@toloka-platform/sdk 0.2.0 → 0.3.0

package/src/cli/keycloak.ts

@@ -0,0 +1,189 @@
+import { TolokaCliError } from "./cli-error";
+
+const KEYCLOAK_REQUEST_TIMEOUT_MS = 15_000;
+
+export type IdentityProviderChoice = {
+  readonly alias: string;
+  readonly name: string;
+  readonly variant: "outline" | "ghost";
+  readonly hint?: string;
+};
+
+const GOOGLE: IdentityProviderChoice = { alias: "google", name: "Google", variant: "outline", hint: "google" };
+const MICROSOFT: IdentityProviderChoice = { alias: "ms", name: "Microsoft", variant: "outline", hint: "ms" };
+const EMAIL: IdentityProviderChoice = { alias: "email", name: "Email", variant: "ghost" };
+const TESTING_USERS: IdentityProviderChoice = {
+  alias: "testing-users",
+  name: "Testing",
+  variant: "ghost",
+  hint: "testing-users",
+};
+
+export type BrowserLoginProvider = {
+  readonly authHost: string;
+  readonly realm: string;
+  readonly clientId: string;
+  readonly identityProviders: readonly IdentityProviderChoice[];
+  readonly issuer: string;
+  readonly authorizationEndpoint: string;
+  readonly tokenEndpoint: string;
+  readonly logoutEndpoint: string;
+};
+
+const keycloakProvider = (
+  authHost: string,
+  realm: string,
+  clientId: string,
+  identityProviders: readonly IdentityProviderChoice[],
+): BrowserLoginProvider => {
+  const issuer = `https://${authHost}/realms/${realm}`;
+  return {
+    authHost,
+    realm,
+    clientId,
+    identityProviders,
+    issuer,
+    authorizationEndpoint: `${issuer}/protocol/openid-connect/auth`,
+    tokenEndpoint: `${issuer}/protocol/openid-connect/token`,
+    logoutEndpoint: `${issuer}/protocol/openid-connect/logout`,
+  };
+};
+
+const PRODUCTION_PROVIDER = keycloakProvider("auth.toloka.ai", "toloka", "platform-cli-production", [
+  GOOGLE,
+  MICROSOFT,
+]);
+const TESTING_PROVIDER = keycloakProvider("auth.toloka-test.ai", "toloka", "platform-cli-testing", [
+  GOOGLE,
+  MICROSOFT,
+  EMAIL,
+  TESTING_USERS,
+]);
+
+export const KNOWN_BROWSER_LOGIN_PROVIDERS: readonly BrowserLoginProvider[] = [
+  PRODUCTION_PROVIDER,
+  TESTING_PROVIDER,
+];
+
+export const browserLoginProviderFor = (baseUrl: string): BrowserLoginProvider | undefined => {
+  let url: URL;
+  try {
+    url = new URL(baseUrl);
+  } catch {
+    return undefined;
+  }
+  if (url.protocol !== "https:") return undefined;
+  if (url.host === "platform.toloka.ai") return PRODUCTION_PROVIDER;
+  if (url.host.endsWith(".platform.toloka-test.ai")) return TESTING_PROVIDER;
+  return undefined;
+};
+
+export type TokenResponse = {
+  readonly access_token: string;
+  readonly expires_in: number;
+  readonly refresh_token: string;
+  readonly refresh_expires_in: number;
+  readonly scope: string;
+};
+
+const readField = (payload: unknown, key: string): unknown =>
+  typeof payload === "object" && payload !== null ? Reflect.get(payload, key) : undefined;
+
+const parseJson = (text: string): unknown => {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return undefined;
+  }
+};
+
+const parseTokenResponse = (text: string): TokenResponse | undefined => {
+  const payload = parseJson(text);
+  const accessToken = readField(payload, "access_token");
+  const expiresIn = readField(payload, "expires_in");
+  const refreshToken = readField(payload, "refresh_token");
+  const refreshExpiresIn = readField(payload, "refresh_expires_in") ?? 0;
+  const scope = readField(payload, "scope") ?? "";
+  if (typeof accessToken !== "string" || accessToken.length === 0) return undefined;
+  if (typeof expiresIn !== "number" || !Number.isFinite(expiresIn)) return undefined;
+  if (typeof refreshToken !== "string" || refreshToken.length === 0) return undefined;
+  if (typeof refreshExpiresIn !== "number" || !Number.isFinite(refreshExpiresIn)) return undefined;
+  if (typeof scope !== "string") return undefined;
+  return {
+    access_token: accessToken,
+    expires_in: expiresIn,
+    refresh_token: refreshToken,
+    refresh_expires_in: refreshExpiresIn,
+    scope,
+  };
+};
+
+export class TokenRequestError extends Error {
+  readonly status: number;
+  readonly oauthError: string | undefined;
+
+  constructor(status: number, body: string) {
+    const payload = parseJson(body);
+    const error = readField(payload, "error");
+    const description = readField(payload, "error_description");
+    const detail =
+      typeof description === "string" && description.length > 0
+        ? typeof error === "string"
+          ? `${error}: ${description}`
+          : description
+        : typeof error === "string"
+          ? error
+          : body.slice(0, 200) || "empty response";
+    super(`The login service answered ${status}: ${detail}`);
+    this.name = "TokenRequestError";
+    this.status = status;
+    this.oauthError = typeof error === "string" ? error : undefined;
+  }
+}
+
+export const requestTokens = async (
+  provider: BrowserLoginProvider,
+  form: Readonly<Record<string, string>>,
+  fetchImplementation: typeof globalThis.fetch = globalThis.fetch,
+): Promise<TokenResponse> => {
+  const response = await fetchImplementation(provider.tokenEndpoint, {
+    method: "POST",
+    headers: {
+      Accept: "application/json",
+      "Content-Type": "application/x-www-form-urlencoded",
+    },
+    body: new URLSearchParams({ client_id: provider.clientId, ...form }).toString(),
+    signal: AbortSignal.timeout(KEYCLOAK_REQUEST_TIMEOUT_MS),
+  });
+  const text = await response.text();
+  if (!response.ok) throw new TokenRequestError(response.status, text);
+  const tokens = parseTokenResponse(text);
+  if (tokens === undefined) {
+    throw new TolokaCliError(
+      `${provider.issuer} returned a token response the CLI does not understand.`,
+      { hint: { description: "Retry; if it keeps failing, report it with toloka report." } },
+    );
+  }
+  return tokens;
+};
+
+export const endKeycloakSession = async (
+  provider: BrowserLoginProvider,
+  refreshToken: string,
+  fetchImplementation: typeof globalThis.fetch = globalThis.fetch,
+): Promise<boolean> => {
+  try {
+    const response = await fetchImplementation(provider.logoutEndpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        client_id: provider.clientId,
+        refresh_token: refreshToken,
+      }).toString(),
+      signal: AbortSignal.timeout(KEYCLOAK_REQUEST_TIMEOUT_MS),
+    });
+    return response.ok;
+  } catch {
+    return false;
+  }
+};

