@positronic/cli 0.0.57 → 0.0.58

package/dist/src/cli.js

@@ -986,6 +986,15 @@ export function buildCli(options) {
             }).command('list', 'List available SSH keys\n', function() {}, function() {
                 var element = authCommand.list();
                 render(element);
+            }).command('format-jwk-key', 'Convert an SSH public key to JWK format for ROOT_PUBLIC_KEY\n', function(yargsFormatJwkKey) {
+                return yargsFormatJwkKey.option('pubkey', {
+                    describe: 'Path to SSH public key file',
+                    type: 'string',
+                    alias: 'p'
+                }).example('$0 auth format-jwk-key', 'Interactive public key selection').example('$0 auth format-jwk-key --pubkey ~/.ssh/id_ed25519.pub', 'Convert specific key');
+            }, function(argv) {
+                var element = authCommand.formatJwkKey(argv);
+                render(element);
             }).command('$0', false, function() {}, function() {
                 // Default to status when just 'px auth' is run
                 var element = authCommand.status();

package/dist/src/commands/auth.js

@@ -35,6 +35,7 @@ import { AuthStatus } from '../components/auth-status.js';
 import { AuthLogin } from '../components/auth-login.js';
 import { AuthLogout } from '../components/auth-logout.js';
 import { AuthList } from '../components/auth-list.js';
+import { AuthFormatJwkKey } from '../components/auth-format-jwk-key.js';
 import { ProjectConfigManager } from './project-config-manager.js';
 export var AuthCommand = /*#__PURE__*/ function() {
     "use strict";
@@ -92,6 +93,18 @@ export var AuthCommand = /*#__PURE__*/ function() {
                     configManager: this.configManager
                 });
             }
+        },
+        {
+            /**
+   * Handles the 'px auth format-jwk-key' command.
+   * Convert an SSH public key to JWK format for ROOT_PUBLIC_KEY configuration.
+   */ key: "formatJwkKey",
+            value: function formatJwkKey(param) {
+                var pubkey = param.pubkey;
+                return React.createElement(AuthFormatJwkKey, {
+                    pubkeyPath: pubkey
+                });
+            }
         }
     ]);
     return AuthCommand;

package/dist/src/commands/helpers.js

@@ -307,6 +307,28 @@ export var apiClient = {
                 ];
             });
         })();
+    },
+    /**
+   * Fetch without authentication - used for unauthenticated endpoints like /auth/setup
+   */ fetchUnauthenticated: function(apiPath, options) {
+        return _async_to_generator(function() {
+            var baseUrl, port, fullUrl;
+            return _ts_generator(this, function(_state) {
+                if (apiBaseUrl) {
+                    baseUrl = apiBaseUrl;
+                } else {
+                    // Fallback to localhost (for backwards compatibility and testing)
+                    port = process.env.POSITRONIC_PORT || '8787';
+                    baseUrl = "http://localhost:".concat(port);
+                }
+                fullUrl = "".concat(baseUrl).concat(apiPath.startsWith('/') ? apiPath : '/' + apiPath);
+                // Don't sign the request - this is for unauthenticated endpoints
+                return [
+                    2,
+                    fetch(fullUrl, options)
+                ];
+            });
+        })();
     }
 };
 export function generateProject(projectName, projectDir) {

