@squadrules/mcp 4.8.6

package/dist/cli/commands/export.js

@@ -0,0 +1,109 @@
+import { handleApiError, isBrowserDisabled } from '../auth-error.js';
+import { writeJson, writeMarkdown, writeStderr } from '../output.js';
+import { resolveSkillZipOutputPath, writeExportedSkillZipToFile } from '../skill-zip-local-write.js';
+import { createClientFromProgram } from '../client-factory.js';
+function appendRepeatable(value, previous) {
+    return [...(previous ?? []), value];
+}
+/**
+ * Build the same selection union as MCP/HTTP from CLI flags. Mutually exclusive with the
+ * positional `<uri>`; passing more (or fewer) than one selection mode is rejected here so the
+ * server returns a clean message instead of a Zod parse error.
+ */
+export function buildExportInput(uri, options) {
+    const format = (options.format ?? 'markdown').trim();
+    const trimmedUri = typeof uri === 'string' ? uri.trim() : '';
+    const hasUri = trimmedUri.length > 0;
+    const hasAdapters = (options.adapters?.length ?? 0) > 0;
+    const hasAll = options.allAdapters === true;
+    const modes = (hasUri ? 1 : 0) + (hasAdapters ? 1 : 0) + (hasAll ? 1 : 0);
+    if (modes === 0) {
+        throw new Error('Export requires a selection: <uri> positional, --adapters <uri-or-slug> (repeatable), or --all-adapters --space-name <name>.');
+    }
+    if (modes > 1) {
+        throw new Error('Choose exactly one selection mode: <uri> positional, --adapters, or --all-adapters. They cannot be combined.');
+    }
+    if (hasAll) {
+        const sn = options.spaceName?.trim() ?? '';
+        if (sn.length === 0) {
+            throw new Error('--all-adapters requires --space-name <name>.');
+        }
+    }
+    else if (options.spaceName !== undefined) {
+        throw new Error('--space-name is only valid with --all-adapters.');
+    }
+    const baseFormat = format;
+    if (hasUri) {
+        return { uri: trimmedUri, format: baseFormat, include_reward: true };
+    }
+    if (hasAdapters) {
+        return { adapters: options.adapters, format: baseFormat, include_reward: true };
+    }
+    return {
+        all_adapters: true,
+        space_name: options.spaceName.trim(),
+        format: baseFormat,
+        include_reward: true
+    };
+}
+export function exportCommand(program) {
+    program
+        .command('export')
+        .description('Export a KAIROS adapter (flat markdown, skill zip/tree, training JSONL, or source)')
+        .argument('[uri]', 'KAIROS adapter or layer URI (single-selection mode)')
+        .option('--adapters <uri-or-slug>', 'Adapter URI or slug (repeat the flag to select multiple)', appendRepeatable)
+        .option('--all-adapters', 'Export every adapter in --space-name')
+        .option('--space-name <name>', 'Space name (human label, not raw id) — required with --all-adapters')
+        .option('--format <format>', 'markdown (flat single-file adapter Markdown), skill_zip, skill_tree, source, trace_jsonl, reward_jsonl, sft_jsonl, preference_jsonl', 'markdown')
+        .option('--output <mode>', 'text to print raw exported content, json to print full response', 'text')
+        .option('--zip-out <file>', 'when format is skill_zip and --output text, write downloaded ZIP bytes to this path')
+        .option('--json-only', 'for skill_zip, print JSON response and do not follow download_ref')
+        .option('--no-download', 'for skill_zip, do not follow download_ref (alias for --json-only)')
+        .action(async (uri, options) => {
+        try {
+            const input = buildExportInput(uri, options);
+            const client = createClientFromProgram(program);
+            const response = await client.export(input);
+            if (options.output === 'json' || options.jsonOnly || options.noDownload) {
+                writeJson(response);
+                return;
+            }
+            if (response.format === 'skill_zip' && response.download_ref?.url) {
+                const downloaded = await client.downloadExportRef(response.download_ref.url);
+                const outputPath = resolveSkillZipOutputPath(options.zipOut, {
+                    ...(downloaded.filename !== undefined
+                        ? { downloadBasename: downloaded.filename }
+                        : {}),
+                    ...(response.download_ref.filename !== undefined
+                        ? { refBasename: response.download_ref.filename }
+                        : {})
+                });
+                writeExportedSkillZipToFile(outputPath, downloaded.data);
+                return;
+            }
+            if (response.format === 'skill_zip' &&
+                response.content_encoding === 'base64' &&
+                (options.zipOut || response.content.length > 0)) {
+                const buf = Buffer.from(response.content, 'base64');
+                const outputPath = resolveSkillZipOutputPath(options.zipOut, {});
+                writeExportedSkillZipToFile(outputPath, buf);
+                return;
+            }
+            if (response.format === 'skill_zip' && response.content_encoding === 'base64') {
+                writeStderr('skill_zip returned inline binary data but no content was available; use --output json to inspect the response.');
+                process.exitCode = 1;
+                return;
+            }
+            if (response.format === 'skill_zip') {
+                writeStderr('skill_zip response did not include download_ref or inline content; use --output json to inspect the response.');
+                process.exitCode = 1;
+                return;
+            }
+            writeMarkdown(response.content);
+        }
+        catch (error) {
+            handleApiError(error, !isBrowserDisabled());
+        }
+    });
+}
+//# sourceMappingURL=export.js.map

