@kodycodes/cli 1.17.0 → 1.19.0

package/dist/remote-execute.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote-execute.js","sourceRoot":"","sources":["../src/remote-execute.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,qBAAqB,EACrB,mBAAmB,EACnB,0BAA0B,GAC1B,MAAM,uBAAuB,CAAA;AAG9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAA;AAiBlE,MAAM,CAAC,MAAM,uCAAuC,GACnD,yUAAyU,CAAA;AAE1U;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,KAAyB;IAEzB,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACnC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;IACzD,CAAC;IACD,MAAM,IAAI,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAA;IAC5C,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAA;IACnF,MAAM,0BAA0B,CAAC,MAAM,CAAC,CAAA;IAExC,MAAM,IAAI,GAA4B,EAAE,IAAI,EAAE,CAAA;IAC9C,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC1D,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;QAAE,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAA;IAElF,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACzC,GAAG,MAAM;QACT,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;QACzB,IAAI,EAAE,CAAC,IAAI,CAAC;QACZ,cAAc,EAAE,KAAK,CAAC,cAAc;KACpC,CAAC,CAAA;IAEF,OAAO,6BAA6B,CAAC,OAAO,CAAC,CAAA;AAC9C,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAGxC;IACA,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IACxD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9D,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAA;IACxF,CAAC;IACD,IAAI,MAAM;QAAE,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAA;IACnD,IAAI,IAAI;QAAE,OAAO,IAAI,CAAA;IACrB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;AACzE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAgB;IAC7D,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;IACjD,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,GACT,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,WAAW,CAAA;QACxF,OAAO;YACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACjC,iBAAiB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;YACtC,OAAO,EAAE,KAAK;SACd,CAAA;IACF,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,KAAK,KAAK,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAA;IAClE,MAAM,cAAc,GACnB,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9E,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1D,MAAM,IAAI,GAA4B;QACrC,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,IAAI;KACJ,CAAA;IACD,KAAK,MAAM,GAAG,IAAI;QACjB,QAAQ;QACR,OAAO;QACP,UAAU;QACV,YAAY;QACZ,QAAQ;QACR,eAAe;QACf,WAAW;QACX,MAAM;QACN,cAAc;QACd,aAAa;QACb,cAAc;KACL,EAAE,CAAC;QACZ,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACvD,CAAC;IAED,IAAI,CAAC,EAAE,EAAE,CAAC;QACT,MAAM,KAAK,GACV,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAC/B,CAAC,CAAC,MAAM,CAAC,KAAK;YACd,CAAC,CAAC,0CAA0C,CAAA;QAC9C,OAAO;YACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;YACpD,iBAAiB,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;YAC5D,OAAO,EAAE,IAAI;SACb,CAAA;IACF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;IAC5B,MAAM,IAAI,GACT,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,WAAW,CAAC,CAAA;IACvF,OAAO;QACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACjC,iBAAiB,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE;QACtC,OAAO,EAAE,KAAK;KACd,CAAA;AACF,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC5E,CAAC"}
+{"version":3,"file":"remote-execute.js","sourceRoot":"","sources":["../src/remote-execute.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,qBAAqB,EACrB,mBAAmB,EACnB,0BAA0B,GAC1B,MAAM,uBAAuB,CAAA;AAG9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAA;AAmBlE,MAAM,CAAC,MAAM,uCAAuC,GACnD,yUAAyU,CAAA;AAE1U;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,KAAyB;IAEzB,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACnC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;IACzD,CAAC;IACD,MAAM,IAAI,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAA;IAC5C,MAAM,MAAM,GAAG;QACd,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAA;IACD,MAAM,0BAA0B,CAAC,MAAM,CAAC,CAAA;IAExC,MAAM,IAAI,GAA4B,EAAE,IAAI,EAAE,CAAA;IAC9C,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC1D,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;QAAE,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAA;IAElF,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACzC,GAAG,MAAM;QACT,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;QACzB,IAAI,EAAE,CAAC,IAAI,CAAC;QACZ,cAAc,EAAE,KAAK,CAAC,cAAc;KACpC,CAAC,CAAA;IAEF,OAAO,6BAA6B,CAAC,OAAO,CAAC,CAAA;AAC9C,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAGxC;IACA,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IACxD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9D,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAA;IACxF,CAAC;IACD,IAAI,MAAM;QAAE,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAA;IACnD,IAAI,IAAI;QAAE,OAAO,IAAI,CAAA;IACrB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;AACzE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAgB;IAC7D,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;IACjD,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,GACT,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,WAAW,CAAA;QACxF,OAAO;YACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACjC,iBAAiB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;YACtC,OAAO,EAAE,KAAK;SACd,CAAA;IACF,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,KAAK,KAAK,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAA;IAClE,MAAM,cAAc,GACnB,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9E,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1D,MAAM,IAAI,GAA4B;QACrC,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,IAAI;KACJ,CAAA;IACD,KAAK,MAAM,GAAG,IAAI;QACjB,QAAQ;QACR,OAAO;QACP,UAAU;QACV,YAAY;QACZ,QAAQ;QACR,eAAe;QACf,WAAW;QACX,MAAM;QACN,cAAc;QACd,aAAa;QACb,cAAc;KACL,EAAE,CAAC;QACZ,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACvD,CAAC;IAED,IAAI,CAAC,EAAE,EAAE,CAAC;QACT,MAAM,KAAK,GACV,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAC/B,CAAC,CAAC,MAAM,CAAC,KAAK;YACd,CAAC,CAAC,0CAA0C,CAAA;QAC9C,OAAO;YACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;YACpD,iBAAiB,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;YAC5D,OAAO,EAAE,IAAI;SACb,CAAA;IACF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;IAC5B,MAAM,IAAI,GACT,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,WAAW,CAAC,CAAA;IACvF,OAAO;QACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACjC,iBAAiB,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE;QACtC,OAAO,EAAE,KAAK;KACd,CAAA;AACF,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC5E,CAAC"}

package/dist/store.d.ts

@@ -1,6 +1,39 @@
+/**
+ * Per-org OAuth credentials used by login / MCP / local-execute Bearer.
+ * `org` is the bound organization slug (ADR 0064). Legacy single-org payloads
+ * may omit it until silent migration discovers the slug via metaGetCurrentUser.
+ */
 export type StoredCredentials = {
     version: 1;
     mcpUrl: string;
+    /** Organization slug this grant is bound to. */
+    org?: string;
+    resource: string;
+    authorizationServerUrl: string;
+    clientId: string;
+    clientSecret?: string;
+    accessToken: string;
+    refreshToken?: string;
+    tokenType: string;
+    expiresAt?: number;
+    scope?: string;
+};
+/** On-disk / keychain envelope for one or more org logins (same MCP origin). */
+export type MultiOrgCredentialStore = {
+    version: 2;
+    mcpUrl: string;
+    /** Active org slug; null while a legacy v1 session awaits slug discovery. */
+    activeOrg: string | null;
+    /** Org slug → credentials (without version/mcpUrl envelope fields). */
+    orgs: Record<string, OrgCredentialRecord>;
+    /**
+     * Legacy single-org tokens waiting for an org slug. At most one. Cleared
+     * once metaGetCurrentUser (or login --org) promotes them into `orgs`.
+     */
+    pending?: OrgCredentialRecord;
+};
+export type OrgCredentialRecord = {
+    org?: string;
     resource: string;
     authorizationServerUrl: string;
     clientId: string;
@@ -28,17 +61,74 @@ export type StoreResolution = {
     createKeyring?: (mcpUrl: string) => SecretBackend;
     fileStorePath?: (mcpUrl: string) => string;
 };
+export type LoadCredentialsOptions = {
+    /** Prefer this org slug (already normalized). */
+    org?: string;
+    backend?: SecretBackend;
+    resolution?: StoreResolution;
+};
 export declare function accountForMcpUrl(mcpUrl: string): string;
 export declare function fileStorePath(mcpUrl: string, home?: string): string;
 export declare function createFileBackend(path: string): SecretBackend;
 export declare function createKeyringBackend(mcpUrl: string): SecretBackend;
 export declare function resolveBackend(mcpUrl: string, preferred?: SecretBackend, resolution?: StoreResolution): SecretBackend;
+/** Parse v1 single-org or v2 multi-org JSON from the credential backend. */
+export declare function parseCredentialStore(raw: string, fallbackMcpUrl?: string): MultiOrgCredentialStore;
+/**
+ * Silent offline migration: wrap a v1 single-org payload as a multi-org store.
