@weftlabs/cli 0.25.0

package/dist/cli.js

@@ -0,0 +1,1104 @@
+// src/credentials.ts
+import { randomUUID } from "crypto";
+import {
+  chmod,
+  mkdir,
+  open,
+  readFile,
+  rename,
+  rm,
+  writeFile
+} from "fs/promises";
+import { dirname } from "path";
+import { setTimeout as delay } from "timers/promises";
+var CREDENTIALS_FILE_MODE = 384;
+var CREDENTIALS_DIR_MODE = 448;
+var LOCK_RETRY_MS = 50;
+var LOCK_TIMEOUT_MS = 1e4;
+function isObject(value) {
+  return typeof value === "object" && value !== null;
+}
+function isBootstrapCredentials(value) {
+  if (value.type === "bootstrap" && typeof value.version === "number" && typeof value.base_url === "string" && typeof value.bootstrap_id === "string" && typeof value.temporary_api_key === "string" && typeof value.device_code === "string" && typeof value.client_id === "string" && typeof value.expiry === "string" && typeof value.polling_interval === "number") {
+    return value;
+  }
+  return void 0;
+}
+function isOAuthCredentials(value) {
+  if (value.type === "oauth" && typeof value.version === "number" && typeof value.base_url === "string" && typeof value.client_id === "string" && typeof value.access_token === "string" && typeof value.refresh_token === "string" && typeof value.token_type === "string" && typeof value.scope === "string" && typeof value.expiry === "string") {
+    return value;
+  }
+  return void 0;
+}
+function resolveCredentialsPath(env) {
+  if (env.WEFT_CREDENTIALS_FILE) return env.WEFT_CREDENTIALS_FILE;
+  if (env.XDG_CONFIG_HOME)
+    return `${env.XDG_CONFIG_HOME}/weft/credentials.json`;
+  const home = env.HOME || env.USERPROFILE;
+  if (!home) return void 0;
+  return `${home}/.config/weft/credentials.json`;
+}
+async function readStoredCredentials(env) {
+  const path = resolveCredentialsPath(env);
+  if (!path) return void 0;
+  try {
+    const raw = await readFile(path, "utf8");
+    const parsed = JSON.parse(raw);
+    if (!isObject(parsed)) throw new Error("Stored credentials malformed");
+    return isBootstrapCredentials(parsed) ?? isOAuthCredentials(parsed);
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+}
+async function writeStoredCredentials(env, credentials) {
+  const path = resolveCredentialsPath(env);
+  if (!path) {
+    throw new Error("HOME, USERPROFILE, or WEFT_CREDENTIALS_FILE is required");
+  }
+  const parent = dirname(path);
+  await mkdir(parent, { recursive: true, mode: CREDENTIALS_DIR_MODE });
+  await chmod(parent, CREDENTIALS_DIR_MODE);
+  const tempPath = `${path}.${randomUUID()}.tmp`;
+  try {
+    await writeFile(tempPath, JSON.stringify(credentials), {
+      mode: CREDENTIALS_FILE_MODE
+    });
+    await rename(tempPath, path);
+    await chmod(path, CREDENTIALS_FILE_MODE);
+  } catch (error) {
+    await rm(tempPath, { force: true });
+    throw error;
+  }
+}
+async function withCredentialsLock(env, action) {
+  const path = resolveCredentialsPath(env);
+  if (!path) {
+    throw new Error("HOME, USERPROFILE, or WEFT_CREDENTIALS_FILE is required");
+  }
+  const lockPath = `${path}.lock`;
+  const deadline = Date.now() + LOCK_TIMEOUT_MS;
+  await mkdir(dirname(path), { recursive: true, mode: CREDENTIALS_DIR_MODE });
+  for (; ; ) {
+    try {
+      const lock = await open(lockPath, "wx", CREDENTIALS_FILE_MODE);
+      await lock.close();
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      if (Date.now() >= deadline) {
+        throw new Error(
+          `Timed out waiting for the credential lock; if no Weft CLI process is running, remove ${lockPath}`
+        );
+      }
+      await delay(LOCK_RETRY_MS);
+    }
+  }
+  try {
+    return await action();
+  } finally {
+    await rm(lockPath, { force: true });
+  }
+}
+
+// src/cli.ts
+import { spawn } from "child_process";
+import { randomUUID as randomUUID2 } from "crypto";
+import { existsSync } from "fs";
+import { dirname as dirname2, join as join2 } from "path";
+
+// src/results.ts
+import { chmod as chmod2, lstat, mkdir as mkdir2, mkdtemp, open as open2, realpath } from "fs/promises";
+import { homedir } from "os";
+import { join, resolve } from "path";
+async function reserveResultDirectory(env) {
+  const root = resolve(
+    env.WEFT_RESULTS_DIR || join(env.HOME || env.USERPROFILE || homedir(), ".weft-results")
+  );
+  await mkdir2(root, { recursive: true, mode: 448 });
+  const stat = await lstat(root);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    throw new Error(
+      "The result storage root must be a directory, not a symlink"
+    );
+  }
+  if (process.platform !== "win32" && ((stat.mode & 18) !== 0 || stat.uid !== process.getuid?.())) {
