@runtypelabs/cli 2.59.1 → 2.59.2

package/dist/chunk-DEPmLshX.js

@@ -0,0 +1,834 @@
+#!/usr/bin/env node
+import { b as CredentialStore, c as loadEffectiveContext, i as assertExpectedApiUrl, l as normalizeApiUrl, n as CliContextError, s as getInvocationOptions, t as isTTY } from "./index.js";
+import { EntityCard, MutationResult, React, loadUi, mutationResultProps, render, useEffect, useMutationState, useState } from "./chunk-CoAWdSiE.js";
+import { i as getApiUrl, n as ApiKeyValidationUnavailableError, r as createCliClient } from "./chunk-BW2fg46T.js";
+import { n as browserLogin, r as orgMismatchWarning, t as apiKeyLogin } from "./chunk-BnWhIqW1.js";
+import { n as ensureAuth, r as getAuthenticatedUser, t as authRequiredMessage } from "./chunk-CJraEBVd.js";
+import { a as printJson } from "./chunk-CcFCyqbB.js";
+import { Command } from "commander";
+import chalk from "chalk";
+// src/auth/agent-auth-client.ts
+/**
+* Protocol error with the spec error code and an agent-actionable hint.
+* `hint` is safe to surface verbatim in JSON output as the next step.
+*/
+var AgentAuthError = class extends Error {
+	code;
+	status;
+	hint;
+	constructor(code, status, message, hint) {
+		super(message);
+		this.code = code;
+		this.status = status;
+		this.hint = hint;
+		this.name = "AgentAuthError";
+	}
+};
+const ERROR_HINTS = {
+	email_already_registered: "This email already has a Runtype account, so it cannot claim a new agent account. Ask the user to sign in at the dashboard, create an API key (Settings > API keys), and give it to you. Then run: runtype auth login --api-key <key> --no-tty",
+	invalid_claim_token: "The claim token is invalid or expired. Run: runtype auth register --force",
+	claim_expired: "The claim window expired. Run: runtype auth register --force",
+	credential_expired: "The temporary credential expired. Run: runtype auth register --force",
+	claimed_or_in_flight: "A claim is already in progress. Ask the user for the 6-digit code from their email, then run: runtype auth verify <code>. If the code expired, re-run: runtype auth claim <email>",
+	otp_invalid: "That code is not correct. Ask the user to re-check the 6-digit code from the most recent Runtype email and run: runtype auth verify <code>",
+	otp_expired: "The code expired. Re-send it with: runtype auth claim <email>",
+	previously_claimed: "This registration was already claimed. Run: runtype auth status to inspect stored credentials.",
+	email_send_failed: "The verification email could not be sent. Retry: runtype auth claim <email>",
+	rate_limited: "Too many attempts. Wait a minute, then retry the same command.",
+	service_disabled: "Agent registration is temporarily disabled. Try again later."
+};
+async function postJson(apiUrl, endpoint, body) {
+	assertExpectedApiUrl(apiUrl);
+	if (getInvocationOptions().expectOrg !== void 0) throw new CliContextError("--expect-org is not supported for anonymous registration or claim/verify actions.");
+	const url = `${apiUrl}${endpoint}`;
+	let response;
+	try {
+		response = await fetch(url, {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				"user-agent": "runtype-cli"
+			},
+			body: JSON.stringify(body)
+		});
+	} catch (error) {
+		throw new AgentAuthError("network_error", 0, `Could not reach ${url}: ${error instanceof Error ? error.message : String(error)}`, "Check network access and the --api-url value, then retry the same command.");
+	}
+	let data = {};
+	try {
+		data = await response.json();
+	} catch {}
+	if (!response.ok) {
+		const code = typeof data.error === "string" ? data.error : `http_${response.status}`;
+		const message = typeof data.message === "string" ? data.message : `Request failed (${response.status})`;
+		throw new AgentAuthError(code, response.status, message, ERROR_HINTS[code]);
+	}
+	return {
+		status: response.status,
+		data
+	};
+}
+function requireString(data, key) {
+	const value = data[key];
+	if (typeof value !== "string" || value.length === 0) throw new AgentAuthError("invalid_response", 0, `Registration response is missing "${key}". The API may be an incompatible version.`);
