@otto-code/cli 0.8.10 → 0.8.13

package/dist/commands/hub/credentials.js

@@ -0,0 +1,143 @@
+import { randomUUID } from "node:crypto";
+import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
+import { z } from "zod";
+import { HubCommandError } from "./error.js";
+import { normalizeHubOrigin } from "./origin.js";
+const PRIVATE_DIRECTORY_MODE = 0o700;
+const PRIVATE_FILE_MODE = 0o600;
+const credentialRecordSchema = z
+    .object({ origin: z.string(), credential: z.string().min(1) })
+    .strict();
+const credentialFileSchema = z
+    .object({
+    version: z.literal(1),
+    activeOrigin: z.string().nullable(),
+    credentials: z.array(credentialRecordSchema),
+})
+    .strict()
+    .superRefine((value, context) => {
+    const origins = new Set();
+    for (const record of value.credentials) {
+        let normalized;
+        try {
+            normalized = normalizeHubOrigin(record.origin);
+        }
+        catch {
+            context.addIssue({ code: "custom", message: "Credential origin is invalid" });
+            continue;
+        }
+        if (normalized !== record.origin || origins.has(record.origin)) {
+            context.addIssue({
+                code: "custom",
+                message: "Credential origins must be unique and normalized",
+            });
+        }
+        origins.add(record.origin);
+    }
+    if (value.activeOrigin !== null && !origins.has(value.activeOrigin)) {
+        context.addIssue({ code: "custom", message: "Active credential is missing" });
+    }
+});
+export class PrivateHubCredentialStore {
+    constructor(env = process.env) {
+        this.filePath = path.join(resolveOttoHome(env), "hub-credentials.json");
+    }
+    active() {
+        const data = this.read();
+        if (data.activeOrigin === null)
+            return null;
+        return data.credentials.find((record) => record.origin === data.activeOrigin) ?? null;
+    }
+    get(origin) {
+        const normalizedOrigin = normalizeHubOrigin(origin);
+        return this.read().credentials.find((record) => record.origin === normalizedOrigin) ?? null;
+    }
+    save(credential) {
+        const origin = normalizeHubOrigin(credential.origin);
+        const current = this.read();
+        const remaining = current.credentials.filter((record) => record.origin !== origin);
+        this.write({
+            version: 1,
+            activeOrigin: origin,
+            credentials: [...remaining, { origin, credential: credential.credential }],
+        });
+    }
+    logoutActive() {
+        const current = this.read();
+        if (current.activeOrigin === null)
+            return null;
+        const removed = current.credentials.find((record) => record.origin === current.activeOrigin);
+        if (removed === undefined)
+            throw invalidCredentialFile();
+        this.write({
+            version: 1,
+            activeOrigin: null,
+            credentials: current.credentials.filter((record) => record.origin !== current.activeOrigin),
+        });
+        return removed;
+    }
+    read() {
+        let contents;
+        try {
+            contents = readFileSync(this.filePath, "utf8");
+        }
+        catch (error) {
+            if (isMissingFile(error))
+                return { version: 1, activeOrigin: null, credentials: [] };
+            throw credentialStorageError();
+        }
+        chmodPrivate(this.filePath, PRIVATE_FILE_MODE);
+        try {
+            return credentialFileSchema.parse(JSON.parse(contents));
+        }
+        catch {
+            throw invalidCredentialFile();
+        }
+    }
+    write(value) {
+        const parsed = credentialFileSchema.parse(value);
+        const directory = path.dirname(this.filePath);
+        mkdirSync(directory, { recursive: true, mode: PRIVATE_DIRECTORY_MODE });
+        chmodPrivate(directory, PRIVATE_DIRECTORY_MODE);
+        const temporaryPath = path.join(directory, `.${path.basename(this.filePath)}.${process.pid}.${randomUUID()}.tmp`);
+        try {
+            writeFileSync(temporaryPath, `${JSON.stringify(parsed, null, 2)}\n`, {
+                encoding: "utf8",
+                mode: PRIVATE_FILE_MODE,
+            });
+            renameSync(temporaryPath, this.filePath);
+            chmodPrivate(this.filePath, PRIVATE_FILE_MODE);
+        }
+        catch {
+            rmSync(temporaryPath, { force: true });
+            throw credentialStorageError();
+        }
+    }
+}
+function resolveOttoHome(env) {
+    const configured = env.OTTO_HOME ?? "~/.otto";
+    const expanded = configured === "~" ? homedir() : configured.replace(/^~\//u, `${homedir()}/`);
+    return path.resolve(expanded);
+}
+function chmodPrivate(target, mode) {
+    if (process.platform === "win32")
+        return;
+    try {
+        chmodSync(target, mode);
+    }
+    catch {
+        throw credentialStorageError();
+    }
+}
+function isMissingFile(error) {
+    return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+function invalidCredentialFile() {
+    return new HubCommandError("HUB_CREDENTIALS_INVALID", "Stored Hub login is invalid. Run `otto hub login <origin>` to replace it.");
+}
+function credentialStorageError() {
+    return new HubCommandError("HUB_CREDENTIALS_UNAVAILABLE", "Could not access the private Hub credential store under OTTO_HOME.");
+}
+//# sourceMappingURL=credentials.js.map

