@tangle-network/tcloud 0.2.0 → 0.3.0

package/dist/cli.cjs

@@ -287,8 +287,10 @@ var DEFAULT_RETRY = {
   retryableStatuses: [429, 500, 502, 503, 504]
 };
 var DEFAULT_TIMEOUT_MS = 6e4;
+var DEFAULT_PLATFORM_URL = "https://id.tangle.tools";
 var TCloudClient = class _TCloudClient {
   baseURL;
+  platformURL;
   apiKey;
   model;
   headers;
@@ -305,6 +307,7 @@ var TCloudClient = class _TCloudClient {
   static OPERATORS_TTL_MS = 5 * 60 * 1e3;
   constructor(config = {}) {
     this.baseURL = (config.baseURL || DEFAULT_BASE_URL).replace(/\/$/, "");
+    this.platformURL = (config.platformURL || DEFAULT_PLATFORM_URL).replace(/\/$/, "");
     this.apiKey = config.apiKey || process.env.TCLOUD_API_KEY;
     this.model = config.model || "gpt-4o-mini";
     this.privacy = config.privacy;
@@ -493,10 +496,11 @@ var TCloudClient = class _TCloudClient {
     return res;
   }
   /**
-   * Prepare headers for chat requests — operator routing + SpendAuth.
+   * Prepare headers for chat requests — operator routing + SpendAuth +
+   * bridge short-circuit headers when `options.bridge` is set.
    * Shared between chat() and chatStream() to eliminate duplication.
    */
-  async _prepareChatRequest(model) {
+  async _prepareChatRequest(model, bridge) {
     const headers = { ...this.headers };
     if (this.spendAuthFn) {
       const auth2 = await this.spendAuthFn();
@@ -513,12 +517,28 @@ var TCloudClient = class _TCloudClient {
         delete headers["Authorization"];
       }
     }
+    if (bridge) {
+      headers["X-Bridge-Unlock"] = bridge.unlock;
+      if (bridge.resume) headers["X-Resume"] = bridge.resume;
+      if (bridge.bridgeUrl) headers["X-Bridge-Url"] = bridge.bridgeUrl;
+      if (bridge.bridgeBearer) headers["X-Bridge-Bearer"] = bridge.bridgeBearer;
+    }
     return { headers, baseURL };
   }
+  /**
+   * Resolve the effective model string. When a bridge is set, rewrite to
+   * `bridge/<harness>/<model>` (or `bridge/<harness>` if no model).
+   */
+  _effectiveModel(options) {
+    if (options.bridge) {
+      return options.bridge.model ? `bridge/${options.bridge.harness}/${options.bridge.model}` : `bridge/${options.bridge.harness}`;
+    }
+    return options.model || this.model;
+  }
   /** Build the chat completions request body */
   _chatBody(options, stream) {
     return JSON.stringify({
-      model: options.model || this.model,
+      model: this._effectiveModel(options),
       messages: options.messages,
       temperature: options.temperature,
       max_tokens: options.maxTokens,
@@ -530,13 +550,17 @@ var TCloudClient = class _TCloudClient {
       response_format: options.responseFormat,
       tools: options.tools,
       tool_choice: options.toolChoice,
+      ...options.gateway ? { gateway: options.gateway } : {},
       ...options.providerOptions
     });
   }
   /** Chat completion (non-streaming) */
   async chat(options) {
     this.checkLimits();
-    const { headers, baseURL } = await this._prepareChatRequest(options.model || this.model);
+    const { headers, baseURL } = await this._prepareChatRequest(
+      this._effectiveModel(options),
+      options.bridge
+    );
     const res = await this._doFetch(`${baseURL}/chat/completions`, {
       method: "POST",
       headers,
@@ -550,7 +574,10 @@ var TCloudClient = class _TCloudClient {
   async *chatStream(options) {
     this.checkLimits();
     this._requestCount++;
-    const { headers, baseURL } = await this._prepareChatRequest(options.model || this.model);
+    const { headers, baseURL } = await this._prepareChatRequest(
+      this._effectiveModel(options),
+      options.bridge
+    );
     const res = await this._doFetch(`${baseURL}/chat/completions`, {
       method: "POST",
       headers,
@@ -579,6 +606,24 @@ var TCloudClient = class _TCloudClient {
       }
     }
   }
+  /**
+   * Bridge — scoped helper for a subscription-backed CLI harness behind
+   * the Tangle Router's cli-bridge. Returns a mini-client bound to
+   * (harness, unlock, resume) so you don't thread those through every
+   * call.
