "./core": "./dist/core.js"
   },
   "files": [
-    "dist",
-    "src"
+    "dist"
   ],
   "engines": {
     "node": ">=22"

package/src/account.ts

@@ -1,501 +0,0 @@
-import { UsageError } from "./args";
-import {
-  API_KEY_OVERRIDES,
-  type Auth,
-  AuthError,
-  isStaffLogin,
-  NotMemberError,
-  orgFromToken,
-  rememberOrg,
-  resolveAuth,
-  staffHint,
-  UNSET_API_KEY,
-} from "./auth/credentials";
-import { CredentialStore, type StaffToken } from "./auth/store";
-import {
-  authorizeDevice,
-  pollDevice,
-  tokenClaims,
-  type WorkosOrg,
-} from "./auth/workos";
-import {
-  type Config,
-  findOrg,
-  loadConfig,
-  mergeOrgs,
-  type Org,
-  orgLabel,
-  requestedOrg,
-  saveConfig,
-} from "./config";
-import { ApiError, send } from "./http";
-import { clean, render } from "./output";
-import type { Deps } from "./run";
-
-async function chooseOrg(deps: Deps, orgs: WorkosOrg[]): Promise<WorkosOrg> {
-  if (orgs.length === 0)
-    throw new AuthError("your account belongs to no organization");
-  if (orgs.length === 1 || !deps.ui) return orgs[0];
-  const id = await deps.ui.select(
-    "Choose an organization",
-    orgs.map((org) => ({ value: org.id, label: clean(org.name) })),
-  );
-  const chosen = orgs.find((org) => org.id === id);
-  if (!chosen) throw new AuthError("sign-in cancelled");
-  return chosen;
-}
-
-export async function login(deps: Deps): Promise<number> {
-  if (deps.env.apiKey)
-    deps.stderr(
-      `Warning: ${API_KEY_OVERRIDES} Every command will use the key, not this sign-in. ${UNSET_API_KEY}\n`,
-    );
-  const client = {
-    clientId: deps.env.workosClientId,
-    apiUrl: deps.env.workosApiUrl,
-    fetch: deps.fetch,
-  };
-  const device = await authorizeDevice(client);
-  const url = device.verification_uri_complete ?? device.verification_uri;
-  deps.stderr(
-    `Open ${clean(url)}\nand confirm the code ${clean(device.user_code)}\n`,
-  );
-  deps.openUrl?.(url);
-
-  let offered: WorkosOrg[] = [];
-  const polling = pollDevice(client, device, (orgs) => {
-    offered = orgs;
-    return chooseOrg(deps, orgs);
-  });
-  const session = deps.ui
-    ? await deps.ui.wait(
-        "Waiting for you to confirm in the browser",
-        "Confirmed",
-        polling,
-      )
-    : await polling;
-
-  const store = new CredentialStore(deps.env);
-  const where = await store.writeLogin({
-    refreshToken: session.refreshToken,
-    email: session.email,
-  });
-  const org = orgFromToken(session.accessToken);
-  const expiresAt = (tokenClaims(session.accessToken).exp ?? 0) * 1000;
-  if (org && expiresAt)
-    store.cacheToken(org.workosId, {
-      accessToken: session.accessToken,
-      expiresAt,
-    });
-
-  const config = loadConfig(deps.env);
-  config.orgs = mergeOrgs(
-    config.orgs,
-    offered.map((o) => ({ workosId: o.id, name: o.name })),
-  );
-  config.org = undefined;
-  saveConfig(deps.env, config);
-  rememberOrg(deps.env, config, org);
-
-  deps.stderr(
-    `Signed in as ${clean(session.email ?? "you")}${config.org ? ` in ${orgLabel(config.org)}` : ""}. ` +
-      `Token saved to the ${where === "keychain" ? "OS keychain" : "config directory"}.\n`,
-  );
-  return 0;
-}
-
-export async function logout(deps: Deps): Promise<number> {
-  const cleared = await new CredentialStore(deps.env).clear();
-  saveConfig(deps.env, { ...loadConfig(deps.env), org: undefined });
-  if (!cleared) {
-    deps.stderr(
-      "Could not remove the sign-in from the OS keychain. Delete the asteroid-cli entry by hand.\n",
-    );
-    return 1;
-  }
-  deps.stderr("Signed out.\n");
-  return 0;
-}
-
-export async function orgs(
-  deps: Deps,
-  flagOrg: string | undefined,
-  json: boolean,
-): Promise<number> {
-  if (deps.env.apiKey)
-    throw new UsageError(
-      `${API_KEY_OVERRIDES} The key acts in one organization; \`asteroid whoami\` shows it. ${UNSET_API_KEY}`,
-    );
-  const config = loadConfig(deps.env);
