dexto 1.6.1 → 1.6.3

package/dist/analytics/wrapper.js

@@ -59,7 +59,7 @@ export function withAnalytics(commandName, handler, opts) {
                         capture('dexto_cli_command', payload);
                     }
                     catch {
-                        // Timeout instrumentation is best-effort.
+                        // Timeout instrumentation must never throw.
                     }
                 }, timeoutMs);
                 // Prevent timeout from keeping process alive

package/dist/cli/auth/dexto-api-key.d.ts

@@ -0,0 +1,34 @@
+export type DextoApiKeyProvisionStatusLevel = 'info' | 'success' | 'warning' | 'error';
+export interface DextoApiKeyProvisionStatus {
+    level: DextoApiKeyProvisionStatusLevel;
+    message: string;
+}
+export interface EnsureDextoApiKeyOptions {
+    onStatus?: ((status: DextoApiKeyProvisionStatus) => void) | undefined;
+}
+/**
+ * Save DEXTO_API_KEY to the resolved dexto .env path and populate the current
+ * process environment immediately.
+ */
+export declare function saveDextoApiKeyToEnv(apiKey: string): Promise<void>;
+export declare function removeDextoApiKeyFromEnv(options?: {
+    expectedValue?: string;
+}): Promise<{
+    removed: boolean;
+    targetEnvPath: string;
+}>;
+/**
+ * Ensure a Dexto API key exists locally for the current auth session.
+ *
+ * - If a local key exists and validates, it is re-saved to .env (sync) and returned.
+ * - If a local key exists but is invalid, it is rotated (regenerated) and returned.
+ * - If no local key exists, a key is provisioned. If one exists server-side but can't
+ *   be returned, it is regenerated to obtain the value.
+ *
+ * Returns `null` if provisioning fails (OAuth login can still succeed without it).
+ */
+export declare function ensureDextoApiKeyForAuthToken(authToken: string, options?: EnsureDextoApiKeyOptions): Promise<{
+    dextoApiKey: string;
+    keyId: string | null;
+} | null>;
+//# sourceMappingURL=dexto-api-key.d.ts.map

package/dist/cli/auth/dexto-api-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dexto-api-key.d.ts","sourceRoot":"","sources":["../../../src/cli/auth/dexto-api-key.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,+BAA+B,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;AAEvF,MAAM,WAAW,0BAA0B;IACvC,KAAK,EAAE,+BAA+B,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACrC,QAAQ,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,0BAA0B,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CACzE;AAaD;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BxE;AAED,wBAAsB,wBAAwB,CAAC,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC;IAC9F,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACzB,CAAC,CAsDD;AAED;;;;;;;;;GASG;AACH,wBAAsB,6BAA6B,CAC/C,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,wBAA6B,GACvC,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAAC,CAkE/D"}