+   *
+   * ```ts
+   * const kimi = tcloud.bridge({ harness: 'kimi', model: 'kimi-for-coding', unlock: UNLOCK, resume: 'pr-42' })
+   * await kimi.ask('review this diff…')
+   * for await (const chunk of kimi.stream('continue…')) process.stdout.write(chunk)
+   * ```
+   *
+   * Sessions persist across process restarts — use the same `resume` id
+   * to land on the same CLI conversation (context intact, no replay tax).
+   */
+  bridge(cfg) {
+    return new BridgeSession(this, cfg);
+  }
   /** Convenience: send a single message and get the text response */
   async ask(message, modelOrOptions) {
     const options = typeof modelOrOptions === "string" ? { model: modelOrOptions } : modelOrOptions;
@@ -617,43 +662,89 @@ var TCloudClient = class _TCloudClient {
     const apiRoot = this.baseURL.replace(/\/v1$/, "");
     return this._fetch(`${apiRoot}/api/operators`);
   }
+  // ── Billing (via id.tangle.tools) ──
   /** Get credit balance */
   async credits() {
-    const apiRoot = this.baseURL.replace(/\/v1$/, "");
-    return this._fetch(`${apiRoot}/api/billing`);
+    const { data } = await this._fetch(`${this.platformURL}/v1/billing/balance`);
+    return data;
   }
-  /** Add credits */
+  /** Add credits via Stripe checkout. Returns the checkout URL. */
   async addCredits(amount) {
-    const apiRoot = this.baseURL.replace(/\/v1$/, "");
-    return this._fetch(`${apiRoot}/api/billing`, {
+    const { data } = await this._fetch(`${this.platformURL}/v1/billing/topup`, {
       method: "POST",
       body: JSON.stringify({ amount })
     });
+    return data;
   }
-  /** Create a new API key */
-  async createKey(name) {
-    const apiRoot = this.baseURL.replace(/\/v1$/, "");
-    return this._fetch(`${apiRoot}/api/keys`, {
+  /** Get transaction history */
+  async transactions(limit = 50) {
+    const { data } = await this._fetch(`${this.platformURL}/v1/billing/transactions?limit=${limit}`);
+    return data;
+  }
+  // ── API Keys (via id.tangle.tools) ──
+  /**
+   * Create a new API key.
+   * When called with an API key (not session), the new key is automatically
+   * a child of the calling key — enabling hierarchical key delegation.
+   *
+   * Pass `parentKeyId` explicitly to create a child of a specific key.
+   * Child keys inherit the parent's product scope, allowedModels, and rpmLimit
+   * if not specified. Budget cannot exceed the parent's remaining budget.
+   */
+  async createKey(opts) {
+    const { data } = await this._fetch(`${this.platformURL}/v1/keys`, {
       method: "POST",
-      body: JSON.stringify({ name })
+      body: JSON.stringify(opts)
     });
+    return data;
   }
-  /** List API keys */
-  async keys() {
-    const apiRoot = this.baseURL.replace(/\/v1$/, "");
-    return this._fetch(`${apiRoot}/api/keys`);
+  /** Get a single API key by ID */
+  async getKey(id) {
+    const { data } = await this._fetch(`${this.platformURL}/v1/keys/${id}`);
+    return data;
   }
-  /** Revoke an API key */
+  /**
+   * List API keys.
+   * Pass `children: true` to list child keys of the calling API key.
+   */
+  async keys(opts) {
+    const q = opts?.children ? "?children=true" : "";
+    const { data } = await this._fetch(`${this.platformURL}/v1/keys${q}`);
+    return data;
+  }
+  /**
+   * Update an API key's limits.
+   * Can adjust budget, allowedModels, rpmLimit, expiresAt, and name.
