@positronic/cli 0.0.58 → 0.0.59

package/dist/src/commands/helpers.js

@@ -233,7 +233,7 @@ import * as https from 'https';
 import { URL } from 'url';
 import { createRequire } from 'module';
 import * as dotenv from 'dotenv';
-import { maybeSignRequest } from '../lib/request-signer.js';
+import { getAuthHeader } from '../lib/jwt-auth.js';
 // API client configuration
 var apiBaseUrl = null;
 var isLocalDevMode = true;
@@ -267,44 +267,55 @@ var isLocalDevMode = true;
 export var apiClient = {
     fetch: function(apiPath, options) {
         return _async_to_generator(function() {
-            var baseUrl, port, fullUrl, requestOptions, method, existingHeaders, headersObj, signatureHeaders;
+            var baseUrl, port, fullUrl, requestOptions, existingHeaders, headersObj, authHeader;
             return _ts_generator(this, function(_state) {
-                if (apiBaseUrl) {
-                    baseUrl = apiBaseUrl;
-                } else {
-                    // Fallback to localhost (for backwards compatibility and testing)
-                    port = process.env.POSITRONIC_PORT || '8787';
-                    baseUrl = "http://localhost:".concat(port);
-                }
-                fullUrl = "".concat(baseUrl).concat(apiPath.startsWith('/') ? apiPath : '/' + apiPath);
-                // Sign requests when not in local dev mode
-                requestOptions = options || {};
-                if (!isLocalDevMode) {
-                    method = ((options === null || options === void 0 ? void 0 : options.method) || 'GET').toUpperCase();
-                    existingHeaders = (options === null || options === void 0 ? void 0 : options.headers) || {};
-                    headersObj = {};
-                    // Convert headers to plain object
-                    if (_instanceof(existingHeaders, Headers)) {
-                        existingHeaders.forEach(function(value, key) {
-                            headersObj[key] = value;
-                        });
-                    } else if (Array.isArray(existingHeaders)) {
-                        existingHeaders.forEach(function(param) {
-                            var _param = _sliced_to_array(param, 2), key = _param[0], value = _param[1];
-                            headersObj[key] = value;
+                switch(_state.label){
+                    case 0:
+                        if (apiBaseUrl) {
+                            baseUrl = apiBaseUrl;
+                        } else {
+                            // Fallback to localhost (for backwards compatibility and testing)
+                            port = process.env.POSITRONIC_PORT || '8787';
+                            baseUrl = "http://localhost:".concat(port);
+                        }
+                        fullUrl = "".concat(baseUrl).concat(apiPath.startsWith('/') ? apiPath : '/' + apiPath);
+                        // Add auth header when not in local dev mode
+                        requestOptions = options || {};
+                        if (!!isLocalDevMode) return [
+                            3,
+                            2
+                        ];
+                        existingHeaders = (options === null || options === void 0 ? void 0 : options.headers) || {};
+                        headersObj = {};
+                        // Convert headers to plain object
+                        if (_instanceof(existingHeaders, Headers)) {
+                            existingHeaders.forEach(function(value, key) {
+                                headersObj[key] = value;
+                            });
+                        } else if (Array.isArray(existingHeaders)) {
+                            existingHeaders.forEach(function(param) {
+                                var _param = _sliced_to_array(param, 2), key = _param[0], value = _param[1];
+                                headersObj[key] = value;
+                            });
+                        } else {
+                            Object.assign(headersObj, existingHeaders);
+                        }
+                        return [
+                            4,
+                            getAuthHeader()
+                        ];
+                    case 1:
+                        authHeader = _state.sent();
+                        requestOptions = _object_spread_props(_object_spread({}, options), {
+                            headers: _object_spread({}, headersObj, authHeader)
                         });
-                    } else {
-                        Object.assign(headersObj, existingHeaders);
-                    }
-                    signatureHeaders = maybeSignRequest(method, fullUrl, headersObj);
-                    requestOptions = _object_spread_props(_object_spread({}, options), {
-                        headers: _object_spread({}, headersObj, signatureHeaders)
-                    });
+                        _state.label = 2;
+                    case 2:
+                        return [
+                            2,
+                            fetch(fullUrl, requestOptions)
+                        ];
                 }
-                return [
-                    2,
-                    fetch(fullUrl, requestOptions)
-                ];
             });
         })();
     },

