@kora-platform/cli 0.7.0-rc1 → 0.8.0-rc10

package/dist/artifact-commands.js

@@ -1,14 +1,17 @@
-import { readFile, writeFile } from "node:fs/promises";
+import { writeFile } from "node:fs/promises";
 import { basename, resolve } from "node:path";
 import { TextDecoder } from "node:util";
 import { genericProblem, usageProblem } from "./cli-errors.js";
 import { readOptionalNumberFlag, readOptionalStringFlag, readRequiredStringFlag } from "./command-flags.js";
-import { renderSuccess, renderTable } from "./format.js";
+import { renderKeyValue, renderSuccess, renderTable } from "./format.js";
+import { readLocalFileBytes } from "./files.js";
+import { confirmDestructive } from "./interaction.js";
 export async function executeArtifactUpload(parsed, context, api, resolveOrgScope) {
     const { org, session } = await resolveOrgScope(parsed, context, api);
     const pathValue = readRequiredArg(parsed, "path");
-    const filePath = resolve(pathValue);
-    const fileBytes = await readFile(filePath);
+    const { absolutePath: filePath, bytes: fileBytes } = await readLocalFileBytes(pathValue, parsed.definition.id, {
+        regularFileMessage: "Artifact upload path must be a regular file, not a directory or symbolic link."
+    });
     const data = await api.uploadArtifact(session, org.id, {
         body: new Uint8Array(fileBytes),
         ...(readOptionalStringFlag(parsed, "sha256") ? { expectedSha256: readOptionalStringFlag(parsed, "sha256") } : {}),
@@ -40,6 +43,27 @@ export async function executeArtifactList(parsed, context, api, resolveOrgScope)
         meta: { command: "artifact list", orgId: org.id }
     };
 }
+export async function executeArtifactInventory(parsed, context, api, resolveOrgScope) {
+    const { org, session } = await resolveOrgScope(parsed, context, api);
+    const data = await api.listArtifacts(session, org.id, readArtifactInventoryFilters(parsed));
+    return {
+        data,
+        human: renderArtifactInventory(data.artifacts),
+        kind: "runtime_artifact_inventory",
+        meta: { command: "artifact inventory", orgId: org.id }
+    };
+}
+export async function executeArtifactInspect(parsed, context, api, resolveOrgScope) {
+    const { org, session } = await resolveOrgScope(parsed, context, api);
+    const artifactId = readRequiredArg(parsed, "artifact-id");
+    const data = await api.getArtifactDetail(session, org.id, artifactId);
+    return {
+        data,
+        human: renderArtifactDetail(data),
+        kind: "runtime_artifact_inspect",
+        meta: { command: "artifact inspect", orgId: org.id }
+    };
+}
 export async function executeArtifactDownload(parsed, context, api, resolveOrgScope) {
     const { org, session } = await resolveOrgScope(parsed, context, api);
     const artifactId = readRequiredArg(parsed, "artifact-id");
@@ -94,6 +118,40 @@ export async function executeArtifactRead(parsed, context, api, resolveOrgScope)
         meta: { command: "artifact read", orgId: org.id }
     };
 }
+export async function executeArtifactArchive(parsed, context, api, resolveOrgScope) {
+    const { org, session } = await resolveOrgScope(parsed, context, api);
+    const artifactId = readRequiredArg(parsed, "artifact-id");
+    const data = await api.archiveArtifact(session, org.id, artifactId);
+    return {
+        data,
+        human: renderSuccess(`Archived artifact ${data.artifact.name} (${data.artifact.artifactId}).`),
+        kind: "runtime_artifact_archive",
+        meta: { command: "artifact archive", orgId: org.id }
+    };
+}
+export async function executeArtifactRestore(parsed, context, api, resolveOrgScope) {
+    const { org, session } = await resolveOrgScope(parsed, context, api);
+    const artifactId = readRequiredArg(parsed, "artifact-id");
+    const data = await api.restoreArtifact(session, org.id, artifactId);
+    return {
+        data,