package/dist/cli/auth/dexto-api-key.js

@@ -0,0 +1,161 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { ensureDextoGlobalDirectory, getDextoEnvPath, logger } from '@dexto/core';
+import { getDextoApiClient } from './api-client.js';
+import { loadAuth, storeAuth } from './service.js';
+async function ensureOwnerOnlyPermissions(filePath) {
+    try {
+        await fs.chmod(filePath, 0o600);
+    }
+    catch (error) {
+        logger.warn('Failed to set permissions on env file', {
+            filePath,
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+}
+/**
+ * Save DEXTO_API_KEY to the resolved dexto .env path and populate the current
+ * process environment immediately.
+ */
+export async function saveDextoApiKeyToEnv(apiKey) {
+    const envVar = 'DEXTO_API_KEY';
+    const targetEnvPath = getDextoEnvPath();
+    await ensureDextoGlobalDirectory();
+    await fs.mkdir(path.dirname(targetEnvPath), { recursive: true });
+    let envContent = '';
+    try {
+        envContent = await fs.readFile(targetEnvPath, 'utf-8');
+    }
+    catch {
+        // File doesn't exist, start fresh
+    }
+    const lines = envContent.split('\n');
+    const keyPattern = new RegExp(`^${envVar}=`);
+    const keyIndex = lines.findIndex((line) => keyPattern.test(line));
+    if (keyIndex >= 0) {
+        lines[keyIndex] = `${envVar}=${apiKey}`;
+    }
+    else {
+        lines.push(`${envVar}=${apiKey}`);
+    }
+    const nextContent = lines.filter(Boolean).join('\n') + '\n';
+    await fs.writeFile(targetEnvPath, nextContent, { encoding: 'utf-8', mode: 0o600 });
+    await ensureOwnerOnlyPermissions(targetEnvPath);
+    process.env[envVar] = apiKey;
+}
+export async function removeDextoApiKeyFromEnv(options = {}) {
+    const envVar = 'DEXTO_API_KEY';
+    const targetEnvPath = getDextoEnvPath();
+    const clearProcessEnv = () => {
+        const currentValue = process.env[envVar];
+        if (!currentValue)
+            return;
+        if (!options.expectedValue || currentValue === options.expectedValue) {
+            delete process.env[envVar];
+        }
+    };
+    let envContent = '';
+    try {
+        envContent = await fs.readFile(targetEnvPath, 'utf-8');
+    }
+    catch {
+        clearProcessEnv();
+        return { removed: false, targetEnvPath };
+    }
+    const lines = envContent.split('\n');
+    const keyPattern = new RegExp(`^${envVar}=(.*)$`);
+    const keyLineIndex = lines.findIndex((line) => keyPattern.test(line));
+    if (keyLineIndex < 0) {
+        clearProcessEnv();
+        return { removed: false, targetEnvPath };
+    }
+    if (options.expectedValue) {
+        const match = lines[keyLineIndex]?.match(keyPattern);
+        const currentValue = match?.[1] ?? '';
+        if (currentValue !== options.expectedValue) {
+            clearProcessEnv();
+            return { removed: false, targetEnvPath };
+        }
+    }
+    lines.splice(keyLineIndex, 1);
+    const nextLines = lines.filter(Boolean);
+    const nextContent = nextLines.length ? nextLines.join('\n') + '\n' : '';
+    try {
+        await fs.writeFile(targetEnvPath, nextContent, { encoding: 'utf-8', mode: 0o600 });
+        await ensureOwnerOnlyPermissions(targetEnvPath);
+    }
+    catch (error) {
+        clearProcessEnv();
+        throw new Error(`Failed to remove ${envVar} from ${targetEnvPath}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    clearProcessEnv();
+    return { removed: true, targetEnvPath };
+}
+/**
+ * Ensure a Dexto API key exists locally for the current auth session.
+ *
+ * - If a local key exists and validates, it is re-saved to .env (sync) and returned.
+ * - If a local key exists but is invalid, it is rotated (regenerated) and returned.
+ * - If no local key exists, a key is provisioned. If one exists server-side but can't
+ *   be returned, it is regenerated to obtain the value.
+ *
+ * Returns `null` if provisioning fails (OAuth login can still succeed without it).
+ */
+export async function ensureDextoApiKeyForAuthToken(authToken, options = {}) {
+    const status = (level, message) => options.onStatus?.({ level, message });
+    try {
+        const apiClient = getDextoApiClient();
+        const auth = await loadAuth();
+        if (!auth) {
+            throw new Error('Authentication state not found');
+        }
+        if (auth.dextoApiKey) {
+            status('info', 'Validating existing API key...');
+            const isValid = await apiClient.validateDextoApiKey(auth.dextoApiKey);
+            if (isValid) {
+                status('success', 'Existing key is valid');
+                if (!auth.dextoApiKeySource && auth.dextoKeyId) {
+                    await storeAuth({
+                        ...auth,
+                        dextoApiKeySource: 'provisioned',
+                    });
+                }
+                await saveDextoApiKeyToEnv(auth.dextoApiKey);
+                return { dextoApiKey: auth.dextoApiKey, keyId: auth.dextoKeyId ?? null };
+            }
+            status('warning', 'Existing key is invalid, rotating...');
+            const rotated = await apiClient.provisionDextoApiKey(authToken, 'Dexto CLI Key', true);
+            await storeAuth({
+                ...auth,
+                dextoApiKey: rotated.dextoApiKey,
+                dextoKeyId: rotated.keyId,
+                dextoApiKeySource: 'provisioned',
+            });
+            await saveDextoApiKeyToEnv(rotated.dextoApiKey);
+            status('success', 'New key provisioned');
+            return { dextoApiKey: rotated.dextoApiKey, keyId: rotated.keyId };
+        }
+        status('info', 'Provisioning Dexto API key...');
+        let provisioned = await apiClient.provisionDextoApiKey(authToken);
+        if (!provisioned.isNewKey) {
+            status('warning', 'Key exists on server, regenerating...');
+            provisioned = await apiClient.provisionDextoApiKey(authToken, 'Dexto CLI Key', true);
+        }
+        await storeAuth({
+            ...auth,
+            dextoApiKey: provisioned.dextoApiKey,
+            dextoKeyId: provisioned.keyId,
+            dextoApiKeySource: 'provisioned',
+        });
+        await saveDextoApiKeyToEnv(provisioned.dextoApiKey);
+        status('success', 'Dexto API key provisioned');
+        return { dextoApiKey: provisioned.dextoApiKey, keyId: provisioned.keyId };
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        logger.warn('Failed to ensure DEXTO_API_KEY', { error: errorMessage });
+        status('error', `Failed to provision Dexto API key: ${errorMessage}`);
+        return null;
+    }
+}

