@debian777/kairos-mcp 3.2.0-pre.0 → 3.2.0-pre.1

package/dist/cli/api-client.d.ts

@@ -1,31 +1,31 @@
 /**
- * API Client for KAIROS REST API
+ * API Client for KAIROS REST API.
+ * Returns canonical response shapes (no metadata wrapper).
  */
-export interface ApiResponse<T = any> {
-    data?: T;
-    error?: string;
-    message?: string;
-    metadata?: {
-        duration_ms?: number;
-        cached?: boolean;
-    };
-}
+import type { SearchOutput } from '../tools/kairos_search_schema.js';
+import type { BeginOutput } from '../tools/kairos_begin.js';
+import type { NextOutput } from '../tools/kairos_next.js';
+import type { AttestOutput } from '../tools/kairos_attest_schema.js';
+import type { MintOutput } from '../tools/kairos_mint_schema.js';
+import type { UpdateOutput } from '../tools/kairos_update_schema.js';
+import type { DeleteOutput } from '../tools/kairos_delete_schema.js';
 export declare class ApiClient {
     private baseUrl;
-    constructor(baseUrl?: string);
+    private openInBrowser;
+    constructor(baseUrl?: string, openInBrowser?: boolean);
     private request;
-    search(query: string): Promise<ApiResponse>;
-    begin(uri: string): Promise<ApiResponse>;
-    next(uri: string, solution?: any): Promise<ApiResponse>;
+    search(query: string): Promise<SearchOutput>;
+    begin(uri: string): Promise<BeginOutput>;
+    next(uri: string, solution?: unknown): Promise<NextOutput>;
     mint(markdown: string, options?: {
         llmModelId?: string;
         force?: boolean;
-    }): Promise<ApiResponse>;
-    update(uris: string[], markdownDoc?: string[], updates?: Record<string, any>): Promise<ApiResponse>;
-    delete(uris: string[]): Promise<ApiResponse>;
+    }, isRetryAfterLogin?: boolean): Promise<MintOutput>;
+    update(uris: string[], markdownDoc?: string[], updates?: Record<string, unknown>): Promise<UpdateOutput>;
+    delete(uris: string[]): Promise<DeleteOutput>;
     attest(uri: string, outcome: 'success' | 'failure', message: string, options?: {
         qualityBonus?: number;
         llmModelId?: string;
-    }): Promise<ApiResponse>;
+    }): Promise<AttestOutput>;
 }
 //# sourceMappingURL=api-client.d.ts.map

package/dist/cli/api-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../../src/cli/api-client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,MAAM,WAAW,WAAW,CAAC,CAAC,GAAG,GAAG;IAChC,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE;QACP,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC;CACL;AAED,qBAAa,SAAS;IAClB,OAAO,CAAC,OAAO,CAAS;gBAEZ,OAAO,CAAC,EAAE,MAAM;YAOd,OAAO;IAmCf,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAO3C,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAOxC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC;IAOvD,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAsChG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;IAOnG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAO5C,MAAM,CACR,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,SAAS,GAAG,SAAS,EAC9B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GACzD,OAAO,CAAC,WAAW,CAAC;CAY1B"}
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../../src/cli/api-client.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAErE,qBAAa,SAAS;IAClB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,aAAa,CAAU;gBAEnB,OAAO,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,OAAO;YASvC,OAAO;IA8Df,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAO5C,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAOxC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;IAO1D,IAAI,CACN,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAClD,iBAAiB,UAAQ,GAC1B,OAAO,CAAC,UAAU,CAAC;IA8ChB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC;IAOxG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAO7C,MAAM,CACR,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,SAAS,GAAG,SAAS,EAC9B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GACzD,OAAO,CAAC,YAAY,CAAC;CAY3B"}

