@maxceem/agw 0.5.1 → 0.6.0

package/dist/agw.mjs

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // <define:__AGW_MANIFEST__>
-var define_AGW_MANIFEST_default = { version: "0.5.1", wrangler: "4.96.0", upgradeFrom: ["0.5.1", "0.5.0", "0.4.0"], release: { url: "https://github.com/maxceem/app-ai-gateway/releases/download/v0.5.1/gateway-0.5.1.tar.gz", sha256: "f4461618d5882d9b32dc44d5d8db048bbb6d6df5ec9899c77c5877491296d77c", manifest: "f08d792d4b9f8b9537075a99583b39c5a355891a20d20632bb5ed957ad6eacf2" } };
+var define_AGW_MANIFEST_default = { version: "0.6.0", wrangler: "4.96.0", upgradeFrom: ["0.6.0", "0.5.2", "0.5.1", "0.5.0", "0.4.0"], release: { url: "https://github.com/maxceem/app-ai-gateway/releases/download/v0.6.0/gateway-0.6.0.tar.gz", sha256: "792ad8d9cbb13a98c1e99532061128c53d28549de4345adbcc1c5b2c34cd1fec", manifest: "2edb8dd7a9e80bd906ef0ab9354b97f4c431e726eca04524569fe5435d7a6b2c" } };
 
 // src/main.ts
 import { Writable as Writable2 } from "node:stream";
@@ -14642,13 +14642,6 @@ var API_STYLES = [
   /** A provider-native operation with no cross-provider contract of its own. */
   "other"
 ];
-var API_STYLE_PATHS = {
-  responses: "v1/responses",
-  chat_completions: "v1/chat/completions",
-  anthropic_messages: "v1/messages",
-  gemini_native: "v1beta/models/{model}:generateContent",
-  audio_transcription: "v1/audio/transcriptions"
-};
 var ENDPOINT_API_STYLES = ["responses", "audio_transcription"];
 var OUTPUT_CLAMP_STYLES = [
   "responses",
@@ -15316,6 +15309,18 @@ var AppUpdateSchema = AppWriteSchema.extend({
     description: "Required: the revision the application was read at. An absent one answers 400 app_revision_required, a stale one 409 app_revision_conflict."
   })
 }).meta({ id: "AppUpdate" });
+var SNIPPET_LANGUAGES = ["swift", "curl"];
+var AppSnippetQuerySchema = external_exports.object({
+  language: external_exports.enum(SNIPPET_LANGUAGES, { error: "language must be swift or curl" }).optional().meta({
+    description: "swift or curl. Defaults to swift for an App Attest application and curl for a server application; the other one is refused with 400 unsupported_snippet."
+  }),
+  provider: external_exports.string().min(1).optional().meta({
+    description: "The slug of the provider to write the example for. Defaults to the first one the application can reach. Unknown answers 404 provider_not_found; held but outside the application's routing or disabled answers 400 provider_unavailable."
+  }),
+  endpoint: external_exports.string().min(1).optional().meta({
+    description: "The name of one of the application's custom endpoints, to call it instead of a provider path. Unknown answers 404 endpoint_not_found."
+  })
+});
 var AppAttestKeyIdSchema = external_exports.string().min(1).max(200);
 var ChallengeSchema = external_exports.string().min(1).max(200);
 var AppAttestRegisterRequestSchema = external_exports.object({
@@ -15489,8 +15494,26 @@ var OrganizationSelectRequestSchema = external_exports.object({
 var CredentialNameRequestSchema = external_exports.object({
   name: external_exports.string().trim().min(1).max(100)
 });
-var ManagementKeyCreateRequestSchema = CredentialNameRequestSchema.meta({ id: "ManagementKeyCreateRequest" });
+var CredentialGrantSchema = external_exports.enum(["read", "manage"]);
+var ManagementKeyCreateRequestSchema = CredentialNameRequestSchema.extend({
+  grant: CredentialGrantSchema.default("manage").meta({
+    description: "How much of your role the key may use. `read` may list, inspect and validate but cannot change your apps, providers or settings: a change your role would otherwise allow is refused with `403 grant_insufficient`, and the key may still revoke itself. `manage` may do everything your role allows. Defaults to `manage`."
+  })
+}).meta({ id: "ManagementKeyCreateRequest" });
 var ApiKeyCreateRequestSchema = CredentialNameRequestSchema.meta({ id: "ApiKeyCreateRequest" });
+var OAuthConsentProofTokenSchema = external_exports.string().regex(/^[A-Za-z0-9_-]{32,256}$/).meta({
+  description: "The proof from the consent page URL's fragment."
+});
+var OAuthConsentProofSchema = external_exports.object({ submissionToken: OAuthConsentProofTokenSchema }).strict();
+var OAuthConsentAllowRequestSchema = external_exports.object({
+  submissionToken: OAuthConsentProofTokenSchema,
+  organizationId: external_exports.string().min(1).max(256).meta({
+    description: "The account the connection acts in: one the signed-in person is a member of."
+  }),
+  grant: CredentialGrantSchema.meta({
+    description: "How much of the person's role the connection may use, whatever the client asked for."
+  })
+}).strict();
 
 // src/common.ts
 import { randomBytes } from "node:crypto";
@@ -16653,15 +16676,6 @@ var StateStore = class {
 function selectedProviderPolicies(routing) {
   return routing.providers.mode === "selected" ? routing.providers.selected : {};
 }
-function providerPolicyFor(routing, slug) {
-  if (routing.providers.mode === "all") return { allowed_paths: [], allowed_models: [] };
-  return Object.hasOwn(routing.providers.selected, slug) ? routing.providers.selected[slug] : void 0;
-}
-function reachableProviders(routing, instances) {
-  return instances.filter(
-    (instance) => instance.status === "active" && providerPolicyFor(routing, instance.slug) !== void 0
-  );
-}
 
 // ../src/shared/protocols.ts
 var PROTOCOLS = {
@@ -16711,23 +16725,6 @@ var PROTOCOLS = {
 var CLASSIFIED = Object.values(PROTOCOLS).filter(
   (protocol) => protocol.path !== null
 );
-function classifyPath(providerPath) {
-  for (const protocol of CLASSIFIED) {
-    const match = protocol.path.exec(providerPath);
-    if (!match) continue;
-    const span = match.indices?.groups?.model;
-    const value = match.groups?.model;
-    if (span === void 0 || value === void 0) return { protocol };
-    return {
-      protocol,
-      model: {
-        value,
-        template: `${providerPath.slice(0, span[0])}{model}${providerPath.slice(span[1])}`
-      }
-    };
-  }
-  return { protocol: PROTOCOLS.other };
-}
 
 // ../src/shared/first-request.ts
 var PROVIDER_PLACEHOLDER = "PROVIDER_SLUG";
@@ -16738,126 +16735,9 @@ var EXAMPLE_GAP_NOTES = {
   model: `No priced model was found for this provider, so ${MODEL_PLACEHOLDER} stands in for one. Use a model the provider serves.`,
   body: `This app allows no path whose request shape is known here, so ${BODY_PLACEHOLDER} stands in for the body the provider documents.`
 };
-function examplePath(type, { gatewayRouted = false, model } = {}) {
-  const own = providerDescriptor(type).examplePath ?? API_STYLE_PATHS.chat_completions;
-  if (own.includes("{model}")) return model ? own.replace("{model}", model) : void 0;
-  return gatewayRouted && own.endsWith("chat/completions") ? API_STYLE_PATHS.chat_completions : own;
-}
-var hello = () => [{ role: "user", content: "Say hello." }];
-var EXAMPLE_BODIES = {
-  responses: (model) => ({ model, input: "Say hello." }),
-  chat_completions: (model) => ({ model, messages: hello() }),
-  anthropic_messages: (model) => ({ model, max_tokens: 128, messages: hello() }),
-  // The model is in the URL, not the body.
