dexto 1.14.5 → 2.0.0-beta.0

package/dist/cli/cloud/transfer.js

@@ -0,0 +1,35 @@
+// Sends local bytes to a URL the server handed out for them, outside MCP JSON.
+import { CommandFailure, isJsonObject } from './command.js';
+/**
+ * Streams `body` to the target with its length, and returns the JSON reply (null when there is
+ * none). A refusal fails with the server's own message.
+ */
+export async function sendBytes(context, target, body) {
+    const response = await context.runtime.fetch(target.url, {
+        body,
+        headers: { ...target.headers, 'content-length': String(body.size) },
+        method: target.method,
+        signal: context.runtime.signal,
+    });
+    const text = await response.text();
+    const parsed = parseJson(text);
+    if (response.ok)
+        return parsed;
+    throw new CommandFailure(response.status === 404 ? 'not_found' : 'failed', `The upload was refused (HTTP ${response.status}): ${refusalMessage(parsed) ?? (text || 'no reason given')}`, null);
+}
+function parseJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}
+/** `{"error":{"message"}}` from the API, or `{"error_description"}` from an upload route. */
+function refusalMessage(body) {
+    if (!isJsonObject(body))
+        return null;
+    if (isJsonObject(body.error) && typeof body.error.message === 'string')
+        return body.error.message;
+    return typeof body.error_description === 'string' ? body.error_description : null;
+}

package/dist/cli/cloud/v1.d.ts

@@ -0,0 +1,19 @@
+import { CommandFailure, type CommandContext, type SignInContext } from './command.js';
+/**
+ * Sends one request to a `/v1` path with the sign-in's credential and Cloud project. The path is
+ * resolved against the API and checked, so no path can send the credential elsewhere.
+ */
+export declare function fetchV1(context: CommandContext, method: string, requestPath: string, body: string | null): Promise<Response>;
+/**
+ * Sends one request to a `/v1` path with its own headers and body, such as a file or a request
+ * for an event stream; `signal` ends it early.
+ */
+export declare function sendV1(context: CommandContext, method: string, requestPath: string, content: {
+    readonly body: string | globalThis.Blob | null;
+    readonly headers: Readonly<Record<string, string>>;
+} | null, signal?: AbortSignal): Promise<Response>;
+/** As `fetchV1`, returning the JSON body of a success and failing with the error's kind otherwise. */
+export declare function callV1(context: CommandContext, method: string, requestPath: string, body: string | null): Promise<unknown>;
+/** A failed call as the contract's failure, by its status and the error's message. */
+export declare function v1Failure(context: SignInContext, status: number, text: string): CommandFailure;
+//# sourceMappingURL=v1.d.ts.map

package/dist/cli/cloud/v1.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"v1.d.ts","sourceRoot":"","sources":["../../../src/cli/cloud/v1.ts"],"names":[],"mappings":"AACA,OAAO,EACH,cAAc,EAId,KAAK,cAAc,EACnB,KAAK,aAAa,EACrB,MAAM,cAAc,CAAC;AAEtB;;;GAGG;AACH,wBAAsB,OAAO,CACzB,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GAAG,IAAI,GACpB,OAAO,CAAC,QAAQ,CAAC,CAOnB;AAED;;;GAGG;AACH,wBAAsB,MAAM,CACxB,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE;IACL,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACtD,GAAG,IAAI,EACR,MAAM,GAAE,WAAoC,GAC7C,OAAO,CAAC,QAAQ,CAAC,CAsBnB;AAED,sGAAsG;AACtG,wBAAsB,MAAM,CACxB,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GAAG,IAAI,GACpB,OAAO,CAAC,OAAO,CAAC,CAKlB;AAED,sFAAsF;AACtF,wBAAgB,SAAS,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,CA0B9F"}

