@usenaive-sdk/vetta-cli 0.1.0 → 0.3.0

package/README.md

@@ -1,7 +1,8 @@
 # @usenaive-sdk/vetta-cli
 
 The `vetta` command line — drive the whole Vetta API from a terminal or a script: agents, sessions,
-computers, skills, files, identities, vaults, comms, deployments, webhooks and credits.
+computers, skills, files, identities, vaults, comms, deployments, webhooks, the monthly plan and
+credits.
 
 It is built on [`@usenaive-sdk/vetta`](https://www.npmjs.com/package/@usenaive-sdk/vetta), the same typed
 client the dashboard uses, so the CLI and the API never drift apart.
@@ -17,6 +18,7 @@ npm i -g @usenaive-sdk/vetta-cli
 ```bash
 vetta login --api-key sk_…      # or: vetta login --email … --password …
 vetta whoami
+vetta plan show                 # an org with no plan is refused everywhere else
 ```
 
 Credentials are stored on a named profile, so several organizations can be driven from one machine
@@ -29,8 +31,8 @@ vetta <group> <command> [flags]
 ```
 
 Groups: `agent` `audit` `auth` `computer` `connections` `credits` `deploy` `domain` `email` `file`
-`identity` `keys` `login` `logout` `models` `org` `phone` `run` `session` `skill` `vault` `webhook`
-`whoami`.
+`identity` `keys` `login` `logout` `models` `org` `phone` `plan` `run` `session` `skill` `vault`
+`webhook` `whoami`.
 
 `vetta <group> --help` lists a group's commands.
 

package/dist/index.js

@@ -23448,6 +23448,10 @@ var SubscriptionSchema = external_exports.object({
   cancel_at_period_end: external_exports.boolean(),
   action_url: external_exports.string().nullable()
 });
+var BillingPortalSessionSchema = external_exports.object({
+  object: external_exports.literal("billing_portal_session"),
+  action_url: external_exports.string()
+});
 var AcknowledgedSchema = external_exports.object({
   object: external_exports.string(),
   delivery: external_exports.enum(["sent", "undeliverable"])
@@ -23455,7 +23459,12 @@ var AcknowledgedSchema = external_exports.object({
 var auth = (config2) => ({
   /** Who this credential is. No scope, no org id needed — that is the whole point (§20.1). */
   me: () => request(config2, IdentitySchema22, { method: "GET", path: "/v1/me" }),
-  /** Sign in, or re-scope the session already held to another organization (§20.4). */
+  /**
+   * Sign in, finish an external sign-in, or re-scope the session already held to another
+   * organization (§20.4). `provider_token` is the access token an external provider sign-in came
+   * back with; the control plane re-verifies it against the provider and refuses an address the
+   * provider has not proved.
+   */
   session: (body) => request(config2, AuthSessionSchema, { method: "POST", path: "/v1/auth/session", body }),
   register: (body) => request(
     config2,
@@ -23531,7 +23540,17 @@ var credits = (config2) => ({
    * Stops the plan at the end of the period already paid for — never immediately. The state
    * follows the provider's callback, so the answer reports the request, not a completed change.
    */
-  cancelSubscription: () => request(config2, SubscriptionSchema, { method: "DELETE", path: "/v1/credits/subscription" })
+  cancelSubscription: () => request(config2, SubscriptionSchema, { method: "DELETE", path: "/v1/credits/subscription" }),
+  /**
+   * A link to the hosted account page: change the card, read the invoices, cancel. Opens nothing
+   * and changes nothing — an organization that never subscribed has no account, and this answers
+   * `404 not_found` rather than an empty page.