+    throw new Error(
+      "The result storage root must be owned by this user and not writable by others"
+    );
+  }
+  const directory = await mkdtemp(join(await realpath(root), "result-"));
+  await chmod2(directory, 448);
+  return directory;
+}
+async function writeResultFile(path, contents) {
+  const file = await open2(path, "wx", 384);
+  try {
+    await file.chmod(384);
+    await file.writeFile(contents);
+    await file.sync();
+  } finally {
+    await file.close();
+  }
+}
+function readableBody(bytes, headers) {
+  const header = (name) => Object.entries(headers).find(([key]) => key.toLowerCase() === name)?.[1];
+  const contentType = header("content-type")?.toLowerCase() ?? "";
+  const mediaType = contentType.split(";", 1)[0].trim();
+  const charset = /(?:^|;)\s*charset\s*=\s*"?([^;"\s]+)/.exec(contentType)?.[1];
+  const encoding = header("content-encoding")?.trim().toLowerCase();
+  const file = {
+    media_type: mediaType || null,
+    body_encoding: "file"
+  };
+  const textual = mediaType.startsWith("text/") || /^application\/(?:json|xml|javascript|x-ndjson|x-www-form-urlencoded|[^;]+\+(?:json|xml))$/.test(
+    mediaType
+  );
+  if (encoding && encoding !== "identity" || charset && !["utf-8", "utf8", "us-ascii"].includes(charset) || !textual && !(bytes.length === 0 && !mediaType))
+    return file;
+  try {
+    const body = new TextDecoder("utf-8", {
+      fatal: true,
+      ignoreBOM: true
+    }).decode(bytes);
+    return { media_type: mediaType || null, body_encoding: "utf-8", body };
+  } catch {
+    return file;
+  }
+}
+
+// src/cli.ts
+import {
+  ResponseError,
+  WeftClient,
+  WeftError
+} from "@weftlabs/sdk";
+var EXIT_SUCCESS = 0;
+var EXIT_USAGE = 2;
+var EXIT_AUTH = 3;
+var EXIT_API = 4;
+var EXIT_INTERNAL = 5;
+var COMMANDS = [
+  "bootstrap",
+  "auth",
+  "skill",
+  "me",
+  "balance",
+  "search",
+  "fetch",
+  "purchases"
+];
+var WEFT_API_BASE = "https://weft.network";
+var OAUTH_SCOPE = "balance fetch search";
+var OAUTH_CLIENT_NAME = "Weft CLI";
+var OAUTH_HOST_NAME = "Weft CLI";
+var OAUTH_REFRESH_SKEW_MS = 6e4;
+var PROCESS_OUTPUT_LIMIT = 8192;
+var SKILL_NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var CORE_SKILL_NAMES = /* @__PURE__ */ new Set(["weft", "weft-setup"]);
+var COMMAND_HELP = {
+  bootstrap: {
+    description: "Bootstrap an agent account",
+    usage: "weft bootstrap --email <email> --agent-name <name> --reason <text>",
+    options: [
+      "--email <email>",
+      "--agent-name <name>",
+      "--reason <text>",
+      "[--base-url <url>]"
+    ]
+  },
+  auth: {
+    description: "Check bootstrap status and exchange device token",
+    usage: "weft auth status",
+    options: ["status"]
+  },
+  skill: {
+    description: "Install the core Weft Skill or one optional workflow Skill",
+    usage: "weft skill install [name --agent <agent> [--global]]",
+    options: ["install", "[name]", "--agent <agent>", "--global"]
+  },
+  me: {
+    description: "Return the authenticated principal",
+    usage: "weft me",
+    options: []
+  },
+  balance: {
+    description: "Return wallet balance and spending policy",
+    usage: "weft balance",
+    options: []
+  },
+  search: {
+    description: "Search for payable resources",
+    usage: "weft search <query> [--max-results <1..50>]",
+    options: ["--max-results <1..50>"]
+  },
+  fetch: {
+    description: "Fetch a URL within an explicit spending limit",
+    usage: "weft fetch <url> --max-cost-usd <amount> [--method <method>] [--idempotency-key <key>] [--raw]",
+    options: [
+      "--max-cost-usd <amount>",
+      "--method <method>",
+      "--idempotency-key <key>",
+      "--raw"
+    ]
+  },
+  purchases: {
+    description: "List purchases or return one purchase by ID",
+    usage: "weft purchases [id] [--page <number>] [--per-page <1..100>]",
+    options: ["--page <number>", "--per-page <1..100>"]
+  }
+};
+async function loadSkillInstaller() {
+  const specifier = new URL("../scripts/install-skill.mjs", import.meta.url).href;
+  const module = await import(specifier);
+  return module.installSkill;
+}
+async function installSkillInBackground() {
+  try {
+    const installSkill = await loadSkillInstaller();
+    await installSkill({ silent: true });
+  } catch {
+  }
+}
+var GLOBAL_OPTIONS = ["--api-key-stdin", "--base-url <url>", "--help", "-h"];
+var CliError = class extends Error {
+  constructor(exitCode, code, message, details) {
+    super(message);
+    this.exitCode = exitCode;
+    this.code = code;
+    this.details = details;
+  }
+};
+function takeValue(args, index, option) {