package/dist/cli/cloud/v1.js

@@ -0,0 +1,65 @@
+// Calls the public /v1 API as the sign-in, for `cloud api` and what the typed client does not cover.
+import { CommandFailure, isJsonObject, signInCommand, UsageError, } from './command.js';
+/**
+ * Sends one request to a `/v1` path with the sign-in's credential and Cloud project. The path is
+ * resolved against the API and checked, so no path can send the credential elsewhere.
+ */
+export async function fetchV1(context, method, requestPath, body) {
+    return await sendV1(context, method, requestPath, body === null ? null : { body, headers: { 'content-type': 'application/json' } });
+}
+/**
+ * Sends one request to a `/v1` path with its own headers and body, such as a file or a request
+ * for an event stream; `signal` ends it early.
+ */
+export async function sendV1(context, method, requestPath, content, signal = context.runtime.signal) {
+    const connection = await context.connection();
+    const apiOrigin = new URL(connection.apiBaseUrl).origin;
+    const url = new URL(requestPath, `${connection.apiBaseUrl}/`);
+    if (!requestPath.startsWith('/v1/') ||
+        url.origin !== apiOrigin ||
+        !url.pathname.startsWith('/v1/'))
+        throw new UsageError('The path must start with /v1/; the CLI only calls the public API.');
+    return await context.runtime.fetch(url, {
+        headers: {
+            ...content?.headers,
+            authorization: `Bearer ${connection.token}`,
+            ...(connection.kind === 'oauth' && connection.cloudProject !== null
+                ? { 'dexto-cloud-project': connection.cloudProject }
+                : {}),
+        },
+        method,
+        ...(content === null || content.body === null ? {} : { body: content.body }),
+        signal,
+    });
+}
+/** As `fetchV1`, returning the JSON body of a success and failing with the error's kind otherwise. */
+export async function callV1(context, method, requestPath, body) {
+    const response = await fetchV1(context, method, requestPath, body);
+    const text = await response.text();
+    if (!response.ok)
+        throw v1Failure(context, response.status, text);
+    return JSON.parse(text);
+}
+/** A failed call as the contract's failure, by its status and the error's message. */
+export function v1Failure(context, status, text) {
+    let message = `HTTP ${status}`;
+    try {
+        const body = JSON.parse(text);
+        if (isJsonObject(body) &&
+            isJsonObject(body.error) &&
+            typeof body.error.message === 'string')
+            message = `HTTP ${status}: ${body.error.message}`;
+    }
+    catch {
+        // Not JSON: the status says enough.
+    }
+    if (status === 401)
+        return new CommandFailure('needs_sign_in', message, signInCommand(context, null));
+    return new CommandFailure(status === 403
+        ? 'needs_permission'
+        : status === 404
+            ? 'not_found'
+            : status === 400 || status === 413 || status === 422
+                ? 'invalid_input'
+                : 'failed', message, null);
+}

package/dist/cli/cloud/zip.d.ts

@@ -0,0 +1,8 @@
+export interface ZipFile {
+    readonly bytes: Uint8Array;
+    /** Relative, with `/` between folders. */
+    readonly path: string;
+}
+/** The archive of these files in order, with its central directory. */
+export declare function zipArchive(files: readonly ZipFile[]): Uint8Array<ArrayBuffer>;
+//# sourceMappingURL=zip.d.ts.map

package/dist/cli/cloud/zip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zip.d.ts","sourceRoot":"","sources":["../../../src/cli/cloud/zip.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,OAAO;IACpB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACzB;AAED,uEAAuE;AACvE,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,GAAG,UAAU,CAAC,WAAW,CAAC,CAqC7E"}

