@ora-ai/cli 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ora (ora-ai)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,102 @@
+# ora — the ora CLI
+
+Drive the [ora](https://agentfront.sh) public API from your terminal. Every
+command is generated from ora's public OpenAPI document, so the CLI always
+matches the API: `https://api.agentfront.sh/openapi.json`.
+
+## Install
+
+    npm install -g @ora-ai/cli
+    ora --help
+
+(`npx @ora-ai/cli` also works. Note: bare `npx ora` fetches an unrelated npm
+spinner library — always use the scoped package name with npx.)
+
+## Interactive
+
+Just run `ora` — browse every command, get prompted for arguments, and see
+the equivalent scriptable command before it runs.
+
+    ora
+
+This only opens in a real terminal (both stdin and stdout attached to a tty).
+Piped or scripted (`ora | less`, `ora > out.txt`, inside CI), bare `ora`
+prints `--help` instead — nothing changes for existing scripts.
+
+## Authenticate
+
+Mint an api key in the ora dashboard (Settings → API keys), then:
+
+    ora login            # paste the key (masked), or:
+    ora login --api-key ora_sk_...
+    ora whoami
+
+In CI, skip login and export `ORA_API_KEY` (prefer short-expiry keys). The
+key is stored at `~/.config/ora/config.json` (0600) and exchanged for a
+short-lived token on every call — the key itself never travels beyond the
+token exchange.
+
+## Use
+
+Every command's `--help` ends with a ready-to-run example (including a request
+body where one is needed) — the fastest way to learn a command is to ask it:
+
+    ora --help                             # all command groups
+    ora experiment runs --help             # everything you can do with runs
+    ora experiment runs create --help      # flags + an example run.json
+
+### Runs — launch and follow agent executions
+
+    ora experiment runs list --page-size 20
+
+    cat > run.json <<'EOF'
+    { "intent": "check pricing for acme.com", "harness": "eve", "model": "claude-sonnet-5" }
+    EOF
+    ora experiment runs create --file run.json           # returns {runId, streamUrl, status}
+    ora experiment runs create --file run.json --watch   # same, then streams live events until done
+    ora experiment runs stream <run-id>                  # attach to a run already in flight
+    ora experiment runs feed                             # org-wide live feed of run status changes
+
+After a run completes, read its artifacts:
+
+    ora experiment runs insight <run-id>       # the analyzed outcome
+    ora experiment runs trajectory <run-id>    # step-by-step trace
+    ora experiment runs raw-trace <run-id>     # the full raw event log
+
+### Intents — AEO measurement (studio)
+
+    ora intents list
+    cat > intent.json <<'EOF'
+    { "title": "Best AEO platform for B2B SaaS", "layer": "discovery" }
+    EOF
+    ora intents create --file intent.json
+    ora intents measurements-status                # are the daily measurements running?
+    ora intents measurements-pause-all             # stop the scans
+    ora intents measurements-resume-all            # restart them
+
+### Sessions — long-lived agent environments
+
+    ora sessions catalog        # harnesses + models you can launch
+    ora sessions list
+    ora sessions hibernate <id>
+    ora sessions wake <id>
+
+### Scripting
+
+`--json` prints the raw API response; with `--watch` it becomes NDJSON (the
+create response first, then one line per event). Exit codes: 0 ok, 1 API/auth
+error, 2 usage error.
+
+    id=$(ora experiment runs create --file run.json --json | jq -r .runId)
+    ora experiment runs stream "$id" --json | jq -c 'select(.event == "step")'
+
+    ora experiment runs list --json | jq '.results[] | {id, harness, status}'
+
+In CI, export `ORA_API_KEY` instead of logging in. Point at another
+environment with `ORA_API_URL` or `--api-url`.
+
+## Errors that explain themselves
+
+- **402** — a plan limit was hit; the message names the dimension and where to upgrade.
+- **403 INSUFFICIENT_SCOPE** — the key lacks a scope; the message names it. Mint
+  a key with that scope and `ora login` again.