+        human: renderSuccess(`Restored artifact ${data.artifact.name} (${data.artifact.artifactId}).`),
+        kind: "runtime_artifact_restore",
+        meta: { command: "artifact restore", orgId: org.id }
+    };
+}
+export async function executeArtifactPurge(parsed, context, api, resolveOrgScope) {
+    const { org, session } = await resolveOrgScope(parsed, context, api);
+    const artifactId = readRequiredArg(parsed, "artifact-id");
+    await confirmDestructive(parsed, context, `Purge bytes for artifact ${artifactId}?`);
+    const data = await api.purgeArtifact(session, org.id, artifactId);
+    return {
+        data,
+        human: renderSuccess(`Purged artifact ${data.artifact.name} (${data.artifact.artifactId}); byte deletion is ${data.artifact.byteDeletionStatus}.`),
+        kind: "runtime_artifact_purge",
+        meta: { command: "artifact purge", orgId: org.id }
+    };
+}
 function readRequiredArg(parsed, name) {
     const value = parsed.args[name];
     if (!value) {
@@ -108,6 +166,108 @@ function readArtifactReadMaxBytes(parsed) {
     }
     return maxBytes;
 }
+function readArtifactInventoryLimit(parsed) {
+    const limit = readOptionalNumberFlag(parsed, "limit");
+    if (limit === undefined) {
+        return undefined;
+    }
+    if (!Number.isInteger(limit) || limit <= 0 || limit > 500) {
+        throw usageProblem("--limit must be an integer between 1 and 500.", parsed.definition.id);
+    }
+    return limit;
+}
+function readArtifactInventoryFilters(parsed) {
+    const producerType = readOptionalStringFlag(parsed, "producer-type");
+    const associationRole = readOptionalStringFlag(parsed, "association-role");
+    const associationKind = readOptionalStringFlag(parsed, "association-kind");
+    const runId = readOptionalStringFlag(parsed, "run-id");
+    const workflowId = readOptionalStringFlag(parsed, "workflow-id");
+    const workflowNodeTestId = readOptionalStringFlag(parsed, "workflow-node-test-id");
+    const nodeId = readOptionalStringFlag(parsed, "node-id");
+    const mediaType = readOptionalStringFlag(parsed, "media-type");
+    const lifecycleStatus = readOptionalArtifactLifecycleFilter(parsed);
+    const createdAfter = readOptionalStringFlag(parsed, "created-after");
+    const createdBefore = readOptionalStringFlag(parsed, "created-before");
+    const limit = readArtifactInventoryLimit(parsed);
+    return {
+        ...(producerType ? { producerType } : {}),
+        ...(associationRole ? { associationRole } : {}),
+        ...(associationKind ? { associationKind } : {}),
+        ...(runId ? { runId } : {}),
+        ...(workflowId ? { workflowId } : {}),
+        ...(workflowNodeTestId ? { workflowNodeTestId } : {}),
+        ...(nodeId ? { nodeId } : {}),
+        ...(mediaType ? { mediaType } : {}),
+        ...(lifecycleStatus ? { lifecycleStatus } : {}),
+        ...(createdAfter ? { createdAfter } : {}),
+        ...(createdBefore ? { createdBefore } : {}),
+        ...(limit !== undefined ? { limit } : {})
+    };
+}
+function renderArtifactInventory(records) {
+    return renderTable(records.map((record) => ({
+        artifactId: record.artifact.artifactId,
+        byteDeletionStatus: record.artifact.byteDeletionStatus,
+        inputUsageCount: record.associationSummary.inputUsageCount,
+        lifecycleStatus: record.artifact.lifecycleStatus,
+        name: record.artifact.name,
+        origin: formatArtifactAssociationOrigin(record.originAssociation),
+        outputOriginCount: record.associationSummary.outputOriginCount,
+        producerType: record.artifact.producerType,
+        reviewUsageCount: record.associationSummary.reviewUsageCount
+    })), [
+        { key: "artifactId", label: "Artifact" },
+        { key: "name", label: "Name" },
+        { key: "lifecycleStatus", label: "Lifecycle" },
+        { key: "byteDeletionStatus", label: "Bytes" },
+        { key: "producerType", label: "Producer" },
