@raster-app/cli 0.1.1 → 0.3.0

package/dist/index.js

@@ -16337,14 +16337,11 @@ config(en_default());
 // package.json
 var package_default = {
   name: "@raster-app/cli",
-  version: "0.1.1",
+  version: "0.3.0",
   description: "Command-line client for the Raster API",
   license: "Apache-2.0",
   type: "module",
-  repository: {
-    type: "git",
-    url: "https://github.com/raster-app/raster-cli"
-  },
+  homepage: "https://docs.raster.app/api/cli",
   engines: {
     node: ">=20"
   },
@@ -16357,7 +16354,6 @@ var package_default = {
   ],
   scripts: {
     build: "bun build src/index.ts --outdir dist --target node --banner '#!/usr/bin/env node'",
-    "build:binary": "bun build src/index.ts --compile --target=bun-darwin-arm64 --outfile raster",
     "gen:types": "bun scripts/gen-types.ts",
     "check:types": "tsc --noEmit",
     "check:tarball": "bun scripts/check-tarball.ts",
@@ -16891,18 +16887,27 @@ class ApiError extends CliError {
 // src/api/client.ts
 var VERSION_HEADER = { "Api-Version": API_VERSION };
 var LOCAL_HOSTNAMES = new Set(["localhost", "127.0.0.1"]);
-function validateBaseUrl(rawUrl) {
+function isRasterHost(hostname3) {
+  return hostname3 === "raster.app" || hostname3.endsWith(".raster.app");
+}
+function assertRasterOrLocalHost(rawUrl, label) {
   let parsed;
   try {
     parsed = new URL(rawUrl);
   } catch {
-    throw new UsageError(`Invalid API base URL: ${rawUrl}`);
+    throw new UsageError(`Invalid ${label}: ${rawUrl}`);
+  }
+  if (LOCAL_HOSTNAMES.has(parsed.hostname)) {
+    return rawUrl.replace(/\/+$/, "");
   }
-  if (parsed.protocol !== "https:" && !LOCAL_HOSTNAMES.has(parsed.hostname)) {
-    throw new UsageError(`API base URL must use https (got ${rawUrl}). localhost and 127.0.0.1 are the only http exceptions.`);
+  if (parsed.protocol !== "https:" || !isRasterHost(parsed.hostname)) {
+    throw new UsageError(`${label} must be https on a raster.app host (got ${rawUrl}); localhost is allowed for development.`);
   }
   return rawUrl.replace(/\/+$/, "");
 }
+function validateBaseUrl(rawUrl) {
+  return assertRasterOrLocalHost(rawUrl, "API base URL");
+}
 function buildRequestHeaders(apiKey) {
   const headers = { "Api-Version": API_VERSION };
   if (apiKey)
@@ -17031,8 +17036,23 @@ function formatBytes(size) {
 var CONFIG_FILE_NAME = "config.json";
 var CONFIG_FILE_MODE = 384;
 var CONFIG_DIR_MODE = 448;
+var oauthTokensSchema = exports_external.object({
+  accessToken: exports_external.string().min(1),
+  refreshToken: exports_external.string().min(1),
+  expiresAt: exports_external.number(),
+  issuer: exports_external.url(),
+  scope: exports_external.string(),
+  resource: exports_external.url()
+});
+var oauthClientSchema = exports_external.object({ clientId: exports_external.string().min(1) });
 var configSchema = exports_external.object({
-  apiKey: exports_external.string().min(1).optional()
+  apiKey: exports_external.string().min(1).optional(),
+  organizationId: exports_external.string().min(1).optional(),
+  libraries: exports_external.array(exports_external.string()).optional(),
+  oauth: oauthTokensSchema.optional(),
+  clients: exports_external.record(exports_external.string(), oauthClientSchema).optional(),
+  defaultOrg: exports_external.string().min(1).optional(),
+  issuer: exports_external.url().optional()
 });
 function configDir(env) {
   if (env.RASTER_CONFIG_HOME)
@@ -17068,13 +17088,334 @@ async function writeConfig(config2, env) {
 `, { mode: CONFIG_FILE_MODE });
   await chmod(path2, CONFIG_FILE_MODE);
 }
-function resolveApiKey(options) {
+async function writeOAuthTokens(tokens, env) {
+  const config2 = await readConfig(env);
+  await writeConfig({ ...config2, oauth: tokens }, env);
+}
+async function clearOAuthTokens(env) {
+  const config2 = await readConfig(env);
+  delete config2.oauth;
+  await writeConfig(config2, env);
+}
+async function getCachedClientId(issuer, env) {
+  return (await readConfig(env)).clients?.[issuer]?.clientId ?? null;
+}
+async function cacheClientId(issuer, clientId, env) {
+  const config2 = await readConfig(env);
+  await writeConfig({ ...config2, clients: { ...config2.clients, [issuer]: { clientId } } }, env);
+}
+
+// src/oauth/issuer.ts
+var DEFAULT_ISSUER = "https://raster.app";
+var RESOURCE_INDICATOR = "https://api.raster.app";
+var USER_SCOPE = "user";
+var DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+function resolveIssuer(options) {
+  const raw = options.env.RASTER_AUTH_ISSUER ?? options.config.issuer ?? DEFAULT_ISSUER;
+  return assertRasterOrLocalHost(raw, "auth issuer");
+}
+
+// src/oauth/open-browser.ts
+import { spawn } from "node:child_process";
+import { platform } from "node:os";
+function openerCommand() {
+  const current = platform();
+  if (current === "darwin")
+    return { command: "open", args: [] };
+  if (current === "win32")
+    return { command: "cmd", args: ["/c", "start", ""] };
+  if (current === "linux")
+    return { command: "xdg-open", args: [] };
+  return null;
+}
+function canOpenBrowser() {
+  if (!openerCommand())
+    return false;
+  if (platform() === "linux" && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY) {
+    return false;
+  }
+  return true;
+}
+async function openBrowser(url2) {
+  const opener = openerCommand();
+  if (!opener)
+    throw new Error("No browser opener is available on this platform.");
+  await new Promise((resolve, reject) => {
+    const child = spawn(opener.command, [...opener.args, url2], { stdio: "ignore", detached: true });
+    child.once("error", reject);
+    child.once("spawn", () => {
+      child.unref();
+      resolve();
+    });
+  });
+}
+
+// src/oauth/http.ts
+var FORM_CONTENT_TYPE = "application/x-www-form-urlencoded";
+var OAUTH_REQUEST_TIMEOUT_MS = 30000;
+var oauthErrorSchema = exports_external.object({
+  error: exports_external.string(),
+  error_description: exports_external.string().optional()
+});
+
+class OAuthError extends CliError {
+  error;
+  constructor(error51, description, status) {
+    super(description ? `${error51}: ${description}` : error51, EXIT_CODES.auth);
+    this.error = error51;
+    this.status = status;
+  }
+  status;
+}
+
+class AuthServerHttpError extends CliError {
+  status;
+  constructor(status) {
+    super(`Authorization server request failed with HTTP ${status}.`, EXIT_CODES.auth);
+    this.status = status;
+  }
+}
+function parseOAuthError(body, status) {
+  const parsed = oauthErrorSchema.safeParse(body);
+  if (!parsed.success)
+    return null;
+  return new OAuthError(parsed.data.error, parsed.data.error_description, status);
+}
+async function readJson(response) {
+  try {
+    return await response.json();
+  } catch {
+    return null;
+  }
+}
+async function postForm(url2, form, fetch) {
+  let response;
+  try {
+    response = await fetch(url2, {
+      method: "POST",
+      headers: { "Content-Type": FORM_CONTENT_TYPE, Accept: "application/json" },
+      body: new URLSearchParams(form).toString(),
+      signal: AbortSignal.timeout(OAUTH_REQUEST_TIMEOUT_MS)
+    });
+  } catch (error51) {
+    throw new NetworkError(`Could not reach the authorization server: ${describeError(error51)}`);
+  }
+  const body = await readJson(response);
+  const oauthError = parseOAuthError(body, response.status);
+  if (oauthError)
+    throw oauthError;
+  if (!response.ok) {
+    throw new AuthServerHttpError(response.status);
+  }
+  return body;
+}
+async function postJson(url2, payload, fetch) {
+  let response;
+  try {
+    response = await fetch(url2, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Accept: "application/json" },
+      body: JSON.stringify(payload),
+      signal: AbortSignal.timeout(OAUTH_REQUEST_TIMEOUT_MS)
+    });
+  } catch (error51) {
+    throw new NetworkError(`Could not reach the authorization server: ${describeError(error51)}`);
+  }
+  const body = await readJson(response);
+  const oauthError = parseOAuthError(body, response.status);
+  if (oauthError)
+    throw oauthError;
+  if (!response.ok) {
+    throw new AuthServerHttpError(response.status);
+  }
+  return body;
+}
+async function getJson(url2, fetch) {
+  let response;
+  try {
+    response = await fetch(url2, {
+      method: "GET",
+      headers: { Accept: "application/json" },
+      signal: AbortSignal.timeout(OAUTH_REQUEST_TIMEOUT_MS)
+    });
+  } catch (error51) {
+    throw new NetworkError(`Could not reach the authorization server: ${describeError(error51)}`);
+  }
+  if (!response.ok) {
+    throw new AuthServerHttpError(response.status);
+  }
+  return readJson(response);
+}
+function describeError(error51) {
+  return error51 instanceof Error ? error51.message : String(error51);
+}
+
+// src/oauth/discovery.ts
+var WELL_KNOWN_PATH = "/.well-known/oauth-authorization-server";
+var metadataSchema = exports_external.object({
