@mootup/moot-cli 0.1.0-rc.0 → 0.2.0

package/README.md

@@ -1,21 +1,28 @@
 # @mootup/moot-cli
 
-Host-side operator CLI for the Moot agent team workflow. Bin name: `mootup`.
+Host-side operator CLI for the Moot agent team workflow. Bin name: `moot`.
 
 ## Install
 
-One-off via `npx`:
+### Recommended: user-local install (no sudo)
 
-    npx @mootup/moot-cli login
-    npx @mootup/moot-cli init
+    npm i -g --prefix ~/.local @mootup/moot-cli
+    moot --version
+
+Most Ubuntu/Debian systems already have `~/.local/bin` in PATH. If `moot --version` is not found after install, add the export to `~/.bashrc`:
+
+    export PATH="$HOME/.local/bin:$PATH"
 
-Or global install:
+### Alternative: system-wide install (requires sudo)
 
-    npm i -g @mootup/moot-cli
-    mootup login
-    mootup init
+    sudo npm i -g @mootup/moot-cli
+    moot --version
+
+### Ephemeral: npx (no install)
+
+    npx @mootup/moot-cli login
 
-Requires Node ≥ 20, Docker, and [`@devcontainers/cli`](https://github.com/devcontainers/cli) on `PATH`:
+Requires Node ≥ 18, Docker, and [`@devcontainers/cli`](https://github.com/devcontainers/cli) on PATH:
 
     npm i -g @devcontainers/cli
 
@@ -24,41 +31,41 @@ Requires Node ≥ 20, Docker, and [`@devcontainers/cli`](https://github.com/devc
 ```bash
 # 1. Create a personal access token at https://mootup.io/settings/api-keys
 # 2. Authenticate (stored under ~/.mootup/credentials.json, mode 0600):
-mootup login
+moot login
 
 # 3. Provision actors and install .devcontainer/ in your repo:
 cd my-project
-mootup init
+moot init
 
 # 4. Bring the devcontainer up and start the agent team:
-mootup up
+moot up
 
 # 5. Inspect, attach, compact as needed:
-mootup status
-mootup attach leader
-mootup compact spec
+moot status
+moot attach leader
+moot compact spec
 
 # 6. Stop everything:
-mootup down
+moot down
 ```
 
 ## Command reference
 
 | Command | Runs | Delegates to |
 |---|---|---|
-| `mootup login [--token <pat>] [--api-url <url>]` | host | writes `~/.mootup/credentials.json` |
-| `mootup init [--force] [--yes] [--api-url <url>]` | host | rotates actor keys, writes `.moot/actors.json`, copies `.devcontainer/` |
-| `mootup up` | host → container | `devcontainer up` + `docker exec <cid> moot up` |
-| `mootup down [role]` | container | `docker exec <cid> moot down [role]` |
-| `mootup status` | container | `docker exec <cid> moot status` |
-| `mootup attach <role>` | container | `docker exec -it <cid> moot attach <role>` |
-| `mootup compact [role]` | container | `docker exec <cid> moot compact [role]` |
+| `moot login [--token <pat>] [--api-url <url>]` | host | writes `~/.mootup/credentials.json` |
+| `moot init [--force] [--yes] [--api-url <url>]` | host | rotates actor keys, writes `.moot/actors.json`, copies `.devcontainer/` |
+| `moot up` | host → container | `devcontainer up` + `docker exec <cid> moot up` |
+| `moot down [role]` | container | `docker exec <cid> moot down [role]` |
+| `moot status` | container | `docker exec <cid> moot status` |
+| `moot attach <role>` | container | `docker exec -it <cid> moot attach <role>` |
+| `moot compact [role]` | container | `docker exec <cid> moot compact [role]` |
 
-The `up`, `down`, `status`, `attach`, and `compact` commands look up the running container by the `devcontainer.local_folder` label the devcontainer CLI stamps on each container; no container → clear error prompting `mootup up`.
+The `up`, `down`, `status`, `attach`, and `compact` commands look up the running container by the `devcontainer.local_folder` label the devcontainer CLI stamps on each container; no container → clear error prompting `moot up`.
 