package/dist/cli/commands/export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.js","sourceRoot":"","sources":["../../../src/cli/commands/export.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AACrG,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAa/D,SAAS,gBAAgB,CAAC,KAAa,EAAE,QAAmB;IACxD,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAuB,EAAE,OAAyB;IAC/E,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,UAAU,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,KAAK,IAAI,CAAC;IAE5C,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACX,8HAA8H,CACjI,CAAC;IACN,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACX,8GAA8G,CACjH,CAAC;IACN,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC3C,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACpE,CAAC;IACL,CAAC;SAAM,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,UAAU,GAAG,MAA+B,CAAC;IAEnD,IAAI,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QACd,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAS,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IACrF,CAAC;IACD,OAAO;QACH,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,OAAO,CAAC,SAAU,CAAC,IAAI,EAAE;QACrC,MAAM,EAAE,UAAU;QAClB,cAAc,EAAE,IAAI;KACvB,CAAC;AACN,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC1C,OAAO;SACF,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,oFAAoF,CAAC;SACjG,QAAQ,CAAC,OAAO,EAAE,qDAAqD,CAAC;SACxE,MAAM,CACH,0BAA0B,EAC1B,0DAA0D,EAC1D,gBAAgB,CACnB;SACA,MAAM,CAAC,gBAAgB,EAAE,sCAAsC,CAAC;SAChE,MAAM,CAAC,qBAAqB,EAAE,qEAAqE,CAAC;SACpG,MAAM,CACH,mBAAmB,EACnB,qIAAqI,EACrI,UAAU,CACb;SACA,MAAM,CAAC,iBAAiB,EAAE,iEAAiE,EAAE,MAAM,CAAC;SACpG,MAAM,CACH,kBAAkB,EAClB,qFAAqF,CACxF;SACA,MAAM,CAAC,aAAa,EAAE,mEAAmE,CAAC;SAC1F,MAAM,CAAC,eAAe,EAAE,mEAAmE,CAAC;SAC5F,MAAM,CACH,KAAK,EACD,GAAuB,EACvB,OAAyB,EAC3B,EAAE;QACA,IAAI,CAAC;YACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBACtE,SAAS,CAAC,QAAQ,CAAC,CAAC;gBACpB,OAAO;YACX,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,IAAI,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC;gBAChE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;gBAC7E,MAAM,UAAU,GAAG,yBAAyB,CAAC,OAAO,CAAC,MAAM,EAAE;oBACzD,GAAG,CAAC,UAAU,CAAC,QAAQ,KAAK,SAAS;wBACjC,CAAC,CAAC,EAAE,gBAAgB,EAAE,UAAU,CAAC,QAAQ,EAAE;wBAC3C,CAAC,CAAC,EAAE,CAAC;oBACT,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,KAAK,SAAS;wBAC5C,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,YAAY,CAAC,QAAQ,EAAE;wBACjD,CAAC,CAAC,EAAE,CAAC;iBACZ,CAAC,CAAC;gBACH,2BAA2B,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;gBACzD,OAAO;YACX,CAAC;YACD,IACI,QAAQ,CAAC,MAAM,KAAK,WAAW;gBAC/B,QAAQ,CAAC,gBAAgB,KAAK,QAAQ;gBACtC,CAAC,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,EACjD,CAAC;gBACC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACpD,MAAM,UAAU,GAAG,yBAAyB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBACjE,2BAA2B,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;gBAC7C,OAAO;YACX,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,IAAI,QAAQ,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;gBAC5E,WAAW,CACP,gHAAgH,CACnH,CAAC;gBACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACrB,OAAO;YACX,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,WAAW,CACP,+GAA+G,CAClH,CAAC;gBACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACrB,OAAO;YACX,CAAC;YACD,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,cAAc,CAAC,KAAK,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAChD,CAAC;IACL,CAAC,CACJ,CAAC;AACV,CAAC"}