+   */
+  billingPortal: () => request(config2, BillingPortalSessionSchema, {
+    method: "POST",
+    path: "/v1/credits/billing_portal",
+    body: {}
+  })
 });
 var auditLogs = (config2) => ({
   list: (query = {}) => request(config2, page(AuditEntrySchema2), { method: "GET", path: "/v1/audit_logs", query })
@@ -23678,14 +23697,23 @@ var phones = (config2) => ({
     body
   })
 });
-var CONNECTORS = ["email", "chat", "tracker", "crm", "docs"];
 var CONNECTION_AUTHS = ["managed_oauth", "oauth", "api_key"];
+var ConnectionFieldSchema = external_exports.object({
+  name: external_exports.string(),
+  label: external_exports.string(),
+  description: external_exports.string(),
+  required: external_exports.boolean()
+});
 var AuthConfigSchema = external_exports.object({
   object: external_exports.literal("auth_config"),
   id: external_exports.string(),
   connector: external_exports.string(),
   auth: external_exports.enum(CONNECTION_AUTHS),
   scopes: external_exports.array(external_exports.string()),
+  /** The operations a connection made from this config may call. Pinned at creation. */
+  tools: external_exports.array(external_exports.string()),
+  /** Supply these to `connect`, or the hosted page asks the person for them instead. */
+  connect_fields: external_exports.array(ConnectionFieldSchema),
   created_at: external_exports.string()
 });
 var ConnectionSchema = external_exports.object({
@@ -23702,7 +23730,38 @@ var ConnectionSchema = external_exports.object({
   last_refreshed_at: external_exports.string().nullable(),
   created_at: external_exports.string()
 });
+var ConnectionAppSchema = external_exports.object({
+  object: external_exports.literal("connection_app"),
+  slug: external_exports.string(),
+  name: external_exports.string(),
+  description: external_exports.string(),
+  categories: external_exports.array(external_exports.string()),
+  /** Which setup paths work: `managed_oauth` is one call, `oauth` needs your own app first. */
+  auth: external_exports.array(external_exports.enum(CONNECTION_AUTHS)),
+  tool_count: external_exports.number()
+});
+var ConnectionAppDetailSchema = ConnectionAppSchema.extend({
+  /** The operations pinned when `tools` is not given to `createAuthConfig`. */
+  default_tools: external_exports.array(external_exports.string()),
+  connect_fields: external_exports.array(ConnectionFieldSchema)
+});
+var ConnectionAppPage = external_exports.object({
+  object: external_exports.literal("list"),
+  data: external_exports.array(ConnectionAppSchema),
+  has_more: external_exports.boolean(),
+  next_cursor: external_exports.string().nullable()
+});
 var connections = (config2) => ({
+  /**
+   * Search the app catalogue — the first call in the flow, and the one that replaced the enum.
+   * `search` matches an app's name, id or description; the reply's `slug` is what `connector` takes.
+   */
+  listApps: (query = {}) => request(config2, ConnectionAppPage, { method: "GET", path: "/v1/connections/apps", query }),
+  /** One app, whole: auth methods, the operations pinned by default, what `connect` will ask for. */
+  getApp: (slug) => request(config2, ConnectionAppDetailSchema, {
+    method: "GET",
+    path: `/v1/connections/apps/${slug}`
+  }),
   /** Org-level: *how* a connector authenticates. Shared across every identity that connects it. */
   createAuthConfig: (body) => request(config2, AuthConfigSchema, {
     method: "POST",
@@ -24638,23 +24697,46 @@ var computer = {
 // src/commands/connections.ts
 function authConfigBody(args) {
   const connector = args.need("connector");
-  if (!CONNECTORS.includes(connector)) {
-    throw new UsageError(`--connector must be one of: ${CONNECTORS.join(", ")}`);
-  }
   const auth3 = args.str("auth");
   if (auth3 !== void 0 && !CONNECTION_AUTHS.includes(auth3)) {
     throw new UsageError(`--auth must be one of: ${CONNECTION_AUTHS.join(", ")}`);
   }
   const clientId = args.str("client-id");
   const scopes2 = args.list("scope");
+  const tools2 = args.list("tool");
   return {
     connector,
     ...auth3 === void 0 ? {} : { auth: auth3 },
     ...scopes2.length === 0 ? {} : { scopes: scopes2 },
+    ...tools2.length === 0 ? {} : { tools: tools2 },
     ...clientId === void 0 ? {} : { client_id: clientId }
   };
 }
+function fieldsFrom(args) {
+  const out = {};
+  for (const pair of args.list("field")) {
+    const at = pair.indexOf("=");
+    if (at < 1) throw new UsageError("--field takes name=value, e.g. --field subdomain=acme");
+    out[pair.slice(0, at)] = pair.slice(at + 1);
+  }
+  return out;
+}
 var connections2 = {
+  /**
+   * Search the catalogue. This is where a setup starts, and it is the command the five-word enum
+   * made impossible: `--search helpdesk` finds what "triage my support tickets" needs.