 ## Scope vs the Python CLI
 
-`@mootup/moot-cli` covers only the host-side operator surface. The Python `moot` CLI inside the devcontainer remains canonical for in-container orchestration (tmux, MCP adapter, channel adapter, hooks, team profile). `mootup init` in v0.1.0-rc.0 installs `.moot/actors.json` + `.devcontainer/` only; skill / CLAUDE.md / hook bundle installation is tracked as a follow-up run (v0.2.0).
+`@mootup/moot-cli` covers only the host-side operator surface. The Python `moot` CLI inside the devcontainer remains canonical for in-container orchestration (tmux, MCP adapter, channel adapter, hooks, team profile). `moot init` in v0.1.0 installs `.moot/actors.json` + `.devcontainer/` only; skill / CLAUDE.md / hook bundle installation is tracked as a follow-up run.
 
 ## Manual smoke test (operator)
 
@@ -66,11 +73,11 @@ Run from a fresh test directory after logging in:
 
     mkdir /tmp/mootup-smoke && cd /tmp/mootup-smoke
     git init
-    mootup init
+    moot init
     test -f .moot/actors.json && echo "actors.json ✓"
     test -d .devcontainer && echo "devcontainer ✓"
-    mootup up
-    mootup status
-    mootup down
+    moot up
+    moot status
+    moot down
 
-`mootup init` hits the authenticated `/api/actors/me`, `/api/actors/me/agents`, `/api/actors/{id}/rotate-key` endpoints against the API URL stored at login time. A reachable backend is required.
+`moot init` hits the authenticated `/api/actors/me`, `/api/actors/me/agents`, `/api/actors/{id}/rotate-key` endpoints against the API URL stored at login time. A reachable backend is required.

package/dist/auth/archetypes.d.ts

@@ -0,0 +1,10 @@
+export interface ArchetypeEntry {
+    id: string;
+    version: string;
+    description: string;
+}
+export declare const ARCHETYPE_CATALOG: readonly ArchetypeEntry[];
+export declare const DEFAULT_ARCHETYPE = "mootup/loop-6";
+export declare function findArchetype(id: string): ArchetypeEntry | null;
+export declare function promptArchetype(prompt?: (q: string) => Promise<string>): Promise<ArchetypeEntry>;
+//# sourceMappingURL=archetypes.d.ts.map

package/dist/auth/archetypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"archetypes.d.ts","sourceRoot":"","sources":["../../src/auth/archetypes.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,iBAAiB,EAAE,SAAS,cAAc,EAO7C,CAAC;AAEX,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAE/D;AAED,wBAAsB,eAAe,CACnC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GACtC,OAAO,CAAC,cAAc,CAAC,CAkBzB"}

package/dist/auth/archetypes.js

@@ -0,0 +1,39 @@
+import { createInterface } from 'node:readline/promises';
+export const ARCHETYPE_CATALOG = [
+    { id: 'mootup/loop-6', version: '1.0', description: 'Full pipeline (product/leader/spec/impl/qa/librarian)' },
+    { id: 'mootup/loop-4', version: '1.0', description: 'Core pipeline (product/spec/impl/qa)' },
+    { id: 'mootup/loop-4-observer', version: '1.0', description: 'Core + librarian' },
+    { id: 'mootup/loop-4-parallel', version: '1.0', description: 'Core + parallel impl-a/impl-b' },
+    { id: 'mootup/loop-4-split-leader', version: '1.0', description: 'Core + dedicated leader' },
+    { id: 'mootup/loop-3', version: '1.0', description: 'Minimal (leader/impl/qa)' },
+];
+export const DEFAULT_ARCHETYPE = 'mootup/loop-6';
+export function findArchetype(id) {
+    return ARCHETYPE_CATALOG.find((a) => a.id === id) ?? null;
+}
+export async function promptArchetype(prompt) {
+    const ask = prompt ?? defaultPrompt;
+    console.log('Available team archetypes:');
+    ARCHETYPE_CATALOG.forEach((a, i) => {
+        const marker = a.id === DEFAULT_ARCHETYPE ? ' (default)' : '';
+        console.log(`  ${i + 1}. ${a.id}${marker} — ${a.description}`);
+    });
+    const answer = (await ask(`Select archetype [1-${ARCHETYPE_CATALOG.length}, default=${DEFAULT_ARCHETYPE}]: `)).trim();
+    if (!answer)
+        return findArchetype(DEFAULT_ARCHETYPE);
+    const idx = Number.parseInt(answer, 10);
+    if (Number.isFinite(idx) && idx >= 1 && idx <= ARCHETYPE_CATALOG.length) {
+        return ARCHETYPE_CATALOG[idx - 1];
+    }
+    const byId = findArchetype(answer);
+    if (byId)
+        return byId;
+    throw new Error(`Unknown archetype: ${answer}`);
+}
+async function defaultPrompt(q) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    const answer = await rl.question(q);
+    rl.close();
+    return answer;
+}
+//# sourceMappingURL=archetypes.js.map