-  gemini_native: () => ({ contents: [{ parts: [{ text: "Say hello." }] }] })
-};
-function requestFor(path, model) {
-  const { style: style2 } = classifyPath(path).protocol;
-  return {
-    body: EXAMPLE_BODIES[style2]?.(model) ?? null,
-    anthropic: style2 === "anthropic_messages"
-  };
-}
-function modelsFor(provider, policy, prices) {
-  if (policy?.allowed_models?.length) return policy.allowed_models;
-  return [
-    ...Object.keys(provider.pricing ?? {}),
-    ...Object.entries(prices[provider.type] ?? {}).filter(([, price]) => price.output !== void 0).map(([model]) => model)
-  ];
-}
-function firstRequest(routing, providers, prices) {
-  let fallback;
-  const candidates = routing ? reachableProviders(routing, providers) : providers.filter((provider) => provider.status === "active");
-  for (const provider of candidates) {
-    const policy = routing?.providers.mode === "selected" ? providerPolicyFor(routing, provider.slug) : void 0;
-    const models = modelsFor(provider, policy, prices);
-    const model = models[0] ?? MODEL_PLACEHOLDER;
-    const gaps = models.length ? [] : ["model"];
-    const fallbackPath = examplePath(provider.type, {
-      gatewayRouted: Boolean(provider.providerGatewayId),
-      model
-    });
-    const paths = policy?.allowed_paths?.length ? policy.allowed_paths : fallbackPath ? [fallbackPath] : [];
-    for (const entry of paths) {
-      const path = typeof entry === "string" ? entry : entry.path;
-      if (path.includes("*")) continue;
-      const fixed = typeof entry !== "string" ? entry.fixed_model : void 0;
-      const { body, anthropic } = requestFor(path, fixed ?? model);
-      const example = {
-        target: { provider: provider.slug, path },
-        body,
-        anthropic,
-        // A fixed model is the app's own, so a catalog that has none of its
-        // own to offer is not a gap on a path that never carries one.
-        gaps: body && fixed ? [] : gaps
-      };
-      if (body) return example;
-      fallback ??= { ...example, gaps: [...example.gaps, "body"] };
-    }
-  }
-  return fallback ?? {
-    target: { provider: PROVIDER_PLACEHOLDER, path: "v1/chat/completions" },
-    body: requestFor("v1/chat/completions", MODEL_PLACEHOLDER).body,
-    anthropic: false,
-    gaps: ["provider", "model"]
-  };
-}
-function exampleNotes(example) {
-  return example.gaps.map((gap) => EXAMPLE_GAP_NOTES[gap]);
-}
-function exampleUrl(baseUrl, appId, target) {
-  const origin2 = baseUrl.replace(/\/+$/, "");
-  const app2 = `${origin2}/v1/apps/${encodeURIComponent(appId)}`;
-  return "endpoint" in target ? `${app2}/endpoints/${encodeURIComponent(target.endpoint)}` : `${app2}/proxy/${encodeURIComponent(target.provider)}/${target.path}`;
-}
 function shellQuote(value) {
   return `'${value.replaceAll("'", "'\\''")}'`;
 }
-function commented(notes2, marker) {
-  return (notes2 ?? []).map((note) => `${marker} ${note}
-`).join("");
-}
-function curlSnippet(options) {
-  const { baseUrl, appId, example, notes: notes2, keyExpression = "$APP_AI_GATEWAY_KEY" } = options;
-  const body = example.body ? JSON.stringify(example.body) : BODY_PLACEHOLDER;
-  return commented(notes2, "#") + `curl --fail-with-body ${shellQuote(exampleUrl(baseUrl, appId, example.target))} \\
-  -H "Authorization: Bearer ${keyExpression}" \\
-  -H 'Content-Type: application/json' \\
-` + (example.anthropic ? "  -H 'anthropic-version: 2023-06-01' \\\n" : "") + `  -d ${shellQuote(body)}
-`;
-}
-var ISSUER_TOKEN_NOTE = "Replace yourIdentitySDK.currentIDToken(forceRefresh: forceRefresh) with your configured issuer integration.";
-function swiftSignsInUsers(authentication) {
-  return authentication?.type === "apple_app_attest" && authentication.end_user.source === "issuer";
-}
-function swiftAuthMode(authentication) {
-  return swiftSignsInUsers(authentication) ? ".appAttest(issuerTokenProvider: { forceRefresh in\n        // Return a fresh signed token from your configured identity SDK.\n        try await yourIdentitySDK.currentIDToken(forceRefresh: forceRefresh)\n    })" : ".appAttestInstall";
-}
-function swiftSnippet(options) {
-  const { baseUrl, appId, example, notes: notes2, authentication } = options;
-  const authMode = swiftAuthMode(authentication);
-  const target = "endpoint" in example.target ? `endpointSlug: ${JSON.stringify(example.target.endpoint)}` : `provider: ${JSON.stringify(example.target.provider)},
-    providerPath: ${JSON.stringify(example.target.path)}`;
-  const body = example.body ? `request.httpBody = Data(${JSON.stringify(JSON.stringify(example.body))}.utf8)` : `// Supply the provider-native JSON body.
