skydive-cli 0.1.0-beta.239 → 0.1.0-beta.276

package/README.md

@@ -61,6 +61,11 @@ skydive secrets rm <KEY> --agent-id <id>
 
 skydive chat                    # interactive chat TUI (Node; fetches Bun on first run)
 skydive chat -p "<prompt>"       # one-shot, non-interactive (runs under Node)
+
+skydive portal open             # open the portal to this machine, headless
+skydive portal grant --agent <id|name>
+skydive portal revoke --agent <id|name>
+skydive portal status
 ```
 
 Global flags: `--json`, `--quiet`, `--api-url <url>`.
@@ -218,12 +223,44 @@ What to know before enabling it:
   outside the launch directory. Launch from a scoped directory, but treat the
   grant as "this agent can act as me on this machine," not "this agent can only
   see this folder."
-- **Teardown is automatic.** Access is revoked when the TUI unmounts, so
-  quitting the chat drops the grant and reaps any processes the agent spawned.
-- **Interactive only.** Machine sharing is **not** available in `-p`
-  (non-interactive) mode \u2014 `--share-machine` has no effect there and the
-  print path carries no portal code. You can have scripted (`-p`) or local
-  access, not both, in a single invocation.
+- **Teardown drops reachability, not the grant.** Quitting the chat closes the
+  portal connection (the machine becomes unreachable) and reaps any processes
+  the agent spawned, but the per-agent grant itself **persists** until you
+  revoke it (`skydive portal revoke` or the web app). The next time this
+  machine shares, previously granted agents can run commands immediately, with
+  no new prompt.
+- **The TUI is not required.** With `-p`, `--share-machine` shares this machine
+  for the duration of that one run: the portal connects before the prompt is
+  sent, the target agent is granted access (the flag is the consent — there is
+  no prompt to approve), and the connection is torn down when the run ends.
+  For access that outlives a single run, use `skydive portal open` (below).
+
+### Headless machine access (`skydive portal`)
+
+`skydive portal` manages machine sharing without the TUI, for scripts, CI-ish
+environments, and driving agents from other tools:
+
+```sh
+skydive portal open                    # connect and stay in the foreground (ctrl+c to close)
+skydive portal open --agent grace      # \u2026and grant that agent on first connect
+skydive portal open --cwd ~/some/repo  # working directory for the agent's commands
+skydive portal grant --agent grace     # allow an agent (machine must have opened once)
+skydive portal revoke --agent grace     # remove an agent's access
+skydive portal status                   # machines, connection state, granted agents
+```
+
+Semantics match the TUI exactly \u2014 same default-deny grants, same audit log,
+same server-side kill switch. `open` keeps the machine reachable only while
+the process runs (park it in tmux for long-lived access); `grant`/`revoke`
+edit the persistent per-agent access.
+
+Two unattended patterns:
+
+- **One-shot:** `skydive chat -p "<prompt>" --agent <name> --share-machine` \u2014
+  shares, grants the target agent, runs the prompt, tears down.
+- **Daemon:** one `skydive portal open` process, plus plain
+  `skydive chat -p "<prompt>" --agent <name>` one-shots from another shell \u2014
+  cheaper when firing many prompts, since each one skips the connect/grant.