+   */
+  apps: async ({ client, args }) => ({
+    out: await client.connections.listApps({
+      search: args.str("search"),
+      limit: args.int("limit"),
+      after: args.str("after")
+    })
+  }),
+  /** One app whole: the auth methods that work, the operations pinned by default, what `connect` asks for. */
+  app: async ({ client, args }) => ({
+    out: await client.connections.getApp(args.str("app") ?? args.at(0, "app-id"))
+  }),
   list: async ({ client, args }) => {
     const identity3 = args.str("identity");
     return { out: await client.connections.list(identity3 === void 0 ? {} : { identity: identity3 }) };
@@ -24673,12 +24755,16 @@ var connections2 = {
   })
 };
 var passport = {
-  connect: async ({ client, args }) => ({
-    out: await client.connections.connect({
-      auth_config_id: args.need("auth-config"),
-      identity: args.str("identity") ?? args.at(0, "identity")
-    })
-  }),
+  connect: async ({ client, args }) => {
+    const fields2 = fieldsFrom(args);
+    return {
+      out: await client.connections.connect({
+        auth_config_id: args.need("auth-config"),
+        identity: args.str("identity") ?? args.at(0, "identity"),
+        ...Object.keys(fields2).length === 0 ? {} : { fields: fields2 }
+      })
+    };
+  },
   /** Revoke. The provider drops the stored credential and every later call is refused. */
   disconnect: async ({ client, args }) => ({
     out: await client.connections.disconnect(args.str("connection") ?? args.at(0, "connection-id"))
@@ -24711,6 +24797,26 @@ var credits2 = {
     })
   })
 };
+var plan = {
+  /** `status`, when the paid period ends, and whether it is already set to stop (§18b). */
+  show: async ({ client }) => ({ out: await client.credits.subscription() }),
+  /**
+   * Opens the hosted checkout and changes **nothing**, exactly like `credits topup`: the plan turns
+   * `active` only when the signed provider callback lands, whenever the customer gets round to
+   * paying. So this prints `action_url` whole and returns, rather than blocking on a purchase it
+   * cannot see, cannot complete and cannot cancel. `vetta plan show` is what reports the outcome.
+   */
+  subscribe: async ({ client }) => ({ out: await client.credits.subscribe() }),
+  /**
+   * The hosted account page — card, invoices, cancellation. Symmetric with `subscribe`: it prints
+   * an `action_url` a human opens and returns, because there is nothing here a terminal can drive.
+   *
+   * It is why `plan` still has no `cancel` command. A cancel command would be a second, narrower
+   * way to do one of the four things this page already does, and it would leave the other three —
+   * a dead card is what actually ends most plans — reachable only from the dashboard.
