@cargo-ai/cli 1.0.44 → 1.0.46

package/build/commands/auth/loginChannel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loginChannel.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/loginChannel.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,MAAM,MAAM,YAAY,GAAG,iBAAiB,GAAG;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAC7B;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GACpB;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GACpB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtB;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,YAAY,GAAG,qBAAqB,CAmD5E"}

package/build/commands/auth/loginChannel.js

@@ -0,0 +1,42 @@
+/**
+ * Picks the sign-in channel and rejects flag combinations whose extra options
+ * would otherwise be accepted and quietly ignored.
+ */
+export function selectLoginChannel(opts) {
+    const wantsEmail = opts.email !== undefined;
+    const wantsOAuth = opts.oauth === true;
+    const wantsToken = opts.token !== undefined;
+    const selectedCount = [wantsEmail, wantsOAuth, wantsToken].filter((selected) => {
+        return selected === true;
+    }).length;
+    if (selectedCount > 1) {
+        return { error: "Pass only one of --email, --oauth or --token." };
+    }
+    if (selectedCount === 0) {
+        return {
+            error: "Must pass --email <email> (emailed code), --oauth (browser sign-in) or --token <token> (existing API token).",
+        };
+    }
+    if (opts.code !== undefined && wantsEmail === false) {
+        return { error: "--code only applies to --email <email>." };
+    }
+    if (opts.workspaceName !== undefined && opts.workspaceUuid !== undefined) {
+        return {
+            error: "Pass only one of --workspace-name and --workspace-uuid; they select different workspaces.",
+        };
+    }
+    // An API token already carries its workspace, so creating one for it cannot
+    // be honoured and must not look like it was.
+    if (wantsToken === true && opts.workspaceName !== undefined) {
+        return {
+            error: "--workspace-name does not apply to --token; an API token is already scoped to a workspace.",
+        };
+    }
+    if (opts.email !== undefined) {
+        return { channel: "email" };
+    }
+    if (opts.token !== undefined) {
+        return { channel: "token", token: opts.token };
+    }
+    return { channel: "oauth" };
+}

package/build/commands/auth/oauth.d.ts

@@ -1,7 +1,3 @@
-import { type OAuthConfigOverrides } from "../../oauthConfig.js";
-export type OAuthLoginResult = {
-    accessToken: string;
-    expiresIn: number;
-};
-export declare function runOAuthDeviceFlow(overrides: OAuthConfigOverrides): Promise<OAuthLoginResult>;
+import { type IdentityTokens } from "./auth0.js";
+export declare function runOAuthDeviceFlow(): Promise<IdentityTokens>;
 //# sourceMappingURL=oauth.d.ts.map

package/build/commands/auth/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/oauth.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,sBAAsB,CAAC;AA8B9B,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,oBAAoB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CA0B3B"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/oauth.ts"],"names":[],"mappings":"AAGA,OAAO,EAIL,KAAK,cAAc,EAIpB,MAAM,YAAY,CAAC;AAepB,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,cAAc,CAAC,CAmBlE"}

