@clawscarf/cli 0.1.0-alpha.1

package/scripts/clawscarf.js

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+import { OperatorError } from "./errors.js";
+import { ModelConfigurationError } from "../runtime/model-contract.js";
+import { CommanderError } from "commander";
+import { ZodError } from "zod";
+import { InstallationError } from "./installation/errors.js";
+import { LocalSetupError } from "./deployment/process.js";
+import { LocalDatabaseError } from "./deployment/database.js";
+import { InstallerCancelled } from "./installation/installer/prompts.js";
+import { installationCommand } from "./installation/command.js";
+const program = installationCommand();
+const commands = [program];
+for (const command of commands) {
+    command.exitOverride().configureOutput({ outputError: () => { } });
+    commands.push(...command.commands);
+}
+try {
+    await program.parseAsync();
+}
+catch (error) {
+    if (error instanceof CommanderError && error.exitCode === 0)
+        process.exit(0);
+    const known = error instanceof OperatorError ||
+        error instanceof InstallationError ||
+        error instanceof LocalSetupError ||
+        error instanceof LocalDatabaseError ||
+        error instanceof ModelConfigurationError;
+    const remote = typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        typeof error.code === "string" &&
+        "detail" in error &&
+        typeof error.detail === "string"
+        ? { code: error.code, detail: error.detail }
+        : null;
+    const fileFailure = error instanceof Error &&
+        "code" in error &&
+        "path" in error &&
+        typeof error.path === "string" &&
+        typeof error.code === "string" &&
+        [
+            "ENOENT",
+            "ENOTDIR",
+            "EACCES",
+            "EPERM",
+            "EEXIST",
+            "ELOOP",
+            "ENOSPC",
+        ].includes(error.code)
+        ? {
+            code: error.code,
+            detail: `File operation failed (${error.code}): ${JSON.stringify(error.path)}. Check the path, permissions and available disk space.`,
+        }
+        : undefined;
+    const failure = {
+        ...(error instanceof LocalSetupError && error.commandFailure
+            ? { command: error.commandFailure }
+            : {}),
+        code: fileFailure?.code ??
+            remote?.code ??
+            (error instanceof InstallerCancelled
+                ? "cancelled"
+                : known
+                    ? error.code
+                    : error instanceof ZodError
+                        ? "invalid_configuration"
+                        : error instanceof CommanderError
+                            ? "invalid_arguments"
+                            : "operation_failed"),
+        detail: fileFailure?.detail ??
+            remote?.detail ??
+            (error instanceof InstallerCancelled
+                ? "Cancelled. Saved files and any running installation are retained."
+                : error instanceof ModelConfigurationError
+                    ? `Model configuration failed (${error.code}).${error.code === "outcome_unknown" ? " Inspect native settings before retrying an apply." : ""}`
+                    : known
+                        ? error.message
+                        : error instanceof ZodError
+                            ? "Invalid or missing fields: " +
+                                [
+                                    ...new Set(error.issues.map((issue) => issue.path.join(".") || "configuration")),
+                                ].join(", ") +
+                                "."
+                            : error instanceof CommanderError
+                                ? error.message
+                                : "Check the configuration, file permissions and local prerequisites. No operation was automatically retried."),
+    };
+    process.stderr.write((program.opts().json
+        ? JSON.stringify(failure)
+        : `Error: ${failure.detail}`) + "\n");
+    process.exitCode = error instanceof InstallerCancelled ? 130 : 1;
+}

package/scripts/cloud/login.js

@@ -0,0 +1,134 @@
+import * as oidc from "openid-client";
+import { z } from "zod";
+import { rm } from "node:fs/promises";
+import { setTimeout as delay } from "node:timers/promises";
+import { createClient } from "../../generated/http/client/index.js";
+import { getCliIdentity } from "../../services/cloud/generated/sdk.gen.js";
+import { cloudUrlSchema } from "./url.js";
+import { readInputFile } from "../installation/files.js";
+import { writePrivate } from "../deployment/state.js";
+import { InstallationError } from "../installation/errors.js";
+const pendingSchema = z.strictObject({
+    cloudUrl: cloudUrlSchema,
+    issuer: z.url(),
+    clientId: z.string().min(1),
+    deviceCode: z.string().min(1),
+    userCode: z.string().regex(/^[A-Z0-9]{4}-[A-Z0-9]{4}$/),
+    expiresAt: z.number(),
+    interval: z.number().positive(),
+    nextPollAt: z.number(),
+    token: z.string().min(1).optional(),
