dexto 1.14.4 → 2.0.0-beta.0

package/dist/cli/auth/oauth.js

@@ -1,434 +0,0 @@
-// packages/cli/src/cli/auth/oauth.ts
-// OAuth flow implementation with local callback server
-//
-// TODO: Add CSRF protection via Device Code Flow (RFC 8628)
-// Current localhost callback pattern lacks CSRF protection. We attempted to add
-// a `state` parameter but Supabase uses `state` internally for its own OAuth CSRF
-// with Google, causing conflicts. The proper solution is Device Code Flow:
-// 1. CLI requests device code from server
-// 2. User visits URL and enters code
-// 3. CLI polls for authorization completion
-// This is what Supabase CLI, GitHub CLI, and others use for secure CLI auth.
-import * as http from 'http';
-import * as url from 'url';
-import * as querystring from 'querystring';
-import chalk from 'chalk';
-import * as p from '@clack/prompts';
-import { logger } from '@dexto/core';
-import { getDextoPackageRoot } from '@dexto/agent-management';
-import { existsSync, readFileSync } from 'node:fs';
-import path from 'node:path';
-import { SUPABASE_URL, SUPABASE_ANON_KEY } from './constants.js';
-// Track active OAuth callback servers by port for cleanup
-const oauthStateStore = new Map();
-function resolveLogoPath() {
-    const packageRoot = getDextoPackageRoot();
-    if (packageRoot) {
-        const standaloneAssetPath = path.join(packageRoot, 'dist', 'cli', 'assets', 'dexto-logo.svg');
-        if (existsSync(standaloneAssetPath)) {
-            return standaloneAssetPath;
-        }
-    }
-    try {
-        const localAssetPath = new URL('../assets/dexto-logo.svg', import.meta.url);
-        const resolvedPath = url.fileURLToPath(localAssetPath);
-        if (existsSync(resolvedPath)) {
-            return resolvedPath;
-        }
-    }
-    catch {
-        // Ignore URL/path errors and return null.
-    }
-    return null;
-}
-const DEXTO_LOGO_DATA_URL = (() => {
-    try {
-        const logoPath = resolveLogoPath();
-        if (!logoPath) {
-            return '';
-        }
-        const svg = readFileSync(logoPath, 'utf-8');
-        return `data:image/svg+xml;base64,${Buffer.from(svg).toString('base64')}`;
-    }
-    catch (error) {
-        logger.debug(`Failed to load Dexto logo asset for OAuth screen: ${error instanceof Error ? error.message : String(error)}`);
-        return '';
-    }
-})();
-const LOGO_FALLBACK_TEXT = DEXTO_LOGO_DATA_URL ? '' : 'D';
-const LOGO_HTML = `<div class="logo">${LOGO_FALLBACK_TEXT}</div>`;
-// Pre-generate HTML strings with logo
-const ERROR_HTML = `${LOGO_HTML}<div class="error-icon">✕</div><h1 class="error-title">Authentication Failed</h1><p>You can close this window and try again in your terminal.</p>`;
-const SUCCESS_HTML = `${LOGO_HTML}<div class="success-icon">✓</div><h1 class="success-title">Login Successful!</h1><p>Welcome to Dexto! You can close this window and return to your terminal.</p>`;
-const NO_DATA_HTML = `${LOGO_HTML}<div class="error-icon">✕</div><h1 class="error-title">No Authentication Data</h1><p>Please try the login process again in your terminal.</p>`;
-// Fixed port for OAuth callback - must match Supabase redirect URL config
-const OAUTH_CALLBACK_PORT = 48102;
-/**
- * Check if fixed port is available, throw if not
- */
-function ensurePortAvailable(port) {
-    return new Promise((resolve, reject) => {
-        const server = http.createServer();
-        server.listen(port, () => {
-            server.close(() => resolve(port));
-        });
-        server.on('error', (err) => {
-            if (err.code === 'EADDRINUSE') {
-                reject(new Error(`Port ${port} is already in use. Please close the application using it and try again.`));
-            }
-            else {
-                reject(err);
-            }
-        });
-    });
-}
-function resolveCallbackServerOptions(options) {
-    return {
-        timeoutMs: options.timeoutMs ?? 5 * 60 * 1000,
-        signal: options.signal ?? null,
-    };
-}
-/**
- * Start local HTTP server to receive OAuth callback
- */
-function startCallbackServer(port, config, options) {
-    return new Promise((resolve, reject) => {
-        let settled = false;
-        const timeoutMs = options.timeoutMs;
-        let timeoutHandle = null;
-        let abortHandler = () => { };
-        const safeCloseServer = (server) => {
-            try {
-                if (server.listening) {
-                    server.close();
-                }
-            }
-            catch (_error) {
-                // ignore
-            }
-        };
-        const cleanup = () => {
-            if (timeoutHandle) {
-                clearTimeout(timeoutHandle);
-            }
-            oauthStateStore.delete(port);
-            options.signal?.removeEventListener('abort', abortHandler);
-        };
-        const safeResolve = (result) => {
-            if (settled)
-                return;
-            settled = true;
-            cleanup();
-            resolve(result);
-        };
-        const safeReject = (error) => {
-            if (settled)
