warpmetal 0.8.13 → 0.9.0

package/README.md

@@ -62,7 +62,7 @@ integration.
 
 The repository also contains a skills-only WarpMetal plugin for the public
 Plugins Directory shared by Codex and ChatGPT. The plugin remains a separate
-artifact from the npm CLI and requires `warpmetal` CLI version 0.8.13 or newer.
+artifact from the npm CLI and requires `warpmetal` CLI version 0.9.0 or newer.
 
 To test the repository marketplace after the plugin lands on `main`:
 
@@ -84,9 +84,13 @@ the repo marketplace is only for development, testing, and direct distribution.
 ## First commands
 
 ```sh
+warpmetal login
+warpmetal auth status
 warpmetal health
 warpmetal catalog
+warpmetal models --auth-mode chatgpt_subscription
 warpmetal order prepare \
+  --account --without-agent-boxes \
   --plan agent \
   --hostname codex-workspace \
   --os '<exact name from warpmetal catalog>' \
@@ -94,11 +98,54 @@ warpmetal order prepare \
   --json
 ```
 
+`warpmetal login` starts WarpMetal account authorization before any SSH key or
+order configuration is needed. It opens the browser approval page by default;
+use `--no-browser` to print the page and user code without opening it. The
+default session requests `cli:read cli:write`; `--read-only` requests only
+`cli:read`. Check the current account with `warpmetal auth status` and revoke
+the CLI session with `warpmetal logout`.
+
+The CLI stores only its own rotating account session under the private
+WarpMetal state directory. Account sessions are separate from browser sessions,
+legacy order owner tokens and SSH credentials, and are bound to the exact
+Identity and account origins that issued them. `--identity-url` and
+`--account-url` accept explicit origins for testing or alternate deployments;
+credentials are never sent after an HTTP redirect or reused for other origins.
+If a refresh response is lost, the CLI clears the local session and requires a
+new login rather than risking reuse of a rotated credential. Logout always
+clears the matching local session, and reports when remote revocation could not
+be confirmed.
+
+Use `warpmetal account orders` and `warpmetal account devices` for your account's
+order history and active servers; add `--task <id>` or `--server <id>` for one
+item. `order prepare --account` binds the unpaid order to the signed-in account
+and uses its verified contact. It never issues an owner token. Login and account
+creation do not require SSH keys or order configuration.
+
+New account preparation defaults to Agent Boxes and an Agent team. Supply the
+selected team in `--runtime-file`; no provider or model is silently selected.
+Use `--without-team` for a single small persistent box, or
+`--without-agent-boxes` for a VPS without boxes. An explicit runtime file keeps
+its existing selections. `warpmetal models --json` supplies published model and
+authentication choices; server readiness checks still apply.
+
+Without `--account`, order preparation retains the existing owner-token
+workflow, including payment and SSH automation. This release adds account order
+preparation and inventory, not a new account payment or runtime-execution grant.
+The account scopes do not authorize charges, renewals, deletion or Fleet access.
+
+`warpmetal catalog` lists VPS plans. `warpmetal models` reads the separate,
+public Agent Teams model catalog. It never signs in to a model provider or
+creates an order. Use `--provider` or `--auth-mode api_key|chatgpt_subscription`
+to filter published entries; JSON preserves the catalog snapshot, provenance,
+freshness state and published authentication modes.
+
 The generated key defaults to
 `${WARPMETAL_HOME:-~/.config/warpmetal}/ssh/warpmetal-codex-workspace`. A
 collision receives a random suffix; existing keys are never overwritten. Once
 checkout returns `serverId`, the CLI binds that ID to the identity so
-`warpmetal server login` and `warpmetal runtime install` can select it without
+`warpmetal server login` is the distinct SSH challenge flow for one server.
+It and `warpmetal runtime install` can select the generated identity without
 an `--identity` flag. Use `--ssh-public-key-file` instead when supplying a
 user-managed public key.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "warpmetal",
-  "version": "0.8.13",
+  "version": "0.9.0",
   "description": "Agent-safe CLI and skill for purchasing, renewing, and managing WarpMetal VPS servers",
   "type": "module",
   "bin": {
@@ -16,7 +16,7 @@
     "node": ">=20.0.0"
   },
   "scripts": {
-    "check": "node --check bin/warpmetal.js && node --check src/api.js && node --check src/args.js && node --check src/cli.js && node --check src/connection.js && node --check src/errors.js && node --check src/host-trust.js && node --check src/install-skill.js && node --check src/installer.js && node --check src/payment.js && node --check src/runtime.js && node --check src/ssh-alias.js && node --check src/ssh.js && node --check src/state.js && node --check src/version.js",
+    "check": "node --check bin/warpmetal.js && node --check src/account-gateway.js && node --check src/account-session.js && node --check src/api.js && node --check src/args.js && node --check src/cli.js && node --check src/connection.js && node --check src/customer-auth.js && node --check src/errors.js && node --check src/host-trust.js && node --check src/install-skill.js && node --check src/installer.js && node --check src/models.js && node --check src/payment.js && node --check src/runtime.js && node --check src/ssh-alias.js && node --check src/ssh.js && node --check src/state.js && node --check src/version.js",
     "plugin:check": "node --test test/plugin.test.js",
     "test": "node --test",
     "prepack": "npm run check && npm test"