package/dist/cli/cloud/zip.js

@@ -0,0 +1,66 @@
+// Writes a .zip of files, as Dexto takes files to publish: each deflated unless that's no smaller.
+import { crc32, deflateRawSync } from 'node:zlib';
+const encoder = new globalThis.TextEncoder();
+/** 1980-01-01, the first date a .zip can hold, so the same files make the same archive. */
+const DOS_DATE = 0x21;
+/** Entry names are UTF-8. */
+const UTF8_FLAG = 0x0800;
+/** The archive of these files in order, with its central directory. */
+export function zipArchive(files) {
+    const parts = [];
+    const directory = [];
+    let offset = 0;
+    for (const file of files) {
+        const name = encoder.encode(file.path);
+        const deflated = deflateRawSync(file.bytes);
+        const stored = deflated.byteLength >= file.bytes.byteLength;
+        const body = stored ? file.bytes : deflated;
+        const entry = {
+            checksum: crc32(file.bytes),
+            method: stored ? 0 : 8,
+            nameLength: name.byteLength,
+            size: body.byteLength,
+            unpackedSize: file.bytes.byteLength,
+        };
+        const local = new DataView(new ArrayBuffer(30));
+        local.setUint32(0, 0x04034b50, true);
+        writeEntryFields(local, 4, entry);
+        parts.push(new Uint8Array(local.buffer), name, body);
+        const central = new DataView(new ArrayBuffer(46));
+        central.setUint32(0, 0x02014b50, true);
+        central.setUint16(4, 20, true);
+        writeEntryFields(central, 6, entry);
+        central.setUint32(42, offset, true);
+        directory.push(new Uint8Array(central.buffer), name);
+        offset += 30 + name.byteLength + body.byteLength;
+    }
+    const directorySize = directory.reduce((total, part) => total + part.byteLength, 0);
+    const end = new DataView(new ArrayBuffer(22));
+    end.setUint32(0, 0x06054b50, true);
+    end.setUint16(8, files.length, true);
+    end.setUint16(10, files.length, true);
+    end.setUint32(12, directorySize, true);
+    end.setUint32(16, offset, true);
+    return concat([...parts, ...directory, new Uint8Array(end.buffer)]);
+}
+/** The fields a local header and a central directory entry share, from the version needed on. */
+function writeEntryFields(view, at, entry) {
+    view.setUint16(at, 20, true);
+    view.setUint16(at + 2, UTF8_FLAG, true);
+    view.setUint16(at + 4, entry.method, true);
+    view.setUint16(at + 6, 0, true);
+    view.setUint16(at + 8, DOS_DATE, true);
+    view.setUint32(at + 10, entry.checksum, true);
+    view.setUint32(at + 14, entry.size, true);
+    view.setUint32(at + 18, entry.unpackedSize, true);
+    view.setUint16(at + 22, entry.nameLength, true);
+}
+function concat(parts) {
+    const out = new Uint8Array(parts.reduce((total, part) => total + part.byteLength, 0));
+    let at = 0;
+    for (const part of parts) {
+        out.set(part, at);
+        at += part.byteLength;
+    }
+    return out;
+}

package/dist/cli/commands/auth/sign-in-commands.d.ts

@@ -0,0 +1,62 @@
+import { dextoAccounts, type dextoCloud, type dextoSignIn } from '@dexto/agent-management';
+type OAuthLogin = dextoAccounts.OAuthLogin;
+type CloudProject = dextoCloud.CloudProject;
+type BrowserSignInInput = dextoSignIn.BrowserSignInInput;
+type EndedSignIn = dextoSignIn.EndedSignIn;
+type SignInInput = dextoSignIn.SignInInput;
+/** Dexto's side of signing in, injected so commands can be tested without a server. */
+export interface DextoSignIn {
+    readonly signInWithBrowser: (input: BrowserSignInInput) => Promise<OAuthLogin>;
+    readonly signInWithDevice: (input: SignInInput) => Promise<OAuthLogin>;
+    readonly endSignIn: (login: OAuthLogin) => Promise<EndedSignIn>;
+    readonly refreshSignIn: (login: OAuthLogin) => Promise<OAuthLogin>;
+    /** The Cloud projects the signed-in organization has. */
+    readonly listProjects: (login: OAuthLogin) => Promise<readonly CloudProject[]>;
+    /** Whether the public API accepts the key; false on 401. */
+    readonly acceptsApiKey: (apiBaseUrl: string, apiKey: string) => Promise<boolean>;
+}
+export interface SignInContext {
+    /** ~/.dexto/accounts */
+    readonly dir: string;
+    readonly environment: Readonly<Record<string, string | undefined>>;
+    /** The Dexto app a new sign-in goes to. */
+    readonly appUrl: string;
+    /** The public API a new sign-in is saved for. */
+    readonly apiBaseUrl: string;
+    /** A command's result: the value for JSON output, the text for people. */
+    readonly result: (value: unknown, text: string) => void;
+    /** Anything else, on stderr. */
+    readonly note: (text: string) => void;
+    /** Asks the person; false when there is no one to ask. */
+    readonly confirm: (question: string) => Promise<boolean>;
+    /** False over SSH or without a display: a loopback redirect can't reach this machine. */
+    readonly canOpenBrowser: boolean;
+    readonly dexto: DextoSignIn;
+}
+export interface LoginOptions {
+    readonly profile: string | null;
+    readonly org: string | null;
+    readonly device: boolean;
+    readonly browser: boolean;
+    readonly scopes: readonly string[];
+    readonly apiKey: string | null;
+}
+export declare function login(context: SignInContext, options: LoginOptions): Promise<void>;
+/** Who the current profile acts as, in a few words, or null when signed out. */
+export declare function describeSignIn(context: SignInContext): Promise<string | null>;
+export declare function logout(context: SignInContext, options: {
+    readonly profile: string | null;
+}): Promise<void>;
+export declare function whoami(context: SignInContext, options: {
+    readonly profile: string | null;
+    readonly apiKey: string | null;
+}): Promise<void>;
+export declare function listAccounts(context: SignInContext, options: {
+    readonly profile: string | null;
+}): Promise<void>;
+export declare function useAccount(context: SignInContext, wanted: string): Promise<void>;
+export declare function removeAccount(context: SignInContext, wanted: string, options: {
+    readonly yes: boolean;
+}): Promise<void>;
+export {};
+//# sourceMappingURL=sign-in-commands.d.ts.map