+  const value = args[index + 1];
+  if (value == null || value.startsWith("--")) {
+    throw new CliError(
+      EXIT_USAGE,
+      "INVALID_ARGUMENT",
+      `${option} requires a value`
+    );
+  }
+  return [value, index + 1];
+}
+function appendBounded(current, chunk) {
+  return `${current}${chunk.toString()}`.slice(-PROCESS_OUTPUT_LIMIT);
+}
+function defaultRunProcess(command, args) {
+  return new Promise((resolve2) => {
+    const child = spawn(command, args, {
+      shell: false,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (chunk) => {
+      stdout = appendBounded(stdout, chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr = appendBounded(stderr, chunk);
+    });
+    child.on("error", (error) => {
+      resolve2({
+        exitCode: 1,
+        stdout,
+        stderr: appendBounded(stderr, error.message)
+      });
+    });
+    child.on("close", (exitCode) => {
+      resolve2({ exitCode: exitCode ?? 1, stdout, stderr });
+    });
+  });
+}
+function resolveNpxCliPath(env, nodeExecutable) {
+  const executableDirectory = dirname2(nodeExecutable);
+  const candidates = [
+    ...env.npm_execpath ? [join2(dirname2(env.npm_execpath), "npx-cli.js")] : [],
+    join2(executableDirectory, "node_modules", "npm", "bin", "npx-cli.js"),
+    join2(
+      executableDirectory,
+      "..",
+      "lib",
+      "node_modules",
+      "npm",
+      "bin",
+      "npx-cli.js"
+    )
+  ];
+  return candidates.find((candidate) => existsSync(candidate));
+}
+function npxProcessInvocation(processArgs, dependencies, env) {
+  if ((dependencies.platform ?? process.platform) !== "win32") {
+    return { executable: "npx", arguments: processArgs };
+  }
+  const nodeExecutable = dependencies.nodeExecutable ?? process.execPath;
+  const npxCliPath = dependencies.npxCliPath ?? resolveNpxCliPath(env, nodeExecutable);
+  if (!npxCliPath) {
+    throw new CliError(
+      EXIT_INTERNAL,
+      "NPX_NOT_FOUND",
+      "Could not find the npm npx program. Install npm, then run the command again."
+    );
+  }
+  return {
+    executable: nodeExecutable,
+    arguments: [npxCliPath, ...processArgs]
+  };
+}
+function rejectUnsafeCredentialArgument(args) {
+  if (args.some((arg) => arg === "--api-key" || arg.startsWith("--api-key="))) {
+    throw new CliError(
+      EXIT_USAGE,
+      "UNSAFE_CREDENTIAL_ARGUMENT",
+      "API keys are accepted only through WEFT_API_KEY or --api-key-stdin"
+    );
+  }
+}
+function requestedHelp(args) {
+  const isHelp = (value) => value === "--help" || value === "-h";
+  if (args.length === 1 && isHelp(args[0])) return "all";
+  if (args.length === 2 && COMMANDS.includes(args[0]) && isHelp(args[1])) {
+    return args[0];
+  }
+  return void 0;
+}
+function helpData(command) {
+  if (command !== "all") {
+    return {
+      command,
+      ...COMMAND_HELP[command],
+      global_options: GLOBAL_OPTIONS
+    };
+  }
+  return {
+    usage: "weft <command> [options]",
+    commands: COMMANDS.map((name) => ({ name, ...COMMAND_HELP[name] })),
+    global_options: GLOBAL_OPTIONS,
+    authentication: ["WEFT_API_KEY", "--api-key-stdin"],
+    exit_codes: { success: 0, usage: 2, auth: 3, api: 4, internal: 5 }
+  };
+}
+function parseArgs(args) {
+  let command;
+  let apiKeyStdin = false;
+  let baseUrl;
+  const positionals = [];
+  const options = /* @__PURE__ */ new Map();
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === "--api-key-stdin") {
+      apiKeyStdin = true;
+    } else if (arg === "--base-url") {
+      [baseUrl, index] = takeValue(args, index, arg);
+    } else if (arg === "--global" || arg === "--raw") {
+      options.set(arg.slice(2), true);
+    } else if (arg.startsWith("--")) {
+      const [value, nextIndex] = takeValue(args, index, arg);
+      options.set(arg.slice(2), value);
+      index = nextIndex;
+    } else if (!command) {
+      if (!COMMANDS.includes(arg)) {
+        throw new CliError(
+          EXIT_USAGE,
+          "UNKNOWN_COMMAND",
+          `Unknown command: ${arg}`
+        );
+      }
+      command = arg;
+    } else {
+      positionals.push(arg);
+    }
+  }
+  if (!command) {
+    throw new CliError(
+      EXIT_USAGE,
+      "COMMAND_REQUIRED",
+      "Command required: bootstrap, auth, me, balance, search, fetch, or purchases"
+    );
+  }
+  return { command, apiKeyStdin, baseUrl, positionals, options };
+}
+function positiveInteger(value, option, maximum) {
+  if (value == null) return void 0;
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new CliError(
+      EXIT_USAGE,
+      "INVALID_ARGUMENT",
+      `${option} must be a positive integer`
+    );
+  }