package/skills/warpmetal/SKILL.md

@@ -11,7 +11,7 @@ with ad hoc HTTP commands.
 
 ## Start safely
 
-1. Run `warpmetal --version` and require version `0.8.13` or newer for this
+1. Run `warpmetal --version` and require version `0.9.0` or newer for this
    plugin. If it is missing or older, explain the compatibility requirement,
    ask before installing or upgrading software, and use only the official npm
    package from `https://www.npmjs.com/package/warpmetal`.
@@ -44,8 +44,14 @@ Run:
 ```sh
 warpmetal health --json
 warpmetal catalog --json
+warpmetal models --json
 ```
 
+`catalog` is the live VPS plan catalog. `models` is the separate public Agent
+Teams model catalog; it makes one read-only request and never infers model
+availability, credentials, entitlement, or provider support. Filter only with
+published `--provider` or `--auth-mode api_key|chatgpt_subscription` values.
+
 Stop the current purchase if `purchasingReady` is false. In unattended
 scheduling, recheck after 60 seconds, then double the delay after each failed
 check up to 15 minutes and honor a longer `Retry-After`; never hot-loop. In an

package/skills/warpmetal/references/cli-reference.md

@@ -3,6 +3,7 @@
 ## Contents
 
 - Discovery
+- Account authentication
 - Purchase and provisioning
 - SSH identities
 - Renewal and notifications
@@ -17,11 +18,106 @@
 ```sh
 warpmetal health --json
 warpmetal catalog [--plan <planId>] --json
+warpmetal models [--provider <id>] [--auth-mode <api_key|chatgpt_subscription>] [--json]
 ```
 
+## Public model catalog
+
+`warpmetal models` performs a read-only `GET /agent-team-model-catalog` request.
+It preserves the published snapshot metadata, source provenance, freshness state
+and authentication modes. `--provider` and `--auth-mode` filter entries and
+remove recommendations whose published entry is no longer present. The command
+does not infer eligibility or contact a model provider. `catalog` remains the
+VPS plan catalog.
+
 `health` exits with code 3 when the service responds but purchasing is paused.
 The catalog remains useful for read-only discovery.
 
