@2kw/ai 5.1.0-dev.7 → 5.2.0-dev.10

package/dist/commands/context.js

@@ -2,11 +2,79 @@ import { Command } from "commander";
 import chalk from "chalk";
 import Table from "cli-table3";
 import { createInterface } from "node:readline/promises";
-import { store, isJsonOutput, getAllContexts, getActiveContextName, getContextCount, setContext, deleteContext, renameContext, setActiveContext, validateContextName, DEFAULT_BASE_URL, } from "../lib/config.js";
-function maskApiKey(key) {
-    if (key.length <= 11)
-        return "****";
-    return key.slice(0, 7) + "..." + key.slice(-4);
+import { store, isJsonOutput, getAllContexts, getActiveContext, getActiveContextName, getContextCount, setContext, deleteContext, renameContext, setActiveContext, updateContext, validateContextName, DEFAULT_BASE_URL, } from "../lib/config.js";
+import { listOrganizations, setActiveOrganization, } from "../lib/auth-service.js";
+import { selectOrganization } from "../lib/auth-session.js";
+import { runAction } from "../lib/client.js";
+import { credentialSummary, maskApiKey, maskSessionToken, redactContext, } from "../lib/redact.js";
+/** An API key carries its organization inside it — there is nothing to switch. */
+const API_KEY_CONTEXT_MESSAGE = "The active context uses an API key, which is bound to one organization. " +
+    'Sign in with "2kw auth login" to switch organizations.';
+/** Same dead end, but claiming an API key the context does not have would lie. */
+const NO_SESSION_MESSAGE = "The active context has no browser session. " +
+    'Sign in with "2kw auth login" to switch organizations.';
+/**
+ * Point the active session context at a different organization.
+ *
+ * The switch is server-side state (the session's active organization), so the
+ * local write that follows is not a cache but the record of what the server was
+ * told. A cached JWT minted for the previous organization would still be
+ * accepted by the API, silently answering as the old org, so it is dropped in
+ * the same write.
+ *
+ * @param orgArg an organization id or slug; omitted means "prompt".
+ */
+export async function performSetOrg(orgArg, deps = {}) {
+    const { listOrgs = listOrganizations, chooseOrg = selectOrganization, setActiveOrg = setActiveOrganization, persist = updateContext, ask, } = deps;
+    const contextName = getActiveContextName();
+    const ctx = getActiveContext();
+    // An API-key context has no session to re-scope: the key itself decides the
+    // organization, and storing an organizationId next to it would be a lie the
+    // next command reads back.
+    if (!ctx?.sessionToken || !ctx.authUrl) {
+        console.error(chalk.red(ctx?.apiKey ? API_KEY_CONTEXT_MESSAGE : NO_SESSION_MESSAGE));
+        process.exitCode = 1;
+        return;
+    }
+    const orgs = await listOrgs(ctx.authUrl, ctx.sessionToken);
+    let org;
+    if (orgArg) {
+        // Both keys, because the id is what `--json` output shows and the slug is
+        // what a human remembers.
+        const match = orgs.find((o) => o.id === orgArg || o.slug === orgArg);
+        if (!match) {
+            const known = orgs.map((o) => o.slug).join(", ");
+            console.error(chalk.red(`No organization "${orgArg}" in this account.` +
+                (known ? ` Available: ${known}.` : "")));
+            process.exitCode = 1;
+            return;
+        }
+        org = match;
+    }
+    else {
+        org = await chooseOrg(orgs, { ask });
+    }
+    await setActiveOrg(ctx.authUrl, ctx.sessionToken, org.id);
+    try {
+        persist(contextName, {
+            organizationId: org.id,
+            cachedJwt: undefined,
+            cachedJwtExp: undefined,
+        });
+    }
+    catch (err) {
+        // Loud on purpose. The server has already switched, so a swallowed write
+        // failure leaves the CLI holding a JWT for the previous organization and no
+        // record of the new one — every later command would quietly act as the old
+        // org, which is far worse than this command failing.