package/src/cli/models.ts

@@ -8,10 +8,9 @@ import { pipeline } from "node:stream/promises";
 
 import type { BaseModel, BaseModelId, Model, ModelVersion, PotatoClient } from "../client";
 import { assertCli, REPORT_HINT, RETRY_OR_REPORT_HINT } from "./cli-error";
+import { formatTable, type TableIo as ModelIo, writeOutput } from "./table";
 
 type ModelApi = Pick<PotatoClient, "baseModels" | "models">;
-type ModelIo = { readonly stdout: (text: string) => void };
-type TableRow = readonly string[];
 
 const BASE_MODEL_IDS = [
   "qwen3-4b",
@@ -20,25 +19,6 @@ const BASE_MODEL_IDS = [
   "qwen3-235b",
 ] satisfies readonly BaseModelId[];
 
-const formatTable = (rows: readonly TableRow[]): string => {
-  const widths = rows.reduce<number[]>(
-    (current, row) => row.map((cell, index) => Math.max(current[index] ?? 0, cell.length)),
-    [],
-  );
-  return rows
-    .map((row) =>
-      row
-        .map((cell, index) => cell.padEnd(widths[index] ?? cell.length))
-        .join("  ")
-        .trimEnd(),
-    )
-    .join("\n");
-};
-
-const writeOutput = (io: ModelIo, json: boolean, value: unknown, formatted: string): void => {
-  io.stdout(json ? JSON.stringify(value, null, 2) : formatted);
-};
-
 const formatBaseModel = (model: BaseModel): string =>
   formatTable([
     ["ID", model.id],

package/src/cli/native-runtime.ts

@@ -0,0 +1,7 @@
+export const isNativeCli = (): boolean =>
+  Reflect.get(globalThis, "Bun")?.isStandaloneExecutable === true;
+
+export const bunSubprocessEnvironment = (
+  environment: NodeJS.ProcessEnv,
+  native = isNativeCli(),
+): NodeJS.ProcessEnv => (native ? { ...environment, BUN_BE_BUN: "1" } : environment);

package/src/cli/program.ts

@@ -4,7 +4,9 @@ import { commandNameFromArgv, createCliAnalytics } from "./analytics";
 import type { CliAnalytics, CliAnalyticsCommandOutcome } from "./analytics";
 import type { AutoUpdateHooks } from "./auto-update";
 import { maybeAutoUpdate } from "./auto-update";
+import type { BrowserLoginFlow } from "./browser-login";
 import { CHECK_RESULT_FILE_ENV, type checkProject } from "./check";
+import { registerAudienceCommands } from "./commands/audience";
 import { registerAuthCommands } from "./commands/auth";
 import { registerConfigCommands } from "./commands/config";
 import { registerDatasetCommands } from "./commands/dataset";
@@ -91,6 +93,7 @@ export function createProgram(context: ProgramContext): CreatedProgram {
   registerAuthCommands(program, host);
   registerProjectCommands(program, host);
   registerDeliveryOrderCommands(program, host);
+  registerAudienceCommands(program, host);
   registerSourceCommands(program, host);
   registerSecretCommands(program, host);
   registerModelCommands(program, host);
@@ -194,6 +197,7 @@ export async function runTolokaCli(
   analytics?: CliAnalytics,
   runChecks?: typeof checkProject,
   autoUpdate?: AutoUpdateHooks,
+  browserLogin?: BrowserLoginFlow,
 ): Promise<number> {
   const { environment, warnings } = normalizeEnvironment(rawEnvironment);
   for (const warning of warnings) io.stderr(warning);
@@ -214,6 +218,7 @@ export async function runTolokaCli(
     io,
     ...(activeAnalytics === undefined ? {} : { analytics: activeAnalytics }),
     ...(injectedClient === undefined ? {} : { injectedClient }),
+    ...(browserLogin === undefined ? {} : { browserLogin }),
     ...(runChecks === undefined ? {} : { runChecks }),
   };
   const { program, exitCode } = createProgram(baseContext);