+   */
+  async updateKey(id, updates) {
+    const { data } = await this._fetch(`${this.platformURL}/v1/keys/${id}`, {
+      method: "PATCH",
+      body: JSON.stringify(updates)
+    });
+    return data;
+  }
+  /** Revoke an API key. If the key has children, they are also revoked recursively. */
   async revokeKey(id) {
-    const apiRoot = this.baseURL.replace(/\/v1$/, "");
-    const res = await proxiedFetch(this.privacy, `${apiRoot}/api/keys/${id}`, {
-      method: "DELETE",
-      headers: this.headers
-    }, false);
-    if (!res.ok) {
-      const err = await res.json().catch(() => ({ error: res.statusText }));
-      throw new TCloudError(res.status, err.error?.message || err.error || err.message || res.statusText);
-    }
+    await this._fetch(`${this.platformURL}/v1/keys/${id}`, { method: "DELETE" });
+  }
+  /** Rotate an API key — creates new key with same config, revokes old */
+  async rotateKey(id) {
+    const { data } = await this._fetch(`${this.platformURL}/v1/keys/${id}/rotate`, { method: "POST" });
+    return data;
+  }
+  // ── Projects (via id.tangle.tools) ──
+  /** Create a project for usage attribution */
+  async createProject(name, product) {
+    const { data } = await this._fetch(`${this.platformURL}/v1/projects`, {
+      method: "POST",
+      body: JSON.stringify({ name, product })
+    });
+    return data;
+  }
+  /** List projects */
+  async projects() {
+    const { data } = await this._fetch(`${this.platformURL}/v1/projects`);
+    return data;
   }
   /** Generate embeddings */
   async embeddings(options) {
@@ -964,6 +1055,61 @@ var TCloudClient = class _TCloudClient {
       };
     });
   }
+  // ── Eval ──────────────────────────────────────────────────────────────
+  get _apiRoot() {
+    return this.baseURL.replace(/\/v1$/, "");
+  }
+  async eval(opts) {
+    return this._request(`${this._apiRoot}/api/eval`, { method: "POST", body: JSON.stringify(opts) });
+  }
+  async createSuite(opts) {
+    return this._request(`${this._apiRoot}/api/eval/suites`, { method: "POST", body: JSON.stringify(opts) });
+  }
+  async listSuites() {
+    return this._fetch(`${this._apiRoot}/api/eval/suites`);
+  }
+  async runSuite(suiteId, opts) {
+    return this._request(`${this._apiRoot}/api/eval/suites/${suiteId}/runs`, { method: "POST", body: JSON.stringify(opts || {}) });
+  }
+  async listRuns(suiteId) {
+    return this._fetch(`${this._apiRoot}/api/eval/suites/${suiteId}/runs`);
+  }
+  async getRun(runId) {
+    return this._fetch(`${this._apiRoot}/api/eval/runs/${runId}`);
+  }
+  async setBaseline(runId) {
+    await this._request(`${this._apiRoot}/api/eval/runs/${runId}`, { method: "PATCH", body: JSON.stringify({ baseline: true }) });
+  }
+  // ── Sandbox ──────────────────────────────────────────────────────────
+  async sandboxPricing(opts) {
+    const p = new URLSearchParams();
+    if (opts?.cpu) p.set("cpu", String(opts.cpu));
+    if (opts?.ram) p.set("ram", String(opts.ram));
+    if (opts?.disk) p.set("disk", String(opts.disk));
+    return this._fetch(`${this._apiRoot}/api/sandbox/pricing?${p}`);
+  }
+  async sandboxStatus() {
+    return this._fetch(`${this._apiRoot}/api/sandbox/link-key`);
+  }
+  async sandboxProvision() {
+    return this._request(`${this._apiRoot}/api/sandbox/provision`, { method: "POST" });
+  }
+  async sandboxCreate(opts) {
+    return this._request(`${this._apiRoot}/api/sandbox/sessions`, { method: "POST", body: JSON.stringify(opts) });
+  }
+  async sandboxList() {
+    return this._fetch(`${this._apiRoot}/api/sandbox/sessions`);
+  }
+  async sandboxStats(sandboxId) {
+    return this._fetch(`${this._apiRoot}/api/sandbox/stats/${sandboxId}`);
+  }
+  async sandboxDestroy(sessionId) {
+    return this._request(`${this._apiRoot}/api/sandbox/sessions/${sessionId}`, { method: "DELETE" });