package/build/commands/auth/oauth.js

@@ -1,13 +1,12 @@
-import { spawn } from "node:child_process";
-import { platform } from "node:process";
-import { getOAuthConfig, } from "../../oauthConfig.js";
-import { failWith, info } from "../runHandler.js";
+import { getOAuthConfig } from "../../oauthConfig.js";
+import { openBrowser } from "../../utils/openBrowser.js";
+import { failWith, info, sleep } from "../runHandler.js";
+import { describeError, errorCodeOf, parseTokenResponse, postToAuth0, readErrorBody, } from "./auth0.js";
 const DEFAULT_POLL_INTERVAL_SECONDS = 5;
 const SLOW_DOWN_BACKOFF_SECONDS = 5;
 const DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
-export async function runOAuthDeviceFlow(overrides) {
-    const oauthConfig = getOAuthConfig(overrides);
-    const deviceCode = await requestDeviceCode(oauthConfig);
+export async function runOAuthDeviceFlow() {
+    const deviceCode = await requestDeviceCode();
     info([
         "",
         "To complete sign-in, open this URL in a browser:",
@@ -19,27 +18,22 @@ export async function runOAuthDeviceFlow(overrides) {
         "",
     ].join("\n"));
     openBrowser(deviceCode.verification_uri_complete);
-    const token = await pollForToken(oauthConfig, deviceCode);
-    return {
-        accessToken: token.access_token,
-        expiresIn: token.expires_in,
-    };
+    return await pollForToken(deviceCode);
 }
-async function requestDeviceCode(config) {
-    const body = new URLSearchParams({
-        client_id: config.clientId,
-        scope: config.scope,
-        audience: config.audience,
-    });
-    body.set("screen_hint", "signup");
-    const response = await fetch(`https://${config.domain}/oauth/device/code`, {
-        method: "POST",
-        headers: { "content-type": "application/x-www-form-urlencoded" },
-        body: body.toString(),
+async function requestDeviceCode() {
+    const config = getOAuthConfig();
+    const response = await postToAuth0({
+        path: "/oauth/device/code",
+        body: new URLSearchParams({
+            client_id: config.clientId,
+            scope: config.scope,
+            audience: config.audience,
+            screen_hint: "signup",
+        }),
     });
     if (response.ok === false) {
-        const text = await safeReadText(response);
-        failWith(`Failed to start device authorization (HTTP ${String(response.status)}): ${text}`);
+        const body = await readErrorBody(response);
+        failWith(`Failed to start device authorization (HTTP ${String(response.status)}): ${describeError(body)}`, { extra: { oauthError: body } });
     }
     const json = (await response.json());
     if (typeof json.device_code !== "string" ||
@@ -51,32 +45,36 @@ async function requestDeviceCode(config) {
     }
     return json;
 }
-async function pollForToken(config, deviceCode) {
-    const startedAtMs = Date.now();
-    const expiresAtMs = startedAtMs + deviceCode.expires_in * 1000;
+async function pollForToken(deviceCode) {
+    const config = getOAuthConfig();
+    const expiresAtMs = Date.now() + deviceCode.expires_in * 1000;
     let intervalSeconds = deviceCode.interval > 0
         ? deviceCode.interval
         : DEFAULT_POLL_INTERVAL_SECONDS;
     while (Date.now() < expiresAtMs) {
         await sleep(intervalSeconds * 1000);
-        const response = await fetch(`https://${config.domain}/oauth/token`, {
-            method: "POST",
-            headers: { "content-type": "application/x-www-form-urlencoded" },
-            body: new URLSearchParams({
-                grant_type: DEVICE_CODE_GRANT,
-                device_code: deviceCode.device_code,
-                client_id: config.clientId,
-            }).toString(),
-        });
+        let response;
+        try {
+            response = await postToAuth0({
+                path: "/oauth/token",