-request.httpBody = Data(${JSON.stringify(BODY_PLACEHOLDER)}.utf8)`;
-  return commented(notes2, "//") + `import Foundation
-import AppAIGateway
-
-let gateway = AppAIGatewayClient(
-    appID: ${JSON.stringify(appId)},
-    baseURL: URL(string: ${JSON.stringify(baseUrl.replace(/\/+$/, ""))})!,
-    authMode: ${authMode}
-)
-
-var request = try await gateway.authorizedRequest(
-    ${target}
-)
-request.setValue("application/json", forHTTPHeaderField: "Content-Type")
-${example.anthropic ? 'request.setValue("2023-06-01", forHTTPHeaderField: "anthropic-version")\n' : ""}${body}
-let (data, _) = try await URLSession.shared.data(for: request)
-print(String(decoding: data, as: UTF8.self))
-`;
-}
 
 // ../src/shared/app-defaults.ts
 function unlimitedScope() {
@@ -17003,8 +16883,8 @@ async function appCommand(ctx, command, args, flags) {
   const action = command.slice(4);
   if (action === "list") return (await ctx.call("listApps")).data;
   if (action === "validate") {
-    const doc2 = localApp(await jsonFile(await required2(flags, "file")));
-    return { definition: doc2, validation: await remoteValidation(ctx, doc2) };
+    const doc = localApp(await jsonFile(await required2(flags, "file")));
+    return { definition: doc, validation: await remoteValidation(ctx, doc) };
   }
   if (action === "add" || action === "update") {
     let current;
@@ -17026,32 +16906,32 @@ async function appCommand(ctx, command, args, flags) {
       ))
         fail("invalid_input", "Provide at least one application change.");
     }
-    const doc2 = await appDocument(flags, current);
-    if (flags["key-output"] && doc2.config.authentication.type !== "api_key")
+    const doc = await appDocument(flags, current);
+    if (flags["key-output"] && doc.config.authentication.type !== "api_key")
       fail("invalid_input", "--key-output only applies to server apps.");
     if (flags["dry-run"])
       return {
         dryRun: true,
-        definition: doc2,
-        validation: await remoteValidation(ctx, doc2, appId2 || void 0)
+        definition: doc,
+        validation: await remoteValidation(ctx, doc, appId2 || void 0)
       };
     {
       let app2;
       let key;
       if (action === "add") {
         await ctx.bootstrap();
-        if (doc2.config.authentication.type === "api_key") {
-          const created = await ctx.keyOperation("app.add", doc2, flags["key-output"]);
+        if (doc.config.authentication.type === "api_key") {
+          const created = await ctx.keyOperation("app.add", doc, flags["key-output"]);
           app2 = created.operation.result.app;
           key = created.key;
         } else {
-          const created = await ctx.operation("app.add", doc2);
+          const created = await ctx.operation("app.add", doc);
           app2 = created.result.app;
         }
       } else {
         const updated = await ctx.call("updateApp", {
           params: { app: appId2 },
-          body: { ...doc2, revision }
+          body: { ...doc, revision }
         });
         ({ app: app2 } = updated.data);
       }
@@ -17069,7 +16949,7 @@ ${snippet}`;
         ...snippet ? { snippet } : {},
         app: app2,
         ...key ? { applicationKey: key } : {},
-        guidance: doc2.config.authentication.type === "apple_app_attest" ? `Add https://github.com/maxceem/app-ai-gateway-swift from 1.0.0, enable App Attest, and test on a supported physical device. Run agw app snippet ${app2.id} --provider <slug> for integration code. Production releases should use production-only App Attest.` : `Store the generated key on your server; never embed it in a mobile application. Run agw app snippet ${app2.id} for this request again.`
+        guidance: doc.config.authentication.type === "apple_app_attest" ? `Add https://github.com/maxceem/app-ai-gateway-swift from 1.0.0, enable App Attest, and test on a supported physical device. Run agw app snippet ${app2.id} --provider <slug> for integration code. Production releases should use production-only App Attest.` : `Store the generated key on your server; never embed it in a mobile application. Run agw app snippet ${app2.id} for this request again.`
       };
     }
   }
@@ -17098,9 +16978,10 @@ ${snippet}`;
     return { appId: appId2, applicationKey: created.key };
   }
   const appId = args[0] ?? "";
+  if (action === "check") return (await ctx.call("checkApp", { params: { app: appId } })).data;
+  if (action === "snippet") return appSnippet(ctx, appId, flags);
   const { data } = await ctx.call("getApp", { params: { app: appId } });
   if (action === "show") return data;
-  const doc = documentOf(data.app);
   if (action === "remove") {
     await confirm(
       `Delete app ${data.app.name} (${appId})? Its keys, users and authentication state will be removed and clients will lose access.`,
@@ -17108,100 +16989,52 @@ ${snippet}`;
     );
     return (await ctx.call("deleteApp", { params: { app: appId }, query: { confirm: appId } })).data;
   }
-  if (action === "check") {
-    const validation = await remoteValidation(ctx, doc, appId);
-    const { data: providers } = await ctx.call("listProviders");
-    const selected = providers.providers.filter(
-      (p) => providerPolicyFor(doc.config.routing, p.slug) !== void 0
-    );
-    return {
-      appId,
-      validation,
-      status: doc.status,
-      providers: selected.map((p) => ({
-        id: p.id,
-        slug: p.slug,
-        status: p.status
-      })),
-      ready: doc.status === "active" && reachableProviders(doc.config.routing, selected).length > 0,
-      limitations: [
-        "No inference was sent.",
-        "Physical device attestation, issuer login, subscription entitlement and upstream credentials were not exercised."
-      ]
-    };
-  }
-  if (action === "snippet") {
-    const ios = doc.config.authentication.type === "apple_app_attest";
-    const language = flags.language ?? (ios ? "swift" : "curl");
-    if (!["swift", "curl"].includes(language))
-      fail("invalid_input", "--language must be swift or curl.");
-    if (language === "swift" !== ios)
-      fail(
-        "unsupported_snippet",
-        ios ? "iOS applications authenticate with App Attest, which curl cannot perform." : "Swift snippets are for iOS applications.",
-        `Run agw app snippet ${appId} --language ${ios ? "swift" : "curl"}.`
-      );
-    const notes2 = [];
-    let example;
-    if (flags.endpoint) {
-      const endpoint = doc.config.endpoints[flags.endpoint];
-      if (!endpoint)
-        fail("endpoint_not_found", "Choose an existing custom endpoint.");
-      const responses = endpoint.api_style === "responses";
-      example = {
-        target: { endpoint: flags.endpoint },
-        body: responses ? { input: "Say hello." } : null,
-        anthropic: false,
-        gaps: responses ? [] : ["body"]
-      };
-    } else {
-      const routing = doc.config.routing;
-      const { data: all } = await ctx.call("listProviders");
-      const reachable = reachableProviders(routing, all.providers);
-      const requested = typeof flags.provider === "string" ? flags.provider : void 0;
-      if (requested && !reachable.some((p) => p.slug === requested))
-        fail(
-          all.providers.some((p) => p.slug === requested) ? "provider_unavailable" : "provider_not_found",
-          all.providers.some((p) => p.slug === requested) ? "That provider is disabled or outside this app's proxy policy." : "No provider has that slug.",
-          "Run agw provider list for the slugs, and agw app show <id> for the policy."
