@vavio/cli 0.0.0 → 0.1.0

package/bin/vavio.mjs

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { main } from "../dist/vavio.mjs";
+
+process.exitCode = await main();

package/dist/vavio.mjs

@@ -0,0 +1,1206 @@
+// src/cli.ts
+import { spawn as spawn2 } from "node:child_process";
+import { readFileSync as readFileSync2 } from "node:fs";
+import os from "node:os";
+import { parseArgs } from "node:util";
+import { discoverOAuthServerInfo } from "@modelcontextprotocol/client";
+
+// src/connection.ts
+import { Client, StreamableHTTPClientTransport } from "@modelcontextprotocol/client";
+
+// src/constants.ts
+var CLI_NAME = "@vavio/cli";
+var CLI_VERSION = "0.1.0";
+var CONTRACT_VERSION = 1;
+var CONTRACT_HEADER = "Vavio-Contract";
+var CONTRACT_MIN_HEADER = "Vavio-Contract-Min";
+var DEFAULT_MCP_URL = "https://vavio.ai/api/mcp";
+var DEFAULT_LOGIN_PORT = 47681;
+var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3;
+var KEYCHAIN_SERVICE = "vavio-cli";
+var OAUTH_CLIENT_NAME = "Vavio CLI";
+var REVOKE_TOOL = "revoke_connection";
+var EXIT = {
+  ok: 0,
+  refused: 1,
+  usage: 2,
+  human: 3,
+  auth: 4,
+  unavailable: 5,
+  upgrade: 6
+};
+var EXIT_CODE_LINES = [
+  "0  done",
+  "1  Vavio refused the request, or it failed",
+  "2  usage error: unknown command or option, missing or invalid argument",
+  "3  the owner must act: see next.text (and next.url)",
+  "4  not signed in, sign-in expired, or this connection was revoked: run vavio login",
+  "5  Vavio is unreachable or this endpoint is not available",
+  "6  this CLI is too old for the server: upgrade @vavio/cli"
+];
+
+// src/errors.ts
+var ERROR_CODES = {
+  usage: EXIT.usage,
+  not_signed_in: EXIT.auth,
+  signin_failed: EXIT.auth,
+  signin_timeout: EXIT.auth,
+  unavailable: EXIT.unavailable,
+  unreachable: EXIT.unavailable,
+  login_port_busy: EXIT.unavailable,
+  upgrade_required: EXIT.upgrade,
+  unknown_tool: EXIT.usage,
+  failed: EXIT.refused,
+  /** An MCP-level tool error without a Vavio result (for example input validation). */
+  tool_error: EXIT.refused
+};
+var CliError = class extends Error {
+  constructor(code, text) {
+    super(text);
+    this.code = code;
+    this.exitCode = ERROR_CODES[code];
+  }
+};
+var usage = (text) => new CliError("usage", text);
+var notSignedIn = (text = "Not signed in to Vavio. Run: vavio login") => new CliError("not_signed_in", text);
+
+// src/connection.ts
+function userAgent() {
+  return `vavio-cli/${CLI_VERSION} (node ${process.versions.node}; ${process.platform})`;
+}
+function contractFetch(base, mcpUrl2) {
+  const seen = { status: null, minContract: null, failure: null };
+  const fetchFn = async (input, init) => {
+    const request = input;
+    const url = new URL(typeof request === "string" ? request : request instanceof URL ? request.href : request.url);
+    const ours = url.origin === mcpUrl2.origin;
+    const headers = new Headers(init?.headers ?? (request instanceof Request ? request.headers : void 0));
+    if (!headers.has("user-agent")) headers.set("user-agent", userAgent());
+    if (ours) headers.set(CONTRACT_HEADER, String(CONTRACT_VERSION));
+    let response;
+    try {
+      response = await base(input, { ...init, headers });
+    } catch {
+      const failure = new CliError("unreachable", `Could not reach ${url.origin}. Check the network, then try again.`);
+      if (ours) {
+        seen.status = 0;
+        seen.failure = failure;
+      }
+      throw failure;
+    }
+    if (ours) {
+      seen.status = response.status;
+      const min = Number(response.headers.get(CONTRACT_MIN_HEADER));
+      if (Number.isInteger(min) && min > 0) seen.minContract = min;
+      if (response.status === 426 || seen.minContract !== null && seen.minContract > CONTRACT_VERSION) {
+        seen.failure = new CliError("upgrade_required", "This vavio CLI is too old for Vavio. Upgrade it: npm install -g @vavio/cli@latest");
+        throw seen.failure;
+      }
+    }
+    return response;
+  };
+  return { fetchFn, seen };
+}
+function failureOf(error, seen) {
+  for (let cause = error, depth = 0; cause && depth < 5; cause = cause.cause, depth += 1) {
+    if (cause instanceof CliError) return cause;
+  }
+  if (seen.failure) return seen.failure;
+  const status = seen.status;
+  const name = error?.name ?? "";
+  if (status === 401 || name === "UnauthorizedError") return notSignedIn("Vavio did not accept this sign-in. Run: vavio login");
+  if (status === 403) return notSignedIn("This sign-in may not use Vavio's tools. Run: vavio login");
+  if (status === 404) return new CliError("unavailable", "Vavio's AI connection is not available at this address yet.");
+  if (status === 429) return new CliError("unavailable", "Vavio is rate limiting this sign-in. Wait a minute, then try again.");
+  if (status !== null && status >= 500) return new CliError("unavailable", `Vavio answered ${status}. Try again in a minute.`);
+  if (status === 0) return new CliError("unreachable", "Could not reach Vavio. Check the network, then try again.");
+  const message = error instanceof Error ? error.message : String(error);
+  if (/not found|unknown tool/i.test(message)) return new CliError("unknown_tool", message.slice(0, 200));
+  return new CliError("failed", `Vavio's MCP server answered with an error: ${message.slice(0, 200)}`);
+}
+async function openSession(input) {
+  const mode = input.era === "legacy" ? "legacy" : input.era === "modern" ? { pin: "2026-07-28" } : "auto";
+  const client = new Client({ name: "vavio-cli", version: CLI_VERSION }, { versionNegotiation: { mode } });
+  const transport = new StreamableHTTPClientTransport(input.url, { fetch: input.fetchFn, authProvider: input.auth });
+  const guard = async (run) => {
+    try {
+      return await run();
+    } catch (error) {
+      throw failureOf(error, input.seen);
+    }
+  };
+  await guard(() => client.connect(transport));
+  let tools = null;
+  const listTools = async () => {
+    if (!tools) {
+      const all = [];
+      let cursor;
+      do {
+        const page = await guard(() => client.listTools(cursor ? { cursor } : {}));
+        all.push(...page.tools);
+        cursor = page.nextCursor;
+      } while (cursor);
+      tools = all;
+    }
+    return tools;
+  };
+  const server = client.getServerVersion();
+  return {
+    era: client.getProtocolEra?.() === "modern" ? "modern" : "legacy",
+    protocolVersion: client.getNegotiatedProtocolVersion?.() ?? null,
+    server: server ? { name: server.name, version: server.version } : null,
+    listTools,
+    async hasTool(name) {
+      return (await listTools()).some((tool) => tool.name === name);