+        const detail = err instanceof Error ? err.message : String(err);
+        console.error(chalk.red(`Switched to ${org.name} on the server, but could not record it in ` +
+            `${store.path}: ${detail}. Later commands may keep using the previous ` +
+            'organization — run "2kw auth login" again once the config store is writable.'));
+        process.exitCode = 1;
+        return;
+    }
+    console.log(chalk.green(`Active organization: ${org.name} (${org.slug})`));
 }
 export function makeContextCommand() {
     const cmd = new Command("context").description("Manage CLI contexts for multiple environments");
@@ -17,16 +85,19 @@ export function makeContextCommand() {
         const contexts = getAllContexts();
         const activeName = getActiveContextName();
         if (isJsonOutput(command)) {
-            console.log(JSON.stringify({ activeContext: activeName, contexts }, null, 2));
+            // Redacted entry by entry: this output is routinely piped into logs and
+            // issue reports, and a session token in one is a live credential.
+            const safe = Object.fromEntries(Object.entries(contexts).map(([name, ctx]) => [name, redactContext(ctx)]));
+            console.log(JSON.stringify({ activeContext: activeName, contexts: safe }, null, 2));
             return;
         }
         const names = Object.keys(contexts);
         if (names.length === 0) {
-            console.log(chalk.dim('No contexts configured. Run "backbone auth login" to get started.'));
+            console.log(chalk.dim('No contexts configured. Run "2kw auth login" to get started.'));
             return;
         }
         const table = new Table({
-            head: ["", "NAME", "BASE URL", "API KEY"].map((h) => chalk.cyan(h)),
+            head: ["", "NAME", "BASE URL", "CREDENTIAL"].map((h) => chalk.cyan(h)),
         });
         for (const name of names) {
             const ctx = contexts[name];
@@ -34,7 +105,7 @@ export function makeContextCommand() {
                 name === activeName ? chalk.green("*") : "",
                 name,
                 ctx.baseUrl,
-                maskApiKey(ctx.apiKey),
+                credentialSummary(ctx),
             ]);
         }
         console.log(table.toString());
@@ -58,8 +129,13 @@ export function makeContextCommand() {
         .argument("<name>", "Context name")
         .option("--base-url <url>", "Base URL")
         .option("--api-key <key>", "API key")
-        .action(async (name, opts) => {
+        .action(async (name, _opts, command) => {
         validateContextName(name);
+        // Merged, not own — the root program declares --base-url and --api-key
+        // too and swallows both, leaving this subcommand's own opts empty for the
+        // flags it documents (see the same note on `auth login`). Without this the
+        // command prompted for values the user had already typed.
+        const opts = command.optsWithGlobals();
         const contexts = getAllContexts();
         if (contexts[name]) {
             throw new Error(`Context "${name}" already exists. Delete it first or choose a different name.`);
@@ -106,16 +182,34 @@ export function makeContextCommand() {
         const contexts = getAllContexts();
         const ctx = contexts[name];
         if (isJsonOutput(command)) {
-            console.log(JSON.stringify({ name, ...(ctx ?? {}) }, null, 2));
+            console.log(JSON.stringify({ name, ...(ctx ? redactContext(ctx) : {}) }, null, 2));
             return;
         }
         if (!ctx) {
-            console.log(chalk.yellow('No active context configured. Run "backbone auth login" to get started.'));
+            console.log(chalk.yellow('No active context configured. Run "2kw auth login" to get started.'));
             return;
         }
-        console.log(`${chalk.cyan("Context")}: ${name}`);
+        console.log(`${chalk.cyan("Context")}:  ${name}`);
         console.log(`${chalk.cyan("Base URL")}: ${ctx.baseUrl}`);
-        console.log(`${chalk.cyan("API Key")}:  ${maskApiKey(ctx.apiKey)}`);
+        if (ctx.sessionToken) {
+            console.log(`${chalk.cyan("Auth")}:     browser session (${ctx.authUrl ?? "no auth URL"})`);
+            console.log(`${chalk.cyan("Session")}:  ${maskSessionToken(ctx.sessionToken)}`);
+            if (ctx.organizationId) {
+                console.log(`${chalk.cyan("Org")}:      ${ctx.organizationId}`);
+            }
+        }
+        else {
+            console.log(`${chalk.cyan("API Key")}:  ${maskApiKey(ctx.apiKey)}`);
+        }
+    });
+    // Interactive by nature (it prompts when no org is named) and it reports its
+    // own outcomes as prose, `--json` or not — same convention as `auth login`.