package/dist/cli/commands/login.d.ts

@@ -0,0 +1,16 @@
+/**
+ * kairos login — obtain and store a Bearer token (--token or browser + PKCE).
+ */
+import { Command } from 'commander';
+/** Resolve current API base URL (same order as docs: env after preAction sync, then config file, then default). Exported for logout. */
+export declare function getBaseUrl(): string;
+/** Check if token is valid (GET /api/me). Used by login to skip relogin and by ApiClient. */
+export declare function isTokenValid(baseUrl: string, token: string): Promise<boolean>;
+export interface LoginWithBrowserOptions {
+    /** If true, only print auth URL to stdout; do not open browser. */
+    noBrowser?: boolean;
+}
+/** Run browser PKCE login and store token. Exported for 401+--open retry from ApiClient. */
+export declare function loginWithBrowser(baseUrl: string, options?: LoginWithBrowserOptions): Promise<boolean>;
+export declare function loginCommand(program: Command): void;
+//# sourceMappingURL=login.d.ts.map

package/dist/cli/commands/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/login.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA6BpC,wIAAwI;AACxI,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED,6FAA6F;AAC7F,wBAAsB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMnF;AAiBD,MAAM,WAAW,uBAAuB;IACpC,mEAAmE;IACnE,SAAS,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,4FAA4F;AAC5F,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC,CA4I3G;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA8BnD"}