+    tokenExpiresAt: z.number().optional(),
+});
+export class CloudAuthorizationRequired extends Error {
+    action;
+    constructor(action) {
+        super("Sign in to ClawScarf, then run configure again with the same directory.");
+        this.action = action;
+    }
+}
+/** The private OAuth challenge survives terminal exit; resuming never allocates another installation. */
+export async function authorizeCloud(cloudUrl, file, options) {
+    const client = createClient({
+        baseUrl: cloudUrlSchema.parse(cloudUrl),
+        redirect: "error",
+    });
+    const response = await getCliIdentity({
+        client,
+        signal: AbortSignal.any([
+            AbortSignal.timeout(10_000),
+            ...(options.signal ? [options.signal] : []),
+        ]),
+    });
+    if (!response.data)
+        throw new InstallationError("unavailable", "ClawScarf login is unavailable. Try again later.");
+    const identity = z
+        .object({
+        issuer: cloudUrlSchema.refine((value) => value.startsWith("https:")),
+        clientId: z.string().min(1),
+    })
+        .parse(response.data);
+    const configuration = await oidc.discovery(new URL(identity.issuer), identity.clientId, undefined, oidc.None(), { timeout: 10 });
+    let pending;
+    try {
+        pending = pendingSchema.parse(JSON.parse((await readInputFile(file, true)).toString("utf8")));
+    }
+    catch (error) {
+        if (!(error instanceof Error && "code" in error && error.code === "ENOENT"))
+            throw error;
+    }
+    if (pending &&
+        (pending.cloudUrl !== cloudUrl ||
+            pending.issuer !== identity.issuer ||
+            pending.clientId !== identity.clientId))
+        throw new InstallationError("invalid_configuration", "Pending authorization belongs to a different cloud identity provider.");
+    if (pending?.token) {
+        if (pending.tokenExpiresAt && pending.tokenExpiresAt > Date.now())
+            return pending.token;
+        pending = undefined;
+    }
+    if (!pending || pending.expiresAt <= Date.now()) {
+        const challenge = await oidc.initiateDeviceAuthorization(configuration, {
+            scope: "openid profile email",
+        });
+        pending = pendingSchema.parse({
+            cloudUrl,
+            ...identity,
+            deviceCode: challenge.device_code,
+            userCode: challenge.user_code,
+            expiresAt: Date.now() + challenge.expires_in * 1000,
+            interval: (challenge.interval ?? 5) * 1000,
+            nextPollAt: 0,
+        });
+        await writePrivate(file, JSON.stringify(pending));
+    }
+    const url = new URL("/setup", cloudUrl);
+    url.searchParams.set("code", pending.userCode);
+    const required = () => new CloudAuthorizationRequired({
+        url: url.href,
+        expiresAt: new Date(pending.expiresAt).toISOString(),
+        retryAfterSeconds: Math.max(1, Math.ceil((pending.nextPollAt - Date.now()) / 1000)),
+    });
+    await options.present?.(url.href, pending.userCode, new Date(pending.expiresAt).toISOString());
+    for (;;) {
+        options.signal?.throwIfAborted();
+        if (pending.expiresAt <= Date.now()) {
+            await rm(file, { force: true });
+            throw new InstallationError("unavailable", "Sign-in expired. Run configure again with the same directory for a new link.");
+        }
+        if (pending.nextPollAt > Date.now()) {
+            if (!options.wait)
+                throw required();
+            await delay(pending.nextPollAt - Date.now(), undefined, {
+                ...(options.signal ? { signal: options.signal } : {}),
+            });
+        }
+        pending.nextPollAt = Date.now() + pending.interval;
+        await writePrivate(file, JSON.stringify(pending));
+        try {
+            const tokens = await oidc.genericGrantRequest(configuration, "urn:ietf:params:oauth:grant-type:device_code", { device_code: pending.deviceCode });
+            pending.token = tokens.access_token;
+            pending.tokenExpiresAt = Date.now() + (tokens.expires_in ?? 60) * 1000;
+            await writePrivate(file, JSON.stringify(pending));
+            return pending.token;
+        }
+        catch (error) {
+            if (!(error instanceof oidc.ResponseBodyError))
+                throw error;
+            if (error.error === "slow_down") {
+                pending.interval += 5000;
+                pending.nextPollAt = Date.now() + pending.interval;
+                await writePrivate(file, JSON.stringify(pending));
+            }
+            else if (error.error !== "authorization_pending") {
+                if (["access_denied", "expired_token", "invalid_grant"].includes(error.error)) {
+                    await rm(file, { force: true });
+                    throw new InstallationError("invalid_configuration", "Sign-in was declined or expired. Run configure again with the same directory to retry.");
+                }
+                throw new InstallationError("unavailable", "Cloud authorization failed. Retry configure with the same directory.");