+	return value;
+}
+function stringArray(value) {
+	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+/** POST /agent/auth — anonymous registration returning a temporary credential + claim token. */
+async function registerAnonymousAgent(apiUrl) {
+	const { data } = await postJson(apiUrl || getApiUrl(), "/agent/auth", {
+		type: "anonymous",
+		requested_credential_type: "api_key"
+	});
+	return {
+		registrationId: requireString(data, "registration_id"),
+		credential: requireString(data, "credential"),
+		credentialExpires: requireString(data, "credential_expires"),
+		scopes: stringArray(data.scopes),
+		claimToken: requireString(data, "claim_token"),
+		claimTokenExpires: requireString(data, "claim_token_expires"),
+		postClaimScopes: stringArray(data.post_claim_scopes)
+	};
+}
+/** POST /agent/auth/claim — email the user a 6-digit code that binds the account to them. */
+async function initiateClaim(claimToken, email, apiUrl) {
+	const { data } = await postJson(apiUrl || getApiUrl(), "/agent/auth/claim", {
+		claim_token: claimToken,
+		email
+	});
+	return {
+		registrationId: requireString(data, "registration_id"),
+		status: typeof data.status === "string" ? data.status : "initiated",
+		otpExpiresAt: requireString(data, "expires_at")
+	};
+}
+/** POST /agent/auth/claim/complete — exchange the OTP for a fresh full-access credential. */
+async function completeClaim(claimToken, otp, apiUrl) {
+	const { data } = await postJson(apiUrl || getApiUrl(), "/agent/auth/claim/complete", {
+		claim_token: claimToken,
+		otp
+	});
+	return {
+		registrationId: requireString(data, "registration_id"),
+		credential: requireString(data, "credential"),
+		scopes: stringArray(data.scopes)
+	};
+}
+// src/commands/auth-agent.ts
+const VERIFY_NEXT = "Ask the user for the 6-digit code from their email, then run: runtype auth verify <code>";
+function claimNext(email) {
+	return email ? `Send the verification email with: runtype auth claim ${email}` : "Ask the user for their email address, then run: runtype auth claim <email>";
+}
+function fail(payload) {
+	console.error(JSON.stringify(payload, null, 2));
+	process.exit(1);
+}
+function failFromError(error, fallbackNext) {
+	if (error instanceof AgentAuthError) fail({
+		status: "error",
+		code: error.code,
+		error: error.message,
+		...error.hint || fallbackNext ? { next: error.hint || fallbackNext } : {}
+	});
+	fail({
+		status: "error",
+		error: error instanceof Error ? error.message : String(error),
+		...fallbackNext ? { next: fallbackNext } : {}
+	});
+}
+async function fetchIdentity(apiKey, apiUrl) {
+	const profile = await createCliClient(apiKey, apiUrl).get("/users/profile");
+	return {
+		userId: typeof profile.id === "string" ? profile.id : "unknown",
+		orgId: typeof profile.orgId === "string" ? profile.orgId : void 0,
+		email: typeof profile.email === "string" ? profile.email : void 0
+	};
+}
+async function registerAction(options) {
+	const store = new CredentialStore();
+	const apiUrl = options.apiUrl || getApiUrl();
+	const existingClaim = await store.getClaimState();
+	const hasCredentials = await store.hasCredentials();
+	if (existingClaim && !options.force) {
+		const resumeDeadline = existingClaim.claimTokenExpires ?? existingClaim.credentialExpires;
+		if (!(resumeDeadline && new Date(resumeDeadline) < /* @__PURE__ */ new Date())) {
+			const payload = {
+				status: "registration_pending",
+				registrationId: existingClaim.registrationId,
+				credentialExpires: existingClaim.credentialExpires,
+				next: existingClaim.claimEmail ? VERIFY_NEXT : claimNext(options.email)
+			};
+			if (existingClaim.claimEmail) payload.claimEmail = existingClaim.claimEmail;
+			printJson(payload);
+			return;
+		}
+	}
+	if (hasCredentials && !existingClaim && !options.force) fail({
+		status: "error",
+		code: "already_authenticated",
+		error: "Credentials are already stored for a claimed account.",
+		next: "Run: runtype auth whoami --no-tty to confirm, or runtype auth logout first if the user wants a different account."