+ * When `org` is already known, it becomes the active org; otherwise tokens sit
+ * in `pending` until metaGetCurrentUser (or login) supplies the slug.
+ */
+export declare function migrateV1ToMultiOrg(credentials: StoredCredentials): MultiOrgCredentialStore;
+/** @deprecated Prefer parseCredentialStore; kept for tests and callers that expect v1. */
 export declare function parseCredentials(raw: string): StoredCredentials;
-export declare function loadCredentials(mcpUrl?: string, backend?: SecretBackend, resolution?: StoreResolution): StoredCredentials | null;
-export declare function saveCredentials(credentials: StoredCredentials, backend?: SecretBackend, resolution?: StoreResolution): {
+export declare function loadCredentialStore(mcpUrl?: string, backend?: SecretBackend, resolution?: StoreResolution): MultiOrgCredentialStore | null;
+export declare function saveCredentialStore(snapshot: MultiOrgCredentialStore, backend?: SecretBackend, resolution?: StoreResolution): {
+    backend: SecretBackend;
+};
+/**
+ * Resolve one org's credentials. Precedence for which org: explicit `org`
+ * option, else the store's active org, else the sole pending legacy session.
+ */
+export declare function loadCredentials(mcpUrl?: string, backend?: SecretBackend, resolution?: StoreResolution, options?: {
+    org?: string;
+}): StoredCredentials | null;
+/** Legacy pending session only (not the active named org). */
+export declare function loadPendingCredentials(mcpUrl?: string, backend?: SecretBackend, resolution?: StoreResolution): StoredCredentials | null;
+export declare function pickCredentialsFromStore(snapshot: MultiOrgCredentialStore, org?: string): StoredCredentials | null;
+/**
+ * Upsert one org's credentials. Replaces that org's prior tokens when the slug
+ * already exists; leaves other orgs untouched.
+ *
+ * `activate` (default true) makes the saved org active — used by `kody login`.
+ * Pass `activate: false` for token refresh so a one-shot `--org` / `KODY_ORG`
+ * refresh does not steal the active org from `kody org use`.
+ */
+export declare function saveCredentials(credentials: StoredCredentials, backend?: SecretBackend, resolution?: StoreResolution, options?: {
+    activate?: boolean;
+}): {
     backend: SecretBackend;
 };
-export declare function deleteCredentials(mcpUrl?: string, backend?: SecretBackend, resolution?: StoreResolution): {
+/**
+ * Promote pending legacy tokens into `orgs[slug]`.
+ * Never overwrites an existing named login (a fresh `kody login` wins), and
+ * never steals `activeOrg` away from an already-active named org.
+ */
+export declare function promotePendingOrg(mcpUrl: string, org: string, backend?: SecretBackend, resolution?: StoreResolution): MultiOrgCredentialStore | null;
+export declare function setActiveOrg(mcpUrl: string, org: string, backend?: SecretBackend, resolution?: StoreResolution): MultiOrgCredentialStore;
+export declare function listOrgSlugs(snapshot: MultiOrgCredentialStore): Array<string>;
+export type ListedOrg = {
+    slug: string;
+    active: boolean;
+    /** True when this row is the unresolved legacy session (no slug yet). */
+    pending?: boolean;
+};
+/** Local-only listing for help / `org list` (no network). */
+export declare function listStoredOrgs(mcpUrl?: string, backend?: SecretBackend, resolution?: StoreResolution): Array<ListedOrg>;
+export declare function deleteCredentials(mcpUrl?: string, backend?: SecretBackend, resolution?: StoreResolution, options?: {
+    org?: string;
+}): {
     deleted: boolean;
     backend: SecretBackend;
+    remaining: number;
 };

package/dist/store.js

@@ -91,36 +91,198 @@ export function resolveBackend(mcpUrl, preferred, resolution) {
         return fileBackendFor(mcpUrl, resolution);
     }
 }
-export function parseCredentials(raw) {
-    const parsed = JSON.parse(raw);
-    if (parsed.version !== 1 || !parsed.accessToken || !parsed.clientId) {
-        throw new Error('Stored Kody credentials are invalid. Run `kody login`.');
-    }
+function withDerivedIssuer(parsed) {
     // Pre-SEP-2352 / partial payloads may omit authorizationServerUrl. Derive
     // the issuer stamp from the MCP origin so reload does not warn, and the
     // next successful save/refresh persists the real AS issuer.