package/src/cli/sign-in-page.ts

@@ -0,0 +1,153 @@
+import type { IdentityProviderChoice } from "./keycloak";
+
+const escapeHtml = (text: string): string =>
+  text.replace(
+    /[&<>"']/gu,
+    (character) =>
+      ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[character] ??
+      character,
+  );
+
+const STYLE = `
+:root {
+  color-scheme: light dark;
+  --background: oklch(0.967 0.001 286.375 / 60%);
+  --card: oklch(1 0 0);
+  --foreground: oklch(0.141 0.005 285.823);
+  --primary: oklch(0.21 0.006 285.885);
+  --muted: oklch(0.967 0.001 286.375);
+  --muted-foreground: oklch(0.552 0.016 285.938);
+  --border: oklch(0.92 0.004 286.32);
+  --ring: oklch(0.141 0.005 285.823 / 10%);
+}
+@media (prefers-color-scheme: dark) {
+  :root {
+    --background: oklch(0.141 0.005 285.823);
+    --card: oklch(0.21 0.006 285.885);
+    --foreground: oklch(0.985 0 0);
+    --primary: oklch(0.92 0.004 286.32);
+    --muted: oklch(0.274 0.006 286.033);
+    --muted-foreground: oklch(0.705 0.015 286.067);
+    --border: oklch(1 0 0 / 10%);
+    --ring: oklch(1 0 0 / 10%);
+  }
+}
+* { box-sizing: border-box; }
+body {
+  margin: 0;
+  min-height: 100vh;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  background: var(--background);
+  color: var(--foreground);
+  font-family: Antarctica, SuisseIntl, -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif;
+  font-size: 14px;
+  line-height: 1.45;
+  -webkit-font-smoothing: antialiased;
+}
+.stage {
+  position: relative;
+  top: -2rem;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 1rem;
+  padding: 0 0.5rem;
+  animation: enter 0.5s cubic-bezier(0.22, 1, 0.36, 1) both;
+}
+@keyframes enter {
+  from { opacity: 0; transform: translateY(100px); }
+  to { opacity: 1; transform: none; }
+}
+.logo { height: 3rem; width: 9rem; color: var(--primary); }
+.card {
+  width: 100%;
+  max-width: 380px;
+  display: flex;
+  flex-direction: column;
+  gap: 2rem;
+  padding-top: 1rem;
+  overflow: hidden;
+  border-radius: 0.75rem;
+  background: var(--card);
+  box-shadow: 0 0 0 1px var(--ring);
+}
+.header { padding: 0 1rem; text-align: center; display: grid; gap: 0.25rem; }
+.title { margin: 0; font-size: 2.25rem; line-height: 1.2; font-weight: 500; }
+.title span, .lead span { display: block; }
+.lead { margin: 0; font-size: 1rem; color: var(--primary); }
+.content { margin-top: 1.5rem; padding: 0 1rem; display: flex; flex-direction: column; gap: 1rem; }
+.button {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  gap: 0.75rem;
+  height: 2.75rem;
+  width: 100%;
+  padding: 0 0.875rem;
+  border: 1px solid var(--border);
+  border-radius: 9999px;
+  background: var(--card);
+  color: var(--foreground);
+  font: inherit;
+  font-weight: 600;
+  text-decoration: none;
+  white-space: nowrap;
+  transition: background-color 0.15s ease;
+}
+.button:hover, .button:focus-visible { background: var(--muted); outline: none; }
+.button svg { width: 1.5rem; height: 1.5rem; flex: none; }
+.button.ghost { border-color: transparent; background: transparent; color: var(--muted-foreground); height: 2.5rem; }
+.button.ghost:hover, .button.ghost:focus-visible { background: var(--muted); color: var(--foreground); }
+.footer {
+  border-top: 1px solid var(--border);
+  background: color-mix(in oklch, var(--muted) 50%, transparent);
+  padding: 1rem;
+  text-align: center;
+  font-size: 0.8rem;
+  color: var(--muted-foreground);
+}
+.footer a { color: var(--primary); font-weight: 500; text-decoration: underline; text-underline-offset: 4px; }
+.footer div + div { margin-top: 0.5rem; }
+`;
+