+                body: new URLSearchParams({
+                    grant_type: DEVICE_CODE_GRANT,
+                    device_code: deviceCode.device_code,
+                    client_id: config.clientId,
+                }),
+            });
+        }
+        catch {
+            // The user may already be mid-way through approving in the browser, so a
+            // dropped connection is not worth making them start over. Keep polling
+            // until the device code itself expires.
+            continue;
+        }
         if (response.ok === true) {
-            const token = (await response.json());
-            if (typeof token.access_token !== "string") {
-                failWith(`Unexpected token response from OAuth provider: ${JSON.stringify(token)}`);
-            }
-            return token;
+            return parseTokenResponse(await response.json());
         }
-        const errorBody = (await safeReadJson(response));
-        const errorCode = errorBody !== undefined ? errorBody.error : undefined;
+        const errorBody = await readErrorBody(response);
+        const errorCode = errorCodeOf(errorBody);
         if (errorCode === "authorization_pending") {
             continue;
         }
@@ -84,57 +82,22 @@ async function pollForToken(config, deviceCode) {
             intervalSeconds = intervalSeconds + SLOW_DOWN_BACKOFF_SECONDS;
             continue;
         }
-        if (errorCode === "expired_token" ||
-            errorCode === "access_denied" ||
-            errorCode === "invalid_grant") {
-            failWith(`Authorization failed: ${errorCode}${errorBody !== undefined && errorBody.error_description !== undefined
-                ? ` - ${errorBody.error_description}`
-                : ""}`, { extra: { oauthError: errorBody } });
-        }
-        failWith(`Token polling failed (HTTP ${String(response.status)}): ${errorBody !== undefined ? JSON.stringify(errorBody) : "no body"}`, { extra: { oauthError: errorBody } });
+        failIfTerminal(response.status, errorCode, errorBody);
     }
     failWith("Authorization timed out before the user completed the flow.");
 }
-function openBrowser(url) {
-    const command = pickOpenCommand();
-    const args = platform === "win32" ? ["/c", "start", "", url] : [url];
-    try {
-        const child = spawn(command, args, {
-            detached: true,
-            stdio: "ignore",
+function failIfTerminal(status, errorCode, errorBody) {
+    if (errorCode === "expired_token" ||
+        errorCode === "access_denied" ||
+        errorCode === "invalid_grant") {
+        failWith(`Authorization failed: ${describeError(errorBody)}`, {
+            extra: { oauthError: errorBody },
         });
-        child.on("error", () => {
-            // Browser launch failed silently; user can still use the printed URL.
-        });
-        child.unref();
-    }
-    catch {
-        // Ignore; user can still use the printed URL.
-    }
-}
-function pickOpenCommand() {
-    if (platform === "darwin")
-        return "open";
-    if (platform === "win32")
-        return "cmd";
-    return "xdg-open";
-}
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}
-async function safeReadText(response) {
-    try {
-        return await response.text();
-    }
-    catch {
-        return "<unreadable body>";
-    }
-}
-async function safeReadJson(response) {
-    try {
-        return await response.json();
     }
-    catch {
-        return undefined;
+    // Rate limits and provider hiccups are transient: the browser half of the
+    // flow is still valid, so only give up once the device code expires.
+    if (status === 429 || status >= 500) {
+        return;
     }
+    failWith(`Token polling failed (HTTP ${String(status)}): ${describeError(errorBody)}`, { extra: { oauthError: errorBody } });
 }