+  issuer: exports_external.string(),
+  authorization_endpoint: exports_external.url(),
+  token_endpoint: exports_external.url(),
+  device_authorization_endpoint: exports_external.url(),
+  registration_endpoint: exports_external.url(),
+  revocation_endpoint: exports_external.url()
+});
+var metadataCache = new Map;
+async function discover(issuer, fetch) {
+  const cached2 = metadataCache.get(issuer);
+  if (cached2)
+    return cached2;
+  const body = await getJson(`${issuer}${WELL_KNOWN_PATH}`, fetch);
+  const parsed = metadataSchema.safeParse(body);
+  if (!parsed.success) {
+    throw new CliError(`The authorization server metadata at ${issuer} is missing required endpoints.`, EXIT_CODES.auth);
+  }
+  const metadata = {
+    issuer: parsed.data.issuer,
+    authorizationEndpoint: assertRasterOrLocalHost(parsed.data.authorization_endpoint, "authorization_endpoint"),
+    tokenEndpoint: assertRasterOrLocalHost(parsed.data.token_endpoint, "token_endpoint"),
+    deviceAuthorizationEndpoint: assertRasterOrLocalHost(parsed.data.device_authorization_endpoint, "device_authorization_endpoint"),
+    registrationEndpoint: assertRasterOrLocalHost(parsed.data.registration_endpoint, "registration_endpoint"),
+    revocationEndpoint: assertRasterOrLocalHost(parsed.data.revocation_endpoint, "revocation_endpoint")
+  };
+  metadataCache.set(issuer, metadata);
+  return metadata;
+}
+
+// src/oauth/register.ts
+var DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+var REGISTRATION_REQUEST = {
+  client_name: "Raster CLI",
+  token_endpoint_auth_method: "none",
+  grant_types: [DEVICE_CODE_GRANT, "authorization_code", "refresh_token"],
+  response_types: ["code"],
+  redirect_uris: ["http://127.0.0.1/callback"]
+};
+var registrationResponseSchema = exports_external.object({ client_id: exports_external.string().min(1) });
+async function ensureClientId(options) {
+  if (options.pinnedClientId)
+    return options.pinnedClientId;
+  const cached2 = await getCachedClientId(options.issuer, options.env);
+  if (cached2)
+    return cached2;
+  const body = await postJson(options.metadata.registrationEndpoint, REGISTRATION_REQUEST, options.fetch);
+  const parsed = registrationResponseSchema.safeParse(body);
+  if (!parsed.success) {
+    throw new CliError("Dynamic client registration did not return a client_id.", EXIT_CODES.auth);
+  }
+  await cacheClientId(options.issuer, parsed.data.client_id, options.env);
+  return parsed.data.client_id;
+}
+
+// src/oauth/tokens.ts
+var ACCESS_TOKEN_SKEW_MS = 60000;
+var SECONDS_TO_MS = 1000;
+var tokenResponseSchema = exports_external.object({
+  access_token: exports_external.string().min(1),
+  refresh_token: exports_external.string().min(1),
+  expires_in: exports_external.number().positive(),
+  token_type: exports_external.string().optional(),
+  scope: exports_external.string().optional()
+});
+function parseTokenResponse(body) {
+  const parsed = tokenResponseSchema.parse(body);
+  return {
+    accessToken: parsed.access_token,
+    refreshToken: parsed.refresh_token,
+    expiresIn: parsed.expires_in,
+    scope: parsed.scope
+  };
+}
+function toStoredTokens(response, context) {
+  return {
+    accessToken: response.accessToken,
+    refreshToken: response.refreshToken,
+    expiresAt: context.now + response.expiresIn * SECONDS_TO_MS,
+    issuer: context.issuer,
+    scope: response.scope ?? context.fallbackScope ?? "user",
+    resource: context.resource
+  };
+}
+function isAccessTokenFresh(tokens, now, skewMs = ACCESS_TOKEN_SKEW_MS) {
+  return now < tokens.expiresAt - skewMs;
+}
+
+// src/oauth/refresh.ts
+var INVALID_GRANT = "invalid_grant";
+
+class OAuthReuseError extends CliError {
+  constructor() {
+    super("Your saved login is no longer valid. Run `raster auth login` to sign in again.", EXIT_CODES.auth);
+  }
+}
+async function refreshTokens(options) {
+  let body;
+  try {
+    body = await postForm(options.metadata.tokenEndpoint, {
+      grant_type: "refresh_token",
+      refresh_token: options.tokens.refreshToken,
+      client_id: options.clientId,
+      resource: RESOURCE_INDICATOR
+    }, options.fetch);
+  } catch (error51) {
+    if (error51 instanceof OAuthError && error51.error === INVALID_GRANT)
+      throw new OAuthReuseError;
+    if (error51 instanceof AuthServerHttpError && error51.status >= 400 && error51.status < 500) {
+      throw new OAuthReuseError;
+    }
+    throw error51;
+  }
+  return toStoredTokens(parseTokenResponse(body), {
+    issuer: options.tokens.issuer,
+    resource: options.tokens.resource,
+    now: options.now,
+    fallbackScope: options.tokens.scope
+  });
+}
+
+// src/oauth/session.ts
+async function ensureFreshOAuthSession(options) {
+  if (isAccessTokenFresh(options.tokens, options.now)) {
+    return { status: "active", tokens: options.tokens };
+  }
+  const issuer = assertRasterOrLocalHost(options.tokens.issuer, "auth issuer");
+  const metadata = await discover(issuer, options.fetch);
+  const clientId = await ensureClientId({
+    issuer,
+    metadata,
+    env: options.env,
+    fetch: options.fetch,
+    pinnedClientId: options.pinnedClientId
+  });
+  try {
+    const rotated = await refreshTokens({
+      tokens: options.tokens,
+      metadata,
+      clientId,
+      fetch: options.fetch,
+      now: options.now
+    });
+    await writeOAuthTokens(rotated, options.env);
+    return { status: "active", tokens: rotated };
+  } catch (error51) {
+    if (error51 instanceof OAuthReuseError) {
+      await clearOAuthTokens(options.env);
+      return { status: "reauth-required" };
+    }
+    throw error51;
+  }
+}
+
+// src/lib/credential.ts
+function resolveCredential(options) {
   if (options.flagKey)
-    return { key: options.flagKey, source: "flag" };
+    return { kind: "apiKey", key: options.flagKey, source: "flag" };
+  if (options.config.oauth)
+    return { kind: "oauth", tokens: options.config.oauth };
   if (options.env.RASTER_API_KEY)
-    return { key: options.env.RASTER_API_KEY, source: "env" };
+    return { kind: "apiKey", key: options.env.RASTER_API_KEY, source: "env" };
   if (options.config.apiKey)
-    return { key: options.config.apiKey, source: "config" };
+    return { kind: "apiKey", key: options.config.apiKey, source: "config" };
   return null;
 }
 
@@ -17191,10 +17532,15 @@ function promptSecret(message) {
 }
 
 // src/lib/context.ts
+var RASTER_ORG_ENV = "RASTER_ORG";
+var PINNED_CLIENT_ID_ENV = "RASTER_OAUTH_CLIENT_ID";
+function toLibraryIds(libraries) {
+  return (libraries ?? []).map((entry) => typeof entry === "string" ? entry : entry?.library).filter((id) => typeof id === "string");
+}
 async function createCommandContext(globals, overrides = {}) {
   const env = overrides.env ?? process.env;
   const config2 = await readConfig(env);
-  const apiKey = resolveApiKey({ flagKey: globals.apiKey, env, config: config2 });
+  const now = overrides.now ?? Date.now;
   const output = {
     json: globals.json === true,
     verbose: globals.verbose === true,
@@ -17203,22 +17549,125 @@ async function createCommandContext(globals, overrides = {}) {
   };
   const baseUrl = validateBaseUrl(env.RASTER_API_BASE_URL ?? DEFAULT_BASE_URL);
   const baseFetch = overrides.fetch ?? globalThis.fetch;
-  const instrumentedFetch = instrumentFetch(baseFetch, output, apiKey ? maskApiKey(apiKey.key) : null);
+  const credential = await resolveActiveCredential({
+    flagKey: globals.apiKey,
+    env,
+    config: config2,
+    fetch: instrumentFetch(baseFetch, output, null),
+    now: now()
+  });
+  const apiKey = credential?.kind === "apiKey" ? { key: credential.key, source: credential.source } : null;
+  const bearer = credentialBearer(credential);
+  const instrumentedFetch = instrumentFetch(baseFetch, output, bearer ? maskApiKey(bearer) : null);
+  const clientFactory = (clientOverrides) => createApiClient({
+    baseUrl,
+    apiKey: clientOverrides ? clientOverrides.apiKey : bearer,
+    fetch: instrumentedFetch
+  });
+  let viewerPromise = null;
+  const loadViewer = () => {
+    if (!viewerPromise) {
+      if (!credential) {
+        throw new AuthSetupError("Not authenticated. Run `raster auth login` or set RASTER_API_KEY.");
+      }
+      viewerPromise = unwrapResult(() => clientFactory().GET("/me", { params: { header: VERSION_HEADER } }));
+    }
+    return viewerPromise;
+  };
+  const cacheMatchesKey = config2.apiKey !== undefined && apiKey?.key === config2.apiKey;
+  const resolveOrgId = async () => {
+    if (globals.org)
+      return globals.org;
+    if (env[RASTER_ORG_ENV])
+      return env[RASTER_ORG_ENV];
+    if (credential?.kind === "oauth") {
+      if (credential.tokens.scope === "org") {
+        const viewer2 = await loadViewer();
+        if (viewer2.organizationId)
+          return viewer2.organizationId;