 
 ## Environment variables
 

package/dist/js/bin.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { t as __exportAll } from "./rolldown-runtime-Cz4Tg37Z.mjs";
 import { hideBin } from "yargs/helpers";
 import yargs from "yargs";
 import { createInterface } from "node:readline";
@@ -12,26 +13,10 @@ import { createHash } from "node:crypto";
 import fs from "node:fs";
 import zlib from "node:zlib";
 import { createParser } from "eventsource-parser";
+import os from "node:os";
 
-//#region \0rolldown/runtime.js
-var __defProp = Object.defineProperty;
-var __exportAll = (all, no_symbols) => {
-	let target = {};
-	for (var name in all) {
-		__defProp(target, name, {
-			get: all[name],
-			enumerable: true
-		});
-	}
-	if (!no_symbols) {
-		__defProp(target, Symbol.toStringTag, { value: "Module" });
-	}
-	return target;
-};
-
-//#endregion
 //#region package.json
-var version$1 = "0.1.0-beta.239";
+var version$1 = "0.1.0-beta.276";
 
 //#endregion
 //#region src/types.ts
@@ -743,7 +728,7 @@ const logoutCommand = {
 		else if (!argv.quiet) console.log("Logged out.");
 	}
 };
-const statusCommand = {
+const statusCommand$1 = {
 	command: "status",
 	describe: "Show current authentication state",
 	handler: async (argv) => {
@@ -798,7 +783,7 @@ const statusCommand = {
 const authCommand = {
 	command: "auth",
 	describe: "Manage authentication",
-	builder: (y) => y.command(loginCommand).command(logoutCommand).command(statusCommand).demandCommand(1, "Specify a subcommand: login, logout, status"),
+	builder: (y) => y.command(loginCommand).command(logoutCommand).command(statusCommand$1).demandCommand(1, "Specify a subcommand: login, logout, status"),
 	handler: () => {}
 };
 
@@ -1031,7 +1016,7 @@ const createCommand = {
 		console.log("  Save this key — it will not be shown again.");
 	}
 };
-const revokeCommand = {
+const revokeCommand$1 = {
 	command: "revoke <id>",
 	describe: "Revoke an API key",
 	builder: (y) => y.positional("id", {
@@ -1059,7 +1044,7 @@ const keysCommand = {
 		type: "string",
 		demandOption: true,
 		describe: "Agent ID"
-	}).command(listCommand$3).command(createCommand).command(revokeCommand).demandCommand(1, "Specify a subcommand: list, create, revoke"),
+	}).command(listCommand$3).command(createCommand).command(revokeCommand$1).demandCommand(1, "Specify a subcommand: list, create, revoke"),
 	handler: () => {}
 };
 
@@ -2108,7 +2093,7 @@ const chatCommand = {
 	}).option("share-machine", {
 		type: "boolean",
 		default: false,
-		describe: "Share this machine with the agent over the portal so it can run commands here (default-deny; you approve per agent)"
+		describe: "Share this machine with the agent over the portal so it can run commands here (default-deny; in the TUI you approve per agent, with -p the flag grants the target agent for the run)"
 	}).option("theme", {
 		type: "string",
 		describe: `Pin a colorscheme (disables automatic light/dark switching). One of: ${themes.map((t) => t.id).join(", ")}. Defaults to following the terminal background; also settable via SKYDIVE_THEME.`
@@ -2152,7 +2137,7 @@ const chatCommand = {
 			printError(`Unknown theme "${themeId}". Valid themes: ${themes.map((t) => t.id).join(", ")}`);
 			process.exit(1);
 		}
-		const { runChat } = await import("./boot-CIdJ5Als.mjs");
+		const { runChat } = await import("./boot-FPpnUcyM.mjs");
 		await runChat({
 			appUrl,
 			sessionToken: session.value.sessionToken,
@@ -2183,6 +2168,29 @@ async function runPrintMode({ argv, appUrl }) {
 			process.exit(1);
 		}
 	}
+	let machineShare = null;
+	if (argv["share-machine"]) {
+		const { PortalClient } = await import("./client-_OL8-XGH.mjs").then((n) => n.n);
+		let signalConnected;
+		const connected = new Promise((resolve) => {
+			signalConnected = resolve;
+		});
+		machineShare = new PortalClient({
+			appUrl,
+			sessionToken: session.value.sessionToken,
+			cwd: process.cwd(),
+			onState: (state) => {
+				if (state.status === "connected") signalConnected();
+				if (state.status === "error") console.error(`portal: connection error: ${state.error ?? "unknown"} — retrying`);
+			}
+		});
+		machineShare.enable();
+		if (await Promise.race([connected.then(() => false), new Promise((resolve) => setTimeout(() => resolve(true), 3e4).unref())])) {
+			machineShare.dispose();
+			printError("Could not connect the portal within 30s — machine sharing is unavailable (network, or the portal kill switch is off). Re-run without --share-machine, or check `skydive portal status`.");
+			process.exit(1);
+		}
+	}
 	try {
 		const result = await runPrint({
 			appUrl,
@@ -2190,12 +2198,15 @@ async function runPrintMode({ argv, appUrl }) {
 			prompt,
 			agentSelector: argv.agent ?? null,
 			conversationId: argv.conversation ?? null,
-			json: argv.json
+			json: argv.json,
+			machineShare
 		});
 		if (argv.json) output(argv, result);
 	} catch (error) {
 		printError(error instanceof Error ? error.message : String(error));
 		process.exit(1);
+	} finally {
+		machineShare?.dispose();
 	}
 }
 
@@ -2963,7 +2974,7 @@ var print_exports = /* @__PURE__ */ __exportAll({
 * disambiguate: an `--agent` selector must match exactly one agent, and
 * when it's omitted we only auto-pick if the account has exactly one.