package/dist/commands/hub/daemon-client.d.ts

@@ -0,0 +1,27 @@
+export interface HubStatus {
+    state: string;
+    daemonId: string | null;
+    hubOrigin: string | null;
+    scopes: string[];
+    connectedAt: string | null;
+    lastError: string | null;
+}
+export interface HubDaemonClient {
+    connectHub(url: string, token: string): Promise<{
+        status: HubStatus;
+    }>;
+    getHubStatus(): Promise<{
+        status: HubStatus;
+    }>;
+    disconnectHub(force: boolean): Promise<{
+        status: HubStatus;
+        warning?: string;
+    }>;
+    close(): Promise<void>;
+}
+export interface HubDaemonConnection {
+    connect(host: string | undefined): Promise<HubDaemonClient>;
+}
+export declare const productionHubDaemonConnection: HubDaemonConnection;
+export declare function withHubDaemon<T>(connection: HubDaemonConnection, host: string | undefined, action: (client: HubDaemonClient) => Promise<T>): Promise<T>;
+//# sourceMappingURL=daemon-client.d.ts.map

package/dist/commands/hub/daemon-client.js

@@ -0,0 +1,14 @@
+import { connectToDaemon } from "../../utils/client.js";
+export const productionHubDaemonConnection = {
+    connect: (host) => connectToDaemon({ host }),
+};
+export async function withHubDaemon(connection, host, action) {
+    const client = await connection.connect(host);
+    try {
+        return await action(client);
+    }
+    finally {
+        await client.close().catch(() => undefined);
+    }
+}
+//# sourceMappingURL=daemon-client.js.map

package/dist/commands/hub/deploy-bundle.d.ts

@@ -0,0 +1,16 @@
+export interface HubBundleFile {
+    path: string;
+    content: string;
+}
+export interface HubDeployBundle {
+    projectSlug: string;
+    files: readonly HubBundleFile[];
+    workflowCount: number;
+}
+interface DiscoverHubBundleInput {
+    cwd: string;
+    project?: string;
+}
+export declare function discoverHubBundle(input: DiscoverHubBundleInput): Promise<HubDeployBundle>;
+export {};
+//# sourceMappingURL=deploy-bundle.d.ts.map