package/dist/cli/auth/index.d.ts

@@ -1,5 +1,6 @@
 export { type AuthConfig, storeAuth, loadAuth, removeAuth, isAuthenticated, getAuthToken, getDextoApiKey, getAuthFilePath, } from './service.js';
-export { type OAuthResult, performOAuthLogin, DEFAULT_OAUTH_CONFIG } from './oauth.js';
+export { type OAuthResult, type OAuthLoginSession, beginOAuthLogin, performOAuthLogin, DEFAULT_OAUTH_CONFIG, } from './oauth.js';
 export { type UsageSummaryResponse, DextoApiClient, getDextoApiClient } from './api-client.js';
 export { SUPABASE_URL, SUPABASE_ANON_KEY, DEXTO_API_URL } from './constants.js';
+export { type DextoApiKeyProvisionStatus, type DextoApiKeyProvisionStatusLevel, type EnsureDextoApiKeyOptions, ensureDextoApiKeyForAuthToken, saveDextoApiKeyToEnv, removeDextoApiKeyFromEnv, } from './dexto-api-key.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/cli/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cli/auth/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACH,KAAK,UAAU,EACf,SAAS,EACT,QAAQ,EACR,UAAU,EACV,eAAe,EACf,YAAY,EACZ,cAAc,EACd,eAAe,GAClB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,KAAK,WAAW,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvF,OAAO,EAAE,KAAK,oBAAoB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAE/F,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cli/auth/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACH,KAAK,UAAU,EACf,SAAS,EACT,QAAQ,EACR,UAAU,EACV,eAAe,EACf,YAAY,EACZ,cAAc,EACd,eAAe,GAClB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACH,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,eAAe,EACf,iBAAiB,EACjB,oBAAoB,GACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,KAAK,oBAAoB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAE/F,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEhF,OAAO,EACH,KAAK,0BAA0B,EAC/B,KAAK,+BAA+B,EACpC,KAAK,wBAAwB,EAC7B,6BAA6B,EAC7B,oBAAoB,EACpB,wBAAwB,GAC3B,MAAM,oBAAoB,CAAC"}

package/dist/cli/auth/index.js

@@ -1,6 +1,7 @@
 // packages/cli/src/cli/auth/index.ts
 // Public exports for auth module
 export { storeAuth, loadAuth, removeAuth, isAuthenticated, getAuthToken, getDextoApiKey, getAuthFilePath, } from './service.js';
-export { performOAuthLogin, DEFAULT_OAUTH_CONFIG } from './oauth.js';
+export { beginOAuthLogin, performOAuthLogin, DEFAULT_OAUTH_CONFIG, } from './oauth.js';
 export { DextoApiClient, getDextoApiClient } from './api-client.js';
 export { SUPABASE_URL, SUPABASE_ANON_KEY, DEXTO_API_URL } from './constants.js';
+export { ensureDextoApiKeyForAuthToken, saveDextoApiKeyToEnv, removeDextoApiKeyFromEnv, } from './dexto-api-key.js';

package/dist/cli/auth/oauth.d.ts

@@ -14,6 +14,16 @@ export interface OAuthResult {
         name?: string | undefined;
     } | undefined;
 }
+interface CallbackServerOptionsInput {
+    timeoutMs?: number | undefined;
+    signal?: AbortSignal | undefined;
+}
+export interface OAuthLoginSession {
+    authUrl: string;
+    result: Promise<OAuthResult>;
+    cancel: () => void;
+}
+export declare function beginOAuthLogin(config: OAuthConfig, options?: CallbackServerOptionsInput): Promise<OAuthLoginSession>;
 /**
  * Perform OAuth login flow with Supabase
  */