-                return;
-            settled = true;
-            cleanup();
-            reject(error);
-        };
-        const server = http.createServer(async (req, res) => {
-            try {
-                if (!req.url) {
-                    res.writeHead(400);
-                    res.end('Bad Request');
-                    return;
-                }
-                const parsedUrl = url.parse(req.url, true);
-                if (req.method === 'GET') {
-                    res.writeHead(200, { 'Content-Type': 'text/html' });
-                    res.end(`
-                        <html>
-                        <head>
-                            <meta charset="utf-8" />
-                            <title>Dexto Authentication</title>
-                            <meta name="viewport" content="width=device-width, initial-scale=1.0">
-                            <link href="https://fonts.googleapis.com/css2?family=Geist:wght@400;500;600;700&display=swap" rel="stylesheet">
-                            <style>
-                                * { margin: 0; padding: 0; box-sizing: border-box; }
-                                body {
-                                    font-family: 'Geist', -apple-system, BlinkMacSystemFont, sans-serif;
-                                    background: linear-gradient(135deg, #0f0f0f 0%, #1a1a1a 100%);
-                                    color: #fafafa;
-                                    min-height: 100vh;
-                                    display: flex;
-                                    align-items: center;
-                                    justify-content: center;
-                                    padding: 20px;
-                                }
-                                .container {
-                                    background: #141414;
-                                    border: 1px solid #262626;
-                                    padding: 48px;
-                                    border-radius: 12px;
-                                    box-shadow: 0 8px 32px rgba(0, 0, 0, 0.4);
-                                    max-width: 450px;
-                                    width: 100%;
-                                    text-align: center;
-                                }
-                                .logo {
-                                    width: 240px;
-                                    height: 70px;
-                                    margin: 0 auto 32px;
-                                    background-image: ${DEXTO_LOGO_DATA_URL ? `url("${DEXTO_LOGO_DATA_URL}")` : 'none'};
-                                    background-repeat: no-repeat;
-                                    background-position: center;
-                                    background-size: contain;
-                                    display: flex;
-                                    align-items: center;
-                                    justify-content: center;
-                                    font-size: 28px;
-                                    font-weight: 600;
-                                    color: #4ec9b0;
-                                }
-                                .spinner {
-                                    font-size: 48px;
-                                    margin-bottom: 24px;
-                                    animation: pulse 2s infinite;
-                                }
-                                @keyframes pulse {
-                                    0%, 100% { opacity: 1; }
-                                    50% { opacity: 0.6; }
-                                }
-                                h1 { font-size: 24px; font-weight: 600; margin-bottom: 12px; color: #fafafa; }
-                                p { color: #a1a1aa; font-size: 16px; line-height: 1.5; }
-                                .success-icon { color: #22c55e; font-size: 64px; margin-bottom: 24px; }
-                                .error-icon { color: #dc2626; font-size: 64px; margin-bottom: 24px; }
-                                .success-title { color: #22c55e; }
-                                .error-title { color: #dc2626; }
-                            </style>
-                        </head>
-                        <body>
-                            <div class="container">
-                                ${LOGO_HTML}
-                                <div class="spinner">◐</div>
-                                <h1>Processing Authentication...</h1>
-                                <p>Please wait while we complete your Dexto login.</p>
-                            </div>
-                            <script>
-                            const hashParams = new URLSearchParams(window.location.hash.substring(1));
-                            const urlParams = new URLSearchParams(window.location.search);
-                            const accessToken = hashParams.get('access_token') || urlParams.get('access_token');
-                            const refreshToken = hashParams.get('refresh_token') || urlParams.get('refresh_token');