+const TOLOKA_LOGO = `<svg class="logo" viewBox="0 0 99 32" fill="none" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="Toloka"><path d="M54.7053 8H42.8716V9.94458H47.6776V23.7003H49.9094V9.94458H54.7053V8Z" fill="currentColor"/><path d="M61.1436 13.8363C60.7103 13.335 60.1687 12.9471 59.5264 12.6725C58.8816 12.398 58.136 12.2619 57.2897 12.2619C56.4433 12.2619 55.7078 12.398 55.068 12.6725C54.4282 12.9471 53.8891 13.335 53.4559 13.8363C53.0226 14.3375 52.6927 14.937 52.4735 15.6347C52.2519 16.3325 52.1436 17.1159 52.1436 17.9849V18.272C52.1436 19.1335 52.2544 19.9169 52.4735 20.6222C52.6952 21.3274 53.0226 21.9295 53.4559 22.4282C53.8891 22.9269 54.4282 23.3123 55.068 23.5869C55.7078 23.8614 56.4483 23.9975 57.2897 23.9975C58.131 23.9975 58.8816 23.8614 59.5264 23.5869C60.1713 23.3123 60.7103 22.9269 61.1436 22.4282C61.5768 21.9295 61.9043 21.3274 62.1259 20.6222C62.3476 19.9169 62.4559 19.1335 62.4559 18.272V17.9849C62.4559 17.1159 62.3451 16.3325 62.1259 15.6347C61.9043 14.937 61.5768 14.3375 61.1436 13.8363ZM60.1813 18.3174C60.1813 18.9219 60.1259 19.466 60.0151 19.9471C59.9043 20.4282 59.733 20.8388 59.4962 21.1813C59.2619 21.5239 58.9597 21.7859 58.5944 21.9672C58.2267 22.1486 57.7909 22.2393 57.2871 22.2393C56.7834 22.2393 56.3551 22.1486 55.9899 21.9672C55.6221 21.7859 55.3224 21.5239 55.0881 21.1813C54.8539 20.8388 54.6801 20.4282 54.5692 19.9471C54.4584 19.466 54.403 18.9244 54.403 18.3174V17.932C54.403 17.335 54.4584 16.7934 54.5692 16.3148C54.6801 15.8337 54.8514 15.4257 55.0881 15.0856C55.3224 14.7481 55.6247 14.4861 55.9899 14.2997C56.3577 14.1159 56.7884 14.0227 57.2871 14.0227C57.7859 14.0227 58.2292 14.1159 58.5944 14.2997C58.9622 14.4861 59.2619 14.7456 59.4962 15.0856C59.7305 15.4232 59.9043 15.8337 60.0151 16.3148C60.1259 16.796 60.1813 17.335 60.1813 17.932V18.3174Z" fill="currentColor"/><path d="M66.3302 8H64.1841V23.7003H66.3302V8Z" fill="currentColor"/><path d="M77.0728 13.8363C76.6395 13.335 76.0979 12.9471 75.4556 12.6725C74.8108 12.398 74.0652 12.2619 73.2188 12.2619C72.3725 12.2619 71.637 12.398 70.9972 12.6725C70.3574 12.9471 69.8183 13.335 69.3851 13.8363C68.9518 14.3375 68.6219 14.937 68.4027 15.6347C68.1811 16.3325 68.0728 17.1159 68.0728 17.9849V18.272C68.0728 19.1335 68.1836 19.9169 68.4027 20.6222C68.6244 21.3274 68.9518 21.9295 69.3851 22.4282C69.8183 22.9269 70.3574 23.3123 70.9972 23.5869C71.637 23.8614 72.3775 23.9975 73.2188 23.9975C74.0602 23.9975 74.8108 23.8614 75.4556 23.5869C76.1005 23.3123 76.6395 22.9269 77.0728 22.4282C77.506 21.9295 77.8335 21.3274 78.0551 20.6222C78.2768 19.9169 78.3851 19.1335 78.3851 18.272V17.9849C78.3851 17.1159 78.2743 16.3325 78.0551 15.6347C77.8335 14.937 77.506 14.3375 77.0728 13.8363ZM76.1131 18.3174C76.1131 18.9219 76.0576 19.466 75.9468 19.9471C75.836 20.4282 75.6647 20.8388 75.4279 21.1813C75.1937 21.5239 74.8914 21.7859 74.5262 21.9672C74.1584 22.1486 73.7226 22.2393 73.2188 22.2393C72.7151 22.2393 72.2869 22.1486 71.9216 21.9672C71.5539 21.7859 71.2541 21.5239 71.0199 21.1813C70.7856 20.8388 70.6118 20.4282 70.501 19.9471C70.3901 19.466 70.3347 18.9244 70.3347 18.3174V17.932C70.3347 17.335 70.3901 16.7934 70.501 16.3148C70.6118 15.8337 70.7831 15.4257 71.0199 15.0856C71.2541 14.7481 71.5564 14.4861 71.9216 14.2997C72.2894 14.1159 72.7201 14.0227 73.2188 14.0227C73.7176 14.0227 74.1609 14.1159 74.5262 14.2997C74.8939 14.4861 75.1937 14.7456 75.4279 15.0856C75.6622 15.4232 75.836 15.8337 75.9468 16.3148C76.0576 16.796 76.1131 17.335 76.1131 17.932V18.3174Z" fill="currentColor"/><path d="M80.043 8V23.7003H82.1689V18.7305L86.4838 23.7003H89.2722L84.0379 17.7733L89.0052 12.5718H86.3881L82.1689 17.2141V8H80.043Z" fill="currentColor"/><path d="M29.267 8H-0.188965V9.94458H13.4307V23.7003H15.6649V9.94458H29.267V8Z" fill="currentColor"/><path d="M98.8563 22.9471C98.816 22.6952 98.7858 22.4282 98.7657 22.1461C98.7455 21.864 98.7329 21.5617 