package/dist/cli/api-client.js

@@ -1,37 +1,73 @@
 /**
- * API Client for KAIROS REST API
+ * API Client for KAIROS REST API.
+ * Returns canonical response shapes (no metadata wrapper).
  */
+import { AuthRequiredError } from './auth-error.js';
 import { getApiUrl } from './config.js';
+import { getDefaultApiUrlFromFile, readConfig } from './config-file.js';
+import { loginWithBrowser } from './commands/login.js';
 export class ApiClient {
     baseUrl;
-    constructor(baseUrl) {
-        // Check environment variable first (set by CLI hook), then parameter, then default
-        this.baseUrl = process.env['KAIROS_API_URL'] || baseUrl || getApiUrl();
-        // Remove trailing slash
+    openInBrowser;
+    constructor(baseUrl, openInBrowser) {
+        // Precedence: env, then parameter, then config file (sync URL only), then default. openInBrowser true = auto-login on 401 or no token
+        const configUrl = getDefaultApiUrlFromFile();
+        this.baseUrl = process.env['KAIROS_API_URL'] || baseUrl || configUrl || getApiUrl();
         this.baseUrl = this.baseUrl.replace(/\/$/, '');
+        const noAutoLogin = process.env['KAIROS_CLI_NO_AUTO_LOGIN'] === '1' || process.env['KAIROS_CLI_NO_AUTO_LOGIN'] === 'true';
+        this.openInBrowser = !noAutoLogin && (openInBrowser !== false);
     }
-    async request(endpoint, options = {}) {
+    async request(endpoint, options = {}, isRetryAfterLogin = false) {
         const url = `${this.baseUrl}${endpoint}`;
         const defaultHeaders = {
             'Content-Type': 'application/json',
         };
-        const bearer = process.env['KAIROS_BEARER_TOKEN'];
+        let bearer = (await readConfig(this.baseUrl)).bearerToken;
+        if (!bearer && this.openInBrowser && !isRetryAfterLogin) {
+            const ok = await loginWithBrowser(this.baseUrl);
+            if (ok)
+                return this.request(endpoint, options, true);
+        }
         if (bearer) {
             defaultHeaders['Authorization'] = `Bearer ${bearer}`;
         }
-        const response = await fetch(url, {
-            ...options,
-            headers: {
-                ...defaultHeaders,
-                ...(options.headers || {}),
-            },
-        });
+        const requestTimeoutMs = 15_000;
+        const ac = new AbortController();
+        const timeoutId = setTimeout(() => ac.abort(), requestTimeoutMs);
+        let response;
+        try {
+            response = await fetch(url, {
+                ...options,
+                signal: ac.signal,
+                headers: {
+                    ...defaultHeaders,
+                    ...(options.headers || {}),
+                },
+            });
+        }
+        catch (err) {
+            clearTimeout(timeoutId);
+            if (err instanceof Error && err.name === 'AbortError') {
+                throw new Error(`Request to ${url} timed out after ${requestTimeoutMs / 1000}s`);
+            }
+            throw err;
+        }
+        clearTimeout(timeoutId);
         const data = await response.json().catch(() => {
             throw new Error(`Failed to parse response from ${url}`);
         });
         if (!response.ok) {
             const errorData = data;
-            throw new Error(errorData.message || errorData.error || `HTTP ${response.status}: ${response.statusText}`);
+            const msg = errorData.message || errorData.error || `HTTP ${response.status}: ${response.statusText}`;
+            if (response.status === 401 && errorData.login_url) {
+                if (this.openInBrowser && !isRetryAfterLogin) {
+                    const ok = await loginWithBrowser(this.baseUrl);
+                    if (ok)
+                        return this.request(endpoint, options, true);
+                }
+                throw new AuthRequiredError(`${msg}\n\nLog in at:\n${errorData.login_url}`, errorData.login_url);
+            }
+            throw new Error(msg);
         }
         return data;
     }
@@ -53,12 +89,12 @@ export class ApiClient {
             body: JSON.stringify({ uri, solution }),
         });
     }
-    async mint(markdown, options) {
+    async mint(markdown, options, isRetryAfterLogin = false) {
         const url = `${this.baseUrl}/api/kairos_mint/raw`;
         const headers = {
             'Content-Type': 'text/markdown',
         };
-        const bearer = process.env['KAIROS_BEARER_TOKEN'];
+        const bearer = (await readConfig(this.baseUrl)).bearerToken;
         if (bearer) {
             headers['Authorization'] = `Bearer ${bearer}`;
         }
@@ -77,8 +113,16 @@ export class ApiClient {
             throw new Error(`Failed to parse response from ${url}`);
         });
         if (!response.ok) {
-            const errorData = data;
-            throw new Error(errorData.message || errorData.error || `HTTP ${response.status}: ${response.statusText}`);
+            const msg = data.message || data.error || `HTTP ${response.status}: ${response.statusText}`;
+            if (response.status === 401 && data.login_url) {
+                if (this.openInBrowser && !isRetryAfterLogin) {
+                    const ok = await loginWithBrowser(this.baseUrl);
+                    if (ok)
+                        return this.mint(markdown, options, true);
+                }
+                throw new AuthRequiredError(`${msg}\n\nLog in at:\n${data.login_url}`, data.login_url);
+            }
+            throw new Error(msg);
         }
         return data;
     }
@@ -101,7 +145,7 @@ export class ApiClient {
                 uri,
                 outcome,
                 message,
-                quality_bonus: options?.qualityBonus || 0,
+                quality_bonus: options?.qualityBonus ?? 0,
                 llm_model_id: options?.llmModelId,
             }),
         });