-    if (typeof parsed.authorizationServerUrl !== 'string' ||
-        !parsed.authorizationServerUrl.trim()) {
-        if (typeof parsed.mcpUrl !== 'string' || !parsed.mcpUrl) {
+    if (typeof parsed.authorizationServerUrl === 'string' &&
+        parsed.authorizationServerUrl.trim()) {
+        return parsed;
+    }
+    if (typeof parsed.mcpUrl !== 'string' || !parsed.mcpUrl) {
+        throw new Error('Stored Kody credentials are invalid. Run `kody login`.');
+    }
+    return {
+        ...parsed,
+        authorizationServerUrl: new URL(parsed.mcpUrl).origin,
+    };
+}
+function recordToCredentials(mcpUrl, record, org) {
+    const slug = org ?? record.org;
+    return withDerivedIssuer({
+        version: 1,
+        mcpUrl,
+        ...(slug ? { org: slug } : {}),
+        resource: record.resource,
+        authorizationServerUrl: record.authorizationServerUrl,
+        clientId: record.clientId,
+        ...(record.clientSecret !== undefined
+            ? { clientSecret: record.clientSecret }
+            : {}),
+        accessToken: record.accessToken,
+        ...(record.refreshToken !== undefined
+            ? { refreshToken: record.refreshToken }
+            : {}),
+        tokenType: record.tokenType,
+        ...(record.expiresAt !== undefined ? { expiresAt: record.expiresAt } : {}),
+        ...(record.scope !== undefined ? { scope: record.scope } : {}),
+    });
+}
+function credentialsToRecord(credentials) {
+    return {
+        ...(credentials.org ? { org: credentials.org } : {}),
+        resource: credentials.resource,
+        authorizationServerUrl: credentials.authorizationServerUrl,
+        clientId: credentials.clientId,
+        ...(credentials.clientSecret !== undefined
+            ? { clientSecret: credentials.clientSecret }
+            : {}),
+        accessToken: credentials.accessToken,
+        ...(credentials.refreshToken !== undefined
+            ? { refreshToken: credentials.refreshToken }
+            : {}),
+        tokenType: credentials.tokenType,
+        ...(credentials.expiresAt !== undefined
+            ? { expiresAt: credentials.expiresAt }
+            : {}),
+        ...(credentials.scope !== undefined ? { scope: credentials.scope } : {}),
+    };
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function parseOrgRecord(value) {
+    if (!isRecord(value))
+        return null;
+    if (typeof value.accessToken !== 'string' || !value.accessToken)
+        return null;
+    if (typeof value.clientId !== 'string' || !value.clientId)
+        return null;
+    if (typeof value.resource !== 'string' || !value.resource)
+        return null;
+    if (typeof value.tokenType !== 'string' || !value.tokenType)
+        return null;
+    const authorizationServerUrl = typeof value.authorizationServerUrl === 'string'
+        ? value.authorizationServerUrl
+        : '';
+    return {
+        ...(typeof value.org === 'string' && value.org.trim()
+            ? { org: value.org.trim().toLowerCase() }
+            : {}),
+        resource: value.resource,
+        authorizationServerUrl,
+        clientId: value.clientId,
+        ...(typeof value.clientSecret === 'string'
+            ? { clientSecret: value.clientSecret }
+            : {}),
+        accessToken: value.accessToken,
+        ...(typeof value.refreshToken === 'string'
+            ? { refreshToken: value.refreshToken }
+            : {}),
+        tokenType: value.tokenType,
+        ...(typeof value.expiresAt === 'number' ? { expiresAt: value.expiresAt } : {}),
+        ...(typeof value.scope === 'string' ? { scope: value.scope } : {}),
+    };
+}
+/** Parse v1 single-org or v2 multi-org JSON from the credential backend. */
+export function parseCredentialStore(raw, fallbackMcpUrl = defaultMcpUrl) {
+    const parsed = JSON.parse(raw);
+    if (!isRecord(parsed) || typeof parsed.version !== 'number') {