package/dist/auth-commands.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The three handwritten auth commands: login / logout / whoami — plus
+ * performLogin/performWhoami, the cores shared verbatim with the interactive
+ * session (interactive/session.ts imports both).
+ *
+ * ResolvedDeps is imported type-only from program.ts — no runtime edge back
+ * to program.ts (program.ts imports these attach* functions by value; see
+ * that file's session-cycle doc comment for the same pattern).
+ */
+import type { Command } from "commander";
+import type { ResolvedDeps } from "./program.js";
+/**
+ * The login core: validate the `ora_sk_` prefix → store → verify by
+ * exchanging for a token → roll back the stored key on verification failure.
+ * Shared verbatim by the scripted `login` action and (Task 4) the
+ * interactive session — prints exactly the lines the action always printed
+ * and returns whether login succeeded.
+ */
+export declare function performLogin(deps: ResolvedDeps, opts: {
+    apiKey?: string;
+    apiUrl?: string;
+}): Promise<boolean>;
+/**
+ * The whoami core: verify the configured key and print its identity. THE one
+ * implementation — shared verbatim by the scripted `whoami` action and the
+ * interactive session's whoami menu entry (interactive/session.ts) so the two
+ * doors never drift apart. Returns whether it succeeded and never throws;
+ * mirrors runOperation's own caller contract (sets process.exitCode on
+ * failure, leaves it alone on success) so both callers reset exit-code state
+ * the same way.
+ */
+export declare function performWhoami(deps: ResolvedDeps, opts: {
+    json?: boolean;
+    apiUrlFlag?: string;
+}): Promise<boolean>;
+export declare function attachLogin(program: Command, deps: ResolvedDeps): void;
+export declare function attachLogout(program: Command, deps: ResolvedDeps): void;
+export declare function attachWhoami(program: Command, deps: ResolvedDeps): void;
+//# sourceMappingURL=auth-commands.d.ts.map

package/dist/auth-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-commands.d.ts","sourceRoot":"","sources":["../src/auth-commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQzC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CA0BnH;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAwBvH;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAWtE;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CASvE;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAUvE"}