+        throw new CliError("This login is bound to an organization that is no longer available. Run `raster auth login` again.", EXIT_CODES.auth);
+      }
+      if (config2.defaultOrg)
+        return config2.defaultOrg;
+      throw new UsageError("This login can access multiple organizations. Pass --org <id> (or set RASTER_ORG); run `raster whoami` to list them.");
+    }
+    if (cacheMatchesKey && config2.organizationId)
+      return config2.organizationId;
+    const viewer = await loadViewer();
+    if (!viewer.organizationId) {
+      throw new CliError("Could not determine the organization from the API key.", EXIT_CODES.generic);
+    }
+    return viewer.organizationId;
+  };
+  const librariesForTarget = async () => {
+    const cached2 = cacheMatchesKey ? config2.libraries : undefined;
+    if (cached2)
+      return cached2;
+    const viewer = await loadViewer();
+    if (credential?.kind === "oauth" && credential.tokens.scope !== "org") {
+      const organizationId = await resolveOrgId();
+      const entry = viewer.organizations?.find((organization) => organization?.organizationId === organizationId);
+      return entry?.libraries ?? [];
+    }
+    return viewer.libraries ?? [];
+  };
   return {
     ...output,
     env,
     baseUrl,
     isInteractive: overrides.isInteractive ?? process.stdin.isTTY === true,
+    credential,
     apiKey,
+    bearerToken: bearer,
     fetch: instrumentedFetch,
-    clientFactory: (clientOverrides) => createApiClient({
-      baseUrl,
-      apiKey: clientOverrides ? clientOverrides.apiKey : apiKey?.key ?? null,
-      fetch: instrumentedFetch
-    }),
+    clientFactory,
     confirm: overrides.confirm ?? promptConfirm,
-    promptSecret: overrides.promptSecret ?? promptSecret
-  };
+    promptSecret: overrides.promptSecret ?? promptSecret,
+    now,
+    issuer: resolveIssuer({ env, config: config2 }),
+    pinnedClientId: env[PINNED_CLIENT_ID_ENV],
+    openBrowser: overrides.openBrowser ?? openBrowser,
+    canOpenBrowser: overrides.canOpenBrowser ?? canOpenBrowser,
+    explicitLibrary: globals.library,
+    resolveOrg: resolveOrgId,
+    resolveLibrary: async () => {
+      if (globals.library)
+        return globals.library;
+      const libraries = toLibraryIds(await librariesForTarget());
+      const onlyLibrary = libraries[0];
+      if (libraries.length === 1 && onlyLibrary)
+        return onlyLibrary;
+      if (libraries.length === 0) {
+        throw new AuthSetupError("No library access for this login. Pass --library <id>.");
+      }
+      throw new UsageError(`This login can access ${libraries.length} libraries (${libraries.join(", ")}). Pass --library <id>.`);
+    }
+  };
+}
+function credentialBearer(credential) {
+  if (!credential)
+    return null;
+  return credential.kind === "apiKey" ? credential.key : credential.tokens.accessToken;
+}
+async function resolveActiveCredential(options) {
+  const credential = resolveCredential({ flagKey: options.flagKey, env: options.env, config: options.config });
+  if (credential?.kind !== "oauth")
+    return credential;
+  const session = await ensureFreshOAuthSession({
+    tokens: credential.tokens,
+    env: options.env,
+    fetch: options.fetch,
+    pinnedClientId: options.env[PINNED_CLIENT_ID_ENV],
+    now: options.now
+  });
+  if (session.status === "reauth-required") {
+    return resolveCredential({
+      flagKey: options.flagKey,
+      env: options.env,
+      config: { ...options.config, oauth: undefined }
+    });
+  }
+  return { kind: "oauth", tokens: session.tokens };
 }
 function instrumentFetch(baseFetch, output, maskedKey) {
   return async (input, init) => {
@@ -17236,10 +17685,15 @@ function instrumentFetch(baseFetch, output, maskedKey) {
     }
   };
 }
-function requireApiKey(context) {
-  if (context.apiKey)
-    return context.apiKey;
-  throw new AuthSetupError("No API key found. Run `raster auth login` or set RASTER_API_KEY.");
+function requireAuth(context) {
+  if (context.credential)
+    return context.credential;
+  throw new AuthSetupError("Not authenticated. Run `raster auth login` or set RASTER_API_KEY.");
+}
+function requireBearer(context) {
+  if (context.bearerToken)
+    return context.bearerToken;
+  throw new AuthSetupError("Not authenticated. Run `raster auth login` or set RASTER_API_KEY.");
 }
 async function executeCommand(context, action) {
   try {
@@ -17284,11 +17738,7 @@ var SEARCH_HIT_COLUMNS = [
   { header: "NAME", value: (hit) => hit.name ?? "" },
   { header: "LIBRARY", value: (hit) => hit.libraryId ?? "" }
 ];
-var inLibraryOptionsSchema = exports_external.object({
-  org: exports_external.string().min(1),
-  library: exports_external.string().min(1)
-});
-var listOptionsSchema = inLibraryOptionsSchema.extend({
+var listOptionsSchema = exports_external.object({
   page: exports_external.coerce.number().int().min(1).optional(),
   pageSize: exports_external.coerce.number().int().min(1).optional(),
   tag: exports_external.array(exports_external.string().min(1)).default([])
@@ -17297,11 +17747,13 @@ async function listAssetsCommand(context, options) {
   if (options.tag.length > MAX_TAGS_PER_QUERY) {
     throw new ValidationError(`At most ${MAX_TAGS_PER_QUERY} --tag filters are supported per query.`);
   }
-  requireApiKey(context);
+  requireAuth(context);
+  const organizationId = await context.resolveOrg();
+  const libraryId = await context.resolveLibrary();
   const client = context.clientFactory();
   const assets = await unwrapResult(() => client.GET("/organizations/{organizationId}/libraries/{libraryId}/assets", {
     params: {
-      path: { organizationId: options.org, libraryId: options.library },
+      path: { organizationId, libraryId },
       header: VERSION_HEADER,
       query: {
         page: options.page,
@@ -17316,10 +17768,9 @@ async function listAssetsCommand(context, options) {
   }
   renderTable(context, assets, ASSET_COLUMNS);
 }
-var getOptionsSchema = inLibraryOptionsSchema;
-async function getAssetCommand(context, assetId, options) {
-  requireApiKey(context);
-  const asset = await fetchAsset(context, options.org, options.library, assetId);
+async function getAssetCommand(context, assetId) {
+  requireAuth(context);
+  const asset = await fetchAsset(context, assetId);
   if (context.json) {
     printJson(context, asset);
     return;
@@ -17335,28 +17786,29 @@ async function getAssetCommand(context, assetId, options) {
     { label: "url", value: asset.url ?? "" }
   ]);
 }
-async function fetchAsset(context, organizationId, libraryId, assetId) {
+async function fetchAsset(context, assetId) {
+  const organizationId = await context.resolveOrg();
+  const libraryId = await context.resolveLibrary();
   const client = context.clientFactory();
   return unwrapResult(() => client.GET("/organizations/{organizationId}/libraries/{libraryId}/assets/{assetId}", {
     params: { path: { organizationId, libraryId, assetId }, header: VERSION_HEADER }
   }));
 }
 var searchOptionsSchema = exports_external.object({
-  org: exports_external.string().min(1),
-  library: exports_external.array(exports_external.string().min(1)).default([]),
   page: exports_external.coerce.number().int().min(1).optional(),
   pageSize: exports_external.coerce.number().int().min(1).optional()
 });
 async function searchAssetsCommand(context, query, options) {
-  requireApiKey(context);
+  requireAuth(context);
+  const organizationId = await context.resolveOrg();
   const client = context.clientFactory();
   const result = await unwrapResult(() => client.GET("/organizations/{organizationId}/search/assets", {
     params: {
-      path: { organizationId: options.org },
+      path: { organizationId },
       header: VERSION_HEADER,
       query: {
         q: query,
-        libraries: options.library.length > 0 ? options.library.join(",") : undefined,
+        libraries: context.explicitLibrary,
         page: options.page,
         pageSize: options.pageSize
       }
@@ -17369,13 +17821,13 @@ async function searchAssetsCommand(context, query, options) {
   note(context, `${result.found} result(s), page ${result.page}.`);
   renderTable(context, result.hits, SEARCH_HIT_COLUMNS);
 }
-var downloadOptionsSchema = inLibraryOptionsSchema.extend({
+var downloadOptionsSchema = exports_external.object({
   output: exports_external.string().min(1).optional(),
   force: exports_external.boolean().default(false)
 });
 async function downloadAssetCommand(context, assetId, options) {
-  requireApiKey(context);
-  const asset = await fetchAsset(context, options.org, options.library, assetId);
+  requireAuth(context);
+  const asset = await fetchAsset(context, assetId);
   const fileUrl = asset.url;
   if (!fileUrl)
     throw new CliError("Asset has no file URL to download.", EXIT_CODES.generic);