+        throw new Error('Stored Kody credentials are invalid. Run `kody login`.');
+    }
+    if (parsed.version === 2) {
+        const mcpUrl = typeof parsed.mcpUrl === 'string' && parsed.mcpUrl
+            ? parsed.mcpUrl
+            : fallbackMcpUrl;
+        const orgs = {};
+        if (isRecord(parsed.orgs)) {
+            for (const [key, value] of Object.entries(parsed.orgs)) {
+                const record = parseOrgRecord(value);
+                if (!record) {
+                    throw new Error('Stored Kody credentials are invalid. Run `kody login`.');
+                }
+                const slug = (record.org ?? key).trim().toLowerCase();
+                if (!slug) {
+                    throw new Error('Stored Kody credentials are invalid. Run `kody login`.');
+                }
+                orgs[slug] = { ...record, org: slug };
+            }
+        }
+        const pending = parsed.pending !== undefined ? parseOrgRecord(parsed.pending) : undefined;
+        if (parsed.pending !== undefined && !pending) {
             throw new Error('Stored Kody credentials are invalid. Run `kody login`.');
         }
+        const activeOrgRaw = typeof parsed.activeOrg === 'string' ? parsed.activeOrg.trim().toLowerCase() : null;
+        const activeOrg = activeOrgRaw && orgs[activeOrgRaw]
+            ? activeOrgRaw
+            : Object.keys(orgs).sort((a, b) => a.localeCompare(b))[0] ?? null;
         return {
-            ...parsed,
-            authorizationServerUrl: new URL(parsed.mcpUrl).origin,
+            version: 2,
+            mcpUrl,
+            activeOrg,
+            orgs,
+            ...(pending ? { pending } : {}),
         };
     }
-    return parsed;
+    if (parsed.version === 1) {
+        const credentials = parseCredentials(JSON.stringify(parsed));
+        return migrateV1ToMultiOrg(credentials);
+    }
+    throw new Error('Stored Kody credentials are invalid. Run `kody login`.');
 }
-function readParsed(store) {
+/**
+ * Silent offline migration: wrap a v1 single-org payload as a multi-org store.
+ * When `org` is already known, it becomes the active org; otherwise tokens sit
+ * in `pending` until metaGetCurrentUser (or login) supplies the slug.
+ */
+export function migrateV1ToMultiOrg(credentials) {
+    const record = credentialsToRecord(withDerivedIssuer(credentials));
+    const slug = typeof credentials.org === 'string' && credentials.org.trim()
+        ? credentials.org.trim().toLowerCase()
+        : null;
+    if (slug) {
+        return {
+            version: 2,
+            mcpUrl: credentials.mcpUrl,
+            activeOrg: slug,
+            orgs: { [slug]: { ...record, org: slug } },
+        };
+    }
+    return {
+        version: 2,
+        mcpUrl: credentials.mcpUrl,
+        activeOrg: null,
+        orgs: {},
+        pending: record,
+    };
+}
+/** @deprecated Prefer parseCredentialStore; kept for tests and callers that expect v1. */
+export function parseCredentials(raw) {
+    const parsed = JSON.parse(raw);
+    if (parsed.version !== 1 || !parsed.accessToken || !parsed.clientId) {
+        throw new Error('Stored Kody credentials are invalid. Run `kody login`.');
+    }
+    const withOrg = typeof parsed.org === 'string' && parsed.org.trim()
+        ? { ...parsed, org: parsed.org.trim().toLowerCase() }
+        : parsed;
+    return withDerivedIssuer(withOrg);
+}
+function readStore(store, mcpUrl) {
     const raw = store.get();
     if (!raw)
         return null;
-    return parseCredentials(raw);
+    return parseCredentialStore(raw, mcpUrl);
 }
-export function loadCredentials(mcpUrl = defaultMcpUrl, backend, resolution) {
+function writeStore(store, snapshot) {
+    store.set(JSON.stringify(snapshot));
+}
+function emptyStore(mcpUrl) {
+    return { version: 2, mcpUrl, activeOrg: null, orgs: {} };
+}