+  if (maximum != null && parsed > maximum) {
+    throw new CliError(
+      EXIT_USAGE,
+      "INVALID_ARGUMENT",
+      `${option} must be at most ${maximum}`
+    );
+  }
+  return parsed;
+}
+function requiredOption(options, name) {
+  const value = options.get(name);
+  if (typeof value !== "string" || !value.trim()) {
+    throw new CliError(EXIT_USAGE, "MISSING_ARGUMENT", `--${name} is required`);
+  }
+  return value;
+}
+function baseApiUrl(baseUrl, env) {
+  const raw = baseUrl ?? env.WEFT_BASE_URL ?? WEFT_API_BASE;
+  return raw.endsWith("/") ? raw.slice(0, -1) : raw;
+}
+function resolveApiKeyFromStored(credentials) {
+  if (!credentials) return void 0;
+  if (credentials.type === "oauth" && credentials.access_token.trim()) {
+    return credentials.access_token;
+  }
+  if (credentials.type === "bootstrap" && credentials.temporary_api_key.trim()) {
+    return credentials.temporary_api_key;
+  }
+  return void 0;
+}
+function oauthNeedsRefresh(credentials) {
+  const expiry = Date.parse(credentials.expiry);
+  return !Number.isFinite(expiry) || expiry <= Date.now() + OAUTH_REFRESH_SKEW_MS;
+}
+async function refreshOAuthCredentials(fetchApi, env, stored) {
+  const token = await requestJson(
+    fetchApi,
+    `${stored.base_url}/oauth/token`,
+    {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: stored.refresh_token,
+        client_id: stored.client_id
+      }).toString()
+    },
+    true
+  );
+  const refreshed = {
+    ...stored,
+    access_token: token.access_token,
+    refresh_token: token.refresh_token,
+    token_type: token.token_type,
+    scope: token.scope,
+    expiry: new Date(Date.now() + token.expires_in * 1e3).toISOString()
+  };
+  await writeStoredCredentials(env, refreshed);
+  return refreshed;
+}
+function noSecretFields(data) {
+  return {
+    ...data,
+    temporary_api_key: void 0,
+    device_code: void 0,
+    access_token: void 0,
+    refresh_token: void 0,
+    client_secret: void 0
+  };
+}
+async function requestJson(fetchApi, url, init, redactError = false) {
+  const response = await fetchApi(url, init);
+  if (!response.ok) {
+    if (redactError) {
+      throw new CliError(
+        response.status === 401 || response.status === 403 ? EXIT_AUTH : response.status >= 500 ? EXIT_INTERNAL : EXIT_API,
+        "OAUTH_TOKEN_ERROR",
+        `OAuth token request failed with HTTP ${response.status}`
+      );
+    }
+    throw new ResponseError(response);
+  }
+  return await response.json();
+}
+function withCredentials(headers, apiKey) {
+  return {
+    ...headers,
+    authorization: `Bearer ${apiKey}`
+  };
+}
+function ensureOnly(options, allowed) {
+  for (const name of options.keys()) {
+    if (!allowed.includes(name)) {
+      throw new CliError(
+        EXIT_USAGE,
+        "UNKNOWN_OPTION",
+        `Unknown option: --${name}`
+      );
+    }
+  }
+}
+async function responseDetails(error) {
+  try {
+    return await error.response.json();
+  } catch {
+    return void 0;
+  }
+}
+async function normalizeError(error) {
+  if (error instanceof CliError) return error;
+  if (error instanceof WeftError) {
+    const exitCode = error.status === 401 || error.status === 403 ? EXIT_AUTH : error.status >= 500 || error.status === 0 ? EXIT_INTERNAL : EXIT_API;
+    return new CliError(exitCode, error.code, error.message, error.details);
+  }
+  if (error instanceof ResponseError) {
+    const details = await responseDetails(error);
+    const body = details;
+    const nested = typeof body?.error === "object" ? body.error : void 0;
+    const code = nested?.code ?? (typeof body?.error === "string" ? body.error : `HTTP_${error.response.status}`);
+    const message2 = nested?.message ?? body?.error_description ?? `Weft API returned HTTP ${error.response.status}`;
+    const exitCode = error.response.status === 401 || error.response.status === 403 ? EXIT_AUTH : error.response.status >= 500 ? EXIT_INTERNAL : EXIT_API;
+    return new CliError(exitCode, code, message2, details);
+  }
+  const message = error instanceof Error ? error.message : String(error);
+  return new CliError(EXIT_INTERNAL, "INTERNAL_ERROR", message);
+}
+async function defaultReadStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+async function defaultWriteOut(value) {
+  await new Promise((resolve2, reject) => {
+    const onError = (error) => reject(error);
+    process.stdout.once("error", onError);
+    process.stdout.write(value, (error) => {
+      if (error) {
+        reject(error);
+      } else {
+        process.stdout.removeListener("error", onError);
+        resolve2();
+      }
+    });
+  });
+}