-        );
-      const { data: catalog } = await ctx.call("listModelPrices");
-      const providers = requested ? reachable.filter((p) => p.slug === requested) : reachable;
-      example = firstRequest(routing, providers, catalog.prices);
-      if (!requested && reachable.length > 1)
-        notes2.push(`This app can reach ${reachable.length} providers. Add --provider <slug> for a different one.`);
-    }
-    notes2.push(...exampleNotes(example));
-    const clientUrl = ctx.active?.deployment?.apiUrl ?? ctx.url;
-    let snippet;
-    if (ios) {
-      if (swiftSignsInUsers(doc.config.authentication)) notes2.push(ISSUER_TOKEN_NOTE);
-      snippet = swiftSnippet({
-        baseUrl: clientUrl,
-        appId,
-        example,
-        authentication: doc.config.authentication,
-        notes: [
-          "Swift package: https://github.com/maxceem/app-ai-gateway-swift (from: 1.0.0)",
-          "Enable App Attest and test on a supported physical device.",
-          ...notes2
-        ]
-      });
-    } else {
-      snippet = curlSnippet({ baseUrl: clientUrl, appId, example, notes: notes2 });
-    }
-    if (flags.output) {
-      const output = await reserveOutput(flags.output);
-      try {
-        await output.write(snippet);
-        return { output: output.path };
-      } finally {
-        await output.cancel();
+  fail("unknown_command", "Unknown command.");
+}
+async function appSnippet(ctx, appId, flags) {
+  const language = flags.language;
+  if (language !== void 0 && !SNIPPET_LANGUAGES.includes(language))
+    fail("invalid_input", "--language must be swift or curl.");
+  const provider = typeof flags.provider === "string" ? flags.provider : void 0;
+  let data;
+  try {
+    ({ data } = await ctx.call("getAppSnippet", {
+      params: { app: appId },
+      query: {
+        ...language === void 0 ? {} : { language },
+        ...provider === void 0 ? {} : { provider },
+        ...flags.endpoint === void 0 ? {} : { endpoint: flags.endpoint }
       }
+    }));
+  } catch (error51) {
+    const remedy = error51 instanceof CliError ? snippetRemedy(error51.code, appId, language) : void 0;
+    if (remedy === void 0 || !(error51 instanceof CliError)) throw error51;
+    throw new CliError(error51.code, error51.message, remedy, error51.exitCode, error51.details);
+  }
+  if (flags.output) {
+    const output = await reserveOutput(flags.output);
+    try {
+      await output.write(data.snippet);
+      return { output: output.path };
+    } finally {
+      await output.cancel();
     }
-    return { language: ios ? "swift" : "shell", snippet, notes: notes2 };
   }
-  fail("unknown_command", "Unknown command.");
+  return data;
+}
+function snippetRemedy(code, appId, language) {
+  switch (code) {
+    // Only a language that was asked for is refused, so the other one is right.
+    case "unsupported_snippet":
+      return `Run agw app snippet ${appId} --language ${language === "swift" ? "curl" : "swift"}.`;
+    case "provider_not_found":
+    case "provider_unavailable":
+      return "Run agw provider list for the slugs, and agw app show <id> for the policy.";
+    case "endpoint_not_found":
+      return `Run agw app show ${appId} for its custom endpoints.`;
+    default:
+      return void 0;
+  }
 }
 
 // src/context.ts
@@ -17606,11 +17439,22 @@ var ManagementKeySummarySchema = external_exports.object({
   createdAt: external_exports.string(),
   revokedAt: external_exports.string().nullable(),
   source: external_exports.string().meta({
-    description: "Where the key was issued: `console`, `cli` for a key a CLI login received, or `bootstrap` for the key a CLI account starts with. Display only.",
+    description: "Where the key was issued: `console`, `cli` for a key a CLI login received, `bootstrap` for the key a CLI account starts with, or `oauth` for an OAuth connection an MCP client holds. Display only.",
     example: "cli"
   }),
+  credentialType: external_exports.enum(["apiKey", "oauth"]).meta({
+    description: "What the row authenticates as: `apiKey` for a management key, `oauth` for an MCP client's connection. `source` says where it was issued and is display only.",
+    example: "apiKey"
+  }),
   label: external_exports.string().nullable().meta({
     description: "Who holds it, as the issuing client described itself, e.g. `CLI on mac-studio`. Display only."
+  }),
+  grant: CredentialGrantSchema.meta({
+    description: "How much of its holder's role the key may use: `read` may list, inspect and validate but cannot change anything other than revoking itself; `manage` does everything the role allows. Keys issued before grants existed are `manage`.",
+    example: "manage"
+  }),
+  clientId: external_exports.string().nullable().meta({
+    description: "For an OAuth connection (`credentialType: \"oauth\"`), the client it was issued to: a registered client's id, or the https URL a client identifies itself with. Null for a key. A connection's `name` is the client's own name for itself, display only; its `expiresAt` is when it ends unless the client refreshes it first."
   })
 });
 var ManagementKeyListResponseSchema = external_exports.object({
@@ -17767,7 +17611,7 @@ var IdentitySessionSchema = external_exports.object({
     organization: OrganizationSummarySchema.nullable(),
     role: OrganizationRoleSchema,
     memberships: external_exports.array(OrganizationMembershipSchema),
-    credentialType: external_exports.enum(["session", "apiKey"]),
+    credentialType: external_exports.enum(["session", "apiKey", "oauth"]),
     /**
      * How the caller proved who they are: `interactive` for a human who just
      * signed in, `credential` for a key. The CLI's browser handoff refuses to
@@ -17785,6 +17629,58 @@ var IdentitySessionSchema = external_exports.object({
     }).nullable()
   })
 });
+var OAuthConsentDetailsResponseSchema = external_exports.object({
+  id: external_exports.string(),
+  /** `pending` until a person allows or denies it, or it lapses ten minutes after it opened. */
+  state: external_exports.enum(["pending", "completed", "denied", "expired", "retired"]),
+  client: external_exports.object({
+    /** The `client_id`: a registered client's id, or the https URL of its metadata document. */
+    id: external_exports.string(),
+    /**
+     * The client's own name for itself. Untrusted text: show it as text, as
+     * declared by `domain`, never as markup.
+     */
+    name: external_exports.string(),
+    /** The host that served the client's metadata document; null for a registered client. */
+    domain: external_exports.string().nullable(),
+    source: external_exports.enum(["cimd", "registered"])
+  }),
+  /** Where the browser is sent once this is decided: the host of the client's redirect URI. */
+  redirectHost: external_exports.string(),
+  /** What the client asked for. The person chooses the grant; it is only the default. */
+  requestedGrant: CredentialGrantSchema,
+  expiresAt: external_exports.string(),
+  /** The person signed in to this browser, who would allow it; null when nobody is. */
+  viewer: external_exports.object({ name: external_exports.string().nullable(), email: external_exports.string().nullable() }).nullable(),
+  /** The accounts that person may connect the client to: every live membership. */
+  accounts: external_exports.array(external_exports.object({
+    id: external_exports.string(),
+    name: external_exports.string(),
+    role: OrganizationRoleSchema
+  })),
+  /**
+   * What stands between this browser and Allow: nobody is signed in, or the
+   * person signed in belongs to no account the client could use. Null when
+   * nothing does.
+   */
+  blockedBy: external_exports.enum(["registration_required", "no_eligible_organization"]).nullable(),
+  /**
+   * Whether "continue without an account" would be admitted now: always on
+   * the hosted service, and on a self-hosted deployment only while it is
+   * empty. A guest connection always has the `manage` grant.
+   */
+  guestAvailable: external_exports.boolean(),
+  /** When an account created now without a person would be deleted unless claimed; null where accounts have no deadline. */
+  guestExpiresAt: external_exports.string().nullable(),
+  googleEnabled: external_exports.boolean(),
+  /** Whether the console's own registration would admit a new person now. */
+  registrationOpen: external_exports.boolean()
+});
+var OAuthConsentRedirectResponseSchema = external_exports.object({
+  redirect: external_exports.string().meta({
+    description: "The client's redirect URI with `code`, `state` and `iss`, or with `error=access_denied` after a denial. Navigate the browser there."