+            }
+            if (!options.wait)
+                throw required();
+        }
+    }
+}

package/scripts/cloud/registration.js

@@ -0,0 +1,232 @@
+import { randomBytes, randomUUID } from "node:crypto";
+import { dirname, join, resolve } from "node:path";
+import { mkdir, rm } from "node:fs/promises";
+import lockfile from "proper-lockfile";
+import { z } from "zod";
+import { createClient } from "../../generated/http/client/index.js";
+import { registerInstallation, getInstallationIdentity, getAccount, } from "../../services/cloud/generated/sdk.gen.js";
+import { cloudUrlSchema } from "./url.js";
+import { installationSchema, } from "../installation/configuration.js";
+import { readInputFile, readJson } from "../installation/files.js";
+import { writePrivate, ensurePrivateFile } from "../deployment/state.js";
+import { InstallationError } from "../installation/errors.js";
+const identitySchema = z.strictObject({
+    issuer: cloudUrlSchema,
+    clientId: z.string().min(1),
+    clientSecret: z.string().min(1),
+});
+const administratorSchema = z.strictObject({
+    issuer: cloudUrlSchema,
+    subject: z.string().min(1),
+    email: z.email(),
+});
+const registrationSchema = z.strictObject({
+    cloudUrl: cloudUrlSchema,
+    request: z.strictObject({
+        reference: z.uuid(),
+        name: z.string().min(1),
+        origin: cloudUrlSchema.nullable(),
+        managementSecret: z.string().min(43),
+        runtimeSecret: z.string().min(43),
+    }),
+    accountId: z.uuid().optional(),
+    installationId: z.uuid().optional(),
+    identity: identitySchema.optional(),
+    administrator: administratorSchema.optional(),
+});
+export async function readHostedRegistration(file) {
+    return registrationSchema.parse(JSON.parse((await readInputFile(file, true)).toString("utf8")));
+}
+/** Hosted login and Connections share registration only when they use the same service. */
+function connectionsRegistration(config) {
+    if (config.connections.mode !== "hosted")
+        return undefined;
+    return config.access.mode === "hosted" &&
+        config.access.cloudUrl === config.connections.cloudUrl
+        ? config.access
+        : config.connections;
+}
+export async function registerCloudServices(configFile, authorize) {
+    const config = installationSchema.parse(await readJson(configFile));
+    const connections = connectionsRegistration(config);
+    const selections = [
+        ...(config.access.mode === "hosted"
+            ? [{ ...config.access, login: true }]
+            : []),
+        ...(connections && connections !== config.access
+            ? [{ ...connections, login: false }]
+            : []),
+    ];
+    for (const selection of selections) {
+        const origin = selection.login
+            ? config.exposure.mode === "https"
+                ? config.exposure.applicationOrigin
+                : `http://127.0.0.1:${String(config.exposure.applicationPort)}`
+            : null;
+        await registerService(resolve(dirname(configFile), selection.registrationFile), selection.cloudUrl, config.name, origin, authorize, selection.login && !config.access.administratorSubject);
+    }
+}
+/** Persist intent before dispatch; retries reuse the same reference and keys. */
+async function registerService(path, cloudUrl, name, origin, authorize, claimAdministrator) {
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    const unlock = await lockfile.lock(dirname(path), {
+        lockfilePath: path + ".lock",
+        retries: 0,
+    });
+    try {
+        let registration;
+        try {
+            registration = await readHostedRegistration(path);
+        }
+        catch (error) {
+            if (!(error instanceof Error &&
+                "code" in error &&
+                error.code === "ENOENT"))
+                throw error;
+            registration = {
+                cloudUrl,
+                request: {
+                    reference: randomUUID(),
+                    name,
+                    origin,
+                    managementSecret: randomBytes(32).toString("base64url"),
+                    runtimeSecret: randomBytes(32).toString("base64url"),
+                },
+            };
+            await writePrivate(path, JSON.stringify(registration));
+        }
+        if (registration.cloudUrl !== cloudUrl ||
+            registration.request.origin !== origin ||
+            registration.request.name !== name)
+            throw new InstallationError("change_unsupported", "Saved cloud registration belongs to different settings. Do not replace it; use the original installation settings.");
+        if (registration.identity) {
+            await ensurePrivateFile(join(dirname(path), "hosted-oidc-secret"), registration.identity.clientSecret);
+            return;
+        }
+        const client = createClient({ baseUrl: cloudUrl, redirect: "error" });
+        if (!registration.installationId) {
+            const auth = await authorize(cloudUrl, path + ".login", claimAdministrator);