package/build/commands/auth/passwordless.d.ts

@@ -0,0 +1,22 @@
+import { type IdentityTokens } from "./auth0.js";
+/**
+ * Asks the identity provider to email a one-time code. This is the only step of
+ * the sign-in flow that needs no credential, which is what makes the flow
+ * usable from a terminal with no browser.
+ */
+export declare function startEmailPasswordless(opts: {
+    email: string;
+}): Promise<void>;
+/**
+ * Trades the emailed code for an access token. `offline_access` is requested so
+ * the caller can refresh once a workspace exists: the workspace list is baked
+ * into the token's claims and a freshly created workspace is not in them yet.
+ */
+export declare function exchangeEmailOtp(opts: {
+    email: string;
+    otp: string;
+}): Promise<IdentityTokens>;
+export declare function refreshAccessToken(opts: {
+    refreshToken: string;
+}): Promise<IdentityTokens>;
+//# sourceMappingURL=passwordless.d.ts.map

package/build/commands/auth/passwordless.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwordless.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/passwordless.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,cAAc,EAIpB,MAAM,YAAY,CAAC;AAMpB;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBhB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb,GAAG,OAAO,CAAC,cAAc,CAAC,CAiC1B;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,cAAc,CAAC,CAqB1B"}

package/build/commands/auth/passwordless.js

@@ -0,0 +1,70 @@
+import { getOAuthConfig } from "../../oauthConfig.js";
+import { failWith } from "../runHandler.js";
+import { describeError, errorCodeOf, parseTokenResponse, postToAuth0, readErrorBody, } from "./auth0.js";
+const PASSWORDLESS_OTP_GRANT = "http://auth0.com/oauth/grant-type/passwordless/otp";
+const EMAIL_REALM = "email";
+/**
+ * Asks the identity provider to email a one-time code. This is the only step of
+ * the sign-in flow that needs no credential, which is what makes the flow
+ * usable from a terminal with no browser.
+ */
+export async function startEmailPasswordless(opts) {
+    const config = getOAuthConfig();
+    const response = await postToAuth0({
+        path: "/passwordless/start",
+        body: {
+            client_id: config.clientId,
+            connection: EMAIL_REALM,
+            email: opts.email,
+            send: "code",
+        },
+    });
+    if (response.ok === false) {
+        const body = await readErrorBody(response);
+        failWith(`Failed to send the verification code to ${opts.email} (HTTP ${String(response.status)}): ${describeError(body)}`, { extra: { oauthError: body } });
+    }
+}
+/**
+ * Trades the emailed code for an access token. `offline_access` is requested so
+ * the caller can refresh once a workspace exists: the workspace list is baked
+ * into the token's claims and a freshly created workspace is not in them yet.
+ */
+export async function exchangeEmailOtp(opts) {
+    const config = getOAuthConfig();
+    const response = await postToAuth0({
+        path: "/oauth/token",
+        body: new URLSearchParams({
+            grant_type: PASSWORDLESS_OTP_GRANT,
+            client_id: config.clientId,
+            username: opts.email,
+            otp: opts.otp,
+            realm: EMAIL_REALM,
+            audience: config.audience,
+            scope: config.scope,
+        }),
+    });
+    if (response.ok === false) {
+        const body = await readErrorBody(response);
+        if (errorCodeOf(body) === "invalid_grant") {
+            failWith("That code is not valid or has expired. Codes are single-use and short-lived — request a new one by re-running without --code.", { extra: { oauthError: body } });
+        }
+        failWith(`Failed to verify the code (HTTP ${String(response.status)}): ${describeError(body)}`, { extra: { oauthError: body } });
+    }
+    return parseTokenResponse(await response.json());
+}
+export async function refreshAccessToken(opts) {
+    const config = getOAuthConfig();
+    const response = await postToAuth0({
+        path: "/oauth/token",
+        body: new URLSearchParams({
+            grant_type: "refresh_token",
+            client_id: config.clientId,
+            refresh_token: opts.refreshToken,
+        }),
+    });
+    if (response.ok === false) {
+        const body = await readErrorBody(response);
+        failWith(`Failed to refresh the access token (HTTP ${String(response.status)}): ${describeError(body)}`, { extra: { oauthError: body } });
+    }
+    return parseTokenResponse(await response.json());
+}

package/build/commands/auth/session.d.ts

@@ -0,0 +1,21 @@
+import { type IdentityTokens } from "./auth0.js";
+import { type ResolvedWorkspace } from "./workspace.js";
+export declare const DEFAULT_BASE_URL = "https://api.getcargo.io";
+export declare function resolveBaseUrl(override: string | undefined): string;
+/**
+ * Picks the workspace to work in and stores the signed-in session. Every
+ * sign-in channel ends here, so the credentials file looks the same however
+ * the user signed in.
+ *
+ * The access token is short-lived and deliberately not treated as the
+ * credential: the refresh token beside it is what keeps the CLI signed in, and
+ * it is renewed on demand rather than by minting an API token per machine.
+ */
+export declare function establishSession(opts: {
+    tokens: IdentityTokens;
+    /** Raw --base-url, so the default is not written to the credentials file. */
+    baseUrlOverride: string | undefined;
+    workspaceUuid: string | undefined;
+    workspaceName: string | undefined;
+}): Promise<ResolvedWorkspace>;
+//# sourceMappingURL=session.d.ts.map

package/build/commands/auth/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/session.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,OAAO,EAAE,KAAK,iBAAiB,EAAoB,MAAM,gBAAgB,CAAC;AAE1E,eAAO,MAAM,gBAAgB,4BAA4B,CAAC;AAE1D,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMnE;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,MAAM,EAAE,cAAc,CAAC;IACvB,6EAA6E;IAC7E,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA4C7B"}