+  }
+  // ── User Info ────────────────────────────────────────────────────────
+  async userInfo() {
+    return this._fetch(`${this._apiRoot}/api/auth/userinfo`);
+  }
 };
 var ALL_TIERS = [
   { name: "cpu-only", cpu: 4, ramGb: 16, gpu: 0, tee: false },
@@ -974,6 +1120,59 @@ var ALL_TIERS = [
   { name: "max-gpu", cpu: 64, ramGb: 256, gpu: 4, tee: false },
   { name: "max-gpu-tee", cpu: 64, ramGb: 256, gpu: 4, tee: true }
 ];
+var BridgeSession = class _BridgeSession {
+  constructor(client, cfg) {
+    this.client = client;
+    this.cfg = cfg;
+  }
+  /** Full chat completion (non-streaming). */
+  async chat(options) {
+    return this.client.chat({ ...options, bridge: this.cfg });
+  }
+  /** Stream OpenAI chat.completion.chunks. */
+  chatStream(options) {
+    return this.client.chatStream({ ...options, bridge: this.cfg });
+  }
+  /** One-shot: send a string, get the assistant text. */
+  async ask(message, extra) {
+    const completion = await this.chat({
+      messages: [{ role: "user", content: message }],
+      ...extra
+    });
+    return completion.choices[0]?.message?.content || "";
+  }
+  /** One-shot: send a string, stream text deltas. */
+  async *stream(message, extra) {
+    for await (const chunk of this.chatStream({
+      messages: [{ role: "user", content: message }],
+      ...extra
+    })) {
+      const content = chunk.choices?.[0]?.delta?.content;
+      if (content) yield content;
+    }
+  }
+  /** Turn-based: send full message history, get assistant text. */
+  async turn(messages, extra) {
+    const completion = await this.chat({ messages, ...extra });
+    return completion.choices[0]?.message?.content || "";
+  }
+  /** Clone with a new resume id — same harness, different logical conversation. */
+  withResume(resume) {
+    return new _BridgeSession(this.client, { ...this.cfg, resume });
+  }
+  /** Clone with a different model inside the same harness. */
+  withModel(model) {
+    return new _BridgeSession(this.client, { ...this.cfg, model });
+  }
+  /** The effective model id that will land on the router (`bridge/<harness>/<model>`). */
+  get model() {
+    return this.cfg.model ? `bridge/${this.cfg.harness}/${this.cfg.model}` : `bridge/${this.cfg.harness}`;
+  }
+  /** The resume id currently bound to this session, if any. */
+  get resume() {
+    return this.cfg.resume;
+  }
+};
 function selectTiers(all, n) {
   if (n >= all.length) return [...all];
   if (n <= 1) return [all[0]];
@@ -1294,6 +1493,7 @@ var TCloud = class _TCloud extends TCloudClient {
 var fs = __toESM(require("fs"), 1);
 var path = __toESM(require("path"), 1);
 var readline = __toESM(require("readline"), 1);
+var import_child_process = require("child_process");
 var CONFIG_DIR = path.join(process.env.HOME || "~", ".tcloud");
 var CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
 var WALLETS_FILE = path.join(CONFIG_DIR, "wallets.json");
@@ -1342,23 +1542,52 @@ program.command("config").description("View or update configuration").option("--
   console.log(JSON.stringify(c, null, 2));
 });
 var auth = program.command("auth").description("Authentication");
-auth.command("login").description("Log in via browser (device flow)").action(async () => {
+function openBrowser(url) {
+  if (process.env.NO_BROWSER || process.env.CI) return false;
+  if (!process.stdout.isTTY) return false;
+  try {
+    const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+    const child = (0, import_child_process.spawn)(cmd, [url], { stdio: "ignore", detached: true });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+var SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+async function runDeviceFlow(mode) {
   const config = loadConfig();
+  const initRes = await fetch(`${config.apiUrl}/api/auth/device`, { method: "POST" });