-                            const expiresIn = hashParams.get('expires_in') || urlParams.get('expires_in');
-                            const error = hashParams.get('error') || urlParams.get('error');
-
-                            if (window.location.hash || window.location.search) {
-                                window.history.replaceState(null, document.title, window.location.pathname);
-                            }
-
-                            if (error) {
-                                fetch('/callback', {
-                                    method: 'POST',
-                                    headers: { 'Content-Type': 'application/json' },
-                                    body: JSON.stringify({ error: error })
-                                }).then(() => {
-                                    document.querySelector('.container').innerHTML = ${JSON.stringify(ERROR_HTML)};
-                                });
-                            } else if (accessToken) {
-                                fetch('/callback', {
-                                    method: 'POST',
-                                    headers: { 'Content-Type': 'application/json' },
-                                    body: JSON.stringify({
-                                        access_token: accessToken,
-                                        refresh_token: refreshToken,
-                                        expires_in: expiresIn ? parseInt(expiresIn) : undefined
-                                    })
-                                }).then(() => {
-                                    document.querySelector('.container').innerHTML = ${JSON.stringify(SUCCESS_HTML)};
-                                });
-                            } else {
-                                document.querySelector('.container').innerHTML = ${JSON.stringify(NO_DATA_HTML)};
-                            }
-                            </script>
-                        </body>
-                        </html>
-                    `);
-                }
-                else if (req.method === 'POST' && parsedUrl.pathname === '/callback') {
-                    let body = '';
-                    const MAX_BODY_SIZE = 10 * 1024; // 10KB - plenty for OAuth tokens
-                    req.on('data', (chunk) => {
-                        if (body.length + chunk.length > MAX_BODY_SIZE) {
-                            req.destroy();
-                            res.writeHead(413);
-                            res.end('Request too large');
-                            return;
-                        }
-                        body += chunk.toString();
-                    });
-                    req.on('end', async () => {
-                        try {
-                            const data = JSON.parse(body);
-                            if (data.error) {
-                                res.writeHead(200);
-                                res.end('OK');
-                                safeCloseServer(server);
-                                safeReject(new Error(`OAuth error: ${data.error}`));
-                                return;
-                            }
-                            if (data.access_token) {
-                                const userResponse = await fetch(`${config.authUrl}/auth/v1/user`, {
-                                    headers: {
-                                        Authorization: `Bearer ${data.access_token}`,
-                                        apikey: config.clientId,
-                                    },
-                                });
-                                const userData = userResponse.ok ? await userResponse.json() : null;
-                                const result = {
-                                    accessToken: data.access_token,
-                                    refreshToken: data.refresh_token,
-                                    expiresIn: data.expires_in,
-                                    user: userData
-                                        ? {
-                                            id: userData.id,
-                                            email: userData.email,
-                                            name: userData.user_metadata?.full_name ||
-                                                userData.email,
-                                        }
-                                        : undefined,
-                                };
-                                res.writeHead(200);
-                                res.end('OK');
-                                safeCloseServer(server);
-                                safeResolve(result);
-                            }
-                            else {
-                                res.writeHead(400);
-                                res.end('Missing tokens');
-                                safeCloseServer(server);
-                                safeReject(new Error('No access token received'));