+	});
+	let registration;
+	try {
+		registration = await registerAnonymousAgent(apiUrl);
+	} catch (error) {
+		failFromError(error, "Retry: runtype auth register");
+	}
+	let identity = { userId: "unknown" };
+	try {
+		identity = await fetchIdentity(registration.credential, apiUrl);
+	} catch {}
+	const claimState = {
+		claimToken: registration.claimToken,
+		registrationId: registration.registrationId,
+		credentialExpires: registration.credentialExpires,
+		claimTokenExpires: registration.claimTokenExpires,
+		apiUrl
+	};
+	const registered = await store.saveCredentials({
+		apiKey: registration.credential,
+		userId: identity.userId,
+		orgId: identity.orgId,
+		apiUrl
+	}, claimState);
+	const base = {
+		status: "registered",
+		accountState: "temporary",
+		registrationId: registration.registrationId,
+		userId: identity.userId,
+		credentialExpires: registration.credentialExpires,
+		note: "A temporary account is active: CLI commands work now with limited models and quota. Verifying an email upgrades it to a full account and replaces the stored credential automatically."
+	};
+	if (options.email) try {
+		const claim = await initiateClaim(registration.claimToken, options.email, apiUrl);
+		await store.saveClaimState({
+			...claimState,
+			claimEmail: options.email,
+			accountId: registered.id
+		});
+		printJson({
+			...base,
+			status: "otp_sent",
+			claimEmail: options.email,
+			otpExpiresAt: claim.otpExpiresAt,
+			next: VERIFY_NEXT
+		});
+		return;
+	} catch (error) {
+		if (error instanceof AgentAuthError) fail({
+			...base,
+			status: "registered_claim_failed",
+			code: error.code,
+			error: error.message,
+			next: error.hint || claimNext(options.email)
+		});
+		throw error;
+	}
+	printJson({
+		...base,
+		next: claimNext()
+	});
+}
+async function claimAction(email, options) {
+	const store = new CredentialStore();
+	const claimState = await store.getClaimState();
+	const apiUrl = options.apiUrl || claimState?.apiUrl || (await store.getCredentials())?.apiUrl || getApiUrl();
+	if (!claimState) {
+		const hasCredentials = await store.hasCredentials();
+		fail({
+			status: "error",
+			code: "no_pending_registration",
+			error: hasCredentials ? "Stored credentials are already claimed; there is nothing to claim." : "No registration found.",
+			next: hasCredentials ? "Run: runtype auth whoami --no-tty" : `Run: runtype auth register --email ${email}`
+		});
+	}
+	try {
+		const claim = await initiateClaim(claimState.claimToken, email, apiUrl);
+		await store.saveClaimState({
+			...claimState,
+			claimEmail: email
+		});
+		printJson({
+			status: "otp_sent",
+			registrationId: claim.registrationId,
+			claimEmail: email,
+			otpExpiresAt: claim.otpExpiresAt,
+			next: VERIFY_NEXT
+		});
+	} catch (error) {
+		failFromError(error, `Retry: runtype auth claim ${email}`);
+	}
+}
+async function verifyAction(code, options) {
+	const store = new CredentialStore();
+	const claimState = await store.getClaimState();
+	const apiUrl = options.apiUrl || claimState?.apiUrl || (await store.getCredentials())?.apiUrl || getApiUrl();
+	if (!claimState) fail({
+		status: "error",
+		code: "no_pending_registration",
+		error: "No claim in progress.",
+		next: "Run: runtype auth register --email <email> first."