package/dist/src/components/auth-login.js

@@ -47,7 +47,7 @@ function _unsupported_iterable_to_array(o, minLen) {
 import React, { useState } from 'react';
 import { Box, Text, useApp } from 'ink';
 import { discoverSSHKeys, expandPath } from '../lib/ssh-key-utils.js';
-import { resetRequestSigner } from '../lib/request-signer.js';
+import { resetJwtAuthProvider } from '../lib/jwt-auth.js';
 import { SelectList } from './select-list.js';
 import { existsSync } from 'fs';
 export var AuthLogin = function(param) {
@@ -103,7 +103,7 @@ export var AuthLogin = function(param) {
             configManager.setDefaultPrivateKeyPath(keyPath);
         }
         // Reset request signer to use new key
-        resetRequestSigner();
+        resetJwtAuthProvider();
         return /*#__PURE__*/ React.createElement(Box, {
             flexDirection: "column",
             paddingTop: 1,
@@ -163,7 +163,7 @@ export var AuthLogin = function(param) {
                 configManager.setDefaultPrivateKeyPath(displayPath);
             }
             // Reset request signer to use new key
-            resetRequestSigner();
+            resetJwtAuthProvider();
             setSelectedPath(displayPath);
             setState('success');
         };

package/dist/src/components/auth-logout.js

@@ -1,6 +1,6 @@
 import React from 'react';
 import { Box, Text } from 'ink';
-import { resetRequestSigner } from '../lib/request-signer.js';
+import { resetJwtAuthProvider } from '../lib/jwt-auth.js';
 export var AuthLogout = function(param) {
     var configManager = param.configManager, forProject = param.forProject;
     var currentProject = configManager.getCurrentProject();
@@ -33,7 +33,7 @@ export var AuthLogout = function(param) {
             }, "Nothing to clear.")));
         }
         configManager.clearProjectPrivateKeyPath(currentProject.name);
-        resetRequestSigner();
+        resetJwtAuthProvider();
         return /*#__PURE__*/ React.createElement(Box, {
             flexDirection: "column",
             paddingTop: 1,
@@ -60,7 +60,7 @@ export var AuthLogout = function(param) {
         }, "Nothing to clear.")));
     }
     configManager.clearDefaultPrivateKeyPath();
-    resetRequestSigner();
+    resetJwtAuthProvider();
     return /*#__PURE__*/ React.createElement(Box, {
         flexDirection: "column",
         paddingTop: 1,