package/dist/auth/archetypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"archetypes.js","sourceRoot":"","sources":["../../src/auth/archetypes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAQzD,MAAM,CAAC,MAAM,iBAAiB,GAA8B;IAC1D,EAAE,EAAE,EAAE,eAAe,EAAe,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,uDAAuD,EAAE;IAC1H,EAAE,EAAE,EAAE,eAAe,EAAe,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,sCAAsC,EAAE;IACzG,EAAE,EAAE,EAAE,wBAAwB,EAAM,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE;IACrF,EAAE,EAAE,EAAE,wBAAwB,EAAM,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,+BAA+B,EAAE;IAClG,EAAE,EAAE,EAAE,4BAA4B,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,yBAAyB,EAAE;IAC5F,EAAE,EAAE,EAAE,eAAe,EAAe,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,0BAA0B,EAAE;CACrF,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAEjD,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAuC;IAEvC,MAAM,GAAG,GAAG,MAAM,IAAI,aAAa,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IAC1C,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,KAAK,iBAAiB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,MAAM,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,CACb,MAAM,GAAG,CAAC,uBAAuB,iBAAiB,CAAC,MAAM,aAAa,iBAAiB,KAAK,CAAC,CAC9F,CAAC,IAAI,EAAE,CAAC;IACT,IAAI,CAAC,MAAM;QAAE,OAAO,aAAa,CAAC,iBAAiB,CAAE,CAAC;IACtD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,iBAAiB,CAAC,MAAM,EAAE,CAAC;QACxE,OAAO,iBAAiB,CAAC,GAAG,GAAG,CAAC,CAAE,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,CAAS;IACpC,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACpC,EAAE,CAAC,KAAK,EAAE,CAAC;IACX,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/auth/credentials.d.ts

@@ -0,0 +1,21 @@
+export declare const KEYTAR_SERVICE = "mootup-cli";
+export interface OAuthCredentialBundle {
+    api_url: string;
+    user_id: string;
+    access_token: string;
+    refresh_token: string;
+    access_token_expires_at: number;
+    installation_id?: string;
+}
+type KeytarLike = {
+    setPassword: (service: string, account: string, password: string) => Promise<void>;
+    getPassword: (service: string, account: string) => Promise<string | null>;
+    deletePassword: (service: string, account: string) => Promise<boolean>;
+};
+export declare function __setKeytarForTest(k: KeytarLike | null): void;
+export declare function storeOAuthCredential(profile: string, creds: OAuthCredentialBundle): Promise<void>;
+export declare function loadRefreshToken(profile: string): Promise<string | null>;
+export declare function deleteOAuthCredential(profile: string): Promise<void>;
+export declare function __clearSessionMemoryForTest(): void;
+export {};
+//# sourceMappingURL=credentials.d.ts.map

package/dist/auth/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/auth/credentials.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,cAAc,eAAe,CAAC;AAE3C,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,MAAM,CAAC;IAChC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAID,KAAK,UAAU,GAAG;IAChB,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnF,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1E,cAAc,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACxE,CAAC;AAIF,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,UAAU,GAAG,IAAI,GAAG,IAAI,CAE7D;AAoBD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,IAAI,CAAC,CA8Bf;AAYD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAY9E;AAED,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAc1E;AAED,wBAAgB,2BAA2B,IAAI,IAAI,CAElD"}