-  const auth = await resolveAuth(
-    deps.env,
-    config,
-    requestedOrg(flagOrg, deps.env, deps.cwd, config),
-    deps.fetch,
-  );
-  const list = loadConfig(deps.env).orgs ?? [];
-  const staff = (await new CredentialStore(deps.env).staffTokens()).filter(
-    (held) => held.expiresAt > Date.now(),
-  );
-  const active = auth.org?.workosId;
-  if (json) {
-    deps.stdout(
-      `${JSON.stringify(
-        [
-          ...list.map((org) => ({ ...org, active: org.workosId === active })),
-          ...staff.map((held) => ({
-            ...held.org,
-            active: held.org.workosId === active,
-            staff: { reason: held.reason, expiresAt: held.expiresAt },
-          })),
-        ],
-        null,
-        2,
-      )}\n`,
-    );
-    return 0;
-  }
-  for (const org of list)
-    deps.stdout(`${org.workosId === active ? "*" : " "} ${orgLabel(org)}\n`);
-  for (const held of staff)
-    deps.stdout(
-      `${held.org.workosId === active ? "*" : " "} ${orgLabel(held.org)}  staff access, ${timeLeft(held.expiresAt)} left\n`,
-    );
-  return 0;
-}
-
-function timeLeft(expiresAt: number): string {
-  const minutes = Math.max(0, Math.round((expiresAt - Date.now()) / 60_000));
-  return minutes >= 60
-    ? `${Math.floor(minutes / 60)}h${String(minutes % 60).padStart(2, "0")}m`
-    : `${minutes}m`;
-}
-
-function isMember(config: Config, org: Org): boolean {
-  return (config.orgs ?? []).some((o) => o.workosId === org.workosId);
-}
-
-/** The org whose sign-in calls the mint: the default, or else any of yours. */
-function homeOrg(config: Config): Org {
-  const org =
-    config.org && isMember(config, config.org) ? config.org : config.orgs?.[0];
-  if (!org)
-    throw new AuthError(
-      "staff access needs a sign-in to one of your own organizations. Run `asteroid login`.",
-    );
-  return org;
-}
-
-const STAFF_TOKEN_PATH = "/users/v2/staff-tokens";
-
-interface MintedStaffToken {
-  token: string;
-  grantId: string;
-  organizationId: string;
-  organizationName: string;
-  workosOrganizationId?: string;
-  reason: string;
-  expiresAt: string;
-}
-
-async function mintStaffToken(
-  deps: Deps,
-  config: Config,
-  ref: string,
-  reason: string,
-): Promise<StaffToken> {
-  const home = await resolveAuth(
-    deps.env,
-    config,
-    homeOrg(config).workosId,
-    deps.fetch,
-  );
-  let minted: MintedStaffToken;
-  try {
-    const response = await send(
-      deps.env.apiUrl,
-      home,
-      {
-        method: "POST",
-        path: STAFF_TOKEN_PATH,
-        query: new URLSearchParams(),
-        json: { organization: ref, reason },
-      },
-      false,
-      deps.fetch,
-    );
-    minted = response.json as MintedStaffToken;
-  } catch (error) {
-    if (error instanceof ApiError && error.status === 403)
-      throw new AuthError(
-        `you are not a member of ${clean(ref)}, and staff access is for Asteroid staff only.`,
-      );
-    if (error instanceof ApiError && error.status === 404)
-      throw new UsageError(
-        `unknown organization ${clean(ref)}. Pass its id or its WorkOS id (org_...).`,
-      );
-    throw error;
-  }
-  return {
-    token: minted.token,
-    grantId: minted.grantId,
-    org: {
-      workosId: minted.workosOrganizationId ?? minted.organizationId,
-      id: minted.organizationId,
-      name: minted.organizationName,
-    },
-    reason: minted.reason,
-    expiresAt: Date.parse(minted.expiresAt),
-  };
-}
-
-async function revokeStaffToken(
-  deps: Deps,
-  home: Auth,
-  held: StaffToken,
-): Promise<boolean> {
-  try {
-    await send(
-      deps.env.apiUrl,
-      home,
-      {
-        method: "DELETE",
-        path: `${STAFF_TOKEN_PATH}/${encodeURIComponent(held.grantId)}`,
-        query: new URLSearchParams(),
-      },
-      false,
-      deps.fetch,
-    );
-    return true;
-  } catch (error) {
-    // Gone already: revoked, or never recorded. Either way it no longer works.