package/dist/cli/api-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../../src/cli/api-client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAYxC,MAAM,OAAO,SAAS;IACV,OAAO,CAAS;IAExB,YAAY,OAAgB;QACxB,mFAAmF;QACnF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC;QACvE,wBAAwB;QACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnD,CAAC;IAEO,KAAK,CAAC,OAAO,CACjB,QAAgB,EAChB,UAAuB,EAAE;QAEzB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC;QACzC,MAAM,cAAc,GAA2B;YAC3C,cAAc,EAAE,kBAAkB;SACrC,CAAC;QACF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAClD,IAAI,MAAM,EAAE,CAAC;YACT,cAAc,CAAC,eAAe,CAAC,GAAG,UAAU,MAAM,EAAE,CAAC;QACzD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC9B,GAAG,OAAO;YACV,OAAO,EAAE;gBACL,GAAG,cAAc;gBACjB,GAAG,CAAC,OAAO,CAAC,OAAiC,IAAI,EAAE,CAAC;aACvD;SACJ,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YAC1C,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QAC5D,CAAC,CAAmB,CAAC;QAErB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,IAAW,CAAC;YAC9B,MAAM,IAAI,KAAK,CACX,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,KAAK,IAAI,QAAQ,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,EAAE,CAC5F,CAAC;QACN,CAAC;QAED,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE;YACtC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;SAClC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC;SAChC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,QAAc;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;SAC1C,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,OAAkD;QAC3E,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,sBAAsB,CAAC;QAClD,MAAM,OAAO,GAA2B;YACpC,cAAc,EAAE,eAAe;SAClC,CAAC;QACF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAClD,IAAI,MAAM,EAAE,CAAC;YACT,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,MAAM,EAAE,CAAC;QAClD,CAAC;QAED,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;YACtB,OAAO,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;QACnD,CAAC;QAED,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;YACjB,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC;QACvC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC9B,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,QAAQ;SACjB,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YAC1C,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QAC5D,CAAC,CAAgB,CAAC;QAElB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,IAAW,CAAC;YAC9B,MAAM,IAAI,KAAK,CACX,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,KAAK,IAAI,QAAQ,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,EAAE,CAC5F,CAAC;QACN,CAAC;QAED,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAc,EAAE,WAAsB,EAAE,OAA6B;QAC9E,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE;YACtC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;SACrE,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAc;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE;YACtC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;SACjC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,MAAM,CACR,GAAW,EACX,OAA8B,EAC9B,OAAe,EACf,OAAwD;QAExD,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE;YACtC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACjB,GAAG;gBACH,OAAO;gBACP,OAAO;gBACP,aAAa,EAAE,OAAO,EAAE,YAAY,IAAI,CAAC;gBACzC,YAAY,EAAE,OAAO,EAAE,UAAU;aACpC,CAAC;SACL,CAAC,CAAC;IACP,CAAC;CACJ"}
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../../src/cli/api-client.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,wBAAwB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AASvD,MAAM,OAAO,SAAS;IACV,OAAO,CAAS;IAChB,aAAa,CAAU;IAE/B,YAAY,OAAgB,EAAE,aAAuB;QACjD,sIAAsI;QACtI,MAAM,SAAS,GAAG,wBAAwB,EAAE,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,OAAO,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;QACpF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,KAAK,MAAM,CAAC;QAC1H,IAAI,CAAC,aAAa,GAAG,CAAC,WAAW,IAAI,CAAC,aAAa,KAAK,KAAK,CAAC,CAAC;IACnE,CAAC;IAEO,KAAK,CAAC,OAAO,CACjB,QAAgB,EAChB,UAAuB,EAAE,EACzB,iBAAiB,GAAG,KAAK;QAEzB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC;QACzC,MAAM,cAAc,GAA2B;YAC3C,cAAc,EAAE,kBAAkB;SACrC,CAAC;QACF,IAAI,MAAM,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;QAC1D,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