+    cmd
+        .command("set-org")
+        .description("Switch the active organization (browser-session contexts only)")
+        .argument("[org]", "Organization id or slug (prompts if omitted)")
+        .action(async (orgArg, _opts, command) => {
+        await runAction(command, () => performSetOrg(orgArg));
     });
     cmd
         .command("delete")

package/dist/commands/convert.js

@@ -1,7 +1,7 @@
 import { Command } from "commander";
 import { readFileSync, writeFileSync } from "node:fs";
 import chalk from "chalk";
-import { getClient, runAction } from "../lib/client.js";
+import { getClient, resolveAuthHeader, runAction } from "../lib/client.js";
 import { resolveConfig, isJsonOutput } from "../lib/config.js";
 import { BackboneApiError } from "../lib/errors.js";
 import { formatDetail, withSpinner } from "../lib/output.js";
@@ -138,13 +138,14 @@ function buildFormData(paths, opts) {
 }
 async function multipartConvert(command, formData, endpoint, pipeline) {
     const config = resolveConfig(command);
+    const authHeader = await resolveAuthHeader(config);
     const baseUrl = config.baseUrl.replace(/\/+$/, "");
     const url = pipeline
         ? `${baseUrl}${endpoint}?pipeline=${encodeURIComponent(pipeline)}`
         : `${baseUrl}${endpoint}`;
     const res = await fetch(url, {
         method: "POST",
-        headers: { Authorization: `Bearer ${config.apiKey}` },
+        headers: { Authorization: authHeader },
         body: formData,
     });
     if (!res.ok) {

package/dist/commands/docs.js

@@ -1,14 +1,18 @@
 import { Command } from "commander";
-import { runAction } from "../lib/client.js";
+import { resolveAuthHeader, runAction } from "../lib/client.js";
 import { resolveConfig, isJsonOutput } from "../lib/config.js";
 /* eslint-enable @typescript-eslint/no-explicit-any */
 /**
- * Fetch the OpenAPI spec from the backend.
+ * Fetch the OpenAPI spec from the backend. Takes a ready-made Authorization
+ * header value so the caller decides between an API key and a session JWT.
  */
-async function fetchSpec(baseUrl, apiKey) {
+async function fetchSpec(baseUrl, authHeader) {
     const specUrl = `${baseUrl.replace(/\/+$/, "")}/v3/api-docs`;
+    // Known asymmetry: this GET is outside the typed client, so a 401 on a
+    // session context is not auto-retried with a re-minted JWT. The 30s freshness
+    // margin in ensureJwt makes an in-flight expiry rare enough to live with.
     const res = await fetch(specUrl, {
-        headers: { Authorization: `Bearer ${apiKey}` },
+        headers: { Authorization: authHeader },
     });
     if (!res.ok) {
         if (res.status === 404 || res.status === 403) {
@@ -74,7 +78,7 @@ export function makeDocsCommand() {
         .action(async (_opts, command) => {
         await runAction(command, async () => {
             const config = resolveConfig(command);
-            const spec = await fetchSpec(config.baseUrl, config.apiKey);
+            const spec = await fetchSpec(config.baseUrl, await resolveAuthHeader(config));
             const tags = spec.tags ?? [];
             const paths = spec.paths ?? {};
             // Count endpoints per tag
@@ -115,7 +119,7 @@ export function makeDocsCommand() {
         .action(async (section, _opts, command) => {
         await runAction(command, async () => {
             const config = resolveConfig(command);
-            const spec = await fetchSpec(config.baseUrl, config.apiKey);
+            const spec = await fetchSpec(config.baseUrl, await resolveAuthHeader(config));
             const allTags = spec.tags ?? [];
             const tagNames = allTags.map((t) => t.name);
             if (!tagNames.includes(section)) {

package/dist/commands/transcribe.js

@@ -1,4 +1,5 @@
 import { Command } from "commander";
+import { resolveAuthHeader } from "../lib/client.js";
 import { resolveConfig, isJsonOutput } from "../lib/config.js";
 import { handleError } from "../lib/errors.js";
 import { formatDetail, withSpinner } from "../lib/output.js";
@@ -17,6 +18,7 @@ export function makeTranscribeCommand() {
         const json = isJsonOutput(command);
         try {
             const config = resolveConfig(command);
+            const authHeader = await resolveAuthHeader(config);
             const { blob, filename } = fileToBlob(file);
             const formData = new FormData();
             formData.append("file", blob, filename);
@@ -34,7 +36,7 @@ export function makeTranscribeCommand() {
             const data = await withSpinner("Transcribing...", async () => {
                 const res = await fetch(url, {
                     method: "POST",
-                    headers: { Authorization: `Bearer ${config.apiKey}` },
+                    headers: { Authorization: authHeader },
                     body: formData,
                 });
                 if (!res.ok) {

package/dist/lib/auth-service.d.ts

@@ -0,0 +1,131 @@
+/**
+ * Thin fetch wrappers for the auth service (Better Auth) endpoints the CLI
+ * needs. Deliberately dependency-free: endpoints are stable REST paths and a
+ * full better-auth client would drag react-oriented tooling into the CLI.