+export function loadCredentialStore(mcpUrl = defaultMcpUrl, backend, resolution) {
     const store = resolveBackend(mcpUrl, backend, resolution);
     try {
-        const loaded = readParsed(store);
+        const loaded = readStore(store, mcpUrl);
         if (loaded)
             return loaded;
     }
@@ -129,27 +291,296 @@ export function loadCredentials(mcpUrl = defaultMcpUrl, backend, resolution) {
             throw error;
     }
     if (store.kind === 'keyring' && !backend) {
-        return readParsed(fileBackendFor(mcpUrl, resolution));
+        return readStore(fileBackendFor(mcpUrl, resolution), mcpUrl);
     }
     return null;
 }
-export function saveCredentials(credentials, backend, resolution) {
-    const store = resolveBackend(credentials.mcpUrl, backend, resolution);
+export function saveCredentialStore(snapshot, backend, resolution) {
+    const store = resolveBackend(snapshot.mcpUrl, backend, resolution);
     try {
-        store.set(JSON.stringify(credentials));
+        writeStore(store, snapshot);
         return { backend: store };
     }
     catch (error) {
         if (store.kind === 'keyring' && !backend) {
-            const fallback = fileBackendFor(credentials.mcpUrl, resolution);
-            fallback.set(JSON.stringify(credentials));
+            const fallback = fileBackendFor(snapshot.mcpUrl, resolution);
+            writeStore(fallback, snapshot);
             return { backend: fallback };
         }
         throw error;
     }
 }
-export function deleteCredentials(mcpUrl = defaultMcpUrl, backend, resolution) {
+/**
+ * Resolve one org's credentials. Precedence for which org: explicit `org`
+ * option, else the store's active org, else the sole pending legacy session.
+ */
+export function loadCredentials(mcpUrl = defaultMcpUrl, backend, resolution, options) {
+    const snapshot = loadCredentialStore(mcpUrl, backend, resolution);
+    if (!snapshot)
+        return null;
+    return pickCredentialsFromStore(snapshot, options?.org);
+}
+/** Legacy pending session only (not the active named org). */
+export function loadPendingCredentials(mcpUrl = defaultMcpUrl, backend, resolution) {
+    const snapshot = loadCredentialStore(mcpUrl, backend, resolution);
+    if (!snapshot?.pending)
+        return null;
+    return recordToCredentials(snapshot.mcpUrl, snapshot.pending);
+}
+export function pickCredentialsFromStore(snapshot, org) {
+    const requested = org?.trim().toLowerCase();
+    if (requested) {
+        const record = snapshot.orgs[requested];
+        if (record)
+            return recordToCredentials(snapshot.mcpUrl, record, requested);
+        // Pending-only legacy store: keep commands working when discovery has
+        // not named the session yet, but do NOT attach the requested slug —
+        // that would let a refresh persist an unverified org name.
+        if (snapshot.pending && Object.keys(snapshot.orgs).length === 0) {
+            return recordToCredentials(snapshot.mcpUrl, snapshot.pending);
+        }
+        return null;
+    }
+    if (snapshot.activeOrg && snapshot.orgs[snapshot.activeOrg]) {
+        return recordToCredentials(snapshot.mcpUrl, snapshot.orgs[snapshot.activeOrg], snapshot.activeOrg);
+    }
+    if (snapshot.pending) {
+        return recordToCredentials(snapshot.mcpUrl, snapshot.pending);
+    }
+    const only = Object.keys(snapshot.orgs);
+    if (only.length === 1) {
+        const slug = only[0];
+        return recordToCredentials(snapshot.mcpUrl, snapshot.orgs[slug], slug);
+    }
+    return null;
+}
+/**
+ * Upsert one org's credentials. Replaces that org's prior tokens when the slug
+ * already exists; leaves other orgs untouched.
+ *
+ * `activate` (default true) makes the saved org active — used by `kody login`.
+ * Pass `activate: false` for token refresh so a one-shot `--org` / `KODY_ORG`
+ * refresh does not steal the active org from `kody org use`.