+async function runCli(args, dependencies = {}) {
+  const outputWriter = dependencies.writeOut ?? defaultWriteOut;
+  const writeErr = dependencies.writeErr ?? ((value) => process.stderr.write(value));
+  let command = "unknown";
+  let idempotencyKey;
+  let schemaVersion = "1";
+  let meta;
+  let deliveryReceipt;
+  const fetchApi = dependencies.fetchApi ?? fetch;
+  const writeOut = async (value) => {
+    try {
+      await outputWriter(value);
+    } catch {
+      throw new CliError(
+        EXIT_INTERNAL,
+        command === "fetch" ? "RESULT_OUTPUT_FAILED" : "OUTPUT_FAILED",
+        "Cannot write stdout. Use the saved result paths below if present. Otherwise keep this receipt and retry the same fetch with --idempotency-key and the same key.",
+        deliveryReceipt === void 0 ? void 0 : { receipt: deliveryReceipt }
+      );
+    }
+  };
+  try {
+    rejectUnsafeCredentialArgument(args);
+    const help = requestedHelp(args);
+    if (help !== void 0) {
+      command = "help";
+      await writeOut(
+        `${JSON.stringify({
+          schema_version: "1",
+          ok: true,
+          command,
+          data: helpData(help)
+        })}
+`
+      );
+      return EXIT_SUCCESS;
+    }
+    const parsed = parseArgs(args);
+    command = parsed.command;
+    const env = dependencies.env ?? process.env;
+    const baseUrl = baseApiUrl(parsed.baseUrl, env);
+    if (parsed.command === "skill") {
+      if (parsed.positionals[0] !== "install" || parsed.positionals.length > 2) {
+        throw new CliError(
+          EXIT_USAGE,
+          "INVALID_ARGUMENT",
+          "skill requires 'install' and accepts at most one Skill name"
+        );
+      }
+      const skillName = parsed.positionals[1];
+      if (skillName) {
+        ensureOnly(parsed.options, ["agent", "global"]);
+        const agent = requiredOption(parsed.options, "agent");
+        if (!SKILL_NAME_PATTERN.test(skillName)) {
+          throw new CliError(
+            EXIT_USAGE,
+            "INVALID_ARGUMENT",
+            "Skill name must contain only lowercase letters, numbers, and single hyphens"
+          );
+        }
+        if (CORE_SKILL_NAMES.has(skillName)) {
+          throw new CliError(
+            EXIT_USAGE,
+            "INVALID_ARGUMENT",
+            `Use 'weft skill install' without a name to install the core ${skillName} Skill`
+          );
+        }
+        if (!SKILL_NAME_PATTERN.test(agent)) {
+          throw new CliError(
+            EXIT_USAGE,
+            "INVALID_ARGUMENT",
+            "Agent name must contain only lowercase letters, numbers, and single hyphens"
+          );
+        }
+        const processArgs = [
+          "--yes",
+          "skills",
+          "add",
+          "weftlabs/skills",
+          "--skill",
+          skillName,
+          "--agent",
+          agent,
+          "--yes",
+          ...parsed.options.get("global") === true ? ["--global"] : []
+        ];
+        const invocation = npxProcessInvocation(processArgs, dependencies, env);
+        const result2 = await (dependencies.runProcess ?? defaultRunProcess)(
+          invocation.executable,
+          invocation.arguments
+        );
+        if (result2.exitCode !== 0) {
+          const remediation = `npx ${processArgs.join(" ")}`;
+          throw new CliError(
+            EXIT_INTERNAL,
+            "SKILL_INSTALL_FAILED",
+            `Could not install ${skillName}. Run '${remediation}' directly for more detail.`,
+            {
+              executable: invocation.executable,
+              arguments: invocation.arguments,
+              exit_code: result2.exitCode,
+              stderr: result2.stderr
+            }
+          );
+        }
+        await writeOut(
+          `${JSON.stringify({
+            schema_version: "1",
+            ok: true,
+            command,
+            data: {
+              status: "installed",
+              skill: skillName,
+              agent,
+              scope: parsed.options.get("global") === true ? "global" : "project"
+            }
+          })}
+`
+        );
+        return EXIT_SUCCESS;
+      }
+      ensureOnly(parsed.options, []);
+      const installSkill = await loadSkillInstaller();
+      const result = await installSkill({ force: true });
+      await writeOut(
+        `${JSON.stringify({
+          schema_version: "1",
+          ok: true,
+          command,
+          data: {
+            status: result.status,
+            installed: result.installed,
+            hosts: result.hosts,
+            ...result.reason === void 0 ? {} : { reason: result.reason },
