@raster-app/cli 0.2.0 → 0.3.1

package/dist/index.js

@@ -16337,14 +16337,11 @@ config(en_default());
 // package.json
 var package_default = {
   name: "@raster-app/cli",
-  version: "0.2.0",
+  version: "0.3.1",
   description: "Command-line client for the Raster API",
   license: "Apache-2.0",
   type: "module",
-  repository: {
-    type: "git",
-    url: "https://github.com/raster-app/raster-cli"
-  },
+  homepage: "https://docs.raster.app/api/cli",
   engines: {
     node: ">=20"
   },
@@ -16357,7 +16354,6 @@ var package_default = {
   ],
   scripts: {
     build: "bun build src/index.ts --outdir dist --target node --banner '#!/usr/bin/env node'",
-    "build:binary": "bun build src/index.ts --compile --target=bun-darwin-arm64 --outfile raster",
     "gen:types": "bun scripts/gen-types.ts",
     "check:types": "tsc --noEmit",
     "check:tarball": "bun scripts/check-tarball.ts",
@@ -16891,18 +16887,27 @@ class ApiError extends CliError {
 // src/api/client.ts
 var VERSION_HEADER = { "Api-Version": API_VERSION };
 var LOCAL_HOSTNAMES = new Set(["localhost", "127.0.0.1"]);
-function validateBaseUrl(rawUrl) {
+function isRasterHost(hostname3) {
+  return hostname3 === "raster.app" || hostname3.endsWith(".raster.app");
+}
+function assertRasterOrLocalHost(rawUrl, label) {
   let parsed;
   try {
     parsed = new URL(rawUrl);
   } catch {
-    throw new UsageError(`Invalid API base URL: ${rawUrl}`);
+    throw new UsageError(`Invalid ${label}: ${rawUrl}`);
+  }
+  if (LOCAL_HOSTNAMES.has(parsed.hostname)) {
+    return rawUrl.replace(/\/+$/, "");
   }
-  if (parsed.protocol !== "https:" && !LOCAL_HOSTNAMES.has(parsed.hostname)) {
-    throw new UsageError(`API base URL must use https (got ${rawUrl}). localhost and 127.0.0.1 are the only http exceptions.`);
+  if (parsed.protocol !== "https:" || !isRasterHost(parsed.hostname)) {
+    throw new UsageError(`${label} must be https on a raster.app host (got ${rawUrl}); localhost is allowed for development.`);
   }
   return rawUrl.replace(/\/+$/, "");
 }
+function validateBaseUrl(rawUrl) {
+  return assertRasterOrLocalHost(rawUrl, "API base URL");
+}
 function buildRequestHeaders(apiKey) {
   const headers = { "Api-Version": API_VERSION };
   if (apiKey)
@@ -17031,10 +17036,23 @@ function formatBytes(size) {
 var CONFIG_FILE_NAME = "config.json";
 var CONFIG_FILE_MODE = 384;
 var CONFIG_DIR_MODE = 448;
+var oauthTokensSchema = exports_external.object({
+  accessToken: exports_external.string().min(1),
+  refreshToken: exports_external.string().min(1),
+  expiresAt: exports_external.number(),
+  issuer: exports_external.url(),
+  scope: exports_external.string(),
+  resource: exports_external.url()
+});
+var oauthClientSchema = exports_external.object({ clientId: exports_external.string().min(1) });
 var configSchema = exports_external.object({
   apiKey: exports_external.string().min(1).optional(),
   organizationId: exports_external.string().min(1).optional(),
-  libraries: exports_external.array(exports_external.string()).optional()
+  libraries: exports_external.array(exports_external.string()).optional(),
+  oauth: oauthTokensSchema.optional(),
+  clients: exports_external.record(exports_external.string(), oauthClientSchema).optional(),
+  defaultOrg: exports_external.string().min(1).optional(),
+  issuer: exports_external.url().optional()
 });
 function configDir(env) {
   if (env.RASTER_CONFIG_HOME)
@@ -17070,17 +17088,348 @@ async function writeConfig(config2, env) {
 `, { mode: CONFIG_FILE_MODE });
   await chmod(path2, CONFIG_FILE_MODE);
 }
-function resolveApiKey(options) {
+async function writeOAuthTokens(tokens, env) {
+  const config2 = await readConfig(env);
+  await writeConfig({ ...config2, oauth: tokens }, env);
+}
+async function clearOAuthTokens(env) {
+  const config2 = await readConfig(env);
+  delete config2.oauth;
+  await writeConfig(config2, env);
+}
+async function getCachedClientId(issuer, env) {
+  return (await readConfig(env)).clients?.[issuer]?.clientId ?? null;
+}
+async function cacheClientId(issuer, clientId, env) {
+  const config2 = await readConfig(env);
+  await writeConfig({ ...config2, clients: { ...config2.clients, [issuer]: { clientId } } }, env);
+}
+
+// src/oauth/issuer.ts
+var DEFAULT_ISSUER = "https://raster.app";
+var RESOURCE_INDICATOR = "https://api.raster.app";
+var USER_SCOPE = "user";
+var DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+function resolveIssuer(options) {
+  const raw = options.env.RASTER_AUTH_ISSUER ?? options.config.issuer ?? DEFAULT_ISSUER;
+  return assertRasterOrLocalHost(raw, "auth issuer");
+}
+
+// src/oauth/open-browser.ts
+import { spawn } from "node:child_process";
+import { platform } from "node:os";
+function openerCommand() {
+  const current = platform();
+  if (current === "darwin")
+    return { command: "open", args: [] };
+  if (current === "win32")
+    return { command: "cmd", args: ["/c", "start", ""] };
+  if (current === "linux")
+    return { command: "xdg-open", args: [] };
+  return null;
+}
+function canOpenBrowser() {
+  if (!openerCommand())
+    return false;
+  if (platform() === "linux" && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY) {
+    return false;
+  }
+  return true;
+}
+async function openBrowser(url2) {
+  const opener = openerCommand();
+  if (!opener)
+    throw new Error("No browser opener is available on this platform.");
+  await new Promise((resolve, reject) => {
+    const child = spawn(opener.command, [...opener.args, url2], { stdio: "ignore", detached: true });
+    child.once("error", reject);
+    child.once("spawn", () => {
+      child.unref();
+      resolve();
+    });
+  });
+}
+
+// src/oauth/http.ts
+var FORM_CONTENT_TYPE = "application/x-www-form-urlencoded";
+var OAUTH_REQUEST_TIMEOUT_MS = 30000;
+var oauthErrorSchema = exports_external.object({
+  error: exports_external.string(),
+  error_description: exports_external.string().optional()
+});
+
+class OAuthError extends CliError {
+  error;
+  constructor(error51, description, status) {
+    super(description ? `${error51}: ${description}` : error51, EXIT_CODES.auth);
+    this.error = error51;
+    this.status = status;
+  }
+  status;
+}
+
+class AuthServerHttpError extends CliError {
+  status;
+  constructor(status) {
+    super(`Authorization server request failed with HTTP ${status}.`, EXIT_CODES.auth);