package/dist/auth-commands.js

@@ -0,0 +1,116 @@
+/**
+ * The three handwritten auth commands: login / logout / whoami — plus
+ * performLogin/performWhoami, the cores shared verbatim with the interactive
+ * session (interactive/session.ts imports both).
+ *
+ * ResolvedDeps is imported type-only from program.ts — no runtime edge back
+ * to program.ts (program.ts imports these attach* functions by value; see
+ * that file's session-cycle doc comment for the same pattern).
+ */
+import { decodeClaims } from "./core/auth.js";
+import { clearCredentials, readConfig, resolveApiUrl, writeConfig } from "./core/config.js";
+import { promptForKey } from "./core/login.js";
+import { renderError } from "./core/output.js";
+import { credentials } from "./core/run-operation.js";
+import { SPEC } from "./generated/operations.js";
+/**
+ * The login core: validate the `ora_sk_` prefix → store → verify by
+ * exchanging for a token → roll back the stored key on verification failure.
+ * Shared verbatim by the scripted `login` action and (Task 4) the
+ * interactive session — prints exactly the lines the action always printed
+ * and returns whether login succeeded.
+ */
+export async function performLogin(deps, opts) {
+    const key = opts.apiKey ?? "";
+    if (!key.startsWith("ora_sk_")) {
+        deps.errOut(renderError(new Error('That does not look like an ora api key (expected an "ora_sk_" prefix).')));
+        process.exitCode = 1;
+        return false;
+    }
+    const previous = readConfig(deps.dir);
+    const apiUrl = resolveApiUrl(previous, opts.apiUrl, SPEC.server, deps.env);
+    // Announce the target BEFORE verifying: a key minted on one environment
+    // failing against another must be self-diagnosing, never a mystery.
+    deps.out(`Verifying against ${apiUrl}`);
+    writeConfig({ ...previous, apiKey: key, ...(opts.apiUrl ? { apiUrl } : {}) }, deps.dir);
+    try {
+        const token = await deps.makeAuth({ apiUrl, apiKey: key }).forceRefresh();
+        const claims = decodeClaims(token);
+        deps.out(`Logged in. org=${String(claims.org ?? claims.organizationId ?? "?")} subject=${String(claims.sub ?? "?")}`);
+        return true;
+    }
+    catch (err) {
+        writeConfig(previous, deps.dir); // verification failed — roll back
+        deps.errOut(renderError(err));
+        process.exitCode = 1;
+        return false;
+    }
+}
+/**
+ * The whoami core: verify the configured key and print its identity. THE one
+ * implementation — shared verbatim by the scripted `whoami` action and the
+ * interactive session's whoami menu entry (interactive/session.ts) so the two
+ * doors never drift apart. Returns whether it succeeded and never throws;
+ * mirrors runOperation's own caller contract (sets process.exitCode on
+ * failure, leaves it alone on success) so both callers reset exit-code state
+ * the same way.
+ */
+export async function performWhoami(deps, opts) {
+    const creds = credentials(deps, opts.apiUrlFlag);
+    if (!creds)
+        return false;
+    try {
+        const token = await deps.makeAuth(creds).forceRefresh();
+        const claims = decodeClaims(token);
+        if (opts.json) {
+            deps.out(JSON.stringify(claims, null, 2));
+            return true;
+        }
+        deps.out([
+            `org:     ${String(claims.org ?? claims.organizationId ?? "?")}`,
+            `subject: ${String(claims.sub ?? "?")}`,
+            ...(Array.isArray(claims.scopes) ? [`scopes:  ${claims.scopes.join(", ")}`] : []),
+            `api:     ${creds.apiUrl}`,
+        ].join("\n"));
+        return true;
+    }
+    catch (err) {
+        deps.errOut(renderError(err));
+        process.exitCode = 1;
+        return false;
+    }
+}
+export function attachLogin(program, deps) {
+    program
+        .command("login")
+        .description("Store an api key for ora (paste, --api-key, or ORA_API_KEY)")
+        .option("--api-key <key>", "the ora_sk_… api key")
+        .option("--api-url <url>", "override the API base URL")
+        .addHelpText("after", "\nExamples:\n  ora login --api-key ora_sk_…\n  ORA_API_KEY=ora_sk_… ora login   # non-interactive (CI)\n  ora login --api-url http://api.localhost:8081   # dev cluster")
+        .action(async (opts) => {
+        const key = opts.apiKey ?? deps.env.ORA_API_KEY ?? (await promptForKey());
+        await performLogin(deps, { apiKey: key, apiUrl: opts.apiUrl });
+    });
+}
+export function attachLogout(program, deps) {
+    program
+        .command("logout")
+        .description("Delete the stored api key and cached token")
+        .addHelpText("after", "\nExamples:\n  ora logout")
+        .action(() => {
+        clearCredentials(deps.dir);
+        deps.out("Logged out — credentials removed.");
+    });
+}
+export function attachWhoami(program, deps) {
+    program
+        .command("whoami")
+        .description("Verify the configured key against the API and print its identity")
+        .option("--json", "print the raw token claims")
+        .option("--api-url <url>", "override the API base URL")
+        .addHelpText("after", "\nExamples:\n  ora whoami\n  ora whoami --json")
+        .action(async (opts) => {
+        await performWhoami(deps, { json: opts.json, apiUrlFlag: opts.apiUrl });
+    });
+}
+//# sourceMappingURL=auth-commands.js.map