+	});
+	if (!claimState.claimEmail) fail({
+		status: "error",
+		code: "claim_not_initiated",
+		error: "No verification email has been sent yet, so there is no code to verify.",
+		next: claimNext()
+	});
+	let completed;
+	try {
+		completed = await completeClaim(claimState.claimToken, code.trim(), apiUrl);
+	} catch (error) {
+		failFromError(error);
+	}
+	let identity = { userId: "unknown" };
+	try {
+		identity = await fetchIdentity(completed.credential, apiUrl);
+	} catch {}
+	const preClaimAccountId = claimState.accountId;
+	const wasDefault = (await store.getDefaultAccount())?.id === preClaimAccountId;
+	const saved = await store.saveCredentials({
+		apiKey: completed.credential,
+		userId: identity.userId,
+		orgId: identity.orgId,
+		apiUrl
+	}, void 0, { makeDefault: wasDefault });
+	if (preClaimAccountId && preClaimAccountId !== saved.id) await store.removeAccount(preClaimAccountId);
+	printJson({
+		status: "authenticated",
+		accountState: "full",
+		registrationId: completed.registrationId,
+		userId: identity.userId,
+		email: identity.email ?? claimState.claimEmail,
+		note: "The account is fully activated and the stored credential was rotated. All limits from the temporary account are removed.",
+		next: "Continue with setup: runtype install-mcp (then confirm with: runtype auth whoami --no-tty)"
+	});
+}
+function registerAgentAuthCommands(authCommand) {
+	authCommand.command("register").description("Create a Runtype account without a browser (agent signup, step 1 of 2)").option("--email <email>", "Also send the verification email in the same step").option("--force", "Register a new account even if one is stored or pending").option("--api-url <url>", "Custom API URL").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(registerAction);
+	authCommand.command("claim <email>").description("Email the user a 6-digit code to attach the account to them").option("--api-url <url>", "Custom API URL").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(claimAction);
+	authCommand.command("verify <code>").description("Complete signup with the 6-digit code from the verification email (step 2 of 2)").option("--api-url <url>", "Custom API URL").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(verifyAction);
+}
+// src/commands/auth.ts
+const authCommand = new Command("auth").description("Manage authentication");
+const NON_TTY_LOGIN_GUIDANCE = {
+	status: "error",
+	code: "tty_required",
+	error: "Browser login needs an interactive terminal, which this environment does not have.",
+	next: ["New account (no browser needed): ask the user for their email, then run: runtype auth register --email <email> — a 6-digit code is emailed to them; finish with: runtype auth verify <code>", "Existing account: ask the user for an API key from the dashboard (Settings > API keys), then run: runtype auth login --api-key <key>"]
+};
+const API_UNREACHABLE_NEXT = ["Confirm this environment can reach the Runtype API directly over HTTPS.", "If egress is restricted, allowlist api.runtype.com (staging: api.runtype-staging.com), then re-run: runtype auth login --api-key <key>"];
+/**
+* Forcing --tty from a non-terminal cannot make browser login work.
+* The flag only switches output rendering; the OAuth callback still cannot complete here.
+* Observed in the field: `auth login --tty` hangs until the harness kills it.
+* Refuse up front with the same guidance instead of hanging.
+*/
+function refuseForcedTtyLogin(options) {
+	if (options.tty === true && process.stdout.isTTY !== true) {
+		console.error(JSON.stringify({
+			...NON_TTY_LOGIN_GUIDANCE,
+			error: "Browser login needs a real interactive terminal. Forcing --tty from a non-terminal only changes output formatting; the browser OAuth callback still cannot complete here, so the command would hang."
+		}, null, 2));
+		process.exit(1);
+	}
+	return false;
+}
+async function getBillingInfo(apiKey, apiUrl) {
+	try {
+		return await createCliClient(apiKey, apiUrl).get("/billing/status");
+	} catch {
+		return null;
+	}
+}
+/** Run one async step under the shared spinner/result chrome. */
+async function renderTask(loadingLabel, task) {
+	await loadUi();
+	const App = () => {
+		const [label, setLabel] = useState(loadingLabel);
+		const [message, setMessage] = useState("");
+		const mutation = useMutationState();
+		useEffect(() => {
+			task(setLabel).then((value) => {
+				setMessage(value.message);
+				mutation.succeed(value.result);
+			}).catch((err) => mutation.fail(err));
+		}, []);
+		return React.createElement(MutationResult, {
+			...mutationResultProps(mutation.state),
+			loadingLabel: label,
+			successMessage: message
+		});
+	};
+	const { waitUntilExit } = render(React.createElement(App));
