@cef-ai/cli 0.2.7 → 0.3.0

package/dist/typegen/fetch.js

@@ -0,0 +1,38 @@
+import crypto from "node:crypto";
+/**
+ * GET `<baseUrl>/<suffix>` and validate the response. Used by `cef typegen`
+ * to fetch model and peer-agent manifests declared in `cef.config.ts`.
+ *
+ * - Redirects are followed transparently (Node's built-in `fetch` does this
+ *   by default with `redirect: "follow"`).
+ * - Content-Type is required to include `json` — anything else (HTML
+ *   error page, plain text) is treated as a typegen failure rather than
+ *   blindly trying to JSON.parse the bytes.
+ * - Non-2xx status codes throw with a `[cef typegen] fetch <url> → <status>`
+ *   message so the CLI surfaces the failing URL to the author.
+ */
+export async function fetchJson(baseUrl, suffix) {
+    // `new URL(rel, base)` requires the base to end with `/` for the path to
+    // be appended rather than replacing the last segment.
+    const baseWithSlash = baseUrl.endsWith("/") ? baseUrl : baseUrl + "/";
+    const url = new URL(suffix, baseWithSlash).href;
+    const res = await fetch(url, { redirect: "follow" });
+    if (!res.ok) {
+        throw new Error(`[cef typegen] fetch ${url} → ${res.status}`);
+    }
+    const ct = res.headers.get("content-type") ?? "";
+    if (!ct.toLowerCase().includes("json")) {
+        throw new Error(`[cef typegen] fetch ${url} → non-JSON content-type "${ct}"`);
+    }
+    const body = await res.text();
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch (err) {
+        throw new Error(`[cef typegen] fetch ${url} → invalid JSON: ${err.message}`);
+    }
+    const integrity = "sha256-" + crypto.createHash("sha256").update(body).digest("base64");
+    return { body, parsed, resolvedUrl: res.url, integrity };
+}
+//# sourceMappingURL=fetch.js.map

package/dist/typegen/fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.js","sourceRoot":"","sources":["../../src/typegen/fetch.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAmBjC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAe,EACf,MAAsC;IAEtC,yEAAyE;IACzE,sDAAsD;IACtD,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,GAAG,CAAC;IACtE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC;IAEhD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,uBAAuB,GAAG,6BAA6B,EAAE,GAAG,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,uBAAuB,GAAG,oBAAqB,GAAa,CAAC,OAAO,EAAE,CACvE,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GACb,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAExE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC;AAC3D,CAAC"}

package/dist/typegen/lockfile.d.ts

@@ -0,0 +1,42 @@
+/**
+ * `cef.lock.json` schema, version 1.
+ *
+ * Modelled after the lockfile shape sketched in the SDK proposal: every
+ * fetched artefact (model spec, peer manifest) gets one entry keyed by the
+ * alias the user gave it in `cef.config.ts`. The entry records both the
+ * declared URL (which may carry a semver range like `agent@^1`) and the
+ * post-resolution / post-redirect URL the runtime should pin to.
+ *
+ * `integrity` is `sha256-<base64>` over the raw fetched bytes — same form
+ * Subresource Integrity uses, so existing tooling can validate it.
+ */
+export interface CefLockfile {
+    version: 1;
+    models: Record<string, LockEntry>;
+    uses: Record<string, LockEntry>;
+}
+export interface LockEntry {
+    /** URL exactly as declared in `cef.config.ts`. */
+    url: string;
+    /** Post-redirect / post-semver-resolution URL. */
+    resolvedUrl: string;
+    /** `sha256-<base64>` of the fetched body. */
+    integrity: string;
+    /** ISO 8601 timestamp at which the artefact was fetched. */
+    fetchedAt: string;
+}
+/**
+ * Read a lockfile from disk. Returns `null` if the file does not exist
+ * (first run) or fails to parse (corrupt — caller decides whether to
+ * regenerate or surface). The `version` field is verified; future format
+ * bumps will live behind explicit migration code rather than silently
+ * accepting older shapes.
+ */
+export declare function readLockfile(path: string): Promise<CefLockfile | null>;
+/**
+ * Write the lockfile as pretty-printed, key-sorted JSON with a trailing
+ * newline. Sorted keys keep diffs stable across runs even when the
+ * iteration order of `models` / `uses` differs.
+ */
+export declare function writeLockfile(path: string, lock: CefLockfile): Promise<void>;
+//# sourceMappingURL=lockfile.d.ts.map

package/dist/typegen/lockfile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockfile.d.ts","sourceRoot":"","sources":["../../src/typegen/lockfile.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,CAAC,CAAC;IACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,SAAS;IACxB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,WAAW,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAsB5E;AAeD;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/dist/typegen/lockfile.js