package/dist/auth-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-commands.js","sourceRoot":"","sources":["../src/auth-commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,2BAA2B,CAAC;AAGjD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAkB,EAAE,IAA0C;IAC/F,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC,CAAC,CAAC;QAC9G,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3E,wEAAwE;IACxE,oEAAoE;IACpE,IAAI,CAAC,GAAG,CAAC,qBAAqB,MAAM,EAAE,CAAC,CAAC;IACxC,WAAW,CAAC,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAExF,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC;QAC1E,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,cAAc,IAAI,GAAG,CAAC,YAAY,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;QACtH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,kCAAkC;QACnE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAkB,EAAE,IAA6C;IACnG,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,GAAG,CACN;YACE,YAAY,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,cAAc,IAAI,GAAG,CAAC,EAAE;YAChE,YAAY,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE;YACvC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,YAAa,MAAM,CAAC,MAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/F,YAAY,KAAK,CAAC,MAAM,EAAE;SAC3B,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAgB,EAAE,IAAkB;IAC9D,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,6DAA6D,CAAC;SAC1E,MAAM,CAAC,iBAAiB,EAAE,sBAAsB,CAAC;SACjD,MAAM,CAAC,iBAAiB,EAAE,2BAA2B,CAAC;SACtD,WAAW,CAAC,OAAO,EAAE,yKAAyK,CAAC;SAC/L,MAAM,CAAC,KAAK,EAAE,IAA0C,EAAE,EAAE;QAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,MAAM,YAAY,EAAE,CAAC,CAAC;QAC1E,MAAM,YAAY,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAgB,EAAE,IAAkB;IAC/D,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,4CAA4C,CAAC;SACzD,WAAW,CAAC,OAAO,EAAE,2BAA2B,CAAC;SACjD,MAAM,CAAC,GAAG,EAAE;QACX,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAgB,EAAE,IAAkB;IAC/D,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,kEAAkE,CAAC;SAC/E,MAAM,CAAC,QAAQ,EAAE,4BAA4B,CAAC;SAC9C,MAAM,CAAC,iBAAiB,EAAE,2BAA2B,CAAC;SACtD,WAAW,CAAC,OAAO,EAAE,gDAAgD,CAAC;SACtE,MAAM,CAAC,KAAK,EAAE,IAAyC,EAAE,EAAE;QAC1D,MAAM,aAAa,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/core/auth.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Api-key → short-lived token exchange.
+ *
+ * The credential travels ONLY as "Authorization: Bearer <ora_sk_…>" to
+ * POST /auth/token (the doc's own rule: never in the request body). The
+ * response {token, expiresIn} is cached on disk (0600) and reused until a 30s
+ * skew before expiry, so a token can't die between "checked" and "used".
+ *
+ * The cache is keyed to (apiUrl, sha256(key)) — pointing the CLI at staging or
+ * switching keys can never replay a token minted elsewhere. Cache write
+ * failures are swallowed: a cache is an optimization, not a requirement.
+ */
+export declare class AuthError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(message: string, status: number, code: string);
+}
+export interface ApiKeyAuthDeps {
+    apiUrl: string;
+    apiKey: string;
+    dir?: string;
+    fetchFn?: typeof fetch;
+    now?: () => number;
+}
+export declare class ApiKeyAuth {
+    private readonly apiUrl;
+    private readonly apiKey;
+    private readonly dir;
+    private readonly fetchFn;
+    private readonly now;
+    constructor(deps: ApiKeyAuthDeps);
+    getToken(): Promise<string>;
+    forceRefresh(): Promise<string>;
+    clearCache(): void;
+    private cachePath;
+    private keyDigest;
+    private readCache;
+}
+/** JWT payload claims, {} on anything unparseable. Display only — never trust. */
+export declare function decodeClaims(token: string): Record<string, unknown>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/core/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/core/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAWH,qBAAa,SAAU,SAAQ,KAAK;IAGhC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAFrB,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM;CAKxB;AASD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,IAAI,EAAE,cAAc;IAQ1B,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;IAM3B,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAqCrC,UAAU,IAAI,IAAI;IAIlB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,SAAS;CAUlB;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQnE"}