+    },
+    async callTool(name, args) {
+      const result = await guard(() => client.callTool({ name, arguments: args }));
+      let value = result.structuredContent;
+      const text = () => Array.isArray(result.content) ? result.content.map((part) => part && typeof part === "object" && "text" in part ? String(part.text) : "").join("") : "";
+      if (!value && result.isError) {
+        value = { outcome: "error", error: { code: "tool_error", text: text().slice(0, 500) } };
+      } else if (!value) {
+        try {
+          const parsed = JSON.parse(text());
+          value = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : { text: text() };
+        } catch {
+          value = { text: text() };
+        }
+      }
+      return { value, isError: result.isError === true };
+    },
+    async close() {
+      await client.close().catch(() => void 0);
+    }
+  };
+}
+
+// src/oauth.ts
+import { randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import {
+  auth
+} from "@modelcontextprotocol/client";
+function loopbackRedirect(port) {
+  return `http://127.0.0.1:${port}/callback`;
+}
+var CliOAuthProvider = class {
+  constructor(opts) {
+    this.opts = opts;
+    this.verifier = null;
+    this.stateValue = null;
+    /** Set by `redirectToAuthorization` in a login. */
+    this.authorizationUrl = null;
+    /** In a login: ignore the stored sign-in (it stays until the new one is saved). */
+    this.fresh = false;
+  }
+  get redirectUrl() {
+    return this.opts.redirectUri;
+  }
+  get clientMetadata() {
+    return {
+      client_name: OAUTH_CLIENT_NAME,
+      redirect_uris: [this.opts.redirectUri],
+      token_endpoint_auth_method: "none",
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      software_id: "vavio-cli",
+      software_version: CLI_VERSION
+    };
+  }
+  state() {
+    this.stateValue = randomBytes(16).toString("base64url");
+    return this.stateValue;
+  }
+  get expectedState() {
+    return this.stateValue;
+  }
+  clientInformation() {
+    const client = this.opts.config.server(this.opts.serverUrl).client;
+    if (!client?.client_id) return void 0;
+    const uris = client.redirect_uris;
+    if (Array.isArray(uris) && !uris.includes(this.opts.redirectUri)) return void 0;
+    return client;
+  }
+  saveClientInformation(info) {
+    const { client_secret: _secret, ...publicInfo } = info;
+    this.opts.config.update(this.opts.serverUrl, { client: publicInfo });
+  }
+  async signIn() {
+    if (this.cached !== void 0) return this.cached;
+    if (this.fresh) return null;
+    const raw = await this.opts.store.get(this.opts.serverUrl);
+    let parsed = null;
+    try {
+      const value = raw ? JSON.parse(raw) : null;
+      parsed = value?.tokens?.access_token ? value : null;
+    } catch {
+      parsed = null;
+    }
+    this.opts.redactor.add(parsed?.tokens.access_token);
+    this.opts.redactor.add(parsed?.tokens.refresh_token);
+    this.cached = parsed;
+    return parsed;
+  }
+  async tokens() {
+    return (await this.signIn())?.tokens;
+  }
+  async saveTokens(tokens) {
+    this.opts.redactor.add(tokens.access_token);
+    this.opts.redactor.add(tokens.refresh_token);
+    this.opts.redactor.add(tokens.id_token);
+    const value = { tokens, saved_at: (/* @__PURE__ */ new Date()).toISOString() };
+    await this.opts.store.set(this.opts.serverUrl, JSON.stringify(value));
+    this.opts.config.update(this.opts.serverUrl, { store: this.opts.store.kind });
+    this.cached = value;
+  }
+  redirectToAuthorization(url) {
+    if (!this.opts.interactive) throw notSignedIn("Your Vavio sign-in has ended. Run: vavio login");
+    this.authorizationUrl = url;
+  }
+  saveCodeVerifier(verifier) {
+    this.opts.redactor.add(verifier);
+    this.verifier = verifier;
+  }
+  codeVerifier() {
+    if (!this.verifier) throw new CliError("signin_failed", "Sign-in lost its PKCE verifier. Run: vavio login");
+    return this.verifier;
+  }
+  saveDiscoveryState(state) {
+    this.discovery = state;
+  }
+  discoveryState() {
+    return this.discovery;
+  }
+  async invalidateCredentials(scope) {
+    if (scope === "all" || scope === "tokens") await this.forgetTokens();
+    if (scope === "all" || scope === "client") this.opts.config.update(this.opts.serverUrl, { client: void 0 });
+    if (scope === "all" || scope === "verifier") this.verifier = null;
+    if (scope === "all" || scope === "discovery") this.discovery = void 0;
+  }
+  async forgetTokens() {
+    await this.opts.store.delete(this.opts.serverUrl);
+    this.cached = null;
+  }
+};
+var PAGE = (title, text) => `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${title}</title></head><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1rem;line-height:1.5"><h1 style="font-size:1.25rem">${title}</h1><p>${text}</p></body></html>`;
+var escapeHtml = (text) => text.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+async function startLoopback(port) {
+  let settle = null;
+  const pending = [];
+  const server = createServer((request, response) => {
+    const url = new URL(request.url ?? "/", "http://127.0.0.1");
+    if (request.method !== "GET" || url.pathname !== "/callback") {
+      response.writeHead(404, { "content-type": "text/plain; charset=utf-8" }).end("Not found");
+      return;
+    }
+    const code = url.searchParams.get("code");
+    const error = url.searchParams.get("error");
+    const outcome = code ? { code, state: url.searchParams.get("state"), iss: url.searchParams.get("iss") } : new CliError("signin_failed", `Vavio did not sign you in (${(error ?? "no code").slice(0, 80)}). Run: vavio login`);
+    response.writeHead(code ? 200 : 400, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" }).end(
+      code ? PAGE("Signed in to Vavio", "You can close this tab and go back to the terminal.") : PAGE("Sign-in did not finish", `Vavio answered: ${escapeHtml((error ?? "no code").slice(0, 80))}. Go back to the terminal and run vavio login again.`)
+    );
+    if (settle) settle(outcome);
+    else pending.push(outcome);
+  });
+  await new Promise((resolve, reject) => {
+    server.once(
+      "error",
+      (error) => reject(
+        error.code === "EADDRINUSE" ? new CliError("login_port_busy", `Port ${port} on 127.0.0.1 is busy. Run: vavio login --port <another port>`) : new CliError("unavailable", `Could not listen on 127.0.0.1:${port} for the sign-in.`)
+      )
+    );
+    server.listen(port, "127.0.0.1", () => resolve());
+  });
+  const address = server.address();
+  const actual = typeof address === "object" && address ? address.port : port;