package/dist/src/lib/jwt-auth.js

@@ -0,0 +1,364 @@
+function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _class_call_check(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+function _defineProperties(target, props) {
+    for(var i = 0; i < props.length; i++){
+        var descriptor = props[i];
+        descriptor.enumerable = descriptor.enumerable || false;
+        descriptor.configurable = true;
+        if ("value" in descriptor) descriptor.writable = true;
+        Object.defineProperty(target, descriptor.key, descriptor);
+    }
+}
+function _create_class(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties(Constructor.prototype, protoProps);
+    if (staticProps) _defineProperties(Constructor, staticProps);
+    return Constructor;
+}
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _instanceof(left, right) {
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else {
+        return left instanceof right;
+    }
+}
+function _ts_generator(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() {
+        return this;
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+import { SignJWT, importPKCS8 } from 'jose';
+import { existsSync } from 'fs';
+import { loadPrivateKey, getPrivateKeyFingerprint, resolvePrivateKeyPath } from './ssh-key-utils.js';
+import { ProjectConfigManager } from '../commands/project-config-manager.js';
+/**
+ * JWT Auth Provider for authenticating API requests
+ * Uses SSH private keys to sign short-lived JWTs
+ */ export var JwtAuthProvider = /*#__PURE__*/ function() {
+    "use strict";
+    function JwtAuthProvider() {
+        _class_call_check(this, JwtAuthProvider);
+        _define_property(this, "privateKey", null);
+        _define_property(this, "fingerprint", null);
+        _define_property(this, "initialized", false);
+        _define_property(this, "initError", null);
+        this.initialize();
+    }
+    _create_class(JwtAuthProvider, [
+        {
+            key: "initialize",
+            value: function initialize() {
+                try {
+                    // Get configured path from project config manager
+                    var configManager = new ProjectConfigManager();
+                    var configuredPath = configManager.getPrivateKeyPath();
+                    var keyPath = resolvePrivateKeyPath(configuredPath);
+                    if (!existsSync(keyPath)) {
+                        this.initError = new Error("Private key not found at ".concat(keyPath, ". Run 'px auth login' to configure your SSH key, or set POSITRONIC_PRIVATE_KEY environment variable."));
+                        return;
+                    }
+                    this.privateKey = loadPrivateKey(keyPath);
+                    this.fingerprint = getPrivateKeyFingerprint(this.privateKey);
+                    this.initialized = true;
+                } catch (error) {
+                    this.initError = _instanceof(error, Error) ? error : new Error('Failed to initialize JWT auth provider');
+                }
+            }
+        },
+        {
+            /**
+   * Check if the provider is ready to create JWTs
+   */ key: "isReady",
+            value: function isReady() {
+                return this.initialized && this.privateKey !== null;
+            }
+        },
+        {
+            /**
+   * Get the error that occurred during initialization, if any
+   */ key: "getError",
+            value: function getError() {
+                return this.initError;
+            }
+        },
+        {
+            /**
+   * Get the fingerprint of the loaded private key
+   */ key: "getFingerprint",
+            value: function getFingerprint() {
+                return this.fingerprint;
+            }
+        },
+        {
+            key: "getAlgorithm",
+            value: /**
+   * Map SSH key type to JWT algorithm
+   */ function getAlgorithm() {
+                if (!this.privateKey) {
+                    throw new Error('Private key not loaded');
+                }
+                var keyType = this.privateKey.type;
+                if (keyType === 'rsa') {
+                    return 'RS256';
+                } else if (keyType === 'ecdsa') {
+                    // ECDSA curve determines algorithm
+                    var curve = this.privateKey.curve;
+                    if (curve === 'nistp256') {
+                        return 'ES256';
+                    } else if (curve === 'nistp384') {
+                        return 'ES384';
+                    } else if (curve === 'nistp521') {
+                        return 'ES512';
+                    }
+                    // Default to ES256 for unknown curves
+                    return 'ES256';
+                } else if (keyType === 'ed25519') {
+                    return 'EdDSA';
+                }
+                throw new Error("Unsupported key type: ".concat(keyType));
+            }
+        },
+        {
+            key: "createToken",
+            value: /**
+   * Create a short-lived JWT for authentication
+   */ function createToken() {
+                return _async_to_generator(function() {
+                    var algorithm, pkcs8Pem, joseKey, jwt;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                if (!this.privateKey || !this.fingerprint) {
+                                    throw new Error('JWT auth provider not initialized');
+                                }
+                                algorithm = this.getAlgorithm();
+                                // Convert SSH private key to PKCS8 PEM format
+                                pkcs8Pem = this.privateKey.toString('pkcs8');
+                                return [
+                                    4,
+                                    importPKCS8(pkcs8Pem, algorithm)
+                                ];
+                            case 1:
+                                joseKey = _state.sent();
+                                return [
+                                    4,
+                                    new SignJWT({}).setProtectedHeader({
+                                        alg: algorithm
+                                    }).setSubject(this.fingerprint).setIssuedAt().setExpirationTime('30s').sign(joseKey)
+                                ];
+                            case 2:
+                                jwt = _state.sent();
+                                return [
+                                    2,
+                                    jwt
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        }
+    ]);
+    return JwtAuthProvider;
+}();
+// Singleton instance
+var providerInstance = null;
+/**
+ * Get the singleton JWT auth provider instance
+ */ export function getJwtAuthProvider() {
+    if (!providerInstance) {
+        providerInstance = new JwtAuthProvider();
+    }
+    return providerInstance;
+}
+/**
+ * Reset the JWT auth provider singleton
+ * Call this after auth config changes to force reinitialization with new key
+ */ export function resetJwtAuthProvider() {
+    providerInstance = null;
+}
+/**
+ * Check if JWT auth is available
+ */ export function isAuthAvailable() {
+    return getJwtAuthProvider().isReady();
+}
+/**
+ * Get the Authorization header if auth is available
+ * Returns { Authorization: 'Bearer <token>' } or empty object
+ */ export function getAuthHeader() {
+    return _async_to_generator(function() {
+        var provider, token, error;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    provider = getJwtAuthProvider();
+                    if (!provider.isReady()) {
+                        return [
+                            2,
+                            {}
+                        ];
+                    }
+                    _state.label = 1;
+                case 1:
+                    _state.trys.push([
+                        1,
+                        3,
+                        ,
+                        4
+                    ]);
+                    return [
+                        4,
+                        provider.createToken()
+                    ];
+                case 2:
+                    token = _state.sent();
+                    return [
+                        2,
+                        {
+                            Authorization: "Bearer ".concat(token)
+                        }
+                    ];
+                case 3:
+                    error = _state.sent();
+                    console.error('Warning: Failed to create auth token:', error);
+                    return [
+                        2,
+                        {}
+                    ];
+                case 4:
+                    return [
+                        2
+                    ];
+            }
+        });
+    })();
+}