+  })
+});
 var OrganizationListResponseSchema = external_exports.object({
   organizations: external_exports.array(OrganizationMembershipSchema)
 });
@@ -17831,6 +17727,35 @@ var AppValidateResponseSchema = external_exports.object({
 var AppDraftValidateResponseSchema = external_exports.object({
   valid: external_exports.literal(true)
 });
+var AppCheckResponseSchema = external_exports.object({
+  appId: external_exports.string(),
+  validation: AppValidateResponseSchema.meta({
+    description: "The stored configuration judged as an update of it would be. A configuration that would be refused answers the check itself with 400."
+  }),
+  status: external_exports.enum(APP_STATUSES),
+  providers: external_exports.array(external_exports.object({
+    id: external_exports.string(),
+    slug: external_exports.string(),
+    status: external_exports.enum(["active", "disabled"])
+  })).meta({
+    description: "Every provider instance the application's routing names, a disabled one included so that it shows as disabled rather than missing."
+  }),
+  ready: external_exports.boolean().meta({
+    description: "Whether the application is active and at least one provider it names is active."
+  }),
+  limitations: external_exports.array(external_exports.string()).meta({
+    description: "What this check did not exercise, one sentence each."
+  })
+});
+var AppSnippetResponseSchema = external_exports.object({
+  language: external_exports.enum(["swift", "shell"]),
+  snippet: external_exports.string().meta({
+    description: "Source to paste. It never contains a credential: a server application's example reads its key from APP_AI_GATEWAY_KEY."
+  }),
+  notes: external_exports.array(external_exports.string()).meta({
+    description: "What the example stands in for or leaves out, one sentence each. They are also written into the snippet as comments."
+  })
+});
 var CreatedApiKeySchema = external_exports.object({
   id: external_exports.string(),
   name: external_exports.string(),
@@ -17839,6 +17764,7 @@ var CreatedApiKeySchema = external_exports.object({
   key_prefix: external_exports.string(),
   created_at: external_exports.string()
 });
+var AppKeyMetadataSchema = CreatedApiKeySchema.omit({ key: true });
 var CreatedAppResponseSchema = AppResponseSchema.extend({
   api_key: CreatedApiKeySchema.nullable()
 });
@@ -17949,6 +17875,41 @@ var ModelPriceSchema = external_exports.object({
 var PricesResponseSchema = external_exports.object({
   prices: external_exports.record(external_exports.string(), external_exports.record(external_exports.string(), ModelPriceSchema))
 });
+var OperationResultSchema = external_exports.object({
+  /** The account a claim settled, a login landed in, or a bootstrap created. */
+  accountId: external_exports.string().optional(),
+  app: AppResponseSchema.shape.app.optional(),
+  api_key: AppKeyMetadataSchema.nullable().optional(),
+  provider: ProviderSummarySchema.optional(),
+  gateway: ProviderGatewaySummarySchema.optional()
+}).meta({ id: "OperationResult" });
+var OperationStatusResponseSchema = external_exports.object({
+  id: external_exports.string(),
+  /**
+   * The operation's kind as the gateway runs it: `app.add.reserved` for an app
+   * created under a reservation, `provider.add.browser` for a provider whose
+   * key a person enters in a browser, `claim`, and so on.
+   */
+  kind: external_exports.string(),
+  state: external_exports.enum(["pending", "completed", "expired"]),
+  /** Set beside `state: "expired"` when a person declined the browser step rather than letting it lapse. */
+  denied: external_exports.literal(true).optional(),
+  createdAt: external_exports.string(),
+  /** While pending, when it lapses unless completed. */
+  expiresAt: external_exports.string(),
+  result: OperationResultSchema.optional(),
+  /** While a key the operation created can still be revealed, once, the page a person opens to see it. */
+  reveal_url: external_exports.url().optional()
+}).meta({ id: "OperationStatus" });
+var RevealedOperationResponseSchema = external_exports.object({
+  id: external_exports.string(),
+  kind: external_exports.string(),
+  result: external_exports.object({
+    app: AppResponseSchema.shape.app.optional(),
+    /** `key` is the plaintext. It is shown this once; the gateway keeps only a hash. */
+    api_key: CreatedApiKeySchema.nullable().optional()
+  })
+}).meta({ id: "RevealedOperation" });
 
 // ../src/contracts/cli.ts
 var CliProofSchema = external_exports.string().regex(/^[A-Za-z0-9_-]{32,256}$/);
@@ -18236,6 +18197,11 @@ var CLI_ERRORS = {
   410: "The protected credential exchange has expired; no replacement is minted.",
   429: "The durable initiation or submission rate limit was reached."
 };
+var CONSENT_ERRORS = {
+  409: "The authorization was denied, already completed by another choice, or the account the choice needed is gone; nothing was written.",
+  410: "The authorization lapsed: it is open for ten minutes. Start the connection again from the client."
+};
+var CONSENT_DESCRIPTION = "The API of the console's OAuth consent page, which an MCP client's authorization request sends a person to. First-party browser only: both the request URL origin and the exact Origin header must match the console origin, and `submissionToken` is the proof from the consent page URL's fragment, so it never travels in a URL. Allowing, continuing without an account and denying each answer the `redirect` to send the browser to, and answer it again, byte for byte, when repeated with the same proof.";
 var BROWSER_HANDOFF_DESCRIPTION = "First-party browser only: both the request URL origin and exact Origin header must match consoleOrigin; a separate submissionToken is required \u2014 the proof from the approval URL's fragment, or, for a login, the user code the terminal shows. Identity approval (a claim or a login) also requires an interactive human session; registration is limited to a valid pending claim or login. Provider secret values are write-only.";
 var SignUpRequestSchema = external_exports.object({
   name: external_exports.string(),
@@ -18486,7 +18452,7 @@ var CATALOG = {
     security: "management",
     // The whole billing subtree is a person's to act on: a service credential
     // may run an account but may not buy, change or cancel what pays for it.
-    policy: { identity: "human" },
+    policy: { session: true },
     response: BillingPlansResponseSchema,
     responseDescription: "Billing service response."
   },
@@ -18497,7 +18463,7 @@ var CATALOG = {
     tags: ["Admin billing"],
     summary: "Get billing access and the current allowance period",
     security: "management",
-    policy: { identity: "human" },
+    policy: { session: true },
     response: BillingStatusResponseSchema,
     responseDescription: "Billing access, and the current period against the plan's request allowance when an entitlement resolves."
   },
@@ -18508,7 +18474,7 @@ var CATALOG = {
     tags: ["Admin billing"],
     summary: "Create a hosted checkout",
     security: "management",
-    policy: { identity: "human" },
+    policy: { session: true },
     request: BillingCheckoutRequestSchema,
     response: BillingCheckoutResponseSchema,
     responseDescription: "Hosted checkout URL."
@@ -18520,7 +18486,7 @@ var CATALOG = {
     tags: ["Admin billing"],
     summary: "Change the subscription plan",
     security: "management",
-    policy: { identity: "human" },
+    policy: { session: true },
     request: BillingPlanSelectionSchema,
     response: BillingChangeResponseSchema,
     responseDescription: "Billing service response."