+ *
+ * Failures leave through exactly three exits, and callers branch on which:
+ *
+ * 1. **Mapped {@link DeviceTokenResult} values** — {@link pollDeviceToken} only.
+ *    `pending` / `slow_down` / `denied` / `expired` are ordinary device-flow
+ *    states, so they are returned rather than thrown and the poll loop reads as
+ *    the state machine it is instead of a try/catch.
+ * 2. **{@link AuthServiceError}** — the service answered, and the answer was no.
+ *    Carries the HTTP `status` and any OAuth `code`. A response came back, so
+ *    replaying the identical request is usually pointless.
+ * 3. **A raw fetch `TypeError`** ("fetch failed") — the transport never
+ *    completed: DNS, TLS, connection refused. This module neither catches nor
+ *    wraps it; it propagates untouched, and it is the retry-worthy case.
+ *
+ * So `err instanceof AuthServiceError` separates "the server rejected us" from
+ * "we never reached the server" — the split retry and diagnostics need.
+ * `classifyAuthFailure` in errors.ts already covers the transport half.
+ */
+/**
+ * OAuth client id sent with every device-flow request.
+ *
+ * Cross-repo coupling: this must equal the auth service's configured app slug
+ * (`APP_1_SLUG`, default `backbone` — see compose.yaml), which the service's
+ * `validateClient` checks the incoming `client_id` against. Change it on one
+ * side only and every login fails with `invalid_client`.
+ */
+export declare const CLI_CLIENT_ID = "backbone";
+/** RFC 8628 grant type used when exchanging a device code for a session. */
+export declare const DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+/**
+ * Injectable fetch. Every wrapper takes one as its last parameter so tests (and
+ * later retry/proxy layers) can supply their own without touching globals.
+ */
+export type FetchFn = typeof fetch;
+/**
+ * A failed auth-service call. Carries the HTTP status and, when the service
+ * supplied one, the machine-readable OAuth error code (e.g. "invalid_client").
+ */
+export declare class AuthServiceError extends Error {
+    readonly status: number;
+    readonly code?: string | undefined;
+    constructor(message: string, status: number, code?: string | undefined);
+}
+export interface DeviceCodeResponse {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+    /** Optional per RFC 8628 — absent unless the service sends a number, so the
+     *  caller's default (RFC recommends 5 s) is type-driven rather than a guess. */
+    interval?: number;
+    /** Optional per RFC 8628 — see {@link DeviceCodeResponse.interval}. */
+    expires_in?: number;
+}
+/**
+ * Outcome of one device-token poll. The non-"ok" variants are the RFC 8628
+ * states a poll loop acts on; anything else is thrown as an AuthServiceError.
+ */
+export type DeviceTokenResult = {
+    status: "ok";
+    accessToken: string;
+} | {
+    status: "pending";
+} | {
+    status: "slow_down";
+} | {
+    status: "denied";
+} | {
+    status: "expired";
+};
+export interface OrgSummary {
+    id: string;
+    name: string;
+    slug: string;
+}
+export interface SessionInfo {
+    email: string;
+}
+/**
+ * Start a device authorization: returns the user code to display and the URL
+ * to open, plus the polling parameters for {@link pollDeviceToken}.