+  return {
+    redirectUri: loopbackRedirect(actual),
+    wait(timeoutMs) {
+      return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new CliError("signin_timeout", "No sign-in arrived in time. Run: vavio login")), timeoutMs);
+        timer.unref?.();
+        settle = (result) => {
+          clearTimeout(timer);
+          if (result instanceof Error) reject(result);
+          else resolve(result);
+        };
+        const early = pending.shift();
+        if (early) settle(early);
+      });
+    },
+    close() {
+      server.closeAllConnections?.();
+      server.close();
+    }
+  };
+}
+async function login(input) {
+  const { serverUrl, provider, fetchFn } = input;
+  provider.fresh = true;
+  const first = await auth(provider, { serverUrl, fetchFn });
+  if (first === "AUTHORIZED") return;
+  const url = provider.authorizationUrl;
+  if (!url) throw new CliError("signin_failed", "Vavio did not return a sign-in page. Run: vavio login");
+  await input.openUrl(url.href);
+  const callback = await input.loopback.wait(input.timeoutMs);
+  input.redactor.add(callback.code);
+  if (!provider.expectedState || callback.state !== provider.expectedState) {
+    throw new CliError("signin_failed", "The sign-in answer did not match this login. Run: vavio login");
+  }
+  const second = await auth(provider, { serverUrl, fetchFn, authorizationCode: callback.code, ...callback.iss ? { iss: callback.iss } : {} });
+  if (second !== "AUTHORIZED") throw new CliError("signin_failed", "Vavio did not finish the sign-in. Run: vavio login");
+}
+function registeredPort(client) {
+  const uris = client?.redirect_uris;
+  if (Array.isArray(uris)) {
+    for (const uri of uris) {
+      const match = typeof uri === "string" ? uri.match(/^http:\/\/127\.0\.0\.1:(\d+)\/callback$/) : null;
+      if (match && Number(match[1]) > 0) return Number(match[1]);
+    }
+  }
+  return DEFAULT_LOGIN_PORT;
+}
+
+// src/paths.ts
+import path from "node:path";
+function configDir(env, platform, home) {
+  if (env.VAVIO_CONFIG_DIR) return path.resolve(env.VAVIO_CONFIG_DIR);
+  if (platform === "win32") return path.join(env.APPDATA ?? path.join(home, "AppData", "Roaming"), "vavio");
+  if (platform === "darwin") return path.join(home, "Library", "Application Support", "vavio");
+  return path.join(env.XDG_CONFIG_HOME || path.join(home, ".config"), "vavio");
+}
+
+// src/redact.ts
+var JWT = /eyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]+/g;
+var Redactor = class {
+  constructor() {
+    this.secrets = /* @__PURE__ */ new Set();
+  }
+  add(value) {
+    if (typeof value === "string" && value.length >= 6) this.secrets.add(value);
+  }
+  apply(text) {
+    let out = text;
+    for (const secret of this.secrets) out = out.split(secret).join("[redacted]");
+    return out.replace(JWT, "[redacted]");
+  }
+};
+
+// src/store.ts
+import { spawn } from "node:child_process";
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import path2 from "node:path";
+var spawnRunner = (command, args, input) => new Promise((resolve) => {
+  let child;
+  try {
+    child = spawn(command, [...args], { stdio: ["pipe", "pipe", "pipe"], shell: false, windowsHide: true });
+  } catch {
+    resolve({ code: 127, stdout: "", stderr: "spawn failed" });
+    return;
+  }
+  let stdout = "";
+  let stderr = "";
+  child.stdout.on("data", (chunk) => stdout += chunk.toString("utf8"));
+  child.stderr.on("data", (chunk) => stderr += chunk.toString("utf8"));
+  child.on("error", () => resolve({ code: 127, stdout, stderr: stderr || "spawn failed" }));
+  child.on("close", (code) => resolve({ code: code ?? 1, stdout, stderr }));
+  child.stdin.on("error", () => void 0);
+  child.stdin.end(input ?? "");
+});
+function writePrivateFile(file, content) {
+  mkdirSync(path2.dirname(file), { recursive: true, mode: 448 });
+  try {
+    chmodSync(path2.dirname(file), 448);
+  } catch {
+  }
+  const temp = `${file}.${randomBytes2(6).toString("hex")}.tmp`;
+  writeFileSync(temp, content, { mode: 384 });
+  chmodSync(temp, 384);
+  renameSync(temp, file);
+}
+function readJson(file) {
+  try {
+    const parsed = JSON.parse(readFileSync(file, "utf8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+var FileStore = class {
+  constructor(dir) {
+    this.kind = "file";
+    this.file = path2.join(dir, "credentials.json");
+  }
+  async get(account) {
+    const value = readJson(this.file)[account];
+    return typeof value === "string" ? value : null;
+  }
+  async set(account, value) {
+    writePrivateFile(this.file, `${JSON.stringify({ ...readJson(this.file), [account]: value }, null, 2)}
+`);
+  }
+  async delete(account) {
+    if (!existsSync(this.file)) return;
+    const rest = readJson(this.file);
+    delete rest[account];
+    if (Object.keys(rest).length === 0) rmSync(this.file, { force: true });
+    else writePrivateFile(this.file, `${JSON.stringify(rest, null, 2)}
+`);
+  }
+};
+var KEYCHAIN_CHUNK = 3e3;
+var MAX_CHUNKS = 16;
+function safeArg(value) {
+  if (/["\\\r\n]/.test(value)) throw new CliError("failed", "This Vavio address cannot be used as a keychain account name.");
+  return `"${value}"`;
+}
+var KeychainStore = class {
+  constructor(run, keychain) {
+    this.run = run;
+    this.keychain = keychain;
+    this.kind = "keychain";
+  }
+  tail() {
+    return this.keychain ? [this.keychain] : [];
+  }
+  async read(account) {
+    const result = await this.run("/usr/bin/security", ["find-generic-password", "-a", account, "-s", KEYCHAIN_SERVICE, "-w", ...this.tail()]);
+    return result.code === 0 ? result.stdout.replace(/\n$/, "") : null;
+  }
+  async get(account) {
+    const head = await this.read(account);
+    const match = head?.match(/^v1\.(\d+)\.([A-Za-z0-9_-]*)$/);
+    if (!match) return null;
+    const parts = [match[2]];
+    for (let i = 1; i < Number(match[1]); i += 1) {
+      const part = await this.read(`${account}#${i}`);
+      if (part === null || !/^[A-Za-z0-9_-]*$/.test(part)) return null;
+      parts.push(part);
+    }
+    return Buffer.from(parts.join(""), "base64url").toString("utf8");
+  }
+  async set(account, value) {
+    const encoded = Buffer.from(value, "utf8").toString("base64url");
+    const chunks = [];
+    for (let i = 0; i < encoded.length || i === 0; i += KEYCHAIN_CHUNK) chunks.push(encoded.slice(i, i + KEYCHAIN_CHUNK));
+    if (chunks.length > MAX_CHUNKS) throw new CliError("failed", "The sign-in is too large for the keychain. Set VAVIO_CREDENTIAL_STORE=file.");
+    const keychain = this.keychain ? ` ${safeArg(this.keychain)}` : "";
+    const lines = chunks.map((chunk, i) => {