package/dist/cli/commands/auth/sign-in-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in-commands.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/auth/sign-in-commands.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,KAAK,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAG3F,KAAK,UAAU,GAAG,aAAa,CAAC,UAAU,CAAC;AAG3C,KAAK,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;AAC5C,KAAK,kBAAkB,GAAG,WAAW,CAAC,kBAAkB,CAAC;AACzD,KAAK,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC;AAC3C,KAAK,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC;AAgB3C,uFAAuF;AACvF,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,iBAAiB,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/E,QAAQ,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACvE,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAChE,QAAQ,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACnE,yDAAyD;IACzD,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,CAAC;IAC/E,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,aAAa;IAC1B,wBAAwB;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IACnE,2CAA2C;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iDAAiD;IACjD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxD,gCAAgC;IAChC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,yFAAyF;IACzF,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;CAC/B;AAED,MAAM,WAAW,YAAY;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,wBAAsB,KAAK,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA8ExF;AAgCD,gFAAgF;AAChF,wBAAsB,cAAc,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAanF;AAED,wBAAsB,MAAM,CACxB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC7C,OAAO,CAAC,IAAI,CAAC,CAQf;AAkBD,wBAAsB,MAAM,CACxB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC7E,OAAO,CAAC,IAAI,CAAC,CA+Cf;AAED,wBAAsB,YAAY,CAC9B,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC7C,OAAO,CAAC,IAAI,CAAC,CAoBf;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQtF;AAED,wBAAsB,aAAa,CAC/B,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;CAAE,GACnC,OAAO,CAAC,IAAI,CAAC,CAmBf"}

