@nurix/nustack 0.10.0-dev.10

package/dist/commands/init.js

@@ -0,0 +1,280 @@
+import { randomUUID } from "node:crypto";
+import path from "node:path";
+import * as p from "@clack/prompts";
+import { createWorkspaceViaAsk, createOrganization, getWorkspace, listWorkspaces, listOrganizations, resolveNuStackUrl, } from "../lib/nustack_client.js";
+import { ensureAccessToken } from "../lib/auth_grant.js";
+import { getOrCreateDeviceId } from "../lib/device_identity.js";
+import { isInteractive } from "../lib/interactive.js";
+import { resolveOrganizationId } from "../lib/workspace_context.js";
+import { openLocalStore } from "../lib/local_store/database.js";
+import { readDeviceState, upsertDeviceState } from "../lib/local_store/device_state.js";
+import { hasManifest, scaffoldManifest } from "../lib/manifest.js";
+import { readWorkspaceManifests } from "../lib/onboarding/manifest_writer.js";
+import { attachRejection, classifyFolder } from "../lib/onboarding/folder_state.js";
+import { attachExistingGit } from "../lib/onboarding/attach_existing_git.js";
+import { initFreshFolder } from "../lib/onboarding/init_fresh_folder.js";
+import { webFirstAttach } from "../lib/onboarding/web_first_attach.js";
+import { performDeviceLogin } from "./login.js";
+export async function runInit(options) {
+    const cwd = process.cwd();
+    const baseUrl = resolveNuStackUrl(options);
+    p.intro("nustack init");
+    if (!isInteractive()) {
+        p.log.error("nustack init needs an interactive terminal (browser sign-in + prompts).");
+        p.outro("Re-run in a terminal, or run `nustack login --no-open` in a scripted context first.");
+        process.exitCode = 1;
+        return;
+    }
+    const accessToken = await ensureSignedIn(baseUrl, cwd);
+    if (!accessToken)
+        return;
+    await runOnboardingFlow(baseUrl, accessToken, {
+        yes: options.yes,
+        workspace: options.workspace,
+        organization: options.organization,
+    });
+}
+export async function ensureSignedIn(baseUrl, cwd) {
+    const deviceAuth = await ensureAccessToken(baseUrl).catch(() => null);
+    if (deviceAuth) {
+        p.log.success(`Signed in as ${deviceAuth.userEmail}`);
+        return deviceAuth.accessToken;
+    }
+    if (!(await performDeviceLogin(baseUrl, cwd))) {
+        p.outro("Sign-in failed — nothing was written.");
+        process.exitCode = 1;
+        return null;
+    }
+    const refreshed = await ensureAccessToken(baseUrl).catch(() => null);
+    if (!refreshed) {
+        p.outro("Sign-in did not complete — run `nustack login` and retry.");
+        process.exitCode = 1;
+        return null;
+    }
+    return refreshed.accessToken;
+}
+export async function runOnboardingFlow(baseUrl, accessToken, options) {
+    const store = await openLocalStore();
+    try {
+        const device = readDeviceState(store);
+        const ctx = {
+            store,
+            baseUrl,
+            accessToken,
+            deviceRef: device?.deviceRef ?? (await getOrCreateDeviceId()),
+            userId: device?.activeUserId ?? null,
+            cwd: process.cwd(),
+            json: false,
+            yes: options.yes === true,
+            interactive: isInteractive(),
+        };
+        await routeOnboarding(ctx, options);
+    }
+    finally {
+        store.close();
+    }
+}
+async function routeOnboarding(ctx, options) {
+    if (options.workspaceId) {
+        await routeWebFirst(ctx, options, options.workspaceId);
+        return;
+    }
+    const state = classifyFolder(ctx.cwd);
+    if (state.class === "git_worktree" && state.repository && state.git) {
+        await routeExistingGit(ctx, options, state.repository.repositoryRoot, state.git.markerWorkspaceId);
+        return;
+    }
+    await routeFreshFolder(ctx, options, state.class === "populated_non_git");
+}
+async function routeExistingGit(ctx, options, root, markerWorkspaceId) {
+    const state = classifyFolder(ctx.cwd);
+    const rejection = state.git ? attachRejection(state.git) : null;
+    if (rejection) {
+        reportFailure({ code: rejection.toUpperCase(), message: rejectionMessage(rejection) });
+        return;
+    }
+    if (!hasManifest(root)) {
+        await scaffoldManifest(root, deriveRepoName(path.basename(root)));
+    }
+    let workspaceId;
+    let organizationId;