package/dist/core/auth.js

@@ -0,0 +1,110 @@
+/**
+ * Api-key → short-lived token exchange.
+ *
+ * The credential travels ONLY as "Authorization: Bearer <ora_sk_…>" to
+ * POST /auth/token (the doc's own rule: never in the request body). The
+ * response {token, expiresIn} is cached on disk (0600) and reused until a 30s
+ * skew before expiry, so a token can't die between "checked" and "used".
+ *
+ * The cache is keyed to (apiUrl, sha256(key)) — pointing the CLI at staging or
+ * switching keys can never replay a token minted elsewhere. Cache write
+ * failures are swallowed: a cache is an optimization, not a requirement.
+ */
+import { createHash } from "node:crypto";
+import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { configDir } from "./config.js";
+const EXPIRY_SKEW_MS = 30_000;
+const DEFAULT_EXPIRES_IN_S = 900;
+export class AuthError extends Error {
+    status;
+    code;
+    constructor(message, status, code) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = "AuthError";
+    }
+}
+export class ApiKeyAuth {
+    apiUrl;
+    apiKey;
+    dir;
+    fetchFn;
+    now;
+    constructor(deps) {
+        this.apiUrl = deps.apiUrl;
+        this.apiKey = deps.apiKey;
+        this.dir = deps.dir ?? configDir();
+        this.fetchFn = deps.fetchFn ?? fetch;
+        this.now = deps.now ?? Date.now;
+    }
+    async getToken() {
+        const cached = this.readCache();
+        if (cached && cached.expiresAt - EXPIRY_SKEW_MS > this.now())
+            return cached.token;
+        return this.forceRefresh();
+    }
+    async forceRefresh() {
+        const res = await this.fetchFn(`${this.apiUrl}/auth/token`, {
+            method: "POST",
+            headers: { authorization: `Bearer ${this.apiKey}`, "content-type": "application/json" },
+            body: "{}",
+        });
+        const body = (await res.json().catch(() => ({})));
+        if (!res.ok || typeof body.token !== "string") {
+            throw new AuthError(body.error ?? `token exchange failed (HTTP ${res.status})`, res.status, body.code ?? "EXCHANGE_FAILED");
+        }
+        const record = {
+            apiUrl: this.apiUrl,
+            keyDigest: this.keyDigest(),
+            token: body.token,
+            expiresAt: this.now() + (body.expiresIn ?? DEFAULT_EXPIRES_IN_S) * 1000,
+        };
+        try {
+            mkdirSync(this.dir, { recursive: true, mode: 0o700 });
+            chmodSync(this.dir, 0o700);
+            writeFileSync(this.cachePath(), `${JSON.stringify(record, null, 2)}\n`, { mode: 0o600 });
+            chmodSync(this.cachePath(), 0o600);
+        }
+        catch {
+            // Unwritable cache just means we exchange again next invocation.
+        }
+        return body.token;
+    }
+    clearCache() {
+        rmSync(this.cachePath(), { force: true });
+    }
+    cachePath() {
+        return join(this.dir, "token.json");
+    }
+    keyDigest() {
+        return createHash("sha256").update(this.apiKey).digest("hex").slice(0, 16);
+    }
+    readCache() {
+        try {
+            const parsed = JSON.parse(readFileSync(this.cachePath(), "utf8"));
+            if (parsed.apiUrl !== this.apiUrl || parsed.keyDigest !== this.keyDigest())
+                return null;
+            if (typeof parsed.token !== "string" || typeof parsed.expiresAt !== "number")
+                return null;
+            return parsed;
+        }
+        catch {
+            return null;
+        }
+    }
+}
+/** JWT payload claims, {} on anything unparseable. Display only — never trust. */
+export function decodeClaims(token) {
+    const payload = token.split(".")[1];
+    if (!payload)
+        return {};
+    try {
+        return JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    }
+    catch {
+        return {};
+    }
+}
+//# sourceMappingURL=auth.js.map