+    this.status = status;
+  }
+}
+function parseOAuthError(body, status) {
+  const parsed = oauthErrorSchema.safeParse(body);
+  if (!parsed.success)
+    return null;
+  return new OAuthError(parsed.data.error, parsed.data.error_description, status);
+}
+async function readJson(response) {
+  try {
+    return await response.json();
+  } catch {
+    return null;
+  }
+}
+async function postForm(url2, form, fetch) {
+  let response;
+  try {
+    response = await fetch(url2, {
+      method: "POST",
+      headers: { "Content-Type": FORM_CONTENT_TYPE, Accept: "application/json" },
+      body: new URLSearchParams(form).toString(),
+      signal: AbortSignal.timeout(OAUTH_REQUEST_TIMEOUT_MS)
+    });
+  } catch (error51) {
+    throw new NetworkError(`Could not reach the authorization server: ${describeError(error51)}`);
+  }
+  const body = await readJson(response);
+  const oauthError = parseOAuthError(body, response.status);
+  if (oauthError)
+    throw oauthError;
+  if (!response.ok) {
+    throw new AuthServerHttpError(response.status);
+  }
+  return body;
+}
+async function postJson(url2, payload, fetch) {
+  let response;
+  try {
+    response = await fetch(url2, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Accept: "application/json" },
+      body: JSON.stringify(payload),
+      signal: AbortSignal.timeout(OAUTH_REQUEST_TIMEOUT_MS)
+    });
+  } catch (error51) {
+    throw new NetworkError(`Could not reach the authorization server: ${describeError(error51)}`);
+  }
+  const body = await readJson(response);
+  const oauthError = parseOAuthError(body, response.status);
+  if (oauthError)
+    throw oauthError;
+  if (!response.ok) {
+    throw new AuthServerHttpError(response.status);
+  }
+  return body;
+}
+async function getJson(url2, fetch) {
+  let response;
+  try {
+    response = await fetch(url2, {
+      method: "GET",
+      headers: { Accept: "application/json" },
+      signal: AbortSignal.timeout(OAUTH_REQUEST_TIMEOUT_MS)
+    });
+  } catch (error51) {
+    throw new NetworkError(`Could not reach the authorization server: ${describeError(error51)}`);
+  }
+  if (!response.ok) {
+    throw new AuthServerHttpError(response.status);
+  }
+  return readJson(response);
+}
+function describeError(error51) {
+  return error51 instanceof Error ? error51.message : String(error51);
+}
+
+// src/oauth/discovery.ts
+var WELL_KNOWN_PATH = "/.well-known/oauth-authorization-server";
+var metadataSchema = exports_external.object({
+  issuer: exports_external.string(),
+  authorization_endpoint: exports_external.url(),
+  token_endpoint: exports_external.url(),
+  device_authorization_endpoint: exports_external.url(),
+  registration_endpoint: exports_external.url(),
+  revocation_endpoint: exports_external.url()
+});
+var metadataCache = new Map;
+async function discover(issuer, fetch) {
+  const cached2 = metadataCache.get(issuer);
+  if (cached2)
+    return cached2;
+  const body = await getJson(`${issuer}${WELL_KNOWN_PATH}`, fetch);
+  const parsed = metadataSchema.safeParse(body);
+  if (!parsed.success) {
+    throw new CliError(`The authorization server metadata at ${issuer} is missing required endpoints.`, EXIT_CODES.auth);
+  }
+  const metadata = {
+    issuer: parsed.data.issuer,
+    authorizationEndpoint: assertRasterOrLocalHost(parsed.data.authorization_endpoint, "authorization_endpoint"),
+    tokenEndpoint: assertRasterOrLocalHost(parsed.data.token_endpoint, "token_endpoint"),
+    deviceAuthorizationEndpoint: assertRasterOrLocalHost(parsed.data.device_authorization_endpoint, "device_authorization_endpoint"),
+    registrationEndpoint: assertRasterOrLocalHost(parsed.data.registration_endpoint, "registration_endpoint"),
+    revocationEndpoint: assertRasterOrLocalHost(parsed.data.revocation_endpoint, "revocation_endpoint")
+  };
+  metadataCache.set(issuer, metadata);
+  return metadata;
+}
+
+// src/oauth/register.ts
+var DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+var REGISTRATION_REQUEST = {
+  client_name: "Raster CLI",
+  token_endpoint_auth_method: "none",
+  grant_types: [DEVICE_CODE_GRANT, "authorization_code", "refresh_token"],
+  response_types: ["code"],
+  redirect_uris: ["http://127.0.0.1/callback"]
+};
+var registrationResponseSchema = exports_external.object({ client_id: exports_external.string().min(1) });
+async function ensureClientId(options) {
+  if (options.pinnedClientId)
+    return options.pinnedClientId;
+  const cached2 = await getCachedClientId(options.issuer, options.env);
+  if (cached2)
+    return cached2;
+  const body = await postJson(options.metadata.registrationEndpoint, REGISTRATION_REQUEST, options.fetch);
+  const parsed = registrationResponseSchema.safeParse(body);
+  if (!parsed.success) {
+    throw new CliError("Dynamic client registration did not return a client_id.", EXIT_CODES.auth);
+  }
+  await cacheClientId(options.issuer, parsed.data.client_id, options.env);
+  return parsed.data.client_id;
+}
+
+// src/oauth/tokens.ts
+var ACCESS_TOKEN_SKEW_MS = 60000;
+var SECONDS_TO_MS = 1000;
+var tokenResponseSchema = exports_external.object({
+  access_token: exports_external.string().min(1),
+  refresh_token: exports_external.string().min(1),
+  expires_in: exports_external.number().positive(),
+  token_type: exports_external.string().optional(),
+  scope: exports_external.string().optional()
+});
+function parseTokenResponse(body) {
+  const parsed = tokenResponseSchema.parse(body);
+  return {
+    accessToken: parsed.access_token,
+    refreshToken: parsed.refresh_token,
+    expiresIn: parsed.expires_in,
+    scope: parsed.scope
+  };
+}
+function toStoredTokens(response, context) {
+  return {
+    accessToken: response.accessToken,
+    refreshToken: response.refreshToken,
+    expiresAt: context.now + response.expiresIn * SECONDS_TO_MS,
+    issuer: context.issuer,
+    scope: response.scope ?? context.fallbackScope ?? "user",
+    resource: context.resource
+  };
+}
+function isAccessTokenFresh(tokens, now, skewMs = ACCESS_TOKEN_SKEW_MS) {
+  return now < tokens.expiresAt - skewMs;
+}
+
+// src/oauth/refresh.ts
+var INVALID_GRANT = "invalid_grant";
+
+class OAuthReuseError extends CliError {
+  constructor() {
+    super("Your saved login is no longer valid. Run `raster auth login` to sign in again.", EXIT_CODES.auth);
+  }
+}
+async function refreshTokens(options) {