+      const name = i === 0 ? account : `${account}#${i}`;
+      const data = i === 0 ? `v1.${chunks.length}.${chunk}` : chunk;
+      return `add-generic-password -U -a ${safeArg(name)} -s ${safeArg(KEYCHAIN_SERVICE)} -l ${safeArg(OAUTH_CLIENT_NAME)} -w ${safeArg(data)}${keychain}`;
+    });
+    const result = await this.run("/usr/bin/security", ["-i"], `${lines.join("\n")}
+`);
+    if (result.code !== 0 || await this.read(account) === null) {
+      throw new CliError("failed", "Could not save the sign-in in the macOS keychain. Unlock it, or set VAVIO_CREDENTIAL_STORE=file.");
+    }
+    for (let i = chunks.length; i < MAX_CHUNKS; i += 1) {
+      const gone = await this.run("/usr/bin/security", ["delete-generic-password", "-a", `${account}#${i}`, "-s", KEYCHAIN_SERVICE, ...this.tail()]);
+      if (gone.code !== 0) break;
+    }
+  }
+  async delete(account) {
+    for (let i = 0; i < MAX_CHUNKS; i += 1) {
+      const name = i === 0 ? account : `${account}#${i}`;
+      const gone = await this.run("/usr/bin/security", ["delete-generic-password", "-a", name, "-s", KEYCHAIN_SERVICE, ...this.tail()]);
+      if (gone.code !== 0 && i > 0) break;
+    }
+  }
+};
+var SecretServiceStore = class {
+  constructor(run) {
+    this.run = run;
+    this.kind = "secret-service";
+  }
+  async get(account) {
+    const result = await this.run("secret-tool", ["lookup", "service", KEYCHAIN_SERVICE, "account", account]);
+    return result.code === 0 && result.stdout ? result.stdout : null;
+  }
+  async set(account, value) {
+    const result = await this.run("secret-tool", ["store", "--label", OAUTH_CLIENT_NAME, "service", KEYCHAIN_SERVICE, "account", account], value);
+    if (result.code !== 0) throw new CliError("failed", "Could not save the sign-in in the Secret Service keyring. Set VAVIO_CREDENTIAL_STORE=file.");
+  }
+  async delete(account) {
+    await this.run("secret-tool", ["clear", "service", KEYCHAIN_SERVICE, "account", account]);
+  }
+};
+function storeOf(kind, choice) {
+  if (kind === "keychain") return new KeychainStore(choice.run, choice.env.VAVIO_KEYCHAIN || void 0);
+  if (kind === "secret-service") return new SecretServiceStore(choice.run);
+  return new FileStore(choice.dir);
+}
+async function chooseStore(choice) {
+  const wanted = (choice.env.VAVIO_CREDENTIAL_STORE ?? "auto").toLowerCase();
+  if (wanted === "file") return storeOf("file", choice);
+  if (choice.platform === "darwin" && (wanted === "keychain" || wanted === "auto")) {
+    if (existsSync("/usr/bin/security") || wanted === "keychain") return storeOf("keychain", choice);
+  }
+  if (choice.platform === "linux" && (wanted === "keychain" || wanted === "auto")) {
+    const probe = await choice.run("secret-tool", ["lookup", "service", KEYCHAIN_SERVICE, "account", "vavio-cli-probe"]);
+    if (probe.code !== 127 && probe.stderr.trim() === "") return storeOf("secret-service", choice);
+    if (wanted === "keychain") throw new CliError("failed", "No Secret Service keyring answered (secret-tool). Set VAVIO_CREDENTIAL_STORE=file.");
+  }
+  if (wanted === "keychain") throw new CliError("failed", "No OS keychain on this platform. Set VAVIO_CREDENTIAL_STORE=file.");
+  return storeOf("file", choice);
+}
+var ConfigFile = class {
+  constructor(dir) {
+    this.file = path2.join(dir, "config.json");
+  }
+  server(url) {
+    const servers = readJson(this.file).servers;
+    return servers?.[url] ?? {};
+  }
+  update(url, patch) {
+    const all = readJson(this.file);
+    const servers = { ...all.servers ?? {} };
+    if (patch === null) delete servers[url];
+    else servers[url] = { ...servers[url], ...patch };
+    writePrivateFile(this.file, `${JSON.stringify({ version: 1, servers }, null, 2)}
+`);
+  }
+};
+
+// ../agent-types-shared/src/stored-uuid.ts
+var STORED_UUID_BODY = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
+var STORED_UUID_PATTERN = new RegExp(`^${STORED_UUID_BODY}$`, "i");
+function isStoredUuid(value) {
+  return typeof value === "string" && STORED_UUID_PATTERN.test(value);
+}
+var RFC_UUID_BODY = "[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}";
+var RFC_UUID_PATTERN = new RegExp(`^${RFC_UUID_BODY}$`, "i");
+
+// src/cli.ts
+var OPTIONS = {
+  json: { type: "boolean" },
+  url: { type: "string" },
+  help: { type: "boolean", short: "h" },
+  version: { type: "boolean", short: "v" },
+  args: { type: "string" },
+  "args-file": { type: "string" },
+  open: { type: "boolean" },
+  limit: { type: "string" },
+  before: { type: "string" },
+  "no-browser": { type: "boolean" },
+  port: { type: "string" }
+};
+var GLOBAL_FLAGS = ["json", "url", "help", "version"];
+var AUTH_REFUSALS = /* @__PURE__ */ new Set(["no_grant", "other_resource", "session_ended", "grant_not_live", "operation_not_granted", "reconnect_required", "bad_actor"]);
+var COMMANDS = {
+  login: {
+    usage: "vavio login [--no-browser] [--port <n>]",
+    summary: "Sign in to Vavio in your browser and save the sign-in on this computer.",
+    details: [
+      "Opens Vavio's consent page; approve it for one workspace. The CLI then acts only on that workspace.",
+      "--no-browser   Print the sign-in address instead of opening a browser.",
+      "--port <n>     Local port for the sign-in answer (default 47681).",
+      "The sign-in is saved in the OS keychain, or in a private file where there is none."
+    ],
+    flags: ["no-browser", "port"]
+  },
+  logout: {
+    usage: "vavio logout",
+    summary: "Remove this computer's sign-in and revoke it on Vavio.",
+    details: ["Exit code 3 means the local sign-in is removed but Vavio could not revoke it from here: next.text says what to do."]
+  },
+  whoami: { usage: "vavio whoami", summary: "Show the signed-in workspace. Same result as vavio account." },
+  account: {
+    usage: "vavio account",
+    summary: "Read the account: workspace, Hermes instances, offerings, included Hermes and open operations."
+  },
+  "instances list": { usage: "vavio instances list", summary: "List the workspace's Hermes instances with their ids and access state." },
+  "instance status": {
+    usage: "vavio instance <instance-id> status",
+    summary: "Read one Hermes instance. The id is required: take it from vavio instances list."
+  },
+  "operations list": {
+    usage: "vavio operations list [--open] [--limit <1-50>] [--before <operation-id>]",
+    summary: "List operations, newest first.",
+    details: [
+      "--open           Only operations still queued, running, waiting for the owner, or with an unknown outcome.",
+      "--before <id>    Older page: pass next_before from the previous page."