@@ -17399,11 +17851,12 @@ async function downloadAssetCommand(context, assetId, options) {
 var uploadedAssetsSchema = exports_external.object({
   assets: exports_external.array(exports_external.looseObject({ id: exports_external.string().optional(), name: exports_external.string().nullish() }))
 });
-var uploadOptionsSchema = inLibraryOptionsSchema;
-async function uploadAssetsCommand(context, files, options) {
+async function uploadAssetsCommand(context, files) {
   if (files.length === 0)
     throw new UsageError("Provide at least one file to upload.");
-  const { key } = requireApiKey(context);
+  const bearer = requireBearer(context);
+  const organizationId = await context.resolveOrg();
+  const libraryId = await context.resolveLibrary();
   const batches = chunk(files, MAX_UPLOAD_FILES);
   const uploadedNames = [];
   const payloads = [];
@@ -17421,7 +17874,7 @@ async function uploadAssetsCommand(context, files, options) {
     if (batches.length > 1) {
       note(context, `Uploading batch ${batchIndex + 1}/${batches.length} (${batch.length} files)…`);
     }
-    const response = await context.fetch(`${context.baseUrl}/organizations/${options.org}/libraries/${options.library}/assets`, { method: "POST", headers: buildRequestHeaders(key), body: formData });
+    const response = await context.fetch(`${context.baseUrl}/organizations/${organizationId}/libraries/${libraryId}/assets`, { method: "POST", headers: buildRequestHeaders(bearer), body: formData });
     const payload = await parseEnvelope(response);
     payloads.push(payload);
     const parsed = uploadedAssetsSchema.safeParse(payload);
@@ -17439,7 +17892,7 @@ async function uploadAssetsCommand(context, files, options) {
 `);
   }
 }
-var removeOptionsSchema = inLibraryOptionsSchema.extend({
+var removeOptionsSchema = exports_external.object({
   yes: exports_external.boolean().default(false)
 });
 async function removeAssetsCommand(context, assetIds, options) {
@@ -17448,7 +17901,9 @@ async function removeAssetsCommand(context, assetIds, options) {
   if (assetIds.length > MAX_DELETE_IDS) {
     throw new ValidationError(`At most ${MAX_DELETE_IDS} asset ids are supported per call.`);
   }
-  requireApiKey(context);
+  requireAuth(context);
+  const organizationId = await context.resolveOrg();
+  const libraryId = await context.resolveLibrary();
   if (!options.yes && context.isInteractive) {
     const confirmed = await context.confirm(`Move ${assetIds.length} asset(s) to trash?`);
     if (!confirmed) {
@@ -17458,10 +17913,7 @@ async function removeAssetsCommand(context, assetIds, options) {
   }
   const client = context.clientFactory();
   const result = await unwrapResult(() => client.DELETE("/organizations/{organizationId}/libraries/{libraryId}/assets", {
-    params: {
-      path: { organizationId: options.org, libraryId: options.library },
-      header: VERSION_HEADER
-    },
+    params: { path: { organizationId, libraryId }, header: VERSION_HEADER },
     body: { ids: assetIds }
   }));
   if (context.json) {
@@ -17470,15 +17922,17 @@ async function removeAssetsCommand(context, assetIds, options) {
   }
   note(context, `Moved ${assetIds.length} asset(s) to trash. They are recoverable from the library trash.`);
 }
-var describeOptionsSchema = inLibraryOptionsSchema.extend({
+var describeOptionsSchema = exports_external.object({
   text: exports_external.string().min(1)
 });
 async function describeAssetCommand(context, assetId, options) {
-  requireApiKey(context);
+  requireAuth(context);
+  const organizationId = await context.resolveOrg();
+  const libraryId = await context.resolveLibrary();
   const client = context.clientFactory();
   const asset = await unwrapResult(() => client.PATCH("/organizations/{organizationId}/libraries/{libraryId}/assets/{assetId}/description", {
     params: {
-      path: { organizationId: options.org, libraryId: options.library, assetId },
+      path: { organizationId, libraryId, assetId },
       header: VERSION_HEADER
     },
     body: { description: options.text }
@@ -17489,36 +17943,327 @@ async function describeAssetCommand(context, assetId, options) {
   }
   note(context, "Description updated.");
 }
-var transferOptionsSchema = inLibraryOptionsSchema.extend({
-  to: exports_external.string().min(1),
-  asset: exports_external.array(exports_external.string().min(1)).min(1)
+var transferOptionsSchema = exports_external.object({
+  to: exports_external.string().min(1)
 });
-async function transferAssetsCommand(context, options) {
-  requireApiKey(context);
+async function transferAssetsCommand(context, assetIds, options) {
+  if (assetIds.length === 0)
+    throw new UsageError("Provide at least one asset id.");
+  requireAuth(context);
+  const organizationId = await context.resolveOrg();
+  const libraryId = await context.resolveLibrary();
   const client = context.clientFactory();
   const result = await unwrapResult(() => client.POST("/organizations/{organizationId}/libraries/{libraryId}/assets/transfer", {
-    params: {
-      path: { organizationId: options.org, libraryId: options.library },
-      header: VERSION_HEADER
-    },
-    body: { targetLibraryId: options.to, assetIds: options.asset }
+    params: { path: { organizationId, libraryId }, header: VERSION_HEADER },
+    body: { targetLibraryId: options.to, assetIds }
   }));
   if (context.json) {
     printJson(context, result);
     return;
   }
-  note(context, `Transferred ${options.asset.length} asset(s) to library ${options.to}.`);
+  note(context, `Transferred ${assetIds.length} asset(s) to library ${options.to}.`);
 }
 function registerAssetCommands(program2, runAction) {
   const assets = program2.command("assets").description("Work with assets in a library");
-  assets.command("ls").description("List assets in a library").requiredOption("--org <organizationId>", "Organization id").requiredOption("--library <libraryId>", "Library id").option("--page <number>", "Page number (1-based)").option("--page-size <number>", "Results per page").option("--tag <tag...>", "Filter by tag (repeatable, up to 5)").action((options, command) => runAction(command, (context) => listAssetsCommand(context, parseOptions(listOptionsSchema, options))));
-  assets.command("get").description("Show a single asset").argument("<assetId>", "Asset id").requiredOption("--org <organizationId>", "Organization id").requiredOption("--library <libraryId>", "Library id").action((assetId, options, command) => runAction(command, (context) => getAssetCommand(context, assetId, parseOptions(getOptionsSchema, options))));
-  assets.command("search").description("Search assets across the organization").argument("<query>", "Search query").requiredOption("--org <organizationId>", "Organization id").option("--library <libraryId...>", "Restrict to specific libraries (repeatable)").option("--page <number>", "Page number (1-based)").option("--page-size <number>", "Results per page").action((query, options, command) => runAction(command, (context) => searchAssetsCommand(context, query, parseOptions(searchOptionsSchema, options))));
-  assets.command("download").description("Download an asset's file").argument("<assetId>", "Asset id").requiredOption("--org <organizationId>", "Organization id").requiredOption("--library <libraryId>", "Library id").option("-o, --output <path>", "Target file path").option("--force", "Overwrite the target file if it exists").action((assetId, options, command) => runAction(command, (context) => downloadAssetCommand(context, assetId, parseOptions(downloadOptionsSchema, options))));
-  assets.command("upload").description("Upload local files as assets").argument("<files...>", "Local file paths").requiredOption("--org <organizationId>", "Organization id").requiredOption("--library <libraryId>", "Library id").action((files, options, command) => runAction(command, (context) => uploadAssetsCommand(context, files, parseOptions(uploadOptionsSchema, options))));
-  assets.command("rm").description("Move assets to trash (recoverable)").argument("<assetIds...>", "Asset ids").requiredOption("--org <organizationId>", "Organization id").requiredOption("--library <libraryId>", "Library id").option("--yes", "Skip the confirmation prompt").action((assetIds, options, command) => runAction(command, (context) => removeAssetsCommand(context, assetIds, parseOptions(removeOptionsSchema, options))));
-  assets.command("describe").description("Set an asset's description").argument("<assetId>", "Asset id").requiredOption("--org <organizationId>", "Organization id").requiredOption("--library <libraryId>", "Library id").requiredOption("--text <description>", "Description text").action((assetId, options, command) => runAction(command, (context) => describeAssetCommand(context, assetId, parseOptions(describeOptionsSchema, options))));