+        { key: "origin", label: "Origin" },
+        { key: "inputUsageCount", label: "Inputs" },
+        { key: "outputOriginCount", label: "Outputs" },
+        { key: "reviewUsageCount", label: "Reviews" }
+    ]);
+}
+function renderArtifactDetail(input) {
+    const summary = renderKeyValue([
+        { label: "Artifact", value: input.artifact.artifactId },
+        { label: "Name", value: input.artifact.name },
+        { label: "Lifecycle", value: input.artifact.lifecycleStatus },
+        { label: "Bytes", value: input.artifact.byteDeletionStatus },
+        { label: "Producer", value: input.artifact.producerType },
+        { label: "Media type", value: input.artifact.mediaType ?? "" },
+        { label: "Size bytes", value: input.artifact.sizeBytes },
+        { label: "Scan", value: input.artifact.scanStatus },
+        { label: "Created", value: input.artifact.createdAt },
+        { label: "Archived", value: input.artifact.archivedAt ?? "" },
+        { label: "Purged", value: input.artifact.purgedAt ?? "" },
+        { label: "Bytes deleted", value: input.artifact.bytesDeletedAt ?? "" }
+    ]);
+    const associations = renderTable(input.associations.map((association) => ({
+        associatedAt: association.associatedAt,
+        associationKind: association.associationKind,
+        nodeId: association.nodeId ?? "",
+        origin: formatArtifactAssociationOrigin(association),
+        role: association.role,
+    })), [
+        { key: "associationKind", label: "Kind" },
+        { key: "role", label: "Role" },
+        { key: "origin", label: "Origin" },
+        { key: "nodeId", label: "Node" },
+        { key: "associatedAt", label: "Associated" }
+    ]);
+    return `${summary}\n\nAssociations:\n${associations}`;
+}
+function formatArtifactAssociationOrigin(association) {
+    if (!association) {
+        return "";
+    }
+    if (association.workflowNodeTestId) {
+        return association.workflowName
+            ? `${association.workflowName}/${association.workflowNodeTestId}`
+            : association.workflowNodeTestId;
+    }
+    return association.workflowRunId ?? association.workflowId ?? "";
+}
 function isInlineArtifactMediaType(contentType) {
     const normalized = contentType.split(";", 1)[0]?.trim().toLowerCase() ?? "";
     if (normalized === "text/html" ||
@@ -124,3 +284,16 @@ function isInlineArtifactMediaType(contentType) {
 function readArtifactContentType(headers) {
     return headers.get("content-type") ?? "application/octet-stream";
 }
+function readOptionalArtifactLifecycleFilter(parsed) {
+    const lifecycleStatus = readOptionalStringFlag(parsed, "lifecycle-status");
+    if (!lifecycleStatus) {
+        return undefined;
+    }
+    if (lifecycleStatus !== "active" &&
+        lifecycleStatus !== "archived" &&
+        lifecycleStatus !== "purged" &&
+        lifecycleStatus !== "all") {
+        throw usageProblem("--lifecycle-status must be one of active, archived, purged, or all.", parsed.definition.id);
+    }
+    return lifecycleStatus;
+}

package/dist/audit-commands.d.ts

@@ -0,0 +1,12 @@
+import type { createPlatformApiClient } from "./api-client.js";
+import type { CommandExecutionContext, ExecutedCommand } from "./command-types.js";
+import type { ParsedCommand } from "./runner.js";
+import type { CliSessionState } from "./session.js";
+type ResolveOrgScope = (parsed: ParsedCommand, context: CommandExecutionContext, api: ReturnType<typeof createPlatformApiClient>) => Promise<{
+    org: {
+        id: string;
+    };
+    session: CliSessionState;
+}>;
+export declare function executeAudit(parsed: ParsedCommand, context: CommandExecutionContext, api: ReturnType<typeof createPlatformApiClient>, resolveOrgScope: ResolveOrgScope): Promise<ExecutedCommand>;
+export {};

package/dist/audit-commands.js

@@ -0,0 +1,74 @@
+import { usageProblem, genericProblem } from "./cli-errors.js";