+## Account authentication
+
+```sh
+warpmetal login [--no-browser] [--read-only] --json
+warpmetal auth status --json
+warpmetal logout --json
+```
+
+`login` uses the public `warpmetal-customer-cli` device client. It requests
+`cli:read cli:write` by default or only `cli:read` with `--read-only`, prints the
+bounded verification page and user code to stderr, and opens that page unless
+`--no-browser` is present. Polling follows the server interval and treats
+pending, slow-down, denial, expiry and cancellation as distinct outcomes. JSON
+stdout contains only safe account identity and scope fields; access, refresh
+and device credentials are never output.
+
+The rotating CLI refresh family is independent of browser sessions, legacy
+owner tokens and SSH credentials. It is stored in an owner-only, atomic session
+file under the private WarpMetal state directory. Concurrent commands serialize
+refresh. If refresh completion is ambiguous, the saved session is cleared and a
+new login is required rather than replaying the old credential.
+
+Sessions are bound to the exact Identity and account origins. Defaults are
+`https://identity.warpmetal.com` and `https://warpmetal.com`; explicit
+`--identity-url` and `--account-url` values must be HTTPS origins (localhost may
+use HTTP). Redirects are refused, and credentials for one origin pair are never
+sent to another. `logout` attempts remote family revocation and always clears
+the matching local session, reporting whether revocation was confirmed.
+
+Account login does not grant server SSH access. `warpmetal server login` remains
+the separate, server-specific SSH challenge command.
+
+## Account orders and devices
+
+```sh
+warpmetal account orders [--task <taskId>] --json
+warpmetal account devices [--server <serverId>] --json
+warpmetal order prepare --account --without-agent-boxes \
+  --plan <planId> --hostname <name> --os '<exact catalog OS>' \
+  --generate-ssh-key [--idempotency-key <key>] --json
+```
+
+Reads require `cli:read`; unpaid preparation requires `cli:write`. Only these
+allowlisted operations are granted. Account scope never authorizes a payment,
+renewal, server deletion, credential change or runtime execution. Collections
+return the server's bounded page and `nextCursor`; order history is distinct from
+active devices and can include released or cancelled orders.
+
+Account mode signs in before checking order fields. It derives contact and
+ownership from the signed-in principal, rejects `--email`, uses the private
+account gateway, and records `ownershipMode: account` plus principal/origin in
+private local state without an owner token. Use the same idempotency key and
+unchanged payload to retry an ambiguous preparation. Do not retry a charge.
+Existing owner-token checkout commands do not become account payment commands.
+
+Boxes/team are selected by default for new account preparation: provide
+`--runtime-file` with your chosen team, `--without-team` for one persistent small
+`main` box, or `--without-agent-boxes` for no runtime. Explicit runtime files keep
+their box/team choices, and older scripts without `--account` retain their
+defaults. Server model/runtime readiness gates remain binding.
+
+The optional `teams` sibling of `sandboxes` uses the deployed team-v1 schema:
+
+```json
+{
+  "sandboxes": [{"name":"manager","size":"small"},{"name":"builder","size":"small"}],
+  "teams": {"version":1,"teams":[{
+    "name":"Build team",
+    "members":[
+      {"sandboxName":"manager","role":"manager","providerId":"openai"},
+      {"sandboxName":"builder","role":"worker","providerId":"anthropic"}
+    ],
+    "links":[{"from":"manager","to":"builder","capability":"task.delegate"}],
+    "startPolicy":"manual"
+  }]}
+}
+```
+
+Provider names in this example are preferences, not qualification proof. Optional
+`modelId` and `authMode` must reflect the selected published entry; omitted values
+mean choose later, never automatic credentials. A team has one manager and 2–8
+distinct declared boxes. Credentials, unknown fields, automatic start and
+cross-team links are rejected. Team/setup files are for order preparation;
+`sandbox create --file` accepts a sandbox batch only.
+
 ## Purchase and provisioning
 
 ```sh

package/src/account-gateway.js

@@ -0,0 +1,217 @@
+import { CliError } from "./errors.js";
+import { AccountSessionStore } from "./account-session.js";