+	await waitUntilExit();
+}
+function loginFields(login) {
+	return [
+		{
+			label: "Organization",
+			value: login.orgId ?? "Personal"
+		},
+		{
+			label: "User ID",
+			value: login.userId
+		},
+		{
+			label: "API URL",
+			value: login.apiUrl
+		},
+		{
+			label: "Default login",
+			value: login.isDefault ? "yes" : "no (run: runtype auth switch)"
+		}
+	];
+}
+function loginJson(login) {
+	const warning = orgMismatchWarning(login);
+	return {
+		status: "authenticated",
+		userId: login.userId,
+		orgId: login.orgId ?? null,
+		apiUrl: login.apiUrl,
+		accountId: login.account.id,
+		isDefault: login.isDefault,
+		secretStore: login.account.secretStore,
+		...warning ? { warning } : {}
+	};
+}
+function loginOutcome(login) {
+	return {
+		message: orgMismatchWarning(login) ?? `Logged in to ${login.orgId ?? "your personal account"}.`,
+		result: React.createElement(EntityCard, { fields: loginFields(login) })
+	};
+}
+authCommand.command("signup").description("Create a new Runtype account (alias for \"auth login\")").option("--api-url <url>", "Custom API URL").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(async (options) => {
+	await loadEffectiveContext(options.apiUrl);
+	refuseForcedTtyLogin(options);
+	if (!isTTY(options)) {
+		console.error(JSON.stringify(NON_TTY_LOGIN_GUIDANCE, null, 2));
+		process.exit(1);
+	}
+	await renderTask("Opening browser for authentication...", async (setLabel) => loginOutcome(await browserLogin({
+		...options,
+		onProgress: setLabel
+	})));
+});
+function failApiKeyLogin(error) {
+	if (error instanceof ApiKeyValidationUnavailableError) {
+		console.error(JSON.stringify({
+			status: "error",
+			code: "api_unreachable",
+			error: error.message,
+			next: API_UNREACHABLE_NEXT
+		}, null, 2));
+		process.exit(1);
+	}
+	const message = error instanceof Error ? error.message : "Unknown error";
+	console.error(JSON.stringify({
+		status: "error",
+		error: message
+	}, null, 2));
+	process.exit(1);
+}
+async function loginAction(options) {
+	await loadEffectiveContext(options.apiUrl);
+	if (options.apiKey) {
+		const apiKey = options.apiKey;
+		if (!isTTY(options)) {
+			let login;
+			try {
+				login = await apiKeyLogin(apiKey, { apiUrl: options.apiUrl });
+			} catch (error) {
+				failApiKeyLogin(error);
+				return;
+			}
+			console.log(JSON.stringify({
+				...loginJson(login),
+				next: "Continue with setup: runtype install-mcp (then confirm with: runtype auth whoami)"
+			}, null, 2));
+			return;
+		}
+		await renderTask("Validating API key...", async () => loginOutcome(await apiKeyLogin(apiKey, { apiUrl: options.apiUrl })));
+		return;
+	}
+	refuseForcedTtyLogin(options);
+	if (!isTTY(options)) {
+		console.error(JSON.stringify(NON_TTY_LOGIN_GUIDANCE, null, 2));
+		process.exit(1);
+	}
+	await renderTask("Initializing authentication...", async (setLabel) => loginOutcome(await browserLogin({
+		...options,
+		onProgress: setLabel
+	})));
+}
+const LOGIN_DESCRIPTION = "Log in to an organization (adds a login; the target org comes from --org, RUNTYPE_ORG, or .runtype/project.json)";
+authCommand.command("login").description(LOGIN_DESCRIPTION).option("--api-url <url>", "Custom API URL").option("--api-key <key>", "Use API key directly").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(loginAction);
+const loginCommand = new Command("login").description(LOGIN_DESCRIPTION).option("--api-url <url>", "Custom API URL").option("--api-key <key>", "Use API key directly").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(loginAction);
+function describeAccountSource(context) {
+	switch (context.accountSource) {
+		case "flag": return "--org flag";
+		case "environment": return "RUNTYPE_ORG";
+		case "project": return context.projectLink ? `project link (${context.projectLink.path})` : "project link";
+		default: return "default login";
+	}
+}
+authCommand.command("status").description("Show which login this directory uses").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(async (options) => {
+	const store = new CredentialStore();
+	if (!isTTY(options)) {
+		try {
+			const context = await loadEffectiveContext();
+			const storedLogins = (await store.listAccounts()).length;
+			const credentials = context.credentials;
+			if (!credentials) {
+				console.log(JSON.stringify({
+					status: "unauthenticated",
+					requestedOrgId: context.requestedOrgId ?? null,
+					accountSource: context.accountSource,
+					projectLink: context.projectLink?.path ?? null,
+					storedLogins,
+					next: context.requestedOrgId ? authRequiredMessage(context) : "New account: runtype auth register --email <email>. Existing account: runtype auth login --api-key <key>."