+    if (markerWorkspaceId) {
+        workspaceId = markerWorkspaceId;
+        const manifests = await readWorkspaceManifests(root);
+        const recorded = manifests.workspaceManifest?.organizationId ?? manifests.serviceWorkspaceBinding?.organizationId ?? null;
+        const resolved = recorded ?? (await resolveOrganizationInteractive(ctx, options));
+        if (!resolved)
+            return;
+        organizationId = resolved;
+    }
+    else {
+        const resolved = await resolveOrganizationInteractive(ctx, options);
+        if (!resolved)
+            return;
+        organizationId = resolved;
+        const chosen = await chooseOrCreateWorkspace(ctx, organizationId, root, "existing_local");
+        if (!chosen)
+            return;
+        workspaceId = chosen;
+    }
+    const spinner = p.spinner();
+    spinner.start("Attaching this repository");
+    const outcome = await attachExistingGit(ctx, { workspaceId, organizationId, confirmRebind: true });
+    spinner.stop(outcome.ok ? "Attached" : "Attach failed", outcome.ok ? 0 : 1);
+    if (outcome.ok)
+        reportSuccess(outcome.result);
+    else
+        reportFailure(outcome);
+}
+async function routeFreshFolder(ctx, options, populated) {
+    const organizationId = await resolveOrganizationInteractive(ctx, options);
+    if (!organizationId)
+        return;
+    const identity = await promptWorkspaceIdentity(ctx);
+    if (!identity)
+        return;
+    const input = { organizationId, name: identity.name, slug: identity.slug, hasUi: true };
+    let outcome = await initFreshFolder(ctx, populated ? { ...input, confirmPopulated: ctx.yes || undefined } : input);
+    if (!outcome.ok && outcome.code === "CONFIRMATION_REQUIRED") {
+        const confirmed = ctx.yes || (ctx.interactive && (await confirm(outcome.message)));
+        if (!confirmed) {
+            p.outro("No changes made — the folder was left untouched.");
+            return;
+        }
+        outcome = await initFreshFolder(ctx, { ...input, confirmPopulated: true });
+    }
+    if (outcome.ok)
+        reportSuccess(outcome.result);
+    else
+        reportFailure(outcome);
+}
+async function routeWebFirst(ctx, options, workspaceId) {
+    const organizationId = await resolveOrganizationInteractive(ctx, options);
+    if (!organizationId)
+        return;
+    let outcome = await webFirstAttach(ctx, { workspaceId, organizationId, confirmPopulated: ctx.yes || undefined });
+    if (!outcome.ok && outcome.code === "CONFIRMATION_REQUIRED") {
+        const confirmed = ctx.yes || (ctx.interactive && (await confirm(outcome.message)));
+        if (!confirmed) {
+            p.outro("No changes made — the folder was left untouched.");
+            return;
+        }
+        outcome = await webFirstAttach(ctx, { workspaceId, organizationId, confirmPopulated: true });
+    }
+    if (!outcome.ok) {
+        reportFailure(outcome);
+        return;
+    }
+    if (outcome.result.overwriteRequired) {
+        p.log.warn(`Local content diverges from the Workspace on ${outcome.result.divergent.map((d) => d.path).join(", ")}. ` +
+            "Nothing was changed — review and approve with `nustack workspace sync approve` (a recovery bundle is kept).");
+    }
+    reportSuccess(outcome.result);
+}
+async function resolveOrganizationInteractive(ctx, options) {
+    const memberships = await listOrganizations(ctx.baseUrl, ctx.accessToken);
+    const active = readDeviceState(ctx.store)?.activeOrganizationId ?? null;
+    const resolved = resolveOrganizationId({ organization: options.organization }, active, memberships.map((m) => ({ id: m.organization.id, slug: m.organization.slug })));
+    if (resolved.ok)
+        return resolved.organizationId;
+    if (!ctx.interactive) {
+        reportFailure({ code: "ORGANIZATION_CONTEXT_MISSING", message: resolved.message });
+        return null;
+    }
+    if (memberships.length === 0) {
+        const name = await p.text({ message: "Name your first Organization:", placeholder: "my-team" });
+        if (p.isCancel(name) || String(name).trim() === "") {
+            reportFailure({ code: "ORGANIZATION_CONTEXT_MISSING", message: "An Organization is required to continue." });
+            return null;
+        }
+        const organization = await createOrganization(ctx.baseUrl, ctx.accessToken, { label: String(name).trim() }, randomUUID());