+ */
+export function saveCredentials(credentials, backend, resolution, options) {
+    const mcpUrl = credentials.mcpUrl;
+    const existing = loadCredentialStore(mcpUrl, backend, resolution) ?? emptyStore(mcpUrl);
+    const slug = typeof credentials.org === 'string' && credentials.org.trim()
+        ? credentials.org.trim().toLowerCase()
+        : null;
+    const record = credentialsToRecord({
+        ...credentials,
+        ...(slug ? { org: slug } : {}),
+        authorizationServerUrl: withDerivedIssuer(credentials).authorizationServerUrl,
+    });
+    const activate = options?.activate !== false;
+    let next;
+    if (slug) {
+        const currentActive = typeof existing.activeOrg === 'string' &&
+            existing.activeOrg.length > 0 &&
+            existing.orgs[existing.activeOrg]
+            ? existing.activeOrg
+            : null;
+        next = {
+            version: 2,
+            mcpUrl,
+            activeOrg: activate || !currentActive ? slug : currentActive,
+            orgs: {
+                ...existing.orgs,
+                [slug]: { ...record, org: slug },
+            },
+            // Keep an unresolved legacy session unless this save is promoting it
+            // (pending tokens matched / were the only login being named).
+            ...(existing.pending &&
+                existing.pending.accessToken !== record.accessToken
+                ? { pending: existing.pending }
+                : {}),
+        };
+    }
+    else {
+        next = {
+            version: 2,
+            mcpUrl,
+            activeOrg: existing.activeOrg,
+            orgs: existing.orgs,
+            pending: record,
+        };
+    }
+    return saveCredentialStore(next, backend, resolution);
+}
+/**
+ * Promote pending legacy tokens into `orgs[slug]`.
+ * Never overwrites an existing named login (a fresh `kody login` wins), and
+ * never steals `activeOrg` away from an already-active named org.
+ */
+export function promotePendingOrg(mcpUrl, org, backend, resolution) {
+    const snapshot = loadCredentialStore(mcpUrl, backend, resolution);
+    if (!snapshot?.pending)
+        return snapshot;
+    const slug = org.trim().toLowerCase();
+    if (!slug) {
+        throw new Error('Organization slug is required to finish credential migration.');
+    }
+    const existingNamed = snapshot.orgs[slug];
+    const orgs = existingNamed
+        ? snapshot.orgs
+        : {
+            ...snapshot.orgs,
+            [slug]: { ...snapshot.pending, org: slug },
+        };
+    const activeIsNamed = typeof snapshot.activeOrg === 'string' &&
+        snapshot.activeOrg.length > 0 &&
+        snapshot.orgs[snapshot.activeOrg] != null;
+    const next = {
+        version: 2,
+        mcpUrl: snapshot.mcpUrl,
+        activeOrg: activeIsNamed ? snapshot.activeOrg : slug,
+        orgs,
+    };
+    saveCredentialStore(next, backend, resolution);
+    return next;
+}
+export function setActiveOrg(mcpUrl, org, backend, resolution) {
+    const snapshot = loadCredentialStore(mcpUrl, backend, resolution);
+    if (!snapshot) {
+        throw new Error('Not logged in. Run `kody login`.');
+    }
+    const slug = org.trim().toLowerCase();
+    if (!snapshot.orgs[slug]) {
+        const known = listOrgSlugs(snapshot);
+        throw new Error(known.length > 0
+            ? `No login stored for org "${slug}". Logged-in orgs: ${known.join(', ')}. Run \`kody login --org ${slug}\`.`
+            : `No login stored for org "${slug}". Run \`kody login --org ${slug}\`.`);
+    }
+    const next = {
+        ...snapshot,
+        activeOrg: slug,
+    };
+    saveCredentialStore(next, backend, resolution);
+    return next;
+}
+export function listOrgSlugs(snapshot) {
+    return Object.keys(snapshot.orgs).sort((a, b) => a.localeCompare(b));
+}
+/** Local-only listing for help / `org list` (no network). */
+export function listStoredOrgs(mcpUrl = defaultMcpUrl, backend, resolution) {
+    const snapshot = loadCredentialStore(mcpUrl, backend, resolution);
+    if (!snapshot)
+        return [];
+    const rows = listOrgSlugs(snapshot).map((slug) => ({
+        slug,
+        active: snapshot.activeOrg === slug,
+    }));
+    if (snapshot.pending && rows.length === 0) {
+        rows.push({ slug: '(pending)', active: true, pending: true });
+    }
+    return rows;
+}
+export function deleteCredentials(mcpUrl = defaultMcpUrl, backend, resolution, options) {
     const store = resolveBackend(mcpUrl, backend, resolution);
+    const snapshot = (() => {
+        try {
+            return readStore(store, mcpUrl);
+        }
+        catch {
+            return null;
+        }
+    })();
+    if (!options?.org) {
+        // Plain logout: remove the active org only (or pending / entire store
+        // when that is all that remains). Documented in help.