,aAAa,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACtD,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAChD,IAAI,EAAE;gBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACT,cAAc,CAAC,eAAe,CAAC,GAAG,UAAU,MAAM,EAAE,CAAC;QACzD,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,CAAC;QAChC,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,gBAAgB,CAAC,CAAC;QACjE,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACD,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBACxB,GAAG,OAAO;gBACV,MAAM,EAAE,EAAE,CAAC,MAAM;gBACjB,OAAO,EAAE;oBACL,GAAG,cAAc;oBACjB,GAAG,CAAC,OAAO,CAAC,OAAiC,IAAI,EAAE,CAAC;iBACvD;aACJ,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,YAAY,CAAC,SAAS,CAAC,CAAC;YACxB,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACpD,MAAM,IAAI,KAAK,CAAC,cAAc,GAAG,oBAAoB,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,GAAG,CAAC;QACd,CAAC;QACD,YAAY,CAAC,SAAS,CAAC,CAAC;QAExB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YAC1C,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,IAAgE,CAAC;YACnF,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,KAAK,IAAI,QAAQ,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;YACtG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;gBACjD,IAAI,IAAI,CAAC,aAAa,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBAC3C,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBAChD,IAAI,EAAE;wBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;gBACzD,CAAC;gBACD,MAAM,IAAI,iBAAiB,CACvB,GAAG,GAAG,mBAAmB,SAAS,CAAC,SAAS,EAAE,EAC9C,SAAS,CAAC,SAAS,CACtB,CAAC;YACN,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAED,OAAO,IAAS,CAAC;IACrB,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,KAAa;QACtB,OAAO,IAAI,CAAC,OAAO,CAAe,oBAAoB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;SAClC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,OAAO,CAAc,mBAAmB,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC;SAChC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,QAAkB;QACtC,OAAO,IAAI,CAAC,OAAO,CAAa,kBAAkB,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;SAC1C,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,IAAI,CACN,QAAgB,EAChB,OAAkD,EAClD,iBAAiB,GAAG,KAAK;QAEzB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,sBAAsB,CAAC;QAClD,MAAM,OAAO,GAA2B;YACpC,cAAc,EAAE,eAAe;SAClC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;QAC5D,IAAI,MAAM,EAAE,CAAC;YACT,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,MAAM,EAAE,CAAC;QAClD,CAAC;QAED,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;YACtB,OAAO,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;QACnD,CAAC;QAED,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;YACjB,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC;QACvC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC9B,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,QAAQ;SACjB,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YAC1C,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QAC5D,CAAC,CAA0E,CAAC;QAE5E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,IAAI,QAAQ,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC5F,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC5C,IAAI,IAAI,CAAC,aAAa,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBAC3C,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBAChD,IAAI,EAAE;wBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;gBACtD,CAAC;gBACD,MAAM,IAAI,iBAAiB,CACvB,GAAG,GAAG,mBAAmB,IAAI,CAAC,SAAS,EAAE,EACzC,IAAI,CAAC,SAAS,CACjB,CAAC;YACN,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAED,OAAO,IAAkB,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAc,EAAE,WAAsB,EAAE,OAAiC;QAClF,OAAO,IAAI,CAAC,OAAO,CAAe,oBAAoB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;SACrE,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAc;QACvB,OAAO,IAAI,CAAC,OAAO,CAAe,oBAAoB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;SACjC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,MAAM,CACR,GAAW,EACX,OAA8B,EAC9B,OAAe,EACf,OAAwD;QAExD,OAAO,IAAI,CAAC,OAAO,CAAe,oBAAoB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACjB,GAAG;gBACH,OAAO;gBACP,OAAO;gBACP,aAAa,EAAE,OAAO,EAAE,YAAY,IAAI,CAAC;gBACzC,YAAY,EAAE,OAAO,EAAE,UAAU;aACpC,CAAC;SACL,CAAC,CAAC;IACP,CAAC;CACJ"}