package/dist/src/components/auth-format-jwk-key.js

@@ -0,0 +1,457 @@
+function _array_like_to_array(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_with_holes(arr) {
+    if (Array.isArray(arr)) return arr;
+}
+function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _iterable_to_array_limit(arr, i) {
+    var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
+    if (_i == null) return;
+    var _arr = [];
+    var _n = true;
+    var _d = false;
+    var _s, _e;
+    try {
+        for(_i = _i.call(arr); !(_n = (_s = _i.next()).done); _n = true){
+            _arr.push(_s.value);
+            if (i && _arr.length === i) break;
+        }
+    } catch (err) {
+        _d = true;
+        _e = err;
+    } finally{
+        try {
+            if (!_n && _i["return"] != null) _i["return"]();
+        } finally{
+            if (_d) throw _e;
+        }
+    }
+    return _arr;
+}
+function _non_iterable_rest() {
+    throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _sliced_to_array(arr, i) {
+    return _array_with_holes(arr) || _iterable_to_array_limit(arr, i) || _unsupported_iterable_to_array(arr, i) || _non_iterable_rest();
+}
+function _unsupported_iterable_to_array(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array(o, minLen);
+}
+function _ts_generator(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() {
+        return this;
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+import React, { useState, useEffect } from 'react';
+import { Box, Text, useApp } from 'ink';
+import { existsSync, readdirSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+import { convertSSHPubKeyToJWK, expandPath } from '../lib/ssh-key-utils.js';
+import { SelectList } from './select-list.js';
+/**
+ * Discover available SSH public keys in ~/.ssh
+ */ function discoverSSHPubKeys() {
+    var sshDir = join(homedir(), '.ssh');
+    if (!existsSync(sshDir)) {
+        return [];
+    }
+    var pubKeys = [];
+    try {
+        var files = readdirSync(sshDir);
+        var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+        try {
+            for(var _iterator = files[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                var file = _step.value;
+                if (file.endsWith('.pub')) {
+                    var fullPath = join(sshDir, file);
+                    pubKeys.push({
+                        path: fullPath,
+                        displayPath: "~/.ssh/".concat(file)
+                    });
+                }
+            }
+        } catch (err) {
+            _didIteratorError = true;
+            _iteratorError = err;
+        } finally{
+            try {
+                if (!_iteratorNormalCompletion && _iterator.return != null) {
+                    _iterator.return();
+                }
+            } finally{
+                if (_didIteratorError) {
+                    throw _iteratorError;
+                }
+            }
+        }
+    } catch (e) {
+        return [];
+    }
+    return pubKeys;
+}
+/**
+ * Copy text to clipboard using pbcopy (macOS) or xclip (Linux)
+ */ function copyToClipboard(text) {
+    return _async_to_generator(function() {
+        var spawn;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    return [
+                        4,
+                        import('child_process')
+                    ];
+                case 1:
+                    spawn = _state.sent().spawn;
+                    return [
+                        2,
+                        new Promise(function(resolve) {
+                            var _proc_stdin, _proc_stdin1;
+                            // Try pbcopy first (macOS)
+                            var proc = spawn('pbcopy', [], {
+                                stdio: [
+                                    'pipe',
+                                    'ignore',
+                                    'ignore'
+                                ]
+                            });
+                            proc.on('error', function() {
+                                var _proc_stdin, _proc_stdin1;
+                                // Try xclip (Linux)
+                                proc = spawn('xclip', [
+                                    '-selection',
+                                    'clipboard'
+                                ], {
+                                    stdio: [
+                                        'pipe',
+                                        'ignore',
+                                        'ignore'
+                                    ]
+                                });
+                                proc.on('error', function() {
+                                    resolve(false);
+                                });
+                                proc.on('close', function(code) {
+                                    resolve(code === 0);
+                                });
+                                (_proc_stdin = proc.stdin) === null || _proc_stdin === void 0 ? void 0 : _proc_stdin.write(text);
+                                (_proc_stdin1 = proc.stdin) === null || _proc_stdin1 === void 0 ? void 0 : _proc_stdin1.end();
+                            });
+                            proc.on('close', function(code) {
+                                resolve(code === 0);
+                            });
+                            (_proc_stdin = proc.stdin) === null || _proc_stdin === void 0 ? void 0 : _proc_stdin.write(text);
+                            (_proc_stdin1 = proc.stdin) === null || _proc_stdin1 === void 0 ? void 0 : _proc_stdin1.end();
+                        })
+                    ];
+            }
+        });
+    })();
+}
+export var AuthFormatJwkKey = function(param) {
+    var pubkeyPath = param.pubkeyPath;
+    var exit = useApp().exit;
+    var _useState = _sliced_to_array(useState(pubkeyPath ? 'success' : 'selecting'), 2), state = _useState[0], setState = _useState[1];
+    var _useState1 = _sliced_to_array(useState(null), 2), error = _useState1[0], setError = _useState1[1];
+    var _useState2 = _sliced_to_array(useState(null), 2), jwkOutput = _useState2[0], setJwkOutput = _useState2[1];
+    var _useState3 = _sliced_to_array(useState(null), 2), fingerprint = _useState3[0], setFingerprint = _useState3[1];
+    var _useState4 = _sliced_to_array(useState(false), 2), copiedToClipboard = _useState4[0], setCopiedToClipboard = _useState4[1];
+    var _useState5 = _sliced_to_array(useState(pubkeyPath || null), 2), selectedPath = _useState5[0], setSelectedPath = _useState5[1];
+    // Handle direct path provided via --pubkey
+    useEffect(function() {
+        if (pubkeyPath && state === 'success' && !jwkOutput) {
+            processKey(pubkeyPath);
+        }
+    }, [
+        pubkeyPath,
+        state,
+        jwkOutput
+    ]);
+    var processKey = function(keyPath) {
+        return _async_to_generator(function() {