+				}, null, 2));
+				return;
+			}
+			const pendingClaim = await store.getClaimState();
+			const claimState = pendingClaim?.accountId === credentials.accountId ? pendingClaim : null;
+			console.log(JSON.stringify({
+				status: "authenticated",
+				accountState: claimState ? "temporary" : "full",
+				userId: credentials.userId,
+				apiUrl: credentials.apiUrl,
+				orgId: credentials.orgId || null,
+				accountId: credentials.accountId,
+				accountSource: context.accountSource,
+				projectLink: context.projectLink?.path ?? null,
+				secretStore: context.account?.secretStore ?? null,
+				storedLogins,
+				...context.credentialSource === "environment" ? { note: "RUNTYPE_API_KEY is set and takes precedence over the stored login." } : {},
+				...claimState ? {
+					registrationId: claimState.registrationId,
+					credentialExpires: claimState.credentialExpires,
+					claimEmail: claimState.claimEmail ?? null,
+					next: claimState.claimEmail ? "Finish signup: ask the user for the 6-digit code from their email, then run: runtype auth verify <code>" : "Finish signup: ask the user for their email, then run: runtype auth claim <email>"
+				} : {}
+			}, null, 2));
+		} catch (error) {
+			const message = error instanceof Error ? error.message : "Unknown error";
+			console.error(JSON.stringify({
+				status: "error",
+				error: message
+			}, null, 2));
+		}
+		return;
+	}
+	await renderTask("Checking authentication...", async () => {
+		const context = await loadEffectiveContext();
+		const storedLogins = (await store.listAccounts()).length;
+		const credentials = context.credentials;
+		if (!credentials) return {
+			message: "Auth Status",
+			result: React.createElement(EntityCard, { fields: [
+				{
+					label: "Status",
+					value: "Not authenticated",
+					color: "yellow"
+				},
+				{
+					label: "Selected by",
+					value: describeAccountSource(context)
+				},
+				{
+					label: "Stored logins",
+					value: String(storedLogins)
+				},
+				{
+					label: "Hint",
+					value: context.requestedOrgId ? authRequiredMessage(context) : "Run runtype auth login"
+				}
+			] })
+		};
+		return {
+			message: "Auth Status",
+			result: React.createElement(EntityCard, { fields: [
+				{
+					label: "Status",
+					value: "Authenticated",
+					color: "green"
+				},
+				{
+					label: "Organization",
+					value: credentials.orgId || "Personal"
+				},
+				{
+					label: "User ID",
+					value: credentials.userId
+				},
+				{
+					label: "API URL",
+					value: credentials.apiUrl
+				},
+				{
+					label: "API Key",
+					value: credentials.apiKey.substring(0, 12) + "..."
+				},
+				{
+					label: "Selected by",
+					value: describeAccountSource(context)
+				},
+				{
+					label: "Stored in",
+					value: context.account?.secretStore === "file" ? "credential file" : "OS keychain"
+				},
+				{
+					label: "Stored logins",
+					value: String(storedLogins)
+				},
+				...context.credentialSource === "environment" ? [{
+					label: "Note",
+					value: "RUNTYPE_API_KEY overrides the stored login",
+					color: "yellow"
+				}] : []
+			] })
+		};
+	});
+});
+authCommand.command("accounts").alias("list").description("List stored logins (one per organization and API URL)").option("--json", "Output as JSON").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(async (options) => {
+	const store = new CredentialStore();
+	const [accounts, defaultAccount, context] = await Promise.all([
+		store.listAccounts(),
+		store.getDefaultAccount(),
+		loadEffectiveContext()
+	]);
+	const rows = accounts.map((account) => ({
+		accountId: account.id,
+		orgId: account.orgId,
+		userId: account.userId,
+		apiUrl: account.apiUrl,
+		isDefault: account.id === defaultAccount?.id,
+		isActive: account.id === context.account?.id,
+		secretStore: account.secretStore,
+		pendingClaim: Boolean(account.claim),
+		lastUsedAt: account.lastUsedAt ?? null
+	}));
+	if (!isTTY(options) || options.json) {
+		console.log(JSON.stringify({ accounts: rows }, null, 2));
+		return;
+	}
+	if (rows.length === 0) {