package/dist/auth/credentials.js

@@ -0,0 +1,97 @@
+import { loadCredential, storeCredential, deleteCredential, } from '../credential.js';
+export const KEYTAR_SERVICE = 'mootup-cli';
+const sessionRefreshTokenMemory = new Map();
+let keytarOverride = null;
+export function __setKeytarForTest(k) {
+    keytarOverride = k;
+}
+async function loadKeytar() {
+    if (keytarOverride)
+        return keytarOverride;
+    try {
+        // keytar is an optionalDependency; dynamic import keeps it optional at build time.
+        const modName = 'keytar';
+        const mod = (await import(/* @vite-ignore */ modName));
+        return mod.default ?? mod;
+    }
+    catch {
+        return null;
+    }
+}
+function keychainRef(profile) {
+    return `${KEYTAR_SERVICE}:${profile}:refresh`;
+}
+export async function storeOAuthCredential(profile, creds) {
+    const keytar = await loadKeytar();
+    let refresh_token_ref;
+    if (keytar) {
+        const ref = keychainRef(profile);
+        try {
+            await keytar.setPassword(KEYTAR_SERVICE, ref, creds.refresh_token);
+            refresh_token_ref = ref;
+        }
+        catch (err) {
+            printKeychainFallback(err);
+            sessionRefreshTokenMemory.set(profile, creds.refresh_token);
+            refresh_token_ref = undefined;
+        }
+    }
+    else {
+        printKeychainFallback(new Error('keytar module not installed'));
+        sessionRefreshTokenMemory.set(profile, creds.refresh_token);
+    }
+    const cred = {
+        api_url: creds.api_url,
+        token: creds.access_token,
+        user_id: creds.user_id,
+        credential_type: 'oauth',
+        access_token_expires_at: creds.access_token_expires_at,
+    };
+    if (refresh_token_ref !== undefined)
+        cred.refresh_token_ref = refresh_token_ref;
+    if (creds.installation_id !== undefined)
+        cred.installation_id = creds.installation_id;
+    storeCredential(cred, profile);
+}
+function printKeychainFallback(err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    const filePath = `${process.env.HOME ?? '~'}/.mootup/credentials.json`;
+    console.error(`note: keychain unavailable (${msg}); refresh-token lives in memory ` +
+        `for this session only. Re-authenticate on next session. ` +
+        `(using file-based storage at ${filePath} for non-secret fields only)`);
+}
+export async function loadRefreshToken(profile) {
+    const cred = loadCredential(profile);
+    if (!cred || cred.credential_type !== 'oauth' || !cred.refresh_token_ref) {
+        return sessionRefreshTokenMemory.get(profile) ?? null;
+    }
+    const keytar = await loadKeytar();
+    if (!keytar)
+        return sessionRefreshTokenMemory.get(profile) ?? null;
+    try {
+        return await keytar.getPassword(KEYTAR_SERVICE, cred.refresh_token_ref);
+    }
+    catch {
+        return null;
+    }
+}
+export async function deleteOAuthCredential(profile) {
+    const cred = loadCredential(profile);
+    if (cred?.refresh_token_ref) {
+        const keytar = await loadKeytar();
+        if (keytar) {
+            try {
+                await keytar.deletePassword(KEYTAR_SERVICE, cred.refresh_token_ref);
+            }
+            catch {
+                // best-effort
+            }
+        }
+    }
+    sessionRefreshTokenMemory.delete(profile);
+    deleteCredential(profile);
+}
+export function __clearSessionMemoryForTest() {
+    sessionRefreshTokenMemory.clear();
+}
+//# sourceMappingURL=credentials.js.map

package/dist/auth/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/auth/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,eAAe,EACf,gBAAgB,GAEjB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC;AAW3C,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAQ5D,IAAI,cAAc,GAAsB,IAAI,CAAC;AAE7C,MAAM,UAAU,kBAAkB,CAAC,CAAoB;IACrD,cAAc,GAAG,CAAC,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAC1C,IAAI,CAAC;QACH,mFAAmF;QACnF,MAAM,OAAO,GAAG,QAAQ,CAAC;QACzB,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAEvC,CAAC;QACf,OAAO,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,GAAG,cAAc,IAAI,OAAO,UAAU,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAe,EACf,KAA4B;IAE5B,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,IAAI,iBAAqC,CAAC;IAE1C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,WAAW,CAAC,cAAc,EAAE,GAAG,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;YACnE,iBAAiB,GAAG,GAAG,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC3B,yBAAyB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;YAC5D,iBAAiB,GAAG,SAAS,CAAC;QAChC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,qBAAqB,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC;QAChE,yBAAyB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,IAAI,GAAe;QACvB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK,CAAC,YAAY;QACzB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,eAAe,EAAE,OAAO;QACxB,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;KACvD,CAAC;IACF,IAAI,iBAAiB,KAAK,SAAS;QAAE,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAChF,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;QAAE,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;IAEtF,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAY;IACzC,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,2BAA2B,CAAC;IACvE,OAAO,CAAC,KAAK,CACX,+BAA+B,GAAG,mCAAmC;QACrE,0DAA0D;QAC1D,gCAAgC,QAAQ,8BAA8B,CACvE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAe;IACpD,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,eAAe,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzE,OAAO,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;IACxD,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;IACnE,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,WAAW,CAAC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAe;IACzD,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,IAAI,EAAE,iBAAiB,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;QAClC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,cAAc,CAAC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACtE,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IACD,yBAAyB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1C,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,yBAAyB,CAAC,KAAK,EAAE,CAAC;AACpC,CAAC"}