+        upsertDeviceState(ctx.store, { activeOrganizationId: organization.id });
+        return organization.id;
+    }
+    const pick = await p.select({
+        message: "Which Organization should this Workspace live in?",
+        options: memberships.map((m) => ({ value: m.organization.id, label: `${m.organization.label} (${m.organization.slug})` })),
+    });
+    if (p.isCancel(pick))
+        return null;
+    upsertDeviceState(ctx.store, { activeOrganizationId: String(pick) });
+    return String(pick);
+}
+async function chooseOrCreateWorkspace(ctx, organizationId, root, entryMode) {
+    const CREATE = "__create__";
+    const workspaces = ctx.interactive ? await listWorkspaces(ctx.baseUrl, ctx.accessToken, organizationId) : [];
+    const pick = ctx.interactive
+        ? await p.select({
+            message: "Attach this repository to which Workspace?",
+            options: [
+                { value: CREATE, label: "Create a new Workspace" },
+                ...workspaces.map((a) => ({ value: a.id, label: `${a.label} (${a.id})` })),
+            ],
+        })
+        : CREATE;
+    if (p.isCancel(pick))
+        return null;
+    if (pick !== CREATE)
+        return String(pick);
+    const identity = await promptWorkspaceIdentity(ctx, deriveRepoName(path.basename(root)));
+    if (!identity)
+        return null;
+    return createAndAwaitWorkspace(ctx, organizationId, identity, entryMode);
+}
+async function createAndAwaitWorkspace(ctx, organizationId, identity, entryMode) {
+    void entryMode;
+    const spinner = p.spinner();
+    spinner.start(`Creating Workspace "${identity.name}"`);
+    try {
+        const outcome = await createWorkspaceViaAsk(ctx.baseUrl, ctx.accessToken, organizationId, `Create a workspace named "${identity.name}".`);
+        const final = await getWorkspace(ctx.baseUrl, ctx.accessToken, outcome.workspaceId);
+        const failed = final.status === "initialization_failed" || final.initStatus === "failed";
+        spinner.stop(failed ? "Workspace initialization failed" : `Workspace ${outcome.workspaceId} ready`, failed ? 1 : 0);
+        return failed ? null : outcome.workspaceId;
+    }
+    catch (error) {
+        spinner.stop("Workspace creation failed", 1);
+        p.log.error(error instanceof Error ? error.message : String(error));
+        return null;
+    }
+}
+async function promptWorkspaceIdentity(ctx, fallback) {
+    const defaultName = fallback ?? deriveRepoName(path.basename(ctx.cwd));
+    if (!ctx.interactive)
+        return { name: defaultName, slug: deriveRepoName(defaultName) };
+    const name = await p.text({ message: "Name this Workspace:", defaultValue: defaultName, placeholder: defaultName });
+    if (p.isCancel(name))
+        return null;
+    const resolved = String(name).trim() || defaultName;
+    return { name: resolved, slug: deriveRepoName(resolved) };
+}
+async function confirm(message) {
+    const answer = await p.confirm({ message });
+    return !p.isCancel(answer) && answer === true;
+}
+function reportSuccess(result) {
+    p.log.success(`Bound to Workspace ${result.workspaceId} on branch ${result.boundBranch} (binding ${result.bindingId}).`);
+    p.log.info(`Toolkit ${result.toolkit.name}@${result.toolkit.version}. No Git push, pull, or remote was created.`);
+    p.outro("Ready — `nustack workspace status` · `nustack docs list` · `nustack workspace sync now`.");
+}
+function reportFailure(failure) {
+    p.log.error(failure.message);
+    p.outro(`Onboarding stopped (${failure.code}). Nothing was pushed.`);
+    process.exitCode = 1;
+}
+function rejectionMessage(rejection) {
+    switch (rejection) {
+        case "nested_workspace":
+            return "This repository is nested inside another NuStack Workspace — one Workspace has one logical repository root (F-014).";
+        case "operation_in_progress":
+            return "A merge, rebase, cherry-pick, or revert is in progress — finish or abort it, then re-run.";
+        case "detached_head":
+            return "HEAD is detached — check out a branch before onboarding.";
+    }
+}
+function deriveRepoName(source) {
+    return source
+        .toLowerCase()
+        .replace(/[^a-z0-9-]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+}