-                            }
-                        }
-                        catch (_err) {
-                            res.writeHead(400);
-                            res.end('Invalid data');
-                            safeCloseServer(server);
-                            safeReject(new Error('Invalid callback data'));
-                        }
-                    });
-                }
-                else {
-                    res.writeHead(404);
-                    res.end('Not Found');
-                }
-            }
-            catch (error) {
-                logger.error(`Callback server error: ${error}`);
-                res.writeHead(500);
-                res.end('Internal Server Error');
-                safeCloseServer(server);
-                safeReject(error);
-            }
-        });
-        timeoutHandle = setTimeout(() => {
-            safeCloseServer(server);
-            safeReject(new Error('Authentication timed out'));
-        }, timeoutMs);
-        abortHandler = () => {
-            const reason = options.signal?.reason;
-            const error = reason instanceof Error
-                ? reason
-                : new Error(typeof reason === 'string' ? reason : 'Authentication cancelled');
-            safeCloseServer(server);
-            safeReject(error);
-        };
-        server.listen(port, 'localhost', () => {
-            logger.debug(`OAuth callback server listening on http://localhost:${port}`);
-        });
-        server.on('error', (error) => {
-            safeCloseServer(server);
-            safeReject(new Error(`Failed to start callback server: ${error.message}`));
-        });
-        if (options.signal) {
-            if (options.signal.aborted) {
-                abortHandler();
-            }
-            else {
-                options.signal.addEventListener('abort', abortHandler, { once: true });
-            }
-        }
-    });
-}
-export async function beginOAuthLogin(config, options = {}) {
-    const resolvedOptions = resolveCallbackServerOptions(options);
-    const port = await ensurePortAvailable(OAUTH_CALLBACK_PORT);
-    const redirectUri = `http://localhost:${port}`;
-    oauthStateStore.set(port, 'active');
-    logger.debug(`Registered OAuth callback server on port ${port}`);
-    const provider = config.provider || 'google';
-    const authParams = querystring.stringify({
-        redirect_to: redirectUri,
-    });
-    const authUrl = `${config.authUrl}/auth/v1/authorize?provider=${provider}&${authParams}`;
-    const abortController = new AbortController();
-    let upstreamAbortHandler = null;
-    if (resolvedOptions.signal) {
-        const handler = () => abortController.abort(resolvedOptions.signal?.reason);
-        upstreamAbortHandler = handler;
-        if (resolvedOptions.signal.aborted) {
-            handler();
-        }
-        else {
-            resolvedOptions.signal.addEventListener('abort', handler, { once: true });
-        }
-    }
-    const result = startCallbackServer(port, config, {
-        timeoutMs: resolvedOptions.timeoutMs,
-        signal: abortController.signal,
-    }).finally(() => {
-        if (resolvedOptions.signal && upstreamAbortHandler) {
-            resolvedOptions.signal.removeEventListener('abort', upstreamAbortHandler);
-        }
-    });
-    return {
-        authUrl,
-        result,
-        cancel: () => abortController.abort(new Error('Authentication cancelled')),
-    };
-}
-/**
- * Perform OAuth login flow with Supabase
- */
-export async function performOAuthLogin(config, options = {}) {
-    try {
-        const session = await beginOAuthLogin(config);
-        console.log(chalk.cyan('🌐 Opening browser for authentication...'));
-        try {
-            const { default: open } = await import('open');
-            await open(session.authUrl);
-            console.log(chalk.green('✅ Browser opened'));
-        }
-        catch (error) {
-            if (options.failOnBrowserOpenError) {
-                session.cancel();
-                throw new Error(`Browser launch failed: ${error instanceof Error ? error.message : String(error)}`);
-            }
-            console.log(chalk.yellow(`💡 Please open manually: ${session.authUrl}`));
-        }
-        const spinner = p.spinner();
-        spinner.start('Waiting for authentication...');
-        try {
-            const result = await session.result;
-            spinner.stop('Authentication successful!');
-            return result;
-        }
-        catch (error) {
-            spinner.stop('Authentication failed');
-            throw error;
-        }
-    }
-    catch (_error) {
-        throw new Error(`OAuth login failed: ${_error instanceof Error ? _error.message : String(_error)}`);
-    }
-}
-/**
- * Default Supabase OAuth configuration for Dexto CLI
- */
-export const DEFAULT_OAUTH_CONFIG = {
-    authUrl: SUPABASE_URL,
-    clientId: SUPABASE_ANON_KEY,
-    provider: 'google',
-    scopes: ['openid', 'email', 'profile'],
-};