+  let body;
+  try {
+    body = await postForm(options.metadata.tokenEndpoint, {
+      grant_type: "refresh_token",
+      refresh_token: options.tokens.refreshToken,
+      client_id: options.clientId,
+      resource: RESOURCE_INDICATOR
+    }, options.fetch);
+  } catch (error51) {
+    if (error51 instanceof OAuthError && error51.error === INVALID_GRANT)
+      throw new OAuthReuseError;
+    if (error51 instanceof AuthServerHttpError && error51.status >= 400 && error51.status < 500) {
+      throw new OAuthReuseError;
+    }
+    throw error51;
+  }
+  return toStoredTokens(parseTokenResponse(body), {
+    issuer: options.tokens.issuer,
+    resource: options.tokens.resource,
+    now: options.now,
+    fallbackScope: options.tokens.scope
+  });
+}
+
+// src/oauth/session.ts
+async function ensureFreshOAuthSession(options) {
+  if (isAccessTokenFresh(options.tokens, options.now)) {
+    return { status: "active", tokens: options.tokens };
+  }
+  const issuer = assertRasterOrLocalHost(options.tokens.issuer, "auth issuer");
+  const metadata = await discover(issuer, options.fetch);
+  const clientId = await ensureClientId({
+    issuer,
+    metadata,
+    env: options.env,
+    fetch: options.fetch,
+    pinnedClientId: options.pinnedClientId
+  });
+  try {
+    const rotated = await refreshTokens({
+      tokens: options.tokens,
+      metadata,
+      clientId,
+      fetch: options.fetch,
+      now: options.now
+    });
+    await writeOAuthTokens(rotated, options.env);
+    return { status: "active", tokens: rotated };
+  } catch (error51) {
+    if (error51 instanceof OAuthReuseError) {
+      await clearOAuthTokens(options.env);
+      return { status: "reauth-required" };
+    }
+    throw error51;
+  }
+}
+
+// src/lib/credential.ts
+function resolveCredential(options) {
   if (options.flagKey)
-    return { key: options.flagKey, source: "flag" };
+    return { kind: "apiKey", key: options.flagKey, source: "flag" };
+  if (options.config.oauth)
+    return { kind: "oauth", tokens: options.config.oauth };
   if (options.env.RASTER_API_KEY)
-    return { key: options.env.RASTER_API_KEY, source: "env" };
+    return { kind: "apiKey", key: options.env.RASTER_API_KEY, source: "env" };
   if (options.config.apiKey)
-    return { key: options.config.apiKey, source: "config" };
+    return { kind: "apiKey", key: options.config.apiKey, source: "config" };
   return null;
 }
 
 // src/lib/output.ts
+var ANSI = { reset: "\x1B[0m", bold: "\x1B[1m", dim: "\x1B[2m", cyan: "\x1B[36m" };
+function paint(text, code, enabled) {
+  return enabled ? `${code}${text}${ANSI.reset}` : text;
+}
+function bold(text, enabled) {
+  return paint(text, ANSI.bold, enabled);
+}
+function dim(text, enabled) {
+  return paint(text, ANSI.dim, enabled);
+}
 function printJson(output, payload) {
   output.stdout(`${JSON.stringify(payload, null, 2)}
 `);
@@ -17193,73 +17542,144 @@ function promptSecret(message) {
 }
 
 // src/lib/context.ts
+var RASTER_ORG_ENV = "RASTER_ORG";
+var PINNED_CLIENT_ID_ENV = "RASTER_OAUTH_CLIENT_ID";
+function toLibraryIds(libraries) {
+  return (libraries ?? []).map((entry) => typeof entry === "string" ? entry : entry?.library).filter((id) => typeof id === "string");
+}
 async function createCommandContext(globals, overrides = {}) {
   const env = overrides.env ?? process.env;
   const config2 = await readConfig(env);
-  const apiKey = resolveApiKey({ flagKey: globals.apiKey, env, config: config2 });
+  const now = overrides.now ?? Date.now;
   const output = {
     json: globals.json === true,
     verbose: globals.verbose === true,
+    color: overrides.stderr === undefined && process.stderr.isTTY === true && env.NO_COLOR === undefined,
     stdout: overrides.stdout ?? ((text) => void process.stdout.write(text)),
     stderr: overrides.stderr ?? ((text) => void process.stderr.write(text))
   };
   const baseUrl = validateBaseUrl(env.RASTER_API_BASE_URL ?? DEFAULT_BASE_URL);
   const baseFetch = overrides.fetch ?? globalThis.fetch;
-  const instrumentedFetch = instrumentFetch(baseFetch, output, apiKey ? maskApiKey(apiKey.key) : null);
+  const credential = await resolveActiveCredential({
+    flagKey: globals.apiKey,
+    env,
+    config: config2,
+    fetch: instrumentFetch(baseFetch, output, null),
+    now: now()
+  });
+  const apiKey = credential?.kind === "apiKey" ? { key: credential.key, source: credential.source } : null;
+  const bearer = credentialBearer(credential);
+  const instrumentedFetch = instrumentFetch(baseFetch, output, bearer ? maskApiKey(bearer) : null);
   const clientFactory = (clientOverrides) => createApiClient({
     baseUrl,
-    apiKey: clientOverrides ? clientOverrides.apiKey : apiKey?.key ?? null,
+    apiKey: clientOverrides ? clientOverrides.apiKey : bearer,
     fetch: instrumentedFetch
   });
   let viewerPromise = null;
   const loadViewer = () => {
     if (!viewerPromise) {
-      if (!apiKey) {
-        throw new AuthSetupError("No API key found. Run `raster auth login` or set RASTER_API_KEY.");
+      if (!credential) {
+        throw new AuthSetupError("Not authenticated. Run `raster auth login` or set RASTER_API_KEY.");
       }
-      viewerPromise = unwrapResult(() => clientFactory({ apiKey: apiKey.key }).GET("/me", { params: { header: VERSION_HEADER } }));
+      viewerPromise = unwrapResult(() => clientFactory().GET("/me", { params: { header: VERSION_HEADER } }));
     }
     return viewerPromise;
   };
   const cacheMatchesKey = config2.apiKey !== undefined && apiKey?.key === config2.apiKey;
+  const resolveOrgId = async () => {
+    if (globals.org)
+      return globals.org;
+    if (env[RASTER_ORG_ENV])
+      return env[RASTER_ORG_ENV];
+    if (credential?.kind === "oauth") {
+      if (credential.tokens.scope === "org") {
+        const viewer2 = await loadViewer();
+        if (viewer2.organizationId)
+          return viewer2.organizationId;
+        throw new CliError("This login is bound to an organization that is no longer available. Run `raster auth login` again.", EXIT_CODES.auth);
+      }
+      if (config2.defaultOrg)
+        return config2.defaultOrg;
+      throw new UsageError("This login can access multiple organizations. Pass --org <id> (or set RASTER_ORG); run `raster whoami` to list them.");
+    }
+    if (cacheMatchesKey && config2.organizationId)
+      return config2.organizationId;