package/dist/commands/lane.js

@@ -0,0 +1,12 @@
+import { LaneSupervisor } from "../lib/lanes/supervisor.js";
+import { sessionsClientFromEnv } from "../lib/sessions/client.js";
+export async function runLaneServe(engineVersion) {
+    const supervisor = new LaneSupervisor({
+        input: process.stdin,
+        output: process.stdout,
+        engineVersion,
+        sessions: sessionsClientFromEnv(process.env),
+    });
+    await supervisor.run();
+    process.exit(0);
+}

package/dist/commands/list.js

@@ -0,0 +1,20 @@
+import { fetchCatalogue, resolveNuStackUrl } from "../lib/nustack_client.js";
+import { printJsonSuccess } from "../lib/json_output.js";
+export async function runList(options, globals) {
+    const baseUrl = resolveNuStackUrl(globals);
+    const catalogue = await fetchCatalogue(baseUrl);
+    const services = catalogue.services ?? [];
+    if (options.json) {
+        printJsonSuccess("list", { services });
+        return;
+    }
+    if (services.length === 0) {
+        console.log(`Catalogue at ${baseUrl} is empty.`);
+        return;
+    }
+    for (const service of services) {
+        const classifier = service.type ?? service.kind ?? "?";
+        const status = service.status ?? "?";
+        console.log(`${service.name.padEnd(30)} ${classifier.padEnd(18)} ${status.padEnd(14)} ${service.description ?? ""}`);
+    }
+}