+            ...result.warnings.length === 0 ? {} : { warnings: result.warnings }
+          }
+        })}
+`
+      );
+      return EXIT_SUCCESS;
+    }
+    await installSkillInBackground();
+    if (parsed.command === "bootstrap") {
+      ensureOnly(parsed.options, ["email", "agent-name", "reason"]);
+      if (parsed.positionals.length !== 0) {
+        throw new CliError(
+          EXIT_USAGE,
+          "INVALID_ARGUMENT",
+          "bootstrap does not accept positional arguments"
+        );
+      }
+      const email = requiredOption(parsed.options, "email");
+      const agentName = requiredOption(parsed.options, "agent-name");
+      const reason = requiredOption(parsed.options, "reason");
+      const register = await requestJson(
+        fetchApi,
+        `${baseUrl}/oauth/register`,
+        {
+          method: "POST",
+          headers: {
+            "content-type": "application/json"
+          },
+          body: JSON.stringify({
+            client_name: OAUTH_CLIENT_NAME,
+            redirect_uris: ["http://localhost/callback"],
+            grant_types: [
+              "urn:ietf:params:oauth:grant-type:device_code",
+              "refresh_token"
+            ],
+            token_endpoint_auth_method: "none",
+            scope: OAUTH_SCOPE
+          })
+        }
+      );
+      const clientId = register.client_id;
+      const bootstrap = await requestJson(
+        fetchApi,
+        `${baseUrl}/api/v1/account_bootstraps`,
+        {
+          method: "POST",
+          headers: {
+            "content-type": "application/json"
+          },
+          body: JSON.stringify({
+            email,
+            agent_name: agentName,
+            host_name: OAUTH_HOST_NAME,
+            reason,
+            oauth_client_id: clientId,
+            requested_scopes: ["balance", "fetch", "search"]
+          })
+        }
+      );
+      const stored = {
+        version: 1,
+        type: "bootstrap",
+        base_url: baseUrl,
+        bootstrap_id: bootstrap.data.id,
+        temporary_api_key: bootstrap.data.temporary_api_key,
+        device_code: bootstrap.data.device_code,
+        client_id: clientId,
+        expiry: bootstrap.data.expires_at,
+        polling_interval: bootstrap.data.approval.interval
+      };
+      await writeStoredCredentials(env, stored);
+      await writeOut(
+        `${JSON.stringify({
+          schema_version: "1",
+          ok: true,
+          command,
+          data: noSecretFields({
+            ...bootstrap.data,
+            client_id: clientId,
+            base_url: baseUrl,
+            polling_interval: bootstrap.data.approval.interval
+          })
+        })}
+`
+      );
+      return EXIT_SUCCESS;
+    }
+    if (parsed.command === "auth") {
+      ensureOnly(parsed.options, []);
+      if (parsed.positionals.length !== 1 || parsed.positionals[0] !== "status") {
+        throw new CliError(
+          EXIT_USAGE,
+          "INVALID_ARGUMENT",
+          "auth requires 'status'"
+        );
+      }
+      const stored = await readStoredCredentials(env);
+      if (stored?.type === "oauth") {
+        await writeOut(
+          `${JSON.stringify({
+            schema_version: "1",
+            ok: true,
+            command,
+            data: {
+              status: "consumed",
+              authentication: "oauth",
+              scope: stored.scope
+            }
+          })}
+`
+        );
+        return EXIT_SUCCESS;
+      }
+      if (!stored) {
+        throw new CliError(
+          EXIT_AUTH,
+          "BOOTSTRAP_REQUIRED",
+          "Run weft bootstrap before auth status"
+        );
+      }
+      const statusBaseUrl = stored.base_url;
+      const status = await requestJson(
+        fetchApi,
+        `${statusBaseUrl}/api/v1/account_bootstraps/${stored.bootstrap_id}`,
+        {
+          method: "GET",
+          headers: withCredentials({}, stored.temporary_api_key)
+        }
+      );
+      const statusValue = status.data.status;
+      if (statusValue !== "claimed" && statusValue !== "consumed") {
+        await writeOut(
+          `${JSON.stringify({
+            schema_version: "1",
+            ok: true,
+            command,
+            data: { status: statusValue }
+          })}
+`
+        );
+        return EXIT_SUCCESS;
+      }
+      const token = await requestJson(
+        fetchApi,
+        `${statusBaseUrl}/oauth/token`,
+        {
+          method: "POST",
+          headers: {
+            "content-type": "application/x-www-form-urlencoded"
+          },
+          body: new URLSearchParams({