+   */
+  portal: async ({ client }) => ({ out: await client.credits.billingPortal() })
+};
 
 // src/commands/deploy.ts
 function fields(args) {
@@ -24969,8 +25075,16 @@ function exitForStopReason(reason) {
 function exitForError(cause) {
   return cause instanceof UsageError ? EXIT_USAGE : EXIT_ERROR;
 }
+var REMEDY = {
+  subscription_required: "vetta plan subscribe"
+};
 function describeError(cause) {
-  if (cause instanceof ApiError) return `error: ${cause.code}: ${cause.message} (${cause.requestId})`;
+  if (cause instanceof ApiError) {
+    const remedy = REMEDY[cause.code];
+    const fix = remedy === void 0 ? "" : `
+fix it with: ${remedy}`;
+    return `error: ${cause.code}: ${cause.message} (${cause.requestId})${fix}`;
+  }
   if (cause instanceof UsageError) return `usage: ${cause.message}`;
   return `error: ${cause instanceof Error ? cause.message : String(cause)}`;
 }
@@ -25309,7 +25423,8 @@ var GROUPS = {
   webhook,
   org,
   keys: keys2,
-  credits: credits2
+  credits: credits2,
+  plan
 };
 var FLAGS = {
   auth: {
@@ -25362,7 +25477,7 @@ var FLAGS = {
     attach: "agent identity",
     detach: "agent identity",
     // Reached as `vetta identity connect|disconnect`; the sub-groups below carry the rest.
-    connect: "identity auth-config",
+    connect: "identity auth-config field",
     disconnect: "connection"
   },
   /** Reached as `vetta identity domain <command>` (`SUBGROUPS`). Org-level: no `--identity`. */
@@ -25384,10 +25499,12 @@ var FLAGS = {
   },
   /** Reached as `vetta identity connections <command>`. */
   connections: {
+    apps: "search limit after",
+    app: "app",
     list: "identity",
     show: "connection",
     configs: "",
-    "config-add": "connector auth scope client-id",
+    "config-add": "connector auth scope tool client-id",
     "config-rm": "auth-config"
   },
   /** Reached as `vetta identity phone <command>` (`SUBGROUPS` in `cli.ts`). */
@@ -25472,7 +25589,12 @@ var FLAGS = {
     remove: ""
   },
   keys: { create: "name scopes", list: "limit after", rotate: "", revoke: "" },
-  credits: { show: "", topup: "usd", ledger: "type session agent deployment from to limit after" }
+  credits: { show: "", topup: "usd", ledger: "type session agent deployment from to limit after" },
+  /**
+   * The monthly plan (§18b). No command takes a flag: the plan has one price, and neither
+   * `subscribe` nor `portal` has anything to configure — each answers a URL for a human to open.
+   */
+  plan: { show: "", subscribe: "", portal: "" }
 };
 var GLOBAL_FLAGS = "json human profile api-key org api-base-url version help";
 var UNSUPPORTED = {
@@ -25495,7 +25617,7 @@ var ALIASES = {
 };
 
 // src/cli.ts
-var VERSION = true ? "0.1.0" : "0.0.0-dev";
+var VERSION = true ? "0.3.0" : "0.0.0-dev";
 var GLOBAL_FLAGS_HELP = "global flags: --json (default) --human --profile <name> --api-key <key> --org <org_id> --api-base-url <url>";
 function usage() {
   const groups = [...Object.keys(GROUPS), ...Object.keys(ALIASES)].sort().join(", ");

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@usenaive-sdk/vetta-cli",
-  "version": "0.1.0",
-  "description": "Vetta command line \u2014 create agents, run sessions, watch events, see cost.",
+  "version": "0.3.0",
+  "description": "Vetta command line — create agents, run sessions, watch events, see cost.",
   "license": "MIT",
   "type": "module",
   "bin": {
@@ -18,19 +18,18 @@
   "publishConfig": {
     "access": "public"
   },
+  "devDependencies": {
+    "@types/node": "22.20.1",
+    "esbuild": "0.28.2",
+    "yaml": "^2.9.0",
+    "@vetta/core": "0.0.0",
+    "@usenaive-sdk/vetta": "0.2.0"
+  },
   "scripts": {
     "build": "node build.mjs",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "test:local": "vitest run",
-    "test:staging": "vitest run test/staging.e2e.ts",
-    "prepublishOnly": "pnpm run build"
-  },
-  "devDependencies": {
-    "@types/node": "catalog:",
-    "esbuild": "0.28.2",
-    "@vetta/core": "workspace:*",
-    "@usenaive-sdk/vetta": "workspace:*",
-    "yaml": "^2.9.0"
+    "test:staging": "vitest run test/staging.e2e.ts"
   }
-}
+}