package/dist/auth/oauth.d.ts

@@ -0,0 +1,42 @@
+export interface OAuthBrowserFlowOptions {
+    apiUrl: string;
+    clientId?: string;
+    scope?: string;
+    fetchImpl?: typeof globalThis.fetch;
+    openImpl?: (url: string) => Promise<void>;
+    waitForCallbackImpl?: (expectedState: string) => Promise<string>;
+}
+export interface OAuthTokenResponse {
+    access_token: string;
+    refresh_token: string;
+    expires_in: number;
+    token_type: string;
+}
+export interface BrowserFlowResult {
+    access_token: string;
+    refresh_token: string;
+    access_token_expires_at: number;
+    token_type: string;
+}
+export declare function shouldUseBrowser(): boolean;
+export declare function base64UrlEncode(buf: Buffer): string;
+export declare function mintPkcePair(): {
+    verifier: string;
+    challenge: string;
+};
+export declare function mintState(): string;
+export declare function generateIdempotencyKey(): string;
+export declare function runBrowserFlow(opts: OAuthBrowserFlowOptions): Promise<BrowserFlowResult>;
+export declare function refreshAccessToken(opts: {
+    apiUrl: string;
+    refreshToken: string;
+    clientId?: string;
+    fetchImpl?: typeof globalThis.fetch;
+}): Promise<BrowserFlowResult>;
+export declare function revokeRefreshToken(opts: {
+    apiUrl: string;
+    refreshToken: string;
+    clientId?: string;
+    fetchImpl?: typeof globalThis.fetch;
+}): Promise<void>;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/auth/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACpC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,mBAAmB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,MAAM,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,gBAAgB,IAAI,OAAO,CAI1C;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wBAAgB,YAAY,IAAI;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAItE;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,iBAAiB,CAAC,CA+D5B;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CACrC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAuB7B;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CACrC,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhB"}