+  if (!initRes.ok) {
+    console.error(`
+  \u2717 Auth server returned ${initRes.status}.`);
+    process.exit(1);
+  }
+  const d = await initRes.json();
+  const urlWithCode = `${d.verification_url}?user_code=${encodeURIComponent(d.user_code)}`;
+  const opened = openBrowser(urlWithCode);
+  const header = mode === "signup" ? "Creating your Tangle account" : "Signing you in";
+  console.log(`
+  ${header}
+`);
+  console.log(`  ${opened ? "Browser opened:" : "Open this URL:"}`);
+  console.log(`  ${urlWithCode}
+`);
+  console.log(`  Verification code: ${d.user_code}
+`);
+  const deadline = Date.now() + (d.expires_in || 600) * 1e3;
+  const interval = Math.max(2, d.interval || 5) * 1e3;
+  const spinnerEnabled = process.stdout.isTTY && !process.env.CI;
+  let frame = 0;
+  function tickSpinner() {
+    if (!spinnerEnabled) return;
+    const remaining = Math.max(0, Math.round((deadline - Date.now()) / 1e3));
+    process.stdout.write(`\r  ${SPINNER_FRAMES[frame++ % SPINNER_FRAMES.length]} waiting for browser confirmation (${remaining}s remaining)  `);
+  }
+  const spinnerTimer = spinnerEnabled ? setInterval(tickSpinner, 100) : null;
   try {
-    const res = await fetch(`${config.apiUrl}/api/auth/device`, { method: "POST" });
-    if (!res.ok) {
-      console.error("Auth server error");
-      process.exit(1);
-    }
-    const d = await res.json();
-    console.log(`
-  Open: ${d.verification_url}
-  Code: ${d.user_code}
-
-  Waiting...`);
-    const deadline = Date.now() + (d.expires_in || 600) * 1e3;
     while (Date.now() < deadline) {
-      await new Promise((r2) => setTimeout(r2, (d.interval || 5) * 1e3));
+      await new Promise((r2) => setTimeout(r2, interval));
       const r = await fetch(`${config.apiUrl}/api/auth/device/token`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
@@ -1368,31 +1597,112 @@ auth.command("login").description("Log in via browser (device flow)").action(asy
       if (t.access_token) {
         config.apiKey = t.access_token;
         saveConfig(config);
-        console.log("\n  Authenticated!");
+        if (spinnerTimer) {
+          clearInterval(spinnerTimer);
+          process.stdout.write("\r" + " ".repeat(80) + "\r");
+        }
+        console.log(`  \u2713 Authenticated`);
+        console.log(`  \u2713 API key saved to ${CONFIG_FILE}
+`);
+        console.log(`  Try it:`);
+        console.log(`    tcloud whoami`);
+        console.log(`    tcloud chat "hello world"
+`);
         return;
       }
       if (t.error === "expired_token") {
-        console.error("\n  Code expired.");
+        if (spinnerTimer) {
+          clearInterval(spinnerTimer);
+          process.stdout.write("\r" + " ".repeat(80) + "\r");
+        }
+        console.error(`  \u2717 Code expired. Run 'tcloud auth ${mode}' again.`);
         process.exit(1);
       }
-      process.stdout.write(".");
     }
-    console.error("\n  Timed out.");
-  } catch (e) {
-    console.error("Failed:", e.message);
+    if (spinnerTimer) {
+      clearInterval(spinnerTimer);
+      process.stdout.write("\r" + " ".repeat(80) + "\r");
+    }
+    console.error(`  \u2717 Timed out after ${Math.round((d.expires_in || 600) / 60)} minutes.`);
+    process.exit(1);
+  } finally {
+    if (spinnerTimer) clearInterval(spinnerTimer);
   }
+}
+auth.command("signup").description("Create an account via browser (device flow)").action(() => runDeviceFlow("signup"));
+auth.command("login").description("Log in via browser (device flow)").action(() => runDeviceFlow("login"));
+auth.command("logout").description("Remove stored credentials").action(() => {
+  const c = loadConfig();
+  delete c.apiKey;
+  saveConfig(c);
+  console.log(`  \u2713 Logged out. Config kept at ${CONFIG_FILE}.`);