98.7279 21.2393C98.7254 20.9143 98.7228 20.5567 98.7228 20.1662L98.743 16.7481C98.743 16.2065 98.7002 15.7204 98.6145 15.2897C98.5289 14.8589 98.4029 14.476 98.2342 14.141C98.0679 13.806 97.8589 13.5189 97.6095 13.2821C97.3601 13.0428 97.073 12.8488 96.7505 12.6952C96.4256 12.5415 96.0654 12.4282 95.6674 12.3526C95.2694 12.2771 94.8387 12.2393 94.3752 12.2393C93.7128 12.2393 93.1158 12.3274 92.5818 12.5012C92.0478 12.675 91.5893 12.9219 91.2039 13.2443C90.8186 13.5642 90.5138 13.9572 90.2845 14.4181C90.0578 14.8816 89.9243 15.4005 89.8891 15.9773H92.0679C92.083 15.6347 92.1385 15.335 92.2392 15.0755C92.34 14.8161 92.4835 14.5995 92.6725 14.4282C92.8614 14.2569 93.0931 14.1284 93.3727 14.0378C93.6498 13.9496 93.9747 13.9043 94.345 13.9043C94.6926 13.9043 95.0075 13.9546 95.2845 14.0529C95.5616 14.1536 95.7984 14.3048 95.9898 14.5113C96.1813 14.7179 96.3299 14.9823 96.4332 15.3073C96.5364 15.6322 96.5868 16.0151 96.5868 16.4559V16.8211C95.549 16.8791 94.5994 16.9773 93.7405 17.1209C92.8689 17.267 92.1259 17.4836 91.5062 17.7758C90.8891 18.0655 90.408 18.4458 90.0553 18.9169C89.7027 19.3879 89.5264 19.9748 89.5264 20.6801V20.7431C89.5264 21.2619 89.6246 21.7229 89.8211 22.1259C90.0175 22.5289 90.2871 22.869 90.6271 23.1461C90.9697 23.4232 91.3727 23.6347 91.8362 23.7758C92.2997 23.9194 92.7808 23.9949 93.2971 23.9949C93.7102 23.9949 94.0931 23.9597 94.4483 23.8917C94.8034 23.8237 95.1259 23.7229 95.4181 23.5944C95.7102 23.466 95.9747 23.3073 96.209 23.1184C96.4432 22.9295 96.6448 22.7153 96.8186 22.4307C96.816 22.932 96.8538 23.3123 96.9521 23.6952H99.0024C98.9445 23.4458 98.8966 23.1939 98.8589 22.942L98.8563 22.9471ZM96.6397 19.2519C96.6397 19.5995 96.6044 19.9143 96.5364 20.1939C96.4684 20.4735 96.3702 20.7229 96.2442 20.942C96.1183 21.1612 95.9621 21.3526 95.7833 21.5164C95.6019 21.6801 95.4029 21.8161 95.1863 21.9219C94.9697 22.0277 94.7329 22.1058 94.481 22.1587C94.2266 22.209 93.9621 22.2368 93.6876 22.2368C93.3626 22.2368 93.0679 22.2015 92.806 22.1284C92.544 22.0579 92.3223 21.9496 92.1385 21.8111C91.9546 21.67 91.811 21.4962 91.7102 21.2871C91.6095 21.0781 91.5591 20.8388 91.5591 20.5642V20.5038C91.5591 20.1284 91.6674 19.8111 91.884 19.5541C92.1007 19.2972 92.4256 19.0907 92.8563 18.9345C93.2871 18.7783 93.8236 18.6574 94.4659 18.5768C95.0931 18.4962 95.8211 18.4357 96.6448 18.3954V19.2544L96.6397 19.2519Z" fill="currentColor"/></svg>`;
+
+const ICONS: Readonly<Record<string, string>> = {
+  google: `<svg viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg" aria-hidden="true"><path d="M30.0014 16.3109C30.0014 15.1598 29.9061 14.3198 29.6998 13.4487H16.2871V18.6442H24.1601C24.0014 19.9354 23.1442 21.8798 21.2394 23.1864L21.2127 23.3604L25.4536 26.58L25.7474 26.6087C28.4458 24.1665 30.0014 20.5731 30.0014 16.3109Z" fill="#4285F4"/><path d="M16.2863 29.9998C20.1434 29.9998 23.3814 28.7553 25.7466 26.6086L21.2386 23.1863C20.0323 24.0108 18.4132 24.5863 16.2863 24.5863C12.5086 24.5863 9.30225 22.1441 8.15929 18.7686L7.99176 18.7825L3.58208 22.127L3.52441 22.2841C5.87359 26.8574 10.699 29.9998 16.2863 29.9998Z" fill="#34A853"/><path d="M8.15964 18.769C7.85806 17.8979 7.68352 16.9645 7.68352 16.0001C7.68352 15.0356 7.85806 14.1023 8.14377 13.2312L8.13578 13.0456L3.67083 9.64746L3.52475 9.71556C2.55654 11.6134 2.00098 13.7445 2.00098 16.0001C2.00098 18.2556 2.55654 20.3867 3.52475 22.2845L8.15964 18.769Z" fill="#FBBC05"/><path d="M16.2864 7.4133C18.9689 7.4133 20.7784 8.54885 21.8102 9.4978L25.8419 5.64C23.3658 3.38445 20.1435 2 16.2864 2C10.699 2 5.8736 5.1422 3.52441 9.71549L8.14345 13.2311C9.30229 9.85555 12.5086 7.4133 16.2864 7.4133Z" fill="#EB4335"/></svg>`,