package/dist/cli/auth-error.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Auth-related errors and handling (401 with login_url).
+ * Auth message is written without "Error: " prefix; --open can open the URL.
+ */
+export declare class AuthRequiredError extends Error {
+    readonly loginUrl: string;
+    constructor(message: string, loginUrl: string);
+}
+/** When set, used instead of system default (open/xdg-open/start). URL is passed as first argument. */
+export declare function openBrowser(url: string): void;
+/**
+ * Handle API errors: AuthRequiredError is printed without "Error: " prefix;
+ * if openInBrowser is true, opens the login URL. Other errors use writeError.
+ * Never returns (calls process.exit(1)).
+ */
+export declare function handleApiError(error: unknown, openInBrowser?: boolean): never;
+//# sourceMappingURL=auth-error.d.ts.map

package/dist/cli/auth-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-error.d.ts","sourceRoot":"","sources":["../../src/cli/auth-error.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,qBAAa,iBAAkB,SAAQ,KAAK;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAEd,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAKhD;AAED,uGAAuG;AACvG,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAiB7C;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,CAAC,EAAE,OAAO,GAAG,KAAK,CAQ7E"}

package/dist/cli/auth-error.js

@@ -0,0 +1,51 @@
+/**
+ * Auth-related errors and handling (401 with login_url).
+ * Auth message is written without "Error: " prefix; --open can open the URL.
+ */
+import { exec } from 'child_process';
+import { platform } from 'os';
+import { writeError, writeStderr } from './output.js';
+export class AuthRequiredError extends Error {
+    loginUrl;
+    constructor(message, loginUrl) {
+        super(message);
+        this.name = 'AuthRequiredError';
+        this.loginUrl = loginUrl;
+    }
+}
+/** When set, used instead of system default (open/xdg-open/start). URL is passed as first argument. */
+export function openBrowser(url) {
+    const browserEnv = process.env['BROWSER'];
+    if (browserEnv) {
+        exec(`${browserEnv} "${url}"`, (err) => {
+            if (err)
+                writeStderr(`Could not run BROWSER: ${err.message}. Open this URL manually:\n${url}`);
+        });
+        return;
+    }
+    const cmd = platform() === 'win32'
+        ? `start "${url}"`
+        : platform() === 'darwin'
+            ? `open "${url}"`
+            : `xdg-open "${url}"`;
+    exec(cmd, (err) => {
+        if (err)
+            writeStderr(`Could not open browser: ${err.message}. Open this URL manually:\n${url}`);
+    });
+}
+/**
+ * Handle API errors: AuthRequiredError is printed without "Error: " prefix;
+ * if openInBrowser is true, opens the login URL. Other errors use writeError.
+ * Never returns (calls process.exit(1)).
+ */
+export function handleApiError(error, openInBrowser) {
+    if (error instanceof AuthRequiredError) {
+        writeStderr(error.message);
+        if (openInBrowser)
+            openBrowser(error.loginUrl);
+        process.exit(1);
+    }
+    writeError(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+}
+//# sourceMappingURL=auth-error.js.map