package/dist/core/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/core/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC,MAAM,OAAO,SAAU,SAAQ,KAAK;IAGvB;IACA;IAHX,YACE,OAAe,EACN,MAAc,EACd,IAAY;QAErB,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAGrB,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAiBD,MAAM,OAAO,UAAU;IACJ,MAAM,CAAS;IACf,MAAM,CAAS;IACf,GAAG,CAAS;IACZ,OAAO,CAAe;IACtB,GAAG,CAAe;IAEnC,YAAY,IAAoB;QAC9B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;QACrC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC;QAClF,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,aAAa,EAAE;YAC1D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACvF,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAK/C,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,SAAS,CACjB,IAAI,CAAC,KAAK,IAAI,+BAA+B,GAAG,CAAC,MAAM,GAAG,EAC1D,GAAG,CAAC,MAAM,EACV,IAAI,CAAC,IAAI,IAAI,iBAAiB,CAC/B,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAgB;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,oBAAoB,CAAC,GAAG,IAAI;SACxE,CAAC;QACF,IAAI,CAAC;YACH,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACtD,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC3B,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACzF,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,UAAU;QACR,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAEO,SAAS;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACtC,CAAC;IAEO,SAAS;QACf,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7E,CAAC;IAEO,SAAS;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC,CAAyB,CAAC;YAC1F,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE;gBAAE,OAAO,IAAI,CAAC;YACxF,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC1F,OAAO,MAAqB,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC;IACnG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/core/config.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Credential + endpoint configuration.
+ *
+ * ~/.config/ora (XDG-respecting) holds config.json (api key, api url) and
+ * token.json (the cached short-lived token, owned by auth.ts). Both are 0600 in
+ * a 0700 dir — the key is a secret. Every read degrades to "not configured"
+ * rather than throwing: a corrupt file must never brick the CLI.
+ *
+ * Permissions are re-asserted on every write, not just on creation. This hardens
+ * pre-existing insecure files (e.g. restored from dotfiles with loose modes).
+ *
+ * Precedence (why: CI overrides laptops, flags override everything):
+ *   api key : ORA_API_KEY env > config.json
+ *   api url : --api-url flag > ORA_API_URL env > config.json > the spec's server
+ */
+export interface OraConfig {
+    apiKey?: string;
+    apiUrl?: string;
+}
+export declare function configDir(env?: NodeJS.ProcessEnv): string;
+export declare function readConfig(dir?: string): OraConfig;
+export declare function writeConfig(cfg: OraConfig, dir?: string): void;
+export declare function clearCredentials(dir?: string): void;
+export declare function resolveApiKey(cfg: OraConfig, env?: NodeJS.ProcessEnv): string | undefined;
+export declare function resolveApiUrl(cfg: OraConfig, flagValue: string | undefined, embeddedDefault: string, env?: NodeJS.ProcessEnv): string;
+//# sourceMappingURL=config.d.ts.map

package/dist/core/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,SAAS,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAGtE;AAED,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAoB,GAAG,SAAS,CAU/D;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,GAAE,MAAoB,GAAG,IAAI,CAK3E;AAED,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAoB,GAAG,IAAI,CAGhE;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAEtG;AAED,wBAAgB,aAAa,CAC3B,GAAG,EAAE,SAAS,EACd,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,eAAe,EAAE,MAAM,EACvB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAER"}

package/dist/core/config.js

@@ -0,0 +1,51 @@
+/**
+ * Credential + endpoint configuration.
+ *
+ * ~/.config/ora (XDG-respecting) holds config.json (api key, api url) and
+ * token.json (the cached short-lived token, owned by auth.ts). Both are 0600 in
+ * a 0700 dir — the key is a secret. Every read degrades to "not configured"
+ * rather than throwing: a corrupt file must never brick the CLI.
+ *
+ * Permissions are re-asserted on every write, not just on creation. This hardens
+ * pre-existing insecure files (e.g. restored from dotfiles with loose modes).
+ *
+ * Precedence (why: CI overrides laptops, flags override everything):
+ *   api key : ORA_API_KEY env > config.json
+ *   api url : --api-url flag > ORA_API_URL env > config.json > the spec's server
+ */
+import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+export function configDir(env = process.env) {
+    const base = env.XDG_CONFIG_HOME || join(homedir(), ".config");
+    return join(base, "ora");
+}
+export function readConfig(dir = configDir()) {
+    try {
+        const parsed = JSON.parse(readFileSync(join(dir, "config.json"), "utf8"));
+        return {
+            ...(typeof parsed.apiKey === "string" ? { apiKey: parsed.apiKey } : {}),
+            ...(typeof parsed.apiUrl === "string" ? { apiUrl: parsed.apiUrl } : {}),
+        };
+    }
+    catch {
+        return {};
+    }
+}
+export function writeConfig(cfg, dir = configDir()) {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    chmodSync(dir, 0o700);
+    writeFileSync(join(dir, "config.json"), `${JSON.stringify(cfg, null, 2)}\n`, { mode: 0o600 });
+    chmodSync(join(dir, "config.json"), 0o600);
+}
+export function clearCredentials(dir = configDir()) {
+    rmSync(join(dir, "config.json"), { force: true });
+    rmSync(join(dir, "token.json"), { force: true });
+}
+export function resolveApiKey(cfg, env = process.env) {
+    return env.ORA_API_KEY || cfg.apiKey;
+}
+export function resolveApiUrl(cfg, flagValue, embeddedDefault, env = process.env) {
+    return (flagValue || env.ORA_API_URL || cfg.apiUrl || embeddedDefault).replace(/\/+$/, "");
+}
+//# sourceMappingURL=config.js.map