 */
-async function runPrint({ appUrl, sessionToken, prompt, agentSelector, conversationId, json }) {
+async function runPrint({ appUrl, sessionToken, prompt, agentSelector, conversationId, json, machineShare }) {
 	const client = createRestClient({
 		appUrl,
 		sessionToken
@@ -2972,6 +2983,10 @@ async function runPrint({ appUrl, sessionToken, prompt, agentSelector, conversat
 		scope: "org",
 		onPage: null
 	}), agentSelector);
+	if (machineShare) {
+		if (!machineShare.isGranted(agent.id)) await machineShare.grantAgent(agent.id);
+		console.error(`portal: shared this machine with ${agent.name} for this run (grant persists until revoked)`);
+	}
 	let send;
 	try {
 		send = await client.sendMessage({
@@ -3330,7 +3345,7 @@ const switchCommand = {
 				printError("The workspace picker needs the Bun runtime and it could not be set up automatically. Pass a workspace slug instead, or install Bun and retry.");
 				process.exit(1);
 			}
-			const { runWorkspacePicker } = await import("./boot-CIdJ5Als.mjs");
+			const { runWorkspacePicker } = await import("./boot-FPpnUcyM.mjs");
 			await runWorkspacePicker(session);
 			return;
 		}
@@ -3367,10 +3382,301 @@ const workspaceCommand = {
 	handler: (argv) => runList(argv, { hint: true })
 };
 
+//#endregion
+//#region src/chat/portal/machine.ts
+/**
+* Identity this machine registers under when the CLI shares it via the portal.
+*
+* The `-cli` suffix / `(CLI)` label keep a CLI-shared machine a DISTINCT portal
+* device from the same host's Skydive Desktop app. `portal_device` is unique on
+* (org, user, machineName), and directives route to whichever socket holds the
+* device — if the CLI and desktop registered the same name they'd share a
+* device row and both execute every directive. Distinct names also make the
+* grant UI unambiguous about which surface is being authorized.
+*/
+function machineIdentity() {
+	const host = (os.hostname() || "machine").trim().replace(/\.local$/i, "") || "machine";
+	return {
+		machineName: `${host}-cli`,
+		friendlyName: `${host} (CLI)`
+	};
+}
+const INHERITED_ENV = [
+	"HOME",
+	"USER",
+	"LOGNAME",
+	"SHELL",
+	"LANG",
+	"LC_ALL",
+	"TMPDIR",
+	"TERM",
+	"PATH"
+];
+function buildEnv(extra) {
+	const env = {};
+	for (const key of INHERITED_ENV) {
+		const value = process.env[key];
+		if (value !== void 0) env[key] = value;
+	}
+	if (extra) for (const [key, value] of Object.entries(extra)) env[key] = value;
+	return env;
+}
+/**
+* Build the desktop-portal WebSocket URL from the chat origin. Mirrors the Rust
+* desktop client: http→ws, https→wss, scheme-less defaults to wss, and the
+* machine/label ride as query pairs (percent-encoded by URL).
+*/
+function portalWsUrl(appUrl, machine, label) {
+	const base = appUrl.replace(/\/+$/, "");
+	let wsBase;
+	if (base.startsWith("https://")) wsBase = `wss://${base.slice(8)}`;
+	else if (base.startsWith("http://")) wsBase = `ws://${base.slice(7)}`;
+	else wsBase = `wss://${base}`;
+	const url = new URL(`${wsBase}/api/v1/portal/desktop`);
+	url.searchParams.set("machine", machine);
+	url.searchParams.set("label", label);
+	return url.toString();
+}
+
+//#endregion
+//#region src/chat/portal/api.ts
+/**
+* The portal's session-authed REST surface, shared by `PortalClient` (the
+* TUI/`portal open` connection) and the `skydive portal` management
+* commands, so the endpoint contracts and response schemas live in exactly
+* one place.