package/dist/commands/login.js

@@ -0,0 +1,134 @@
+import * as p from "@clack/prompts";
+import { resolveNuStackUrl } from "../lib/nustack_client.js";
+import { launchBrowser } from "../lib/browser_opener.js";
+import { isKeychainAvailable } from "../lib/device_keychain.js";
+import { isInteractive } from "../lib/interactive.js";
+import { ensureAccessToken, loginWithLoopback, loginWithPastedCode, prepareLogin, } from "../lib/auth_grant.js";
+async function readStdinLine() {
+    return new Promise((resolve) => {
+        let buffered = "";
+        const onData = (chunk) => {
+            buffered += chunk.toString();
+            const newline = buffered.indexOf("\n");
+            if (newline >= 0) {
+                process.stdin.off("data", onData);
+                process.stdin.pause();
+                resolve(buffered.slice(0, newline));
+            }
+        };
+        process.stdin.on("data", onData);
+        process.stdin.once("end", () => resolve(buffered));
+        process.stdin.resume();
+    });
+}
+async function promptForCode() {
+    if (!isInteractive())
+        return readStdinLine();
+    const answer = await p.text({ message: "Paste the code from the sign-in page", placeholder: "code" });
+    if (p.isCancel(answer))
+        throw new Error("Sign-in cancelled.");
+    return String(answer);
+}
+function waitForEnter() {
+    if (!isInteractive())
+        return undefined;
+    return () => new Promise((resolve) => {
+        const onData = (chunk) => {
+            if (chunk.toString().includes("\n") || chunk.toString().includes("\r")) {
+                process.stdin.off("data", onData);
+                process.stdin.pause();
+                resolve();
+            }
+        };
+        process.stdin.on("data", onData);
+        process.stdin.resume();
+    });
+}
+async function pasteFlow(ctx, flags) {
+    return loginWithPastedCode(ctx, {
+        force: flags.force,
+        onAuthorizeUrl: (url) => p.note(`${url}\n\nSign in there, then copy the code the page shows.`, "Open this URL in any browser"),
+        promptForCode,
+    });
+}
+async function loopbackFlow(ctx, flags) {
+    const ui = { spinner: null };
+    const switchToPaste = waitForEnter();
+    try {
+        return await loginWithLoopback(ctx, {
+            force: flags.force,
+            onAuthorizeUrl: (url) => {
+                p.note(`${url}\n\n${isInteractive() ? "Press Enter to paste a code instead." : ""}`.trim(), "Sign in with your browser");
+                if (flags.open !== false)
+                    launchBrowser(url);
+                ui.spinner = p.spinner();
+                ui.spinner.start("Waiting for the browser");
+            },
+            switchToPaste: switchToPaste
+                ? async () => {
+                    await switchToPaste();
+                    ui.spinner?.stop("Switching to a pasted code");
+                    ui.spinner = null;
+                }
+                : undefined,
+            promptForCode,
+        });
+    }
+    finally {
+        ui.spinner?.stop("Done");
+    }
+}
+export async function performDeviceLogin(baseUrl, _cwd = process.cwd(), flags = {}) {
+    if (!isKeychainAvailable()) {
+        p.log.error("No OS keychain on this platform — NuStack keeps a machine's sign-in only in the keychain.");
+        return false;
+    }
+    if (!flags.force && !flags.reauthorize) {
+        const live = await ensureAccessToken(baseUrl).catch(() => null);
+        if (live) {
+            p.log.success(`Signed in as ${live.userEmail || "this account"} — already signed in on this machine (use --force to switch accounts).`);
+            return true;
+        }
+    }
+    let result;
+    try {
+        const ctx = await prepareLogin(baseUrl);
+        const useManual = flags.manual === true;
+        if (isInteractive() && !useManual && flags.manual === undefined) {
+            const choice = await p.select({
+                message: "How do you want to sign in?",
+                options: [
+                    { value: "browser", label: "Log in with browser", hint: "opens your browser on this machine" },
+                    { value: "paste", label: "Paste a code", hint: "sign in anywhere and paste the code here" },
+                ],
+                initialValue: "browser",
+            });
+            if (p.isCancel(choice)) {
+                p.log.warn("Sign-in cancelled.");
+                return false;
+            }
+            result = choice === "paste" ? await pasteFlow(ctx, flags) : await loopbackFlow(ctx, flags);
+        }
+        else {
+            result = useManual ? await pasteFlow(ctx, flags) : await loopbackFlow(ctx, flags);
+        }
+    }
+    catch (error) {
+        p.log.error(error instanceof Error ? error.message : String(error));
+        return false;
+    }
+    p.log.success(`Signed in as ${result.userEmail || "this account"}`);
+    p.log.info("This machine's grant is saved to your keychain — the desktop shares it. Manage it with `nustack device list`.");
+    return true;
+}
+export async function runLogin(options, flags = {}) {
+    const baseUrl = resolveNuStackUrl(options);
+    p.intro("nustack login");
+    const didLogin = await performDeviceLogin(baseUrl, process.cwd(), flags);
+    if (!didLogin) {
+        p.outro("Nothing was written.");
+        process.exitCode = 1;
+        return;
+    }
+    p.outro("Signed in on this device.");
+}