package/dist/cli/commands/auth/sign-in-commands.js

@@ -0,0 +1,247 @@
+// `dexto login`, `logout`, `whoami` and `accounts`: signing in to Dexto and the saved profiles.
+import { dextoAccounts } from '@dexto/agent-management';
+import { CommandFailure, UsageError } from '../../cloud/command.js';
+const { DEFAULT_PROFILE, forgetLogin, listAccounts: readAccounts, profileNameFor, readCurrentProfile, readLogin, requireProfileName, resolveCredential, resolveProfile, writeCurrentProfile, writeLogin, } = dextoAccounts;
+export async function login(context, options) {
+    const named = options.profile ?? nonEmpty(context.environment.DEXTO_PROFILE);
+    // --org names the profile and switches to it, unless --profile or DEXTO_PROFILE chose one.
+    const switches = options.org !== null && named === null;
+    const profile = options.org !== null && switches
+        ? profileNameFor(options.org)
+        : await resolveProfile(context.dir, named, {});
+    const saved = await readLogin(context.dir, profile);
+    if (options.apiKey !== null) {
+        if (options.org !== null)
+            throw new UsageError('An API key acts as itself; --org is for signing in.');
+        await saveApiKey(context, profile, options.apiKey);
+        return;
+    }
+    const previous = saved?.kind === 'oauth' ? saved : null;
+    const input = {
+        appUrl: previous?.appUrl ?? context.appUrl,
+        apiBaseUrl: previous?.apiBaseUrl ?? context.apiBaseUrl,
+        // Signing in again starts at the organization the profile was signed in for.
+        organization: options.org ?? previous?.signedInAs?.organization.id ?? null,
+        // ...and keeps the permissions granted before.
+        extraScopes: [...(previous?.scopes ?? []), ...options.scopes.flatMap(splitList)],
+    };
+    // A browser elsewhere can't reach this machine's loopback redirect, so use a code instead.
+    const device = options.device || (options.browser && !context.canOpenBrowser);
+    if (device && !options.device)
+        context.note('No browser here, so sign in with a code on any device.');
+    const signedIn = device
+        ? await context.dexto.signInWithDevice(input)
+        : await context.dexto.signInWithBrowser({ ...input, openBrowser: options.browser });
+    // A name made from --org can match another organization's profile: keep that sign-in.
+    const savedOrganization = previous?.signedInAs?.organization ?? null;
+    const newOrganization = signedIn.signedInAs?.organization ?? null;
+    if (switches &&
+        savedOrganization !== null &&
+        newOrganization !== null &&
+        savedOrganization.id !== newOrganization.id)
+        throw new UsageError(`The profile ${profile} already signs in to ${savedOrganization.name}. Sign in to ${newOrganization.name} with --profile <name> to keep both.`);
+    const withProject = {
+        ...signedIn,
+        cloudProject: chooseProject(await context.dexto.listProjects(signedIn), previous?.cloudProject ?? null),
+    };
+    await writeLogin(context.dir, profile, withProject);
+    if (switches)
+        await writeCurrentProfile(context.dir, profile);
+    const current = (await resolveProfile(context.dir, null, context.environment)) === profile;
+    context.result({
+        profile,
+        current,
+        account: signedIn.signedInAs?.account ?? null,
+        organization: signedIn.signedInAs?.organization ?? null,
+        cloud_project: withProject.cloudProject,
+        scopes: withProject.scopes,
+    }, [
+        `Signed in${describeSignedInAs(signedIn.signedInAs)}${profile === DEFAULT_PROFILE ? '' : ` (profile ${profile})`}.`,
+        withProject.cloudProject === null
+            ? 'This organization has no Cloud project for Dexto models to bill.'
+            : `Dexto models bill Cloud project ${withProject.cloudProject.name}.`,
+        ...(current
+            ? []
+            : [
+                `Other commands still use another profile: pass --profile ${profile}, or run dexto accounts use ${profile}.`,
+            ]),
+    ].join(' '));
+}
+/**
+ * The project chosen before while it is still live, so signing in again doesn't move anyone;
+ * otherwise the organization's default project.
+ */
+function chooseProject(projects, previous) {
+    const chosen = projects.find((project) => project.id === previous?.id && !project.archived) ??
+        projects.find((project) => project.isDefault && !project.archived) ??
+        null;
+    return chosen === null ? null : { id: chosen.id, name: chosen.name };
+}
+async function saveApiKey(context, profile, apiKey) {
+    if (!(await context.dexto.acceptsApiKey(context.apiBaseUrl, apiKey)))
+        throw new CommandFailure('needs_sign_in', 'Dexto refused this API key.', null);
+    await writeLogin(context.dir, profile, {
+        kind: 'api_key',
+        apiKey,
+        apiBaseUrl: context.apiBaseUrl,
+        savedAt: new Date().toISOString(),
+    });
+    context.result({ profile, key: maskApiKey(apiKey) }, `Saved API key ${maskApiKey(apiKey)}${profile === DEFAULT_PROFILE ? '' : ` (profile ${profile})`}.`);
+}
+/** Who the current profile acts as, in a few words, or null when signed out. */
+export async function describeSignIn(context) {
+    const environmentKey = nonEmpty(context.environment.DEXTO_API_KEY);
+    if (environmentKey !== null)
+        return `API key ${maskApiKey(environmentKey)} from DEXTO_API_KEY`;
+    const profile = await resolveProfile(context.dir, null, context.environment);
+    const saved = await readLogin(context.dir, profile);
+    if (saved === null)
+        return null;
+    const suffix = profile === DEFAULT_PROFILE ? '' : ` (profile ${profile})`;
+    if (saved.kind === 'api_key')
+        return `API key ${maskApiKey(saved.apiKey)}${suffix}`;
+    const who = saved.signedInAs === null
+        ? saved.appUrl
+        : `${saved.signedInAs.account.email} in ${saved.signedInAs.organization.name}`;
+    return `${who}${suffix}`;
+}
+export async function logout(context, options) {
+    const profile = await resolveProfile(context.dir, options.profile, context.environment);
+    const removed = await logOutProfile(context, profile);
+    const named = profile === DEFAULT_PROFILE ? '' : ` for profile ${profile}`;
+    context.result({ profile, logged_out: removed }, removed ? `Logged out${named}.` : `No saved sign-in${named}.`);
+}
+/**
+ * Ends a profile's sign-in on its server, then forgets it here. A sign-in the server didn't end