+import { readOptionalNumberFlag, readOptionalStringFlag } from "./command-flags.js";
+import { renderPrettyJson, renderTable } from "./format.js";
+export async function executeAudit(parsed, context, api, resolveOrgScope) {
+    const { org, session } = await resolveOrgScope(parsed, context, api);
+    switch (parsed.definition.id) {
+        case "audit.list": {
+            const action = readOptionalStringFlag(parsed, "action");
+            const actorId = readOptionalStringFlag(parsed, "actor");
+            const category = readOptionalStringFlag(parsed, "category");
+            const from = readOptionalStringFlag(parsed, "from");
+            const limit = readOptionalNumberFlag(parsed, "limit");
+            const outcome = readOptionalStringFlag(parsed, "outcome");
+            const resourceId = readOptionalStringFlag(parsed, "resource-id");
+            const resourceType = readOptionalStringFlag(parsed, "resource-type");
+            const to = readOptionalStringFlag(parsed, "to");
+            const data = await api.listAuditEvents(session, org.id, {
+                ...(action ? { action } : {}),
+                ...(actorId ? { actorId } : {}),
+                ...(category ? { category } : {}),
+                ...(from ? { from } : {}),
+                ...(limit !== undefined ? { limit } : {}),
+                ...(outcome ? { outcome } : {}),
+                ...(resourceId ? { resourceId } : {}),
+                ...(resourceType ? { resourceType } : {}),
+                ...(to ? { to } : {})
+            });
+            return {
+                data,
+                human: renderTable(data.events.map(formatAuditEventRow), [
+                    { key: "occurredAt", label: "Occurred" },
+                    { key: "outcome", label: "Outcome" },
+                    { key: "category", label: "Category" },
+                    { key: "action", label: "Action" },
+                    { key: "actorId", label: "Actor" },
+                    { key: "resource", label: "Resource" },
+                    { key: "id", label: "Event" }
+                ]),
+                kind: "audit_event_list",
+                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
+            };
+        }
+        case "audit.get": {
+            const data = await api.getAuditEvent(session, org.id, readRequiredArg(parsed, "event-id"));
+            return {
+                data,
+                human: renderPrettyJson(data.event),
+                kind: "audit_event_get",
+                meta: { command: parsed.definition.path.join(" "), orgId: org.id }
+            };
+        }
+        default:
+            throw genericProblem(`Unhandled audit command ${parsed.definition.id}.`, parsed.definition.id);
+    }
+}
+function formatAuditEventRow(event) {
+    return {
+        ...event,
+        resource: formatAuditResource(event)
+    };
+}
+function formatAuditResource(event) {
+    if (event.resourceType && event.resourceId) {
+        return `${event.resourceType}:${event.resourceId}`;
+    }
+    return event.resourceType ?? event.resourceId ?? "";
+}
+function readRequiredArg(parsed, name) {
+    const value = parsed.args[name];
+    if (!value) {
+        throw usageProblem(`Missing required argument <${name}>.`, parsed.definition.id);
+    }
+    return value;
+}

package/dist/auth-commands.d.ts

@@ -2,5 +2,6 @@ import type { createPlatformApiClient } from "./api-client.js";
 import type { CommandExecutionContext, ExecutedCommand } from "./command-types.js";
 import type { ParsedCommand } from "./runner.js";
 export declare function executeAuthLogin(parsed: ParsedCommand, context: CommandExecutionContext, api: ReturnType<typeof createPlatformApiClient>): Promise<ExecutedCommand>;
+export declare function executeAuthSignup(parsed: ParsedCommand, context: CommandExecutionContext, api: ReturnType<typeof createPlatformApiClient>): Promise<ExecutedCommand>;
