busa-cli 0.9.9 → 0.9.11

package/dist/{chunk-ZC4HCQAB.js → chunk-IO4ARUEI.js}

@@ -769,12 +769,16 @@ import { spawn } from "child_process";
 import { createHash as createHash4, randomBytes } from "crypto";
 import { createServer } from "http";
 import { createInterface } from "readline/promises";
+
+// ../../packages/busabase-contract/src/auth/device-authorization.ts
+var BUSABASE_CLI_CLIENT_ID = "busabase-cli";
+
+// src/login.ts
 import { DEFAULT_BASE_URL, normalizeBaseUrl } from "busabase-sdk";
-var CLI_CLIENT_ID = "busabase-cli";
 var CLI_CLIENT_PLATFORM = "cli";
 var OAUTH_TIMEOUT_MS = 5 * 60 * 1e3;
 var EXPIRES_AT_KEY = "BUSABASE_TOKEN_EXPIRES_AT";
-var SESSION_TOKEN_PREFIX = "bss_";
+var LEGACY_SESSION_TOKEN_PREFIX = "bss_";
 var AUTO_REFRESH_THRESHOLD_MS = 2 * 24 * 60 * 60 * 1e3;
 var DEFAULT_LOCAL_URL = "http://localhost:15419";
 var base64url = (buffer) => buffer.toString("base64url");
@@ -832,7 +836,7 @@ async function verifyAuth(baseUrl, token) {
   }
   return await res.json();
 }
-async function oauthLogin(baseUrl, useBrowser) {
+async function loopbackOauthLogin(baseUrl, useBrowser) {
   const codeVerifier = base64url(randomBytes(32));
   const codeChallenge = base64url(createHash4("sha256").update(codeVerifier).digest());
   const state = base64url(randomBytes(16));
@@ -887,7 +891,7 @@ async function oauthLogin(baseUrl, useBrowser) {
         const redirect = `http://127.0.0.1:${port}/callback`;
         const authorizeUrl = new URL(`${baseUrl}/api/oauth/authorize`);
         authorizeUrl.searchParams.set("response_type", "code");
-        authorizeUrl.searchParams.set("client_id", CLI_CLIENT_ID);
+        authorizeUrl.searchParams.set("client_id", BUSABASE_CLI_CLIENT_ID);
         authorizeUrl.searchParams.set("client_platform", CLI_CLIENT_PLATFORM);
         authorizeUrl.searchParams.set("code_challenge", codeChallenge);
         authorizeUrl.searchParams.set("code_challenge_method", "S256");
@@ -912,7 +916,7 @@ async function oauthLogin(baseUrl, useBrowser) {
     headers: { "content-type": "application/json" },
     body: JSON.stringify({
       grant_type: "authorization_code",
-      client_id: CLI_CLIENT_ID,
+      client_id: BUSABASE_CLI_CLIENT_ID,
       client_platform: CLI_CLIENT_PLATFORM,
       code,
       code_verifier: codeVerifier,
@@ -927,7 +931,110 @@ async function oauthLogin(baseUrl, useBrowser) {
   const payload = await tokenRes.json();
   const token = payload.apiKey ?? payload.token ?? payload.accessToken;
   if (!token) throw new Error("Token exchange returned no credential.");
-  return { token, expiresAt: payload.expiresAt ?? void 0 };
+  return payload.apiKey ? { token, apiKeyExpiresAt: payload.expiresAt ?? void 0 } : { token, expiresAt: payload.expiresAt ?? void 0 };
+}
+var delay = (durationMs) => new Promise((resolve) => setTimeout(resolve, durationMs));
+async function readDeviceResponse(response) {
+  return await response.json().catch(() => ({}));
+}
+async function deviceLogin(baseUrl, useBrowser) {
+  const origin = new URL(baseUrl).origin;
+  let codeResponse;
+  try {
+    codeResponse = await fetch(`${baseUrl}/api/auth/device/code`, {
+      method: "POST",
+      headers: { "content-type": "application/json", origin },
+      body: JSON.stringify({
+        client_id: BUSABASE_CLI_CLIENT_ID,
+        scope: "openid profile email"
+      })
+    });
+  } catch {
+    throw new Error(`Could not start device sign-in because ${baseUrl} could not be reached.`);
+  }
+  const code = await codeResponse.json().catch(() => ({}));
+  if (!codeResponse.ok) {
+    throw new Error(
+      `Could not start device sign-in (HTTP ${codeResponse.status})${code.error_description ? `: ${code.error_description}` : "."}`
+    );
+  }
+  if (!code.device_code || !code.user_code || !code.verification_uri) {
+    throw new Error("Device sign-in returned an incomplete authorization response.");
+  }