+    const viewer = await loadViewer();
+    if (!viewer.organizationId) {
+      throw new CliError("Could not determine the organization from the API key.", EXIT_CODES.generic);
+    }
+    return viewer.organizationId;
+  };
+  const librariesForTarget = async () => {
+    const cached2 = cacheMatchesKey ? config2.libraries : undefined;
+    if (cached2)
+      return cached2;
+    const viewer = await loadViewer();
+    if (credential?.kind === "oauth" && credential.tokens.scope !== "org") {
+      const organizationId = await resolveOrgId();
+      const entry = viewer.organizations?.find((organization) => organization?.organizationId === organizationId);
+      return entry?.libraries ?? [];
+    }
+    return viewer.libraries ?? [];
+  };
   return {
     ...output,
     env,
     baseUrl,
     isInteractive: overrides.isInteractive ?? process.stdin.isTTY === true,
+    credential,
     apiKey,
+    bearerToken: bearer,
     fetch: instrumentedFetch,
     clientFactory,
     confirm: overrides.confirm ?? promptConfirm,
     promptSecret: overrides.promptSecret ?? promptSecret,
+    now,
+    issuer: resolveIssuer({ env, config: config2 }),
+    pinnedClientId: env[PINNED_CLIENT_ID_ENV],
+    openBrowser: overrides.openBrowser ?? openBrowser,
+    canOpenBrowser: overrides.canOpenBrowser ?? canOpenBrowser,
     explicitLibrary: globals.library,
-    resolveOrg: async () => {
-      if (globals.org)
-        return globals.org;
-      if (cacheMatchesKey && config2.organizationId)
-        return config2.organizationId;
-      const viewer = await loadViewer();
-      if (!viewer.organizationId) {
-        throw new CliError("Could not determine the organization from the API key.", EXIT_CODES.generic);
-      }
-      return viewer.organizationId;
-    },
+    resolveOrg: resolveOrgId,
     resolveLibrary: async () => {
       if (globals.library)
         return globals.library;
-      const cachedLibraries = cacheMatchesKey ? config2.libraries : undefined;
-      const source = cachedLibraries ?? (await loadViewer()).libraries ?? [];
-      const libraries = source.filter((value) => typeof value === "string");
+      const libraries = toLibraryIds(await librariesForTarget());
       const onlyLibrary = libraries[0];
       if (libraries.length === 1 && onlyLibrary)
         return onlyLibrary;
       if (libraries.length === 0) {
-        throw new AuthSetupError("The API key has no library access.");
+        throw new AuthSetupError("No library access for this login. Pass --library <id>.");
       }
-      throw new UsageError(`The API key can access ${libraries.length} libraries (${libraries.join(", ")}). Pass --library <id>.`);
+      throw new UsageError(`This login can access ${libraries.length} libraries (${libraries.join(", ")}). Pass --library <id>.`);
     }
   };
 }
+function credentialBearer(credential) {
+  if (!credential)
+    return null;
+  return credential.kind === "apiKey" ? credential.key : credential.tokens.accessToken;
+}
+async function resolveActiveCredential(options) {
+  const credential = resolveCredential({ flagKey: options.flagKey, env: options.env, config: options.config });
+  if (credential?.kind !== "oauth")
+    return credential;
+  const session = await ensureFreshOAuthSession({
+    tokens: credential.tokens,
+    env: options.env,
+    fetch: options.fetch,
+    pinnedClientId: options.env[PINNED_CLIENT_ID_ENV],
+    now: options.now
+  });
+  if (session.status === "reauth-required") {
+    return resolveCredential({
+      flagKey: options.flagKey,
+      env: options.env,
+      config: { ...options.config, oauth: undefined }
+    });
+  }
+  return { kind: "oauth", tokens: session.tokens };
+}
 function instrumentFetch(baseFetch, output, maskedKey) {
   return async (input, init) => {
     const request = input instanceof Request ? input : new Request(String(input), init);
@@ -17276,10 +17696,15 @@ function instrumentFetch(baseFetch, output, maskedKey) {
     }
   };
 }
-function requireApiKey(context) {
-  if (context.apiKey)
-    return context.apiKey;
-  throw new AuthSetupError("No API key found. Run `raster auth login` or set RASTER_API_KEY.");
+function requireAuth(context) {
+  if (context.credential)
+    return context.credential;
+  throw new AuthSetupError("Not authenticated. Run `raster auth login` or set RASTER_API_KEY.");
+}
+function requireBearer(context) {
+  if (context.bearerToken)
+    return context.bearerToken;
+  throw new AuthSetupError("Not authenticated. Run `raster auth login` or set RASTER_API_KEY.");
 }
 async function executeCommand(context, action) {
   try {
@@ -17333,7 +17758,7 @@ async function listAssetsCommand(context, options) {
   if (options.tag.length > MAX_TAGS_PER_QUERY) {
     throw new ValidationError(`At most ${MAX_TAGS_PER_QUERY} --tag filters are supported per query.`);
   }
-  requireApiKey(context);
+  requireAuth(context);
   const organizationId = await context.resolveOrg();
   const libraryId = await context.resolveLibrary();
   const client = context.clientFactory();
@@ -17355,7 +17780,7 @@ async function listAssetsCommand(context, options) {
   renderTable(context, assets, ASSET_COLUMNS);
 }
 async function getAssetCommand(context, assetId) {
-  requireApiKey(context);
+  requireAuth(context);
   const asset = await fetchAsset(context, assetId);
   if (context.json) {
     printJson(context, asset);
@@ -17385,7 +17810,7 @@ var searchOptionsSchema = exports_external.object({
   pageSize: exports_external.coerce.number().int().min(1).optional()
 });
 async function searchAssetsCommand(context, query, options) {
-  requireApiKey(context);
+  requireAuth(context);
   const organizationId = await context.resolveOrg();
   const client = context.clientFactory();
   const result = await unwrapResult(() => client.GET("/organizations/{organizationId}/search/assets", {
@@ -17412,7 +17837,7 @@ var downloadOptionsSchema = exports_external.object({
   force: exports_external.boolean().default(false)
 });
 async function downloadAssetCommand(context, assetId, options) {
-  requireApiKey(context);
+  requireAuth(context);
   const asset = await fetchAsset(context, assetId);
   const fileUrl = asset.url;
   if (!fileUrl)
@@ -17440,7 +17865,7 @@ var uploadedAssetsSchema = exports_external.object({
 async function uploadAssetsCommand(context, files) {