+  ms: `<svg viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg" aria-hidden="true"><rect x="17" y="17" width="10" height="10" fill="#FEBA08"/><rect x="5" y="17" width="10" height="10" fill="#05A6F0"/><rect x="17" y="5" width="10" height="10" fill="#80BC06"/><rect x="5" y="5" width="10" height="10" fill="#F25325"/></svg>`,
+  "testing-users": `<svg viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg" aria-hidden="true"><path fill="#FFCC4D" d="M22.845 13.625c-.21-1.907-.428-2.875-1.012-4.042 0 0 1.75-5.25.584-7.408-.394-.727-4.32.985-5.834 2.158 0 0-2.333-.582-4.083-.582s-4.083.582-4.083.582C6.902 3.16 2.977 1.448 2.583 2.175c-1.166 2.158.584 7.408.584 7.408-.584 1.167-.803 2.135-1.012 4.042-.23 2.09.228 3.757.428 4.125.228.418 1.381 1.764 2.917 2.916 2.333 1.75 5.833 2.334 7 2.334 1.166 0 4.666-.584 7-2.334 1.536-1.152 2.689-2.498 2.916-2.916.2-.368.66-2.034.429-4.125z"/><path fill="#664500" d="M18.6 12.382c-.035-.08-.874-1.924-2.6-1.924-1.725 0-2.565 1.845-2.6 1.924a.294.294 0 00.44.353c.008-.006.737-.527 2.16-.527 1.415 0 2.143.514 2.16.526a.29.29 0 00.44-.352zm-7 0c-.035-.08-.874-1.924-2.6-1.924-1.725 0-2.565 1.845-2.6 1.924a.291.291 0 00.44.353c.008-.006.736-.527 2.16-.527 1.415 0 2.143.514 2.16.526a.29.29 0 00.44-.352zm3.617 3.406a.299.299 0 01.348-.035.29.29 0 01.135.318c-.007.025-.668 2.554-3.2 2.554s-3.193-2.529-3.199-2.554a.292.292 0 01.489-.278s.586.499 2.71.499c2.126 0 2.71-.499 2.717-.504z"/></svg>`,
+  email: `<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" xmlns="http://www.w3.org/2000/svg" aria-hidden="true"><rect width="20" height="16" x="2" y="4" rx="2"/><path d="m22 7-8.97 5.7a1.94 1.94 0 0 1-2.06 0L2 7"/></svg>`,
+};
+
+const document = (title: string, body: string): string =>
+  `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escapeHtml(title)}</title><style>${STYLE}</style></head><body><main class="stage">${TOLOKA_LOGO}<section class="card" role="region" aria-labelledby="title">${body}</section></main></body></html>`;
+
+const button = (choice: IdentityProviderChoice, href: string): string =>
+  `<a class="button ${choice.variant}" href="${escapeHtml(href)}">${ICONS[choice.alias] ?? ""}Continue with ${escapeHtml(choice.name)}</a>`;
+
+const externalLink = (href: string, text: string): string =>
+  `<a href="${escapeHtml(href)}" target="_blank" rel="noopener noreferrer">${escapeHtml(text)}</a>`;
+
+export const signInPage = (
+  choices: readonly IdentityProviderChoice[],
+  authorizationUrlFor: (hint: string | undefined) => string,
+  registrationUrl?: string,
+): string => {
+  const buttons = choices.map((choice) => button(choice, authorizationUrlFor(choice.hint))).join("");
+  const registration =
+    registrationUrl === undefined
+      ? ""
+      : `<div>New to Toloka? ${externalLink(registrationUrl, "Create an account")}. By signing up, you agree to our ${externalLink("https://toloka.ai/legal/self-service-agreement", "User Agreement")}.</div>`;
+  return document(
+    "Sign in to Toloka",
+    `<header class="header"><h1 class="title" id="title"><span>Welcome</span><span>to Toloka Platform</span></h1><p class="lead"><span>Choose how to sign in.</span><span>The Toloka CLI is waiting in your terminal.</span></p></header><div class="content">${buttons}</div><footer class="footer">${registration}<div>You can close this tab once you are signed in.</div><div>Want to use an API key instead? Run <code>toloka login</code> and choose API key. ${externalLink("https://platform.toloka.ai/docs/integration/cli/", "Help")}</div></footer>`,
+  );
+};
+
+export const statusPage = (title: string, body: string): string =>
+  document(
+    title,
+    `<header class="header"><h1 class="title" id="title">${escapeHtml(title)}</h1><p class="lead">${escapeHtml(body)}</p></header><footer class="footer"><div>Toloka CLI</div></footer>`,
+  );