+    ],
+    flags: ["open", "limit", "before"]
+  },
+  "operations get": { usage: "vavio operations get <operation-id>", summary: "Read one operation: status, result or error, and the next step." },
+  offerings: { usage: "vavio offerings", summary: "List what Vavio offers and whether it can be bought now." },
+  tools: { usage: "vavio tools", summary: "List every tool Vavio's server offers, with its input schema, in server order." },
+  call: {
+    usage: "vavio call <tool> [--args '<json object>' | --args-file <path|->]",
+    summary: "Call any Vavio tool by name. Prints the tool's result.",
+    details: [
+      "--args-file -   Read the JSON arguments from stdin.",
+      "Use vavio tools to see names and input schemas. Tool results follow the same exit codes as the other commands."
+    ],
+    flags: ["args", "args-file"]
+  }
+};
+var GROUPS = {
+  instances: ["instances list"],
+  instance: ["instance status"],
+  operations: ["operations list", "operations get"]
+};
+function mainHelp() {
+  const width = Math.max(...Object.values(COMMANDS).map((c) => c.usage.replace(/^vavio /, "").split(" [")[0].length)) + 2;
+  const lines = Object.values(COMMANDS).map((c) => `  ${c.usage.replace(/^vavio /, "").split(" [")[0].padEnd(width)}${c.summary}`);
+  return [
+    "vavio: operate your Vavio account and Hermes instances from a terminal or an AI assistant.",
+    "",
+    "Usage: vavio <command> [options]",
+    "",
+    "Commands:",
+    ...lines,
+    "",
+    "Options for every command:",
+    "  --json          Print exactly one JSON object on stdout, errors included.",
+    `  --url <url>     Vavio MCP endpoint (default ${DEFAULT_MCP_URL}, or VAVIO_URL).`,
+    "  -h, --help      Show help for a command: vavio <command> --help",
+    "  -v, --version   Print the version.",
+    "",
+    "Exit codes:",
+    ...EXIT_CODE_LINES.map((line) => `  ${line}`),
+    "",
+    "Environment:",
+    "  VAVIO_URL                 MCP endpoint, as --url.",
+    "  VAVIO_CONFIG_DIR          Folder for config.json and, without a keychain, credentials.json.",
+    "  VAVIO_CREDENTIAL_STORE    auto (default), keychain or file.",
+    "  VAVIO_ACCESS_TOKEN        Use this token for the run; it is never saved or refreshed.",
+    "",
+    "Never put secrets (API keys, bot tokens, passwords) in arguments. Vavio collects them on its own web pages."
+  ].join("\n");
+}
+function commandHelp(key) {
+  const c = COMMANDS[key];
+  return [`Usage: ${c.usage}`, "", c.summary, ...c.details?.length ? ["", ...c.details] : [], "", "Also: --json, --url <url>. Exit codes: vavio --help."].join("\n");
+}
+var Output = class {
+  constructor(io, redactor, json) {
+    this.io = io;
+    this.redactor = redactor;
+    this.json = json;
+  }
+  out(text) {
+    this.io.stdout.write(this.redactor.apply(text.endsWith("\n") ? text : `${text}
+`));
+  }
+  err(text) {
+    this.io.stderr.write(this.redactor.apply(text.endsWith("\n") ? text : `${text}
+`));
+  }
+  value(value) {
+    this.out(JSON.stringify(value));
+  }
+};
+function nextOf(value) {
+  const next = value.next;
+  return next && typeof next === "object" ? next : null;
+}
+function exitForResult(value, isError) {
+  const refused = value.outcome === "refused" ? value.refused : void 0;
+  if (refused) {
+    if (AUTH_REFUSALS.has(String(refused.code))) return EXIT.auth;
+    return nextOf(value)?.kind === "human" ? EXIT.human : EXIT.refused;
+  }
+  if (isError) return EXIT.refused;
+  return nextOf(value)?.kind === "human" ? EXIT.human : EXIT.ok;
+}
+function nextLine(value) {
+  const next = nextOf(value);
+  if (!next) return null;
+  if (next.kind === "human") return `Next (you): ${next.text ?? ""}${next.url ? ` ${next.url}` : ""}`;
+  if (next.kind === "call") {
+    const wait = next.after_seconds ? ` after ${next.after_seconds}s` : "";
+    return `Next: ${next.tool}${wait}${next.text ? `: ${next.text}` : ""}`;
+  }
+  return next.text ? `Next: ${next.text}` : null;
+}
+function table(rows) {
+  const widths = rows[0].map((_, i) => Math.max(...rows.map((row) => row[i].length)));
+  return rows.map((row) => row.map((cell, i) => i === row.length - 1 ? cell : cell.padEnd(widths[i])).join("  ")).join("\n");
+}
+var str = (value) => value === null || value === void 0 ? "-" : String(value);
+var FORMAT = {
+  account(v) {
+    const ws = v.workspace ?? {};
+    const instances = v.instances ?? [];
+    const offerings = v.offerings ?? [];
+    const ent = v.entitlements?.hermes ?? {};
+    return [
+      `Workspace  ${str(ws.name)} (${str(ws.id)})`,
+      `Role       ${str(v.role)}`,
+      `Hermes     ${instances.length} instance(s); included ${str(ent.used)} of ${str(ent.granted)}`,
+      ...instances.map((i) => `  ${str(i.id)}  ${str(i.access)}  ${str(i.address)}`),
+      `Offerings  ${offerings.map((o) => `${str(o.title)}: ${o.purchasable ? "for sale" : "not for sale yet"}`).join("; ") || "none"}`,
+      `Open operations  ${str(v.open_operations)}`
+    ].join("\n");
+  },
+  whoami(v) {
+    const ws = v.workspace ?? {};
+    return `Signed in as the ${str(v.role)} of workspace ${str(ws.name)} (${str(ws.id)}).`;
+  },
+  instances(v) {
+    const rows = (v.instances ?? []).map((i) => [str(i.id), str(i.access), str(i.lifecycle_state), str(i.address)]);
+    return rows.length ? table([["ID", "ACCESS", "STATE", "ADDRESS"], ...rows]) : "No Hermes instances in this workspace.";
+  },
+  instance(v) {
+    const i = v.instance ?? v ?? {};
+    return Object.entries(i).filter(([key]) => !["outcome", "observed_at", "source", "next"].includes(key)).map(([key, value]) => `${key.padEnd(16)}${typeof value === "object" && value !== null ? JSON.stringify(value) : str(value)}`).join("\n");
+  },
+  operations(v) {
+    const rows = (v.operations ?? []).map((o) => [str(o.id), str(o.kind), str(o.status), str(o.updated_at)]);
+    const more = v.next_before ? `
+Older: vavio operations list --before ${str(v.next_before)}` : "";
+    return (rows.length ? table([["ID", "KIND", "STATUS", "UPDATED"], ...rows]) : "No operations.") + more;
+  },
+  operation(v) {
+    const o = v.operation ?? {};
+    const lines = [`Operation  ${str(o.id)}`, `Kind       ${str(o.kind)}`, `Status     ${str(o.status)}`, `Updated    ${str(o.updated_at)}`];
+    if (o.result) lines.push(`Result     ${JSON.stringify(o.result)}`);
+    const error = o.error;
+    if (error) lines.push(`Error      ${str(error.code)}: ${str(error.text)} (retry ${str(error.retry)})`);
+    const human = o.human;