@@ -18532,7 +18498,7 @@ var CATALOG = {
     tags: ["Admin billing"],
     summary: "Resume a canceled subscription",
     security: "management",
-    policy: { identity: "human" },
+    policy: { session: true },
     request: BillingPlanSelectionSchema,
     response: BillingChangeResponseSchema,
     responseDescription: "Billing service response."
@@ -18544,7 +18510,7 @@ var CATALOG = {
     tags: ["Admin billing"],
     summary: "Cancel the subscription at period end",
     security: "management",
-    policy: { identity: "human" },
+    policy: { session: true },
     response: BillingCancelResponseSchema,
     responseDescription: "Cancellation accepted."
   },
@@ -18555,7 +18521,7 @@ var CATALOG = {
     tags: ["Admin billing"],
     summary: "Start a no-card trial",
     security: "management",
-    policy: { identity: "human" },
+    policy: { session: true },
     request: BillingTrialRequestSchema,
     response: BillingAccessSchema,
     responseDescription: "Trial access state."
@@ -18592,7 +18558,7 @@ var CATALOG = {
     security: "management",
     // A POST that stores nothing: it answers whether a body would be accepted,
     // which is a read of the configuration rules and not a write.
-    policy: { role: "member", access: "read" },
+    policy: { role: "member", access: "read", grant: "read" },
     params: APP_PARAM,
     request: AppWriteSchema,
     response: AppValidateResponseSchema,
@@ -18605,11 +18571,34 @@ var CATALOG = {
     summary: "Validate a new application configuration without saving it",
     description: "Judged as a creation would be, against the account's current providers and prices.",
     security: "management",
-    policy: { role: "member", access: "read" },
+    policy: { role: "member", access: "read", grant: "read" },
     request: AppWriteSchema,
     response: AppDraftValidateResponseSchema,
     responseDescription: "The configuration would be accepted."
   },
+  checkApp: {
+    method: "GET",
+    path: "/v1/admin/apps/{app}/check",
+    tags: ["Admin applications"],
+    summary: "Check whether an application is ready to serve requests",
+    description: "Validates the stored configuration as an update of it would be judged, lists every provider its routing names with that provider's status \u2014 a disabled one included \u2014 and reports `ready` when the application is active and at least one of those providers is active. It sends no inference: App Attest on a physical device, issuer sign-in, subscription entitlements and the upstream credentials themselves are not exercised, and `limitations` says so in every answer. A stored configuration that would no longer be accepted answers `400 invalid_request` with the reason.",
+    security: "management",
+    params: APP_PARAM,
+    response: AppCheckResponseSchema,
+    responseDescription: "What the check established, and what it did not exercise."
+  },
+  getAppSnippet: {
+    method: "GET",
+    path: "/v1/admin/apps/{app}/snippet",
+    tags: ["Admin applications"],
+    summary: "Get the first request an application can send",
+    description: "Written against what the application has today: a provider it can reach and a priced model where those exist, and named placeholders, explained in `notes`, where they do not. An App Attest application gets Swift for the App AI Gateway Swift package and a server application gets curl; asking for the other answers `400 unsupported_snippet`. The URL is the one application clients call, which is this deployment's separate API host where it publishes one. A snippet never contains a credential: a server application's example reads its key from the `APP_AI_GATEWAY_KEY` environment variable.",
+    security: "management",
+    params: APP_PARAM,
+    query: AppSnippetQuerySchema,
+    response: AppSnippetResponseSchema,
+    responseDescription: "The example, its language and the notes written into it."
+  },
   deleteApp: {
     method: "DELETE",
     path: "/v1/admin/apps/{app}",
@@ -18638,7 +18627,7 @@ var CATALOG = {
     path: "/v1/admin/keys",
     tags: ["Admin management keys"],
     summary: "Create a management key",
-    description: "Console session only, and requires the owner or admin role. A management key cannot create another one, so revoking a key you handed out ends that access for good. The plaintext agw_mgmt_ token is returned once, and never expires; the account's own deadline is the only one.",
+    description: "Console session only, and requires the owner or admin role. A management key cannot create another one, so revoking a key you handed out ends that access for good. The plaintext agw_mgmt_ token is returned once, and never expires; the account's own deadline is the only one. A key created with the `read` grant cannot change your apps, providers or settings: a change its owner's role would otherwise allow is refused with `403 grant_insufficient`, and the key may still revoke itself.",
     security: "session",
     request: ManagementKeyCreateRequestSchema,
     status: 201,
@@ -18797,6 +18786,9 @@ var CATALOG = {
     tags: ["Admin organizations"],
     summary: "List the organizations the caller belongs to",
     security: "management",
+    // cf-auth lists them only for an interactive session: a key is scoped to
+    // its one organization and may not read the others its owner belongs to.
+    policy: { session: true },
     response: OrganizationListResponseSchema,
     responseDescription: "Memberships ordered by organization creation time."
   },
@@ -18810,8 +18802,11 @@ var CATALOG = {
     // Switching the active organization re-signs the cookie naming which
     // tenant the caller reads; gating it behind owner/admin would strand a
     // read-only member in one organization, and gating it behind setup access
-    // would strand them in an account whose trial has ended.
-    policy: { role: "member", access: "read" },
+    // would strand them in an account whose trial has ended. Only an
+    // interactive session has a cookie to re-sign, and cf-auth refuses any
+    // other caller, so the entry says so rather than leaving a key to learn it
+    // from the handler — after the grant check, with a remedy that cannot work.
+    policy: { role: "member", access: "read", session: true },
     request: OrganizationSelectRequestSchema,
     response: IdentitySessionSchema,
     responseDescription: "Session rescoped to the selected organization."
@@ -19021,6 +19016,34 @@ var CATALOG = {
     response: PricesResponseSchema,
     responseDescription: "The priced model catalog this deployment enforces."
   },
+  getOperation: {
+    method: "GET",
+    path: "/v1/admin/operations/{id}",
+    tags: ["Admin change operations"],
+    summary: "Get where an operation stands",
+    description: "Any credential of the account that opened the operation may read it, whatever its role and grant; any other is answered `404 operation_not_found`, so the answer never says whether the id exists elsewhere. A pending operation reports when it lapses, a completed one what it changed, and one declined in a browser `expired` with `denied: true`. It never returns a secret and never collects one: a key the operation created is revealed only on the page `reveal_url` names, to a person signed in to the console as an owner or admin. The approval link of a pending browser step is in the answer that opened it and nowhere else.",
+    security: "management",
+    params: { id: { example: "4b1e\u2026" } },
+    response: OperationStatusResponseSchema,
+    responseDescription: "Where the operation stands, and what it changed once completed."
+  },
+  revealOperation: {
+    method: "POST",
+    path: "/v1/admin/operations/{id}/reveal",
+    tags: ["Admin change operations"],
+    summary: "Reveal the key an operation created, once",
+    description: "Console session only, and requires the owner or admin role in the operation's account; a management key is refused with `403 session_required`. First-party console only: the request URL's origin and the exact `Origin` header must both be the console origin. Answers the key an app or key creation made once, within 15 minutes of its creation: a second reveal is `409 already_revealed`, and one after the window, or for a key revoked since, is `410 operation_expired`. Reveal it only on a page a person asked to see it on, never on load.",
+    security: "session",
+    // Read access: the key already exists, and collecting it is not a change.