package/dist/commands/hub/deploy-bundle.js

@@ -0,0 +1,248 @@
+import { lstat, readFile, readdir } from "node:fs/promises";
+import path from "node:path";
+import YAML from "yaml";
+import { HubCommandError } from "./error.js";
+const HUB_RESOURCE_PATH = ".otto/hub.yml";
+const LEGACY_TOML_PATH = ".otto/hub.toml";
+const WORKFLOW_DIRECTORY = ".otto/workflows";
+const PARTIAL_DIRECTORY = `${WORKFLOW_DIRECTORY}/partials`;
+const PROJECT_SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u;
+export async function discoverHubBundle(input) {
+    const projectSlug = requireProjectSlug(input.project);
+    const root = path.resolve(input.cwd);
+    await rejectLegacyToml(root);
+    const resource = await readBundleFile(root, HUB_RESOURCE_PATH, {
+        missingCode: "HUB_RESOURCE_MISSING",
+        missingMessage: `${HUB_RESOURCE_PATH} does not exist. Run this command from the project root.`,
+    });
+    const workflowNames = await discoverWorkflowNames(root);
+    const workflows = await Promise.all(workflowNames.map((name) => readBundleFile(root, `${WORKFLOW_DIRECTORY}/${name}`)));
+    const partialPaths = collectPartialPaths(workflows);
+    const partials = await Promise.all(partialPaths.map((file) => readBundleFile(root, file)));
+    const files = [resource, ...workflows, ...partials].toSorted(compareBundleFiles);
+    assertUniqueBundlePaths(files);
+    return { projectSlug, files, workflowCount: workflows.length };
+}
+function requireProjectSlug(project) {
+    if (project === undefined) {
+        throw new HubCommandError("HUB_PROJECT_REQUIRED", "Project is required. Pass --project <slug>.");
+    }
+    if (!PROJECT_SLUG_PATTERN.test(project)) {
+        throw new HubCommandError("HUB_INVALID_PROJECT", "Project must be a bare slug such as my-project.");
+    }
+    return project;
+}
+async function rejectLegacyToml(root) {
+    try {
+        await lstat(path.join(root, LEGACY_TOML_PATH));
+    }
+    catch (error) {
+        if (errorCode(error) === "ENOENT")
+            return;
+        throw unreadablePath(LEGACY_TOML_PATH);
+    }
+    throw new HubCommandError("HUB_CONFIGURATION_EXTENSION_UNSUPPORTED", `${LEGACY_TOML_PATH} is not supported. Use ${HUB_RESOURCE_PATH}.`);
+}
+async function discoverWorkflowNames(root) {
+    const directory = path.join(root, WORKFLOW_DIRECTORY);
+    await requireSafeDirectory(root, directory, WORKFLOW_DIRECTORY, {
+        missingCode: "HUB_WORKFLOW_DIRECTORY_MISSING",
+        missingMessage: `${WORKFLOW_DIRECTORY} does not exist.`,
+    });
+    let entries;
+    try {
+        entries = await readdir(directory, { withFileTypes: true });
+    }
+    catch {
+        throw unreadablePath(WORKFLOW_DIRECTORY);
+    }
+    const names = [];
+    for (const entry of entries.toSorted((left, right) => compareText(left.name, right.name))) {
+        const bundlePath = `${WORKFLOW_DIRECTORY}/${entry.name}`;
+        if (entry.isSymbolicLink())
+            throw unsafePath(bundlePath);
+        if (entry.isDirectory()) {
+            if (entry.name === "partials")
+                continue;
+            throw new HubCommandError("HUB_WORKFLOW_PATH_UNSUPPORTED", `${bundlePath} is not a direct-child .yml workflow.`);
+        }
+        if (!entry.isFile())
+            throw regularFileRequired(bundlePath);
+        if (!entry.name.endsWith(".yml")) {
+            throw new HubCommandError("HUB_WORKFLOW_EXTENSION_UNSUPPORTED", `${bundlePath} must use the .yml extension.`);
+        }
+        names.push(entry.name);
+    }
+    if (names.length === 0) {
+        throw new HubCommandError("HUB_WORKFLOW_MISSING", `${WORKFLOW_DIRECTORY} must contain at least one direct-child .yml workflow.`);
+    }
+    return names;
+}
+function collectPartialPaths(workflows) {
+    const paths = new Set();
+    for (const workflow of workflows) {
+        let document;
+        try {
+            document = YAML.parse(workflow.content);
+        }
+        catch {
+            throw new HubCommandError("HUB_WORKFLOW_INVALID_YAML", `${workflow.path} is not valid YAML.`);
+        }
+        if (!isRecord(document) || !Array.isArray(document["steps"]))
+            continue;
+        for (const step of document["steps"]) {
+            if (!isRecord(step) || !Array.isArray(step["prompt"]))
+                continue;
+            for (const block of step["prompt"]) {
+                if (!isRecord(block) || !Object.hasOwn(block, "include"))
+                    continue;
+                const include = block["include"];
+                if (typeof include !== "string") {
+                    throw invalidPartialPath(workflow.path, String(include));
+                }
+                paths.add(resolvePartialPath(workflow.path, include));
+            }
+        }
+    }
+    return [...paths].sort(compareText);
+}
+function resolvePartialPath(workflowPath, include) {
+    const decoded = decodePartialPath(workflowPath, include);