package/dist/commands/logout.js

@@ -0,0 +1,44 @@
+import * as p from "@clack/prompts";
+import { resolveNuStackUrl } from "../lib/nustack_client.js";
+import { clearDeviceId } from "../lib/device_identity.js";
+import { deleteDeviceCredential, isKeychainAvailable } from "../lib/device_keychain.js";
+import { fetchAuthConfig, readGrant, revokeGrant } from "../lib/auth_grant.js";
+const SHARED_SIGNOUT_NOTE = "This signs out both the CLI and the desktop on this machine.";
+export async function runLogout(options, flags = {}) {
+    p.intro("nustack logout");
+    const baseUrl = resolveNuStackUrl(options);
+    const grant = isKeychainAvailable() ? await readGrant() : null;
+    if (grant) {
+        const clientId = grant.clientId ?? (await fetchAuthConfig(baseUrl).then((c) => c.clientId).catch(() => null));
+        const outcome = clientId ? await revokeGrant({ authBaseUrl: grant.authBaseUrl, refreshToken: grant.grantToken, clientId }) : "unreachable";
+        if (outcome === "revoked") {
+            p.log.success("Ended this machine's grant at the auth service — it can no longer mint access.");
+        }
+        else if (outcome === "already_ended") {
+            p.log.info("This machine's grant had already been ended at the auth service.");
+        }
+        else if (outcome === "refused") {
+            p.log.warn("The auth service refused to end the grant — clearing local material anyway. Revoke it from Profile › Devices.");
+        }
+        else {
+            p.log.warn("Couldn't reach the auth service to end the grant — clearing local material anyway. Revoke it from Profile › Devices when you are back online.");
+        }
+        const cleared = await deleteDeviceCredential(grant.deviceId);
+        if (cleared)
+            p.log.success("Cleared the keychain grant.");
+    }
+    else {
+        p.log.info("No keychain credential to clear on this machine.");
+    }
+    p.log.info(SHARED_SIGNOUT_NOTE);
+    if (flags.forgetDevice) {
+        const forgot = await clearDeviceId();
+        if (forgot) {
+            p.log.success("Cleared ~/.nustack/device_id (the shared machine identity) — the next login mints a new one.");
+        }
+        else {
+            p.log.info("No ~/.nustack/device_id to clear.");
+        }
+    }
+    p.outro("Signed out. Run `nustack login` to sign back in.");
+}

package/dist/commands/open.js

@@ -0,0 +1,54 @@
+import * as p from "@clack/prompts";
+import { fetchCatalogue, resolveNuStackUrl } from "../lib/nustack_client.js";
+import { launchBrowser } from "../lib/browser_opener.js";
+import { printJsonError, printJsonSuccess } from "../lib/json_output.js";
+export async function runOpen(serviceName, options, globals) {
+    const baseUrl = resolveNuStackUrl(globals);
+    const json = options.json === true;
+    const catalogue = await fetchCatalogue(baseUrl);
+    const entry = (catalogue.services ?? []).find((service) => service.name === serviceName);
+    if (!entry) {
+        const message = `'${serviceName}' is not in the catalogue at ${baseUrl}.`;
+        if (json)
+            printJsonError("open", { code: "SERVICE_NOT_FOUND", message });
+        else {
+            p.log.error(message);
+            process.exitCode = 1;
+        }
+        return;
+    }
+    const endpoints = entry.http?.endpoints ?? {};
+    const wanted = options.env ?? "dev";
+    const resolved = resolveUrl(endpoints, wanted, entry.repository);
+    if (!resolved) {
+        const message = `'${serviceName}' declares no endpoints and no repository to open.`;
+        if (json)
+            printJsonError("open", { code: "NOTHING_TO_OPEN", message });
+        else {
+            p.log.error(message);
+            process.exitCode = 1;
+        }
+        return;
+    }
+    if (json) {
+        printJsonSuccess("open", { service: serviceName, url: resolved.url, source: resolved.source });
+        return;
+    }
+    launchBrowser(resolved.url);
+    p.log.success(`Opening ${resolved.url} (${resolved.source})`);
+}
+function resolveUrl(endpoints, wanted, repository) {
+    const wantedUrl = endpoints[wanted];
+    if (wantedUrl)
+        return { url: wantedUrl, source: wanted };
+    if (endpoints.dev)
+        return { url: endpoints.dev, source: "dev" };
+    if (endpoints.production)
+        return { url: endpoints.production, source: "production" };
+    const [firstEnv, firstUrl] = Object.entries(endpoints)[0] ?? [];
+    if (firstEnv && firstUrl)
+        return { url: firstUrl, source: firstEnv };
+    if (repository)
+        return { url: repository, source: "repository" };
+    return null;
+}