-  assets.command("transfer").description("Move assets to another library").requiredOption("--org <organizationId>", "Organization id").requiredOption("--library <libraryId>", "Source library id").requiredOption("--to <libraryId>", "Target library id").requiredOption("--asset <assetId...>", "Asset ids (repeatable)").action((options, command) => runAction(command, (context) => transferAssetsCommand(context, parseOptions(transferOptionsSchema, options))));
+  assets.command("ls").description("List assets in the library").option("--page <number>", "Page number (1-based)").option("--page-size <number>", "Results per page").option("--tag <tag...>", "Filter by tag (repeatable, up to 5)").action((options, command) => runAction(command, (context) => listAssetsCommand(context, parseOptions(listOptionsSchema, options))));
+  assets.command("get").description("Show a single asset").argument("<assetId>", "Asset id").action((assetId, _options, command) => runAction(command, (context) => getAssetCommand(context, assetId)));
+  assets.command("search").description("Search assets across the organization (pass --library to scope to one)").argument("<query>", "Search query").option("--page <number>", "Page number (1-based)").option("--page-size <number>", "Results per page").action((query, options, command) => runAction(command, (context) => searchAssetsCommand(context, query, parseOptions(searchOptionsSchema, options))));
+  assets.command("download").description("Download an asset's file").argument("<assetId>", "Asset id").option("-o, --output <path>", "Target file path").option("--force", "Overwrite the target file if it exists").action((assetId, options, command) => runAction(command, (context) => downloadAssetCommand(context, assetId, parseOptions(downloadOptionsSchema, options))));
+  assets.command("upload").description("Upload local files as assets").argument("<files...>", "Local file paths").action((files, _options, command) => runAction(command, (context) => uploadAssetsCommand(context, files)));
+  assets.command("rm").description("Move assets to trash (recoverable)").argument("<assetIds...>", "Asset ids").option("--yes", "Skip the confirmation prompt").action((assetIds, options, command) => runAction(command, (context) => removeAssetsCommand(context, assetIds, parseOptions(removeOptionsSchema, options))));
+  assets.command("describe").description("Set an asset's description").argument("<assetId>", "Asset id").requiredOption("--text <description>", "Description text").action((assetId, options, command) => runAction(command, (context) => describeAssetCommand(context, assetId, parseOptions(describeOptionsSchema, options))));
+  assets.command("transfer").description("Move assets to another library").argument("<assetIds...>", "Asset ids to move").requiredOption("--to <libraryId>", "Target library id").action((assetIds, options, command) => runAction(command, (context) => transferAssetsCommand(context, assetIds, parseOptions(transferOptionsSchema, options))));
+}
+
+// src/oauth/login.ts
+import { setTimeout as sleep } from "node:timers/promises";
+
+// src/oauth/loopback.ts
+import { createServer } from "node:http";
+var CALLBACK_PATH = "/callback";
+var LOOPBACK_HOST = "127.0.0.1";
+var SUCCESS_PAGE = "<!doctype html><meta charset=utf-8><title>Raster CLI</title>" + '<body style="font-family:system-ui;text-align:center;padding-top:4rem">' + "<h1>Signed in</h1><p>You can close this tab and return to the terminal.</p></body>";
+var FAILURE_PAGE = "<!doctype html><meta charset=utf-8><title>Raster CLI</title>" + '<body style="font-family:system-ui;text-align:center;padding-top:4rem">' + "<h1>Sign-in failed</h1><p>You can close this tab and return to the terminal.</p></body>";
+async function startLoopbackServer() {
+  let resolveCallback;
+  let rejectCallback;
+  const callbackPromise = new Promise((resolve, reject) => {
+    resolveCallback = resolve;
+    rejectCallback = reject;
+  });
+  let settled = false;
+  const server = createServer((request, response) => {
+    const url2 = new URL(request.url ?? "/", `http://${LOOPBACK_HOST}`);
+    if (url2.pathname !== CALLBACK_PATH) {
+      response.writeHead(404).end();
+      return;
+    }
+    const code = url2.searchParams.get("code");
+    const state = url2.searchParams.get("state");
+    if (code && state) {
+      response.writeHead(200, { "Content-Type": "text/html" }).end(SUCCESS_PAGE);
+      if (!settled) {
+        settled = true;
+        resolveCallback({ code, state });
+      }
+      return;
+    }
+    response.writeHead(400, { "Content-Type": "text/html" }).end(FAILURE_PAGE);
+    if (!settled) {
+      settled = true;
+      const error51 = url2.searchParams.get("error");
+      rejectCallback(new CliError(error51 ? `The authorization server returned an error: ${error51}.` : "The authorization server returned no code.", EXIT_CODES.auth));
+    }
+  });
+  let port;
+  try {
+    port = await listenOnEphemeralPort(server);
+  } catch (error51) {
+    server.close();
+    throw error51;
+  }
+  return {
+    redirectUri: `http://${LOOPBACK_HOST}:${port}${CALLBACK_PATH}`,
+    waitForCallback: () => callbackPromise,
+    close: () => {
+      server.close();
+    }
+  };
+}
+function listenOnEphemeralPort(server) {
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, LOOPBACK_HOST, () => {
+      const address = server.address();
+      if (address !== null && typeof address === "object" && typeof address.port === "number") {
+        resolve(address.port);
+        return;
+      }
+      reject(new CliError("Could not bind a loopback port for the browser login.", EXIT_CODES.generic));
+    });
+  });
+}
+
+// src/oauth/pkce.ts
+import { createHash, randomBytes } from "node:crypto";
+var VERIFIER_BYTES = 32;
+var STATE_BYTES = 16;
+function base64UrlEncode(input) {
+  return input.toString("base64url");
+}
+function createPkce() {
+  const verifier = base64UrlEncode(randomBytes(VERIFIER_BYTES));
+  const challenge = base64UrlEncode(createHash("sha256").update(verifier).digest());
+  return { verifier, challenge, method: "S256" };
+}
+function createState() {
+  return base64UrlEncode(randomBytes(STATE_BYTES));
+}
+
+// src/oauth/browser.ts
+var DEFAULT_LOGIN_TIMEOUT_MS = 5 * 60000;
+async function withDeadline(promise2, ms) {
+  let timer;
+  try {
+    return await Promise.race([
+      promise2,
+      new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new CliError("Timed out waiting for browser sign-in. Run `raster auth login` again.", EXIT_CODES.auth)), ms);
+      })
+    ]);
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+  }
+}
+async function runBrowserLogin(options) {
+  const pkce = createPkce();
+  const state = createState();
+  const server = await startLoopbackServer();
+  try {
+    const authorizeUrl = buildAuthorizeUrl({
+      metadata: options.metadata,
+      clientId: options.clientId,
+      redirectUri: server.redirectUri,
+      challenge: pkce.challenge,
+      state
+    });
+    await options.openBrowser(authorizeUrl);
+    const callback = await withDeadline(server.waitForCallback(), options.loginTimeoutMs ?? DEFAULT_LOGIN_TIMEOUT_MS);
+    if (callback.state !== state) {
+      throw new CliError("The browser login response failed its state check. Run `raster auth login` again.", EXIT_CODES.auth);
+    }
+    const body = await postForm(options.metadata.tokenEndpoint, {
+      grant_type: "authorization_code",
+      code: callback.code,
+      redirect_uri: server.redirectUri,
+      client_id: options.clientId,
+      code_verifier: pkce.verifier,
+      resource: RESOURCE_INDICATOR
+    }, options.fetch);
+    return toStoredTokens(parseTokenResponse(body), {
+      issuer: options.issuer,
+      resource: RESOURCE_INDICATOR,
+      now: options.now()
+    });
+  } finally {
+    server.close();
+  }
+}
+function buildAuthorizeUrl(options) {
+  const url2 = new URL(options.metadata.authorizationEndpoint);
+  url2.search = new URLSearchParams({
+    response_type: "code",
+    client_id: options.clientId,
+    redirect_uri: options.redirectUri,
+    scope: USER_SCOPE,
+    resource: RESOURCE_INDICATOR,
+    code_challenge: options.challenge,
+    code_challenge_method: "S256",
+    state: options.state
+  }).toString();
+  return url2.toString();
+}
+
+// src/oauth/device.ts
+var SLOW_DOWN_INCREMENT_SECONDS = 5;
+var SECONDS_TO_MS2 = 1000;
+var deviceResponseSchema = exports_external.object({
+  device_code: exports_external.string().min(1),
+  user_code: exports_external.string().min(1),
+  verification_uri: exports_external.url(),
+  verification_uri_complete: exports_external.url().optional(),
+  expires_in: exports_external.number().positive(),
+  interval: exports_external.number().positive().optional()
+});
+var DEFAULT_INTERVAL_SECONDS = 5;