+    if (/^(?:[a-zA-Z]:[\\/]|[\\/]{1,2})/u.test(decoded)) {
+        throw invalidPartialPath(workflowPath, include);
+    }
+    const segments = decoded.replaceAll("\\", "/").split("/");
+    if (segments.some((segment) => segment.length === 0 || segment === "." || segment === "..") ||
+        segments[0] !== "partials") {
+        throw invalidPartialPath(workflowPath, include);
+    }
+    return `${WORKFLOW_DIRECTORY}/${segments.join("/")}`;
+}
+function decodePartialPath(workflowPath, include) {
+    let decoded = include;
+    for (let attempt = 0; attempt < 8; attempt += 1) {
+        let next;
+        try {
+            next = decodeURIComponent(decoded);
+        }
+        catch {
+            throw invalidPartialPath(workflowPath, include);
+        }
+        if (next === decoded)
+            break;
+        decoded = next;
+    }
+    if (decoded.includes("\0") || /%[0-9a-f]{2}/iu.test(decoded)) {
+        throw invalidPartialPath(workflowPath, include);
+    }
+    return decoded;
+}
+async function readBundleFile(root, bundlePath, missing = {
+    missingCode: "HUB_BUNDLE_FILE_MISSING",
+    missingMessage: `${bundlePath} does not exist.`,
+}) {
+    const absolutePath = path.join(root, ...bundlePath.split("/"));
+    await rejectSymlinkComponents(root, absolutePath, bundlePath);
+    let stats;
+    try {
+        stats = await lstat(absolutePath);
+    }
+    catch (error) {
+        if (errorCode(error) === "ENOENT") {
+            throw new HubCommandError(missing.missingCode, missing.missingMessage);
+        }
+        throw unreadablePath(bundlePath);
+    }
+    if (stats.isSymbolicLink())
+        throw unsafePath(bundlePath);
+    if (!stats.isFile())
+        throw regularFileRequired(bundlePath);
+    if (!hasReadPermission(stats.mode))
+        throw unreadablePath(bundlePath);
+    try {
+        return { path: bundlePath, content: (await readFile(absolutePath)).toString("utf8") };
+    }
+    catch {
+        throw unreadablePath(bundlePath);
+    }
+}
+async function requireSafeDirectory(root, absolutePath, bundlePath, missing) {
+    await rejectSymlinkComponents(root, absolutePath, bundlePath);
+    let stats;
+    try {
+        stats = await lstat(absolutePath);
+    }
+    catch (error) {
+        if (errorCode(error) === "ENOENT") {
+            throw new HubCommandError(missing.missingCode, missing.missingMessage);
+        }
+        throw unreadablePath(bundlePath);
+    }
+    if (stats.isSymbolicLink())
+        throw unsafePath(bundlePath);
+    if (!stats.isDirectory()) {
+        throw new HubCommandError("HUB_WORKFLOW_DIRECTORY_INVALID", `${bundlePath} must be a directory.`);
+    }
+}
+async function rejectSymlinkComponents(root, target, bundlePath) {
+    const relative = path.relative(root, target);
+    let current = root;
+    for (const segment of relative.split(path.sep).filter(Boolean)) {
+        current = path.join(current, segment);
+        try {
+            if ((await lstat(current)).isSymbolicLink())
+                throw unsafePath(bundlePath);
+        }
+        catch (error) {
+            if (error instanceof HubCommandError)
+                throw error;
+            if (errorCode(error) === "ENOENT")
+                return;
+            throw unreadablePath(bundlePath);
+        }
+    }
+}
+function assertUniqueBundlePaths(files) {
+    const seen = new Set();
+    for (const file of files) {
+        if (seen.has(file.path)) {
+            throw new HubCommandError("HUB_BUNDLE_PATH_DUPLICATE", `${file.path} appears more than once in the discovered bundle.`);
+        }
+        seen.add(file.path);
+    }
+}
+function invalidPartialPath(workflowPath, include) {
+    return new HubCommandError("HUB_PARTIAL_PATH_INVALID", `${workflowPath} includes an unsafe path outside ${PARTIAL_DIRECTORY}: ${include}`);
+}
+function unsafePath(bundlePath) {
+    return new HubCommandError("HUB_BUNDLE_UNSAFE_PATH", `${bundlePath} must not use a symlink.`);
+}
+function unreadablePath(bundlePath) {
+    return new HubCommandError("HUB_BUNDLE_UNREADABLE", `Could not read ${bundlePath}. Check the file and permissions.`);
+}
+function regularFileRequired(bundlePath) {
+    return new HubCommandError("HUB_BUNDLE_NOT_FILE", `${bundlePath} must be a regular file.`);
+}
+function compareBundleFiles(left, right) {
+    return compareText(left.path, right.path);
+}
+function compareText(left, right) {
+    if (left < right)
+        return -1;
+    if (left > right)
+        return 1;
+    return 0;
+}
+function hasReadPermission(mode) {
+    return (mode & 0o444) !== 0;
+}
+function errorCode(error) {
+    if (typeof error !== "object" || error === null)
+        return undefined;
+    const code = Reflect.get(error, "code");
+    return typeof code === "string" ? code : undefined;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=deploy-bundle.js.map