package/dist/commands/organization.js

@@ -0,0 +1,114 @@
+import { randomUUID } from "node:crypto";
+import { createOrganization, listOrganizations, resolveNuStackUrl, } from "../lib/nustack_client.js";
+import { ensureAuthWithRecovery, lastAuthFailure } from "../lib/auth_recovery.js";
+import { openLocalStore } from "../lib/local_store/database.js";
+import { readDeviceState, upsertDeviceState } from "../lib/local_store/device_state.js";
+import { printJsonError, printJsonSuccess } from "../lib/json_output.js";
+async function requireAuth(command, json, globals) {
+    const baseUrl = resolveNuStackUrl(globals);
+    const deviceAuth = await ensureAuthWithRecovery(baseUrl, json);
+    if (!deviceAuth) {
+        const failure = lastAuthFailure();
+        if (json)
+            printJsonError(command, { code: failure.code, message: failure.message });
+        else {
+            console.error(failure.message);
+            process.exitCode = 1;
+        }
+        return null;
+    }
+    return { baseUrl, accessToken: deviceAuth.accessToken };
+}
+export async function runOrganizationList(options, globals) {
+    const json = options.json === true;
+    const auth = await requireAuth("organization list", json, globals);
+    if (!auth)
+        return;
+    const memberships = await listOrganizations(auth.baseUrl, auth.accessToken);
+    const active = await readActiveOrganizationId();
+    if (json) {
+        printJsonSuccess("organization list", {
+            activeOrganizationId: active,
+            organizations: memberships.map((m) => ({ ...m.organization, role: m.role, active: m.organization.id === active })),
+        });
+        return;
+    }
+    if (memberships.length === 0) {
+        console.log("No Organization memberships. Create one with `nustack organization create <name>`.");
+        return;
+    }
+    for (const m of memberships) {
+        const marker = m.organization.id === active ? "*" : " ";
+        console.log(`${marker} ${m.organization.id.padEnd(24)} ${m.organization.slug.padEnd(20)} ${m.organization.label.padEnd(24)} ${m.role}`);
+    }
+}
+export async function runOrganizationCreate(name, options, globals) {
+    const json = options.json === true;
+    if (!name || name.trim() === "") {
+        const message = "An Organization name is required: `nustack organization create <name>`.";
+        if (json)
+            printJsonError("organization create", { code: "VALIDATION_FAILED", message });
+        else {
+            console.error(message);
+            process.exitCode = 1;
+        }
+        return;
+    }
+    const auth = await requireAuth("organization create", json, globals);
+    if (!auth)
+        return;
+    const organization = await createOrganization(auth.baseUrl, auth.accessToken, { label: name.trim() }, randomUUID());
+    if (json) {
+        printJsonSuccess("organization create", { organization });
+        return;
+    }
+    console.log(`Created Organization ${organization.label} (${organization.id}, slug ${organization.slug}).`);
+    console.log("Set it active with `nustack organization use " + organization.id + "`.");
+}
+export async function runOrganizationUse(target, options, globals) {
+    const json = options.json === true;
+    const auth = await requireAuth("organization use", json, globals);
+    if (!auth)
+        return;
+    const memberships = await listOrganizations(auth.baseUrl, auth.accessToken);
+    const match = memberships.find((m) => m.organization.id === target || m.organization.slug === target);
+    if (!match) {
+        const message = `No Organization "${target}" among your memberships — run \`nustack organization list\`.`;
+        if (json)
+            printJsonError("organization use", { code: "ORGANIZATION_CONTEXT_MISSING", message });
+        else {
+            console.error(message);
+            process.exitCode = 1;
+        }
+        return;
+    }
+    const store = await openLocalStore();
+    try {
+        upsertDeviceState(store, { activeOrganizationId: match.organization.id });
+    }
+    finally {
+        store.close();
+    }
+    if (json) {
+        printJsonSuccess("organization use", { activeOrganizationId: match.organization.id, organization: match.organization });
+        return;
+    }
+    console.log(`Active Organization set to ${match.organization.label} (${match.organization.id}).`);
+}
+async function readActiveOrganizationId() {
+    try {
+        const store = await openLocalStore();
+        try {
+            return readDeviceState(store)?.activeOrganizationId ?? null;
+        }
+        finally {
+            store.close();
+        }
+    }
+    catch {
+        return null;
+    }
+}
+export async function readActiveOrganizationContext() {
+    return readActiveOrganizationId();
+}