+            const account = await getAccount({
+                client,
+                auth,
+                signal: AbortSignal.timeout(10_000),
+            });
+            if (!account.data) {
+                if (account.response?.status === 401)
+                    await rm(path + ".login", { force: true });
+                throw new InstallationError("unavailable", "Cloud account could not be verified. Registration has not been dispatched.");
+            }
+            const { accountId, identity } = z
+                .object({
+                accountId: z.uuid(),
+                identity: administratorSchema.nullable(),
+            })
+                .parse(account.data);
+            if (registration.accountId && registration.accountId !== accountId)
+                throw new InstallationError("change_unsupported", "Resume registration with the original ClawScarf account.");
+            if (claimAdministrator && !identity)
+                throw new InstallationError("invalid_configuration", "A provisioning credential does not select an administrator. Supply --administrator-subject and --administrator-email during initial configuration, or sign in interactively.");
+            registration.accountId = accountId;
+            if (claimAdministrator && identity)
+                registration.administrator = identity;
+            await writePrivate(path, JSON.stringify(registration));
+            const result = await registerInstallation({
+                client,
+                auth,
+                body: registration.request,
+                signal: AbortSignal.timeout(60_000),
+            });
+            if (!result.data)
+                throw new InstallationError("unavailable", `Cloud registration was not confirmed (HTTP ${String(result.response?.status ?? "unavailable")}). Retry this installation with its saved settings.`);
+            const installation = z
+                .object({
+                id: z.uuid(),
+                origin: z.string().nullable(),
+                oidcState: z.enum([
+                    "ready",
+                    "pending",
+                    "provisioning",
+                    "failed",
+                    "uncertain",
+                    "disabled",
+                ]),
+            })
+                .parse(result.data);
+            if (installation.origin !== origin)
+                throw new InstallationError("invalid_configuration", "Cloud registration returned a different installation origin.");
+            registration.installationId = installation.id;
+            await writePrivate(path, JSON.stringify(registration));
+            if (origin && installation.oidcState !== "ready")
+                throw new InstallationError("unavailable", `Hosted login registration is ${installation.oidcState}. No new client will be allocated; contact the cloud operator.`);
+        }
+        await rm(path + ".login", { force: true });
+        if (!origin)
+            return;
+        const result = await getInstallationIdentity({
+            client,
+            auth: registration.request.managementSecret,
+            path: { id: registration.installationId },
+            signal: AbortSignal.timeout(15_000),
+        });
+        if (!result.data)
+            throw new InstallationError("unavailable", "Hosted login credentials are unavailable. The saved registration is retained; no keys are replaced.");
+        registration.identity = identitySchema.parse(result.data);
+        if (registration.administrator &&
+            registration.administrator.issuer !== registration.identity.issuer)
+            throw new InstallationError("invalid_configuration", "Administrator identity belongs to a different issuer.");
+        await ensurePrivateFile(join(dirname(path), "hosted-oidc-secret"), registration.identity.clientSecret);
+        await writePrivate(path, JSON.stringify(registration));
+    }
+    finally {
+        await unlock();
+    }
+}
+export async function hostedOidc(file) {
+    const registration = await readHostedRegistration(file);
+    if (!registration.identity)
+        throw new InstallationError("unavailable", "Hosted login registration is incomplete. Resume the installer or run configure again.");
+    if (registration.administrator &&
+        registration.administrator.issuer !== registration.identity.issuer)
+        throw new InstallationError("invalid_configuration", "Administrator identity belongs to a different issuer.");
+    const clientSecretFile = join(dirname(file), "hosted-oidc-secret");
+    if ((await readInputFile(clientSecretFile, true)).toString("utf8") !==
+        registration.identity.clientSecret)
+        throw new InstallationError("invalid_configuration", "Hosted OIDC credentials do not match the saved registration.");
+    return {
+        issuer: registration.identity.issuer,
+        clientId: registration.identity.clientId,
+        clientSecretFile,
+        ...(registration.administrator
+            ? {