@@ -0,0 +1,58 @@
+import fs from "node:fs/promises";
+/**
+ * Read a lockfile from disk. Returns `null` if the file does not exist
+ * (first run) or fails to parse (corrupt — caller decides whether to
+ * regenerate or surface). The `version` field is verified; future format
+ * bumps will live behind explicit migration code rather than silently
+ * accepting older shapes.
+ */
+export async function readLockfile(path) {
+    let raw;
+    try {
+        raw = await fs.readFile(path, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return null;
+        throw err;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!parsed ||
+        typeof parsed !== "object" ||
+        parsed.version !== 1) {
+        return null;
+    }
+    return parsed;
+}
+/**
+ * Sort an object's keys for stable JSON output. We do this recursively for
+ * `models` / `uses` records so a re-run with no changes produces a
+ * byte-identical lockfile (good for diffs and content-addressing).
+ */
+function sortKeys(obj) {
+    const sorted = {};
+    for (const k of Object.keys(obj).sort()) {
+        sorted[k] = obj[k];
+    }
+    return sorted;
+}
+/**
+ * Write the lockfile as pretty-printed, key-sorted JSON with a trailing
+ * newline. Sorted keys keep diffs stable across runs even when the
+ * iteration order of `models` / `uses` differs.
+ */
+export async function writeLockfile(path, lock) {
+    const out = {
+        version: 1,
+        models: sortKeys(lock.models),
+        uses: sortKeys(lock.uses),
+    };
+    await fs.writeFile(path, JSON.stringify(out, null, 2) + "\n", "utf8");
+}
+//# sourceMappingURL=lockfile.js.map

package/dist/typegen/lockfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockfile.js","sourceRoot":"","sources":["../../src/typegen/lockfile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AA+BlC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,CAAC,MAAM;QACP,OAAO,MAAM,KAAK,QAAQ;QACzB,MAAgC,CAAC,OAAO,KAAK,CAAC,EAC/C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAqB,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAoC,GAAM;IACzD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAW,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,IAAiB;IAEjB,MAAM,GAAG,GAAgB;QACvB,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QAC7B,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;KAC1B,CAAC;IACF,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AACxE,CAAC"}

package/dist/typegen/schema-to-ts.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Compile a JSON Schema into a TypeScript interface declaration string.
+ *
+ * Wraps `json-schema-to-typescript`'s `compile` with the defaults the rest
+ * of the CLI assumes:
+ *
+ * - `bannerComment: ""` — we add our own banner once at the top of the
+ *   generated file rather than per interface.
+ * - `additionalProperties: false` — typegen output should be strict by
+ *   default; if a schema permits extra properties it can declare them
+ *   itself with `additionalProperties: true`.
+ * - `format: false` — we already format the assembled output once at the
+ *   end of `buildGeneratedDts`, so per-interface prettier passes are wasted
+ *   work (and a perf cost on big schemas).
+ *
+ * Returns the raw output string (one or more `export interface` blocks,
+ * potentially with helper aliases for nested objects). Callers concatenate
+ * the returned strings into the final `.cef/generated.d.ts` body.
+ */
+export declare function schemaToTsInterface(name: string, schema: unknown): Promise<string>;
+//# sourceMappingURL=schema-to-ts.d.ts.map

package/dist/typegen/schema-to-ts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-to-ts.d.ts","sourceRoot":"","sources":["../../src/typegen/schema-to-ts.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,MAAM,CAAC,CAOjB"}