+            var expandedPath, keyInfo, jwkString, copied, err;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        _state.trys.push([
+                            0,
+                            2,
+                            ,
+                            3
+                        ]);
+                        expandedPath = expandPath(keyPath);
+                        if (!existsSync(expandedPath)) {
+                            setError("Public key file not found: ".concat(keyPath));
+                            setState('error');
+                            return [
+                                2
+                            ];
+                        }
+                        keyInfo = convertSSHPubKeyToJWK(expandedPath);
+                        jwkString = JSON.stringify(keyInfo.jwk, null, 2);
+                        setJwkOutput(jwkString);
+                        setFingerprint(keyInfo.fingerprint);
+                        setSelectedPath(keyPath);
+                        return [
+                            4,
+                            copyToClipboard(jwkString)
+                        ];
+                    case 1:
+                        copied = _state.sent();
+                        setCopiedToClipboard(copied);
+                        setState('success');
+                        return [
+                            3,
+                            3
+                        ];
+                    case 2:
+                        err = _state.sent();
+                        setError(err.message || 'Failed to convert key');
+                        setState('error');
+                        return [
+                            3,
+                            3
+                        ];
+                    case 3:
+                        return [
+                            2
+                        ];
+                }
+            });
+        })();
+    };
+    // Check for available keys when in selecting state
+    var pubKeys = discoverSSHPubKeys();
+    if (state === 'selecting' && pubKeys.length === 0) {
+        return /*#__PURE__*/ React.createElement(Box, {
+            flexDirection: "column",
+            paddingTop: 1,
+            paddingBottom: 1
+        }, /*#__PURE__*/ React.createElement(Text, {
+            color: "yellow"
+        }, "No SSH public keys found in ~/.ssh/"), /*#__PURE__*/ React.createElement(Box, {
+            marginTop: 1,
+            flexDirection: "column"
+        }, /*#__PURE__*/ React.createElement(Text, {
+            dimColor: true
+        }, "Generate a new SSH key with:"), /*#__PURE__*/ React.createElement(Box, {
+            marginLeft: 2,
+            marginTop: 1
+        }, /*#__PURE__*/ React.createElement(Text, {
+            color: "cyan"
+        }, 'ssh-keygen -t ed25519 -C "your-email@example.com"'))), /*#__PURE__*/ React.createElement(Box, {
+            marginTop: 1
+        }, /*#__PURE__*/ React.createElement(Text, {
+            dimColor: true
+        }, "Or specify a public key path with: px auth format-jwk-key --pubkey /path/to/key.pub")));
+    }
+    if (state === 'selecting') {
+        var items = pubKeys.map(function(key) {
+            return {
+                id: key.path,
+                label: key.displayPath,
+                description: ''
+            };
+        });
+        var handleSelect = function(item) {
+            return _async_to_generator(function() {
+                return _ts_generator(this, function(_state) {
+                    switch(_state.label){
+                        case 0:
+                            return [
+                                4,
+                                processKey(item.id)
+                            ];
+                        case 1:
+                            _state.sent();
+                            return [
+                                2
+                            ];
+                    }
+                });
+            })();
+        };
+        var handleCancel = function() {
+            exit();
+        };
+        return /*#__PURE__*/ React.createElement(SelectList, {
+            items: items,
+            header: "Select an SSH public key to convert to JWK format",
+            onSelect: handleSelect,
+            onCancel: handleCancel,
+            footer: "Use arrow keys to navigate, Enter to select, q to cancel"
+        });
+    }
+    if (state === 'error') {
+        return /*#__PURE__*/ React.createElement(Box, {
+            flexDirection: "column",
+            paddingTop: 1,
+            paddingBottom: 1
+        }, /*#__PURE__*/ React.createElement(Text, {
+            color: "red"
+        }, "Error: ", error));
+    }
+    if (state === 'success' && jwkOutput) {
+        var displayPath = (selectedPath === null || selectedPath === void 0 ? void 0 : selectedPath.startsWith(homedir())) ? selectedPath.replace(homedir(), '~') : selectedPath;
+        return /*#__PURE__*/ React.createElement(Box, {
+            flexDirection: "column",
+            paddingTop: 1,
+            paddingBottom: 1
+        }, /*#__PURE__*/ React.createElement(Text, {
+            bold: true,
+            color: "green"
+        }, "JWK Public Key"), /*#__PURE__*/ React.createElement(Box, {
+            marginTop: 1
+        }, /*#__PURE__*/ React.createElement(Text, {
+            dimColor: true
+        }, "Source: ", displayPath)), fingerprint && /*#__PURE__*/ React.createElement(Box, null, /*#__PURE__*/ React.createElement(Text, {
+            dimColor: true
+        }, "Fingerprint: ", fingerprint)), /*#__PURE__*/ React.createElement(Box, {
+            marginTop: 1,
+            flexDirection: "column"
+        }, /*#__PURE__*/ React.createElement(Text, {
+            color: "cyan"
+        }, jwkOutput)), /*#__PURE__*/ React.createElement(Box, {
+            marginTop: 1
+        }, copiedToClipboard ? /*#__PURE__*/ React.createElement(Text, {
+            color: "green"
+        }, "Copied to clipboard.") : /*#__PURE__*/ React.createElement(Text, {
+            color: "yellow"
+        }, "Could not copy to clipboard - copy the value above manually.")), /*#__PURE__*/ React.createElement(Box, {
+            marginTop: 1,
+            flexDirection: "column"
+        }, /*#__PURE__*/ React.createElement(Text, {
+            bold: true
+        }, "Next steps:"), /*#__PURE__*/ React.createElement(Box, {
+            marginLeft: 2,
+            marginTop: 1,
+            flexDirection: "column"
+        }, /*#__PURE__*/ React.createElement(Text, null, "1. Go to Cloudflare dashboard"), /*#__PURE__*/ React.createElement(Text, null, "2. Navigate to Workers & Pages ", '>', " Your project ", '>', " Settings ", '>', " Variables and Secrets"), /*#__PURE__*/ React.createElement(Text, null, "3. Add a new secret named ", /*#__PURE__*/ React.createElement(Text, {
+            color: "cyan"
+        }, "ROOT_PUBLIC_KEY")), /*#__PURE__*/ React.createElement(Text, null, "4. Paste the JWK value above"))));
+    }
+    return null;
+};