   if (files.length === 0)
     throw new UsageError("Provide at least one file to upload.");
-  const { key } = requireApiKey(context);
+  const bearer = requireBearer(context);
   const organizationId = await context.resolveOrg();
   const libraryId = await context.resolveLibrary();
   const batches = chunk(files, MAX_UPLOAD_FILES);
@@ -17460,7 +17885,7 @@ async function uploadAssetsCommand(context, files) {
     if (batches.length > 1) {
       note(context, `Uploading batch ${batchIndex + 1}/${batches.length} (${batch.length} files)…`);
     }
-    const response = await context.fetch(`${context.baseUrl}/organizations/${organizationId}/libraries/${libraryId}/assets`, { method: "POST", headers: buildRequestHeaders(key), body: formData });
+    const response = await context.fetch(`${context.baseUrl}/organizations/${organizationId}/libraries/${libraryId}/assets`, { method: "POST", headers: buildRequestHeaders(bearer), body: formData });
     const payload = await parseEnvelope(response);
     payloads.push(payload);
     const parsed = uploadedAssetsSchema.safeParse(payload);
@@ -17487,7 +17912,7 @@ async function removeAssetsCommand(context, assetIds, options) {
   if (assetIds.length > MAX_DELETE_IDS) {
     throw new ValidationError(`At most ${MAX_DELETE_IDS} asset ids are supported per call.`);
   }
-  requireApiKey(context);
+  requireAuth(context);
   const organizationId = await context.resolveOrg();
   const libraryId = await context.resolveLibrary();
   if (!options.yes && context.isInteractive) {
@@ -17506,13 +17931,13 @@ async function removeAssetsCommand(context, assetIds, options) {
     printJson(context, result);
     return;
   }
-  note(context, `Moved ${assetIds.length} asset(s) to trash. They are recoverable from the library trash.`);
+  note(context, `Moved ${assetIds.length} asset(s) to trash.`);
 }
 var describeOptionsSchema = exports_external.object({
   text: exports_external.string().min(1)
 });
 async function describeAssetCommand(context, assetId, options) {
-  requireApiKey(context);
+  requireAuth(context);
   const organizationId = await context.resolveOrg();
   const libraryId = await context.resolveLibrary();
   const client = context.clientFactory();
@@ -17535,7 +17960,7 @@ var transferOptionsSchema = exports_external.object({
 async function transferAssetsCommand(context, assetIds, options) {
   if (assetIds.length === 0)
     throw new UsageError("Provide at least one asset id.");
-  requireApiKey(context);
+  requireAuth(context);
   const organizationId = await context.resolveOrg();
   const libraryId = await context.resolveLibrary();
   const client = context.clientFactory();
@@ -17561,48 +17986,418 @@ function registerAssetCommands(program2, runAction) {
   assets.command("transfer").description("Move assets to another library").argument("<assetIds...>", "Asset ids to move").requiredOption("--to <libraryId>", "Target library id").action((assetIds, options, command) => runAction(command, (context) => transferAssetsCommand(context, assetIds, parseOptions(transferOptionsSchema, options))));
 }
 
+// src/oauth/login.ts
+import { setTimeout as sleep } from "node:timers/promises";
+
+// src/oauth/loopback.ts
+import { createServer } from "node:http";
+var CALLBACK_PATH = "/callback";
+var LOOPBACK_HOST = "127.0.0.1";
+var SUCCESS_PAGE = "<!doctype html><meta charset=utf-8><title>Raster CLI</title>" + '<body style="font-family:system-ui;text-align:center;padding-top:4rem">' + "<h1>Signed in</h1><p>You can close this tab and return to the terminal.</p></body>";
+var FAILURE_PAGE = "<!doctype html><meta charset=utf-8><title>Raster CLI</title>" + '<body style="font-family:system-ui;text-align:center;padding-top:4rem">' + "<h1>Sign-in failed</h1><p>You can close this tab and return to the terminal.</p></body>";
+async function startLoopbackServer() {
+  let resolveCallback;
+  let rejectCallback;
+  const callbackPromise = new Promise((resolve, reject) => {
+    resolveCallback = resolve;
+    rejectCallback = reject;
+  });
+  let settled = false;
+  const server = createServer((request, response) => {
+    const url2 = new URL(request.url ?? "/", `http://${LOOPBACK_HOST}`);
+    if (url2.pathname !== CALLBACK_PATH) {
+      response.writeHead(404).end();
+      return;
+    }
+    const code = url2.searchParams.get("code");
+    const state = url2.searchParams.get("state");
+    if (code && state) {
+      response.writeHead(200, { "Content-Type": "text/html", Connection: "close" }).end(SUCCESS_PAGE);
+      if (!settled) {
+        settled = true;
+        resolveCallback({ code, state });
+      }
+      return;
+    }
+    response.writeHead(400, { "Content-Type": "text/html", Connection: "close" }).end(FAILURE_PAGE);
+    if (!settled) {
+      settled = true;
+      const error51 = url2.searchParams.get("error");
+      rejectCallback(new CliError(error51 ? `The authorization server returned an error: ${error51}.` : "The authorization server returned no code.", EXIT_CODES.auth));
+    }
+  });
+  let port;
+  try {
+    port = await listenOnEphemeralPort(server);
+  } catch (error51) {
+    server.close();
+    throw error51;
+  }
+  return {
+    redirectUri: `http://${LOOPBACK_HOST}:${port}${CALLBACK_PATH}`,
+    waitForCallback: () => callbackPromise,
+    close: () => {
+      server.close();
+      server.closeAllConnections?.();
+    }
+  };
+}
+function listenOnEphemeralPort(server) {
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, LOOPBACK_HOST, () => {
+      const address = server.address();
+      if (address !== null && typeof address === "object" && typeof address.port === "number") {
+        resolve(address.port);
+        return;
+      }
+      reject(new CliError("Could not bind a loopback port for the browser login.", EXIT_CODES.generic));
+    });
+  });
+}
+
+// src/oauth/pkce.ts
+import { createHash, randomBytes } from "node:crypto";
+var VERIFIER_BYTES = 32;
+var STATE_BYTES = 16;
+function base64UrlEncode(input) {
+  return input.toString("base64url");
+}
+function createPkce() {
+  const verifier = base64UrlEncode(randomBytes(VERIFIER_BYTES));
+  const challenge = base64UrlEncode(createHash("sha256").update(verifier).digest());
+  return { verifier, challenge, method: "S256" };
+}
+function createState() {
+  return base64UrlEncode(randomBytes(STATE_BYTES));
+}
+
+// src/oauth/browser.ts