+ * keeps working until it expires, so a note says where to end it.
+ */
+async function logOutProfile(context, profile) {
+    const saved = await readLogin(context.dir, profile);
+    if (saved?.kind === 'oauth') {
+        const ended = await context.dexto.endSignIn(saved);
+        if (ended.status === 'failed')
+            context.note(`Couldn't end the sign-in on ${saved.appUrl} (${ended.reason}). Sign it out at ${new URL('/settings/sign-ins', saved.appUrl).href}, or it keeps working until it expires.`);
+    }
+    return await forgetLogin(context.dir, profile);
+}
+export async function whoami(context, options) {
+    const credential = await resolveCredential({
+        dir: context.dir,
+        apiKey: options.apiKey,
+        profile: options.profile,
+        environment: context.environment,
+        refresh: context.dexto.refreshSignIn,
+    });
+    if (credential === null)
+        throw new CommandFailure('needs_sign_in', 'Not signed in.', 'dexto login');
+    if (credential.kind === 'api_key') {
+        const from = credential.source === 'flag'
+            ? ' (from --api-key)'
+            : credential.source === 'environment'
+                ? ' (from DEXTO_API_KEY)'
+                : `, profile ${credential.profile}`;
+        context.result({ as: 'api_key', key: maskApiKey(credential.token), source: credential.source }, field('api key', `${maskApiKey(credential.token)}${from}`));
+        return;
+    }
+    const { login: saved } = credential;
+    context.result({
+        as: 'person',
+        profile: credential.profile,
+        account: saved.signedInAs?.account ?? null,
+        organization: saved.signedInAs?.organization ?? null,
+        app_url: saved.appUrl,
+        cloud_project: saved.cloudProject,
+        scopes: saved.scopes,
+    }, [
+        field('profile', credential.profile),
+        field('account', saved.signedInAs?.account.email ?? 'unknown'),
+        field('organization', saved.signedInAs === null
+            ? 'unknown'
+            : `${saved.signedInAs.organization.name} (${saved.signedInAs.organization.slug})`),
+        field('app', saved.appUrl),
+        field('scopes', saved.scopes.join(' ')),
+    ].join('\n'));
+}
+export async function listAccounts(context, options) {
+    const inUse = await resolveProfile(context.dir, options.profile, context.environment);
+    const accounts = (await readAccounts(context.dir)).map(({ name, login: saved }) => ({
+        profile: name,
+        current: name === inUse,
+        kind: saved.kind,
+        account: saved.kind === 'oauth' ? (saved.signedInAs?.account ?? null) : null,
+        organization: saved.kind === 'oauth' ? (saved.signedInAs?.organization ?? null) : null,
+        key: saved.kind === 'api_key' ? maskApiKey(saved.apiKey) : null,
+        url: saved.kind === 'oauth' ? saved.appUrl : saved.apiBaseUrl,
+    }));
+    const rows = accounts.map((account) => [
+        `${account.current ? '*' : ' '} ${account.profile}`,
+        account.key !== null ? `API key ${account.key}` : (account.account?.email ?? account.url),
+        account.organization?.name ?? '',
+    ]);
+    context.result({ data: accounts }, rows.length === 0 ? 'No saved sign-ins. Run dexto login.' : table(rows));
+}
+export async function useAccount(context, wanted) {
+    const { name, login: saved } = await requireSaved(context, wanted);
+    await writeCurrentProfile(context.dir, name);
+    const overridden = (await resolveProfile(context.dir, null, context.environment)) !== name;
+    context.result({ current: name }, `Now using ${describeProfile(name, saved)}.${overridden ? ' DEXTO_PROFILE still chooses another profile here.' : ''}`);
+}
+export async function removeAccount(context, wanted, options) {
+    const { name, login: saved } = await requireSaved(context, wanted);
+    const question = saved.kind === 'oauth'
+        ? `Log ${describeProfile(name, saved)} out and forget it on this machine?`
+        : `Forget ${describeProfile(name, saved)} on this machine?`;
+    if (!options.yes && !(await context.confirm(question)))
+        throw new CommandFailure('needs_confirmation', `${question} Pass --yes once your person has agreed.`, `dexto accounts remove ${name} --yes`);
+    const wasCurrent = (await readCurrentProfile(context.dir)) === name;
+    await logOutProfile(context, name);
+    if (wasCurrent)
+        await writeCurrentProfile(context.dir, DEFAULT_PROFILE);
+    context.result({ removed: name, current: wasCurrent ? DEFAULT_PROFILE : null }, `Removed ${name}.${wasCurrent && name !== DEFAULT_PROFILE ? ` Now using ${DEFAULT_PROFILE}.` : ''}`);
+}
+async function requireSaved(context, wanted) {
+    const name = requireProfileName(wanted);
+    const saved = await readLogin(context.dir, name);
+    if (saved === null)
+        throw new CommandFailure('not_found', `No saved sign-in is named ${name}.`, `dexto login --profile ${name}`);
+    return { name, login: saved };
+}
+/** `work (ada@example.com in Acme)`, or the key or app a profile signs in with. */
+function describeProfile(name, saved) {
+    if (saved.kind === 'api_key')
+        return `${name} (API key ${maskApiKey(saved.apiKey)})`;
+    return saved.signedInAs === null
+        ? `${name} (${saved.appUrl})`
+        : `${name} (${saved.signedInAs.account.email} in ${saved.signedInAs.organization.name})`;
+}
+/** ` as ada@example.com in Acme`, or nothing when the server didn't say. */
+function describeSignedInAs(signedInAs) {
+    return signedInAs === null
+        ? ''
+        : ` as ${signedInAs.account.email} in ${signedInAs.organization.name}`;
+}
+/** `dxt_123…abcd`: enough to recognize a key without showing it. */
+function maskApiKey(apiKey) {
+    return apiKey.length <= 12 ? '…' : `${apiKey.slice(0, 7)}…${apiKey.slice(-4)}`;
+}
+function field(name, value) {
+    return `${name.padEnd(13)} ${value}`;
+}
+function table(rows) {
+    const widths = rows[0]?.map((_, column) => Math.max(...rows.map((row) => row[column]?.length ?? 0)));
+    return rows
+        .map((row) => row
+        .map((cell, column) => column === row.length - 1 ? cell : cell.padEnd(widths?.[column] ?? 0))
+        .join('  ')
+        .trimEnd())
+        .join('\n');
+}
+function splitList(value) {
+    return value
+        .split(/[\s,]+/u)
+        .map((each) => each.trim())
+        .filter((each) => each.length > 0);
+}
+function nonEmpty(value) {
+    return value === undefined || value.length === 0 ? null : value;
+}

