@whittlelabs/trivet 0.1.8 → 0.1.10

package/bin.js

@@ -59266,18 +59266,6 @@ var require_client2 = __commonJS({
           body: request
         }));
       }
-      /**
-       * Mint a pre-authorised device-code (pairing code) bound to an existing
-       * service identity. The Sift "Pair your Sifter" button calls this and
-       * shows `userCode` to the user.
-       *
-       * Requires `keep:service-identities:write`.
-       */
-      async createDeviceCodePreauth(request) {
-        return answer(await this.api.post("/api/oauth/device-code/preauth", {
-          body: { client_id: request.clientId, boundAgentId: request.boundAgentId, ttlSeconds: request.ttlSeconds }
-        }));
-      }
       // ── Hosted Sifter ───────────────────────────────────────────────
       /**
        * Reveal a person's model-provider key for one hosted dispatch, with the
@@ -67953,6 +67941,10 @@ var require_store = __commonJS({
         await fsp.rename(tmp, this.path);
         await fsp.chmod(this.path, 384);
       }
+      /** Forget the pairing: `revoke` of this machine, whose credential is dead. */
+      async remove() {
+        await fsp.rm(this.path, { force: true });
+      }
     };
     exports2.PairingConfigStore = PairingConfigStore;
   }
@@ -75773,38 +75765,55 @@ var require_pairings = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.listPairings = listPairings;
     exports2.revokePairing = revokePairing;
+    var keep_1 = require_keep();
+    var keep_2 = require_dist4();
+    var version_check_1 = require_version_check();
+    var PAGE_LIMIT = 100;
     async function listPairings(opts) {
-      const fetcher = opts.fetcher ?? globalThis.fetch;
-      const url = `${opts.brand.keepRegistration.keepApiUrl.replace(/\/$/, "")}/api/me/service-identities?client_id=${encodeURIComponent(opts.brand.keepRegistration.oauthClientId)}`;
-      const response = await fetcher(url, {
-        method: "GET",
-        headers: { Authorization: `Bearer ${opts.accessToken}` }
-      });
-      return parseJson(response);
+      const machines = [];
+      for (let offset = 0; ; offset += PAGE_LIMIT) {
+        const { pairings, total } = await ask(opts, (keep) => keep.get("/api/pairings", {
+          query: { limit: PAGE_LIMIT, offset },
+          headers: { Authorization: `Bearer ${opts.accessToken}` }
+        }));
+        machines.push(...pairings);
+        if (pairings.length < PAGE_LIMIT || offset + pairings.length >= total)
+          return machines;
+      }
     }
     async function revokePairing(opts) {
-      const fetcher = opts.fetcher ?? globalThis.fetch;
-      const url = `${opts.brand.keepRegistration.keepApiUrl.replace(/\/$/, "")}/api/service-identities/${encodeURIComponent(opts.identityId)}`;
-      const response = await fetcher(url, {
-        method: "DELETE",
+      await ask(opts, (keep) => keep.delete("/api/pairings/{pairingId}", {
+        path: { pairingId: opts.pairingId },
         headers: { Authorization: `Bearer ${opts.accessToken}` }
-      });
-      if (!response.ok) {
-        throw new Error(`Revoke failed with status ${response.status}`);
-      }
+      }));
     }
-    async function parseJson(response) {
-      let body2;
-      try {
-        body2 = await response.json();
-      } catch {
-        throw new Error(`Keep returned non-JSON (status ${response.status}).`);
-      }
-      if (!response.ok) {
-        const err2 = body2;
-        throw new Error(err2.error?.message ?? `Keep returned status ${response.status}.`);
+    async function ask(opts, send) {
+      const fetcher = opts.fetcher ?? globalThis.fetch;
+      let belowFloor;
+      const transport = async (url, init2) => {
+        const response = await fetcher(url, init2);
+        try {
+          (0, version_check_1.checkResponseMinVersion)({
+            response,
+            productId: opts.brand.product.id,
+            currentVersion: opts.brand.product.version,
+            packageName: opts.brand.product.packageName
+          });
+        } catch (err2) {
+          belowFloor = err2;
+          throw err2;
+        }
+        return response;
+      };
+      const result = await send((0, keep_1.createClient)({ baseUrl: opts.keepApiUrl.replace(/\/$/, ""), transport }));
+      if (belowFloor !== void 0)
+        throw belowFloor;
+      if (result.success)
+        return result.data;
+      if (result.error.status === 401) {
+        throw new keep_2.AgentCredentialRevokedError(`Keep refused this machine's token (401): ${result.error.message}`);
       }
-      return body2.data;