package/dist/cli/auth/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/cli/auth/oauth.ts"],"names":[],"mappings":"AA4CA,UAAU,WAAW;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,IAAI,CAAC,EACC;QACI,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC7B,GACD,SAAS,CAAC;CACnB;AAiQD;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CA2CjF;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAKlC,CAAC"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/cli/auth/oauth.ts"],"names":[],"mappings":"AA8EA,UAAU,WAAW;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,IAAI,CAAC,EACC;QACI,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC7B,GACD,SAAS,CAAC;CACnB;AA4BD,UAAU,0BAA0B;IAChC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CACpC;AAqSD,MAAM,WAAW,iBAAiB;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7B,MAAM,EAAE,MAAM,IAAI,CAAC;CACtB;AAED,wBAAsB,eAAe,CACjC,MAAM,EAAE,WAAW,EACnB,OAAO,GAAE,0BAA+B,GACzC,OAAO,CAAC,iBAAiB,CAAC,CAyC5B;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CA8BjF;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAKlC,CAAC"}

package/dist/cli/auth/oauth.js

@@ -15,17 +15,43 @@ import * as querystring from 'querystring';
 import chalk from 'chalk';
 import * as p from '@clack/prompts';
 import { logger } from '@dexto/core';
-import { readFileSync } from 'node:fs';
+import { getDextoPackageRoot } from '@dexto/agent-management';
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
 import { SUPABASE_URL, SUPABASE_ANON_KEY } from './constants.js';
 // Track active OAuth callback servers by port for cleanup
 const oauthStateStore = new Map();
+function resolveLogoPath() {
+    const packageRoot = getDextoPackageRoot();
+    if (packageRoot) {
+        const standaloneAssetPath = path.join(packageRoot, 'dist', 'cli', 'assets', 'dexto-logo.svg');
+        if (existsSync(standaloneAssetPath)) {
+            return standaloneAssetPath;
+        }
+    }
+    try {
+        const localAssetPath = new URL('../assets/dexto-logo.svg', import.meta.url);
+        const resolvedPath = url.fileURLToPath(localAssetPath);
+        if (existsSync(resolvedPath)) {
+            return resolvedPath;
+        }
+    }
+    catch {
+        // Ignore URL/path errors and return null.
+    }
+    return null;
+}
 const DEXTO_LOGO_DATA_URL = (() => {
     try {
-        const svg = readFileSync(new URL('../assets/dexto-logo.svg', import.meta.url), 'utf-8');
+        const logoPath = resolveLogoPath();
+        if (!logoPath) {
+            return '';
+        }
+        const svg = readFileSync(logoPath, 'utf-8');
         return `data:image/svg+xml;base64,${Buffer.from(svg).toString('base64')}`;
     }
     catch (error) {
-        logger.warn(`Failed to load Dexto logo asset for OAuth screen: ${error instanceof Error ? error.message : String(error)}`);
+        logger.debug(`Failed to load Dexto logo asset for OAuth screen: ${error instanceof Error ? error.message : String(error)}`);
         return '';
     }
 })();
@@ -56,11 +82,52 @@ function ensurePortAvailable(port) {
         });
     });
 }
+function resolveCallbackServerOptions(options) {
+    return {
+        timeoutMs: options.timeoutMs ?? 5 * 60 * 1000,
+        signal: options.signal ?? null,
+    };
+}
 /**
  * Start local HTTP server to receive OAuth callback
  */
-function startCallbackServer(port, config) {
+function startCallbackServer(port, config, options) {
     return new Promise((resolve, reject) => {
+        let settled = false;
+        const timeoutMs = options.timeoutMs;
+        let timeoutHandle = null;
+        let abortHandler = () => { };
+        const safeCloseServer = (server) => {
+            try {
+                if (server.listening) {
+                    server.close();
+                }
+            }
+            catch (_error) {
+                // ignore
+            }
+        };
+        const cleanup = () => {
+            if (timeoutHandle) {
+                clearTimeout(timeoutHandle);
+            }
+            oauthStateStore.delete(port);
+            options.signal?.removeEventListener('abort', abortHandler);
+        };
+        const safeResolve = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            resolve(result);
+        };
+        const safeReject = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            reject(error);
+        };
         const server = http.createServer(async (req, res) => {
             try {
                 if (!req.url) {
@@ -197,8 +264,8 @@ function startCallbackServer(port, config) {
                             if (data.error) {
                                 res.writeHead(200);
                                 res.end('OK');
-                                server.close();
-                                reject(new Error(`OAuth error: ${data.error}`));
+                                safeCloseServer(server);
+                                safeReject(new Error(`OAuth error: ${data.error}`));
                                 return;
                             }
                             if (data.access_token) {
@@ -224,21 +291,21 @@ function startCallbackServer(port, config) {
                                 };
                                 res.writeHead(200);
                                 res.end('OK');
-                                server.close();
-                                resolve(result);
+                                safeCloseServer(server);
+                                safeResolve(result);
                             }
                             else {
                                 res.writeHead(400);
                                 res.end('Missing tokens');
-                                server.close();
-                                reject(new Error('No access token received'));