+		console.log(chalk.yellow("No stored logins. Run: runtype login"));
+		return;
+	}
+	for (const row of rows) {
+		const marker = row.isActive ? chalk.green("*") : " ";
+		const tags = [row.isDefault ? "default" : null, row.pendingClaim ? "unclaimed" : null].filter(Boolean).join(", ");
+		console.log(`${marker} ${chalk.bold(row.orgId ?? "Personal")}  ${chalk.gray(row.apiUrl)}${tags ? `  ${chalk.cyan(`(${tags})`)}` : ""}`);
+	}
+	console.log(chalk.gray("\n* = login used in this directory"));
+});
+/** Resolve an `auth switch`/`logout` argument (org id or account id) to exactly one stored login. */
+async function findAccountArgument(store, value, apiUrl) {
+	const accounts = await store.listAccounts();
+	const byId = accounts.find((account) => account.id === value);
+	if (byId) return byId;
+	const target = apiUrl ? normalizeApiUrl(apiUrl) : void 0;
+	const matches = accounts.filter((account) => account.orgId === value && (!target || account.apiUrl === target));
+	if (matches.length === 1) return matches[0];
+	if (matches.length > 1) throw new CliContextError(`${value} has logins on several API URLs (${matches.map((m) => m.apiUrl).join(", ")}); pass --api-url to pick one.`);
+	throw new CliContextError(`No stored login for ${value}. Run: runtype login --org ${value}`);
+}
+authCommand.command("switch [org]").description("Set the default login used outside linked projects").option("--api-url <url>", "Disambiguate when the organization has logins on several API URLs").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(async (org, options) => {
+	const store = new CredentialStore();
+	const accounts = await store.listAccounts();
+	if (accounts.length === 0) {
+		console.error(chalk.yellow("No stored logins. Run: runtype login"));
+		process.exit(1);
+		return;
+	}
+	let account;
+	if (org) account = await findAccountArgument(store, org, options.apiUrl ?? getInvocationOptions().apiUrl);
+	else if (!isTTY(options)) {
+		console.error(JSON.stringify({
+			status: "error",
+			error: "Pass the organization to switch to.",
+			next: "runtype auth accounts --json, then: runtype auth switch <orgId>"
+		}));
+		process.exit(1);
+		return;
+	} else {
+		const { promptForAccount } = await import("./chunk-CGDQoqDC.js");
+		account = await promptForAccount(accounts);
+	}
+	if (!account) return;
+	await store.setDefaultAccount(account.id);
+	const context = await loadEffectiveContext();
+	const shadowed = context.accountSource !== "default" && context.account?.id !== account.id ? `This directory still uses ${context.requestedOrgId} (${describeAccountSource(context)}).` : null;
+	if (!isTTY(options)) {
+		console.log(JSON.stringify({
+			status: "switched",
+			accountId: account.id,
+			orgId: account.orgId,
+			apiUrl: account.apiUrl,
+			...shadowed ? { note: shadowed } : {}
+		}, null, 2));
+		return;
+	}
+	console.log(chalk.green(`Default login is now ${account.orgId ?? "Personal"} (${account.apiUrl}).`));
+	if (shadowed) console.log(chalk.yellow(shadowed));
+});
+authCommand.command("export-key").description("Print the active login's API key to stdout (for use in scripts and .env files)").action(async () => {
+	const apiKey = await new CredentialStore().getApiKey();
+	if (!apiKey) {
+		console.error("Not authenticated. Run `runtype auth login` first.");
+		process.exit(1);
+		return;
+	}
+	process.stdout.write(apiKey);
+});
+registerAgentAuthCommands(authCommand);
+authCommand.command("logout [org]").description("Remove the login this directory uses (or the named org's login, or --all)").option("--all", "Remove every stored login").option("--api-url <url>", "Disambiguate when the organization has logins on several API URLs").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(async (org, options) => {
+	const store = new CredentialStore();
+	const logout = async () => {
+		if (options.all) {
+			const accounts = await store.listAccounts();
+			for (const account of accounts) await store.removeAccount(account.id);
+			return { removed: accounts };
+		}
+		if (org) {
+			const account = await findAccountArgument(store, org, options.apiUrl ?? getInvocationOptions().apiUrl);