+import {
+  CustomerAuthClient,
+  DEFAULT_ACCOUNT_ORIGIN,
+  DEFAULT_IDENTITY_ORIGIN,
+  validateOrigin,
+} from "./customer-auth.js";
+import { USER_AGENT } from "./version.js";
+
+function safeGatewayCode(data) {
+  const value = data?.code ?? data?.error?.code;
+  return typeof value === "string" && /^[a-z][a-z0-9_]{0,63}$/.test(value)
+    ? value
+    : "unavailable";
+}
+
+function allowedAccountRoute(method, path) {
+  if (typeof path !== "string" || !path.startsWith("/")) return false;
+  if (method === "POST") return path === "/account/cli/orders";
+  if (method !== "GET") return false;
+  return (
+    [
+      "/account/cli/whoami",
+      "/account/cli/devices",
+      "/account/cli/orders",
+    ].includes(path) ||
+    /^\/account\/cli\/(?:devices|orders)\/[^/?#]+$/.test(path)
+  );
+}
+
+export class AccountGatewayClient {
+  constructor({
+    accountOrigin,
+    accessToken,
+    scopes = [],
+    fetchImpl = globalThis.fetch,
+    timeoutMs = 30_000,
+  } = {}) {
+    this.accountOrigin = validateOrigin(
+      accountOrigin || DEFAULT_ACCOUNT_ORIGIN,
+      "WarpMetal account URL",
+    );
+    if (typeof accessToken !== "string" || accessToken.length === 0) {
+      throw new CliError("A WarpMetal account access token is required.", {
+        exitCode: 4,
+        code: "invalid_token",
+      });
+    }
+    this.accessToken = accessToken;
+    this.scopes = scopes;
+    this.fetchImpl = fetchImpl;
+    this.timeoutMs = timeoutMs;
+  }
+
+  async request(method, path, { body, idempotencyKey } = {}) {
+    if (!allowedAccountRoute(method, path)) {
+      throw new CliError("The requested account gateway route is not allowed.", {
+        exitCode: 2,
+        code: "account_route_not_allowed",
+      });
+    }
+    const url = new URL(path, `${this.accountOrigin}/`);
+    if (url.origin !== this.accountOrigin || `${url.pathname}${url.search}${url.hash}` !== path) {
+      throw new CliError("The requested account gateway route is not allowed.", {
+        exitCode: 2,
+        code: "account_route_not_allowed",
+      });
+    }
+    const headers = {
+      Accept: "application/json",
+      Authorization: `Bearer ${this.accessToken}`,
+      "User-Agent": USER_AGENT,
+    };
+    if (body !== undefined) headers["Content-Type"] = "application/json";
+    if (idempotencyKey) headers["Idempotency-Key"] = idempotencyKey;
+    let response;
+    try {
+      response = await this.fetchImpl(url, {
+        method,
+        redirect: "manual",
+        headers,
+        body: body === undefined ? undefined : JSON.stringify(body),
+        signal: AbortSignal.timeout(this.timeoutMs),
+      });
+    } catch {
+      throw new CliError(`Could not reach ${url.origin}.`, {
+        exitCode: 3,
+        code: "unavailable",
+      });
+    }
+    if (response.status >= 300 && response.status < 400) {
+      throw new CliError("The account gateway refused an HTTP redirect.", {
+        exitCode: 3,
+        code: "redirect_refused",
+      });
+    }
+    let data;
+    try {
+      const text = await response.text();
+      data = text ? JSON.parse(text) : {};
+    } catch {
+      throw new CliError("The account gateway returned an invalid response.", {
+        exitCode: 3,
+        code: "invalid_response",
+      });
+    }
+    if (!response.ok) {
+      const code = safeGatewayCode(data);
+      throw new CliError(`Account request failed: ${code} (HTTP ${response.status}).`, {
+        exitCode: response.status === 401 || response.status === 403 ? 4 : 3,
+        code,
+      });
+    }
+    return data;
+  }
+
+  whoami() {
+    return this.request("GET", "/account/cli/whoami");
+  }
+
+  orders() {
+    return this.request("GET", "/account/cli/orders");
+  }
+
+  order(id) {
+    return this.request("GET", `/account/cli/orders/${encodeURIComponent(id)}`);
+  }
+
+  devices() {
+    return this.request("GET", "/account/cli/devices");
+  }
+
+  device(id) {
+    return this.request("GET", `/account/cli/devices/${encodeURIComponent(id)}`);
+  }
+
+  prepareOrder(body, idempotencyKey) {
+    if (!this.scopes.includes("cli:write")) {
+      throw new CliError("This account session does not include cli:write.", {
+        exitCode: 4,
+        code: "insufficient_scope",
+      });
+    }
+    return this.request("POST", "/account/cli/orders", { body, idempotencyKey });
+  }
+}
+