package/dist/cli/commands/login.js

@@ -0,0 +1,226 @@
+/**
+ * kairos login — obtain and store a Bearer token (--token or browser + PKCE).
+ */
+import { createServer } from 'http';
+import { createHash, randomBytes } from 'crypto';
+import { getCliApiUrlDefault } from '../config.js';
+function escapeHtml(s) {
+    return s
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;');
+}
+import { openBrowser } from '../auth-error.js';
+import { readConfig, writeConfig, normalizeApiUrl } from '../config-file.js';
+import { getToken, isKeyringAvailable } from '../keyring.js';
+import { fetchOAuthProtectedResourceMetadata, KAIROS_CLI_CLIENT_ID } from '../oauth-refresh.js';
+import { writeError, writeStdout, writeStderr } from '../output.js';
+/** Describe where the current token is stored (no path). Used for "Already authenticated. Token …" message. */
+async function getTokenStorageHint(baseUrl, token) {
+    const normalized = normalizeApiUrl(baseUrl);
+    if (isKeyringAvailable()) {
+        const fromKeyring = await getToken(normalized);
+        if (fromKeyring === token)
+            return 'Token stored in keychain.';
+    }
+    return 'Token in config file.';
+}
+/** Resolve current API base URL (same order as docs: env after preAction sync, then config file, then default). Exported for logout. */
+export function getBaseUrl() {
+    return getCliApiUrlDefault().replace(/\/$/, '');
+}
+/** Check if token is valid (GET /api/me). Used by login to skip relogin and by ApiClient. */
+export async function isTokenValid(baseUrl, token) {
+    // codeql[js/file-access-to-http]: CLI uses configured API base URL (env or saved config) for Kairos requests by design.
+    const res = await fetch(`${baseUrl}/api/me`, {
+        headers: { Authorization: `Bearer ${token}` },
+    });
+    return res.ok;
+}
+async function loginWithToken(baseUrl, token) {
+    // codeql[js/file-access-to-http]: CLI uses configured API base URL (env or saved config) for Kairos requests by design.
+    const res = await fetch(`${baseUrl}/api/me`, {
+        headers: { Authorization: `Bearer ${token}` },
+    });
+    if (!res.ok) {
+        const body = await res.json().catch(() => ({}));
+        writeError(body.message || `HTTP ${res.status}: token invalid or expired`);
+        return false;
+    }
+    await writeConfig({ apiUrl: baseUrl, bearerToken: token, refreshToken: null });
+    writeStdout('Token validated and stored.');
+    return true;
+}
+/** Run browser PKCE login and store token. Exported for 401+--open retry from ApiClient. */
+export async function loginWithBrowser(baseUrl, options) {
+    // codeql[js/file-access-to-http]: CLI uses configured API base URL (env or saved config) for Kairos requests by design.
+    const endpoints = await fetchOAuthProtectedResourceMetadata(baseUrl);
+    if (!endpoints) {
+        const wellKnownUrl = `${baseUrl.replace(/\/$/, '')}/.well-known/oauth-protected-resource`;
+        writeError(`Server did not return auth metadata (GET ${wellKnownUrl}). Is auth enabled?`);
+        return false;
+    }
+    const { authEndpoint, tokenEndpoint } = endpoints;
+    const clientId = KAIROS_CLI_CLIENT_ID;
+    const codeVerifier = randomBytes(32).toString('base64url');
+    const codeChallenge = createHash('sha256').update(codeVerifier).digest('base64url').replace(/=/g, '');
+    const state = randomBytes(16).toString('base64url');
+    // Request-bound token in callback path to avoid shared-link attacks: only this login attempt accepts this URL
+    const callbackPathToken = randomBytes(16).toString('base64url');
+    return new Promise((resolve) => {
+        // Bind to an open port, then send that redirect_uri to Keycloak (best practice). Tests can pin port via KAIROS_LOGIN_CALLBACK_PORT.
+        const callbackPortEnv = process.env['KAIROS_LOGIN_CALLBACK_PORT'];
+        const requestedPort = callbackPortEnv ? parseInt(callbackPortEnv, 10) : 0;
+        const noBrowser = !!options?.noBrowser;
+        let listenPort = 0;
+        const server = createServer(async (req, res) => {
+            const url = new URL(req.url ?? '/', `http://localhost`);
+            const expectedPath = `/callback/${callbackPathToken}`;
+            if (url.pathname !== expectedPath) {
+                res.writeHead(404).end();
+                return;
+            }
+            const errorParam = url.searchParams.get('error');
+            if (errorParam) {
+                const desc = url.searchParams.get('error_description') || errorParam;
+                res.writeHead(200, { 'Content-Type': 'text/html' }).end(`<!DOCTYPE html><html><body><p>Login failed: ${escapeHtml(desc)}</p><p>Try again or run <code>kairos login</code> from the terminal.</p></body></html>`);
+                writeError(`Login failed: ${desc}`);
+                server.close();
+                resolve(false);
+                return;
+            }
+            const code = url.searchParams.get('code');
+            const stateParam = url.searchParams.get('state');
+            if (stateParam !== state || !code) {
+                res.writeHead(400, { 'Content-Type': 'text/plain' }).end('Invalid callback (missing code or state).');
+                server.close();
+                resolve(false);
+                return;
+            }
+            res.writeHead(200, { 'Content-Type': 'text/html' }).end('<!DOCTYPE html><html><body><p>Login successful. You can close this tab.</p></body></html>');
+            server.close();
+            try {
+                const redirectUri = `http://localhost:${listenPort}${expectedPath}`;
+                const tokenAc = new AbortController();
+                const tokenTimeout = setTimeout(() => tokenAc.abort(), 30_000);
+                let tokenRes;
+                try {
+                    tokenRes = await fetch(tokenEndpoint, {
+                        method: 'POST',
+                        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                        body: new URLSearchParams({
+                            grant_type: 'authorization_code',
+                            code,
+                            redirect_uri: redirectUri,
+                            client_id: clientId,
+                            code_verifier: codeVerifier,
+                        }),
+                        signal: tokenAc.signal,
+                    });
+                }
+                finally {
+                    clearTimeout(tokenTimeout);
+                }
+                if (!tokenRes.ok) {
+                    const text = await tokenRes.text();
+                    writeError(`Token exchange failed: ${tokenRes.status} ${text}`);
+                    resolve(false);
+                    return;
+                }
+                const bodyText = await tokenRes.text();
+                const tokens = JSON.parse(bodyText);
+                if (!tokens.access_token) {
+                    writeError('No access_token in response.');
+                    resolve(false);
+                    return;
+                }
+                const refreshTok = typeof tokens.refresh_token === 'string' && tokens.refresh_token.length > 0
+                    ? tokens.refresh_token
+                    : null;
+                await writeConfig({
+                    apiUrl: baseUrl,
+                    bearerToken: tokens.access_token,
+                    refreshToken: refreshTok,
+                });
+                writeStdout('Login successful. Token stored.');
+                resolve(true);
+            }
+            catch (e) {
+                if (e instanceof DOMException && e.name === 'AbortError') {
+                    writeError('Token exchange timed out after 30 seconds. Check your network connection and try again.');
+                }
+                else {
+                    writeError(e instanceof Error ? e.message : String(e));
+                }
+                resolve(false);
+            }
+        });
+        server.on('error', (err) => {
+            if (err.code === 'EADDRINUSE') {
+                writeError(`Port ${requestedPort} in use or inaccessible. Set KAIROS_LOGIN_CALLBACK_PORT to another port.`);
+            }
+            else {
+                writeError(err.message || String(err));
+            }
+            resolve(false);
+        });
+        server.listen(requestedPort, '127.0.0.1', () => {
+            listenPort = server.address().port;
+            const redirectUri = `http://localhost:${listenPort}/callback/${callbackPathToken}`;
+            const authUrl = new URL(authEndpoint);
+            authUrl.searchParams.set('response_type', 'code');
+            authUrl.searchParams.set('client_id', clientId);
+            authUrl.searchParams.set('redirect_uri', redirectUri);
+            authUrl.searchParams.set('scope', 'openid profile email');
+            authUrl.searchParams.set('state', state);
+            authUrl.searchParams.set('code_challenge', codeChallenge);
+            authUrl.searchParams.set('code_challenge_method', 'S256');
+            authUrl.searchParams.set('prompt', 'login');
+            const authUrlStr = authUrl.toString();
+            if (noBrowser) {
+                writeStdout(authUrlStr);
+                writeStderr(authUrlStr); // also stderr so tests see it when stdout is pipe-buffered
+            }
+            else {
+                openBrowser(authUrlStr);
+                writeStdout('[i] Log in to KAIROS in the browser.');
+                writeStdout(`[i] If the browser did not open, open this link:\n${authUrlStr}`);
+                writeStdout('[i] Awaiting authentication in the browser.');
+            }
+        });
+    });
+}
+export function loginCommand(program) {
+    program
+        .command('login')
+        .description('Store a Bearer token (use --token or browser). Other commands auto-login when needed; login kept for testing.')
+        .option('-t, --token <token>', 'Use this token (validated with GET /api/me)')
+        .option('--no-browser', 'Only print login URL to stdout; do not open a browser')
+        .action(async (opts) => {
+        try {
+            const baseUrl = getBaseUrl();
+            if (opts.token) {
+                const ok = await loginWithToken(baseUrl, opts.token);
+                process.exit(ok ? 0 : 1);
+                return;
+            }
+            const config = await readConfig(baseUrl);
+            if (config.bearerToken && (await isTokenValid(baseUrl, config.bearerToken))) {
+                const storage = await getTokenStorageHint(baseUrl, config.bearerToken);
+                writeStdout(`Already authenticated. ${storage}`);
+                process.exit(0);
+                return;
+            }
+            // --no-browser can be on program or login command; preAction sets KAIROS_NO_BROWSER when on program
+            const noBrowser = opts.browser === false || process.env['KAIROS_NO_BROWSER'] === '1';
+            const ok = await loginWithBrowser(baseUrl, noBrowser ? { noBrowser: true } : undefined);
+            process.exit(ok ? 0 : 1);
+        }
+        catch (error) {
+            writeError(error instanceof Error ? error.message : String(error));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=login.js.map