+async function requestDeviceCode(options) {
+  const body = await postForm(options.metadata.deviceAuthorizationEndpoint, { client_id: options.clientId, scope: USER_SCOPE, resource: RESOURCE_INDICATOR }, options.fetch);
+  const parsed = deviceResponseSchema.safeParse(body);
+  if (!parsed.success) {
+    throw new CliError("The device authorization response was malformed.", EXIT_CODES.auth);
+  }
+  return {
+    deviceCode: parsed.data.device_code,
+    userCode: parsed.data.user_code,
+    verificationUri: parsed.data.verification_uri,
+    verificationUriComplete: parsed.data.verification_uri_complete,
+    expiresInSeconds: parsed.data.expires_in,
+    intervalSeconds: parsed.data.interval ?? DEFAULT_INTERVAL_SECONDS
+  };
+}
+function nextPollAction(errorCode, interval) {
+  if (errorCode === "authorization_pending")
+    return { kind: "wait", interval };
+  if (errorCode === "slow_down")
+    return { kind: "wait", interval: interval + SLOW_DOWN_INCREMENT_SECONDS };
+  return { kind: "fail" };
+}
+async function pollForToken(options) {
+  const deadline = options.now() + options.expiresInSeconds * SECONDS_TO_MS2;
+  let interval = options.intervalSeconds;
+  while (true) {
+    if (options.now() >= deadline) {
+      throw new CliError("The device code expired before you finished signing in. Run `raster auth login` again.", EXIT_CODES.auth);
+    }
+    let outcome;
+    try {
+      outcome = await pollOnce(options);
+    } catch (error51) {
+      if (!(error51 instanceof NetworkError))
+        throw error51;
+      outcome = { kind: "error", error: "authorization_pending" };
+    }
+    if (outcome.kind === "tokens")
+      return outcome.tokens;
+    const action = nextPollAction(outcome.error, interval);
+    if (action.kind === "fail") {
+      throw new CliError(`Device authorization failed: ${outcome.error}. Run \`raster auth login\` again.`, EXIT_CODES.auth);
+    }
+    interval = action.interval;
+    await options.sleep(interval * SECONDS_TO_MS2);
+  }
+}
+async function pollOnce(options) {
+  try {
+    const body = await postForm(options.metadata.tokenEndpoint, { grant_type: DEVICE_CODE_GRANT_TYPE, device_code: options.deviceCode, client_id: options.clientId }, options.fetch);
+    const tokens = toStoredTokens(parseTokenResponse(body), {
+      issuer: options.issuer,
+      resource: RESOURCE_INDICATOR,
+      now: options.now()
+    });
+    return { kind: "tokens", tokens };
+  } catch (error51) {
+    if (error51 instanceof OAuthError)
+      return { kind: "error", error: error51.error };
+    throw error51;
+  }
+}
+
+// src/oauth/login.ts
+async function runOAuthLogin(method, deps) {
+  const metadata = await discover(deps.issuer, deps.fetch);
+  const clientId = await ensureClientId({
+    issuer: deps.issuer,
+    metadata,
+    env: deps.env,
+    fetch: deps.fetch,
+    pinnedClientId: deps.pinnedClientId
+  });
+  if (method === "browser") {
+    if (!deps.openBrowser) {
+      throw new CliError("No browser opener is available for the authorization-code flow.", EXIT_CODES.auth);
+    }
+    return runBrowserLogin({
+      metadata,
+      issuer: deps.issuer,
+      clientId,
+      fetch: deps.fetch,
+      openBrowser: deps.openBrowser,
+      now: deps.now
+    });
+  }
+  const device = await requestDeviceCode({ metadata, clientId, fetch: deps.fetch });
+  deps.onDevicePrompt?.(device);
+  return pollForToken({
+    metadata,
+    issuer: deps.issuer,
+    clientId,
+    deviceCode: device.deviceCode,
+    intervalSeconds: device.intervalSeconds,
+    expiresInSeconds: device.expiresInSeconds,
+    fetch: deps.fetch,
+    sleep: deps.sleep ?? ((ms) => sleep(ms)),
+    now: deps.now
+  });
+}
+
+// src/oauth/revoke.ts
+async function revokeToken(options) {
+  try {
+    const issuer = assertRasterOrLocalHost(options.tokens.issuer, "auth issuer");
+    const metadata = await discover(issuer, options.fetch);
+    const clientId = await ensureClientId({
+      issuer,
+      metadata,
+      env: options.env,
+      fetch: options.fetch,
+      pinnedClientId: options.pinnedClientId
+    });
+    const response = await options.fetch(metadata.revocationEndpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        token: options.tokens.refreshToken,
+        token_type_hint: "refresh_token",
+        client_id: clientId
+      }).toString(),
+      signal: AbortSignal.timeout(OAUTH_REQUEST_TIMEOUT_MS)
+    });
+    return response.ok;
+  } catch {
+    return false;
+  }
 }
 
 // src/commands/auth.ts
@@ -17526,32 +18271,97 @@ async function fetchViewer(context, apiKey) {
   const client = context.clientFactory({ apiKey });
   return unwrapResult(() => client.GET("/me", { params: { header: VERSION_HEADER } }));
 }
-var loginOptionsSchema = exports_external.object({
-  apiKey: exports_external.string().min(1).optional()
-});
-async function loginCommand(context, options) {
-  const promptedKey = options.apiKey ?? (context.isInteractive ? await context.promptSecret("Paste your Raster API key") : null);
-  if (!promptedKey) {
-    throw new UsageError("Provide a key with --api-key, or run `raster auth login` in an interactive terminal.");
+async function loginCommand(context, options = {}) {
+  if (context.apiKey?.source === "flag") {
+    await apiKeyLogin(context, context.apiKey.key);
+    return;
+  }
+  if (!options.device && !options.browser && context.isInteractive) {
+    const promptedKey = await context.promptSecret("Paste your Raster API key (or press Enter to use OAuth)");
+    if (promptedKey) {
+      await apiKeyLogin(context, promptedKey);
+      return;
+    }
+  }
+  if (context.env.RASTER_API_KEY && !context.isInteractive && !options.device && !options.browser) {
+    await apiKeyLogin(context, context.env.RASTER_API_KEY);
+    return;
   }
-  const viewer = await fetchViewer(context, promptedKey);
+  await oauthLogin(context, options);
+}
+async function apiKeyLogin(context, key) {
+  const viewer = await fetchViewer(context, key);
   const config2 = await readConfig(context.env);
-  await writeConfig({ ...config2, apiKey: promptedKey }, context.env);
+  await writeConfig({
+    ...config2,
+    apiKey: key,
+    organizationId: viewer?.organizationId,
+    libraries: (viewer?.libraries ?? []).map((entry) => entry.library),
+    oauth: undefined
+  }, context.env);
   if (context.json) {
     printJson(context, viewer);
     return;
   }
   const organizationLabel = viewer?.organizationName ?? viewer?.organizationId ?? "your organization";
-  note(context, `Logged in to ${organizationLabel} as ${maskApiKey(promptedKey)}. Key stored in ${configPath(context.env)}.`);
+  note(context, `Logged in to ${organizationLabel} as ${maskApiKey(key)}. Key stored in ${configPath(context.env)}.`);
+}
+function chooseLoginMethod(context, options) {
+  if (options.device && options.browser) {
+    throw new UsageError("Pass only one of --device or --browser.");
+  }
+  if (options.browser) {
+    if (!context.canOpenBrowser()) {
+      throw new UsageError("No browser is available to open. Use --device, or run on a machine with a display.");
+    }
+    return "browser";
+  }
+  if (options.device)
+    return "device";
+  return context.isInteractive && context.canOpenBrowser() ? "browser" : "device";
+}
+async function oauthLogin(context, options) {
+  const method = chooseLoginMethod(context, options);
+  const tokens = await runOAuthLogin(method, {
+    issuer: context.issuer,
+    env: context.env,
+    fetch: context.fetch,
+    pinnedClientId: context.pinnedClientId,
+    now: context.now,
+    openBrowser: context.openBrowser,
+    onDevicePrompt: (prompt) => {
+      note(context, `To sign in, visit ${prompt.verificationUri} and enter the code: ${prompt.userCode}`);
+      if (prompt.verificationUriComplete) {
+        note(context, `Or open this link directly: ${prompt.verificationUriComplete}`);
+      }
+      note(context, "Waiting for you to finish signing in…");
+    }
+  });
+  await writeOAuthTokens(tokens, context.env);
+  if (context.json) {
+    printJson(context, { issuer: tokens.issuer, scope: tokens.scope, resource: tokens.resource });
+    return;
+  }
+  note(context, `Logged in via OAuth (${tokens.scope} scope). Tokens stored in ${configPath(context.env)}. ` + "Pass --org <id> or set RASTER_ORG to choose an organization; run `raster whoami` to list them.");
 }
 async function logoutCommand(context) {
   const config2 = await readConfig(context.env);
-  delete config2.apiKey;
-  await writeConfig(config2, context.env);
-  note(context, "Logged out. Stored API key removed.");
+  if (config2.oauth) {
+    await revokeToken({
+      tokens: config2.oauth,
+      env: context.env,
+      fetch: context.fetch,
+      pinnedClientId: context.pinnedClientId
+    });
+  }
+  const cleared = { ...config2 };
+  delete cleared.apiKey;