+var DEFAULT_LOGIN_TIMEOUT_MS = 5 * 60000;
+async function withDeadline(promise2, ms) {
+  let timer;
+  try {
+    return await Promise.race([
+      promise2,
+      new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new CliError("Timed out waiting for browser sign-in. Run `raster auth login` again.", EXIT_CODES.auth)), ms);
+      })
+    ]);
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+  }
+}
+async function runBrowserLogin(options) {
+  const pkce = createPkce();
+  const state = createState();
+  const server = await startLoopbackServer();
+  try {
+    const authorizeUrl = buildAuthorizeUrl({
+      metadata: options.metadata,
+      clientId: options.clientId,
+      redirectUri: server.redirectUri,
+      challenge: pkce.challenge,
+      state
+    });
+    options.onAuthorizeUrl?.(authorizeUrl);
+    await options.openBrowser(authorizeUrl);
+    const callback = await withDeadline(server.waitForCallback(), options.loginTimeoutMs ?? DEFAULT_LOGIN_TIMEOUT_MS);
+    if (callback.state !== state) {
+      throw new CliError("The browser login response failed its state check. Run `raster auth login` again.", EXIT_CODES.auth);
+    }
+    const body = await postForm(options.metadata.tokenEndpoint, {
+      grant_type: "authorization_code",
+      code: callback.code,
+      redirect_uri: server.redirectUri,
+      client_id: options.clientId,
+      code_verifier: pkce.verifier,
+      resource: RESOURCE_INDICATOR
+    }, options.fetch);
+    return toStoredTokens(parseTokenResponse(body), {
+      issuer: options.issuer,
+      resource: RESOURCE_INDICATOR,
+      now: options.now()
+    });
+  } finally {
+    server.close();
+  }
+}
+function buildAuthorizeUrl(options) {
+  const url2 = new URL(options.metadata.authorizationEndpoint);
+  url2.search = new URLSearchParams({
+    response_type: "code",
+    client_id: options.clientId,
+    redirect_uri: options.redirectUri,
+    scope: USER_SCOPE,
+    resource: RESOURCE_INDICATOR,
+    code_challenge: options.challenge,
+    code_challenge_method: "S256",
+    state: options.state
+  }).toString();
+  return url2.toString();
+}
+
+// src/oauth/device.ts
+var SLOW_DOWN_INCREMENT_SECONDS = 5;
+var SECONDS_TO_MS2 = 1000;
+var deviceResponseSchema = exports_external.object({
+  device_code: exports_external.string().min(1),
+  user_code: exports_external.string().min(1),
+  verification_uri: exports_external.url(),
+  verification_uri_complete: exports_external.url().optional(),
+  expires_in: exports_external.number().positive(),
+  interval: exports_external.number().positive().optional()
+});
+var DEFAULT_INTERVAL_SECONDS = 5;
+async function requestDeviceCode(options) {
+  const body = await postForm(options.metadata.deviceAuthorizationEndpoint, { client_id: options.clientId, scope: USER_SCOPE, resource: RESOURCE_INDICATOR }, options.fetch);
+  const parsed = deviceResponseSchema.safeParse(body);
+  if (!parsed.success) {
+    throw new CliError("The device authorization response was malformed.", EXIT_CODES.auth);
+  }
+  return {
+    deviceCode: parsed.data.device_code,
+    userCode: parsed.data.user_code,
+    verificationUri: parsed.data.verification_uri,
+    verificationUriComplete: parsed.data.verification_uri_complete,
+    expiresInSeconds: parsed.data.expires_in,
+    intervalSeconds: parsed.data.interval ?? DEFAULT_INTERVAL_SECONDS
+  };
+}
+function nextPollAction(errorCode, interval) {
+  if (errorCode === "authorization_pending")
+    return { kind: "wait", interval };
+  if (errorCode === "slow_down")
+    return { kind: "wait", interval: interval + SLOW_DOWN_INCREMENT_SECONDS };
+  return { kind: "fail" };
+}
+async function pollForToken(options) {
+  const deadline = options.now() + options.expiresInSeconds * SECONDS_TO_MS2;
+  let interval = options.intervalSeconds;
+  while (true) {
+    if (options.now() >= deadline) {
+      throw new CliError("The device code expired before you finished signing in. Run `raster auth login` again.", EXIT_CODES.auth);
+    }
+    let outcome;
+    try {
+      outcome = await pollOnce(options);
+    } catch (error51) {
+      if (!(error51 instanceof NetworkError))
+        throw error51;
+      outcome = { kind: "error", error: "authorization_pending" };
+    }
+    if (outcome.kind === "tokens")
+      return outcome.tokens;
+    const action = nextPollAction(outcome.error, interval);
+    if (action.kind === "fail") {
+      throw new CliError(`Device authorization failed: ${outcome.error}. Run \`raster auth login\` again.`, EXIT_CODES.auth);
+    }
+    interval = action.interval;
+    await options.sleep(interval * SECONDS_TO_MS2);
+  }
+}
+async function pollOnce(options) {
+  try {
+    const body = await postForm(options.metadata.tokenEndpoint, { grant_type: DEVICE_CODE_GRANT_TYPE, device_code: options.deviceCode, client_id: options.clientId }, options.fetch);
+    const tokens = toStoredTokens(parseTokenResponse(body), {
+      issuer: options.issuer,
+      resource: RESOURCE_INDICATOR,
+      now: options.now()
+    });
+    return { kind: "tokens", tokens };
+  } catch (error51) {
+    if (error51 instanceof OAuthError)
+      return { kind: "error", error: error51.error };
+    throw error51;
+  }
+}
+
+// src/oauth/login.ts
+async function runOAuthLogin(method, deps) {
+  const metadata = await discover(deps.issuer, deps.fetch);
+  const clientId = await ensureClientId({
+    issuer: deps.issuer,
+    metadata,
+    env: deps.env,
+    fetch: deps.fetch,
+    pinnedClientId: deps.pinnedClientId
+  });
+  if (method === "browser") {
+    if (!deps.openBrowser) {
+      throw new CliError("No browser opener is available for the authorization-code flow.", EXIT_CODES.auth);
+    }
+    return runBrowserLogin({
+      metadata,
+      issuer: deps.issuer,
+      clientId,
+      fetch: deps.fetch,
+      openBrowser: deps.openBrowser,
+      now: deps.now,
+      onAuthorizeUrl: deps.onAuthorizeUrl
+    });
+  }
+  const device = await requestDeviceCode({ metadata, clientId, fetch: deps.fetch });
+  deps.onDevicePrompt?.(device);
+  return pollForToken({
+    metadata,
+    issuer: deps.issuer,
+    clientId,
+    deviceCode: device.deviceCode,
+    intervalSeconds: device.intervalSeconds,
+    expiresInSeconds: device.expiresInSeconds,
+    fetch: deps.fetch,
+    sleep: deps.sleep ?? ((ms) => sleep(ms)),
+    now: deps.now
+  });
+}