package/src/cli/skill.ts

@@ -1,9 +1,19 @@
 import { createHash } from "node:crypto";
-import { copyFile, mkdir, mkdtemp, readFile, realpath, rename, rm, stat } from "node:fs/promises";
+import {
+  copyFile,
+  mkdir,
+  mkdtemp,
+  readFile,
+  realpath,
+  rename,
+  rm,
+  stat,
+  writeFile,
+} from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { assertSafeDestination, entryStats, hasErrorCode } from "./file-system";
 import { formatCliError } from "./format-error";
-import { releaseChannelFor, SDK_PACKAGE_NAME, SDK_VERSION } from "./sdk-version";
+import { SDK_PACKAGE_NAME, SDK_VERSION } from "./sdk-version";
 import { assertCli, REINSTALL_HINT, TolokaCliError } from "./cli-error";
 
 export const SKILL_CATALOG_MANIFEST = "catalog.json";
@@ -16,9 +26,7 @@ const MAX_MANIFEST_BYTES = 1024 * 1024;
 const MAX_SKILL_ID_LENGTH = 64;
 const SKILL_ID_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u;
 const DIGEST_PATTERN = /^[a-f0-9]{64}$/u;
-const UPGRADE_HINT = `bun add --global ${SDK_PACKAGE_NAME}@${
-  releaseChannelFor(SDK_VERSION) ?? "latest"
-}`;
+const UPGRADE_HINT = "rerun the CLI installer to update";
 
 export type SkillDescriptor = {
   readonly id: string;
@@ -86,21 +94,15 @@ const parseDescriptor = (value: unknown, invalid: (detail: string) => string): S
     { hint: REINSTALL_HINT },
   );
   assertCli(isNonEmptyString(name), invalid(`skill ${id} needs a name.`), { hint: REINSTALL_HINT });
-  assertCli(
-    isNonEmptyString(description),
-    invalid(`skill ${id} needs a description.`),
-    { hint: REINSTALL_HINT },
-  );
-  assertCli(
-    isStringArray(tags),
-    invalid(`skill ${id} tags must be strings.`),
-    { hint: REINSTALL_HINT },
-  );
-  assertCli(
-    isNonEmptyString(version),
-    invalid(`skill ${id} needs a version.`),
-    { hint: REINSTALL_HINT },
-  );
+  assertCli(isNonEmptyString(description), invalid(`skill ${id} needs a description.`), {
+    hint: REINSTALL_HINT,
+  });
+  assertCli(isStringArray(tags), invalid(`skill ${id} tags must be strings.`), {
+    hint: REINSTALL_HINT,
+  });
+  assertCli(isNonEmptyString(version), invalid(`skill ${id} needs a version.`), {
+    hint: REINSTALL_HINT,
+  });
   assertCli(
     typeof digest === "string" && DIGEST_PATTERN.test(digest),
     invalid(`skill ${id} digest must be the sha256 hex digest of its files.`),
@@ -154,6 +156,9 @@ const findSkillCatalogRootAbove = async (directory: string): Promise<string | un
 export async function resolveBundledSkillCatalogRoot(
   runtimeEntry: string | undefined = process.argv[1],
 ): Promise<string> {
+  if (Reflect.get(globalThis, "Bun")?.isStandaloneExecutable === true) {
+    return join(dirname(process.argv[1]!), "skills");
+  }
   const entry = runtimeEntry === undefined ? undefined : await realpath(runtimeEntry);
   const runtimeRoot =
     entry === undefined ? undefined : await findSkillCatalogRootAbove(dirname(entry));
@@ -197,11 +202,9 @@ export async function loadSkillCatalog(catalogRoot: string): Promise<SkillCatalo
   const skills = manifest.skills.map((skill) => parseDescriptor(skill, invalid));
   const ids = new Set<string>();
   for (const skill of skills) {
-    assertCli(
-      !ids.has(skill.id),
-      invalid(`skill id ${skill.id} appears more than once.`),
-      { hint: REINSTALL_HINT },
-    );
+    assertCli(!ids.has(skill.id), invalid(`skill id ${skill.id} appears more than once.`), {
+      hint: REINSTALL_HINT,
+    });
     ids.add(skill.id);
   }
   return { root: catalogRoot, manifestPath, skills };
@@ -329,7 +332,12 @@ export async function installSkill({
     for (const path of skill.files) {
       const target = join(temporary, path);
       await mkdir(dirname(target), { recursive: true });
-      await copyFile(join(catalog.root, skill.id, path), target);
+      const source = join(catalog.root, skill.id, path);
+      if (Reflect.get(globalThis, "Bun")?.isStandaloneExecutable === true) {
+        await writeFile(target, await readFile(source));
+      } else {
+        await copyFile(source, target);
+      }
     }
     assertCli(
       (await computeSkillDigest(temporary, skill.files)) === skill.digest,