 export declare function executeAuthLogout(context: CommandExecutionContext, api: ReturnType<typeof createPlatformApiClient>): Promise<ExecutedCommand>;
 export declare function executeAuthWhoami(context: CommandExecutionContext, api: ReturnType<typeof createPlatformApiClient>): Promise<ExecutedCommand>;

package/dist/auth-commands.js

@@ -1,8 +1,9 @@
-import { authProblem, toProblem } from "./cli-errors.js";
+import { authProblem, toProblem, usageProblem } from "./cli-errors.js";
+import { readOptionalStringFlag } from "./command-flags.js";
 import { writeCliConfig, readCliConfig, findRepoConfigPath } from "./config.js";
 import { renderKeyValue, renderSuccess } from "./format.js";
 import { chooseOrganization, ensureInteractive } from "./interaction.js";
-import { promptPassword, promptText } from "./prompts.js";
+import { isInteractive, promptPassword, promptText } from "./prompts.js";
 export async function executeAuthLogin(parsed, context, api) {
     const prompts = parsed.json
         ? {
@@ -10,13 +11,12 @@ export async function executeAuthLogin(parsed, context, api) {
             stdout: context.stderr
         }
         : context;
+    if (parsed.flags.device === true || !isInteractive(prompts)) {
+        return executeDeviceLogin(parsed, context, api, prompts);
+    }
     ensureInteractive(prompts, "auth login");
-    const persistedGlobalConfig = await readCliConfig(context.configPath);
-    const repoConfigPath = await findRepoConfigPath(context.cwd);
-    const repoConfig = repoConfigPath ? await readCliConfig(repoConfigPath) : {};
-    const envBaseUrl = context.env.KORA_BASE_URL;
-    const configuredBaseUrl = envBaseUrl ?? repoConfig.baseUrl ?? persistedGlobalConfig.baseUrl;
-    const baseUrl = configuredBaseUrl ?? await promptText("Platform base URL: ", prompts);
+    const resolvedBaseUrl = await resolveAuthBaseUrl(parsed, context, prompts);
+    const { baseUrl } = resolvedBaseUrl;
     const authSettings = await readAuthSettingsOrDefault(api, baseUrl);
     const oidcLoginUrl = buildOidcStartUrl(baseUrl);
     if (authSettings.oidcEnabled && !authSettings.localEnabled) {
@@ -28,8 +28,8 @@ export async function executeAuthLogin(parsed, context, api) {
             },
             human: [
                 "SSO is required for this deployment.",
-                `Open this URL in a browser: ${oidcLoginUrl}`,
-                "The CLI does not complete browser SSO login in this release. API keys remain the supported non-browser CLI auth path."
+                "Run `kora auth login --device` to approve this login in the browser instead.",
+                `SSO sign-in URL: ${oidcLoginUrl}`
             ].join("\n"),
             kind: "access_auth_login_sso_required",
             meta: {
@@ -45,41 +45,153 @@ export async function executeAuthLogin(parsed, context, api) {
     const email = await promptText("Email: ", prompts);
     const password = await promptPassword("Password: ", prompts);
     const session = await api.login({ baseUrl, email, password });
-    const organizations = (await api.listOrganizations(session)).organizations;
-    const activeOrg = organizations.length === 1
-        ? organizations[0] ?? null
-        : organizations.length > 1
-            ? await chooseOrganization(organizations, prompts, parsed)
-            : null;
-    const latestSession = await readLatestSessionForWrite(context.sessionStore, session);
-    const sessionForWrite = isSameSessionIdentity(latestSession, session) ? latestSession : session;
-    const nextSession = {
-        ...sessionForWrite,
-        activeOrg: activeOrg
-            ? {
-                id: activeOrg.id,
-                name: activeOrg.name,
-                role: activeOrg.role,
-                slug: activeOrg.slug,
-                status: activeOrg.status
+    const nextSession = await writeSessionWithSelectedOrg({
+        api,