+ *
+ * The payload is validated rather than cast — the login flow prints these
+ * strings and polls with `device_code`, so a malformed 200 must fail here
+ * instead of surfacing as the literal "undefined" in a user's terminal.
+ */
+export declare function requestDeviceCode(authUrl: string, clientId: string, fetchFn?: FetchFn): Promise<DeviceCodeResponse>;
+/**
+ * Poll once for the session token behind a device code.
+ *
+ * Unlike the other wrappers this does not treat a 400 as fatal: the RFC 8628
+ * flow reports its in-progress and terminal states through the error field of a
+ * 400 body, so those are mapped to results the caller's loop can act on. Only
+ * an outcome that is neither a token nor a known state throws.
+ */
+export declare function pollDeviceToken(authUrl: string, clientId: string, deviceCode: string, fetchFn?: FetchFn): Promise<DeviceTokenResult>;
+/**
+ * Exchange a browser session for a short-lived organization JWT — the token the
+ * API itself accepts. Scoped to the session's currently active organization.
+ */
+export declare function fetchJwt(authUrl: string, sessionToken: string, fetchFn?: FetchFn): Promise<string>;
+/**
+ * Organizations the session's user belongs to, projected to what the CLI shows.
+ *
+ * Entries without a usable string `id` are dropped: an org that cannot be named
+ * in `set-active` is not selectable, and coercing one into the list would put
+ * the string "undefined" in front of the user.
+ */
+export declare function listOrganizations(authUrl: string, sessionToken: string, fetchFn?: FetchFn): Promise<OrgSummary[]>;
+/**
+ * Switch the session's active organization. The choice is server-side state, so
+ * every JWT minted afterwards is scoped to it.
+ */
+export declare function setActiveOrganization(authUrl: string, sessionToken: string, organizationId: string, fetchFn?: FetchFn): Promise<void>;
+/** Who the stored session belongs to — used by `auth status` and login output. */
+export declare function getSessionInfo(authUrl: string, sessionToken: string, fetchFn?: FetchFn): Promise<SessionInfo>;
+/**
+ * Ask the auth service to revoke the session.
+ *
+ * A 200 is *not* proof of revocation: Better Auth answers `{success: true}`
+ * unconditionally and only deletes the session when the bearer actually
+ * resolves to one. Callers should therefore clear local credentials regardless
+ * of the outcome, and must not report "revoked server-side" on the strength of
+ * this call alone.
+ */
+export declare function revokeSession(authUrl: string, sessionToken: string, fetchFn?: FetchFn): Promise<void>;
+//# sourceMappingURL=auth-service.d.ts.map

package/dist/lib/auth-service.js

@@ -0,0 +1,240 @@
+/**
+ * Thin fetch wrappers for the auth service (Better Auth) endpoints the CLI
+ * needs. Deliberately dependency-free: endpoints are stable REST paths and a
+ * full better-auth client would drag react-oriented tooling into the CLI.
+ *
+ * Failures leave through exactly three exits, and callers branch on which:
+ *
+ * 1. **Mapped {@link DeviceTokenResult} values** — {@link pollDeviceToken} only.
+ *    `pending` / `slow_down` / `denied` / `expired` are ordinary device-flow
+ *    states, so they are returned rather than thrown and the poll loop reads as
+ *    the state machine it is instead of a try/catch.
+ * 2. **{@link AuthServiceError}** — the service answered, and the answer was no.
+ *    Carries the HTTP `status` and any OAuth `code`. A response came back, so
+ *    replaying the identical request is usually pointless.
+ * 3. **A raw fetch `TypeError`** ("fetch failed") — the transport never
+ *    completed: DNS, TLS, connection refused. This module neither catches nor
+ *    wraps it; it propagates untouched, and it is the retry-worthy case.
+ *
+ * So `err instanceof AuthServiceError` separates "the server rejected us" from
+ * "we never reached the server" — the split retry and diagnostics need.
+ * `classifyAuthFailure` in errors.ts already covers the transport half.
+ */
+/**
+ * OAuth client id sent with every device-flow request.
+ *
+ * Cross-repo coupling: this must equal the auth service's configured app slug
+ * (`APP_1_SLUG`, default `backbone` — see compose.yaml), which the service's
+ * `validateClient` checks the incoming `client_id` against. Change it on one
+ * side only and every login fails with `invalid_client`.