+                administratorSubject: registration.administrator.subject,
+                administratorEmail: registration.administrator.email,
+            }
+            : {}),
+    };
+}
+export async function hostedConnections(config, configFile) {
+    const selected = connectionsRegistration(config);
+    if (!selected)
+        return undefined;
+    const file = resolve(dirname(configFile), selected.registrationFile);
+    const registration = await readHostedRegistration(file);
+    const origin = selected === config.access
+        ? config.exposure.mode === "https"
+            ? config.exposure.applicationOrigin
+            : `http://127.0.0.1:${String(config.exposure.applicationPort)}`
+        : null;
+    if (!registration.installationId ||
+        registration.cloudUrl !== selected.cloudUrl ||
+        registration.request.name !== config.name ||
+        registration.request.origin !== origin)
+        throw new InstallationError("invalid_configuration", "Connections registration is incomplete or belongs to another cloud service.");
+    const managementKeyFile = file + ".management-key";
+    const credentialFile = file + ".runtime-key";
+    await ensurePrivateFile(managementKeyFile, registration.request.managementSecret);
+    await ensurePrivateFile(credentialFile, registration.request.runtimeSecret);
+    return {
+        brokerUrl: `${registration.cloudUrl}/api/connections`,
+        managementKeyFile,
+        credentialFile,
+    };
+}

package/scripts/cloud/url.js

@@ -0,0 +1,9 @@
+import { z } from "zod";
+export const defaultCloudUrl = "https://cloud.clawscarf.com";
+export const cloudUrlSchema = z.url().refine((value) => {
+    const url = new URL(value);
+    return (url.origin === value &&
+        (url.protocol === "https:" ||
+            (url.protocol === "http:" &&
+                ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname))));
+}, "Use an HTTPS origin, or loopback HTTP for development.");

package/scripts/connections.js

@@ -0,0 +1,193 @@
+import { readFile } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { sessionRequest } from "./session.js";
+import * as api from "../services/connections/cloud/generated/sdk.gen.js";
+import { InstallationError } from "./installation/errors.js";
+import { writeResult } from "./output.js";
+export function connectionCommands(command, program) {
+    command
+        .description("Manage connected accounts and their agent access")
+        .option("--origin <url>", "Installation origin")
+        .option("--session-file <path>", "Private signed-in administrator session");
+    const output = (value, text) => {
+        writeResult(program, value, text);
+    };
+    async function request(revision) {
+        const base = await sessionRequest(command.opts());
+        return {
+            ...base,
+            headers: {
+                ...base.headers,
+                "idempotency-key": randomUUID(),
+                "if-match": `"${String(revision ?? 0)}"`,
+            },
+        };
+    }
+    const grant = (ids) => ids === undefined
+        ? { mode: "all" }
+        : {
+            mode: "selected",
+            agentIds: ids
+                .split(",")
+                .map((x) => x.trim())
+                .filter(Boolean),
+        };
+    command
+        .command("list")
+        .option("--all", "Include disconnected history")
+        .option("--cursor <cursor>", "Continue a previous page")
+        .action(async (options) => {
+        const result = (await api.listConnections({
+            ...(await request()),
+            query: {
+                limit: 100,
+                includeDisconnected: options.all ?? false,
+                ...(options.cursor ? { cursor: options.cursor } : {}),
+            },
+        })).data;
+        output(result, (result.items
+            .map((c) => `${c.name} · ${c.state} · ${c.id}`)
+            .join("\n") || "No connections.") +
+            (result.nextCursor ? `\nMore: --cursor ${result.nextCursor}` : ""));
+    });
+    command
+        .command("catalog")
+        .option("--query <text>", "Find a service")
+        .option("--cursor <cursor>", "Continue a previous page")
+        .action(async (options) => {
+        const result = (await api.listConnectors({
+            ...(await request()),
+            query: { limit: 100, ...options },
+        })).data;
+        output(result, result.items.map((c) => `${c.name} · ${c.id}`).join("\n") +
+            (result.nextCursor ? `\nMore: --cursor ${result.nextCursor}` : ""));
+    });
+    command.command("agents").action(async () => {
+        const result = (await api.listConnectionAgents(await request())).data;
+        output(result, result.agents.map((a) => a.name ?? a.id).join("\n"));
+    });
+    command
+        .command("add <connectorId>")
+        .option("--name <name>", "Connection name")
+        .option("--agents <ids>", "Comma-separated agent IDs; omitted means all agents")
+        .action(async (connectorId, options) => {
+        const result = (await api.createConnection({