+  const verificationUrl = code.verification_uri_complete ?? code.verification_uri;
+  say("");
+  say("Authorize Busabase CLI in any browser:");
+  say(`  ${code.verification_uri}`);
+  say(`  Code: ${code.user_code}`);
+  say("");
+  if (useBrowser) openBrowser(verificationUrl);
+  say("Waiting for authorization\u2026");
+  const expiresInSeconds = Math.max(1, code.expires_in ?? 15 * 60);
+  const deadline = Date.now() + expiresInSeconds * 1e3;
+  let intervalSeconds = Math.max(1, code.interval ?? 5);
+  let consecutiveNetworkFailures = 0;
+  while (Date.now() < deadline) {
+    await delay(intervalSeconds * 1e3);
+    let tokenResponse;
+    try {
+      tokenResponse = await fetch(`${baseUrl}/api/auth/device/token`, {
+        method: "POST",
+        headers: { "content-type": "application/json", origin },
+        body: JSON.stringify({
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+          device_code: code.device_code,
+          client_id: BUSABASE_CLI_CLIENT_ID
+        })
+      });
+      consecutiveNetworkFailures = 0;
+    } catch {
+      consecutiveNetworkFailures += 1;
+      if (consecutiveNetworkFailures >= 3) {
+        throw new Error(
+          "Device sign-in lost its network connection. Check connectivity and run `busabase-cli login` again."
+        );
+      }
+      continue;
+    }
+    const payload = await readDeviceResponse(tokenResponse);
+    if (tokenResponse.ok && payload.access_token) {
+      const finalizeResponse = await fetch(`${baseUrl}/api/v1/device/finalize`, {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${payload.access_token}`,
+          "content-type": "application/json"
+        },
+        body: JSON.stringify({ deviceCode: code.device_code })
+      });
+      const finalized = await finalizeResponse.json().catch(() => ({}));
+      if (!finalizeResponse.ok || !finalized.apiKey || finalized.credentialType !== "api_key") {
+        const finalizeError = typeof finalized.error === "string" ? finalized.error : finalized.error?.message ?? finalized.message;
+        throw new Error(
+          `Device sign-in could not finalize the selected API key${finalizeError ? `: ${finalizeError}` : ` (HTTP ${finalizeResponse.status})`}.`
+        );
+      }
+      return {
+        token: finalized.apiKey,
+        apiKeyExpiresAt: finalized.expiresAt ?? void 0
+      };
+    }
+    switch (payload.error) {
+      case "authorization_pending":
+        continue;
+      case "slow_down":
+        intervalSeconds += 5;
+        continue;
+      case "access_denied":
+        throw new Error("Device sign-in was denied. No credential was saved.");
+      case "expired_token":
+        throw new Error("The device code expired. Run `busabase-cli login` to request a new one.");
+      default:
+        throw new Error(
+          `Device sign-in failed${payload.error_description ? `: ${payload.error_description}` : ` (HTTP ${tokenResponse.status})`}.`
+        );
+    }
+  }
+  throw new Error("The device code expired. Run `busabase-cli login` to request a new one.");
 }
 async function refreshToken(baseUrl, token) {
   const res = await fetch(`${baseUrl}/api/oauth/refresh`, {
@@ -972,12 +1079,12 @@ async function chooseTarget() {
   say("How should this CLI connect?");
   say("  1. Local/Desktop on this computer \u2014 no account, no login");
   say("     Use when you run `busabase server` or the Busabase Desktop app locally.");
-  say("  2. Busabase Cloud \u2014 browser sign-in (recommended)");
-  say("     Best for humans: opens the browser and saves a refreshable CLI session.");
+  say("  2. Busabase Cloud \u2014 device sign-in (recommended)");
+  say("     Works locally, over SSH, and in containers; approve from any browser.");
   say("  3. Busabase Cloud \u2014 paste an API key");
   say("     Best for CI, servers, or agents where a browser is not available.");
-  say("  4. Self-hosted Busabase \u2014 browser sign-in");