package/dist/typegen/schema-to-ts.js

@@ -0,0 +1,29 @@
+import { compile } from "json-schema-to-typescript";
+/**
+ * Compile a JSON Schema into a TypeScript interface declaration string.
+ *
+ * Wraps `json-schema-to-typescript`'s `compile` with the defaults the rest
+ * of the CLI assumes:
+ *
+ * - `bannerComment: ""` — we add our own banner once at the top of the
+ *   generated file rather than per interface.
+ * - `additionalProperties: false` — typegen output should be strict by
+ *   default; if a schema permits extra properties it can declare them
+ *   itself with `additionalProperties: true`.
+ * - `format: false` — we already format the assembled output once at the
+ *   end of `buildGeneratedDts`, so per-interface prettier passes are wasted
+ *   work (and a perf cost on big schemas).
+ *
+ * Returns the raw output string (one or more `export interface` blocks,
+ * potentially with helper aliases for nested objects). Callers concatenate
+ * the returned strings into the final `.cef/generated.d.ts` body.
+ */
+export async function schemaToTsInterface(name, schema) {
+    const out = await compile(schema, name, {
+        bannerComment: "",
+        additionalProperties: false,
+        format: false,
+    });
+    return out.trim();
+}
+//# sourceMappingURL=schema-to-ts.js.map

package/dist/typegen/schema-to-ts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-to-ts.js","sourceRoot":"","sources":["../../src/typegen/schema-to-ts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAmB,MAAM,2BAA2B,CAAC;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,MAAe;IAEf,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAoB,EAAE,IAAI,EAAE;QACpD,aAAa,EAAE,EAAE;QACjB,oBAAoB,EAAE,KAAK;QAC3B,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC"}

package/package.json

@@ -1,70 +1,32 @@
 {
   "name": "@cef-ai/cli",
-  "version": "0.2.7",
-  "description": "CEF AI command-line interface",
+  "version": "0.3.0",
   "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "bin": {
-    "cef": "dist/cli.js",
-    "cef-deploy": "dist/cli.js"
+    "cef": "./dist/cli.js"
   },
   "files": [
-    "dist/",
-    "README.md",
-    "example/agents",
-    "example/engagements",
-    "example/queries",
-    "example/.env.example",
-    "example/cef.config.yaml"
+    "dist"
   ],
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/CEF-AI/deploy-sdk"
-  },
-  "homepage": "https://github.com/CEF-AI/deploy-sdk#readme",
-  "keywords": [
-    "cef",
-    "cef-ai",
-    "deploy",
-    "cli",
-    "cere"
-  ],
-  "scripts": {
-    "build": "tsc && cp -r src/commands/dev/static dist/commands/dev/static",
-    "prepublishOnly": "npm run build",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "test:coverage": "vitest run --coverage",
-    "test:integration": "vitest run --config vitest.integration.config.ts",
-    "test:e2e": "vitest run --config vitest.e2e.config.ts",
-    "typecheck": "tsc --noEmit",
-    "lint": "eslint src tests",
-    "dev": "tsx src/cli.ts"
+  "publishConfig": {
+    "access": "public"
   },
   "dependencies": {
-    "better-sqlite3": "^12.8.0",
-    "esbuild": "^0.25.0",
-    "chalk": "^5.6.2",
-    "commander": "^14.0.3",
-    "dotenv": "^16.4.5",
-    "ora": "^9.3.0",
-    "sqlite-vec": "^0.1.9",
-    "typescript": "^5.4.5",
-    "ws": "^8.20.0",
-    "yaml": "^2.8.3"
+    "commander": "^12.0.0",
+    "esbuild": "^0.21.0",
+    "json-schema-to-typescript": "^14.0.0",
+    "typescript": "^5.4.0",
+    "@cef-ai/agent-sdk": "0.1.0"
   },
   "devDependencies": {
-    "@eslint/js": "^9.15.0",
-    "@types/better-sqlite3": "^7.6.13",
-    "@types/node": "^20.14.0",
-    "@types/ws": "^8.18.1",
-    "@vitest/coverage-v8": "^4.1.0",
-    "eslint": "^9.15.0",
-    "tsx": "^4.15.7",
-    "typescript-eslint": "^8.15.0",
-    "vitest": "^4.1.0"
+    "@types/node": "^20.11.0",
+    "vitest": "^1.5.0"
   },
-  "engines": {
-    "node": ">=18.0.0"
-  },
-  "license": "Apache-2.0"
-}
+  "scripts": {
+    "build": "tsc -b && chmod +x dist/cli.js",
+    "test": "vitest run",
+    "lint": "eslint src"
+  }
+}

package/dist/commands/auth/index.d.ts

@@ -1,2 +0,0 @@
-import { Command } from 'commander';
-export declare function registerAuthCommands(program: Command): void;