+            ...(await request()),
+            body: {
+                connectorId,
+                name: options.name ?? connectorId,
+                grant: grant(options.agents),
+            },
+        })).data;
+        output(result, `${result.name} created · ${result.id}\nUse clawscarf connections connect ${result.id} with the same origin and session.`);
+    });
+    command
+        .command("edit <connectionId>")
+        .option("--name <name>", "New name")
+        .option("--agents <ids>", "Selected agent IDs")
+        .option("--all-agents", "Grant all current and future agents")
+        .action(async (connectionId, options) => {
+        if (options.agents !== undefined && options.allAgents)
+            throw new InstallationError("invalid_configuration", "Choose --agents or --all-agents.");
+        const current = (await api.getConnection({
+            ...(await request()),
+            path: { connectionId },
+        })).data;
+        const result = (await api.updateConnection({
+            ...(await request(current.revision)),
+            path: { connectionId },
+            body: {
+                name: options.name ?? current.name,
+                grant: options.allAgents
+                    ? { mode: "all" }
+                    : options.agents === undefined
+                        ? current.grant
+                        : grant(options.agents),
+            },
+        })).data;
+        output(result, "Connection updated.");
+    });
+    command
+        .command("connect <connectionId>")
+        .action(async (connectionId) => {
+        const current = (await api.getConnection({
+            ...(await request()),
+            path: { connectionId },
+        })).data;
+        const result = current.setup &&
+            ["creating", "pending", "verifying"].includes(current.setup.state)
+            ? (await api.getConnectionSetup({
+                ...(await request()),
+                path: { connectionId, setupId: current.setup.id },
+            })).data
+            : (await api.startConnectionSetup({
+                ...(await request(current.revision)),
+                path: { connectionId },
+                body: {
+                    kind: current.state === "connected" ? "reconnect" : "initial",
+                },
+            })).data;
+        output(result, result.url
+            ? `Continue in your signed-in installation browser:\n${result.url}`
+            : `Setup ${result.setup.state}. Refresh before retrying.`);
+    });
+    command
+        .command("complete <connectionId> <setupId>")
+        .requiredOption("--receipt-file <path>", "Private OAuth return receipt")
+        .action(async (connectionId, setupId, options) => {
+        const result = (await api.completeConnectionSetup({
+            ...(await request()),
+            path: { connectionId, setupId },
+            body: {
+                sessionUri: (await readFile(options.receiptFile, "utf8")).trim(),
+            },
+        })).data;
+        output(result, "Connection completed.");
+    });
+    command
+        .command("cancel <connectionId> <setupId>")
+        .action(async (connectionId, setupId) => {
+        const current = (await api.getConnection({
+            ...(await request()),
+            path: { connectionId },
+        })).data;
+        const result = (await api.cancelConnectionSetup({
+            ...(await request(current.revision)),
+            path: { connectionId, setupId },
+        })).data;
+        output(result, "Setup cancelled.");
+    });
+    command
+        .command("disconnect <connectionId>")
+        .description("Disconnect an account or remove an inactive entry")
+        .action(async (connectionId) => {
+        const current = (await api.getConnection({
+            ...(await request()),
+            path: { connectionId },
+        })).data;
+        const result = (await api.disconnectConnection({
+            ...(await request(current.revision)),
+            path: { connectionId },
+        })).data;
+        output(result, "Connection removed. Remote account cleanup may still be pending.");
+    });
+    command
+        .command("refresh <connectionId>")
+        .action(async (connectionId) => {
+        const current = (await api.getConnection({
+            ...(await request()),
+            path: { connectionId },
+        })).data;
+        const result = (await api.refreshConnection({
+            ...(await request(current.revision)),
+            path: { connectionId },
+        })).data;
+        output(result, `${result.name} · ${result.state}`);
+    });
+    command.command("usage").action(async () => {
+        const result = (await api.getConnectionUsage(await request())).data;
+        output(result, result.limits
+            .map((l) => `${l.installation ? "Installation" : "Account"}${l.backend ? ` / ${l.backend}` : ""}: ${String(l.used)}/${String(l.limit)} calls`)
+            .join("\n") + `\nResets ${result.resetsAt}`);
+    });
+}