 });
 auth.command("set-key").description("Set API key directly").argument("<key>").action((key) => {
   const c = loadConfig();
   c.apiKey = key;
   saveConfig(c);
-  console.log("API key saved.");
+  console.log("  \u2713 API key saved.");
 });
 auth.command("status").description("Show auth status").action(() => {
   const c = loadConfig();
-  console.log(c.apiKey ? `Authenticated: ${c.apiKey.slice(0, 15)}...` : "Not authenticated");
+  console.log(c.apiKey ? `  \u2713 Authenticated: ${c.apiKey.slice(0, 15)}...${c.apiKey.slice(-4)}` : "  \u2717 Not authenticated. Run: tcloud auth signup");
   const w = loadWallets();
-  if (w.length) console.log(`Shielded wallets: ${w.length}`);
+  if (w.length) console.log(`  Shielded wallets: ${w.length}`);
+});
+auth.command("whoami").description("Show logged-in account details").action(async () => {
+  const c = loadConfig();
+  if (!c.apiKey) {
+    console.log("  \u2717 Not authenticated. Run: tcloud auth signup");
+    return;
+  }
+  try {
+    const res = await fetch(`${c.apiUrl}/api/auth/userinfo`, {
+      headers: { Authorization: `Bearer ${c.apiKey}` }
+    });
+    if (!res.ok) {
+      console.log(`  \u2717 Auth check failed (${res.status}). Your key may be revoked \u2014 run: tcloud auth login`);
+      return;
+    }
+    const me = await res.json();
+    const user = me.user ?? {};
+    const sub = me.subscription;
+    console.log(`  Email:   ${user.email ?? "n/a"}`);
+    console.log(`  User:    ${user.name ?? user.id ?? "n/a"}`);
+    console.log(`  Plan:    ${sub?.plan ?? "free"}`);
+    console.log(`  Balance: $${Number(me.balance ?? 0).toFixed(4)}`);
+    console.log(`  Key:     ${c.apiKey.slice(0, 15)}...${c.apiKey.slice(-4)}`);
+    console.log(`  API:     ${c.apiUrl}`);
+  } catch (e) {
+    console.log(`  \u2717 ${e.message ?? e}`);
+  }
+});
+program.command("signup").description("Create an account via browser (alias for `auth signup`)").action(() => runDeviceFlow("signup"));
+program.command("login").description("Log in via browser (alias for `auth login`)").action(() => runDeviceFlow("login"));
+program.command("logout").description("Remove stored credentials (alias for `auth logout`)").action(() => {
+  const c = loadConfig();
+  delete c.apiKey;
+  saveConfig(c);
+  console.log(`  \u2713 Logged out.`);
+});
+program.command("whoami").description("Show logged-in account (alias for `auth whoami`)").action(async () => {
+  const c = loadConfig();
+  if (!c.apiKey) {
+    console.log("  \u2717 Not authenticated. Run: tcloud signup");
+    return;
+  }
+  try {
+    const res = await fetch(`${c.apiUrl}/api/auth/userinfo`, { headers: { Authorization: `Bearer ${c.apiKey}` } });
+    if (!res.ok) {
+      console.log(`  \u2717 Auth failed (${res.status}). Run: tcloud login`);
+      return;
+    }
+    const me = await res.json();
+    const user = me.user ?? {};
+    const sub = me.subscription;
+    console.log(`  ${user.email ?? user.name ?? user.id}  \xB7  $${Number(me.balance ?? 0).toFixed(4)}  \xB7  ${sub?.plan ?? "free"}`);
+  } catch (e) {
+    console.log(`  \u2717 ${e.message ?? e}`);
+  }
 });
 var wallet = program.command("wallet").description("Shielded wallet management");
 wallet.command("generate").description("Generate ephemeral wallet").option("-l, --label <name>").action((opts) => {
@@ -1513,7 +1823,10 @@ credits.command("add").description("Add credits").argument("<amount>").action(as
   const client = getClient();
   try {
     const data = await client.addCredits(parseFloat(amount));
-    console.log(`Credits added. New balance: $${data.balance.toFixed(4)}`);
+    if (data.url) {
+      console.log(`Checkout URL: ${data.url}`);
+      console.log("Complete payment to add credits.");
+    }
   } catch (e) {
     console.error("Error:", e.message);
   }