package/dist/src/lib/ssh-key-utils.js

@@ -171,15 +171,6 @@ import { createPublicKey } from 'crypto';
     var publicKey = privateKey.toPublic();
     return publicKey.fingerprint('sha256').toString();
 }
-/**
- * Sign data with an SSH private key
- */ export function signWithPrivateKey(privateKey, data) {
-    var dataBuffer = typeof data === 'string' ? Buffer.from(data) : data;
-    var signer = privateKey.createSign('sha256');
-    signer.update(dataBuffer);
-    var signature = signer.sign();
-    return signature.toBuffer('raw');
-}
 /**
  * Resolve the private key path from environment, config, or default
  * @param configuredPath - Optional configured path from ProjectConfigManager

package/dist/types/commands/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/commands/helpers.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAUtD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,YAAY,KAAK,IAAI,CAAC;AAGhE,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC;AAMzC;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,GAAE,OAAc,GAAG,IAAI,CAGtF;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED;;;GAGG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAOtC;AAGD,eAAO,MAAM,SAAS;qBACG,MAAM,YAAY,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC;IAiDxE;;OAEG;oCACmC,MAAM,YAAY,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC;CAkBxF,CAAC;AAEF,wBAAsB,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,iBAsF5E;AAED,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,aAAa,EAAE,CAsCxE;AAeD,UAAU,UAAU;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD;AAED,MAAM,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,UAAU,CAAC;IAC9C,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;CAC5B,KAAK,IAAI,CAAC;AAEX;;GAEG;AACH,wBAAsB,aAAa,CACjC,eAAe,EAAE,MAAM,EACvB,MAAM,GAAE,SAAqB,EAC7B,UAAU,CAAC,EAAE,oBAAoB,GAChC,OAAO,CAAC,UAAU,CAAC,CA+KrB;AAqKD;;GAEG;AACH,wBAAsB,aAAa,CACjC,eAAe,EAAE,MAAM,EACvB,MAAM,GAAE,SAAqB,mBAoB9B;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAwCnE;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAO3E;AAsCD;;GAEG;AACH,wBAAsB,cAAc,CAClC,IAAI,CAAC,EAAE,MAAM,EACb,SAAS,SAAO,GACf,OAAO,CAAC,OAAO,CAAC,CAsBlB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,0BAA0B,CAC9C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,SAAqB,EAC7B,UAAU,CAAC,EAAE,gBAAgB,EAC7B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,IAAI,CAAC,CA2If"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/commands/helpers.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAUtD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,YAAY,KAAK,IAAI,CAAC;AAGhE,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC;AAMzC;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,GAAE,OAAc,GAAG,IAAI,CAGtF;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED;;;GAGG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAOtC;AAGD,eAAO,MAAM,SAAS;qBACG,MAAM,YAAY,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC;IAgDxE;;OAEG;oCACmC,MAAM,YAAY,WAAW,KAAG,OAAO,CAAC,QAAQ,CAAC;CAkBxF,CAAC;AAEF,wBAAsB,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,iBAsF5E;AAED,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,aAAa,EAAE,CAsCxE;AAeD,UAAU,UAAU;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD;AAED,MAAM,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,UAAU,CAAC;IAC9C,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;CAC5B,KAAK,IAAI,CAAC;AAEX;;GAEG;AACH,wBAAsB,aAAa,CACjC,eAAe,EAAE,MAAM,EACvB,MAAM,GAAE,SAAqB,EAC7B,UAAU,CAAC,EAAE,oBAAoB,GAChC,OAAO,CAAC,UAAU,CAAC,CA+KrB;AAqKD;;GAEG;AACH,wBAAsB,aAAa,CACjC,eAAe,EAAE,MAAM,EACvB,MAAM,GAAE,SAAqB,mBAoB9B;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAwCnE;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAO3E;AAsCD;;GAEG;AACH,wBAAsB,cAAc,CAClC,IAAI,CAAC,EAAE,MAAM,EACb,SAAS,SAAO,GACf,OAAO,CAAC,OAAO,CAAC,CAsBlB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,0BAA0B,CAC9C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,SAAqB,EAC7B,UAAU,CAAC,EAAE,gBAAgB,EAC7B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,IAAI,CAAC,CA2If"}