+                                safeCloseServer(server);
+                                safeReject(new Error('No access token received'));
                             }
                         }
                         catch (_err) {
                             res.writeHead(400);
                             res.end('Invalid data');
-                            server.close();
-                            reject(new Error('Invalid callback data'));
+                            safeCloseServer(server);
+                            safeReject(new Error('Invalid callback data'));
                         }
                     });
                 }
@@ -251,59 +318,95 @@ function startCallbackServer(port, config) {
                 logger.error(`Callback server error: ${error}`);
                 res.writeHead(500);
                 res.end('Internal Server Error');
-                server.close();
-                oauthStateStore.delete(port);
-                reject(error);
+                safeCloseServer(server);
+                safeReject(error);
             }
         });
-        const timeoutMs = 5 * 60 * 1000;
-        const timeoutHandle = setTimeout(() => {
-            server.close();
-            oauthStateStore.delete(port);
-            reject(new Error('Authentication timed out'));
+        timeoutHandle = setTimeout(() => {
+            safeCloseServer(server);
+            safeReject(new Error('Authentication timed out'));
         }, timeoutMs);
-        const cleanup = () => {
-            clearTimeout(timeoutHandle);
-            oauthStateStore.delete(port);
+        abortHandler = () => {
+            const reason = options.signal?.reason;
+            const error = reason instanceof Error
+                ? reason
+                : new Error(typeof reason === 'string' ? reason : 'Authentication cancelled');
+            safeCloseServer(server);
+            safeReject(error);
         };
         server.listen(port, 'localhost', () => {
             logger.debug(`OAuth callback server listening on http://localhost:${port}`);
         });
-        server.on('close', cleanup);
         server.on('error', (error) => {
-            cleanup();
-            reject(new Error(`Failed to start callback server: ${error.message}`));
+            safeCloseServer(server);
+            safeReject(new Error(`Failed to start callback server: ${error.message}`));
         });
+        if (options.signal) {
+            if (options.signal.aborted) {
+                abortHandler();
+            }
+            else {
+                options.signal.addEventListener('abort', abortHandler, { once: true });
+            }
+        }
     });
 }
+export async function beginOAuthLogin(config, options = {}) {
+    const resolvedOptions = resolveCallbackServerOptions(options);
+    const port = await ensurePortAvailable(OAUTH_CALLBACK_PORT);
+    const redirectUri = `http://localhost:${port}`;
+    oauthStateStore.set(port, 'active');
+    logger.debug(`Registered OAuth callback server on port ${port}`);
+    const provider = config.provider || 'google';
+    const authParams = querystring.stringify({
+        redirect_to: redirectUri,
+    });
+    const authUrl = `${config.authUrl}/auth/v1/authorize?provider=${provider}&${authParams}`;
+    const abortController = new AbortController();
+    let upstreamAbortHandler = null;
+    if (resolvedOptions.signal) {
+        const handler = () => abortController.abort(resolvedOptions.signal?.reason);
+        upstreamAbortHandler = handler;
+        if (resolvedOptions.signal.aborted) {
+            handler();
+        }
+        else {
+            resolvedOptions.signal.addEventListener('abort', handler, { once: true });
+        }
+    }
+    const result = startCallbackServer(port, config, {
+        timeoutMs: resolvedOptions.timeoutMs,
+        signal: abortController.signal,
+    }).finally(() => {
+        if (resolvedOptions.signal && upstreamAbortHandler) {
+            resolvedOptions.signal.removeEventListener('abort', upstreamAbortHandler);
+        }
+    });
+    return {
+        authUrl,
+        result,
+        cancel: () => abortController.abort(new Error('Authentication cancelled')),
+    };
+}
 /**
  * Perform OAuth login flow with Supabase
  */
 export async function performOAuthLogin(config) {
     try {
-        const port = await ensurePortAvailable(OAUTH_CALLBACK_PORT);
-        const redirectUri = `http://localhost:${port}`;
-        oauthStateStore.set(port, 'active');
-        logger.debug(`Registered OAuth callback server on port ${port}`);
-        const provider = config.provider || 'google';
-        const authParams = querystring.stringify({
-            redirect_to: redirectUri,
-        });
-        const authUrl = `${config.authUrl}/auth/v1/authorize?provider=${provider}&${authParams}`;
-        const tokenPromise = startCallbackServer(port, config);
+        const session = await beginOAuthLogin(config);
         console.log(chalk.cyan('🌐 Opening browser for authentication...'));
         try {
             const { default: open } = await import('open');
-            await open(authUrl);
+            await open(session.authUrl);
             console.log(chalk.green('✅ Browser opened'));
         }
         catch (_error) {
-            console.log(chalk.yellow(`💡 Please open manually: ${authUrl}`));
+            console.log(chalk.yellow(`💡 Please open manually: ${session.authUrl}`));
         }
         const spinner = p.spinner();
         spinner.start('Waiting for authentication...');
         try {
-            const result = await tokenPromise;
+            const result = await session.result;
             spinner.stop('Authentication successful!');
             return result;
         }