package/dist/auth/oauth.js

@@ -0,0 +1,200 @@
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import { createServer } from 'node:net';
+import { spawn } from 'node:child_process';
+export function shouldUseBrowser() {
+    if (process.env.MOOTUP_FORCE_DEVICE_CODE === '1')
+        return false;
+    if (process.platform === 'darwin' || process.platform === 'win32')
+        return true;
+    return Boolean(process.env.DISPLAY || process.env.WAYLAND_DISPLAY);
+}
+export function base64UrlEncode(buf) {
+    return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+export function mintPkcePair() {
+    const verifier = base64UrlEncode(randomBytes(32));
+    const challenge = base64UrlEncode(createHash('sha256').update(verifier).digest());
+    return { verifier, challenge };
+}
+export function mintState() {
+    return randomBytes(16).toString('hex');
+}
+export function generateIdempotencyKey() {
+    return randomUUID();
+}
+export async function runBrowserFlow(opts) {
+    const clientId = opts.clientId ?? 'mootup-cli';
+    const scope = opts.scope ?? 'team:install';
+    const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+    const openFn = opts.openImpl ?? openBrowser;
+    const { verifier, challenge } = mintPkcePair();
+    const state = mintState();
+    let port;
+    let waitForCallback;
+    if (opts.waitForCallbackImpl) {
+        port = 0;
+        waitForCallback = opts.waitForCallbackImpl;
+    }
+    else {
+        const listener = await startCallbackListener(state);
+        port = listener.port;
+        waitForCallback = listener.wait;
+    }
+    const redirectUri = `http://localhost:${port}/callback`;
+    const authorizeUrl = `${opts.apiUrl}/oauth/authorize?response_type=code&client_id=${encodeURIComponent(clientId)}` +
+        `&redirect_uri=${encodeURIComponent(redirectUri)}&scope=${encodeURIComponent(scope)}` +
+        `&state=${state}&code_challenge=${challenge}&code_challenge_method=S256`;
+    console.log(`Opening browser for authorization: ${authorizeUrl}`);
+    try {
+        await openFn(authorizeUrl);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Could not launch browser (${msg}). Open the URL above manually.`);
+    }
+    const code = await waitForCallback(state);
+    const tokenRes = await fetchImpl(`${opts.apiUrl}/oauth/token`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            grant_type: 'authorization_code',
+            code,
+            code_verifier: verifier,
+            redirect_uri: redirectUri,
+            client_id: clientId,
+        }).toString(),
+    });
+    if (tokenRes.status !== 200) {
+        const body = await tokenRes.text();
+        throw new Error(`/oauth/token exchange failed (${tokenRes.status}): ${body}`);
+    }
+    const body = (await tokenRes.json());
+    if (!body.access_token || !body.refresh_token) {
+        throw new Error('/oauth/token response missing access_token or refresh_token');
+    }
+    return {
+        access_token: body.access_token,
+        refresh_token: body.refresh_token,
+        access_token_expires_at: Math.floor(Date.now() / 1000) + (body.expires_in ?? 0),
+        token_type: body.token_type ?? 'Bearer',
+    };
+}
+export async function refreshAccessToken(opts) {
+    const clientId = opts.clientId ?? 'mootup-cli';
+    const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+    const res = await fetchImpl(`${opts.apiUrl}/oauth/token`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            grant_type: 'refresh_token',
+            refresh_token: opts.refreshToken,
+            client_id: clientId,
+        }).toString(),
+    });
+    if (res.status !== 200) {
+        const body = await res.text();
+        throw new Error(`/oauth/token refresh failed (${res.status}): ${body}`);
+    }
+    const body = (await res.json());
+    return {
+        access_token: body.access_token,
+        refresh_token: body.refresh_token,
+        access_token_expires_at: Math.floor(Date.now() / 1000) + (body.expires_in ?? 0),
+        token_type: body.token_type ?? 'Bearer',
+    };
+}
+export async function revokeRefreshToken(opts) {
+    const clientId = opts.clientId ?? 'mootup-cli';
+    const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+    await fetchImpl(`${opts.apiUrl}/oauth/revoke`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            token: opts.refreshToken,
+            client_id: clientId,
+        }).toString(),
+    });
+}
+async function openBrowser(url) {
+    const cmd = process.platform === 'darwin'
+        ? 'open'
+        : process.platform === 'win32'
+            ? 'start'
+            : 'xdg-open';
+    const child = spawn(cmd, [url], { stdio: 'ignore', detached: true, shell: process.platform === 'win32' });
+    child.unref();
+}
+async function startCallbackListener(expectedState) {
+    let server;
+    let resolveWait;
+    let rejectWait;
+    const waitPromise = new Promise((resolve, reject) => {
+        resolveWait = resolve;
+        rejectWait = reject;
+    });
+    server = createServer((socket) => {
+        let buf = '';
+        socket.on('data', (chunk) => {
+            buf += chunk.toString('utf8');
+            const headerEnd = buf.indexOf('\r\n\r\n');
+            if (headerEnd === -1)
+                return;
+            const firstLine = buf.slice(0, buf.indexOf('\r\n'));
+            const match = firstLine.match(/^GET\s+(\S+)\s+HTTP/);
+            if (!match) {
+                socket.end('HTTP/1.1 400 Bad Request\r\n\r\n');
+                return;
+            }
+            const pathAndQuery = match[1];
+            const url = new URL(pathAndQuery, 'http://localhost');
+            const gotState = url.searchParams.get('state');
+            const gotCode = url.searchParams.get('code');
+            const gotError = url.searchParams.get('error');
+            if (gotError) {
+                sendResponse(socket, 400, `OAuth error: ${gotError}. You can close this window.`);
+                rejectWait(new Error(`OAuth error: ${gotError}`));
+                return;
+            }
+            if (!gotState || !gotCode || gotState !== expectedState) {
+                sendResponse(socket, 400, 'OAuth state mismatch. You can close this window.');
+                rejectWait(new Error('OAuth state mismatch'));
+                return;
+            }
+            sendResponse(socket, 200, 'Authorization received. You can close this window.');
+            resolveWait(gotCode);
+        });
+        socket.on('error', () => {
+            // ignore
+        });
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', resolve);
+    });
+    const address = server.address();
+    const port = typeof address === 'object' && address ? address.port : 0;
+    return {
+        port,
+        wait: async (expected) => {
+            try {
+                const code = await waitPromise;
+                return code;
+            }
+            finally {
+                server.close();
+            }
+            // eslint-disable-next-line @typescript-eslint/no-unused-vars
+            void expected;
+        },
+    };
+}
+function sendResponse(socket, status, body) {
+    const reason = status === 200 ? 'OK' : 'Bad Request';
+    socket.end(`HTTP/1.1 ${status} ${reason}\r\n` +
+        'Content-Type: text/plain; charset=utf-8\r\n' +
+        `Content-Length: ${Buffer.byteLength(body)}\r\n` +
+        'Connection: close\r\n' +
+        '\r\n' +
+        body);
+}
+//# sourceMappingURL=oauth.js.map