+    if (human) lines.push(`Owner step ${str(human.text)}${human.url ? ` ${str(human.url)}` : ""}`);
+    return lines.join("\n");
+  },
+  offerings(v) {
+    const rows = (v.offerings ?? []).map((o) => {
+      const price = o.price;
+      return [str(o.id), str(o.title), price ? `${str(price.amount)} ${str(price.currency)}/${str(price.interval)}` : "no price set", o.purchasable ? "for sale" : `not for sale${o.reason ? `: ${str(o.reason)}` : ""}`];
+    });
+    return rows.length ? table([["ID", "TITLE", "PRICE", "STATUS"], ...rows]) : "No offerings.";
+  },
+  raw(v) {
+    return JSON.stringify(v, null, 2);
+  }
+};
+function mcpUrl(raw) {
+  let url;
+  try {
+    url = new URL(raw || DEFAULT_MCP_URL);
+  } catch {
+    throw usage(`Not a URL: ${raw}`);
+  }
+  const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) throw usage("The Vavio URL must use https (http only for localhost).");
+  url.hash = "";
+  return url;
+}
+async function storeFor(ctx) {
+  const kind = ctx.config.server(ctx.key).store;
+  const choice = { env: ctx.env, platform: ctx.platform, dir: ctx.dir, run: ctx.run };
+  return kind ? storeOf(kind, choice) : chooseStore(choice);
+}
+function accessTokenOf(ctx) {
+  return ctx.io.accessToken ?? ctx.env.VAVIO_ACCESS_TOKEN ?? null;
+}
+async function connect(ctx) {
+  const era = (ctx.io.era ?? ctx.env.VAVIO_MCP_ERA) || "auto";
+  if (!["auto", "legacy", "modern"].includes(era)) throw usage("VAVIO_MCP_ERA must be auto, legacy or modern.");
+  const token = accessTokenOf(ctx);
+  if (token) {
+    ctx.redactor.add(token);
+    return openSession({ url: ctx.url, fetchFn: ctx.fetch.fetchFn, seen: ctx.fetch.seen, era, auth: { token: async () => token } });
+  }
+  const store = await storeFor(ctx);
+  const client = ctx.config.server(ctx.key).client;
+  const provider = new CliOAuthProvider({
+    serverUrl: ctx.key,
+    config: ctx.config,
+    store,
+    redactor: ctx.redactor,
+    interactive: false,
+    redirectUri: loopbackRedirect(registeredPort(client))
+  });
+  if (!await provider.signIn()) throw notSignedIn();
+  return openSession({ url: ctx.url, fetchFn: ctx.fetch.fetchFn, seen: ctx.fetch.seen, era, auth: provider });
+}
+async function withSession(ctx, work) {
+  const session = await connect(ctx);
+  try {
+    return await work(session);
+  } finally {
+    await session.close();
+  }
+}
+function report(ctx, value, isError, format) {
+  const code = exitForResult(value, isError);
+  if (ctx.out.json) {
+    ctx.out.value(value);
+    return code;
+  }
+  if (value.outcome === "refused") {
+    const refused = value.refused ?? {};
+    ctx.out.err(`Refused (${str(refused.code)}): ${str(refused.text)}`);
+  } else {
+    ctx.out.out(format(value));
+  }
+  const line = nextLine(value);
+  if (line && (code !== EXIT.ok || nextOf(value)?.kind === "human")) ctx.out.err(line);
+  return code;
+}
+async function callAndReport(ctx, tool, args, format) {
+  return withSession(ctx, async (session) => {
+    if (!await session.hasTool(tool)) throw new CliError("unavailable", `This Vavio server does not offer ${tool} yet.`);
+    const answer = await session.callTool(tool, args);
+    return report(ctx, answer.value, answer.isError, format);
+  });
+}
+function defaultOpenUrl(platform) {
+  return (url) => {
+    const [command, args] = platform === "darwin" ? ["open", [url]] : platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : ["xdg-open", [url]];
+    try {
+      const child = spawn2(command, args, { stdio: "ignore", detached: true, shell: false });
+      child.on("error", () => void 0);
+      child.unref();
+    } catch {
+    }
+  };
+}
+async function readArgs(ctx) {
+  const inline = ctx.flags.args;
+  const file = ctx.flags["args-file"];
+  if (inline !== void 0 && file !== void 0) throw usage("Use --args or --args-file, not both.");
+  let text = inline;
+  if (file !== void 0) {
+    try {
+      text = file === "-" ? await (ctx.io.readStdin ?? readAllStdin)() : readFileSync2(file, "utf8");
+    } catch {
+      throw usage(`Could not read ${file === "-" ? "stdin" : file}.`);
+    }
+  }
+  if (text === void 0 || text.trim() === "") return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw usage("The arguments are not valid JSON. Pass one JSON object, for example --args '{}'.");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw usage("The arguments must be one JSON object.");
+  return parsed;
+}
+function readAllStdin() {
+  return new Promise((resolve, reject) => {
+    let text = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => text += chunk);
+    process.stdin.on("end", () => resolve(text));
+    process.stdin.on("error", reject);
+  });
+}
+async function cmdLogin(ctx) {
+  const portFlag = ctx.flags.port;
+  const port = portFlag === void 0 ? registeredPort(ctx.config.server(ctx.key).client) : Number(portFlag);
+  if (!Number.isInteger(port) || port < 0 || port > 65535) throw usage("--port must be a port number.");
+  const choice = { env: ctx.env, platform: ctx.platform, dir: ctx.dir, run: ctx.run };
+  const store = await chooseStore(choice);
+  const loopback = await startLoopback(port);
+  const provider = new CliOAuthProvider({ serverUrl: ctx.key, config: ctx.config, store, redactor: ctx.redactor, interactive: true, redirectUri: loopback.redirectUri });
+  const open = ctx.flags["no-browser"] ? null : ctx.io.openUrl ?? defaultOpenUrl(ctx.platform);
+  try {
+    await login({
+      serverUrl: ctx.key,
+      provider,
+      loopback,
+      fetchFn: ctx.fetch.fetchFn,
+      redactor: ctx.redactor,
+      timeoutMs: ctx.io.loginTimeoutMs ?? LOGIN_TIMEOUT_MS,
+      openUrl: async (url) => {
+        ctx.out.err(open ? `Opening your browser to sign in to Vavio. If it does not open, go to:
+  ${url}` : `To sign in to Vavio, open:
+  ${url}`);
+        ctx.out.err("Waiting for you to approve in the browser...");
+        await open?.(url);
+      }
+    });
+  } catch (error) {
+    if (error instanceof CliError) throw error;
+    throw new CliError("signin_failed", `Sign-in failed: ${(error instanceof Error ? error.message : String(error)).slice(0, 200)}. Run: vavio login`);
+  } finally {
+    loopback.close();
+  }
+  if (!await provider.signIn()) throw new CliError("signin_failed", "Vavio did not finish the sign-in. Run: vavio login");
+  const clientId = String(ctx.config.server(ctx.key).client?.client_id ?? "");
+  let workspace = null;
+  try {
+    const answer = await withSession(ctx, (session) => session.callTool("account_overview", {}));