+			await store.removeAccount(account.id);
+			return { removed: [account] };
+		}
+		const removed = await store.clearCredentials();
+		return { removed: removed ? [removed] : [] };
+	};
+	if (!isTTY(options)) {
+		const { removed } = await logout();
+		if (removed.length === 0) {
+			console.log(JSON.stringify({ status: "no_credentials" }, null, 2));
+			return;
+		}
+		console.log(JSON.stringify({
+			status: "logged_out",
+			removed: removed.map((account) => ({
+				orgId: account.orgId,
+				apiUrl: account.apiUrl
+			})),
+			remainingLogins: (await store.listAccounts()).length
+		}, null, 2));
+		return;
+	}
+	await renderTask("Logging out...", async () => {
+		const { removed } = await logout();
+		if (removed.length === 0) return { message: "No stored credentials found" };
+		return { message: `Logged out of ${removed.map((account) => account.orgId ?? "Personal").join(", ")}` };
+	});
+});
+authCommand.command("whoami").description("Display current user information").option("--json", "Output as JSON").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(async (options) => {
+	const apiKey = await ensureAuth({
+		interactive: false,
+		exitOnFailure: false
+	});
+	const context = await loadEffectiveContext();
+	const credentials = {
+		...context.credentialSource === "stored" ? context.credentials : {},
+		apiKey,
+		apiUrl: context.apiUrl
+	};
+	if (!credentials || !credentials.apiKey) {
+		if (!isTTY(options) || options.json) console.log(JSON.stringify({
+			status: "unauthenticated",
+			...context.requestedOrgId ? {
+				requestedOrgId: context.requestedOrgId,
+				next: authRequiredMessage(context)
+			} : {}
+		}, null, 2));
+		else {
+			console.log(chalk.yellow(context.requestedOrgId ? authRequiredMessage(context) : "Not logged in"));
+			if (!context.requestedOrgId) console.log("Run: runtype auth login");
+		}
+		return;
+	}
+	if (!isTTY(options) || options.json) {
+		try {
+			const user = await getAuthenticatedUser();
+			const billingInfo = await getBillingInfo(credentials.apiKey, credentials.apiUrl);
+			console.log(JSON.stringify({
+				userId: user.userId,
+				orgId: user.orgId,
+				apiUrl: credentials.apiUrl || getApiUrl(),
+				credentialSource: context.credentialSource,
+				accountSource: context.accountSource,
+				projectLink: context.projectLink?.path ?? null,
+				billing: billingInfo
+			}, null, 2));
+		} catch (error) {
+			const message = error instanceof Error ? error.message : "Unknown error";
+			console.error(JSON.stringify({
+				status: "error",
+				error: message
+			}, null, 2));
+			process.exit(1);
+		}
+		return;
+	}
+	await renderTask("Fetching user information...", async () => {
+		const user = await getAuthenticatedUser();
+		const billingInfo = await getBillingInfo(credentials.apiKey, credentials.apiUrl);
+		const fields = [
+			{
+				label: "User ID",
+				value: user.userId
+			},
+			{
+				label: "Organization",
+				value: user.orgId || "Personal"
+			},
+			{
+				label: "API Key",
+				value: credentials.apiKey.substring(0, 10) + "..."
+			},
+			{
+				label: "API URL",
+				value: credentials.apiUrl || getApiUrl()
+			},
+			{
+				label: "Selected by",
+				value: context.credentialSource === "environment" ? "RUNTYPE_API_KEY" : describeAccountSource(context)
+			},
+			{
+				label: "Created",
+				value: credentials.createdAt
+			},
+			{
+				label: "Last Used",
+				value: credentials.lastUsed
+			}
+		];
+		if (billingInfo) {
+			const plan = billingInfo.planName || billingInfo.plan;
+			if (plan) fields.push({
+				label: "Plan",
+				value: plan,
+				color: "green"
+			});
+			const usage = billingInfo.usage;
+			if (usage) {
+				const used = usage.executionsToday ?? usage.executionsThisMonth;
+				const value = usage.executionsThisMonthAvailable === false || typeof used !== "number" ? "unavailable" : used.toLocaleString();
+				fields.push({
+					label: "Executions today",
+					value
+				});
+			}
+		}
+		return {
+			message: "Current User",
+			result: React.createElement(EntityCard, { fields })
+		};
+	});
+});
+export { authCommand, loginCommand };
+