package/dist/types/lib/jwt-auth.d.ts

@@ -0,0 +1,51 @@
+/**
+ * JWT Auth Provider for authenticating API requests
+ * Uses SSH private keys to sign short-lived JWTs
+ */
+export declare class JwtAuthProvider {
+    private privateKey;
+    private fingerprint;
+    private initialized;
+    private initError;
+    constructor();
+    private initialize;
+    /**
+     * Check if the provider is ready to create JWTs
+     */
+    isReady(): boolean;
+    /**
+     * Get the error that occurred during initialization, if any
+     */
+    getError(): Error | null;
+    /**
+     * Get the fingerprint of the loaded private key
+     */
+    getFingerprint(): string | null;
+    /**
+     * Map SSH key type to JWT algorithm
+     */
+    private getAlgorithm;
+    /**
+     * Create a short-lived JWT for authentication
+     */
+    createToken(): Promise<string>;
+}
+/**
+ * Get the singleton JWT auth provider instance
+ */
+export declare function getJwtAuthProvider(): JwtAuthProvider;
+/**
+ * Reset the JWT auth provider singleton
+ * Call this after auth config changes to force reinitialization with new key
+ */
+export declare function resetJwtAuthProvider(): void;
+/**
+ * Check if JWT auth is available
+ */
+export declare function isAuthAvailable(): boolean;
+/**
+ * Get the Authorization header if auth is available
+ * Returns { Authorization: 'Bearer <token>' } or empty object
+ */
+export declare function getAuthHeader(): Promise<Record<string, string>>;
+//# sourceMappingURL=jwt-auth.d.ts.map

package/dist/types/lib/jwt-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-auth.d.ts","sourceRoot":"","sources":["../../../src/lib/jwt-auth.ts"],"names":[],"mappings":"AAUA;;;GAGG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,UAAU,CAAiC;IACnD,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,SAAS,CAAsB;;IAMvC,OAAO,CAAC,UAAU;IA0BlB;;OAEG;IACH,OAAO,IAAI,OAAO;IAIlB;;OAEG;IACH,QAAQ,IAAI,KAAK,GAAG,IAAI;IAIxB;;OAEG;IACH,cAAc,IAAI,MAAM,GAAG,IAAI;IAI/B;;OAEG;IACH,OAAO,CAAC,YAAY;IA4BpB;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;CAuBrC;AAKD;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,eAAe,CAKpD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAEzC;AAED;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAarE"}