package/dist/cli/auth/service.d.ts

@@ -1,24 +0,0 @@
-export interface AuthConfig {
-    /** Supabase access token from OAuth login (optional if using --api-key) */
-    token?: string | undefined;
-    refreshToken?: string | undefined;
-    userId?: string | undefined;
-    email?: string | undefined;
-    expiresAt?: number | undefined;
-    createdAt: number;
-    /** Dexto API key for gateway access (from --api-key or provisioned after OAuth) */
-    dextoApiKey?: string | undefined;
-    dextoKeyId?: string | undefined;
-    /** Application origin that issued the saved API key; absent for legacy credentials. */
-    dextoPlatformUrl?: string | undefined;
-    dextoApiKeySource?: 'provisioned' | 'user-supplied' | undefined;
-}
-export declare function storeAuth(config: AuthConfig): Promise<void>;
-export declare function loadAuth(): Promise<AuthConfig | null>;
-export declare function removeAuth(): Promise<void>;
-export declare function isAuthenticated(): Promise<boolean>;
-export declare function getAuthToken(): Promise<string | null>;
-export declare function getAuthTokenQuietly(): Promise<string | null>;
-export declare function getDextoApiKey(): Promise<string | null>;
-export declare function getAuthFilePath(): string;
-//# sourceMappingURL=service.d.ts.map

package/dist/cli/auth/service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/cli/auth/service.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,UAAU;IACvB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,uFAAuF;IACvF,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,iBAAiB,CAAC,EAAE,aAAa,GAAG,eAAe,GAAG,SAAS,CAAC;CACnE;AAmBD,wBAAsB,SAAS,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAQjE;AAED,wBAAsB,QAAQ,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CA4B3D;AAED,wBAAsB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAOhD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CAGxD;AAsDD,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE3D;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAElE;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ7D;AA8CD,wBAAgB,eAAe,IAAI,MAAM,CAExC"}