package/build/commands/auth/session.js

@@ -0,0 +1,55 @@
+import { saveCredentials } from "../../credentials.js";
+import { getOAuthConfig } from "../../oauthConfig.js";
+import { failWith } from "../runHandler.js";
+import { refreshAccessToken } from "./passwordless.js";
+import { resolveWorkspace } from "./workspace.js";
+export const DEFAULT_BASE_URL = "https://api.getcargo.io";
+export function resolveBaseUrl(override) {
+    if (override !== undefined && override.length > 0) {
+        return override;
+    }
+    return DEFAULT_BASE_URL;
+}
+/**
+ * Picks the workspace to work in and stores the signed-in session. Every
+ * sign-in channel ends here, so the credentials file looks the same however
+ * the user signed in.
+ *
+ * The access token is short-lived and deliberately not treated as the
+ * credential: the refresh token beside it is what keeps the CLI signed in, and
+ * it is renewed on demand rather than by minting an API token per machine.
+ */
+export async function establishSession(opts) {
+    const baseUrl = resolveBaseUrl(opts.baseUrlOverride);
+    const { workspace, wasCreated } = await resolveWorkspace({
+        baseUrl,
+        accessToken: opts.tokens.accessToken,
+        explicitUuid: opts.workspaceUuid,
+        explicitName: opts.workspaceName,
+    });
+    let { accessToken, refreshToken, expiresAt } = opts.tokens;
+    if (refreshToken === undefined) {
+        failWith("The identity provider issued no refresh token, so the CLI cannot keep this session alive. Enable the Refresh Token grant for the CLI application in Auth0, then sign in again.");
+    }
+    if (wasCreated === true) {
+        // The workspace list is a claim on the access token, so a workspace created
+        // moments ago is absent from the one we are holding and every request for
+        // it would be rejected. Only reissuing the token picks it up.
+        const refreshed = await refreshAccessToken({ refreshToken });
+        accessToken = refreshed.accessToken;
+        expiresAt = refreshed.expiresAt;
+        // Only a tenant that rotates refresh tokens returns a new one; keep the
+        // existing one otherwise, since it is still the valid one.
+        if (refreshed.refreshToken !== undefined) {
+            refreshToken = refreshed.refreshToken;
+        }
+    }
+    const { domain, clientId } = getOAuthConfig();
+    saveCredentials({
+        accessToken,
+        workspaceUuid: workspace.uuid,
+        baseUrl: opts.baseUrlOverride,
+        session: { refreshToken, expiresAt, domain, clientId },
+    });
+    return workspace;
+}

package/build/commands/auth/workspace.d.ts

@@ -1,10 +1,18 @@
+import { type WorkspaceManagement } from "@cargo-ai/api";
 export type ResolvedWorkspace = {
     uuid: string;
     name: string;
 };
+export type WorkspaceResolution = {
+    workspace: ResolvedWorkspace;
+    /** Callers need this: a new workspace is absent from the caller's token claims. */
+    wasCreated: boolean;
+};
 export declare function resolveWorkspace(opts: {
     baseUrl: string;
     accessToken: string;
     explicitUuid: string | undefined;
-}): Promise<ResolvedWorkspace>;
+    explicitName: string | undefined;
+}): Promise<WorkspaceResolution>;
+export declare function findWorkspaceByName(workspaces: readonly WorkspaceManagement.Workspace[], name: string): ResolvedWorkspace | undefined;
 //# sourceMappingURL=workspace.d.ts.map

package/build/commands/auth/workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/workspace.ts"],"names":[],"mappings":"AAeA,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAyBF,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAoH7B"}
+{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/workspace.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAYzD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,iBAAiB,CAAC;IAC7B,mFAAmF;IACnF,UAAU,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA2H/B;AAcD,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,SAAS,mBAAmB,CAAC,SAAS,EAAE,EACpD,IAAI,EAAE,MAAM,GACX,iBAAiB,GAAG,SAAS,CAY/B"}