package/dist/types/lib/ssh-key-utils.d.ts

@@ -29,10 +29,6 @@ export declare function loadPrivateKey(pathOrEnv?: string): sshpk.PrivateKey;
  * Get the fingerprint of a private key (from its public component)
  */
 export declare function getPrivateKeyFingerprint(privateKey: sshpk.PrivateKey): string;
-/**
- * Sign data with an SSH private key
- */
-export declare function signWithPrivateKey(privateKey: sshpk.PrivateKey, data: Buffer | string): Buffer;
 /**
  * Resolve the private key path from environment, config, or default
  * @param configuredPath - Optional configured path from ProjectConfigManager

package/dist/types/lib/ssh-key-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssh-key-utils.d.ts","sourceRoot":"","sources":["../../../src/lib/ssh-key-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAI1B,OAAO,EAAmB,UAAU,EAAE,MAAM,QAAQ,CAAC;AAErD,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,UAAU,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,aAAa,EAAE,CAkDjD;AA0CD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAiBpE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,UAAU,CAyBnE;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,MAAM,CAG7E;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,KAAK,CAAC,UAAU,EAC5B,IAAI,EAAE,MAAM,GAAG,MAAM,GACpB,MAAM,CAMR;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAoB5E;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAKlD"}
+{"version":3,"file":"ssh-key-utils.d.ts","sourceRoot":"","sources":["../../../src/lib/ssh-key-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAI1B,OAAO,EAAmB,UAAU,EAAE,MAAM,QAAQ,CAAC;AAErD,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,UAAU,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,aAAa,EAAE,CAkDjD;AA0CD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAiBpE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,UAAU,CAyBnE;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,MAAM,CAG7E;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAoB5E;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAKlD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@positronic/cli",
-  "version": "0.0.58",
+  "version": "0.0.59",
   "publishConfig": {
     "access": "public"
   },
@@ -23,9 +23,9 @@
     "clean": "rm -rf tsconfig.tsbuildinfo dist node_modules"
   },
   "dependencies": {
-    "@positronic/core": "^0.0.58",
-    "@positronic/spec": "^0.0.58",
-    "@positronic/template-new-project": "^0.0.58",
+    "@positronic/core": "^0.0.59",
+    "@positronic/spec": "^0.0.59",
+    "@positronic/template-new-project": "^0.0.59",
     "caz": "^2.0.0",
     "chokidar": "^3.6.0",
     "dotenv": "^16.4.7",
@@ -33,6 +33,7 @@
     "ink": "^5.2.1",
     "ink-text-input": "^6.0.0",
     "istextorbinary": "^9.5.0",
+    "jose": "^5.2.0",
     "node-fetch": "^3.3.2",
     "react": "^18.3.1",
     "react-robot": "^1.2.1",