package/dist/src/hooks/useApi.js

@@ -218,6 +218,16 @@ function _ts_generator(thisArg, body) {
 }
 import { useState, useEffect, useCallback } from 'react';
 import { apiClient, isApiLocalDevMode } from '../commands/helpers.js';
+var ROOT_KEY_NOT_CONFIGURED_ERROR = {
+    title: 'Root Key Not Configured',
+    message: 'The server does not have a root authentication key configured.',
+    details: "Run 'px auth format-jwk-key' to generate the key, then add ROOT_PUBLIC_KEY as a secret in your server configuration."
+};
+var AUTH_REQUIRED_ERROR = {
+    title: 'Authentication Required',
+    message: 'Your request could not be authenticated.',
+    details: "Run 'px auth login' to configure your SSH key, or check that your key is registered on the server."
+};
 function getConnectionErrorMessage() {
     if (isApiLocalDevMode()) {
         return {
@@ -233,6 +243,125 @@ function getConnectionErrorMessage() {
         };
     }
 }
+/**
+ * Fetch auth setup instructions from the server
+ */ function fetchAuthSetupInstructions() {
+    return _async_to_generator(function() {
+        var response;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    return [
+                        4,
+                        apiClient.fetchUnauthenticated('/auth/setup')
+                    ];
+                case 1:
+                    response = _state.sent();
+                    if (!response.ok) return [
+                        3,
+                        3
+                    ];
+                    return [
+                        4,
+                        response.json()
+                    ];
+                case 2:
+                    return [
+                        2,
+                        _state.sent()
+                    ];
+                case 3:
+                    return [
+                        2,
+                        null
+                    ];
+            }
+        });
+    })();
+}
+/**
+ * Check if the error response indicates ROOT_KEY_NOT_CONFIGURED
+ */ function isRootKeyNotConfiguredError(response) {
+    return _async_to_generator(function() {
+        var clonedResponse, data, e;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    _state.trys.push([
+                        0,
+                        2,
+                        ,
+                        3
+                    ]);
+                    clonedResponse = response.clone();
+                    return [
+                        4,
+                        clonedResponse.json()
+                    ];
+                case 1:
+                    data = _state.sent();
+                    return [
+                        2,
+                        data.error === 'ROOT_KEY_NOT_CONFIGURED'
+                    ];
+                case 2:
+                    e = _state.sent();
+                    return [
+                        2,
+                        false
+                    ];
+                case 3:
+                    return [
+                        2
+                    ];
+            }
+        });
+    })();
+}
+/**
+ * Build the appropriate auth error based on the response
+ */ function buildAuthError(response) {
+    return _async_to_generator(function() {
+        var setupInfo;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    return [
+                        4,
+                        isRootKeyNotConfiguredError(response)
+                    ];
+                case 1:
+                    if (!_state.sent()) return [
+                        3,
+                        3
+                    ];
+                    return [
+                        4,
+                        fetchAuthSetupInstructions()
+                    ];
+                case 2:
+                    setupInfo = _state.sent();
+                    if (setupInfo) {
+                        return [
+                            2,
+                            _object_spread_props(_object_spread({}, ROOT_KEY_NOT_CONFIGURED_ERROR), {
+                                details: setupInfo.instructions
+                            })
+                        ];
+                    }
+                    return [
+                        2,
+                        ROOT_KEY_NOT_CONFIGURED_ERROR
+                    ];
+                case 3:
+                    return [
+                        2,
+                        AUTH_REQUIRED_ERROR
+                    ];
+            }
+        });
+    })();
+}
 export function useApiGet(endpoint, options) {
     var _useState = _sliced_to_array(useState(null), 2), data = _useState[0], setData = _useState[1];
     var _useState1 = _sliced_to_array(useState(true), 2), loading = _useState1[0], setLoading = _useState1[1];
@@ -246,9 +375,9 @@ export function useApiGet(endpoint, options) {
                         case 0:
                             _state.trys.push([
                                 0,
-                                7,
                                 8,
-                                9
+                                9,
+                                10
                             ]);
                             setLoading(true);
                             setError(null);
@@ -273,41 +402,44 @@ export function useApiGet(endpoint, options) {
                             setData(result);
                             return [
                                 3,
-                                6
+                                7
                             ];
                         case 3:
                             if (!(response.status === 401)) return [
                                 3,
-                                4
+                                5
                             ];
-                            setError({
-                                title: 'Authentication Required',
-                                message: 'Your request could not be authenticated.',
-                                details: "Run 'px auth login' to configure your SSH key, or check that your key is registered on the server."
-                            });
                             return [
-                                3,
-                                6
+                                4,
+                                buildAuthError(response)
                             ];
                         case 4:
+                            setError.apply(void 0, [
+                                _state.sent()
+                            ]);
+                            return [
+                                3,
+                                7
+                            ];
+                        case 5:
                             return [
                                 4,
                                 response.text()
                             ];
-                        case 5:
+                        case 6:
                             errorText = _state.sent();
                             setError({
                                 title: 'Server Error',
                                 message: "Error fetching ".concat(endpoint, ": ").concat(response.status, " ").concat(response.statusText),
                                 details: "Server response: ".concat(errorText)