package/dist/cli/auth/service.js

@@ -1,161 +0,0 @@
-// packages/cli/src/cli/auth/service.ts
-// Auth storage, token management, and refresh logic
-import chalk from 'chalk';
-import { existsSync, promises as fs } from 'fs';
-import { z } from 'zod';
-import { getDextoGlobalPath, logger } from '@dexto/core';
-import { SUPABASE_URL, SUPABASE_ANON_KEY } from './constants.js';
-const AUTH_CONFIG_FILE = 'auth.json';
-const AuthConfigSchema = z
-    .object({
-    token: z.string().min(1).optional(),
-    refreshToken: z.string().optional(),
-    userId: z.string().optional(),
-    email: z.string().email().optional(),
-    expiresAt: z.number().optional(),
-    createdAt: z.number(),
-    dextoApiKey: z.string().optional(),
-    dextoKeyId: z.string().optional(),
-    dextoPlatformUrl: z.string().url().optional(),
-    dextoApiKeySource: z.enum(['provisioned', 'user-supplied']).optional(),
-})
-    .refine((data) => data.token || data.dextoApiKey, {
-    message: 'Either token (from OAuth) or dextoApiKey (from --api-key) is required',
-});
-export async function storeAuth(config) {
-    const authPath = getDextoGlobalPath('', AUTH_CONFIG_FILE);
-    const dextoDir = getDextoGlobalPath('', '');
-    await fs.mkdir(dextoDir, { recursive: true });
-    await fs.writeFile(authPath, JSON.stringify(config, null, 2), { mode: 0o600 });
-    logger.debug(`Stored auth config at: ${authPath}`);
-}
-export async function loadAuth() {
-    const authPath = getDextoGlobalPath('', AUTH_CONFIG_FILE);
-    if (!existsSync(authPath)) {
-        return null;
-    }
-    try {
-        const content = await fs.readFile(authPath, 'utf-8');
-        const config = JSON.parse(content);
-        const validated = AuthConfigSchema.parse(config);
-        if (validated.expiresAt && validated.expiresAt < Date.now()) {
-            // Only remove auth if there's no refresh token available
-            // If refresh token exists, return the expired auth and let getAuthToken() handle refresh
-            if (!validated.refreshToken) {
-                await removeAuth();
-                return null;
-            }
-        }
-        return validated;
-    }
-    catch (error) {
-        logger.warn(`Invalid auth config, removing: ${error}`);
-        await removeAuth();
-        return null;
-    }
-}
-export async function removeAuth() {
-    const authPath = getDextoGlobalPath('', AUTH_CONFIG_FILE);
-    if (existsSync(authPath)) {
-        await fs.unlink(authPath);
-        logger.debug(`Removed auth config from: ${authPath}`);
-    }
-}
-export async function isAuthenticated() {
-    const auth = await loadAuth();
-    return auth !== null;
-}
-async function resolveAuthToken(options) {
-    const auth = await loadAuth();
-    if (!auth) {
-        return null;
-    }
-    const now = Date.now();
-    const fiveMinutes = 5 * 60 * 1000;
-    const isExpiringSoon = auth.expiresAt && auth.expiresAt < now + fiveMinutes;
-    if (!isExpiringSoon) {
-        return auth.token ?? null;
-    }
-    if (!auth.refreshToken) {
-        logger.debug('Token expired but no refresh token available');
-        await removeAuth();
-        return null;
-    }
-    logger.debug('Access token expired or expiring soon, refreshing...');
-    if (!options.quiet) {
-        console.log(chalk.cyan('🔄 Access token expiring soon, refreshing...'));
-    }
-    const refreshResult = await refreshAccessToken(auth.refreshToken);
-    if (!refreshResult) {
-        logger.debug('Token refresh failed, removing auth');
-        if (!options.quiet) {
-            console.log(chalk.red('❌ Token refresh failed. Please login again.'));
-        }
-        await removeAuth();
-        return null;
-    }
-    const newExpiresAt = Date.now() + refreshResult.expiresIn * 1000;
-    await storeAuth({
-        ...auth,
-        token: refreshResult.accessToken,
-        refreshToken: refreshResult.refreshToken,
-        expiresAt: newExpiresAt,
-    });
-    logger.debug('Token refreshed successfully');
-    if (!options.quiet) {
-        console.log(chalk.green('✅ Access token refreshed successfully'));
-    }
-    return refreshResult.accessToken;
-}
-export async function getAuthToken() {
-    return resolveAuthToken({ quiet: false });
-}
-export async function getAuthTokenQuietly() {
-    return resolveAuthToken({ quiet: true });
-}
-export async function getDextoApiKey() {
-    // Explicit env var takes priority (for CI, testing, account override)
-    if (process.env.DEXTO_API_KEY?.trim()) {
-        return process.env.DEXTO_API_KEY;
-    }
-    // Fall back to auth.json (from `dexto login`)
-    const auth = await loadAuth();
-    return auth?.dextoApiKey || null;
-}
-async function refreshAccessToken(refreshToken) {
-    try {
-        const response = await fetch(`${SUPABASE_URL}/auth/v1/token?grant_type=refresh_token`, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                apikey: SUPABASE_ANON_KEY,
-            },
-            body: JSON.stringify({
-                refresh_token: refreshToken,
-            }),
-            signal: AbortSignal.timeout(10_000),
-        });
-        if (!response.ok) {
-            logger.debug(`Token refresh failed: ${response.status}`);
-            return null;
-        }
-        const data = await response.json();
-        if (!data.access_token || !data.refresh_token) {
-            logger.debug('Token refresh response missing required tokens');
-            return null;
-        }
-        logger.debug('Successfully refreshed access token');
-        return {
-            accessToken: data.access_token,
-            refreshToken: data.refresh_token,
-            expiresIn: data.expires_in || 3600,
-        };
-    }
-    catch (error) {
-        logger.debug(`Token refresh error: ${error instanceof Error ? error.message : String(error)}`);
-        return null;
-    }
-}
-export function getAuthFilePath() {
-    return getDextoGlobalPath('', AUTH_CONFIG_FILE);
-}