-    if (error instanceof ApiError && error.status === 404) return true;
-    deps.stderr(
-      `Could not revoke staff access to ${orgLabel(held.org)}: ${clean(error instanceof Error ? error.message : String(error))}. It ends at ${new Date(held.expiresAt).toISOString()}.\n`,
-    );
-    return false;
-  }
-}
-
-/** `use --exit`: revoke every staff token now and go back to your own org. */
-async function exitStaff(deps: Deps): Promise<number> {
-  const store = new CredentialStore(deps.env);
-  const held = await store.staffTokens();
-  const config = loadConfig(deps.env);
-  if (held.length === 0) {
-    deps.stderr("No staff access to leave.\n");
-    return 0;
-  }
-  const home = await resolveAuth(
-    deps.env,
-    config,
-    homeOrg(config).workosId,
-    deps.fetch,
-  );
-  const left: StaffToken[] = [];
-  const kept: StaffToken[] = [];
-  for (const token of held) {
-    // Keep a token whose grant is still live, so a retry can revoke it.
-    const ended =
-      token.expiresAt <= Date.now() ||
-      (await revokeStaffToken(deps, home, token));
-    if (!ended) {
-      kept.push(token);
-      continue;
-    }
-    await store.dropStaffToken(token.grantId);
-    left.push(token);
-  }
-  const back = held.find((t) => t.from)?.from ?? homeOrg(config);
-  saveConfig(deps.env, { ...loadConfig(deps.env), org: back });
-  if (left.length > 0)
-    deps.stderr(
-      `Left staff access to ${left.map((t) => orgLabel(t.org)).join(", ")}.\n`,
-    );
-  if (kept.length > 0)
-    deps.stderr(
-      `Still holding staff access to ${kept.map((t) => orgLabel(t.org)).join(", ")}. Run \`asteroid use --exit\` again to retry.\n`,
-    );
-  deps.stderr(`Now using ${orgLabel(back)}.\n`);
-  return kept.length === 0 ? 0 : 1;
-}
-
-async function askReason(deps: Deps, org: string): Promise<string | undefined> {
-  if (!deps.ui) return undefined;
-  const reason = await deps.ui.text(
-    `You are not a member of ${clean(org)}. Why do you need staff access? This is audited.`,
-  );
-  return reason?.trim() || undefined;
-}
-
-/** The staff path of `use`: mint a token for an org you are not a member of. */
-async function useAsStaff(
-  deps: Deps,
-  config: Config,
-  ref: string,
-  reason: string | undefined,
-  staff: boolean,
-): Promise<number> {
-  const store = new CredentialStore(deps.env);
-  const held = await store.staffToken(ref);
-  if (held && held.expiresAt - 30_000 > Date.now() && !reason) {
-    saveConfig(deps.env, { ...config, org: held.org });
-    deps.stderr(
-      `Now using ${orgLabel(held.org)} with staff access, ${timeLeft(held.expiresAt)} left.\n`,
-    );
-    return 0;
-  }
-  if (!reason && staff) reason = await askReason(deps, ref);
-  if (!reason)
-    throw new UsageError(
-      `you are not a member of ${clean(ref)}.${staffHint(ref, staff)}${staff ? " The reason is audited." : ""}`,
-    );
-  // The mint takes an id, not a name. A held token knows the id.
-  const minted = await mintStaffToken(
-    deps,
-    config,
-    held?.org.id ?? ref,
-    reason,
-  );
-  const previous = config.org
-    ? isMember(config, config.org)
-      ? config.org
-      : (await store.staffToken(config.org.workosId))?.from
-    : undefined;
-  try {
-    await store.saveStaffToken(
-      { ...minted, from: previous ?? held?.from },
-      held?.grantId,
-    );
-  } catch (error) {
-    // Nothing holds the token, so nothing could revoke it later. End it now.
-    const home = await resolveAuth(
-      deps.env,
-      config,
-      homeOrg(config).workosId,
-      deps.fetch,
-    );
-    await revokeStaffToken(deps, home, minted);
-    throw error;
-  }
-  saveConfig(deps.env, { ...loadConfig(deps.env), org: minted.org });
-  deps.stderr(
-    `Staff access to ${orgLabel(minted.org)} for ${timeLeft(minted.expiresAt)}, until ${new Date(minted.expiresAt).toLocaleTimeString()}. ` +
-      `Reason: ${clean(minted.reason)}. This is audited. Run \`asteroid use --exit\` to leave.\n`,
-  );
-  return 0;
-}
-
-export interface UseOptions {
-  reason?: string;
-  exit?: boolean;
-}
-
-export async function use(
-  deps: Deps,
-  ref: string | undefined,
-  options: UseOptions = {},
-): Promise<number> {
-  if (deps.env.apiKey)
-    throw new UsageError(
-      `${API_KEY_OVERRIDES} \`use\` only switches the login's organization. ${UNSET_API_KEY}`,
-    );
-  if (options.exit) {
-    if (ref || options.reason)
-      throw new UsageError("usage: asteroid use --exit");
-    return exitStaff(deps);
-  }
-  // `--reason --exit` must not mint a grant whose reason is "--exit".