package/dist/auth/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,YAAY,EAA4B,MAAM,UAAU,CAAC;AAClE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAyB3C,MAAM,UAAU,gBAAgB;IAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,QAAQ,GAAG,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAClF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA6B;IAE7B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,IAAI,WAAW,CAAC;IAE5C,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,YAAY,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAE1B,IAAI,IAAY,CAAC;IACjB,IAAI,eAA2D,CAAC;IAChE,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,CAAC;QACT,eAAe,GAAG,IAAI,CAAC,mBAAmB,CAAC;IAC7C,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QACrB,eAAe,GAAG,QAAQ,CAAC,IAAI,CAAC;IAClC,CAAC;IAED,MAAM,WAAW,GAAG,oBAAoB,IAAI,WAAW,CAAC;IACxD,MAAM,YAAY,GAChB,GAAG,IAAI,CAAC,MAAM,iDAAiD,kBAAkB,CAAC,QAAQ,CAAC,EAAE;QAC7F,iBAAiB,kBAAkB,CAAC,WAAW,CAAC,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE;QACrF,UAAU,KAAK,mBAAmB,SAAS,6BAA6B,CAAC;IAE3E,OAAO,CAAC,GAAG,CAAC,sCAAsC,YAAY,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CACX,6BAA6B,GAAG,iCAAiC,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IAE1C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,MAAM,cAAc,EAAE;QAC7D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,aAAa,EAAE,QAAQ;YACvB,YAAY,EAAE,WAAW;YACzB,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC,QAAQ,EAAE;KACd,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuB,CAAC;IAC3D,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,uBAAuB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;QAC/E,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;KACxC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAKxC;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACrD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,MAAM,cAAc,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC,QAAQ,EAAE;KACd,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;IACtD,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,uBAAuB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;QAC/E,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;KACxC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAKxC;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACrD,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,MAAM,eAAe,EAAE;QAC7C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,KAAK,EAAE,IAAI,CAAC,YAAY;YACxB,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC,QAAQ,EAAE;KACd,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW;IACpC,MAAM,GAAG,GACP,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAC3B,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC5B,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,UAAU,CAAC;IACnB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC;IAC1G,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AAOD,KAAK,UAAU,qBAAqB,CAAC,aAAqB;IACxD,IAAI,MAAc,CAAC;IACnB,IAAI,WAAmC,CAAC;IACxC,IAAI,UAAgC,CAAC;IACrC,MAAM,WAAW,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1D,WAAW,GAAG,OAAO,CAAC;QACtB,UAAU,GAAG,MAAM,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,YAAY,CAAC,CAAC,MAAc,EAAE,EAAE;QACvC,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9B,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC1C,IAAI,SAAS,KAAK,CAAC,CAAC;gBAAE,OAAO;YAC7B,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YACpD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACrD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;gBAC/C,OAAO;YACT,CAAC;YACD,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;YACtD,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC7C,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,QAAQ,EAAE,CAAC;gBACb,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,gBAAgB,QAAQ,8BAA8B,CAAC,CAAC;gBAClF,UAAU,CAAC,IAAI,KAAK,CAAC,gBAAgB,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;gBACxD,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,kDAAkD,CAAC,CAAC;gBAC9E,UAAU,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;gBAC9C,OAAO;YACT,CAAC;YACD,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,oDAAoD,CAAC,CAAC;YAChF,WAAW,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,SAAS;QACX,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvE,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,KAAK,EAAE,QAAgB,EAAE,EAAE;YAC/B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC;gBAC/B,OAAO,IAAI,CAAC;YACd,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;YACD,6DAA6D;YAC7D,KAAK,QAAQ,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,MAAc,EAAE,IAAY;IAChE,MAAM,MAAM,GAAG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;IACrD,MAAM,CAAC,GAAG,CACR,YAAY,MAAM,IAAI,MAAM,MAAM;QAClC,6CAA6C;QAC7C,mBAAmB,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM;QAChD,uBAAuB;QACvB,MAAM;QACN,IAAI,CACL,CAAC;AACJ,CAAC"}