                             });
-                            _state.label = 6;
-                        case 6:
+                            _state.label = 7;
+                        case 7:
                             return [
                                 3,
-                                9
+                                10
                             ];
-                        case 7:
+                        case 8:
                             err = _state.sent();
                             baseError = getConnectionErrorMessage();
                             errorDetails = err.message;
@@ -319,14 +451,14 @@ export function useApiGet(endpoint, options) {
                             }));
                             return [
                                 3,
-                                9
+                                10
                             ];
-                        case 8:
+                        case 9:
                             setLoading(false);
                             return [
                                 7
                             ];
-                        case 9:
+                        case 10:
                             return [
                                 2
                             ];
@@ -356,9 +488,9 @@ export function useApiPost(endpoint, defaultOptions) {
                     case 0:
                         _state.trys.push([
                             0,
-                            7,
                             8,
-                            9
+                            9,
+                            10
                         ]);
                         setLoading(true);
                         setError(null);
@@ -390,21 +522,22 @@ export function useApiPost(endpoint, defaultOptions) {
                     case 3:
                         if (!(response.status === 401)) return [
                             3,
-                            4
+                            5
                         ];
-                        errorObj = {
-                            title: 'Authentication Required',
-                            message: 'Your request could not be authenticated.',
-                            details: "Run 'px auth login' to configure your SSH key, or check that your key is registered on the server."
-                        };
+                        return [
+                            4,
+                            buildAuthError(response)
+                        ];
+                    case 4:
+                        errorObj = _state.sent();
                         setError(errorObj);
                         throw errorObj;
-                    case 4:
+                    case 5:
                         return [
                             4,
                             response.text()
                         ];
-                    case 5:
+                    case 6:
                         errorText = _state.sent();
                         errorObj1 = {
                             title: 'Server Error',
@@ -413,12 +546,12 @@ export function useApiPost(endpoint, defaultOptions) {
                         };
                         setError(errorObj1);
                         throw errorObj1;
-                    case 6:
+                    case 7:
                         return [
                             3,
-                            9
+                            10
                         ];
-                    case 7:
+                    case 8:
                         err = _state.sent();
                         // If it's already our error object, don't wrap it again
                         if (err.title && err.message) {
@@ -435,12 +568,12 @@ export function useApiPost(endpoint, defaultOptions) {
                         });
                         setError(errorObj2);
                         throw errorObj2;
-                    case 8:
+                    case 9:
                         setLoading(false);
                         return [
                             7
                         ];
-                    case 9:
+                    case 10:
                         return [
                             2
                         ];
@@ -469,9 +602,9 @@ export function useApiDelete(resourceType) {
                     case 0:
                         _state.trys.push([
                             0,
-                            6,
                             7,
-                            8
+                            8,
+                            9
                         ]);
                         setLoading(true);
                         setError(null);
@@ -494,21 +627,22 @@ export function useApiDelete(resourceType) {
                     case 2:
                         if (!(response.status === 401)) return [
                             3,
-                            3
+                            4
                         ];
-                        errorObj = {
-                            title: 'Authentication Required',
-                            message: 'Your request could not be authenticated.',
-                            details: "Run 'px auth login' to configure your SSH key, or check that your key is registered on the server."
-                        };
+                        return [
+                            4,
+                            buildAuthError(response)
+                        ];
+                    case 3:
+                        errorObj = _state.sent();
                         setError(errorObj);
                         throw errorObj;
-                    case 3:
+                    case 4:
                         return [
                             4,
                             response.text()
                         ];
-                    case 4:
+                    case 5:
                         errorText = _state.sent();
                         errorObj1 = {
                             title: 'Server Error',
@@ -517,12 +651,12 @@ export function useApiDelete(resourceType) {
                         };
                         setError(errorObj1);
                         throw errorObj1;
-                    case 5:
+                    case 6:
                         return [
                             3,
-                            8
+                            9
                         ];
-                    case 6:
+                    case 7:
                         err = _state.sent();
                         // If it's already our error object, don't wrap it again
                         if (err.title && err.message) {
@@ -539,12 +673,12 @@ export function useApiDelete(resourceType) {
                         });
                         setError(errorObj2);
                         throw errorObj2;
-                    case 7:
+                    case 8:
                         setLoading(false);
                         return [
                             7
                         ];
-                    case 8:
+                    case 9:
                         return [
                             2
                         ];