package/dist/commands/hub/deploy.d.ts

@@ -0,0 +1,40 @@
+import type { Command } from "commander";
+import { type SingleResult } from "../../output/index.js";
+import { HubHttpClient, type HubInstallResult, type HubValidationResult } from "./hub-client/index.js";
+import { type HubCredentialStore } from "./credentials.js";
+import { type HubDeployBundle } from "./deploy-bundle.js";
+import { type HubReporter } from "./reporter.js";
+export interface HubDeployOptions {
+    project?: string;
+    hub?: string;
+    apiKey?: string;
+    dryRun?: boolean;
+    json?: boolean;
+}
+export interface HubDeployEnvironment {
+    cwd: string;
+    env: Readonly<Record<string, string | undefined>>;
+    credentials?: HubCredentialStore;
+    hub?: Pick<HubHttpClient, "installConfiguration" | "validateConfiguration">;
+    reporter?: HubReporter;
+}
+export interface HubDeployCommandDependencies {
+    env: Readonly<Record<string, string | undefined>>;
+    credentials: HubCredentialStore;
+    hub: Pick<HubHttpClient, "installConfiguration" | "validateConfiguration">;
+    reporter: HubReporter;
+    cwd(): string;
+}
+interface HubDeployResult extends HubInstallResult {
+    origin: string;
+    workflows: number;
+}
+interface HubDryRunResult extends HubValidationResult {
+    origin: string;
+    workflows: number;
+}
+export declare function runHubDeploy(options: HubDeployOptions, environment?: HubDeployEnvironment): Promise<SingleResult<HubDeployResult> | SingleResult<HubDryRunResult>>;
+export declare function runHubDeployBundle(options: HubDeployOptions, deployInput: HubDeployBundle, environment: HubDeployEnvironment): Promise<SingleResult<HubDeployResult> | SingleResult<HubDryRunResult>>;
+export declare function addHubDeployCommand(hub: Command, dependencies: HubDeployCommandDependencies): void;
+export {};
+//# sourceMappingURL=deploy.d.ts.map