+        context,
+        parsed,
+        prompts,
+        session
+    });
+    if (resolvedBaseUrl.shouldPersistGlobalBaseUrl) {
+        await writeCliConfig(context.configPath, {
+            ...resolvedBaseUrl.persistedGlobalConfig,
+            baseUrl
+        });
+    }
+    return {
+        data: {
+            activeOrg: nextSession.activeOrg,
+            user: nextSession.user
+        },
+        human: renderSuccess(nextSession.activeOrg
+            ? `Logged in as ${nextSession.user.email}. Active org: ${nextSession.activeOrg.slug}.`
+            : `Logged in as ${nextSession.user.email}.`),
+        kind: "access_auth_login",
+        meta: {
+            command: "auth login",
+            orgId: nextSession.activeOrg?.id ?? null
+        }
+    };
+}
+export async function executeAuthSignup(parsed, context, api) {
+    const prompts = parsed.json
+        ? {
+            ...context,
+            stdout: context.stderr
+        }
+        : context;
+    ensureInteractive(prompts, "auth signup");
+    const resolvedBaseUrl = await resolveAuthBaseUrl(parsed, context, prompts);
+    const { baseUrl } = resolvedBaseUrl;
+    const authSettings = await readAuthSettingsOrDefault(api, baseUrl);
+    const oidcLoginUrl = buildOidcStartUrl(baseUrl);
+    if (!authSettings.localEnabled) {
+        return {
+            data: {
+                loginUrl: oidcLoginUrl,
+                mode: authSettings.mode
+            },
+            human: [
+                "Local account signup is disabled for this deployment.",
+                `Account creation is managed by SSO. Sign in once in a browser: ${oidcLoginUrl}`,
+                "Then run `kora auth login --device` to approve a CLI login in the browser."
+            ].join("\n"),
+            kind: "access_auth_signup_sso_required",
+            meta: {
+                command: "auth signup",
+                orgId: null
             }
-            : null
+        };
+    }
+    if (authSettings.oidcEnabled) {
+        prompts.stdout.write(`SSO is also available at: ${oidcLoginUrl}\n`);
+        prompts.stdout.write("Continuing with local account signup.\n");
+    }
+    const name = await promptText("Name: ", prompts);
+    const email = await promptText("Email: ", prompts);
+    const password = await promptPassword("Password: ", prompts);
+    const session = await api.signup({ baseUrl, email, name, password });
+    const nextSession = await writeSessionWithSelectedOrg({
+        api,
+        context,
+        parsed,
+        prompts,
+        session
+    });
+    if (resolvedBaseUrl.shouldPersistGlobalBaseUrl) {
+        await writeCliConfig(context.configPath, {
+            ...resolvedBaseUrl.persistedGlobalConfig,
+            baseUrl
+        });
+    }
+    return {
+        data: {
+            activeOrg: nextSession.activeOrg,
+            user: nextSession.user
+        },
+        human: renderSuccess(nextSession.activeOrg
+            ? `Signed up as ${nextSession.user.email}. Active org: ${nextSession.activeOrg.slug}.`
+            : `Signed up as ${nextSession.user.email}.`),
+        kind: "access_auth_signup",
+        meta: {
+            command: "auth signup",
+            orgId: nextSession.activeOrg?.id ?? null
+        }
     };
-    await context.sessionStore.write(nextSession);
-    if (!envBaseUrl && !repoConfig.baseUrl) {
+}
+async function executeDeviceLogin(parsed, context, api, prompts) {
+    const resolvedBaseUrl = await resolveAuthBaseUrl(parsed, context, prompts, {
+        allowPrompt: isInteractive(prompts)
+    });
+    const { baseUrl } = resolvedBaseUrl;
+    const started = await api.startDeviceLogin(baseUrl);
+    const verificationUrl = buildDeviceVerificationUrl(baseUrl, started.verificationPath, started.userCode);
+    prompts.stdout.write(`Open this URL in a browser to approve the login:\n\n  ${verificationUrl}\n\n`);