+export function accountSessionContext({
+  stateDirectory,
+  identityOrigin = DEFAULT_IDENTITY_ORIGIN,
+  accountOrigin = DEFAULT_ACCOUNT_ORIGIN,
+  fetchImpl = globalThis.fetch,
+} = {}) {
+  const checkedIdentity = validateOrigin(identityOrigin, "WarpMetal Identity URL");
+  const checkedAccount = validateOrigin(accountOrigin, "WarpMetal account URL");
+  return {
+    identityOrigin: checkedIdentity,
+    accountOrigin: checkedAccount,
+    auth: new CustomerAuthClient({
+      identityOrigin: checkedIdentity,
+      accountOrigin: checkedAccount,
+      fetchImpl,
+    }),
+    store: new AccountSessionStore(stateDirectory, {
+      identityOrigin: checkedIdentity,
+      accountOrigin: checkedAccount,
+    }),
+    fetchImpl,
+  };
+}
+
+export async function authenticatedAccountClient(options) {
+  const context = accountSessionContext(options);
+  return context.store.withLock(async () => {
+    let session = await context.store.read();
+    if (!session) return null;
+    if (Date.parse(session.accessExpiresAt) <= Date.now() + 30_000) {
+      let refreshed;
+      try {
+        refreshed = await context.auth.refresh(
+          session.refreshToken,
+          session.scopes,
+        );
+      } catch (error) {
+        await context.store.clear();
+        if (error?.code === "unavailable") {
+          throw new CliError(
+            "Refresh completion is unknown, so the saved session was cleared. Run warpmetal login again.",
+            { exitCode: 3, code: "refresh_ambiguous" },
+          );
+        }
+        throw error;
+      }
+      try {
+        session = { ...session, ...refreshed, refreshedAt: new Date().toISOString() };
+        await context.store.write(session);
+      } catch (error) {
+        await context.store.clear();
+        throw new CliError(
+          "The rotated account session could not be saved, so local credentials were cleared. Run warpmetal login again.",
+          { exitCode: 3, code: "refresh_ambiguous" },
+        );
+      }
+    }
+    return {
+      client: new AccountGatewayClient({
+        accountOrigin: context.accountOrigin,
+        accessToken: session.accessToken,
+        scopes: session.scopes,
+        fetchImpl: context.fetchImpl,
+      }),
+      session,
+      context,
+    };
+  });
+}

package/src/account-session.js

@@ -0,0 +1,209 @@
+import { createHash, randomUUID } from "node:crypto";
+import {
+  chmod,
+  mkdir,
+  open,
+  readFile,
+  rename,
+  stat,
+  unlink,
+} from "node:fs/promises";
+import { isAbsolute, join, resolve } from "node:path";
+
+import { CliError } from "./errors.js";
+
+const SESSION_VERSION = 1;
+const LOCK_WAIT_MS = 45_000;
+const LOCK_STALE_MS = 30_000;
+
+function sessionKey(identityOrigin, accountOrigin) {
+  return createHash("sha256")
+    .update(`${identityOrigin}\n${accountOrigin}\n`, "utf8")
+    .digest("hex");
+}
+
+async function privateDirectory(path) {
+  await mkdir(path, { recursive: true, mode: 0o700 });
+  if (process.platform !== "win32") await chmod(path, 0o700);
+}
+
+async function atomicWrite(path, value) {
+  const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
+  let handle;
+  try {
+    handle = await open(temporary, "wx", 0o600);
+    await handle.writeFile(`${JSON.stringify(value, null, 2)}\n`, "utf8");
+    await handle.sync();
+    await handle.close();
+    handle = undefined;
+    await rename(temporary, path);
+  } catch (error) {
+    await handle?.close().catch(() => {});
+    await unlink(temporary).catch(() => {});
+    throw error;
+  }
+  if (process.platform !== "win32") await chmod(path, 0o600);
+}
+
+function validateSession(value, identityOrigin, accountOrigin) {
+  if (
+    !value ||
+    value.version !== SESSION_VERSION ||
+    value.identityOrigin !== identityOrigin ||
+    value.accountOrigin !== accountOrigin ||
+    typeof value.accessToken !== "string" ||
+    typeof value.refreshToken !== "string" ||
+    !value.refreshToken.startsWith("wmclr_") ||
+    typeof value.accessExpiresAt !== "string" ||
+    !Number.isFinite(Date.parse(value.accessExpiresAt)) ||
+    !Array.isArray(value.scopes) ||
+    value.scopes.length === 0 ||
+    new Set(value.scopes).size !== value.scopes.length ||
+    value.scopes.some((scope) => !["cli:read", "cli:write"].includes(scope)) ||
+    !value.scopes.includes("cli:read")
+  ) {
+    throw new CliError(