+            grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+            device_code: stored.device_code,
+            client_id: stored.client_id,
+            name: OAUTH_CLIENT_NAME
+          }).toString()
+        },
+        true
+      );
+      const oauth = {
+        version: 1,
+        type: "oauth",
+        base_url: statusBaseUrl,
+        client_id: stored.client_id,
+        access_token: token.access_token,
+        refresh_token: token.refresh_token,
+        token_type: token.token_type,
+        scope: token.scope,
+        expiry: new Date(Date.now() + token.expires_in * 1e3).toISOString()
+      };
+      await writeStoredCredentials(env, oauth);
+      await writeOut(
+        `${JSON.stringify({
+          schema_version: "1",
+          ok: true,
+          command,
+          data: {
+            status: "consumed",
+            authentication: "oauth",
+            scope: token.scope
+          }
+        })}
+`
+      );
+      return EXIT_SUCCESS;
+    }
+    const rawKey = parsed.apiKeyStdin ? await (dependencies.readStdin ?? defaultReadStdin)() : env.WEFT_API_KEY;
+    let apiKey = rawKey?.trim();
+    let authenticatedBaseUrl = baseUrl;
+    if (parsed.apiKeyStdin && !apiKey) {
+      throw new CliError(
+        EXIT_AUTH,
+        "API_KEY_REQUIRED",
+        "--api-key-stdin requires a non-empty API key"
+      );
+    }
+    if (!apiKey && !parsed.apiKeyStdin) {
+      let stored = await readStoredCredentials(env);
+      if (stored?.type === "oauth" && oauthNeedsRefresh(stored)) {
+        stored = await withCredentialsLock(env, async () => {
+          const current = await readStoredCredentials(env);
+          if (current?.type === "oauth" && oauthNeedsRefresh(current)) {
+            return refreshOAuthCredentials(fetchApi, env, current);
+          }
+          return current;
+        });
+      }
+      apiKey = resolveApiKeyFromStored(stored);
+      if (stored) authenticatedBaseUrl = stored.base_url;
+    }
+    if (!apiKey) {
+      throw new CliError(
+        EXIT_AUTH,
+        "API_KEY_REQUIRED",
+        "Set WEFT_API_KEY, pass --api-key-stdin, or store credentials"
+      );
+    }
+    const client = new WeftClient({
+      apiKey,
+      baseUrl: authenticatedBaseUrl,
+      fetchApi
+    });
+    let data;
+    if (parsed.command === "me") {
+      ensureOnly(parsed.options, []);
+      data = await client.me();
+    } else if (parsed.command === "balance") {
+      ensureOnly(parsed.options, []);
+      data = await client.balance();
+    } else if (parsed.command === "search") {
+      ensureOnly(parsed.options, ["max-results"]);
+      if (parsed.positionals.length !== 1) {
+        throw new CliError(
+          EXIT_USAGE,
+          "INVALID_ARGUMENT",
+          "search requires exactly one query"
+        );
+      }
+      data = await client.search({
+        query: parsed.positionals[0],
+        maxResults: positiveInteger(
+          parsed.options.get("max-results"),
+          "--max-results",
+          50
+        )
+      });
+    } else if (parsed.command === "fetch") {
+      ensureOnly(parsed.options, [
+        "max-cost-usd",
+        "method",
+        "idempotency-key",
+        "raw"
+      ]);
+      const raw = parsed.options.has("raw");
+      schemaVersion = raw ? "1" : "2";
+      if (parsed.positionals.length !== 1) {
+        throw new CliError(
+          EXIT_USAGE,
+          "INVALID_ARGUMENT",
+          "fetch requires exactly one URL"
+        );
+      }
+      const maxCostUsd = requiredOption(parsed.options, "max-cost-usd");
+      if (!/^\d+(?:\.\d+)?$/.test(maxCostUsd) || Number(maxCostUsd) <= 0) {
+        throw new CliError(
+          EXIT_USAGE,
+          "INVALID_ARGUMENT",
+          "--max-cost-usd must be a positive decimal"
+        );
+      }
+      const method = parsed.options.get("method");
+      const request = {
+        url: parsed.positionals[0],
+        maxCostUsd,
+        method: typeof method === "string" ? method.toUpperCase() : void 0
+      };
+      const explicitKey = parsed.options.get("idempotency-key");
+      idempotencyKey = typeof explicitKey === "string" ? explicitKey : (dependencies.generateIdempotencyKey ?? randomUUID2)();
+      let resultDirectory;
+      if (!raw) {
+        try {
+          resultDirectory = await reserveResultDirectory(env);
+        } catch {
+          throw new CliError(
+            EXIT_INTERNAL,
+            "RESULT_STORAGE_UNAVAILABLE",
+            "Cannot reserve local result storage. Set WEFT_RESULTS_DIR to a directory you own that is writable only by you, with no symlink at that path, then retry. No fetch was sent."