package/dist/commands/auth/index.js

@@ -1,162 +0,0 @@
-import http from 'http';
-import { exec } from 'child_process';
-import { saveCredentials, loadCredentials, clearCredentials, parseToken, getCredentialsPath, } from '../../lib/credentials.js';
-const DEFAULT_ROB_URL = 'https://rob.compute.test.ddcdragon.com';
-const LOGIN_TIMEOUT_MS = 300_000;
-function openBrowser(url) {
-    const cmd = process.platform === 'darwin'
-        ? `open "${url}"`
-        : process.platform === 'win32'
-            ? `start "" "${url}"`
-            : `xdg-open "${url}"`;
-    exec(cmd, (err) => {
-        if (err) {
-            console.log(`  Could not open browser automatically.`);
-            console.log(`  Open this URL manually:\n  ${url}\n`);
-        }
-    });
-}
-function saveAndPrint(token) {
-    const parsed = parseToken(token);
-    if (!parsed) {
-        console.error('  Error: Invalid token format. Expected: base64.base64.signature');
-        process.exit(1);
-    }
-    const expiresAt = new Date(parsed.expiresAt).getTime();
-    if (expiresAt <= Date.now()) {
-        console.error('  Error: Token is already expired.');
-        process.exit(1);
-    }
-    saveCredentials({
-        email: parsed.email,
-        publicKey: parsed.publicKey,
-        token,
-        expiresAt: parsed.expiresAt,
-    });
-    const expiresIn = Math.round((expiresAt - Date.now()) / 3600000);
-    console.log(`\n  Logged in as ${parsed.email}`);
-    console.log(`  Token expires in ~${expiresIn}h`);
-    console.log(`  Credentials saved to ${getCredentialsPath()}\n`);
-}
-function loginWithCallback(robUrl) {
-    return new Promise((resolve, reject) => {
-        let port = 0;
-        const server = http.createServer((req, res) => {
-            // CORS preflight
-            if (req.method === 'OPTIONS') {
-                res.writeHead(204, {
-                    'Access-Control-Allow-Origin': '*',
-                    'Access-Control-Allow-Methods': 'POST',
-                    'Access-Control-Allow-Headers': 'Content-Type',
-                });
-                res.end();
-                return;
-            }
-            if (req.method === 'POST' && req.url === '/callback') {
-                let body = '';
-                req.on('data', (chunk) => { body += chunk; });
-                req.on('end', () => {
-                    try {
-                        const { token } = JSON.parse(body);
-                        if (!token)
-                            throw new Error('Missing token');
-                        res.writeHead(200, {
-                            'Content-Type': 'application/json',
-                            'Access-Control-Allow-Origin': '*',
-                        });
-                        res.end(JSON.stringify({ ok: true }));
-                        saveAndPrint(token);
-                        server.close();
-                        resolve();
-                    }
-                    catch {
-                        res.writeHead(400, {
-                            'Content-Type': 'application/json',
-                            'Access-Control-Allow-Origin': '*',
-                        });
-                        res.end(JSON.stringify({ error: 'Invalid request' }));
-                    }
-                });
-                return;
-            }
-            res.writeHead(404);
-            res.end();
-        });
-        server.on('error', (err) => {
-            reject(err);
-        });
-        server.listen(0, '127.0.0.1', () => {
-            const addr = server.address();
-            port = typeof addr === 'object' ? addr.port : 0;
-            const authUrl = `${robUrl}/#/cli-auth?port=${port}`;
-            console.log(`\n  Opening browser for authentication...`);
-            console.log(`  If the browser doesn't open, visit:\n  ${authUrl}\n`);
-            console.log(`  Waiting for login...`);
-            openBrowser(authUrl);
-        });
-        const timeout = setTimeout(() => {
-            server.close();
-            reject(new Error('Login timed out. Try again with: cef login'));
-        }, LOGIN_TIMEOUT_MS);
-        server.on('close', () => clearTimeout(timeout));
-    });
-}
-async function handleLogin(opts) {
-    if (opts.token) {
-        saveAndPrint(opts.token);
-        return;
-    }
-    await loginWithCallback(DEFAULT_ROB_URL);
-}
-function handleLogout() {
-    const cleared = clearCredentials();
-    if (cleared) {
-        console.log('\n  Logged out. Credentials cleared.\n');
-    }
-    else {
-        console.log('\n  Not logged in (no credentials found).\n');
-    }
-}
-function handleWhoami() {
-    const creds = loadCredentials();
-    if (!creds) {
-        console.log('\n  Not logged in. Run `cef login` to authenticate.\n');
-        return;
-    }
-    const expiresAt = new Date(creds.expiresAt);
-    const msLeft = expiresAt.getTime() - Date.now();
-    const hoursLeft = Math.max(0, Math.round(msLeft / 3600000));
-    const minutesLeft = Math.max(0, Math.round(msLeft / 60000));
-    console.log(`\n  Email:      ${creds.email}`);
-    console.log(`  Public Key: ${creds.publicKey}`);
-    if (minutesLeft < 60) {
-        console.log(`  Expires in: ${minutesLeft} minutes`);
-    }
-    else {
-        console.log(`  Expires in: ~${hoursLeft} hours`);
-    }
-    console.log(`  Stored at:  ${getCredentialsPath()}\n`);
-}
-export function registerAuthCommands(program) {
-    program
-        .command('login')
-        .description('Authenticate with CEF platform')
-        .option('--token <token>', 'Manually provide a bearer token')
-        .action(async (opts) => {
-        try {
-            await handleLogin(opts);
-        }
-        catch (err) {
-            console.error(`\n  Login failed: ${err.message}\n`);
-            process.exit(1);
-        }
-    });
-    program
-        .command('logout')
-        .description('Clear stored credentials')
-        .action(() => handleLogout());
-    program
-        .command('whoami')
-        .description('Show current authentication status')
-        .action(() => handleWhoami());
-}