package/dist/types/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,MAAM,OAAO,CAAC;AAU1B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAK5D,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,KAAK,GAAG,CAAC;CAC9C;AAoBD,wBAAgB,QAAQ,CAAC,OAAO,EAAE,UAAU,4BA+3C3C"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,MAAM,OAAO,CAAC;AAU1B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAK5D,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,KAAK,GAAG,CAAC;CAC9C;AAoBD,wBAAgB,QAAQ,CAAC,OAAO,EAAE,UAAU,4BAu5C3C"}

package/dist/types/commands/auth.d.ts

@@ -8,6 +8,9 @@ interface LoginArgs {
 interface LogoutArgs {
     project?: boolean;
 }
+interface FormatJwkKeyArgs {
+    pubkey?: string;
+}
 export declare class AuthCommand {
     private configManager;
     constructor(configManager?: ProjectConfigManager);
@@ -31,6 +34,11 @@ export declare class AuthCommand {
      * List available SSH keys.
      */
     list(): React.ReactElement;
+    /**
+     * Handles the 'px auth format-jwk-key' command.
+     * Convert an SSH public key to JWK format for ROOT_PUBLIC_KEY configuration.
+     */
+    formatJwkKey({ pubkey }: ArgumentsCamelCase<FormatJwkKeyArgs>): React.ReactElement;
 }
 export {};
 //# sourceMappingURL=auth.d.ts.map