package/dist/src/lib/request-signer.js

@@ -1,208 +0,0 @@
-function _class_call_check(instance, Constructor) {
-    if (!(instance instanceof Constructor)) {
-        throw new TypeError("Cannot call a class as a function");
-    }
-}
-function _defineProperties(target, props) {
-    for(var i = 0; i < props.length; i++){
-        var descriptor = props[i];
-        descriptor.enumerable = descriptor.enumerable || false;
-        descriptor.configurable = true;
-        if ("value" in descriptor) descriptor.writable = true;
-        Object.defineProperty(target, descriptor.key, descriptor);
-    }
-}
-function _create_class(Constructor, protoProps, staticProps) {
-    if (protoProps) _defineProperties(Constructor.prototype, protoProps);
-    if (staticProps) _defineProperties(Constructor, staticProps);
-    return Constructor;
-}
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-function _instanceof(left, right) {
-    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
-        return !!right[Symbol.hasInstance](left);
-    } else {
-        return left instanceof right;
-    }
-}
-import { loadPrivateKey, getPrivateKeyFingerprint, signWithPrivateKey, resolvePrivateKeyPath } from './ssh-key-utils.js';
-import { existsSync } from 'fs';
-import { ProjectConfigManager } from '../commands/project-config-manager.js';
-/**
- * Request signer for RFC 9421 HTTP Message Signatures
- */ export var RequestSigner = /*#__PURE__*/ function() {
-    "use strict";
-    function RequestSigner() {
-        _class_call_check(this, RequestSigner);
-        _define_property(this, "privateKey", null);
-        _define_property(this, "fingerprint", null);
-        _define_property(this, "initialized", false);
-        _define_property(this, "initError", null);
-        this.initialize();
-    }
-    _create_class(RequestSigner, [
-        {
-            key: "initialize",
-            value: function initialize() {
-                try {
-                    // Get configured path from project config manager
-                    var configManager = new ProjectConfigManager();
-                    var configuredPath = configManager.getPrivateKeyPath();
-                    var keyPath = resolvePrivateKeyPath(configuredPath);
-                    if (!existsSync(keyPath)) {
-                        this.initError = new Error("Private key not found at ".concat(keyPath, ". Run 'px auth login' to configure your SSH key, or set POSITRONIC_PRIVATE_KEY environment variable."));
-                        return;
-                    }
-                    this.privateKey = loadPrivateKey(keyPath);
-                    this.fingerprint = getPrivateKeyFingerprint(this.privateKey);
-                    this.initialized = true;
-                } catch (error) {
-                    this.initError = _instanceof(error, Error) ? error : new Error('Failed to initialize request signer');
-                }
-            }
-        },
-        {
-            /**
-   * Check if the signer is ready to sign requests
-   */ key: "isReady",
-            value: function isReady() {
-                return this.initialized && this.privateKey !== null;
-            }
-        },
-        {
-            /**
-   * Get the error that occurred during initialization, if any
-   */ key: "getError",
-            value: function getError() {
-                return this.initError;
-            }
-        },
-        {
-            /**
-   * Get the fingerprint of the loaded private key
-   */ key: "getFingerprint",
-            value: function getFingerprint() {
-                return this.fingerprint;
-            }
-        },
-        {
-            /**
-   * Sign an HTTP request and return the signature headers
-   */ key: "signRequest",
-            value: function signRequest(method, url) {
-                var headers = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : {};
-                if (!this.privateKey || !this.fingerprint) {
-                    throw new Error('Request signer not initialized');
-                }
-                var parsedUrl = new URL(url);
-                var created = Math.floor(Date.now() / 1000);
-                // Build the signature base
-                var coveredComponents = [
-                    '"@method"',
-                    '"@path"',
-                    '"@authority"'
-                ];
-                // Add content-type if present
-                if (headers['Content-Type'] || headers['content-type']) {
-                    coveredComponents.push('"content-type"');
-                }
-                // Create the signature base string
-                var signatureBaseLines = [];
-                var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
-                try {
-                    for(var _iterator = coveredComponents[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-                        var component = _step.value;
-                        var componentName = component.replace(/"/g, '');
-                        if (componentName === '@method') {
-                            signatureBaseLines.push('"@method": '.concat(method.toUpperCase()));
-                        } else if (componentName === '@path') {
-                            signatureBaseLines.push('"@path": '.concat(parsedUrl.pathname));
-                        } else if (componentName === '@authority') {
-                            signatureBaseLines.push('"@authority": '.concat(parsedUrl.host));
-                        } else {
-                            // Regular header
-                            var headerValue = headers[componentName] || headers[componentName.toLowerCase()] || headers[componentName.charAt(0).toUpperCase() + componentName.slice(1)];
-                            if (headerValue) {
-                                signatureBaseLines.push('"'.concat(componentName.toLowerCase(), '": ').concat(headerValue));
-                            }
-                        }
-                    }
-                } catch (err) {
-                    _didIteratorError = true;
-                    _iteratorError = err;
-                } finally{
-                    try {
-                        if (!_iteratorNormalCompletion && _iterator.return != null) {
-                            _iterator.return();
-                        }
-                    } finally{
-                        if (_didIteratorError) {
-                            throw _iteratorError;
-                        }
-                    }
-                }
-                // Create the signature-params line
-                var signatureParams = "(".concat(coveredComponents.join(' '), ");created=").concat(created, ';keyid="').concat(this.fingerprint, '"');
-                signatureBaseLines.push('"@signature-params": '.concat(signatureParams));
-                var signatureBase = signatureBaseLines.join('\n');
-                // Sign the base
-                var signatureBytes = signWithPrivateKey(this.privateKey, signatureBase);
-                var signatureValue = signatureBytes.toString('base64');
-                return {
-                    Signature: "sig1=:".concat(signatureValue, ":"),
-                    'Signature-Input': "sig1=".concat(signatureParams)
-                };
-            }
-        }
-    ]);
-    return RequestSigner;
-}();
-// Singleton instance
-var signerInstance = null;
-/**
- * Get the singleton request signer instance
- */ export function getRequestSigner() {
-    if (!signerInstance) {
-        signerInstance = new RequestSigner();
-    }
-    return signerInstance;
-}
-/**
- * Reset the request signer singleton
- * Call this after auth config changes to force reinitialization with new key
- */ export function resetRequestSigner() {
-    signerInstance = null;
-}
-/**
- * Check if request signing is available
- */ export function isSigningAvailable() {
-    return getRequestSigner().isReady();
-}
-/**
- * Sign an HTTP request if signing is available
- * Returns the additional headers to add, or empty object if signing is not available
- */ export function maybeSignRequest(method, url) {
-    var headers = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : {};
-    var signer = getRequestSigner();
-    if (!signer.isReady()) {
-        return {};
-    }
-    try {
-        return signer.signRequest(method, url, headers);
-    } catch (error) {
-        console.error('Warning: Failed to sign request:', error);
-        return {};
-    }
-}