package/build/commands/auth/workspace.js

@@ -1,41 +1,26 @@
-import * as fs from "node:fs";
 import * as readline from "node:readline/promises";
-import * as tty from "node:tty";
 import { createApi } from "../../api.js";
-import { ExitCodes, failWith, info, startSpinner, success, } from "../runHandler.js";
-// Interactive prompts must not assume stdin is a terminal: `curl | sh`
-// installers and agent-driven shells pipe stdin while the controlling
-// terminal stays reachable via /dev/tty. Prefer stdin when it is a TTY,
-// otherwise fall back to opening /dev/tty directly.
-function openPromptInput() {
-    if (process.stdin.isTTY === true) {
-        return { stream: process.stdin, close: () => undefined };
-    }
-    try {
-        const fd = fs.openSync("/dev/tty", "r");
-        const stream = new tty.ReadStream(fd);
-        return { stream, close: () => stream.destroy() };
-    }
-    catch {
-        return undefined;
-    }
-}
+import { askQuestion, openPromptInput } from "../../utils/prompt.js";
+import { ExitCodes, failWith, handleApiCall, info, success, } from "../runHandler.js";
 export async function resolveWorkspace(opts) {
+    const accessToken = opts.accessToken;
     const api = createApi({
         baseUrl: opts.baseUrl,
-        accessToken: opts.accessToken,
+        getAccessToken: () => Promise.resolve(accessToken),
         workspaceUuid: undefined,
     });
-    let workspaces;
-    try {
-        const result = await api.workspaceManagement.workspace.all({
-            refresh: false,
-        });
-        workspaces = result.workspaces;
-    }
-    catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        failWith(`Failed to list workspaces: ${message}`);
+    const { workspaces } = await handleApiCall(() => api.workspaceManagement.workspace.all({ refresh: false }), { spinner: "Loading workspaces..." });
+    if (opts.explicitName !== undefined && opts.explicitName.length > 0) {
+        // Reuse a same-named workspace rather than creating a duplicate, so that
+        // re-running a non-interactive sign-in is idempotent as documented.
+        const existingWorkspace = findWorkspaceByName(workspaces, opts.explicitName);
+        if (existingWorkspace !== undefined) {
+            return { workspace: existingWorkspace, wasCreated: false };
+        }
+        return {
+            workspace: await createWorkspace(api, opts.explicitName),
+            wasCreated: true,
+        };
     }
     if (opts.explicitUuid !== undefined) {
         const matchedWorkspace = workspaces.find((workspace) => {
@@ -44,16 +29,20 @@ export async function resolveWorkspace(opts) {
         if (matchedWorkspace === undefined) {
             failWith(`Workspace ${opts.explicitUuid} is not in your accessible workspaces.`, { code: ExitCodes.NotFound });
         }
-        return { uuid: matchedWorkspace.uuid, name: matchedWorkspace.name };
+        return {
+            workspace: { uuid: matchedWorkspace.uuid, name: matchedWorkspace.name },
+            wasCreated: false,
+        };
     }
     if (workspaces.length === 0) {
         const promptInput = openPromptInput();
         if (promptInput === undefined) {
-            failWith("No workspaces found.", { code: ExitCodes.NotFound });
+            failWith("No workspaces found. Re-run with --workspace-name <name> to create one.", { code: ExitCodes.NotFound });
         }
         let name;
         try {
-            name = await promptWorkspaceName(promptInput.stream);
+            info("You don't have any workspaces yet. Let's create one.");
+            name = await askQuestion(promptInput.stream, "Workspace name (or press Enter to skip): ");
         }
         finally {
             promptInput.close();
@@ -63,31 +52,19 @@ export async function resolveWorkspace(opts) {
                 code: ExitCodes.InvalidUsage,
             });
         }
-        const spinner = startSpinner("Creating workspace...");
-        let createdWorkspace;
-        try {
-            createdWorkspace = await api.workspaceManagement.workspace.create({
-                name,
-            });
-        }
-        catch (err) {
-            spinner.stop();
-            const message = err instanceof Error ? err.message : String(err);
-            failWith(`Failed to create workspace: ${message}`);
-        }
-        spinner.stop();
-        success(`Created workspace: ${createdWorkspace.workspace.name} (${createdWorkspace.workspace.uuid})`);
-        return {
-            uuid: createdWorkspace.workspace.uuid,
-            name: createdWorkspace.workspace.name,
-        };
+        const workspace = await createWorkspace(api, name);
+        success(`Created workspace: ${workspace.name} (${workspace.uuid})`);
+        return { workspace, wasCreated: true };
     }
     if (workspaces.length === 1) {
         const [firstWorkspace] = workspaces;
         if (firstWorkspace === undefined) {
             failWith("Unexpected empty workspace list after length check.");
         }
-        return { uuid: firstWorkspace.uuid, name: firstWorkspace.name };
+        return {
+            workspace: { uuid: firstWorkspace.uuid, name: firstWorkspace.name },
+            wasCreated: false,
+        };
     }
     const promptInput = openPromptInput();
     if (promptInput === undefined) {
@@ -103,25 +80,21 @@ export async function resolveWorkspace(opts) {
     if (selectedWorkspace === undefined) {
         failWith("No workspace selected.", { code: ExitCodes.InvalidUsage });
     }
-    return selectedWorkspace;
+    return { workspace: selectedWorkspace, wasCreated: false };
 }
-async function promptWorkspaceName(input) {
-    const rl = readline.createInterface({
-        input,
-        output: process.stderr,
+async function createWorkspace(api, name) {
+    const result = await handleApiCall(() => api.workspaceManagement.workspace.create({ name }), { spinner: "Creating workspace..." });
+    return { uuid: result.workspace.uuid, name: result.workspace.name };
+}
+export function findWorkspaceByName(workspaces, name) {
+    const wanted = name.trim().toLowerCase();
+    const matched = workspaces.find((workspace) => {
+        return workspace.name.trim().toLowerCase() === wanted;
     });
-    try {
-        info("You don't have any workspaces yet. Let's create one.");
-        const answer = await rl.question("Workspace name (or press Enter to skip): ");
-        const trimmed = answer.trim();
-        if (trimmed === "") {
-            return undefined;
-        }
-        return trimmed;
-    }
-    finally {
-        rl.close();
+    if (matched === undefined) {
+        return undefined;
     }
+    return { uuid: matched.uuid, name: matched.name };
 }
 async function promptWorkspaceSelection(workspaces, input) {
     const rl = readline.createInterface({