+      throw new Error(result.error.message || `Keep answered ${result.error.status ?? "nothing"}.`);
     }
   }
 });
@@ -75815,42 +75824,75 @@ var require_list = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.buildListCommand = buildListCommand;
+    exports2.mintAgentToken = mintAgentToken;
+    exports2.renderPairings = renderPairings;
     var commander_1 = require_commander();
     var keep_1 = require_dist4();
     var apply_1 = require_apply();
     var store_1 = require_store();
     var pairings_1 = require_pairings();
+    var version_check_1 = require_version_check();
+    var typed_exit_1 = require_typed_exit();
     function buildListCommand(brand) {
-      return new commander_1.Command("list").description(`List paired ${brand.product.title} machines`).option("-p, --profile <name>", 'Config profile whose pairing credentials to use (default "default")').action(async (options) => {
+      return new commander_1.Command("list").description(`List the machines paired to your account as a ${brand.product.title}`).option("-p, --profile <name>", 'Config profile whose pairing credentials to use (default "default")').option("--json", "Print the pairings as JSON and nothing else").action(async (options) => {
         try {
           const paths = (0, apply_1.resolvePaths)(brand, (0, apply_1.resolveProfile)(brand, options.profile));
-          const store = new store_1.PairingConfigStore(paths.configFile);
-          const pairing = store.read();
-          const tokens = new keep_1.ServiceTokenManager({
+          const pairing = new store_1.PairingConfigStore(paths.configFile).read();
+          const machines = await (0, pairings_1.listPairings)({
+            brand,
             keepApiUrl: pairing.keepApiUrl,
-            clientId: pairing.credentials.clientId,
-            clientSecret: pairing.credentials.clientSecret
+            accessToken: await mintAgentToken(pairing, brand)
           });
-          const accessToken = await tokens.getToken();
-          if (!accessToken) {
-            throw new Error("Failed to mint service token from stored credentials.");
-          }
-          const machines = await (0, pairings_1.listPairings)({ brand, accessToken });
-          if (machines.length === 0) {
-            console.log("No paired machines.");
+          if (options.json) {
+            console.log(JSON.stringify(machines, null, 2));
             return;
           }
-          console.log(["id", "name", "hostname", "pairedAt", "lastSeenAt", "active"].join("	"));
-          for (const m of machines) {
-            console.log([m.id, m.name, m.hostname ?? "-", m.pairedAt ?? "-", m.lastSeenAt ?? "-", m.active].join("	"));
-          }
+          for (const line of renderPairings(machines, pairing.serviceIdentity.id))
+            console.log(line);
         } catch (err2) {
+          if ((0, typed_exit_1.isTypedExit)(err2))
+            throw err2;
           const message = err2 instanceof Error ? err2.message : String(err2);
           console.error(`list failed: ${message}`);
           process.exit(1);
         }
       });
     }
+    async function mintAgentToken(pairing, brand) {
+      const token = await new keep_1.AgentTokenManager({
+        keepApiUrl: pairing.keepApiUrl,
+        clientId: pairing.credentials.clientId,
+        clientSecret: pairing.credentials.clientSecret,
+        onResponse: (response) => (0, version_check_1.checkResponseMinVersion)({
+          response,
+          productId: brand.product.id,
+          currentVersion: brand.product.version,
+          packageName: brand.product.packageName
+        })
+      }).getToken();
+      if (!token)
+        throw new Error("This pairing holds no credentials to mint a token with. Run `init` again.");
+      return token;
+    }
+    function renderPairings(machines, self2) {
+      if (machines.length === 0)
+        return ["No paired machines."];
+      const header = ["", "ID", "NAME", "HOST", "PAIRED", "LAST USED"];
+      const rows = machines.map((m) => [
+        m.id === self2 ? "*" : "",
+        m.id,
+        m.displayName,
+        m.hostname ?? "-",
+        m.pairedAt.slice(0, 10),
+        m.lastUsedAt ? m.lastUsedAt.slice(0, 16).replace("T", " ") : "never"
+      ]);
+      const widths = header.map((h, i2) => Math.max(h.length, ...rows.map((r) => r[i2].length)));
+      const line = (cells) => cells.map((cell, i2) => cell.padEnd(widths[i2])).join("  ").trimEnd();
+      const lines = [line(header), ...rows.map(line)];
+      if (machines.some((m) => m.id === self2))
+        lines.push("", "* this machine");
+      return lines;
+    }
   }
 });
 