+
+// src/oauth/revoke.ts
+async function revokeToken(options) {
+  try {
+    const issuer = assertRasterOrLocalHost(options.tokens.issuer, "auth issuer");
+    const metadata = await discover(issuer, options.fetch);
+    const clientId = await ensureClientId({
+      issuer,
+      metadata,
+      env: options.env,
+      fetch: options.fetch,
+      pinnedClientId: options.pinnedClientId
+    });
+    const response = await options.fetch(metadata.revocationEndpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        token: options.tokens.refreshToken,
+        token_type_hint: "refresh_token",
+        client_id: clientId
+      }).toString(),
+      signal: AbortSignal.timeout(OAUTH_REQUEST_TIMEOUT_MS)
+    });
+    return response.ok;
+  } catch {
+    return false;
+  }
+}
+
 // src/commands/auth.ts
 async function fetchViewer(context, apiKey) {
   const client = context.clientFactory({ apiKey });
   return unwrapResult(() => client.GET("/me", { params: { header: VERSION_HEADER } }));
 }
-async function loginCommand(context) {
-  const flagKey = context.apiKey?.source === "flag" ? context.apiKey.key : null;
-  const key = flagKey ?? (context.isInteractive ? await context.promptSecret("Paste your Raster API key") : null);
-  if (!key) {
-    throw new UsageError("Provide a key with --api-key, or run `raster auth login` in an interactive terminal.");
+async function loginCommand(context, options = {}) {
+  if (context.apiKey?.source === "flag") {
+    await apiKeyLogin(context, context.apiKey.key);
+    return;
   }
+  if (context.env.RASTER_API_KEY && !context.isInteractive && !options.device && !options.browser) {
+    await apiKeyLogin(context, context.env.RASTER_API_KEY);
+    return;
+  }
+  await oauthLogin(context, options);
+}
+async function apiKeyLogin(context, key) {
   const viewer = await fetchViewer(context, key);
   const config2 = await readConfig(context.env);
   await writeConfig({
     ...config2,
     apiKey: key,
     organizationId: viewer?.organizationId,
-    libraries: (viewer?.libraries ?? []).filter((library) => typeof library === "string")
+    libraries: (viewer?.libraries ?? []).map((entry) => entry.library),
+    oauth: undefined
   }, context.env);
   if (context.json) {
     printJson(context, viewer);
     return;
   }
   const organizationLabel = viewer?.organizationName ?? viewer?.organizationId ?? "your organization";
-  note(context, `Logged in to ${organizationLabel} as ${maskApiKey(key)}. Key stored in ${configPath(context.env)}.`);
+  note(context, `Logged in to ${organizationLabel}.`);
+}
+function chooseLoginMethod(context, options) {
+  if (options.device && options.browser) {
+    throw new UsageError("Pass only one of --device or --browser.");
+  }
+  if (options.browser) {
+    if (!context.canOpenBrowser()) {
+      throw new UsageError("No browser is available to open. Use --device, or run on a machine with a display.");
+    }
+    return "browser";
+  }
+  if (options.device)
+    return "device";
+  return context.isInteractive && context.canOpenBrowser() ? "browser" : "device";
+}
+async function oauthLogin(context, options) {
+  const method = chooseLoginMethod(context, options);
+  const tokens = await runOAuthLogin(method, {
+    issuer: context.issuer,
+    env: context.env,
+    fetch: context.fetch,
+    pinnedClientId: context.pinnedClientId,
+    now: context.now,
+    openBrowser: context.openBrowser,
+    onDevicePrompt: (prompt) => {
+      const target = prompt.verificationUriComplete ? bold(prompt.verificationUriComplete, context.color) : `${bold(prompt.verificationUri, context.color)} and enter code ${bold(prompt.userCode, context.color)}`;
+      note(context, "");
+      note(context, `Visit ${target}`);
+      note(context, "");
+      note(context, dim("Waiting for authentication…", context.color));
+    },
+    onAuthorizeUrl: (url2) => {
+      note(context, "");
+      note(context, `Visit ${bold(url2, context.color)}`);
+      note(context, "");
+      note(context, dim("Waiting for authentication…", context.color));
+    }
+  });
+  await writeOAuthTokens(tokens, context.env);
+  if (context.json) {
+    printJson(context, { issuer: tokens.issuer, scope: tokens.scope, resource: tokens.resource });
+    return;
+  }
+  note(context, "Logged in.");
 }
 async function logoutCommand(context) {
   const config2 = await readConfig(context.env);
-  delete config2.apiKey;
-  await writeConfig(config2, context.env);
-  note(context, "Logged out. Stored API key removed.");
+  if (config2.oauth) {
+    await revokeToken({
+      tokens: config2.oauth,
+      env: context.env,
+      fetch: context.fetch,
+      pinnedClientId: context.pinnedClientId
+    });
+  }
+  const cleared = { ...config2 };
+  delete cleared.apiKey;
+  delete cleared.oauth;
+  await writeConfig(cleared, context.env);
+  note(context, "Logged out.");
 }
 async function statusCommand(context) {
-  if (!context.apiKey) {
+  if (!context.credential) {
     if (context.json) {
       printJson(context, { authenticated: false });
       return;
     }
-    note(context, "Not authenticated. Run `raster auth login` or set RASTER_API_KEY.");
+    note(context, "Not authenticated. Run `raster auth login`.");
+    return;
+  }
+  if (context.credential.kind === "oauth") {
+    statusForOAuth(context, context.credential.tokens);
+    return;
+  }
+  await statusForApiKey(context, context.credential.key, context.credential.source);
+}
+function statusForOAuth(context, tokens) {
+  const fresh = isAccessTokenFresh(tokens, context.now());
+  if (context.json) {
+    printJson(context, { authenticated: true, kind: "oauth", issuer: tokens.issuer, scope: tokens.scope, fresh });
     return;
   }
-  const { key, source } = context.apiKey;
+  note(context, `OAuth login on ${tokens.issuer}, ${tokens.scope} scope.`);
+  note(context, fresh ? "Token fresh." : "Token refreshes on next use.");
+}
+async function statusForApiKey(context, key, source) {
   let viewer = null;
   let failureMessage = null;
   try {
@@ -17611,15 +18406,10 @@ async function statusCommand(context) {
     failureMessage = error51 instanceof Error ? error51.message : String(error51);
   }
   if (context.json) {
-    printJson(context, {
-      authenticated: true,
-      source,
-      keyPrefix: maskApiKey(key),
-      organization: viewer ?? null
-    });