package/dist/core/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/core/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAOjC,MAAM,UAAU,SAAS,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IAC/D,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAc,SAAS,EAAE;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAA4B,CAAC;QACrG,OAAO;YACL,GAAG,CAAC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAc,EAAE,MAAc,SAAS,EAAE;IACnE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9F,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAc,SAAS,EAAE;IACxD,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAc,EAAE,MAAyB,OAAO,CAAC,GAAG;IAChF,OAAO,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,MAAM,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,GAAc,EACd,SAA6B,EAC7B,eAAuB,EACvB,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,CAAC,SAAS,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC7F,CAAC"}

package/dist/core/http.d.ts

@@ -0,0 +1,46 @@
+/**
+ * The one HTTP door for every generated command.
+ *
+ * Auth policy mirrors the platform's createServiceClient: on a 401 the token
+ * is force-re-exchanged and the request retried EXACTLY once. 5xx is never
+ * retried — a POST /runs may have been admitted and billed; at-most-once is
+ * the CLI's promise for mutations.
+ *
+ * Non-ok responses map to ApiError carrying the platform envelope
+ * {error, code, details?} so output.ts can tell the 402/403 stories.
+ */
+export declare class ApiError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly details?: Record<string, unknown> | undefined;
+    constructor(message: string, status: number, code: string, details?: Record<string, unknown> | undefined);
+}
+export interface CallOptions {
+    method: string;
+    path: string;
+    query?: Record<string, string | number | boolean | undefined>;
+    body?: unknown;
+}
+/** The narrow auth port — both members required so a fake-retry can't hide. */
+export interface TokenSource {
+    getToken(): Promise<string>;
+    forceRefresh(): Promise<string>;
+}
+export interface HttpClientDeps {
+    apiUrl: string;
+    auth: TokenSource;
+    fetchFn?: typeof fetch;
+}
+export declare class HttpClient {
+    private readonly apiUrl;
+    private readonly auth;
+    private readonly fetchFn;
+    constructor(deps: HttpClientDeps);
+    /** JSON operations: parsed body (null when empty), ApiError on non-ok. */
+    call(opts: CallOptions): Promise<unknown>;
+    /** Stream operations: the raw ok Response, for core/sse.ts to consume. */
+    open(opts: CallOptions): Promise<Response>;
+    private url;
+    private send;
+}
+//# sourceMappingURL=http.d.ts.map

package/dist/core/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/core/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,qBAAa,QAAS,SAAQ,KAAK;IAG/B,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAH1C,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;CAK7C;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,+EAA+E;AAC/E,MAAM,WAAW,WAAW;IAC1B,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAc;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;gBAE3B,IAAI,EAAE,cAAc;IAMhC,0EAA0E;IACpE,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAW/C,0EAA0E;IACpE,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAIhD,OAAO,CAAC,GAAG;YAQG,IAAI;CAmBnB"}