package/dist/cli/commands/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/cli/commands/login.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD,SAAS,UAAU,CAAC,CAAS;IACzB,OAAO,CAAC;SACH,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,mCAAmC,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChG,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEpE,+GAA+G;AAC/G,KAAK,UAAU,mBAAmB,CAAC,OAAe,EAAE,KAAa;IAC7D,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,kBAAkB,EAAE,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,WAAW,KAAK,KAAK;YAAE,OAAO,2BAA2B,CAAC;IAClE,CAAC;IACD,OAAO,uBAAuB,CAAC;AACnC,CAAC;AAED,wIAAwI;AACxI,MAAM,UAAU,UAAU;IACtB,OAAO,mBAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAe,EAAE,KAAa;IAC7D,wHAAwH;IACxH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,SAAS,EAAE;QACzC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;KAChD,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,EAAE,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,KAAa;IACxD,wHAAwH;IACxH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,SAAS,EAAE;QACzC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;KAChD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACV,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAyB,CAAC;QACxE,UAAU,CAAC,IAAI,CAAC,OAAO,IAAI,QAAQ,GAAG,CAAC,MAAM,4BAA4B,CAAC,CAAC;QAC3E,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,WAAW,CAAC,6BAA6B,CAAC,CAAC;IAC3C,OAAO,IAAI,CAAC;AAChB,CAAC;AAOD,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAe,EAAE,OAAiC;IACrF,wHAAwH;IACxH,MAAM,SAAS,GAAG,MAAM,mCAAmC,CAAC,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,SAAS,EAAE,CAAC;QACb,MAAM,YAAY,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,uCAAuC,CAAC;QAC1F,UAAU,CAAC,4CAA4C,YAAY,qBAAqB,CAAC,CAAC;QAC1F,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,SAAS,CAAC;IAClD,MAAM,QAAQ,GAAG,oBAAoB,CAAC;IAEtC,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACtG,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,8GAA8G;IAC9G,MAAM,iBAAiB,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEhE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,oIAAoI;QACpI,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QAClE,MAAM,aAAa,GAAG,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC;QACvC,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YACxD,MAAM,YAAY,GAAG,aAAa,iBAAiB,EAAE,CAAC;YACtD,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;gBAChC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBACzB,OAAO;YACX,CAAC;YACD,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,UAAU,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,UAAU,CAAC;gBACrE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CACnD,+CAA+C,UAAU,CAAC,IAAI,CAAC,wFAAwF,CAC1J,CAAC;gBACF,UAAU,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;gBACpC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,CAAC;gBACf,OAAO;YACX,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,UAAU,KAAK,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;gBAChC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;gBACtG,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,CAAC;gBACf,OAAO;YACX,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CACnD,2FAA2F,CAC9F,CAAC;YACF,MAAM,CAAC,KAAK,EAAE,CAAC;YAEf,IAAI,CAAC;gBACD,MAAM,WAAW,GAAG,oBAAoB,UAAU,GAAG,YAAY,EAAE,CAAC;gBACpE,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;gBACtC,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;gBAC/D,IAAI,QAAkB,CAAC;gBACvB,IAAI,CAAC;oBACD,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;wBAClC,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;wBAChE,IAAI,EAAE,IAAI,eAAe,CAAC;4BACtB,UAAU,EAAE,oBAAoB;4BAChC,IAAI;4BACJ,YAAY,EAAE,WAAW;4BACzB,SAAS,EAAE,QAAQ;4BACnB,aAAa,EAAE,YAAY;yBAC9B,CAAC;wBACF,MAAM,EAAE,OAAO,CAAC,MAAM;qBACzB,CAAC,CAAC;gBACP,CAAC;wBAAS,CAAC;oBACP,YAAY,CAAC,YAAY,CAAC,CAAC;gBAC/B,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACf,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACnC,UAAU,CAAC,0BAA0B,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;oBAChE,OAAO,CAAC,KAAK,CAAC,CAAC;oBACf,OAAO;gBACX,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAsD,CAAC;gBACzF,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;oBACvB,UAAU,CAAC,8BAA8B,CAAC,CAAC;oBAC3C,OAAO,CAAC,KAAK,CAAC,CAAC;oBACf,OAAO;gBACX,CAAC;gBACD,MAAM,UAAU,GACZ,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;oBACvE,CAAC,CAAC,MAAM,CAAC,aAAa;oBACtB,CAAC,CAAC,IAAI,CAAC;gBACf,MAAM,WAAW,CAAC;oBACd,MAAM,EAAE,OAAO;oBACf,WAAW,EAAE,MAAM,CAAC,YAAY;oBAChC,YAAY,EAAE,UAAU;iBAC3B,CAAC,CAAC;gBACH,WAAW,CAAC,iCAAiC,CAAC,CAAC;gBAC/C,OAAO,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACT,IAAI,CAAC,YAAY,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBACvD,UAAU,CAAC,yFAAyF,CAAC,CAAC;gBAC1G,CAAC;qBAAM,CAAC;oBACJ,UAAU,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3D,CAAC;gBACD,OAAO,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YAC9C,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC5B,UAAU,CAAC,QAAQ,aAAa,0EAA0E,CAAC,CAAC;YAChH,CAAC;iBAAM,CAAC;gBACJ,UAAU,CAAC,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,EAAE,GAAG,EAAE;YAC3C,UAAU,GAAI,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;YACzD,MAAM,WAAW,GAAG,oBAAoB,UAAU,aAAa,iBAAiB,EAAE,CAAC;YACnF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;YACtC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAClD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAChD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YACtD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;YAC1D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACzC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;YAC1D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;YAC1D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtC,IAAI,SAAS,EAAE,CAAC;gBACZ,WAAW,CAAC,UAAU,CAAC,CAAC;gBACxB,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,2DAA2D;YACxF,CAAC;iBAAM,CAAC;gBACJ,WAAW,CAAC,UAAU,CAAC,CAAC;gBACxB,WAAW,CAAC,sCAAsC,CAAC,CAAC;gBACpD,WAAW,CAAC,qDAAqD,UAAU,EAAE,CAAC,CAAC;gBAC/E,WAAW,CAAC,6CAA6C,CAAC,CAAC;YAC/D,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAgB;IACzC,OAAO;SACF,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,+GAA+G,CAAC;SAC5H,MAAM,CAAC,qBAAqB,EAAE,6CAA6C,CAAC;SAC5E,MAAM,CAAC,cAAc,EAAE,uDAAuD,CAAC;SAC/E,MAAM,CAAC,KAAK,EAAE,IAA2C,EAAE,EAAE;QAC1D,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrD,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACzB,OAAO;YACX,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;gBAC1E,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;gBACvE,WAAW,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;gBACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO;YACX,CAAC;YACD,oGAAoG;YACpG,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,GAAG,CAAC;YACrF,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACxF,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,UAAU,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACL,CAAC,CAAC,CAAC;AACX,CAAC"}