package/dist/cli/auth-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-error.js","sourceRoot":"","sources":["../../src/cli/auth-error.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC/B,QAAQ,CAAS;IAE1B,YAAY,OAAe,EAAE,QAAgB;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC7B,CAAC;CACJ;AAED,uGAAuG;AACvG,MAAM,UAAU,WAAW,CAAC,GAAW;IACnC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,UAAU,EAAE,CAAC;QACb,IAAI,CAAC,GAAG,UAAU,KAAK,GAAG,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;YACnC,IAAI,GAAG;gBAAE,WAAW,CAAC,0BAA0B,GAAG,CAAC,OAAO,8BAA8B,GAAG,EAAE,CAAC,CAAC;QACnG,CAAC,CAAC,CAAC;QACH,OAAO;IACX,CAAC;IACD,MAAM,GAAG,GACL,QAAQ,EAAE,KAAK,OAAO;QAClB,CAAC,CAAC,UAAU,GAAG,GAAG;QAClB,CAAC,CAAC,QAAQ,EAAE,KAAK,QAAQ;YACvB,CAAC,CAAC,SAAS,GAAG,GAAG;YACjB,CAAC,CAAC,aAAa,GAAG,GAAG,CAAC;IAChC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;QACd,IAAI,GAAG;YAAE,WAAW,CAAC,2BAA2B,GAAG,CAAC,OAAO,8BAA8B,GAAG,EAAE,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc,EAAE,aAAuB;IAClE,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;QACrC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,IAAI,aAAa;YAAE,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,UAAU,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC"}

package/dist/cli/commands/attest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attest.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/attest.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA2DpD"}
+{"version":3,"file":"attest.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/attest.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAgDpD"}

package/dist/cli/commands/attest.js

@@ -2,6 +2,7 @@
  * kairos attest command (V2: no final_solution required)
  */
 import { ApiClient } from '../api-client.js';
+import { handleApiError } from '../auth-error.js';
 import { writeError, writeJson } from '../output.js';
 export function attestCommand(program) {
     program
@@ -25,7 +26,7 @@ export function attestCommand(program) {
                 process.exit(1);
                 return;
             }
-            const client = new ApiClient();
+            const client = new ApiClient(undefined, !program.opts()['noBrowser']);
             const attestOptions = {
                 qualityBonus,
             };
@@ -33,19 +34,10 @@ export function attestCommand(program) {
                 attestOptions.llmModelId = options.model;
             }
             const response = await client.attest(uri, outcome, message, attestOptions);
-            if (response.error) {
-                writeError(response.error);
-                if (response.message) {
-                    writeError(response.message);
-                }
-                process.exit(1);
-                return;
-            }
             writeJson(response);
         }
         catch (error) {
-            writeError(error instanceof Error ? error.message : String(error));
-            process.exit(1);
+            handleApiError(error, !program.opts()['noBrowser']);
         }
     });
 }