package/build/commands/billing/addPaymentMethod.d.ts

@@ -0,0 +1,26 @@
+import { type Billing } from "@cargo-ai/api";
+import type { Api } from "../../api.js";
+export declare const DEFAULT_TIMEOUT_SECONDS = 300;
+export declare const DEFAULT_POLL_INTERVAL_SECONDS = 3;
+export type AddPaymentMethodOptions = {
+    timeout: number;
+    pollInterval: number;
+    open: boolean;
+};
+/**
+ * Hands card entry off to Stripe's hosted billing portal and waits for the card
+ * on file to change.
+ *
+ * The card never touches this process: the CLI only ever sees the last four
+ * digits that the API already exposes. Polling is what makes the handoff usable
+ * from a script — the caller gets a definite answer instead of having to guess
+ * whether the human finished.
+ */
+export declare function runAddPaymentMethod(api: Api, opts: AddPaymentMethodOptions): Promise<void>;
+/**
+ * Stripe never exposes a raw card number here, so a change is detected from the
+ * fields the API does return. Replacing a card with the very same one is
+ * therefore indistinguishable from doing nothing, and the command times out.
+ */
+export declare function fingerprintCard(card: Billing.CreditCard | undefined): string;
+//# sourceMappingURL=addPaymentMethod.d.ts.map

package/build/commands/billing/addPaymentMethod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"addPaymentMethod.d.ts","sourceRoot":"","sources":["../../../src/commands/billing/addPaymentMethod.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAWxC,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAE/C,MAAM,MAAM,uBAAuB,GAAG;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;CACf,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAgDf;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,GAAG,SAAS,GAAG,MAAM,CAW5E"}