package/dist/cli/commands/logout.d.ts

@@ -0,0 +1,6 @@
+/**
+ * kairos logout — clear stored Bearer token for the current environment (by API URL).
+ */
+import { Command } from 'commander';
+export declare function logoutCommand(program: Command): void;
+//# sourceMappingURL=logout.d.ts.map

package/dist/cli/commands/logout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/logout.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CASpD"}

package/dist/cli/commands/logout.js

@@ -0,0 +1,17 @@
+/**
+ * kairos logout — clear stored Bearer token for the current environment (by API URL).
+ */
+import { writeConfig } from '../config-file.js';
+import { getBaseUrl } from './login.js';
+import { writeStdout } from '../output.js';
+export function logoutCommand(program) {
+    program
+        .command('logout')
+        .description('Clear stored access and refresh credentials for the current --url / env')
+        .action(async () => {
+        const baseUrl = getBaseUrl();
+        await writeConfig({ apiUrl: baseUrl, bearerToken: null });
+        writeStdout('Credentials cleared from config.');
+    });
+}
+//# sourceMappingURL=logout.js.map

package/dist/cli/commands/logout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../../src/cli/commands/logout.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC1C,OAAO;SACF,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,yEAAyE,CAAC;SACtF,MAAM,CAAC,KAAK,IAAI,EAAE;QACf,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAC7B,MAAM,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,WAAW,CAAC,kCAAkC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACX,CAAC"}