+    if (answer.value.outcome === "ok") workspace = answer.value.workspace ?? null;
+  } catch {
+    workspace = null;
+  }
+  const value = { outcome: "ok", signed_in: true, server: ctx.key, client_id: clientId, credential_store: store.kind, workspace };
+  if (ctx.out.json) ctx.out.value(value);
+  else {
+    const where = store.kind === "file" ? "a private file" : store.kind === "keychain" ? "the macOS keychain" : "the Secret Service keyring";
+    ctx.out.out(`Signed in to Vavio${workspace ? `: workspace ${str(workspace.name)} (${str(workspace.id)})` : ""}. Saved in ${where}.`);
+  }
+  return EXIT.ok;
+}
+async function revokeOnServer(ctx, provider) {
+  try {
+    const viaTool = await withSession(ctx, async (session) => {
+      if (!await session.hasTool(REVOKE_TOOL)) return null;
+      const answer = await session.callTool(REVOKE_TOOL, {});
+      return answer.value.outcome === "ok" && !answer.isError;
+    });
+    if (viaTool !== null) return viaTool ? "revoked" : "failed";
+  } catch (error) {
+    if (error instanceof CliError && error.exitCode === EXIT.auth) return "revoked";
+  }
+  try {
+    const info = await discoverOAuthServerInfo(ctx.key, { fetchFn: ctx.fetch.fetchFn });
+    const endpoint = info.authorizationServerMetadata?.revocation_endpoint;
+    const tokens = await provider.tokens();
+    const clientId = ctx.config.server(ctx.key).client?.client_id;
+    if (!endpoint || !tokens || typeof clientId !== "string") return "not_supported";
+    let ok = true;
+    for (const [token, hint] of [
+      [tokens.refresh_token, "refresh_token"],
+      [tokens.access_token, "access_token"]
+    ]) {
+      if (!token) continue;
+      const response = await ctx.fetch.fetchFn(endpoint, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ token, token_type_hint: hint, client_id: clientId }).toString()
+      });
+      ok &&= response.ok;
+    }
+    return ok ? "revoked" : "failed";
+  } catch {
+    return "failed";
+  }
+}
+async function cmdLogout(ctx) {
+  const store = await storeFor(ctx);
+  const provider = new CliOAuthProvider({
+    serverUrl: ctx.key,
+    config: ctx.config,
+    store,
+    redactor: ctx.redactor,
+    interactive: false,
+    redirectUri: loopbackRedirect(registeredPort(ctx.config.server(ctx.key).client))
+  });
+  if (!await provider.signIn()) {
+    const value2 = { outcome: "ok", signed_out: false, server: ctx.key, text: "Not signed in on this computer." };
+    if (ctx.out.json) ctx.out.value(value2);
+    else ctx.out.out(value2.text);
+    return EXIT.ok;
+  }
+  const revocation = await revokeOnServer(ctx, provider);
+  await provider.forgetTokens();
+  const revoked = revocation === "revoked";
+  const value = {
+    outcome: "ok",
+    signed_out: true,
+    server: ctx.key,
+    server_revoked: revoked,
+    revocation,
+    next: revoked ? { kind: "none", text: "Signed out, and Vavio revoked this connection." } : { kind: "human", text: "This computer is signed out, but Vavio has not revoked the connection. Remove Vavio CLI from the assistants connected to your Vavio account." }
+  };
+  if (ctx.out.json) ctx.out.value(value);
+  else {
+    ctx.out.out(revoked ? "Signed out. Vavio revoked this connection." : "Signed out on this computer.");
+    if (!revoked) ctx.out.err(`Next (you): ${value.next.text}`);
+  }
+  return revoked ? EXIT.ok : EXIT.human;
+}
+async function cmdInstanceStatus(ctx, id) {
+  if (!isStoredUuid(id)) throw usage(`Not an instance id: ${id}. Take one from vavio instances list.`);
+  return withSession(ctx, async (session) => {
+    if (await session.hasTool("get_instance")) {
+      const answer2 = await session.callTool("get_instance", { instance_id: id });
+      return report(ctx, answer2.value, answer2.isError, FORMAT.instance);
+    }
+    const answer = await session.callTool("list_instances", {});
+    const value = answer.value;
+    if (value.outcome !== "ok") return report(ctx, value, answer.isError, FORMAT.instance);
+    const instance = (value.instances ?? []).find((item) => item.id === id);
+    if (!instance) {
+      return report(
+        ctx,
+        {
+          outcome: "refused",
+          refused: { code: "target_not_found", text: "No such item in this workspace." },
+          observed_at: value.observed_at,
+          source: "vavio",
+          next: { kind: "call", tool: "list_instances", args: {} }
+        },
+        true,
+        FORMAT.instance
+      );
+    }
+    return report(ctx, { outcome: "ok", instance, observed_at: value.observed_at, source: "vavio", next: value.next }, false, FORMAT.instance);
+  });
+}
+async function cmdOperationsList(ctx) {
+  const args = { status: ctx.flags.open ? "open" : "all" };
+  if (ctx.flags.limit !== void 0) {
+    const limit = Number(ctx.flags.limit);
+    if (!Number.isInteger(limit) || limit < 1 || limit > 50) throw usage("--limit must be a whole number from 1 to 50.");
+    args.limit = limit;
+  }
+  if (ctx.flags.before !== void 0) {
+    if (!isStoredUuid(ctx.flags.before)) throw usage("--before must be an operation id (next_before from the previous page).");
+    args.before = ctx.flags.before;
+  }
+  return callAndReport(ctx, "list_operations", args, FORMAT.operations);
+}
+async function cmdTools(ctx) {
+  return withSession(ctx, async (session) => {
+    const tools = await session.listTools();
+    const value = { outcome: "ok", tools, era: session.era, protocol_version: session.protocolVersion, server: session.server };
+    if (ctx.out.json) ctx.out.value(value);
+    else ctx.out.out(tools.map((tool) => `${tool.name}
+  ${tool.description ?? ""}`).join("\n"));
+    return EXIT.ok;
+  });
+}
+async function cmdCall(ctx, tool) {
+  const args = await readArgs(ctx);
+  return withSession(ctx, async (session) => {
+    if (!await session.hasTool(tool)) throw new CliError("unknown_tool", `Vavio offers no tool named ${tool}. Run: vavio tools`);
+    const answer = await session.callTool(tool, args);
+    return report(ctx, answer.value, answer.isError, FORMAT.raw);
+  });
+}
+function route(positionals) {
+  const [first, second, third, ...rest] = positionals;
+  const exact = (n) => {
+    if (positionals.length > n) throw usage(`Unexpected argument: ${positionals[n]}. See vavio --help.`);
+  };
+  switch (first) {
+    case "login":
+      exact(1);
+      return { key: "login", run: cmdLogin };
+    case "logout":
+      exact(1);
+      return { key: "logout", run: cmdLogout };
+    case "whoami":
+      exact(1);