package/dist/cli/auth/types.d.ts

@@ -1,11 +0,0 @@
-export interface AuthenticatedUser {
-    id: string;
-    email: string;
-    name?: string | undefined;
-}
-export interface DeviceApiKeyLoginResult {
-    dextoApiKey: string;
-    dextoKeyId: string;
-    dextoKeyDisplay: string;
-}
-//# sourceMappingURL=types.d.ts.map

package/dist/cli/auth/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/cli/auth/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;CAC3B"}

package/dist/cli/auth/types.js

@@ -1 +0,0 @@
-export {};

package/dist/cli/cloud-chat.d.ts

@@ -1,18 +0,0 @@
-import { type AgentEventMap } from '@dexto/core';
-import { type TuiAgentBackend } from '@dexto/tui';
-import { createDeployClient } from './commands/deploy/client.js';
-export interface StartCloudChatCliOptions {
-    cloudAgentId?: string;
-    initialPrompt?: string;
-    resume?: string;
-    continueMostRecent?: boolean;
-    workspaceRoot?: string;
-}
-type DeployClient = ReturnType<typeof createDeployClient>;
-type CloudApprovalDecision = Parameters<DeployClient['submitCloudAgentApproval']>[2];
-type CloudChatBackend = TuiAgentBackend;
-export declare function buildCloudApprovalDecision(approval: AgentEventMap['approval:response']): CloudApprovalDecision | null;
-export declare function createCloudAgentBackend(client: DeployClient, cloudAgentId: string): CloudChatBackend;
-export declare function startCloudChatCli(options: StartCloudChatCliOptions): Promise<void>;
-export {};
-//# sourceMappingURL=cloud-chat.d.ts.map

package/dist/cli/cloud-chat.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cloud-chat.d.ts","sourceRoot":"","sources":["../../src/cli/cloud-chat.ts"],"names":[],"mappings":"AAAA,OAAO,EAIH,KAAK,aAAa,EASrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAGjE,MAAM,WAAW,wBAAwB;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,KAAK,YAAY,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAK1D,KAAK,qBAAqB,GAAG,UAAU,CAAC,YAAY,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AASrF,KAAK,gBAAgB,GAAG,eAAe,CAAC;AAmNxC,wBAAgB,0BAA0B,CACtC,QAAQ,EAAE,aAAa,CAAC,mBAAmB,CAAC,GAC7C,qBAAqB,GAAG,IAAI,CAsB9B;AA4CD,wBAAgB,uBAAuB,CACnC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,MAAM,GACrB,gBAAgB,CAimBlB;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBxF"}