+*/
+const deviceSchema = z.object({
+	id: z.string(),
+	machineName: z.string(),
+	friendlyName: z.string(),
+	connected: z.boolean(),
+	lastSeen: z.string().nullable(),
+	grantedAgentIds: z.array(z.string())
+});
+const devicesResponseSchema = z.object({
+	devices: z.array(deviceSchema),
+	agents: z.array(z.object({
+		id: z.string(),
+		name: z.string()
+	}))
+});
+const deviceTokenSchema = z.object({ token: z.string().min(1) });
+async function portalFetch(auth, path, init) {
+	const res = await fetch(`${auth.appUrl}${path}`, {
+		method: init.method,
+		headers: {
+			authorization: `Bearer ${auth.sessionToken}`,
+			accept: "application/json",
+			...init.body ? { "content-type": "application/json" } : {}
+		},
+		...init.body ? { body: init.body } : {}
+	});
+	if (!res.ok) {
+		const body = await res.text().then((text) => text.slice(0, 120)).catch(() => "");
+		throw new Error(`${init.method} ${path} failed (${res.status}): ${body}`);
+	}
+	return res.json();
+}
+async function fetchPortalDevices(auth) {
+	const json = await portalFetch(auth, "/api/v1/portal/devices", { method: "GET" });
+	return devicesResponseSchema.parse(json);
+}
+/** Short-lived token the machine presents when dialing the portal WebSocket. */
+async function mintPortalDeviceToken(auth) {
+	const json = await portalFetch(auth, "/api/v1/portal/device-token", { method: "POST" });
+	return deviceTokenSchema.parse(json).token;
+}
+async function grantPortalAccess(auth, { deviceId, agentId }) {
+	await portalFetch(auth, `/api/v1/portal/devices/${encodeURIComponent(deviceId)}/grants`, {
+		method: "POST",
+		body: JSON.stringify({ agentId })
+	});
+}
+async function revokePortalAccess(auth, { deviceId, agentId }) {
+	await portalFetch(auth, `/api/v1/portal/devices/${encodeURIComponent(deviceId)}/grants/${encodeURIComponent(agentId)}`, { method: "DELETE" });
+}
+/**
+* The device row for a given machine identity. Matching is by `machineName`
+* equality — the stable per-surface handle (`<host>-cli` vs the desktop's
+* `<host>`), not the display label.
+*/
+function findThisDevice(devices, machineName) {
+	return devices.find((device) => device.machineName === machineName) ?? null;
+}
+
+//#endregion
+//#region src/commands/portal.ts
+/**
+* Resolve everything a grant/revoke needs in one round trip: the devices
+* response carries both the user's machines and the org's agent roster, so
+* the `--agent` selector (id or name) resolves without a separate paginated
+* agent listing.
+*/
+async function resolveGrantTarget(argv) {
+	const session = requireSession(argv);
+	const { devices, agents } = await fetchPortalDevices(session);
+	const agent = resolveAgent(agents, argv.agent);
+	const { machineName } = machineIdentity();
+	const device = findThisDevice(devices, machineName);
+	if (!device) throw new Error(`this machine (${machineName}) isn't registered with the portal yet — run \`skydive portal open\` once to register it.`);
+	return {
+		session,
+		agent,
+		device
+	};
+}
+function agentOption(y) {
+	return y.option("agent", {
+		type: "string",
+		demandOption: true,
+		describe: "Agent, by id or name"
+	});
+}
+const openCommand = {
+	command: "open",
+	describe: "Open the portal to this machine so granted agents can run commands here (stays in the foreground; ctrl+c to close)",
+	builder: (y) => y.option("agent", {
+		type: "string",
+		describe: "Also grant this agent (by id or name) access to the machine once connected"
+	}).option("cwd", {
+		type: "string",
+		describe: "Working directory for the agent's commands (default: the current directory)"
+	}),