+      "The saved WarpMetal account session is invalid. Run warpmetal logout, then login again.",
+      { code: "invalid_session" },
+    );
+  }
+  return value;
+}
+
+function processExists(pid) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code === "EPERM";
+  }
+}
+
+function pause(milliseconds) {
+  return new Promise((resolvePause) => setTimeout(resolvePause, milliseconds));
+}
+
+export class AccountSessionStore {
+  constructor(directory, { identityOrigin, accountOrigin } = {}) {
+    if (typeof directory !== "string" || directory.length === 0) {
+      throw new CliError("A WarpMetal state directory is required.", {
+        exitCode: 2,
+      });
+    }
+    this.stateDirectory = isAbsolute(directory) ? directory : resolve(directory);
+    this.identityOrigin = identityOrigin;
+    this.accountOrigin = accountOrigin;
+    this.directory = join(this.stateDirectory, "account-sessions");
+    const key = sessionKey(identityOrigin, accountOrigin);
+    this.path = join(this.directory, `${key}.json`);
+    this.lockPath = join(this.directory, `${key}.lock`);
+  }
+
+  async read() {
+    try {
+      const value = JSON.parse(await readFile(this.path, "utf8"));
+      return validateSession(value, this.identityOrigin, this.accountOrigin);
+    } catch (error) {
+      if (error?.code === "ENOENT") return null;
+      if (error instanceof CliError) throw error;
+      throw new CliError(
+        "The saved WarpMetal account session could not be read. Run warpmetal logout, then login again.",
+        { code: "invalid_session" },
+      );
+    }
+  }
+
+  async write(session) {
+    await privateDirectory(this.directory);
+    await atomicWrite(
+      this.path,
+      validateSession(
+        {
+          ...session,
+          version: SESSION_VERSION,
+          identityOrigin: this.identityOrigin,
+          accountOrigin: this.accountOrigin,
+        },
+        this.identityOrigin,
+        this.accountOrigin,
+      ),
+    );
+  }
+
+  async clear() {
+    try {
+      await unlink(this.path);
+      return true;
+    } catch (error) {
+      if (error?.code === "ENOENT") return false;
+      throw error;
+    }
+  }
+
+  async #recoverStaleLock() {
+    let info;
+    try {
+      info = await stat(this.lockPath);
+    } catch (error) {
+      if (error?.code === "ENOENT") return;
+      throw error;
+    }
+    if (Date.now() - info.mtimeMs < LOCK_STALE_MS) return;
+    let owner;
+    try {
+      owner = JSON.parse(await readFile(this.lockPath, "utf8"));
+    } catch {
+      owner = null;
+    }
+    if (owner && processExists(owner.pid)) return;
+    try {
+      await unlink(this.lockPath);
+    } catch (error) {
+      if (error?.code !== "ENOENT") throw error;
+    }
+  }
+
+  async withLock(callback) {
+    await privateDirectory(this.directory);
+    const deadline = Date.now() + LOCK_WAIT_MS;
+    let handle;
+    while (!handle) {
+      try {
+        const candidate = await open(this.lockPath, "wx", 0o600);
+        try {
+          await candidate.writeFile(
+            `${JSON.stringify({ pid: process.pid, createdAt: new Date().toISOString() })}\n`,
+            "utf8",
+          );
+          await candidate.sync();
+          handle = candidate;
+        } catch (error) {
+          await candidate.close().catch(() => {});
+          await unlink(this.lockPath).catch(() => {});
+          throw error;
+        }
+      } catch (error) {
+        if (error?.code !== "EEXIST") throw error;
+        await this.#recoverStaleLock();
+        if (Date.now() >= deadline) {
+          throw new CliError(
+            "Another WarpMetal process is updating this account session. Try again.",
+            { exitCode: 3, code: "session_locked" },
+          );
+        }
+        await pause(50 + Math.floor(Math.random() * 75));
+      }
+    }
+    try {
+      return await callback();
+    } finally {
+      await handle.close();
+      try {
+        await unlink(this.lockPath);
+      } catch (error) {
+        if (error?.code !== "ENOENT") throw error;
+      }
+    }
+  }
+}

package/src/api.js

@@ -135,6 +135,10 @@ export class WarpMetalClient {
     return this.request("GET", "/catalog");
   }
 
+  modelCatalog() {
+    return this.request("GET", "/agent-team-model-catalog");
+  }
+
   prepareOrder(body, idempotencyKey) {
     return this.request("POST", "/orders", { body, idempotencyKey });
   }