package/dist/cli/commands/attest.js.map

@@ -1 +1 @@
-{"version":3,"file":"attest.js","sourceRoot":"","sources":["../../../src/cli/commands/attest.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC1C,OAAO;SACF,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,mDAAmD,CAAC;SAChE,QAAQ,CAAC,OAAO,EAAE,sCAAsC,CAAC;SACzD,QAAQ,CAAC,WAAW,EAAE,6BAA6B,CAAC;SACpD,QAAQ,CAAC,WAAW,EAAE,0DAA0D,CAAC;SACjF,MAAM,CAAC,0BAA0B,EAAE,gDAAgD,EAAE,GAAG,CAAC;SACzF,MAAM,CAAC,iBAAiB,EAAE,0DAA0D,CAAC;SACrF,MAAM,CAAC,KAAK,EACT,GAAW,EACX,OAAe,EACf,OAAe,EACf,OAAkD,EACpD,EAAE;QACA,IAAI,CAAC;YACD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBACjD,UAAU,CAAC,wCAAwC,CAAC,CAAC;gBACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO;YACX,CAAC;YAED,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACjF,IAAI,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;gBACtB,UAAU,CAAC,kCAAkC,CAAC,CAAC;gBAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO;YACX,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAE/B,MAAM,aAAa,GAAmD;gBAClE,YAAY;aACf,CAAC;YACF,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChB,aAAa,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC;YAC7C,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAChC,GAAG,EACH,OAAgC,EAChC,OAAO,EACP,aAAa,CAChB,CAAC;YAEF,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACjB,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC3B,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACnB,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACjC,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO;YACX,CAAC;YAED,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,UAAU,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACL,CAAC,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"attest.js","sourceRoot":"","sources":["../../../src/cli/commands/attest.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC1C,OAAO;SACF,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,mDAAmD,CAAC;SAChE,QAAQ,CAAC,OAAO,EAAE,sCAAsC,CAAC;SACzD,QAAQ,CAAC,WAAW,EAAE,6BAA6B,CAAC;SACpD,QAAQ,CAAC,WAAW,EAAE,0DAA0D,CAAC;SACjF,MAAM,CAAC,0BAA0B,EAAE,gDAAgD,EAAE,GAAG,CAAC;SACzF,MAAM,CAAC,iBAAiB,EAAE,0DAA0D,CAAC;SACrF,MAAM,CAAC,KAAK,EACT,GAAW,EACX,OAAe,EACf,OAAe,EACf,OAAkD,EACpD,EAAE;QACA,IAAI,CAAC;YACD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBACjD,UAAU,CAAC,wCAAwC,CAAC,CAAC;gBACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO;YACX,CAAC;YAED,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACjF,IAAI,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;gBACtB,UAAU,CAAC,kCAAkC,CAAC,CAAC;gBAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO;YACX,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;YAEtE,MAAM,aAAa,GAAmD;gBAClE,YAAY;aACf,CAAC;YACF,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChB,aAAa,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC;YAC7C,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAChC,GAAG,EACH,OAAgC,EAChC,OAAO,EACP,aAAa,CAChB,CAAC;YACF,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,cAAc,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QACxD,CAAC;IACL,CAAC,CAAC,CAAC;AACX,CAAC"}

package/dist/cli/commands/begin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"begin.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/begin.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA0BnD"}
+{"version":3,"file":"begin.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/begin.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAcnD"}

package/dist/cli/commands/begin.js

@@ -2,7 +2,8 @@
  * kairos begin command - Read step 1 (no proof-of-work required)
  */
 import { ApiClient } from '../api-client.js';
-import { writeError, writeJson } from '../output.js';
+import { handleApiError } from '../auth-error.js';
+import { writeJson } from '../output.js';
 export function beginCommand(program) {
     program
         .command('begin')
@@ -10,22 +11,12 @@ export function beginCommand(program) {
         .argument('<uri>', 'KAIROS memory URI (kairos://mem/...)')
         .action(async (uri) => {
         try {
-            const client = new ApiClient();
+            const client = new ApiClient(undefined, !program.opts()['noBrowser']);
             const response = await client.begin(uri);
-            if (response.error) {
-                writeError(response.error);
-                if (response.message) {
-                    writeError(response.message);
-                }
-                process.exit(1);
-                return;
-            }
-            // Pretty print the response
             writeJson(response);
         }
         catch (error) {
-            writeError(error instanceof Error ? error.message : String(error));
-            process.exit(1);
+            handleApiError(error, !program.opts()['noBrowser']);
         }
     });
 }

package/dist/cli/commands/begin.js.map

@@ -1 +1 @@
-{"version":3,"file":"begin.js","sourceRoot":"","sources":["../../../src/cli/commands/begin.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,UAAU,YAAY,CAAC,OAAgB;IACzC,OAAO;SACF,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,4EAA4E,CAAC;SACzF,QAAQ,CAAC,OAAO,EAAE,sCAAsC,CAAC;SACzD,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;QAC1B,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAEzC,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACjB,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC3B,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACnB,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACjC,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO;YACX,CAAC;YAED,4BAA4B;YAC5B,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,UAAU,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACL,CAAC,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"begin.js","sourceRoot":"","sources":["../../../src/cli/commands/begin.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,UAAU,YAAY,CAAC,OAAgB;IACzC,OAAO;SACF,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,4EAA4E,CAAC;SACzF,QAAQ,CAAC,OAAO,EAAE,sCAAsC,CAAC;SACzD,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;QAC1B,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;YACtE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACzC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,cAAc,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QACxD,CAAC;IACL,CAAC,CAAC,CAAC;AACX,CAAC"}