+    policy: { role: "admin", access: "read", session: true },
+    params: { id: { example: "4b1e\u2026" } },
+    response: RevealedOperationResponseSchema,
+    responseDescription: "The key the operation created, with its plaintext.",
+    errors: {
+      409: "The key was already revealed.",
+      410: "The reveal window passed, or the key was revoked since it was created."
+    }
+  },
   getCliCapabilities: {
     method: "GET",
     path: "/v1/cli/capabilities",
@@ -19091,9 +19114,9 @@ var CATALOG = {
     summary: "Revoke the management key this request is sent with",
     description: "Logging a CLI out. Any management key may end itself, whatever its role and whatever the account's standing; a browser session cannot use this and signs out instead.",
     security: "management",
-    // Holding a key is authority enough to end it: a member may, and an
-    // account past its free window may.
-    policy: { role: "member", access: "read" },
+    // Holding a key is authority enough to end it: a member may, an account
+    // past its free window may, and a key with the `read` grant may.
+    policy: { role: "member", access: "read", grant: "read" },
     response: CliCredentialRevokeResponseSchema,
     responseDescription: "The key is revoked; the next request made with it is refused.",
     errors: CLI_ERRORS
@@ -19205,6 +19228,74 @@ var CATALOG = {
     responseDescription: "A new human identity for a pending claim or login, with its session set as a cookie.",
     errors: CLI_ERRORS
   },
+  /*
+   * The OAuth consent page's API. Like the CLI handoff, there is no page to
+   * fetch here: the console renders `/oauth/consent` from its own bundle, and
+   * these four carry the proof from its fragment in their bodies. The OAuth
+   * endpoints themselves — discovery, `/oauth/authorize`, `/oauth/token` and
+   * `/oauth/revoke` — are HTTP-only and not management operations, so they
+   * have no entries; the MCP guide documents them.
+   */
+  getOauthConsentDetails: {
+    method: "POST",
+    path: "/v1/console/oauth/{id}/details",
+    tags: ["Console OAuth consent"],
+    summary: "OAuth consent: details",
+    description: `${CONSENT_DESCRIPTION} Reading the details changes nothing. The client's name is its own claim, shown as declared by the host that served its metadata document.`,
+    security: "public",
+    params: { id: { description: "The authorization's id, from the consent page URL's `id` query parameter." } },
+    request: OAuthConsentProofSchema,
+    response: OAuthConsentDetailsResponseSchema,
+    responseDescription: "Who is asking and for what, who this browser would allow it as, the accounts that person may choose, and whether continuing without an account is available.",
+    errors: CONSENT_ERRORS
+  },
+  allowOauthConsent: {
+    method: "POST",
+    path: "/v1/console/oauth/{id}/allow",
+    tags: ["Console OAuth consent"],
+    summary: "OAuth consent: allow",
+    description: `${CONSENT_DESCRIPTION} Console session only: the person signed in to this browser connects the client to one of their accounts, with the grant they choose. A management key or an OAuth access token is refused with \`403 session_required\`.`,
+    security: "session",
+    // Any member may connect a client with their own role, as any member may
+    // log a CLI in; the grant is theirs to narrow. Read access, because
+    // connecting changes nothing in the account.
+    policy: { role: "member", access: "read", session: true },
+    params: { id: { description: "The authorization's id." } },
+    request: OAuthConsentAllowRequestSchema,
+    response: OAuthConsentRedirectResponseSchema,
+    responseDescription: "The client's redirect URI with the authorization code.",
+    errors: CONSENT_ERRORS
+  },
+  continueOauthWithoutAccount: {
+    method: "POST",
+    path: "/v1/console/oauth/{id}/guest",
+    tags: ["Console OAuth consent"],
+    summary: "OAuth consent: continue without an account",
+    description: `${CONSENT_DESCRIPTION} Creates an account nobody has claimed yet, owned by the connection's own service identity, and connects the client to it with the \`manage\` grant whatever it asked for. Admitted where the deployment allows a new unclaimed account \u2014 always on the hosted service, where it is deleted unless a person claims it, and on a self-hosted deployment only while it is empty \u2014 and counted per network address with the CLI's account creation. Repeating it for the same authorization answers the same account.`,
+    security: "public",
+    params: { id: { description: "The authorization's id." } },
+    request: OAuthConsentProofSchema,
+    response: OAuthConsentRedirectResponseSchema,
+    responseDescription: "The client's redirect URI with the authorization code.",
+    errors: {
+      ...CONSENT_ERRORS,
+      409: "This deployment no longer admits an account without a person (a self-hosted one that has been initialized), or another choice completed the authorization first.",
+      429: "Too many accounts were created from this network address. Carries Retry-After."
+    }
+  },
+  denyOauthConsent: {
+    method: "POST",
+    path: "/v1/console/oauth/{id}/deny",
+    tags: ["Console OAuth consent"],
+    summary: "OAuth consent: deny",
+    description: `${CONSENT_DESCRIPTION} Anyone holding the link may decline, signed in or not.`,
+    security: "public",
+    params: { id: { description: "The authorization's id." } },
+    request: OAuthConsentProofSchema,
+    response: OAuthConsentRedirectResponseSchema,
+    responseDescription: "The client's redirect URI with `error=access_denied`.",
+    errors: CONSENT_ERRORS
+  },
   cliBrowserGoogle: {
     method: "POST",
     path: "/v1/cli/browser/{id}/google",
@@ -19237,6 +19328,93 @@ function operationPath(name, ...rest) {
   return query === void 0 ? filled : filled + searchSuffix(query);
 }
 
+// src/client.ts
+var CLI_OPERATIONS = /* @__PURE__ */ new Set([
+  "getCliCapabilities",
+  "bootstrapCliAccount",
+  "createCliOperation",
+  "pollCliOperation",
+  "getCliAccount",
+  "getCliUsage",
+  "openCliLogin",
+  "redeemCliLogin",
+  "revokeCliCredential"
+]);
+var pathFor = operationPath;
+var GatewayClient = class {
+  transport;
+  source;
+  constructor(transport, source) {
+    this.transport = transport;
+    this.source = source;
+  }
+  /**
+   * Sends one documented operation and parses its answer with that operation's
+   * own schema.
+   *
+   * The parse is not a formality. zod drops what a schema does not declare, so
+   * this is what keeps an undocumented server field — or anything an unexpected
+   * response carries — out of the values the commands go on to print.
+   */
+  async publicCall(name, { params, query, body, key, url: url2, headers } = {}) {
+    const wire = await this.transport.request(
+      url2 ?? this.source.url(),
+      pathFor(name, params, query),
+      {
+        method: CATALOG[name].method,
+        ...body === void 0 ? {} : { body },
+        ...key === void 0 ? {} : { key },
+        ...headers === void 0 ? {} : { headers }
+      }
+    );
+    return { data: parse4(name, wire.data) };
+  }
+  /** The same call, with the connection's management credential attached. */
+  async call(name, options = {}) {
+    const key = options.key ?? this.credential(name);
+    try {
+      return await this.publicCall(name, { ...options, key });
+    } catch (error51) {
+      if (error51 instanceof CliError && error51.details?.status === 401 && options.key === void 0 && this.source.environmentKey())
+        throw new CliError(
+          error51.code,
+          error51.message,
+          `Check ${MANAGEMENT_KEY_ENV}: the deployment refused the key it holds.`,
+          error51.exitCode,
+          error51.details
+        );
+      throw error51;
+    }
+  }
+  /**
+   * The current management credential, or the refusal that names the way back.