+ */
+export const CLI_CLIENT_ID = "backbone";
+/** RFC 8628 grant type used when exchanging a device code for a session. */
+export const DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+/**
+ * A failed auth-service call. Carries the HTTP status and, when the service
+ * supplied one, the machine-readable OAuth error code (e.g. "invalid_client").
+ */
+export class AuthServiceError extends Error {
+    status;
+    code;
+    constructor(message, status, code) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = "AuthServiceError";
+    }
+}
+const JSON_HEADERS = { "content-type": "application/json" };
+/** Build an absolute endpoint URL, tolerating trailing slashes on authUrl. */
+function api(authUrl, path) {
+    return `${authUrl.replace(/\/+$/, "")}/api/auth${path}`;
+}
+function bearer(sessionToken) {
+    return { Authorization: `Bearer ${sessionToken}` };
+}
+function str(value) {
+    return typeof value === "string" ? value : undefined;
+}
+function num(value) {
+    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
+/** View a parsed body as a keyed object; anything else (string, null) reads as empty. */
+function rec(value) {
+    return value !== null && typeof value === "object" ? value : {};
+}
+/**
+ * Parse a JSON body, degrading to `{}` rather than throwing on an empty or
+ * non-JSON payload (a gateway's HTML 502, say). Returns `unknown` because these
+ * endpoints legitimately answer with arrays as well as objects.
+ */
+async function readJson(res) {
+    try {
+        return await res.json();
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Return the parsed body of a successful response, or throw an AuthServiceError
+ * built from whatever the service reported.
+ */
+async function requireOk(res, what) {
+    const body = await readJson(res);
+    if (res.ok)
+        return body;
+    const err = rec(body);
+    const detail = str(err.error_description) ?? str(err.message) ?? `HTTP ${res.status}`;
+    throw new AuthServiceError(`${what}: ${detail}`, res.status, str(err.error));
+}
+/**
+ * Start a device authorization: returns the user code to display and the URL
+ * to open, plus the polling parameters for {@link pollDeviceToken}.
+ *
+ * The payload is validated rather than cast — the login flow prints these
+ * strings and polls with `device_code`, so a malformed 200 must fail here
+ * instead of surfacing as the literal "undefined" in a user's terminal.
+ */
+export async function requestDeviceCode(authUrl, clientId, fetchFn = fetch) {
+    const res = await fetchFn(api(authUrl, "/device/code"), {
+        method: "POST",
+        headers: { ...JSON_HEADERS },
+        body: JSON.stringify({ client_id: clientId }),
+    });
+    const body = rec(await requireOk(res, "Device authorization request failed"));
+    const deviceCode = str(body.device_code);
+    const userCode = str(body.user_code);
+    const verificationUri = str(body.verification_uri);
+    if (!deviceCode || !userCode || !verificationUri) {
+        throw new AuthServiceError("Auth service returned an incomplete device authorization " +
+            "(device_code, user_code, and verification_uri are required).", res.status);
+    }
+    return {
+        device_code: deviceCode,
+        user_code: userCode,
+        verification_uri: verificationUri,
+        // RFC 8628 marks the pre-filled URI optional; fall back to the bare
+        // verification URI so callers always have something to open.
+        verification_uri_complete: str(body.verification_uri_complete) ?? verificationUri,
+        interval: num(body.interval),
+        expires_in: num(body.expires_in),
+    };
+}
+/**
+ * Poll once for the session token behind a device code.
+ *
+ * Unlike the other wrappers this does not treat a 400 as fatal: the RFC 8628
+ * flow reports its in-progress and terminal states through the error field of a
+ * 400 body, so those are mapped to results the caller's loop can act on. Only
+ * an outcome that is neither a token nor a known state throws.