+  delete cleared.oauth;
+  await writeConfig(cleared, context.env);
+  note(context, "Logged out. Stored credentials removed.");
 }
 async function statusCommand(context) {
-  if (!context.apiKey) {
+  if (!context.credential) {
     if (context.json) {
       printJson(context, { authenticated: false });
       return;
@@ -17559,7 +18369,22 @@ async function statusCommand(context) {
     note(context, "Not authenticated. Run `raster auth login` or set RASTER_API_KEY.");
     return;
   }
-  const { key, source } = context.apiKey;
+  if (context.credential.kind === "oauth") {
+    statusForOAuth(context, context.credential.tokens);
+    return;
+  }
+  await statusForApiKey(context, context.credential.key, context.credential.source);
+}
+function statusForOAuth(context, tokens) {
+  const fresh = isAccessTokenFresh(tokens, context.now());
+  if (context.json) {
+    printJson(context, { authenticated: true, kind: "oauth", issuer: tokens.issuer, scope: tokens.scope, fresh });
+    return;
+  }
+  note(context, `OAuth login on ${tokens.issuer} (${tokens.scope} scope).`);
+  note(context, fresh ? "Access token is fresh." : "Access token will be refreshed on the next request.");
+}
+async function statusForApiKey(context, key, source) {
   let viewer = null;
   let failureMessage = null;
   try {
@@ -17568,12 +18393,7 @@ async function statusCommand(context) {
     failureMessage = error51 instanceof Error ? error51.message : String(error51);
   }
   if (context.json) {
-    printJson(context, {
-      authenticated: true,
-      source,
-      keyPrefix: maskApiKey(key),
-      organization: viewer ?? null
-    });
+    printJson(context, { authenticated: true, kind: "apiKey", source, keyPrefix: maskApiKey(key), organization: viewer ?? null });
     return;
   }
   note(context, `API key ${maskApiKey(key)} (from ${source}).`);
@@ -17584,25 +18404,34 @@ async function statusCommand(context) {
   note(context, `Could not validate the key against the API: ${failureMessage ?? "unknown error"}`);
 }
 async function whoamiCommand(context) {
-  const { key } = requireApiKey(context);
-  const viewer = await fetchViewer(context, key);
+  requireAuth(context);
+  const viewer = await unwrapResult(() => context.clientFactory().GET("/me", { params: { header: VERSION_HEADER } }));
   if (context.json) {
     printJson(context, viewer);
     return;
   }
+  const isBroadOAuthLogin = context.credential?.kind === "oauth" && context.credential.tokens.scope !== "org";
+  const organizations = viewer?.organizations ?? [];
+  if (isBroadOAuthLogin && organizations.length > 0) {
+    renderTable(context, organizations, [
+      { header: "organization", value: (organization) => organization.organizationId },
+      { header: "name", value: (organization) => organization.organizationName ?? "" }
+    ]);
+    return;
+  }
   renderRecord(context, [
     { label: "organization", value: viewer?.organizationId ?? "" },
     { label: "name", value: viewer?.organizationName ?? "" },
     { label: "plan", value: viewer?.plan ?? "" },
-    { label: "libraries", value: (viewer?.libraries ?? []).join(", ") }
+    { label: "libraries", value: (viewer?.libraries ?? []).map((entry) => entry.library).join(", ") }
   ]);
 }
 function registerAuthCommands(program2, runAction) {
   const auth = program2.command("auth").description("Manage CLI authentication");
-  auth.command("login").description("Validate an API key against the API and store it").option("--api-key <key>", "API key to store (prompts when omitted)").action((options, command) => runAction(command, (context) => loginCommand(context, parseOptions(loginOptionsSchema, options))));
-  auth.command("logout").description("Remove the stored API key").action((_options, command) => runAction(command, (context) => logoutCommand(context)));
-  auth.command("status").description("Show which API key is in use and where it came from").action((_options, command) => runAction(command, (context) => statusCommand(context)));
-  program2.command("whoami").description("Show the organization and libraries the API key can access").action((_options, command) => runAction(command, (context) => whoamiCommand(context)));
+  auth.command("login").description("Sign in via OAuth (opens a browser when available, otherwise a device code; force with --device/--browser), or validate an API key with --api-key").option("--device", "Force the device authorization grant (SSH/headless friendly)").option("--browser", "Use the browser authorization-code flow").action((options, command) => runAction(command, (context) => loginCommand(context, { device: options.device, browser: options.browser })));
+  auth.command("logout").description("Revoke the OAuth token (if any) and remove stored credentials").action((_options, command) => runAction(command, (context) => logoutCommand(context)));
+  auth.command("status").description("Show which credential is in use and where it came from").action((_options, command) => runAction(command, (context) => statusCommand(context)));
+  program2.command("whoami").description("Show the organizations and libraries the current credential can access").action((_options, command) => runAction(command, (context) => whoamiCommand(context)));
 }
 
 // src/commands/libraries.ts
@@ -17614,16 +18443,16 @@ var LIBRARY_COLUMNS = [
   { header: "TAGS", value: (library) => String((library.tags ?? []).length) }
 ];
 var listOptionsSchema2 = exports_external.object({
-  org: exports_external.string().min(1),
   page: exports_external.coerce.number().int().min(1).optional(),
   pageSize: exports_external.coerce.number().int().min(1).optional()
 });
 async function listLibrariesCommand(context, options) {
-  requireApiKey(context);
+  requireAuth(context);
+  const organizationId = await context.resolveOrg();
   const client = context.clientFactory();
   const libraries = await unwrapResult(() => client.GET("/organizations/{organizationId}/libraries", {
     params: {
-      path: { organizationId: options.org },
+      path: { organizationId },
       header: VERSION_HEADER,
       query: { page: options.page, pageSize: options.pageSize }
     }
@@ -17635,15 +18464,15 @@ async function listLibrariesCommand(context, options) {
   renderTable(context, libraries, LIBRARY_COLUMNS);
 }
 var createOptionsSchema = exports_external.object({
-  org: exports_external.string().min(1),
   name: exports_external.string().min(1),
   slug: exports_external.string().min(1).optional()
 });
 async function createLibraryCommand(context, options) {
-  requireApiKey(context);
+  requireAuth(context);
+  const organizationId = await context.resolveOrg();
   const client = context.clientFactory();
   const library = await unwrapResult(() => client.POST("/organizations/{organizationId}/libraries", {
-    params: { path: { organizationId: options.org }, header: VERSION_HEADER },
+    params: { path: { organizationId }, header: VERSION_HEADER },
     body: { name: options.name, slug: options.slug }
   }));
   if (context.json) {
@@ -17657,16 +18486,16 @@ async function createLibraryCommand(context, options) {
   note(context, "Library created.");
 }
 var renameOptionsSchema = exports_external.object({
-  org: exports_external.string().min(1),
-  library: exports_external.string().min(1),
   name: exports_external.string().min(1)
 });
 async function renameLibraryCommand(context, options) {
-  requireApiKey(context);
+  requireAuth(context);
+  const organizationId = await context.resolveOrg();
+  const libraryId = await context.resolveLibrary();
   const client = context.clientFactory();
   const library = await unwrapResult(() => client.PATCH("/organizations/{organizationId}/libraries/{libraryId}", {
     params: {
-      path: { organizationId: options.org, libraryId: options.library },
+      path: { organizationId, libraryId },
       header: VERSION_HEADER
     },
     body: { name: options.name }
@@ -17679,9 +18508,9 @@ async function renameLibraryCommand(context, options) {
 }
 function registerLibraryCommands(program2, runAction) {
   const libraries = program2.command("libraries").description("Work with libraries");
-  libraries.command("ls").description("List libraries in an organization").requiredOption("--org <organizationId>", "Organization id").option("--page <number>", "Page number (1-based)").option("--page-size <number>", "Results per page").action((options, command) => runAction(command, (context) => listLibrariesCommand(context, parseOptions(listOptionsSchema2, options))));
-  libraries.command("create").description("Create a library").requiredOption("--org <organizationId>", "Organization id").requiredOption("--name <name>", "Library name").option("--slug <slug>", "URL slug for the library").action((options, command) => runAction(command, (context) => createLibraryCommand(context, parseOptions(createOptionsSchema, options))));