+          );
+        }
+      }
+      const response = await client.fetch(request, { idempotencyKey });
+      meta = { idempotency_key: idempotencyKey };
+      data = response;
+      const { bodyBase64, ...receipt } = response;
+      deliveryReceipt = receipt;
+      if (resultDirectory) {
+        const savedPath = join2(resultDirectory, "body");
+        const receiptPath = join2(resultDirectory, "receipt.json");
+        const bytes = typeof bodyBase64 === "string" ? Buffer.from(bodyBase64, "base64") : void 0;
+        if (!bytes || bytes.toString("base64") !== bodyBase64) {
+          throw new CliError(
+            EXIT_INTERNAL,
+            "RESULT_DECODE_FAILED",
+            "Fetch returned invalid Base64. No body was saved. Keep this receipt and retry the same request with --idempotency-key and the same key; if it persists, report the artifact ID to support.",
+            { receipt, file_complete: false }
+          );
+        }
+        try {
+          meta = {
+            ...meta,
+            saved_path: savedPath,
+            receipt_path: receiptPath,
+            byte_count: bytes.length
+          };
+          await writeResultFile(
+            receiptPath,
+            `${JSON.stringify({ schema_version: "2", meta, data: receipt })}
+`
+          );
+          await writeResultFile(savedPath, bytes);
+          data = { ...receipt, ...readableBody(bytes, response.headers) };
+        } catch {
+          throw new CliError(
+            EXIT_INTERNAL,
+            "RESULT_STORAGE_FAILED",
+            "Fetch returned, but local result delivery failed. Keep this receipt. Check local storage, then retry the same request with --idempotency-key and the key below. Do not use a new key.",
+            {
+              receipt,
+              saved_path: savedPath,
+              receipt_path: receiptPath,
+              file_complete: false
+            }
+          );
+        }
+      }
+    } else {
+      ensureOnly(parsed.options, ["page", "per-page"]);
+      if (parsed.positionals.length > 1) {
+        throw new CliError(
+          EXIT_USAGE,
+          "INVALID_ARGUMENT",
+          "purchases accepts at most one purchase ID"
+        );
+      }
+      data = parsed.positionals[0] ? await client.purchase(
+        positiveInteger(parsed.positionals[0], "purchase ID")
+      ) : await client.purchases({
+        page: positiveInteger(parsed.options.get("page"), "--page"),
+        perPage: positiveInteger(
+          parsed.options.get("per-page"),
+          "--per-page",
+          100
+        )
+      });
+    }
+    await writeOut(
+      `${JSON.stringify({
+        schema_version: schemaVersion,
+        ok: true,
+        command,
+        ...meta === void 0 ? {} : { meta },
+        data
+      })}
+`
+    );
+    return EXIT_SUCCESS;
+  } catch (error) {
+    const normalized = await normalizeError(error);
+    writeErr(
+      `${JSON.stringify({
+        schema_version: schemaVersion,
+        ok: false,
+        command,
+        ...idempotencyKey === void 0 ? {} : { meta: { ...meta, idempotency_key: idempotencyKey } },
+        error: {
+          code: normalized.code,
+          message: normalized.message,
+          ...normalized.details === void 0 ? {} : { details: normalized.details }
+        }
+      })}
+`
+    );
+    return normalized.exitCode;
+  }
+}
+export {
+  EXIT_API,
+  EXIT_AUTH,
+  EXIT_INTERNAL,
+  EXIT_SUCCESS,
+  EXIT_USAGE,
+  runCli
+};
+//# sourceMappingURL=cli.js.map