+ */
+export async function pollDeviceToken(authUrl, clientId, deviceCode, fetchFn = fetch) {
+    const res = await fetchFn(api(authUrl, "/device/token"), {
+        method: "POST",
+        headers: { ...JSON_HEADERS },
+        body: JSON.stringify({
+            grant_type: DEVICE_GRANT_TYPE,
+            device_code: deviceCode,
+            client_id: clientId,
+        }),
+    });
+    const body = rec(await readJson(res));
+    const accessToken = str(body.access_token);
+    if (res.ok && accessToken)
+        return { status: "ok", accessToken };
+    switch (str(body.error)) {
+        case "authorization_pending":
+            return { status: "pending" };
+        case "slow_down":
+            return { status: "slow_down" };
+        case "access_denied":
+            return { status: "denied" };
+        case "expired_token":
+            return { status: "expired" };
+    }
+    // Neither a token nor a state we know. Say which, because "failed: HTTP 200"
+    // reads as a contradiction when the real fault is a well-formed empty answer.
+    const detail = str(body.error_description) ?? str(body.message);
+    throw new AuthServiceError(detail
+        ? `Device token exchange failed: ${detail}`
+        : `Unrecognized device token response (HTTP ${res.status}, no access_token, no error).`, res.status, str(body.error));
+}
+/**
+ * Exchange a browser session for a short-lived organization JWT — the token the
+ * API itself accepts. Scoped to the session's currently active organization.
+ */
+export async function fetchJwt(authUrl, sessionToken, fetchFn = fetch) {
+    const res = await fetchFn(api(authUrl, "/token"), { headers: bearer(sessionToken) });
+    const body = rec(await requireOk(res, "Could not obtain an organization token"));
+    const token = str(body.token);
+    if (!token) {
+        throw new AuthServiceError("Auth service returned no token for this session.", res.status);
+    }
+    return token;
+}
+/**
+ * Organizations the session's user belongs to, projected to what the CLI shows.
+ *
+ * Entries without a usable string `id` are dropped: an org that cannot be named
+ * in `set-active` is not selectable, and coercing one into the list would put
+ * the string "undefined" in front of the user.
+ */
+export async function listOrganizations(authUrl, sessionToken, fetchFn = fetch) {
+    const res = await fetchFn(api(authUrl, "/organization/list"), {
+        headers: bearer(sessionToken),
+    });
+    const body = await requireOk(res, "Could not list organizations");
+    if (!Array.isArray(body))
+        return [];
+    return body.flatMap((entry) => {
+        const org = rec(entry);
+        const id = str(org.id);
+        if (!id)
+            return [];
+        // A nameless org is still selectable — show the id rather than drop it.
+        return [{ id, name: str(org.name) ?? id, slug: str(org.slug) ?? id }];
+    });
+}
+/**
+ * Switch the session's active organization. The choice is server-side state, so
+ * every JWT minted afterwards is scoped to it.
+ */
+export async function setActiveOrganization(authUrl, sessionToken, organizationId, fetchFn = fetch) {
+    const res = await fetchFn(api(authUrl, "/organization/set-active"), {
+        method: "POST",
+        headers: { ...JSON_HEADERS, ...bearer(sessionToken) },
+        body: JSON.stringify({ organizationId }),
+    });
+    await requireOk(res, "Could not set the active organization");
+}
+/** Who the stored session belongs to — used by `auth status` and login output. */
+export async function getSessionInfo(authUrl, sessionToken, fetchFn = fetch) {
+    const res = await fetchFn(api(authUrl, "/get-session"), {
+        headers: bearer(sessionToken),
+    });
+    const body = rec(await requireOk(res, "Could not read the current session"));
+    const email = str(rec(body.user).email);
+    if (!email) {
+        throw new AuthServiceError("Auth service returned a session without a user email.", res.status);
+    }
+    return { email };
+}
+/**
+ * Ask the auth service to revoke the session.
+ *
+ * A 200 is *not* proof of revocation: Better Auth answers `{success: true}`
+ * unconditionally and only deletes the session when the bearer actually
+ * resolves to one. Callers should therefore clear local credentials regardless
+ * of the outcome, and must not report "revoked server-side" on the strength of
+ * this call alone.
+ */
+export async function revokeSession(authUrl, sessionToken, fetchFn = fetch) {
+    const res = await fetchFn(api(authUrl, "/sign-out"), {
+        method: "POST",
+        headers: { ...JSON_HEADERS, ...bearer(sessionToken) },
+        body: "{}",
+    });
+    await requireOk(res, "Could not sign out");
+}
+//# sourceMappingURL=auth-service.js.map