package/dist/auth/profile.d.ts

@@ -0,0 +1,3 @@
+export declare const PROFILE_RE: RegExp;
+export declare function validateProfile(profile: string): void;
+//# sourceMappingURL=profile.d.ts.map

package/dist/auth/profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../src/auth/profile.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,UAAU,QAAkB,CAAC;AAE1C,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAMrD"}

package/dist/auth/profile.js

@@ -0,0 +1,7 @@
+export const PROFILE_RE = /^[a-z0-9_-]+$/;
+export function validateProfile(profile) {
+    if (!PROFILE_RE.test(profile)) {
+        throw new Error(`invalid profile name '${profile}' (must match ${PROFILE_RE})`);
+    }
+}
+//# sourceMappingURL=profile.js.map

package/dist/auth/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/auth/profile.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,UAAU,GAAG,eAAe,CAAC;AAE1C,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,yBAAyB,OAAO,iBAAiB,UAAU,GAAG,CAC/D,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/bin.js

@@ -7,24 +7,42 @@ import { cmdDown } from './commands/down.js';
 import { cmdStatus } from './commands/status.js';
 import { cmdAttach } from './commands/attach.js';
 import { cmdCompact } from './commands/compact.js';
+import { cmdLogout } from './commands/logout.js';
+import { cmdRefresh } from './commands/refresh.js';
 const program = new Command();
 program
-    .name('mootup')
+    .name('moot')
     .description('Host-side operator CLI for the Moot agent team workflow')
-    .version('0.1.0-rc.0');
+    .version('0.1.0');
 program
     .command('login')
     .description('Authenticate against mootup.io and store credential')
     .option('--token <pat>', 'Personal access token (prompts if omitted)')
     .option('--api-url <url>', 'Moot API URL', 'https://mootup.io')
+    .option('--profile <name>', 'Named profile (default "default")')
     .action((opts) => cmdLogin(opts));
 program
     .command('init')
-    .description('Rotate actor keys, write .moot/actors.json, install .devcontainer/')
+    .description('Authenticate (OAuth), select harness + archetype, install team, write .moot/actors.json')
     .option('--force', 'Rotate keys for already-keyed agents (destructive)', false)
     .option('--yes', 'Skip all confirmation prompts', false)
     .option('--api-url <url>', 'Moot API URL (overrides stored credential)')
+    .option('--profile <name>', 'Named profile (default "default")')
+    .option('--archetype <id>', 'Archetype to install (skips prompt)')
+    .option('--harness <name>', 'Harness integration (claude-code, cursor-agent, cursor-ide, sdk)', 'claude-code')
+    .option('--show-token', 'For --harness sdk, print the full PAT plaintext', false)
     .action((opts) => cmdInit(opts));
+program
+    .command('logout')
+    .description('Revoke OAuth installation and clear local credential')
+    .option('--profile <name>', 'Named profile (default "default")')
+    .option('--all', 'Revoke all installations (alias for logout; multi-install deferred)', false)
+    .action((opts) => cmdLogout(opts));
+program
+    .command('refresh')
+    .description('Refresh the stored OAuth access token')
+    .option('--profile <name>', 'Named profile (default "default")')
+    .action((opts) => cmdRefresh(opts));
 program
     .command('up')
     .description('Bring the devcontainer up and start the agent team')