package/dist/cli/commands/auth/sign-in-context.d.ts

@@ -0,0 +1,16 @@
+import type { SignInContext } from './sign-in-commands.js';
+/** Where results and notes go, and what cancels a sign-in; the terminal's by default. */
+export interface SignInIo {
+    readonly result: (value: unknown, text: string) => void;
+    readonly note: (text: string) => void;
+    /** Asks the person; false when there is no one to ask. */
+    readonly confirm: (question: string) => Promise<boolean>;
+    readonly signal: AbortSignal;
+}
+/**
+ * Carries this machine's earlier sign-ins into ~/.dexto/accounts, once: the `dexto-cloud` preview
+ * CLI's, else dexto 1.x's saved API key.
+ */
+export declare function carryOverEarlierSignIns(): Promise<void>;
+export declare function nodeSignInContext(io?: SignInIo): Promise<SignInContext>;
+//# sourceMappingURL=sign-in-context.d.ts.map

package/dist/cli/commands/auth/sign-in-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in-context.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/auth/sign-in-context.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,yFAAyF;AACzF,MAAM,WAAW,QAAQ;IACrB,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxD,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAChC;AAmBD;;;GAGG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC,CAQ7D;AAED,wBAAsB,iBAAiB,CAAC,EAAE,GAAE,QAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAiCvF"}