+	handler: async (argv) => {
+		const session = requireSession(argv);
+		const agent = argv.agent ? resolveAgent((await fetchPortalDevices(session)).agents, argv.agent) : null;
+		const cwd = argv.cwd ? path.resolve(argv.cwd) : process.cwd();
+		const { machineName } = machineIdentity();
+		const { PortalClient } = await import("./client-_OL8-XGH.mjs").then((n) => n.n);
+		let lastLine = "";
+		let signalConnected;
+		const connected = new Promise((resolve) => {
+			signalConnected = resolve;
+		});
+		const client = new PortalClient({
+			appUrl: session.appUrl,
+			sessionToken: session.sessionToken,
+			cwd,
+			onState: (state) => {
+				if (state.status === "connected") signalConnected();
+				const line = state.status === "error" ? `portal: connection error: ${state.error ?? "unknown"} — retrying` : `portal: ${state.status}`;
+				if (line === lastLine) return;
+				lastLine = line;
+				if (state.status === "error") console.error(line);
+				else if (!argv.quiet) console.log(line);
+			}
+		});
+		const stop = () => {
+			client.dispose();
+			process.exit(0);
+		};
+		process.on("SIGINT", stop);
+		process.on("SIGTERM", stop);
+		client.enable();
+		await connected;
+		if (agent) {
+			await client.grantAgent(agent.id);
+			console.log(`portal: granted ${agent.name} access to this machine (persists until revoked)`);
+		}
+		console.log(`portal: open — granted agents can run commands on ${machineName} as your user, cwd ${cwd}. ctrl+c to close.`);
+		await new Promise(() => {});
+	}
+};
+const grantCommand = {
+	command: "grant",
+	describe: "Allow an agent to run commands on this machine (persists until revoked)",
+	builder: agentOption,
+	handler: async (argv) => {
+		const { session, agent, device } = await resolveGrantTarget(argv);
+		await grantPortalAccess(session, {
+			deviceId: device.id,
+			agentId: agent.id
+		});
+		if (argv.json) {
+			output(argv, {
+				deviceId: device.id,
+				agentId: agent.id
+			});
+			return;
+		}
+		console.log(`Granted ${agent.name} access to ${device.friendlyName}. The agent can run commands here whenever its portal is open (\`skydive portal open\` or the chat TUI). Revoke with \`skydive portal revoke --agent ${agent.name}\`.`);
+	}
+};
+const revokeCommand = {
+	command: "revoke",
+	describe: "Remove an agent's access to this machine",
+	builder: agentOption,
+	handler: async (argv) => {
+		const { session, agent, device } = await resolveGrantTarget(argv);
+		await revokePortalAccess(session, {
+			deviceId: device.id,
+			agentId: agent.id
+		});
+		if (argv.json) {
+			output(argv, {
+				deviceId: device.id,
+				agentId: agent.id
+			});
+			return;
+		}
+		console.log(`Revoked ${agent.name}'s access to ${device.friendlyName}.`);
+	}
+};
+const statusCommand = {
+	command: "status",
+	describe: "Show your portal machines, connection state, and granted agents",
+	handler: async (argv) => {
+		const { devices, agents } = await fetchPortalDevices(requireSession(argv));
+		if (argv.json) {
+			output(argv, {
+				devices,
+				agents
+			});
+			return;
+		}
+		if (devices.length === 0) {
+			console.log("No machines registered. Run `skydive portal open` to register this one.");
+			return;
+		}
+		const { headers, rows } = buildDeviceTable(devices, agents, machineIdentity().machineName);
+		printTable(headers, rows);
+	}
+};
+/**
+* Build the `portal status` table. Grant ids are shown as agent names when the
+* org roster resolves them (deleted agents fall back to the raw id), and the
+* device this CLI would register as is marked so "which row is me" doesn't
+* depend on knowing the `-cli` naming convention.