package/dist/commands/deploy/clone.d.ts

@@ -1,13 +0,0 @@
-import type { EnvConfig } from '../../lib/types.js';
-export interface CloneOptions {
-    pubkey: string;
-    outputDir: string;
-    force: boolean;
-}
-export interface CloneResult {
-    entity: string;
-    name: string;
-    action: 'written' | 'skipped' | 'fetched';
-    file?: string;
-}
-export declare function runClone(env: EnvConfig, options: CloneOptions): Promise<CloneResult[]>;

package/dist/commands/deploy/clone.js

@@ -1,143 +0,0 @@
-import fs from 'fs';
-import path from 'path';
-import { stringify } from 'yaml';
-import { createApiClient } from '../../lib/api.js';
-import { toFileName, errorMessage } from '../../lib/utils.js';
-function writeFileIfAllowed(filePath, content, force, allowedBase) {
-    if (allowedBase) {
-        const resolved = path.resolve(filePath);
-        const base = path.resolve(allowedBase);
-        if (!resolved.startsWith(base + path.sep) && resolved !== base) {
-            throw new Error(`Path traversal detected: ${filePath} escapes ${allowedBase}`);
-        }
-    }
-    if (fs.existsSync(filePath) && !force)
-        return 'skipped';
-    fs.mkdirSync(path.dirname(filePath), { recursive: true });
-    fs.writeFileSync(filePath, content, 'utf8');
-    return 'written';
-}
-async function safeFetch(label, fn) {
-    try {
-        return await fn();
-    }
-    catch (err) {
-        console.warn(`Warning: Could not fetch ${label}: ${errorMessage(err)}`);
-        return null;
-    }
-}
-export async function runClone(env, options) {
-    const { pubkey, outputDir, force } = options;
-    const api = createApiClient(env, pubkey);
-    const results = [];
-    // Fetch in parallel
-    const [engagementsRes, agentsRes, ontologyRes, cubbiesRes] = await Promise.all([
-        safeFetch('engagements', () => api.getEngagements()),
-        safeFetch('agents', () => api.getAgents()),
-        safeFetch('ontology', () => api.getOntology()),
-        safeFetch('cubbies', () => api.getCubbies()),
-    ]);
-    const allAgents = agentsRes?.data ?? [];
-    const engagements = engagementsRes?.data ?? [];
-    // Separate concierge agents from user agents
-    const conciergeMap = new Map(allAgents.filter(a => a.isConcierge).map(a => [a.agentId, a]));
-    const userAgents = allAgents.filter(a => !a.isConcierge);
-    // ─── Write engagement files ────────────────────────────────────────────
-    const engagementConfigs = engagements.map(eng => {
-        const concierge = conciergeMap.get(eng.conciergeAgentId);
-        const tsCode = concierge?.tasks[0]?.tsCode ?? '';
-        let fileName = `${toFileName(eng.name)}.ts`;
-        if (fileName === 'unknown.ts')
-            fileName = `unknown-${eng.engagementId}.ts`;
-        const relPath = `./engagements/${fileName}`;
-        const absPath = path.join(outputDir, 'engagements', fileName);
-        if (tsCode) {
-            const action = writeFileIfAllowed(absPath, tsCode, force, outputDir);
-            results.push({ entity: 'engagement', name: eng.name, action, file: relPath });
-        }
-        return {
-            name: eng.name,
-            description: eng.description || undefined,
-            engagementId: eng.engagementId,
-            file: relPath,
-            version: eng.version || '1.0.0',
-        };
-    });
-    // ─── Write agent task files ────────────────────────────────────────────
-    const agentConfigs = userAgents.map(agent => {
-        const tasks = agent.tasks.map(task => {
-            let taskFileName = `${toFileName(task.alias)}.ts`;
-            if (taskFileName === 'unknown.ts')