-  if (options.reason?.startsWith("-"))
-    throw new UsageError(
-      `--reason needs a value, not ${clean(options.reason)}. Give the reason without a leading -.`,
-    );
-  const config = loadConfig(deps.env);
-  if (!ref && deps.ui && (config.orgs?.length ?? 0) > 0) {
-    ref = await deps.ui.select(
-      "Use which organization?",
-      (config.orgs ?? []).map((o) => ({
-        value: o.workosId,
-        label: orgLabel(o),
-      })),
-    );
-    if (!ref) return 1;
-  }
-  if (!ref) throw new UsageError("usage: asteroid use <org>");
-  const login = await new CredentialStore(deps.env).readLogin();
-  if (!login) throw new AuthError("not signed in. Run `asteroid login`.");
-  const staff = isStaffLogin(login);
-  const org = findOrg(ref, config.orgs ?? []);
-  // Not one of yours: an id or name the sign-in does not list. A bare WorkOS id
-  // may still be yours, so the refresh decides.
-  if (!org || (!isMember(config, org) && options.reason))
-    return useAsStaff(deps, config, ref, options.reason, staff);
-  let auth: Auth;
-  try {
-    auth = await resolveAuth(deps.env, config, org.workosId, deps.fetch);
-  } catch (error) {
-    if (error instanceof NotMemberError)
-      return useAsStaff(deps, config, ref, options.reason, staff);
-    throw error;
-  }
-  const updated = loadConfig(deps.env);
-  updated.org =
-    updated.orgs?.find((o) => o.workosId === org.workosId) ?? auth.org ?? org;
-  saveConfig(deps.env, updated);
-  deps.stderr(`Now using ${orgLabel(updated.org)}.\n`);
-  return 0;
-}
-
-export async function whoami(
-  deps: Deps,
-  flagOrg: string | undefined,
-  json: boolean,
-): Promise<number> {
-  const config = loadConfig(deps.env);
-  const auth = await resolveAuth(
-    deps.env,
-    config,
-    requestedOrg(flagOrg, deps.env, deps.cwd, config),
-    deps.fetch,
-  );
-  const response = await send(
-    deps.env.apiUrl,
-    auth,
-    { method: "GET", path: "/users/v2/whoami", query: new URLSearchParams() },
-    false,
-    deps.fetch,
-  );
-  const body = (response.json ?? {}) as Record<string, unknown>;
-  const minutes = auth.expiresAt
-    ? Math.max(0, Math.round((auth.expiresAt - Date.now()) / 60_000))
-    : undefined;
-  if (json) {
-    deps.stdout(
-      `${JSON.stringify({ ...body, organizationName: auth.org?.name, tokenExpiresInMinutes: minutes }, null, 2)}\n`,
-    );
-    return 0;
-  }
-  const grant = body.staffGrant as { reason?: string } | undefined;
-  const person = body.person as { email?: string } | undefined;
-  const orgId = body.organizationId as string | undefined;
-  const organization = auth.org ? orgLabel(auth.org) : (orgId ?? "none");
-  deps.stdout(
-    `${render({
-      as: person?.email ?? body.id,
-      kind: body.kind,
-      credential: body.credential,
-      source:
-        auth.kind === "api-key"
-          ? "ASTEROID_API_KEY"
-          : auth.staff
-            ? "asteroid use (staff access)"
-            : "asteroid login",
-      organization,
-      ...(grant ? { staffReason: grant.reason } : {}),
-      ...(auth.expiresAt === undefined
-        ? {}
-        : { tokenExpiresIn: timeLeft(auth.expiresAt) }),
-    })}\n`,
-  );
-  return 0;
-}

package/src/args.ts

@@ -1,39 +0,0 @@
-import type { CliCommand } from "./types";
-
-export class UsageError extends Error {}
-
-export interface Parsed {
-  positionals: string[];
-  flags: Map<string, string[]>;
-  json: boolean;
-  org?: string;
-  body?: string;
-  output?: string;
-}
-
-export function leadingWords(argv: string[]): string[] {
-  const words: string[] = [];
-  for (const token of argv) {
-    if (token.startsWith("-")) break;
-    words.push(token);
-  }
-  return words;
-}
-
-export function matchCommand(
-  words: string[],
-  commands: CliCommand[],
-): { command?: CliCommand; prefix: string[] } {
-  for (let length = Math.min(words.length, 4); length > 0; length--) {
-    const candidate = words.slice(0, length).join(" ");
-    const command = commands.find((c) => c.command === candidate);
-    if (command) return { command, prefix: words.slice(0, length) };
-  }
-  for (let length = Math.min(words.length, 3); length > 0; length--) {
-    const prefix = words.slice(0, length);
-    if (commands.some((c) => c.command.startsWith(`${prefix.join(" ")} `))) {
-      return { prefix };
-    }
-  }
-  return { prefix: [] };
-}