+*/
+function buildDeviceTable(devices, agents, thisMachineName) {
+	const agentNames = new Map(agents.map((a) => [a.id, a.name]));
+	return {
+		headers: [
+			"Machine",
+			"Connected",
+			"Last seen",
+			"Granted agents"
+		],
+		rows: devices.map((device) => [
+			device.machineName === thisMachineName ? `${device.friendlyName} *` : device.friendlyName,
+			device.connected ? "yes" : "no",
+			device.lastSeen ?? "-",
+			device.grantedAgentIds.length === 0 ? "-" : device.grantedAgentIds.map((id) => agentNames.get(id) ?? id).join(", ")
+		])
+	};
+}
+const portalCommand = {
+	command: "portal",
+	describe: "Open this machine's portal to agents and manage their access",
+	builder: (y) => y.command(openCommand).command(grantCommand).command(revokeCommand).command(statusCommand).demandCommand(1, "Specify a subcommand: open, grant, revoke, status"),
+	handler: () => {}
+};
+
 //#endregion
 //#region src/cli.ts
 function createCli(argv) {
-	return yargs(argv).scriptName("skydive").usage("$0 <command> [options]").example("skydive auth login", "Store your API key").example("skydive chat", "Open the interactive chat TUI (prod)").example("skydive chat --api-url http://localhost:4500", "Chat against a local dev API").example("skydive agents list", "List your agents").example("skydive keys create \"my-key\"", "Create an API key").example("skydive secrets set OPENAI_API_KEY --agent-id <id>", "Set a secret (value from stdin)").example("skydive workspace list", "List workspaces on your account").example("skydive workspace switch acme-team", "Switch which workspace `skydive chat` uses").option("json", {
+	return yargs(argv).scriptName("skydive").usage("$0 <command> [options]").example("skydive auth login", "Store your API key").example("skydive chat", "Open the interactive chat TUI (prod)").example("skydive chat --api-url http://localhost:4500", "Chat against a local dev API").example("skydive agents list", "List your agents").example("skydive keys create \"my-key\"", "Create an API key").example("skydive secrets set OPENAI_API_KEY --agent-id <id>", "Set a secret (value from stdin)").example("skydive workspace list", "List workspaces on your account").example("skydive workspace switch acme-team", "Switch which workspace `skydive chat` uses").example("skydive portal open --agent grace", "Open the portal to this machine for an agent, headless (no TUI)").option("json", {
 		type: "boolean",
 		default: false,
 		global: true,
@@ -3384,7 +3690,7 @@ function createCli(argv) {
 		type: "string",
 		global: true,
 		describe: "Override API base URL"
-	}).command(authCommand).command(chatCommand).command(messagesCommand).command(conversationsCommand).command(agentsCommand).command(keysCommand).command(secretsCommand).command(workspaceCommand).demandCommand(1, "Specify a command. Run --help for usage.").strict().wrap(null).version(version$1).alias("v", "version").alias("h", "help").help().fail((msg, err) => {
+	}).command(authCommand).command(chatCommand).command(messagesCommand).command(conversationsCommand).command(agentsCommand).command(keysCommand).command(secretsCommand).command(workspaceCommand).command(portalCommand).demandCommand(1, "Specify a command. Run --help for usage.").strict().wrap(null).version(version$1).alias("v", "version").alias("h", "help").help().fail((msg, err) => {
 		printError(err ? err instanceof Error ? err.message : String(err) : msg ?? "Unknown error");
 		process.exit(1);
 	});
@@ -3457,4 +3763,4 @@ function resolveArgv(args, tty = {
 createCli(resolveArgv(hideBin(process.argv))).parse();
 
 //#endregion
-export { getSavedTheme as A, themesForMode as C, DEFAULT_API_URL as D, setActiveWorkspace as E, saveTheme as M, DEFAULT_APP_URL as O, themeVersion as S, listWorkspaces as T, noColorRequested as _, parseOauthConnectParams as a, themeMode as b, parseConnectCard as c, HttpError as d, createRestClient as f, monoTheme as g, findTheme as h, parseExternalOauthConnectParams as i, resolveWebUrl as j, getConfigPath as k, errorMessage as l, applyTheme as m, MASK_CHAR as n, reconcileMaskedInput as o, DEFAULT_THEME_ID as p, cardActionErrorMessage as r, resolveConnectUrl as s, resolveAgent as t, isRecord as u, theme as v, getActiveWorkspaceId as w, themeModeFromColorFgBg as x, themeForMode as y };
+export { themesForMode as A, monoTheme as C, themeMode as D, themeForMode as E, DEFAULT_APP_URL as F, getConfigPath as I, getSavedTheme as L, listWorkspaces as M, setActiveWorkspace as N, themeModeFromColorFgBg as O, DEFAULT_API_URL as P, resolveWebUrl as R, findTheme as S, theme as T, isRecord as _, buildEnv as a, DEFAULT_THEME_ID as b, resolveAgent as c, parseExternalOauthConnectParams as d, parseOauthConnectParams as f, errorMessage as g, parseConnectCard as h, mintPortalDeviceToken as i, getActiveWorkspaceId as j, themeVersion as k, MASK_CHAR as l, resolveConnectUrl as m, findThisDevice as n, machineIdentity as o, reconcileMaskedInput as p, grantPortalAccess as r, portalWsUrl as s, fetchPortalDevices as t, cardActionErrorMessage as u, HttpError as v, noColorRequested as w, applyTheme as x, createRestClient as y, saveTheme as z };