+        if (!snapshot) {
+            if (store.kind === 'keyring' && !backend) {
+                const file = fileBackendFor(mcpUrl, resolution);
+                const fileSnap = readStore(file, mcpUrl);
+                if (!fileSnap)
+                    return { deleted: false, backend: store, remaining: 0 };
+                return deleteCredentials(mcpUrl, file, resolution, options);
+            }
+            return { deleted: false, backend: store, remaining: 0 };
+        }
+        const target = snapshot.activeOrg ??
+            (snapshot.pending ? null : listOrgSlugs(snapshot)[0] ?? null);
+        if (target) {
+            return deleteOrgFromStore(snapshot, target, store, backend, resolution);
+        }
+        if (snapshot.pending) {
+            const next = {
+                version: 2,
+                mcpUrl: snapshot.mcpUrl,
+                activeOrg: snapshot.activeOrg,
+                orgs: snapshot.orgs,
+            };
+            if (Object.keys(next.orgs).length === 0) {
+                return wipeStore(mcpUrl, store, backend, resolution);
+            }
+            writeStore(store, next);
+            return {
+                deleted: true,
+                backend: store,
+                remaining: Object.keys(next.orgs).length,
+            };
+        }
+        return wipeStore(mcpUrl, store, backend, resolution);
+    }
+    const slug = options.org.trim().toLowerCase();
+    if (!snapshot) {
+        if (store.kind === 'keyring' && !backend) {
+            const file = fileBackendFor(mcpUrl, resolution);
+            const fileSnap = readStore(file, mcpUrl);
+            if (!fileSnap)
+                return { deleted: false, backend: store, remaining: 0 };
+            return deleteCredentials(mcpUrl, file, resolution, options);
+        }
+        return { deleted: false, backend: store, remaining: 0 };
+    }
+    return deleteOrgFromStore(snapshot, slug, store, backend, resolution);
+}
+function deleteOrgFromStore(snapshot, slug, store, backend, resolution) {
+    if (!snapshot.orgs[slug]) {
+        return {
+            deleted: false,
+            backend: store,
+            remaining: Object.keys(snapshot.orgs).length + (snapshot.pending ? 1 : 0),
+        };
+    }
+    const { [slug]: _removed, ...rest } = snapshot.orgs;
+    const remainingSlugs = Object.keys(rest);
+    if (remainingSlugs.length === 0 && !snapshot.pending) {
+        return wipeStore(snapshot.mcpUrl, store, backend, resolution);
+    }
+    const nextActive = snapshot.activeOrg === slug
+        ? remainingSlugs.sort((a, b) => a.localeCompare(b))[0] ?? null
+        : snapshot.activeOrg;
+    const next = {
+        version: 2,
+        mcpUrl: snapshot.mcpUrl,
+        activeOrg: nextActive,
+        orgs: rest,
+        ...(snapshot.pending ? { pending: snapshot.pending } : {}),
+    };
+    try {
+        writeStore(store, next);
+        return { deleted: true, backend: store, remaining: remainingSlugs.length };
+    }
+    catch (error) {
+        if (store.kind === 'keyring' && !backend) {
+            const fallback = fileBackendFor(snapshot.mcpUrl, resolution);
+            writeStore(fallback, next);
+            // Drop the stale keyring secret so the next load prefers the file
+            // (loadCredentials prefers keyring over file when both exist).
+            try {
+                store.delete();
+            }
+            catch {
+                // best-effort; file has the reduced store either way
+            }
+            return { deleted: true, backend: fallback, remaining: remainingSlugs.length };
+        }
+        throw error;
+    }
+}
+function wipeStore(mcpUrl, store, backend, resolution) {
     let deleted = false;
     try {
         deleted = store.delete();
@@ -161,6 +592,6 @@ export function deleteCredentials(mcpUrl = defaultMcpUrl, backend, resolution) {
         const file = fileBackendFor(mcpUrl, resolution);
         deleted = file.delete() || deleted;
     }
-    return { deleted, backend: store };
+    return { deleted, backend: store, remaining: 0 };
 }
 //# sourceMappingURL=store.js.map