+    prompts.stdout.write(`Confirmation code: ${started.userCode}\n`);
+    prompts.stdout.write("Waiting for browser approval...\n");
+    const expiresAtMs = Date.parse(started.expiresAt);
+    const pollIntervalMs = Math.max(0, started.pollIntervalSeconds * 1000);
+    let session = null;
+    while (Date.now() < expiresAtMs) {
+        const claim = await api.claimDeviceLogin({ baseUrl, deviceCode: started.deviceCode });
+        if (claim.status === "approved") {
+            session = claim.session;
+            break;
+        }
+        if (claim.status === "denied") {
+            throw authProblem("Device login was denied in the browser.", "auth login");
+        }
+        if (claim.status === "expired") {
+            break;
+        }
+        await sleep(pollIntervalMs);
+    }
+    if (!session) {
+        throw authProblem("Device login expired before it was approved. Run `kora auth login` again.", "auth login");
+    }
+    const nextSession = await writeSessionWithSelectedOrg({
+        allowInteractiveOrgChoice: isInteractive(prompts),
+        api,
+        context,
+        parsed,
+        prompts,
+        session
+    });
+    if (resolvedBaseUrl.shouldPersistGlobalBaseUrl) {
         await writeCliConfig(context.configPath, {
-            ...persistedGlobalConfig,
+            ...resolvedBaseUrl.persistedGlobalConfig,
             baseUrl
         });
     }
     return {
         data: {
             activeOrg: nextSession.activeOrg,
+            method: "device",
             user: nextSession.user
         },
         human: renderSuccess(nextSession.activeOrg
             ? `Logged in as ${nextSession.user.email}. Active org: ${nextSession.activeOrg.slug}.`
-            : `Logged in as ${nextSession.user.email}.`),
+            : `Logged in as ${nextSession.user.email}. No active organization selected; use \`kora org select <org>\` or \`kora org create\`.`),
         kind: "access_auth_login",
         meta: {
             command: "auth login",
@@ -87,6 +199,57 @@ export async function executeAuthLogin(parsed, context, api) {
         }
     };
 }
+function buildDeviceVerificationUrl(baseUrl, verificationPath, userCode) {
+    const normalizedBaseUrl = baseUrl.replace(/\/+$/u, "");
+    const normalizedPath = verificationPath.startsWith("/") ? verificationPath : `/${verificationPath}`;
+    return `${normalizedBaseUrl}${normalizedPath}?code=${encodeURIComponent(userCode)}`;
+}
+function sleep(ms) {
+    return new Promise((resolve) => {
+        setTimeout(resolve, ms);
+    });
+}
+async function resolveAuthBaseUrl(parsed, context, prompts, options = { allowPrompt: true }) {
+    const persistedGlobalConfig = await readCliConfig(context.configPath);
+    const repoConfigPath = await findRepoConfigPath(context.cwd);
+    const repoConfig = repoConfigPath ? await readCliConfig(repoConfigPath) : {};
+    const flagBaseUrl = readOptionalStringFlag(parsed, "base-url");
+    const envBaseUrl = context.env.KORA_BASE_URL;
+    const configuredBaseUrl = flagBaseUrl ?? envBaseUrl ?? repoConfig.baseUrl ?? persistedGlobalConfig.baseUrl;
+    if (!configuredBaseUrl && !options.allowPrompt) {
+        throw usageProblem("Pass --base-url <url> or set KORA_BASE_URL to log in from a non-interactive shell.", "auth login");
+    }
+    const baseUrl = configuredBaseUrl ?? await promptText("Platform base URL: ", prompts);
+    return {
+        baseUrl,
+        persistedGlobalConfig,
+        shouldPersistGlobalBaseUrl: !flagBaseUrl && !envBaseUrl && !repoConfig.baseUrl
+    };
+}
+async function writeSessionWithSelectedOrg(input) {
+    const organizations = (await input.api.listOrganizations(input.session)).organizations;
+    const activeOrg = organizations.length === 1
+        ? organizations[0] ?? null
+        : organizations.length > 1 && (input.allowInteractiveOrgChoice ?? true)
+            ? await chooseOrganization(organizations, input.prompts, input.parsed)