package/src/cli/style.ts

@@ -0,0 +1,37 @@
+export type Style = {
+  readonly bold: (text: string) => string;
+  readonly dim: (text: string) => string;
+  readonly green: (text: string) => string;
+  readonly cyan: (text: string) => string;
+};
+
+const ESC = String.fromCharCode(27);
+
+const paint =
+  (open: number, close: number) =>
+  (text: string): string =>
+    `${ESC}[${open}m${text}${ESC}[${close}m`;
+
+const identity = (text: string): string => text;
+
+export const ANSI_STYLE: Style = {
+  bold: paint(1, 22),
+  dim: paint(2, 22),
+  green: paint(32, 39),
+  cyan: paint(36, 39),
+};
+
+export const PLAIN_STYLE: Style = { bold: identity, dim: identity, green: identity, cyan: identity };
+
+export const styleFor = (
+  environment: Readonly<Record<string, string | undefined>>,
+  isTerminal: boolean,
+): Style => {
+  if (environment.FORCE_COLOR !== undefined) {
+    return environment.FORCE_COLOR === "0" ? PLAIN_STYLE : ANSI_STYLE;
+  }
+  if (!isTerminal || environment.NO_COLOR !== undefined || environment.TERM === "dumb") {
+    return PLAIN_STYLE;
+  }
+  return ANSI_STYLE;
+};

package/src/cli/table.ts

@@ -0,0 +1,21 @@
+export type TableRow = readonly string[];
+export type TableIo = { readonly stdout: (text: string) => void };
+
+export const formatTable = (rows: readonly TableRow[]): string => {
+  const widths = rows.reduce<number[]>(
+    (current, row) => row.map((cell, index) => Math.max(current[index] ?? 0, cell.length)),
+    [],
+  );
+  return rows
+    .map((row) =>
+      row
+        .map((cell, index) => cell.padEnd(widths[index] ?? cell.length))
+        .join("  ")
+        .trimEnd(),
+    )
+    .join("\n");
+};
+
+export const writeOutput = (io: TableIo, json: boolean, value: unknown, formatted: string): void => {
+  io.stdout(json ? JSON.stringify(value, null, 2) : formatted);
+};

package/src/cli/terminal-io.ts

@@ -1,8 +1,10 @@
+import select from "@inquirer/select";
 import { createInterface } from "node:readline/promises";
-import type { AuthPrompt } from "./auth";
+import type { AuthChoose, AuthPrompt } from "./auth";
 import type { CliIo } from "./context";
 import { pickPipeline } from "./runs";
 import { TolokaCliError } from "./cli-error";
+import { styleFor } from "./style";
 
 const stdinClosedError = () =>
   new TolokaCliError("Standard input closed before an API key was entered.", {
@@ -102,9 +104,14 @@ const promptFromTerminal: AuthPrompt = async (question, options = {}) => {
   }
 };
 
+const chooseFromTerminal: AuthChoose = (message, choices) => select({ message, choices });
+
 export const terminalIo = (): CliIo => ({
   stdout: (text) => console.log(text),
   stderr: (text) => console.error(text),
   readStdin: readStandardInput,
-  ...(process.stdin.isTTY ? { prompt: promptFromTerminal, select: pickPipeline } : {}),
+  style: styleFor(process.env, process.stdout.isTTY),
+  ...(process.stdin.isTTY
+    ? { prompt: promptFromTerminal, choose: chooseFromTerminal, select: pickPipeline }
+    : {}),
 });

package/src/cli/trainings.ts

@@ -14,6 +14,7 @@ import type {
 import type { BaseModelId, TrainingConfigurationInput } from "../../openapi/gen/models";
 import { assertCli, RETRY_OR_REPORT_HINT, TolokaCliError } from "./cli-error";
 import type { CliErrorHint } from "./cli-error";
+import { formatTable, type TableIo as TrainingIo, writeOutput } from "./table";
 
 const ESTIMATE_FILE_HINT: CliErrorHint = {
   description: "Regenerate it with toloka training cost <training> --json > <file>.",
@@ -49,28 +50,6 @@ type TrainingDraftApi = Pick<PotatoClient, "trainings" | "files" | "datasets">;
 type TrainingCostApi = Pick<PotatoClient, "trainings" | "waitFor">;
 type TrainingRunApi = Pick<PotatoClient, "trainings" | "waitFor">;
 const GISTING_PROMPT_MAX_BYTES = 256 * 1024;
-type TrainingIo = { readonly stdout: (text: string) => void };
-type TableRow = readonly string[];
-
-const formatTable = (rows: readonly TableRow[]): string => {
-  const widths = rows.reduce<number[]>(
-    (current, row) => row.map((cell, index) => Math.max(current[index] ?? 0, cell.length)),
-    [],
-  );
-  return rows
-    .map((row) =>
-      row
-        .map((cell, index) => cell.padEnd(widths[index] ?? cell.length))
-        .join("  ")
-        .trimEnd(),
-    )
-    .join("\n");
-};
-
-const writeOutput = (io: TrainingIo, json: boolean, value: unknown, formatted: string): void => {
-  io.stdout(json ? JSON.stringify(value, null, 2) : formatted);
-};
-
 const formatTraining = (training: Training): string =>
   formatTable([
     ["ID", training.id],