package/dist/types/commands/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/commands/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,OAAO,CAAC;AAChD,OAAO,KAAK,MAAM,OAAO,CAAC;AAK1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,UAAU,SAAS;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,UAAU,UAAU;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,aAAa,CAAuB;gBAEhC,aAAa,CAAC,EAAE,oBAAoB;IAIhD;;;OAGG;IACH,MAAM,IAAI,KAAK,CAAC,YAAY;IAM5B;;;OAGG;IACH,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,kBAAkB,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,YAAY;IAQ3E;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,kBAAkB,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,YAAY;IAOvE;;;OAGG;IACH,IAAI,IAAI,KAAK,CAAC,YAAY;CAK3B"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/commands/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,OAAO,CAAC;AAChD,OAAO,KAAK,MAAM,OAAO,CAAC;AAM1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,UAAU,SAAS;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,UAAU,UAAU;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,UAAU,gBAAgB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,aAAa,CAAuB;gBAEhC,aAAa,CAAC,EAAE,oBAAoB;IAIhD;;;OAGG;IACH,MAAM,IAAI,KAAK,CAAC,YAAY;IAM5B;;;OAGG;IACH,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,kBAAkB,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,YAAY;IAQ3E;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,kBAAkB,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,YAAY;IAOvE;;;OAGG;IACH,IAAI,IAAI,KAAK,CAAC,YAAY;IAM1B;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC,YAAY;CAKnF"}

package/dist/types/commands/helpers.d.ts

@@ -24,6 +24,10 @@ export declare function isApiLocalDevMode(): boolean;
 export declare function getApiBaseUrl(): string;
 export declare const apiClient: {
     fetch: (apiPath: string, options?: RequestInit) => Promise<Response>;
+    /**
+     * Fetch without authentication - used for unauthenticated endpoints like /auth/setup
+     */
+    fetchUnauthenticated: (apiPath: string, options?: RequestInit) => Promise<Response>;
 };
 export declare function generateProject(projectName: string, projectDir: string): Promise<void>;
 export declare function scanLocalResources(resourcesDir: string): ResourceEntry[];

package/dist/types/commands/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/commands/helpers.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAUtD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,YAAY,KAAK,IAAI,CAAC;AAGhE,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC;AAMzC;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,GAAE,OAAc,GAAG,IAAI,CAGtF;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED;;;GAGG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAOtC;AAGD,eAAO,MAAM,SAAS;qBACG,MAAM,YAAY,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC;CAgDzE,CAAC;AAEF,wBAAsB,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,iBAsF5E;AAED,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,aAAa,EAAE,CAsCxE;AAeD,UAAU,UAAU;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD;AAED,MAAM,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,UAAU,CAAC;IAC9C,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;CAC5B,KAAK,IAAI,CAAC;AAEX;;GAEG;AACH,wBAAsB,aAAa,CACjC,eAAe,EAAE,MAAM,EACvB,MAAM,GAAE,SAAqB,EAC7B,UAAU,CAAC,EAAE,oBAAoB,GAChC,OAAO,CAAC,UAAU,CAAC,CA+KrB;AAqKD;;GAEG;AACH,wBAAsB,aAAa,CACjC,eAAe,EAAE,MAAM,EACvB,MAAM,GAAE,SAAqB,mBAoB9B;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAwCnE;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAO3E;AAsCD;;GAEG;AACH,wBAAsB,cAAc,CAClC,IAAI,CAAC,EAAE,MAAM,EACb,SAAS,SAAO,GACf,OAAO,CAAC,OAAO,CAAC,CAsBlB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,0BAA0B,CAC9C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,SAAqB,EAC7B,UAAU,CAAC,EAAE,gBAAgB,EAC7B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,IAAI,CAAC,CA2If"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/commands/helpers.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAUtD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,YAAY,KAAK,IAAI,CAAC;AAGhE,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC;AAMzC;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,GAAE,OAAc,GAAG,IAAI,CAGtF;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED;;;GAGG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAOtC;AAGD,eAAO,MAAM,SAAS;qBACG,MAAM,YAAY,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC;IAiDxE;;OAEG;oCACmC,MAAM,YAAY,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC;CAkBxF,CAAC;AAEF,wBAAsB,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,iBAsF5E;AAED,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,aAAa,EAAE,CAsCxE;AAeD,UAAU,UAAU;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD;AAED,MAAM,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,UAAU,CAAC;IAC9C,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;CAC5B,KAAK,IAAI,CAAC;AAEX;;GAEG;AACH,wBAAsB,aAAa,CACjC,eAAe,EAAE,MAAM,EACvB,MAAM,GAAE,SAAqB,EAC7B,UAAU,CAAC,EAAE,oBAAoB,GAChC,OAAO,CAAC,UAAU,CAAC,CA+KrB;AAqKD;;GAEG;AACH,wBAAsB,aAAa,CACjC,eAAe,EAAE,MAAM,EACvB,MAAM,GAAE,SAAqB,mBAoB9B;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAwCnE;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAO3E;AAsCD;;GAEG;AACH,wBAAsB,cAAc,CAClC,IAAI,CAAC,EAAE,MAAM,EACb,SAAS,SAAO,GACf,OAAO,CAAC,OAAO,CAAC,CAsBlB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,0BAA0B,CAC9C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,SAAqB,EAC7B,UAAU,CAAC,EAAE,gBAAgB,EAC7B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,IAAI,CAAC,CA2If"}