+            : null;
+    const latestSession = await readLatestSessionForWrite(input.context.sessionStore, input.session);
+    const sessionForWrite = isSameSessionIdentity(latestSession, input.session) ? latestSession : input.session;
+    const nextSession = {
+        ...sessionForWrite,
+        activeOrg: activeOrg
+            ? {
+                id: activeOrg.id,
+                name: activeOrg.name,
+                role: activeOrg.role,
+                slug: activeOrg.slug,
+                status: activeOrg.status
+            }
+            : null
+    };
+    await input.context.sessionStore.write(nextSession);
+    return nextSession;
+}
 async function readAuthSettingsOrDefault(api, baseUrl) {
     try {
         return await api.getAuthSettings(baseUrl);

package/dist/cli-errors.d.ts

@@ -1,13 +1,18 @@
 import { ApiError } from "./transport.js";
+type CliProblemDetails = Record<string, unknown>;
 export declare class CliProblem extends Error {
+    readonly code: string;
     readonly detail: string;
+    readonly details?: CliProblemDetails;
     readonly exitCode: number;
     readonly instance: string;
     readonly status: number;
     readonly title: string;
     readonly type: string;
     constructor(input: {
+        code: string;
         detail: string;
+        details?: CliProblemDetails;
         exitCode: number;
         instance: string;
         status: number;
@@ -15,9 +20,10 @@ export declare class CliProblem extends Error {
         type: string;
     });
 }
-export declare function usageProblem(detail: string, instance: string): CliProblem;
+export declare function usageProblem(detail: string, instance: string, details?: CliProblemDetails): CliProblem;
 export declare function authProblem(detail: string, instance: string): CliProblem;
 export declare function notFoundProblem(detail: string, instance: string): CliProblem;
 export declare function genericProblem(detail: string, instance: string): CliProblem;
 export declare function toProblem(error: unknown, instance: string): CliProblem | ApiError;
 export declare function exitCodeFromError(error: CliProblem | ApiError): number;
+export {};

package/dist/cli-errors.js

@@ -1,6 +1,8 @@
 import { ApiError } from "./transport.js";
 export class CliProblem extends Error {
+    code;
     detail;
+    details;
     exitCode;
     instance;
     status;
@@ -9,7 +11,11 @@ export class CliProblem extends Error {
     constructor(input) {
         super(input.detail);
         this.name = "CliProblem";
+        this.code = input.code;
         this.detail = input.detail;
+        if (input.details) {
+            this.details = input.details;
+        }
         this.exitCode = input.exitCode;
         this.instance = input.instance;
         this.status = input.status;
@@ -17,9 +23,11 @@ export class CliProblem extends Error {
         this.type = input.type;
     }
 }
-export function usageProblem(detail, instance) {
+export function usageProblem(detail, instance, details) {
     return new CliProblem({
+        code: "cli/usage",
         detail,
+        ...(details ? { details } : {}),
         exitCode: 2,
         instance,
         status: 400,
@@ -29,6 +37,7 @@ export function usageProblem(detail, instance) {
 }
 export function authProblem(detail, instance) {
     return new CliProblem({
+        code: "cli/auth",
         detail,
         exitCode: 3,
         instance,
@@ -39,6 +48,7 @@ export function authProblem(detail, instance) {
 }
 export function notFoundProblem(detail, instance) {
     return new CliProblem({
+        code: "cli/not_found",
         detail,
         exitCode: 4,
         instance,
@@ -49,6 +59,7 @@ export function notFoundProblem(detail, instance) {
 }
 export function genericProblem(detail, instance) {
     return new CliProblem({
+        code: "cli/error",
         detail,
         exitCode: 1,
         instance,