-                taskFileName = `unknown-${task.id}.ts`;
-            const relPath = `./agents/${agent.alias}/tasks/${taskFileName}`;
-            const absPath = path.join(outputDir, 'agents', agent.alias, 'tasks', taskFileName);
-            if (task.tsCode) {
-                const action = writeFileIfAllowed(absPath, task.tsCode, force, outputDir);
-                results.push({ entity: 'agent-task', name: `${agent.name}/${task.name}`, action, file: relPath });
-            }
-            return {
-                name: task.name,
-                alias: task.alias,
-                file: relPath,
-                parameters: task.parameters,
-                returns: task.returns,
-            };
-        });
-        return {
-            name: agent.name,
-            alias: agent.alias,
-            description: agent.description || undefined,
-            agentId: agent.agentId,
-            version: agent.version || '1.0.0',
-            tasks,
-        };
-    });
-    // ─── Map ontology to workspace config ──────────────────────────────────
-    const workspaceConfigs = ontologyRes?.workspaces?.map(ws => ({
-        name: ws.name,
-        description: ws.description || undefined,
-        workspaceId: ws.workspaceId,
-        streams: ws.streams?.map(s => ({
-            name: s.name,
-            description: s.description || undefined,
-            streamId: s.streamId,
-            selectors: s.selectors?.length ? s.selectors : undefined,
-            deployments: s.deployments?.map(d => ({
-                name: d.name,
-                description: d.description || undefined,
-                deploymentId: d.deploymentId,
-                engagement: d.engagements?.[0]?.name ?? '',
-                isActive: d.isActive,
-                triggers: d.triggers?.length ? d.triggers : undefined,
-            })),
-        })),
-    }));
-    // ─── Map remote cubbies to config ───────────────────────────────────────
-    const remoteCubbies = cubbiesRes ?? [];
-    const cubbyConfigs = remoteCubbies.map(cubby => ({
-        alias: cubby.alias,
-        name: cubby.name,
-        description: cubby.description || undefined,
-        cubbyId: cubby.cubbyId,
-        migrations: cubby.migrations,
-        maxSizeBytes: cubby.maxSizeBytes,
-        idleTimeout: cubby.idleTimeout,
-    }));
-    // ─── Build config ──────────────────────────────────────────────────────
-    const config = {
-        agentServicePubKey: pubkey,
-    };
-    if (engagementConfigs.length)
-        config.engagements = engagementConfigs;
-    if (agentConfigs.length)
-        config.agents = agentConfigs;
-    if (cubbyConfigs.length)
-        config.cubbies = cubbyConfigs;
-    if (workspaceConfigs && workspaceConfigs.length)
-        config.workspaces = workspaceConfigs;
-    // Write config file (respects --force)
-    const configPath = path.join(outputDir, 'cef.config.yaml');
-    const configAction = writeFileIfAllowed(configPath, stringify(config), force);
-    results.push({ entity: 'config', name: 'cef.config.yaml', action: configAction, file: configPath });
-    return results;
-}

package/dist/commands/deploy/delete.d.ts

@@ -1,14 +0,0 @@
-import type { ResolvedConfig } from '../../lib/types.js';
-export interface DeleteResult {
-    entity: string;
-    name: string;
-    id: string;
-    action: 'deleted' | 'skipped' | 'failed';
-    error?: string;
-}
-interface DeleteOptions {
-    only?: string;
-    force?: boolean;
-}
-export declare function runDelete(resolved: ResolvedConfig, options: DeleteOptions): Promise<DeleteResult[]>;
-export {};