package/dist/cli/commands/search.d.ts

@@ -0,0 +1,6 @@
+/**
+ * activate command
+ */
+import { Command } from 'commander';
+export declare function activateCommand(program: Command): void;
+//# sourceMappingURL=search.d.ts.map

package/dist/cli/commands/search.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/search.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAetD"}

package/dist/cli/commands/search.js

@@ -0,0 +1,25 @@
+/**
+ * activate command
+ */
+import { handleApiError, isBrowserDisabled } from '../auth-error.js';
+import { writeJson } from '../output.js';
+import { formatNextCallBlock } from '../format-next-call.js';
+import { createClientFromProgram } from '../client-factory.js';
+export function activateCommand(program) {
+    program
+        .command('activate')
+        .description('Activate the best matching KAIROS adapter for a query')
+        .argument('<query...>', 'Search query (multiple words allowed)')
+        .action(async (query) => {
+        try {
+            const client = createClientFromProgram(program);
+            const response = await client.activate(query.join(' '));
+            const nextCall = formatNextCallBlock(response);
+            writeJson(nextCall ? { ...response, cli_next_call: nextCall } : response);
+        }
+        catch (error) {
+            handleApiError(error, !isBrowserDisabled());
+        }
+    });
+}
+//# sourceMappingURL=search.js.map

package/dist/cli/commands/search.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"search.js","sourceRoot":"","sources":["../../../src/cli/commands/search.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC5C,OAAO;SACF,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,uDAAuD,CAAC;SACpE,QAAQ,CAAC,YAAY,EAAE,uCAAuC,CAAC;SAC/D,MAAM,CAAC,KAAK,EAAE,KAAe,EAAE,EAAE;QAC9B,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YAC/C,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,cAAc,CAAC,KAAK,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAChD,CAAC;IACL,CAAC,CAAC,CAAC;AACX,CAAC"}

package/dist/cli/commands/serve.d.ts

@@ -0,0 +1,18 @@
+/**
+ * kairos serve — run the KAIROS MCP server (same bootstrap as `node dist/bootstrap.js`).
+ * Transport: `--transport` overrides `TRANSPORT_TYPE`; default for this command is stdio.
+ * Main HTTP listener: `--server-port` wins over `SERVER_PORT` (same resolution as server config).
+ * Other CLI commands do not read `--transport` or `--server-port` unless those env vars are set in the shell.
+ */
+import type { Command } from 'commander';
+export type ServeTransport = 'stdio' | 'http';
+/**
+ * Resolve main HTTP listen port for `kairos serve`: CLI --server-port > SERVER_PORT > unset (inherit in child).
+ */
+export declare function resolveServeServerPort(cliServerPort: string | undefined): number | undefined;
+/**
+ * Resolve MCP transport for `kairos serve`: CLI --transport > TRANSPORT_TYPE > defaultStdio.
+ */
+export declare function resolveServeTransport(cliTransport: string | undefined, defaultStdio?: boolean): ServeTransport;
+export declare function serveCommand(program: Command): void;
+//# sourceMappingURL=serve.d.ts.map

package/dist/cli/commands/serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/serve.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOzC,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,MAAM,CAAC;AAU9C;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAU5F;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,EAAE,YAAY,UAAO,GAAG,cAAc,CAa3G;AAgCD,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAoGnD"}