@@ -75860,43 +75902,51 @@ var require_revoke = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.buildRevokeCommand = buildRevokeCommand;
+    exports2.pickMachine = pickMachine;
     var commander_1 = require_commander();
-    var keep_1 = require_dist4();
     var apply_1 = require_apply();
     var store_1 = require_store();
     var pairings_1 = require_pairings();
+    var list_1 = require_list();
+    var typed_exit_1 = require_typed_exit();
     function buildRevokeCommand(brand) {
-      return new commander_1.Command("revoke").description(`Revoke a paired ${brand.product.title}`).argument("<nameOrId>", "Machine name or service-identity id to revoke").option("-p, --profile <name>", 'Config profile whose pairing credentials to use (default "default")').action(async (nameOrId, options) => {
+      return new commander_1.Command("revoke").description(`Revoke a machine paired to your account as a ${brand.product.title} (this one included)`).argument("<machine>", "The machine to revoke: its id, the start of its id, its name, or its host, as `list` shows them").option("-p, --profile <name>", 'Config profile whose pairing credentials to use (default "default")').action(async (machine, options) => {
         try {
           const paths = (0, apply_1.resolvePaths)(brand, (0, apply_1.resolveProfile)(brand, options.profile));
           const store = new store_1.PairingConfigStore(paths.configFile);
           const pairing = store.read();
-          const tokens = new keep_1.ServiceTokenManager({
-            keepApiUrl: pairing.keepApiUrl,
-            clientId: pairing.credentials.clientId,
-            clientSecret: pairing.credentials.clientSecret
-          });
-          const accessToken = await tokens.getToken();
-          if (!accessToken) {
-            throw new Error("Failed to mint service token from stored credentials.");
-          }
-          const machines = await (0, pairings_1.listPairings)({ brand, accessToken });
-          const target = machines.find((m) => m.id === nameOrId || m.name === nameOrId || m.displayName === nameOrId);
-          if (!target) {
-            throw new Error(`No paired machine matches "${nameOrId}".`);
-          }
+          const api = { brand, keepApiUrl: pairing.keepApiUrl, accessToken: await (0, list_1.mintAgentToken)(pairing, brand) };
+          const target = pickMachine(await (0, pairings_1.listPairings)(api), machine);
+          await (0, pairings_1.revokePairing)({ ...api, pairingId: target.id });
           if (target.id === pairing.serviceIdentity.id) {
-            throw new Error("Refusing to revoke the currently-paired identity. Run `init` on a different machine and revoke from there.");
+            await store.remove();
+            console.log(`Revoked this machine, "${target.displayName}" (${target.id}).`);
+            console.log(`Its pairing is removed from ${paths.configFile}; run \`${brand.product.cliBinary} init\` to pair it again.`);
+            return;
           }
-          await (0, pairings_1.revokePairing)({ brand, accessToken, identityId: target.id });
-          console.log(`Revoked ${target.name} (${target.id}).`);
+          console.log(`Revoked "${target.displayName}" (${target.id}). It can take no more work.`);
         } catch (err2) {
+          if ((0, typed_exit_1.isTypedExit)(err2))
+            throw err2;
           const message = err2 instanceof Error ? err2.message : String(err2);
           console.error(`revoke failed: ${message}`);
           process.exit(1);
         }
       });
     }
+    function pickMachine(machines, query) {
+      const exact = machines.find((m) => m.id === query);
+      if (exact)
+        return exact;
+      const candidates = machines.filter((m) => m.id.startsWith(query) || m.name === query || m.displayName === query || m.hostname === query);
+      if (candidates.length === 1)
+        return candidates[0];
+      if (candidates.length === 0) {
+        throw new Error(`No paired machine matches "${query}". Run \`list\` to see them.`);
+      }
+      const named = candidates.map((m) => `  ${m.id}  ${m.displayName}${m.hostname ? ` (${m.hostname})` : ""}`);
+      throw new Error([`"${query}" matches ${candidates.length} machines; name one by its id:`, ...named].join("\n"));
+    }
   }
 });
 
@@ -76402,7 +76452,7 @@ var import_shuttle2 = __toESM(require_dist8());
 
 // src/brand.ts
 var import_shuttle = __toESM(require_dist8());
-var buildVersion = true ? "0.1.8" : pkg.version;
+var buildVersion = true ? "0.1.10" : pkg.version;
 var EXECUTORS = ["claude-code"];
 var trivetBrand = {
   product: {