package/dist/cli/commands/auth/sign-in-context.js

@@ -0,0 +1,68 @@
+// The sign-in context for this machine: ~/.dexto/accounts, Dexto's OAuth server and the browser.
+import os from 'node:os';
+import path from 'node:path';
+import * as p from '@clack/prompts';
+import { dextoAccounts, dextoCloud, dextoSignIn } from '@dexto/agent-management';
+import { getDextoGlobalPath } from '@dexto/core';
+import { shouldAttemptBrowserLaunch } from '../../auth/browser-launch.js';
+import { DEXTO_PLATFORM_URL, DEXTO_PUBLIC_API_URL } from '../../auth/constants.js';
+import { nodeSignInRuntime } from '../../auth/sign-in-runtime.js';
+const TERMINAL = {
+    result: (_value, text) => process.stdout.write(`${text}\n`),
+    note: (text) => process.stderr.write(`${text}\n`),
+    confirm: async (question) => {
+        if (!process.stdin.isTTY)
+            return false;
+        const answer = await p.confirm({ message: question, initialValue: false });
+        return answer === true;
+    },
+    signal: new AbortController().signal,
+};
+/** The folder the internal `dexto-cloud` CLI saved its sign-ins in. */
+function cloudCliDirectory() {
+    const configHome = process.env.XDG_CONFIG_HOME ?? path.join(os.homedir(), '.config');
+    return path.join(configHome, 'dexto-cloud');
+}
+/**
+ * Carries this machine's earlier sign-ins into ~/.dexto/accounts, once: the `dexto-cloud` preview
+ * CLI's, else dexto 1.x's saved API key.
+ */
+export async function carryOverEarlierSignIns() {
+    const dir = getDextoGlobalPath('accounts');
+    await dextoAccounts.carryOverCloudCliLogins(dir, cloudCliDirectory());
+    await dextoAccounts.carryOverDexto1ApiKey(dir, getDextoGlobalPath('', 'auth.json'), DEXTO_PUBLIC_API_URL);
+}
+export async function nodeSignInContext(io = TERMINAL) {
+    const dir = getDextoGlobalPath('accounts');
+    await carryOverEarlierSignIns();
+    const runtime = { ...nodeSignInRuntime(io.signal), note: io.note };
+    return {
+        dir,
+        environment: process.env,
+        appUrl: DEXTO_PLATFORM_URL,
+        apiBaseUrl: DEXTO_PUBLIC_API_URL,
+        result: io.result,
+        note: io.note,
+        confirm: io.confirm,
+        canOpenBrowser: shouldAttemptBrowserLaunch(),
+        dexto: {
+            signInWithBrowser: (input) => dextoSignIn.signInWithBrowser(runtime, input),
+            signInWithDevice: (input) => dextoSignIn.signInWithDevice(runtime, input),
+            endSignIn: (login) => dextoSignIn.endSignIn(runtime, login),
+            refreshSignIn: (login) => dextoSignIn.refreshSignIn(runtime, login),
+            listProjects: (login) => dextoCloud.listCloudProjects(runtime.fetch, login.apiBaseUrl, login.accessToken),
+            acceptsApiKey: async (apiBaseUrl, apiKey) => {
+                const response = await fetch(`${apiBaseUrl}/v1/models`, {
+                    headers: { authorization: `Bearer ${apiKey}` },
+                    signal: AbortSignal.timeout(10_000),
+                });
+                await response.body?.cancel();
+                if (response.status === 401)
+                    return false;
+                if (!response.ok)
+                    throw new Error(`Couldn't check the API key: HTTP ${response.status}.`);
+                return true;
+            },
+        },
+    };
+}

package/dist/cli/commands/cloud/register.d.ts

@@ -1,3 +1,8 @@
 import type { Command } from 'commander';
+/**
+ * These words run on the cloud command engine, which reads its own arguments and global options
+ * (--json, --api-key, --profile, --project). Analytics records only the command name, never its
+ * arguments, which can hold a key.
+ */
 export declare function registerCloudCommand(program: Command): void;
 //# sourceMappingURL=register.d.ts.map

package/dist/cli/commands/cloud/register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/cloud/register.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAazC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAgC3D"}
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/cloud/register.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAmBzC;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAuB3D"}