package/dist/commands/hub/deploy.js

@@ -0,0 +1,90 @@
+import { withOutput } from "../../output/index.js";
+import { addJsonOption } from "../../utils/command-options.js";
+import { resolveHubCredential, resolveHubOrigin } from "./authority.js";
+import { HubHttpClient, } from "./hub-client/index.js";
+import { PrivateHubCredentialStore } from "./credentials.js";
+import { discoverHubBundle } from "./deploy-bundle.js";
+import { processHubReporter, reportHubProgress } from "./reporter.js";
+import { addHubResolutionHelp } from "./help.js";
+const resultSchema = {
+    idField: "versionId",
+    columns: [
+        { header: "PROJECT", field: "projectSlug" },
+        { header: "VERSION", field: "version" },
+        { header: "VERSION ID", field: "versionId" },
+        { header: "ACTIVE", field: "active" },
+        { header: "WORKFLOWS", field: "workflows" },
+        { header: "HUB", field: "origin" },
+    ],
+};
+const validationSchema = {
+    idField: "projectSlug",
+    columns: [
+        { header: "PROJECT", field: "projectSlug" },
+        { header: "VALID", field: "valid" },
+        { header: "WORKFLOWS", field: "workflows" },
+        { header: "HUB", field: "origin" },
+    ],
+};
+export async function runHubDeploy(options, environment = {
+    cwd: process.cwd(),
+    env: process.env,
+    credentials: new PrivateHubCredentialStore(),
+    hub: new HubHttpClient(),
+}) {
+    const deployInput = await discoverHubBundle({
+        cwd: environment.cwd,
+        ...(options.project === undefined ? {} : { project: options.project }),
+    });
+    return runHubDeployBundle(options, deployInput, environment);
+}
+export async function runHubDeployBundle(options, deployInput, environment) {
+    const credentials = environment.credentials ?? new PrivateHubCredentialStore(environment.env);
+    const resolution = {
+        options: { origin: options.hub, apiKey: options.apiKey },
+        env: environment.env,
+        credentials,
+    };
+    const origin = resolveHubOrigin(resolution);
+    const action = options.dryRun === true ? "Validating" : "Deploying";
+    reportHubProgress(environment.reporter ?? processHubReporter, options, `${action} ${deployInput.projectSlug} ${options.dryRun === true ? "against" : "to"} ${origin}`);
+    const credential = resolveHubCredential({ ...resolution, origin });
+    const request = {
+        origin,
+        apiKey: credential,
+        ...deployInput,
+    };
+    if (options.dryRun === true) {
+        const validated = await (environment.hub ?? new HubHttpClient()).validateConfiguration(request);
+        return {
+            type: "single",
+            data: { ...validated, workflows: deployInput.workflowCount, origin },
+            schema: validationSchema,
+        };
+    }
+    const deployed = await (environment.hub ?? new HubHttpClient()).installConfiguration(request);
+    return {
+        type: "single",
+        data: { ...deployed, workflows: deployInput.workflowCount, origin },
+        schema: resultSchema,
+    };
+}
+export function addHubDeployCommand(hub, dependencies) {
+    addJsonOption(addHubResolutionHelp(hub
+        .command("deploy")
+        .description("Discover, validate, and activate the canonical .otto Hub bundle")
+        .option("-p, --project <slug>", "Target project slug")
+        .option("--hub <origin>", "Otto Hub origin")
+        .option("--api-key <secret>", "Organization API key")
+        .option("--dry-run", "Validate without installing or activating"))).action(withOutput(async (...args) => {
+        const options = args.at(-2);
+        return runHubDeploy(options, {
+            cwd: dependencies.cwd(),
+            env: dependencies.env,
+            credentials: dependencies.credentials,
+            hub: dependencies.hub,
+            reporter: dependencies.reporter,
+        });
+    }));
+}
+//# sourceMappingURL=deploy.js.map

package/dist/commands/hub/disconnect.d.ts

@@ -0,0 +1,16 @@
+import type { Command } from "commander";
+import type { HubDaemonConnection } from "./daemon-client.js";
+import { type HubReporter } from "./reporter.js";
+interface HubDisconnectOptions {
+    force?: boolean;
+    host?: string;
+    json?: boolean;
+}
+interface HubDisconnectDependencies {
+    daemon: HubDaemonConnection;
+    reporter: HubReporter;
+}
+export declare function runHubDisconnect(options: HubDisconnectOptions, dependencies: HubDisconnectDependencies): Promise<import("../../output/types.js").ListResult<import("./status-output.js").HubRow>>;
+export declare function addHubDisconnectCommand(parent: Command, dependencies: HubDisconnectDependencies): void;
+export {};
+//# sourceMappingURL=disconnect.d.ts.map