-  libraries.command("rename").description("Rename a library").requiredOption("--org <organizationId>", "Organization id").requiredOption("--library <libraryId>", "Library id").requiredOption("--name <name>", "New library name").action((options, command) => runAction(command, (context) => renameLibraryCommand(context, parseOptions(renameOptionsSchema, options))));
+  libraries.command("ls").description("List libraries in the organization").option("--page <number>", "Page number (1-based)").option("--page-size <number>", "Results per page").action((options, command) => runAction(command, (context) => listLibrariesCommand(context, parseOptions(listOptionsSchema2, options))));
+  libraries.command("create").description("Create a library").requiredOption("--name <name>", "Library name").option("--slug <slug>", "URL slug for the library").action((options, command) => runAction(command, (context) => createLibraryCommand(context, parseOptions(createOptionsSchema, options))));
+  libraries.command("rename").description("Rename the library (the one the key scopes to, or pass --library)").requiredOption("--name <name>", "New library name").action((options, command) => runAction(command, (context) => renameLibraryCommand(context, parseOptions(renameOptionsSchema, options))));
 }
 
 // src/commands/orgs.ts
@@ -17733,16 +18562,16 @@ var TAG_COLUMNS = [
   { header: "TYPE", value: (tag) => tag.type ?? "" }
 ];
 var listOptionsSchema3 = exports_external.object({
-  org: exports_external.string().min(1),
-  library: exports_external.string().min(1),
   limit: exports_external.coerce.number().int().min(1).optional()
 });
 async function listTagsCommand(context, options) {
-  requireApiKey(context);
+  requireAuth(context);
+  const organizationId = await context.resolveOrg();
+  const libraryId = await context.resolveLibrary();
   const client = context.clientFactory();
   const tags = await unwrapResult(() => client.GET("/organizations/{organizationId}/libraries/{libraryId}/tags", {
     params: {
-      path: { organizationId: options.org, libraryId: options.library },
+      path: { organizationId, libraryId },
       header: VERSION_HEADER,
       query: { limit: options.limit }
     }
@@ -17754,53 +18583,54 @@ async function listTagsCommand(context, options) {
   renderTable(context, tags, TAG_COLUMNS);
 }
 var mutateOptionsSchema = exports_external.object({
-  org: exports_external.string().min(1),
-  library: exports_external.string().min(1),
-  asset: exports_external.array(exports_external.string().min(1)).min(1),
   tag: exports_external.array(exports_external.string().min(1)).min(1)
 });
-async function tagAssetsCommand(context, options) {
-  requireApiKey(context);
+async function tagAssetsCommand(context, assetIds, options) {
+  if (assetIds.length === 0)
+    throw new UsageError("Provide at least one asset id.");
+  requireAuth(context);
+  const organizationId = await context.resolveOrg();
+  const libraryId = await context.resolveLibrary();
   const client = context.clientFactory();
   const result = await unwrapResult(() => client.POST("/organizations/{organizationId}/libraries/{libraryId}/assets/tag", {
-    params: {
-      path: { organizationId: options.org, libraryId: options.library },
-      header: VERSION_HEADER
-    },
-    body: { assetIds: options.asset, tags: options.tag }
+    params: { path: { organizationId, libraryId }, header: VERSION_HEADER },
+    body: { assetIds, tags: options.tag }
   }));
   if (context.json) {
     printJson(context, result);
     return;
   }
-  note(context, `Tagged ${options.asset.length} asset(s) with ${options.tag.join(", ")}.`);
+  note(context, `Tagged ${assetIds.length} asset(s) with ${options.tag.join(", ")}.`);
 }
-async function untagAssetsCommand(context, options) {
-  requireApiKey(context);
+async function untagAssetsCommand(context, assetIds, options) {
+  if (assetIds.length === 0)
+    throw new UsageError("Provide at least one asset id.");
+  requireAuth(context);
+  const organizationId = await context.resolveOrg();
+  const libraryId = await context.resolveLibrary();
   const client = context.clientFactory();
   const result = await unwrapResult(() => client.POST("/organizations/{organizationId}/libraries/{libraryId}/assets/untag", {
-    params: {
-      path: { organizationId: options.org, libraryId: options.library },
-      header: VERSION_HEADER
-    },
-    body: { assetIds: options.asset, tags: options.tag }
+    params: { path: { organizationId, libraryId }, header: VERSION_HEADER },
+    body: { assetIds, tags: options.tag }
   }));
   if (context.json) {
     printJson(context, result);
     return;
   }
-  note(context, `Removed ${options.tag.join(", ")} from ${options.asset.length} asset(s).`);
+  note(context, `Removed ${options.tag.join(", ")} from ${assetIds.length} asset(s).`);
 }
 function registerTagCommands(program2, runAction) {
   const tags = program2.command("tags").description("Work with tags in a library");
-  tags.command("ls").description("List tags in a library").requiredOption("--org <organizationId>", "Organization id").requiredOption("--library <libraryId>", "Library id").option("--limit <number>", "Maximum number of tags to return").action((options, command) => runAction(command, (context) => listTagsCommand(context, parseOptions(listOptionsSchema3, options))));
-  tags.command("add").description("Add tags to assets").requiredOption("--org <organizationId>", "Organization id").requiredOption("--library <libraryId>", "Library id").requiredOption("--asset <assetId...>", "Asset ids (repeatable)").requiredOption("--tag <tag...>", "Tags to add (repeatable)").action((options, command) => runAction(command, (context) => tagAssetsCommand(context, parseOptions(mutateOptionsSchema, options))));
-  tags.command("rm").description("Remove tags from assets").requiredOption("--org <organizationId>", "Organization id").requiredOption("--library <libraryId>", "Library id").requiredOption("--asset <assetId...>", "Asset ids (repeatable)").requiredOption("--tag <tag...>", "Tags to remove (repeatable)").action((options, command) => runAction(command, (context) => untagAssetsCommand(context, parseOptions(mutateOptionsSchema, options))));
+  tags.command("ls").description("List tags in the library").option("--limit <number>", "Maximum number of tags to return").action((options, command) => runAction(command, (context) => listTagsCommand(context, parseOptions(listOptionsSchema3, options))));
+  tags.command("add").description("Add tags to assets").argument("<assetIds...>", "Asset ids to tag").requiredOption("--tag <tag...>", "Tags to add (repeatable)").action((assetIds, options, command) => runAction(command, (context) => tagAssetsCommand(context, assetIds, parseOptions(mutateOptionsSchema, options))));
+  tags.command("rm").description("Remove tags from assets").argument("<assetIds...>", "Asset ids to untag").requiredOption("--tag <tag...>", "Tags to remove (repeatable)").action((assetIds, options, command) => runAction(command, (context) => untagAssetsCommand(context, assetIds, parseOptions(mutateOptionsSchema, options))));
 }
 
 // src/index.ts
 var globalOptionsSchema = exports_external.object({
   apiKey: exports_external.string().optional(),
+  org: exports_external.string().optional(),
+  library: exports_external.string().optional(),
   json: exports_external.boolean().optional(),
   verbose: exports_external.boolean().optional()
 });
@@ -17830,7 +18660,7 @@ function exitCodeForCommanderError(error51) {
   return EXIT_CODES.generic;
 }
 var program2 = new Command;
-program2.name("raster").description("Command-line client for the Raster API").version(`${package_default.version} (Api-Version ${API_VERSION})`, "-V, --version", "Print the CLI version and the pinned Api-Version").option("--api-key <key>", "API key (overrides RASTER_API_KEY and the config file)").option("--json", "Print machine-readable JSON to stdout").option("--verbose", "Log requests to stderr (keys masked)").exitOverride();
+program2.name("raster").description("Command-line client for the Raster API").version(`${package_default.version} (Api-Version ${API_VERSION})`, "-V, --version", "Print the CLI version and the pinned Api-Version").option("--api-key <key>", "API key (overrides RASTER_API_KEY and the config file)").option("--org <organizationId>", "Organization id (derived from the API key when omitted)").option("--library <libraryId>", "Library id (derived from the API key when it has one library)").option("--json", "Print machine-readable JSON to stdout").option("--verbose", "Log requests to stderr (keys masked)").exitOverride();
 registerAuthCommands(program2, runAction);
 registerLibraryCommands(program2, runAction);
 registerAssetCommands(program2, runAction);