package/dist/cli/commands/delete.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/delete.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA0BpD"}
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/delete.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAcpD"}

package/dist/cli/commands/delete.js

@@ -2,7 +2,8 @@
  * kairos delete command
  */
 import { ApiClient } from '../api-client.js';
-import { writeError, writeJson } from '../output.js';
+import { handleApiError } from '../auth-error.js';
+import { writeJson } from '../output.js';
 export function deleteCommand(program) {
     program
         .command('delete')
@@ -10,22 +11,12 @@ export function deleteCommand(program) {
         .argument('<uris...>', 'KAIROS memory URIs (kairos://mem/...)')
         .action(async (uris) => {
         try {
-            const client = new ApiClient();
+            const client = new ApiClient(undefined, !program.opts()['noBrowser']);
             const response = await client.delete(uris);
-            if (response.error) {
-                writeError(response.error);
-                if (response.message) {
-                    writeError(response.message);
-                }
-                process.exit(1);
-                return;
-            }
-            // Pretty print the response
             writeJson(response);
         }
         catch (error) {
-            writeError(error instanceof Error ? error.message : String(error));
-            process.exit(1);
+            handleApiError(error, !program.opts()['noBrowser']);
         }
     });
 }

package/dist/cli/commands/delete.js.map

@@ -1 +1 @@
-{"version":3,"file":"delete.js","sourceRoot":"","sources":["../../../src/cli/commands/delete.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC1C,OAAO;SACF,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,oCAAoC,CAAC;SACjD,QAAQ,CAAC,WAAW,EAAE,uCAAuC,CAAC;SAC9D,MAAM,CAAC,KAAK,EAAE,IAAc,EAAE,EAAE;QAC7B,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAE3C,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACjB,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC3B,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACnB,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACjC,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO;YACX,CAAC;YAED,4BAA4B;YAC5B,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,UAAU,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACL,CAAC,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"delete.js","sourceRoot":"","sources":["../../../src/cli/commands/delete.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC1C,OAAO;SACF,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,oCAAoC,CAAC;SACjD,QAAQ,CAAC,WAAW,EAAE,uCAAuC,CAAC;SAC9D,MAAM,CAAC,KAAK,EAAE,IAAc,EAAE,EAAE;QAC7B,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;YACtE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3C,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,cAAc,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QACxD,CAAC;IACL,CAAC,CAAC,CAAC;AACX,CAAC"}

package/dist/cli/commands/login.d.ts

@@ -0,0 +1,16 @@
+/**
+ * kairos login — obtain and store a Bearer token (--token or browser + PKCE).
+ */
+import { Command } from 'commander';
+/** Resolve current API base URL (env, then config default, then getApiUrl()). Exported for logout. */
+export declare function getBaseUrl(): string;
+/** Check if token is valid (GET /api/me). Used by login to skip relogin and by ApiClient. */
+export declare function isTokenValid(baseUrl: string, token: string): Promise<boolean>;
+export interface LoginWithBrowserOptions {
+    /** If true, only print auth URL to stdout; do not open browser. */
+    noBrowser?: boolean;
+}
+/** Run browser PKCE login and store token. Exported for 401+--open retry from ApiClient. */
+export declare function loginWithBrowser(baseUrl: string, options?: LoginWithBrowserOptions): Promise<boolean>;
+export declare function loginCommand(program: Command): void;
+//# sourceMappingURL=login.d.ts.map

package/dist/cli/commands/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/login.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAoBpC,sGAAsG;AACtG,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED,6FAA6F;AAC7F,wBAAsB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAKnF;AAuBD,MAAM,WAAW,uBAAuB;IACpC,mEAAmE;IACnE,SAAS,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,4FAA4F;AAC5F,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC,CAuI3G;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA2BnD"}