+      return { key: "whoami", run: (ctx) => callAndReport(ctx, "account_overview", {}, FORMAT.whoami) };
+    case "account":
+      exact(1);
+      return { key: "account", run: (ctx) => callAndReport(ctx, "account_overview", {}, FORMAT.account) };
+    case "offerings":
+      exact(1);
+      return { key: "offerings", run: (ctx) => callAndReport(ctx, "list_offerings", {}, FORMAT.offerings) };
+    case "tools":
+      exact(1);
+      return { key: "tools", run: cmdTools };
+    case "instances":
+      if (second !== void 0 && second !== "list") throw usage(`Unknown command: instances ${second}. See vavio instances --help.`);
+      exact(2);
+      return { key: "instances list", run: (ctx) => callAndReport(ctx, "list_instances", {}, FORMAT.instances) };
+    case "instance":
+      if (second === void 0) throw usage("vavio instance needs an explicit instance id: vavio instance <instance-id> status. Take the id from vavio instances list.");
+      if (third !== "status") throw usage(`Unknown command: instance <id> ${third ?? ""}. Use: vavio instance <instance-id> status`.trim());
+      exact(3);
+      return { key: "instance status", run: (ctx) => cmdInstanceStatus(ctx, second) };
+    case "operations":
+      if (second === "list") {
+        exact(2);
+        return { key: "operations list", run: cmdOperationsList };
+      }
+      if (second === "get") {
+        if (third === void 0) throw usage("vavio operations get needs an operation id.");
+        if (rest.length) exact(3);
+        if (!isStoredUuid(third)) throw usage(`Not an operation id: ${third}.`);
+        return { key: "operations get", run: (ctx) => callAndReport(ctx, "get_operation", { operation_id: third }, FORMAT.operation) };
+      }
+      throw usage(`Unknown command: operations ${second ?? ""}. Use: vavio operations list | vavio operations get <id>`.trim());
+    case "call":
+      if (second === void 0) throw usage("vavio call needs a tool name. Run vavio tools to see them.");
+      exact(2);
+      return { key: "call", run: (ctx) => cmdCall(ctx, second) };
+    default:
+      throw usage(`Unknown command: ${first}. See vavio --help.`);
+  }
+}
+function helpFor(positionals) {
+  const words = positionals[0] === "help" ? positionals.slice(1) : positionals;
+  if (words.length === 0) return mainHelp();
+  const [first, second] = words;
+  const key = first === "instance" ? "instance status" : second && COMMANDS[`${first} ${second}`] ? `${first} ${second}` : first;
+  if (COMMANDS[key]) return commandHelp(key);
+  if (GROUPS[first]) return GROUPS[first].map(commandHelp).join("\n\n");
+  throw usage(`Unknown command: ${first}. See vavio --help.`);
+}
+async function runCli(argv, io = {}) {
+  const stdout = io.stdout ?? process.stdout;
+  const stderr = io.stderr ?? process.stderr;
+  const env = io.env ?? process.env;
+  const redactor = new Redactor();
+  let json = argv.includes("--json");
+  const out = () => new Output({ stdout, stderr }, redactor, json);
+  try {
+    let parsed;
+    try {
+      parsed = parseArgs({ args: [...argv], options: OPTIONS, allowPositionals: true, strict: true });
+    } catch (error) {
+      throw usage(`${error.message.split("\n")[0]} See vavio --help.`);
+    }
+    const flags = parsed.values;
+    json = flags.json === true;
+    const positionals = parsed.positionals;
+    if (flags.version) {
+      if (json) out().value({ name: CLI_NAME, version: CLI_VERSION, contract: CONTRACT_VERSION });
+      else out().out(`${CLI_NAME} ${CLI_VERSION} (contract ${CONTRACT_VERSION})`);
+      return EXIT.ok;
+    }
+    if (flags.help || positionals.length === 0 || positionals[0] === "help") {
+      const text = helpFor(positionals);
+      if (json) out().value({ outcome: "ok", help: text });
+      else out().out(text);
+      return EXIT.ok;
+    }
+    const target = route(positionals);
+    const allowed = /* @__PURE__ */ new Set([...GLOBAL_FLAGS, ...COMMANDS[target.key].flags ?? []]);
+    for (const name of Object.keys(flags)) {
+      if (!allowed.has(name)) throw usage(`--${name} does not apply to vavio ${target.key}. See vavio ${target.key.split(" ")[0]} --help.`);
+    }
+    const url = mcpUrl(flags.url ?? env.VAVIO_URL);
+    const platform = io.platform ?? process.platform;
+    const dir = configDir(env, platform, io.home ?? os.homedir());
+    const ctx = {
+      io: { ...io, stdout, stderr },
+      env,
+      flags,
+      out: out(),
+      redactor,
+      url,
+      key: url.href,
+      dir,
+      config: new ConfigFile(dir),
+      run: io.run ?? spawnRunner,
+      platform,
+      fetch: contractFetch(io.fetch ?? globalThis.fetch, url)
+    };
+    return await target.run(ctx);
+  } catch (error) {
+    const failure = error instanceof CliError ? error : new CliError("failed", `Unexpected error: ${(error instanceof Error ? error.message : String(error)).slice(0, 200)}`);
+    if (json) out().value({ outcome: "error", error: { code: failure.code, text: failure.message }, exit_code: failure.exitCode });
+    else out().err(`vavio: ${failure.message}`);
+    return failure.exitCode;
+  }
+}
+async function main() {
+  return runCli(process.argv.slice(2));
+}
+export {
+  CLI_NAME,
+  CLI_VERSION,
+  CONTRACT_HEADER,
+  CONTRACT_MIN_HEADER,
+  CONTRACT_VERSION,
+  DEFAULT_MCP_URL,
+  ERROR_CODES,
+  EXIT,
+  EXIT_CODE_LINES,
+  REVOKE_TOOL,
+  exitForResult,
+  main,
+  runCli
+};

package/package.json

@@ -1,8 +1,40 @@
 {
   "name": "@vavio/cli",
-  "version": "0.0.0",
-  "description": "The Vavio command line. Coming soon.",
-  "homepage": "https://vavio.ai",
+  "version": "0.1.0",
+  "description": "vavio: operate your Vavio account and Hermes instances from a terminal or your own AI assistant, over Vavio's MCP server.",
   "license": "UNLICENSED",
-  "files": ["README.md"]
+  "homepage": "https://vavio.ai",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Vavio-AI/vavio.git",
+    "directory": "packages/vavio-cli"
+  },
+  "type": "module",
+  "bin": {
+    "vavio": "bin/vavio.mjs"
+  },
+  "exports": {
+    ".": "./dist/vavio.mjs"
+  },
+  "files": [
+    "bin",
+    "dist"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "node build.mjs",
+    "test:clean-install": "node scripts/clean-install.mjs"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/client": "2.4.0"
+  },
+  "devDependencies": {
+    "esbuild": "0.27.4"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": false
+  }
 }

package/README.md

@@ -1,3 +0,0 @@
-# @vavio/cli
-
-The Vavio command line. Coming soon: https://vavio.ai