package/dist/types/components/auth-format-jwk-key.d.ts

@@ -0,0 +1,6 @@
+interface AuthFormatJwkKeyProps {
+    pubkeyPath?: string;
+}
+export declare const AuthFormatJwkKey: ({ pubkeyPath }: AuthFormatJwkKeyProps) => import("react/jsx-runtime").JSX.Element | null;
+export {};
+//# sourceMappingURL=auth-format-jwk-key.d.ts.map

package/dist/types/components/auth-format-jwk-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-format-jwk-key.d.ts","sourceRoot":"","sources":["../../../src/components/auth-format-jwk-key.tsx"],"names":[],"mappings":"AAQA,UAAU,qBAAqB;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAoED,eAAO,MAAM,gBAAgB,GAAI,gBAAgB,qBAAqB,mDAgJrE,CAAC"}

package/dist/types/hooks/useApi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useApi.d.ts","sourceRoot":"","sources":["../../../src/hooks/useApi.ts"],"names":[],"mappings":"AAmBA,wBAAgB,SAAS,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG;;;;eAIjD,MAAM;iBACJ,MAAM;kBACL,MAAM;;EAoDnB;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,GAAG;;;;eAIzD,MAAM;iBACJ,MAAM;kBACL,MAAM;;qBAIF,GAAG,YAAY,GAAG;EA8DnC;AAED,wBAAgB,YAAY,CAAC,YAAY,EAAE,MAAM;;;eAGtC,MAAM;iBACJ,MAAM;kBACL,MAAM;;wBAIC,MAAM,YAAY,GAAG;EA0DzC"}
+{"version":3,"file":"useApi.d.ts","sourceRoot":"","sources":["../../../src/hooks/useApi.ts"],"names":[],"mappings":"AA2EA,wBAAgB,SAAS,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG;;;;eAIjD,MAAM;iBACJ,MAAM;kBACL,MAAM;;EAgDnB;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,GAAG;;;;eAIzD,MAAM;iBACJ,MAAM;kBACL,MAAM;;qBAIF,GAAG,YAAY,GAAG;EA0DnC;AAED,wBAAgB,YAAY,CAAC,YAAY,EAAE,MAAM;;;eAGtC,MAAM;iBACJ,MAAM;kBACL,MAAM;;wBAIC,MAAM,YAAY,GAAG;EAsDzC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@positronic/cli",
-  "version": "0.0.57",
+  "version": "0.0.58",
   "publishConfig": {
     "access": "public"
   },
@@ -23,9 +23,9 @@
     "clean": "rm -rf tsconfig.tsbuildinfo dist node_modules"
   },
   "dependencies": {
-    "@positronic/core": "^0.0.57",
-    "@positronic/spec": "^0.0.57",
-    "@positronic/template-new-project": "^0.0.57",
+    "@positronic/core": "^0.0.58",
+    "@positronic/spec": "^0.0.58",
+    "@positronic/template-new-project": "^0.0.58",
     "caz": "^2.0.0",
     "chokidar": "^3.6.0",
     "dotenv": "^16.4.7",