package/dist/cli/commands/serve.js

@@ -0,0 +1,165 @@
+/**
+ * kairos serve — run the KAIROS MCP server (same bootstrap as `node dist/bootstrap.js`).
+ * Transport: `--transport` overrides `TRANSPORT_TYPE`; default for this command is stdio.
+ * Main HTTP listener: `--server-port` wins over `SERVER_PORT` (same resolution as server config).
+ * Other CLI commands do not read `--transport` or `--server-port` unless those env vars are set in the shell.
+ */
+import { spawn } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { config as dotenvConfig } from 'dotenv';
+import { writeStderr } from '../output.js';
+import { writeConfig } from '../config-file.js';
+const VALID = new Set(['stdio', 'http']);
+function parseListenPort(raw, label) {
+    const n = parseInt(raw.trim(), 10);
+    if (!Number.isFinite(n) || n < 1 || n > 65535) {
+        throw new Error(`Invalid ${label} port "${raw}" (use 1–65535)`);
+    }
+    return n;
+}
+/**
+ * Resolve main HTTP listen port for `kairos serve`: CLI --server-port > SERVER_PORT > unset (inherit in child).
+ */
+export function resolveServeServerPort(cliServerPort) {
+    const trimmed = cliServerPort?.trim();
+    if (trimmed) {
+        return parseListenPort(trimmed, '--server-port');
+    }
+    const fromEnv = process.env['SERVER_PORT']?.trim();
+    if (fromEnv) {
+        return parseListenPort(fromEnv, 'SERVER_PORT');
+    }
+    return undefined;
+}
+/**
+ * Resolve MCP transport for `kairos serve`: CLI --transport > TRANSPORT_TYPE > defaultStdio.
+ */
+export function resolveServeTransport(cliTransport, defaultStdio = true) {
+    const trimmed = cliTransport?.trim().toLowerCase();
+    if (trimmed) {
+        if (!VALID.has(trimmed)) {
+            throw new Error(`Invalid --transport "${cliTransport}" (use stdio or http)`);
+        }
+        return trimmed;
+    }
+    const fromEnv = process.env['TRANSPORT_TYPE']?.trim().toLowerCase();
+    if (fromEnv && VALID.has(fromEnv)) {
+        return fromEnv;
+    }
+    return defaultStdio ? 'stdio' : 'http';
+}
+function findPackageRoot() {
+    let dir = path.dirname(fileURLToPath(import.meta.url));
+    for (let i = 0; i < 10; i++) {
+        const pkgJson = path.join(dir, 'package.json');
+        if (existsSync(pkgJson)) {
+            try {
+                const pkg = JSON.parse(readFileSync(pkgJson, 'utf8'));
+                if (pkg.name === '@jakub-plichcinski/kairos-mcp') {
+                    return dir;
+                }
+            }
+            catch {
+                // ignore
+            }
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..', '..');
+}
+function bootstrapEntry(root) {
+    const distBootstrap = path.join(root, 'dist', 'bootstrap.js');
+    if (existsSync(distBootstrap)) {
+        return [distBootstrap];
+    }
+    const srcBootstrap = path.join(root, 'src', 'bootstrap.ts');
+    return ['--loader', 'ts-node/esm', srcBootstrap];
+}
+export function serveCommand(program) {
+    program
+        .command('serve')
+        .description('Run the KAIROS MCP server (HTTP or stdio). Same stack as Docker Compose / dev:start when using HTTP. Root --url does not set the listen address; use SERVER_PORT / --server-port.')
+        .option('--env-file <path>', 'Path to dotenv file', '.env')
+        .option('--metrics-port <n>', 'Metrics listen port (sets METRICS_PORT)')
+        .option('--transport <mode>', 'Transport: stdio or http (overrides TRANSPORT_TYPE for this process)')
+        .option('--server-port <port>', 'Main HTTP listener port (sets SERVER_PORT for this process; with --server-port, updates CLI defaultUrl)')
+        .action(async (options) => {
+        const envPath = options.envFile ?? '.env';
+        if (existsSync(envPath)) {
+            dotenvConfig({ path: envPath });
+        }
+        if (options.metricsPort !== undefined && options.metricsPort !== '') {
+            const n = parseInt(options.metricsPort, 10);
+            if (!Number.isFinite(n) || n < 1) {
+                writeStderr(`Invalid --metrics-port: ${options.metricsPort}\n`);
+                process.exit(1);
+            }
+            process.env['METRICS_PORT'] = String(n);
+        }
+        const envBefore = process.env['TRANSPORT_TYPE'];
+        let transport;
+        try {
+            transport = resolveServeTransport(options.transport, true);
+        }
+        catch (e) {
+            program.error(e instanceof Error ? e.message : String(e));
+            return;
+        }
+        let listenPort;
+        try {
+            listenPort = resolveServeServerPort(options.serverPort);
+        }
+        catch (e) {
+            program.error(e instanceof Error ? e.message : String(e));
+            return;
+        }
+        const source = options.transport?.trim()
+            ? 'cli'
+            : envBefore?.trim()
+                ? 'env'
+                : 'default';
+        if (options.serverPort?.trim()) {
+            try {
+                await writeConfig({ apiUrl: `http://localhost:${listenPort}` });
+            }
+            catch (e) {
+                program.error(e instanceof Error
+                    ? `kairos serve: could not update CLI config defaultUrl: ${e.message}`
+                    : String(e));
+                return;
+            }
+        }
+        const root = findPackageRoot();
+        const args = bootstrapEntry(root);
+        const env = {
+            ...process.env,
+            TRANSPORT_TYPE: transport,
+            KAIROS_CLI_SERVE: '1',
+            KAIROS_CLI_TRANSPORT_SOURCE: source
+        };
+        if (listenPort !== undefined) {
+            env['SERVER_PORT'] = String(listenPort);
+        }
+        const child = spawn(process.execPath, args, {
+            cwd: root,
+            env,
+            stdio: 'inherit'
+        });
+        child.on('error', (err) => {
+            process.stderr.write(`kairos serve: failed to start server: ${err.message}\n`);
+            process.exitCode = 1;
+        });
+        child.on('exit', (code, signal) => {
+            if (signal) {
+                process.kill(process.pid, signal);
+            }
+            process.exit(code ?? 0);
+        });
+    });
+}
+//# sourceMappingURL=serve.js.map