package/dist/types/lib/request-signer.d.ts

@@ -1,51 +0,0 @@
-export type SignedHeaders = {
-    Signature: string;
-    'Signature-Input': string;
-    [key: string]: string;
-};
-/**
- * Request signer for RFC 9421 HTTP Message Signatures
- */
-export declare class RequestSigner {
-    private privateKey;
-    private fingerprint;
-    private initialized;
-    private initError;
-    constructor();
-    private initialize;
-    /**
-     * Check if the signer is ready to sign requests
-     */
-    isReady(): boolean;
-    /**
-     * Get the error that occurred during initialization, if any
-     */
-    getError(): Error | null;
-    /**
-     * Get the fingerprint of the loaded private key
-     */
-    getFingerprint(): string | null;
-    /**
-     * Sign an HTTP request and return the signature headers
-     */
-    signRequest(method: string, url: string, headers?: Record<string, string>): SignedHeaders;
-}
-/**
- * Get the singleton request signer instance
- */
-export declare function getRequestSigner(): RequestSigner;
-/**
- * Reset the request signer singleton
- * Call this after auth config changes to force reinitialization with new key
- */
-export declare function resetRequestSigner(): void;
-/**
- * Check if request signing is available
- */
-export declare function isSigningAvailable(): boolean;
-/**
- * Sign an HTTP request if signing is available
- * Returns the additional headers to add, or empty object if signing is not available
- */
-export declare function maybeSignRequest(method: string, url: string, headers?: Record<string, string>): Record<string, string>;
-//# sourceMappingURL=request-signer.d.ts.map

package/dist/types/lib/request-signer.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"request-signer.d.ts","sourceRoot":"","sources":["../../../src/lib/request-signer.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CACvB,CAAC;AAEF;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,UAAU,CAAiC;IACnD,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,SAAS,CAAsB;;IAMvC,OAAO,CAAC,UAAU;IA0BlB;;OAEG;IACH,OAAO,IAAI,OAAO;IAIlB;;OAEG;IACH,QAAQ,IAAI,KAAK,GAAG,IAAI;IAIxB;;OAEG;IACH,cAAc,IAAI,MAAM,GAAG,IAAI;IAI/B;;OAEG;IACH,WAAW,CACT,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACnC,aAAa;CAuDjB;AAKD;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,aAAa,CAKhD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACnC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYxB"}