+   * An admin operation is also reachable from a plain deployment connection,
+   * which is why those get the wider instruction.
+   */
+  credential(name) {
+    const token = this.source.managementKey();
+    if (!token)
+      fail(
+        "login_required",
+        "The selected connection is not authenticated.",
+        CLI_OPERATIONS.has(name) ? `Run agw account login, or set ${MANAGEMENT_KEY_ENV}.` : `Run agw account login or agw deployment connect, or set ${MANAGEMENT_KEY_ENV}.`,
+        4
+      );
+    return token;
+  }
+};
+function parse4(name, data) {
+  const parsed = CATALOG[name].response.safeParse(data);
+  if (!parsed.success)
+    fail(
+      "invalid_response",
+      `The deployment answered ${String(name)} with an unusable body.`,
+      "Check that the CLI and the deployment are the same release.",
+      3
+    );
+  return parsed.data;
+}
+
 // src/login.ts
 import { createServer } from "node:http";
 import { hostname as hostname4, platform as platform2, release } from "node:os";
@@ -19399,17 +19577,6 @@ function jsonLine(line, paint) {
 }
 
 // src/context.ts
-var CLI_OPERATIONS = /* @__PURE__ */ new Set([
-  "getCliCapabilities",
-  "bootstrapCliAccount",
-  "createCliOperation",
-  "pollCliOperation",
-  "getCliAccount",
-  "getCliUsage",
-  "openCliLogin",
-  "redeemCliLogin",
-  "revokeCliCredential"
-]);
 var LOGIN_TIMEOUT_SECONDS = 300;
 var LOGIN_RECORD_MS = 36e5;
 var LOOPBACK_GRACE_MS = 1e4;
@@ -19422,7 +19589,6 @@ var defaultIo = () => ({
 });
 var KEY_OPERATION_KINDS = /* @__PURE__ */ new Set(["app.add", "app.key.add"]);
 var OPERATION_RETENTION_MS = 90 * 864e5;
-var pathFor = operationPath;
 var RETRYABLE_STATUS = /* @__PURE__ */ new Set([408, 425, 429]);
 var OPERATION_BOUND_STATUS = /* @__PURE__ */ new Set([409, 410]);
 function definitiveRefusal(error51) {
@@ -19447,7 +19613,8 @@ function bootstrapCredential(operation2) {
 var Context = class {
   store;
   state;
-  transport;
+  /** Every request this context sends goes through it. */
+  client;
   flags;
   io;
   /** Operations whose result this run has printed, released once stdout has taken it. */
@@ -19456,9 +19623,13 @@ var Context = class {
   constructor(store, state, transport, flags, io = {}) {
     this.store = store;
     this.state = state;
-    this.transport = transport;
     this.flags = flags;
     this.io = { ...defaultIo(), ...io };
+    this.client = new GatewayClient(transport, {
+      url: () => this.url,
+      managementKey: () => this.managementKey,
+      environmentKey: () => this.environmentKey
+    });
   }
   get active() {
     return this.state.active;
@@ -19491,70 +19662,13 @@ var Context = class {
   async save() {
     await this.store.write(this.state);
   }
-  /**
-   * Sends one documented operation and parses its answer with that operation's
-   * own schema.
-   *
-   * The parse is not a formality. zod drops what a schema does not declare, so
-   * this is what keeps an undocumented server field — or anything an unexpected
-   * response carries — out of the values the commands go on to print.
-   */
-  async publicCall(name, { params, query, body, key, url: url2, headers } = {}) {
-    const wire = await this.transport.request(
-      url2 ?? this.url,
-      pathFor(name, params, query),
-      {
-        method: CATALOG[name].method,
-        ...body === void 0 ? {} : { body },
-        ...key === void 0 ? {} : { key },
-        ...headers === void 0 ? {} : { headers }
-      }
-    );
-    return { data: this.parse(name, wire.data) };
-  }
-  parse(name, data) {
-    const parsed = CATALOG[name].response.safeParse(data);
-    if (!parsed.success)
-      fail(
-        "invalid_response",
-        `The deployment answered ${String(name)} with an unusable body.`,
-        "Check that the CLI and the deployment are the same release.",
-        3
-      );
-    return parsed.data;
+  /** One documented operation, sent with only the credential `options` names; see {@link GatewayClient}. */
+  publicCall(name, options = {}) {
+    return this.client.publicCall(name, options);
   }
   /** The same call, with the connection's management credential attached. */
-  async call(name, options = {}) {
-    const key = options.key ?? this.credential(name);
-    try {
-      return await this.publicCall(name, { ...options, key });
-    } catch (error51) {
-      if (error51 instanceof CliError && error51.details?.status === 401 && options.key === void 0 && this.environmentKey)
-        throw new CliError(
-          error51.code,
-          error51.message,
-          `Check ${MANAGEMENT_KEY_ENV}: the deployment refused the key it holds.`,
-          error51.exitCode,
-          error51.details
-        );
-      throw error51;
-    }
-  }
-  /**
-   * The current management credential, or the refusal that names the way back.
-   * An admin operation is also reachable from a plain deployment connection,
-   * which is why those get the wider instruction.
-   */
-  credential(name) {
-    const token = this.managementKey;
-    if (!token)
-      fail(
-        "login_required",
-        "The selected connection is not authenticated.",
-        CLI_OPERATIONS.has(name) ? `Run agw account login, or set ${MANAGEMENT_KEY_ENV}.` : `Run agw account login or agw deployment connect, or set ${MANAGEMENT_KEY_ENV}.`,
-        4
-      );
-    return token;
+  call(name, options = {}) {
+    return this.client.call(name, options);
   }
   /**
    * The record for one operation: the one an identical earlier command left,
@@ -21622,10 +21736,7 @@ function app(command, result, context, style2) {
         ],
         style2
       ),
-      ...notes([
-        ...result.validation.remote ? [] : result.validation.skipped,
-        ...result.limitations
-      ])
+      ...notes(result.limitations)
     ];
   if ("definition" in result) {
     const dryRun = "dryRun" in result;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maxceem/agw",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "type": "module",
   "description": "Manage App AI Gateway from a terminal or coding agent: providers, iOS and server apps, usage, and self-hosted deployment on Cloudflare",
   "keywords": [
@@ -25,7 +25,7 @@
     "directory": "cli"
   },
   "bugs": "https://github.com/maxceem/app-ai-gateway/issues",
-  "upgradeFrom": ["0.5.0", "0.4.0"],
+  "upgradeFrom": ["0.5.2", "0.5.1", "0.5.0", "0.4.0"],
   "license": "Apache-2.0",
   "bin": {
     "agw": "dist/agw.mjs"