package/dist/commands/hub/disconnect.js

@@ -0,0 +1,24 @@
+import { withOutput } from "../../output/index.js";
+import { addJsonAndDaemonHostOptions } from "../../utils/command-options.js";
+import { withHubDaemon } from "./daemon-client.js";
+import { reportHubProgress } from "./reporter.js";
+import { hubStatusResult } from "./status-output.js";
+export function runHubDisconnect(options, dependencies) {
+    return withHubDaemon(dependencies.daemon, options.host, async (client) => {
+        const current = (await client.getHubStatus()).status;
+        if (current.hubOrigin !== null) {
+            reportHubProgress(dependencies.reporter, options, `Disconnecting this daemon from ${current.hubOrigin}`);
+        }
+        const response = await client.disconnectHub(options.force ?? false);
+        return hubStatusResult(response.status, response.warning);
+    });
+}
+export function addHubDisconnectCommand(parent, dependencies) {
+    addJsonAndDaemonHostOptions(parent
+        .command("disconnect")
+        .option("--force", "Remove local authority without notifying the Hub")).action(withOutput(async (...args) => {
+        const options = args.at(-2);
+        return runHubDisconnect(options, dependencies);
+    }));
+}
+//# sourceMappingURL=disconnect.js.map

package/dist/commands/hub/error.d.ts

@@ -0,0 +1,6 @@
+export declare class HubCommandError extends Error {
+    readonly code: string;
+    readonly details?: string | undefined;
+    constructor(code: string, message: string, details?: string | undefined);
+}
+//# sourceMappingURL=error.d.ts.map

package/dist/commands/hub/error.js

@@ -0,0 +1,9 @@
+export class HubCommandError extends Error {
+    constructor(code, message, details) {
+        super(message);
+        this.code = code;
+        this.details = details;
+        this.name = "HubCommandError";
+    }
+}
+//# sourceMappingURL=error.js.map

package/dist/commands/hub/help.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from "commander";
+export declare function addHubResolutionHelp(command: Command): Command;
+//# sourceMappingURL=help.d.ts.map

package/dist/commands/hub/help.js

@@ -0,0 +1,5 @@
+const resolutionHelp = "\nHub origin precedence: command origin/--hub, OTTO_HUB_URL, active stored login, then https://hub.otto-code.me.\nCredential precedence: --api-key, OTTO_HUB_API_KEY, then a stored login for the exact resolved origin.\n";
+export function addHubResolutionHelp(command) {
+    return command.addHelpText("after", resolutionHelp);
+}
+//# sourceMappingURL=help.js.map

package/dist/commands/hub/hub-client/index.d.ts

@@ -0,0 +1,19 @@
+import type { HubBundleFile } from "../deploy-bundle.js";
+import { type CliAuthorization, type CliAuthorizationPoll, type HubInstallResult, type HubConfigurationResources, type HubProject, type HubValidationResult } from "./internal/contracts.js";
+export type { CliAuthorization, CliAuthorizationPoll, HubInstallResult, HubConfigurationResources, HubProject, HubValidationResult, } from "./internal/contracts.js";
+interface HubConfigurationInput {
+    origin: string;
+    apiKey: string;
+    projectSlug: string;
+    files: readonly HubBundleFile[];
+}
+export declare class HubHttpClient {
+    startCliAuthorization(origin: string): Promise<CliAuthorization>;
+    pollCliAuthorization(origin: string, deviceCode: string, timeoutMilliseconds: number): Promise<CliAuthorizationPoll>;
+    listProjects(origin: string, apiKey: string): Promise<HubProject[]>;
+    listConfigurationResources(origin: string, apiKey: string): Promise<HubConfigurationResources>;
+    installConfiguration(input: HubConfigurationInput): Promise<HubInstallResult>;
+    validateConfiguration(input: HubConfigurationInput): Promise<HubValidationResult>;
+    issueEnrollmentToken(origin: string, apiKey: string): Promise<string>;
+}
+//# sourceMappingURL=index.d.ts.map