+    printJson(context, { authenticated: true, kind: "apiKey", source, keyPrefix: maskApiKey(key), organization: viewer ?? null });
     return;
   }
-  note(context, `API key ${maskApiKey(key)} (from ${source}).`);
+  note(context, `API key ${maskApiKey(key)}, from ${source}.`);
   if (viewer) {
     note(context, `Organization: ${viewer.organizationName ?? viewer.organizationId ?? "unknown"} · plan: ${viewer.plan ?? "unknown"}`);
     return;
@@ -17627,25 +18417,34 @@ async function statusCommand(context) {
   note(context, `Could not validate the key against the API: ${failureMessage ?? "unknown error"}`);
 }
 async function whoamiCommand(context) {
-  const { key } = requireApiKey(context);
-  const viewer = await fetchViewer(context, key);
+  requireAuth(context);
+  const viewer = await unwrapResult(() => context.clientFactory().GET("/me", { params: { header: VERSION_HEADER } }));
   if (context.json) {
     printJson(context, viewer);
     return;
   }
+  const isBroadOAuthLogin = context.credential?.kind === "oauth" && context.credential.tokens.scope !== "org";
+  const organizations = viewer?.organizations ?? [];
+  if (isBroadOAuthLogin && organizations.length > 0) {
+    renderTable(context, organizations, [
+      { header: "organization", value: (organization) => organization.organizationId },
+      { header: "name", value: (organization) => organization.organizationName ?? "" }
+    ]);
+    return;
+  }
   renderRecord(context, [
     { label: "organization", value: viewer?.organizationId ?? "" },
     { label: "name", value: viewer?.organizationName ?? "" },
     { label: "plan", value: viewer?.plan ?? "" },
-    { label: "libraries", value: (viewer?.libraries ?? []).join(", ") }
+    { label: "libraries", value: (viewer?.libraries ?? []).map((entry) => entry.library).join(", ") }
   ]);
 }
 function registerAuthCommands(program2, runAction) {
   const auth = program2.command("auth").description("Manage CLI authentication");
-  auth.command("login").description("Validate an API key against the API and store it (pass --api-key, or run interactively to be prompted)").action((_options, command) => runAction(command, (context) => loginCommand(context)));
-  auth.command("logout").description("Remove the stored API key").action((_options, command) => runAction(command, (context) => logoutCommand(context)));
-  auth.command("status").description("Show which API key is in use and where it came from").action((_options, command) => runAction(command, (context) => statusCommand(context)));
-  program2.command("whoami").description("Show the organization and libraries the API key can access").action((_options, command) => runAction(command, (context) => whoamiCommand(context)));
+  auth.command("login").description("Sign in via OAuth (opens a browser when available, otherwise a device code; force with --device/--browser), or validate an API key with --api-key").option("--device", "Force the device authorization grant (SSH/headless friendly)").option("--browser", "Use the browser authorization-code flow").action((options, command) => runAction(command, (context) => loginCommand(context, { device: options.device, browser: options.browser })));
+  auth.command("logout").description("Revoke the OAuth token (if any) and remove stored credentials").action((_options, command) => runAction(command, (context) => logoutCommand(context)));
+  auth.command("status").description("Show which credential is in use and where it came from").action((_options, command) => runAction(command, (context) => statusCommand(context)));
+  program2.command("whoami").description("Show the organizations and libraries the current credential can access").action((_options, command) => runAction(command, (context) => whoamiCommand(context)));
 }
 
 // src/commands/libraries.ts
@@ -17661,7 +18460,7 @@ var listOptionsSchema2 = exports_external.object({
   pageSize: exports_external.coerce.number().int().min(1).optional()
 });
 async function listLibrariesCommand(context, options) {
-  requireApiKey(context);
+  requireAuth(context);
   const organizationId = await context.resolveOrg();
   const client = context.clientFactory();
   const libraries = await unwrapResult(() => client.GET("/organizations/{organizationId}/libraries", {
@@ -17682,7 +18481,7 @@ var createOptionsSchema = exports_external.object({
   slug: exports_external.string().min(1).optional()
 });
 async function createLibraryCommand(context, options) {
-  requireApiKey(context);
+  requireAuth(context);
   const organizationId = await context.resolveOrg();
   const client = context.clientFactory();
   const library = await unwrapResult(() => client.POST("/organizations/{organizationId}/libraries", {
@@ -17703,7 +18502,7 @@ var renameOptionsSchema = exports_external.object({
   name: exports_external.string().min(1)
 });
 async function renameLibraryCommand(context, options) {
-  requireApiKey(context);
+  requireAuth(context);
   const organizationId = await context.resolveOrg();
   const libraryId = await context.resolveLibrary();
   const client = context.clientFactory();
@@ -17779,7 +18578,7 @@ var listOptionsSchema3 = exports_external.object({
   limit: exports_external.coerce.number().int().min(1).optional()
 });
 async function listTagsCommand(context, options) {
-  requireApiKey(context);
+  requireAuth(context);
   const organizationId = await context.resolveOrg();
   const libraryId = await context.resolveLibrary();
   const client = context.clientFactory();
@@ -17802,7 +18601,7 @@ var mutateOptionsSchema = exports_external.object({
 async function tagAssetsCommand(context, assetIds, options) {
   if (assetIds.length === 0)
     throw new UsageError("Provide at least one asset id.");
-  requireApiKey(context);
+  requireAuth(context);
   const organizationId = await context.resolveOrg();
   const libraryId = await context.resolveLibrary();
   const client = context.clientFactory();
@@ -17819,7 +18618,7 @@ async function tagAssetsCommand(context, assetIds, options) {
 async function untagAssetsCommand(context, assetIds, options) {
   if (assetIds.length === 0)
     throw new UsageError("Provide at least one asset id.");
-  requireApiKey(context);
+  requireAuth(context);
   const organizationId = await context.resolveOrg();
   const libraryId = await context.resolveLibrary();
   const client = context.clientFactory();