package/dist/cli/auth/service.d.ts

@@ -9,6 +9,7 @@ export interface AuthConfig {
     /** Dexto API key for gateway access (from --api-key or provisioned after OAuth) */
     dextoApiKey?: string | undefined;
     dextoKeyId?: string | undefined;
+    dextoApiKeySource?: 'provisioned' | 'user-supplied' | undefined;
 }
 export declare function storeAuth(config: AuthConfig): Promise<void>;
 export declare function loadAuth(): Promise<AuthConfig | null>;

package/dist/cli/auth/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/cli/auth/service.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,UAAU;IACvB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAiBD,wBAAsB,SAAS,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAQjE;AAED,wBAAsB,QAAQ,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CA4B3D;AAED,wBAAsB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAOhD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CAGxD;AAED,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4C3D;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ7D;AA8CD,wBAAgB,eAAe,IAAI,MAAM,CAExC"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/cli/auth/service.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,UAAU;IACvB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,iBAAiB,CAAC,EAAE,aAAa,GAAG,eAAe,GAAG,SAAS,CAAC;CACnE;AAkBD,wBAAsB,SAAS,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAQjE;AAED,wBAAsB,QAAQ,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CA4B3D;AAED,wBAAsB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAOhD;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CAGxD;AAED,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4C3D;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ7D;AA8CD,wBAAgB,eAAe,IAAI,MAAM,CAExC"}

package/dist/cli/auth/service.js

@@ -16,6 +16,7 @@ const AuthConfigSchema = z
     createdAt: z.number(),
     dextoApiKey: z.string().optional(),
     dextoKeyId: z.string().optional(),
+    dextoApiKeySource: z.enum(['provisioned', 'user-supplied']).optional(),
 })
     .refine((data) => data.token || data.dextoApiKey, {
     message: 'Either token (from OAuth) or dextoApiKey (from --api-key) is required',

package/dist/cli/commands/auth/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/auth/login.ts"],"names":[],"mappings":"AAcA;;GAEG;AACH,wBAAsB,kBAAkB,CACpC,OAAO,GAAE;IACL,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,OAAO,CAAC;CACpB,GACP,OAAO,CAAC,IAAI,CAAC,CAiEf;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAgCxD"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/auth/login.ts"],"names":[],"mappings":"AAiCA;;GAEG;AACH,wBAAsB,kBAAkB,CACpC,OAAO,GAAE;IACL,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,OAAO,CAAC;CACpB,GACP,OAAO,CAAC,IAAI,CAAC,CAqEf;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAwCxD"}