-  say("     Use your team's Busabase URL when it supports OAuth login.");
+  say("  4. Self-hosted Busabase \u2014 device sign-in");
+  say("     Use your team's Busabase URL when it supports device authorization.");
   say("  5. Self-hosted Busabase \u2014 paste an API key");
   say("     Use your team's Busabase URL with a long-lived key for automation.");
   const choice = await ask("Choose 1-5 [2]: ");
@@ -994,11 +1101,11 @@ async function chooseTarget() {
     case "3":
       return { baseUrl: cloud, method: "api-key" };
     case "4":
-      return { baseUrl: await askSelfHostedUrl(), method: "oauth" };
+      return { baseUrl: await askSelfHostedUrl(), method: "device" };
     case "5":
       return { baseUrl: await askSelfHostedUrl(), method: "api-key" };
     default:
-      return { baseUrl: cloud, method: "oauth" };
+      return { baseUrl: cloud, method: "device" };
   }
 }
 async function runLogin(options) {
@@ -1007,14 +1114,16 @@ async function runLogin(options) {
   let method;
   if (apiKey) {
     method = "api-key";
+  } else if (options.deviceCode) {
+    method = "device";
   } else if (options.oauth) {
-    method = "oauth";
+    method = "loopback-oauth";
   } else if (isInteractive()) {
     const target = await chooseTarget();
     baseUrl = normalizeBaseUrl(target.baseUrl);
     method = target.method;
   } else {
-    method = isLocalHost(baseUrl) ? "none" : "oauth";
+    method = isLocalHost(baseUrl) ? "none" : "device";
   }
   if (method === "none") {
     if (await probeAuthRequired(baseUrl)) {
@@ -1034,10 +1143,16 @@ async function runLogin(options) {
   }
   let token;
   let expiresAt;
-  if (method === "oauth") {
-    const result = await oauthLogin(baseUrl, options.browser);
+  let apiKeyExpiresAt;
+  if (method === "device") {
+    const result = await deviceLogin(baseUrl, options.browser);
+    token = result.token;
+    apiKeyExpiresAt = result.apiKeyExpiresAt;
+  } else if (method === "loopback-oauth") {
+    const result = await loopbackOauthLogin(baseUrl, options.browser);
     token = result.token;
     expiresAt = result.expiresAt;
+    apiKeyExpiresAt = result.apiKeyExpiresAt;
   } else {
     if (!apiKey) {
       say("Create a key in the dashboard \u2192 Settings \u2192 API Keys (shown once).");
@@ -1060,10 +1175,13 @@ async function runLogin(options) {
   say(`\u2713 Signed in and saved to ${dotEnvPath()}`);
   return {
     status: "signed in",
-    method,
+    method: method === "loopback-oauth" ? "oauth" : method,
+    credentialType: method === "device" ? "api_key" : expiresAt ? "session" : "api_key",
     user: verify.user?.email ?? verify.user?.name ?? verify.user?.id ?? "(unknown)",
     space: spaceId ?? "(server default)",
-    expiresAt: expiresAt ?? "(no expiry \u2014 API key)",
+    createdSpace: String(Boolean(verify.createdSpace)),
+    bootstrapRequired: String(Boolean(verify.bootstrapRequired)),
+    expiresAt: expiresAt ?? apiKeyExpiresAt ?? "(no expiry \u2014 API key)",
     baseUrl,
     config: dotEnvPath()
   };
@@ -1072,10 +1190,12 @@ async function runRefresh(options) {
   const baseUrl = normalizeBaseUrl(options.baseUrl);
   const token = options.apiKey;
   if (!token) throw new Error("Not signed in \u2014 run `busabase-cli login` first.");
-  if (!token.startsWith(SESSION_TOKEN_PREFIX)) {
+  const file = loadDotEnvFile();
+  const isSavedExpiringSession = file.BUSABASE_API_KEY === token && Boolean(file.BUSABASE_TOKEN_EXPIRES_AT);
+  if (!token.startsWith(LEGACY_SESSION_TOKEN_PREFIX) && !isSavedExpiringSession) {
     return {
       status: "nothing to refresh",
-      detail: "This credential is an API key, which doesn't expire. Only OAuth sessions refresh."
+      detail: "This credential is an API key and cannot be refreshed. Only OAuth sessions refresh."
     };
   }
   let refreshed;
@@ -1101,13 +1221,14 @@ async function runRefresh(options) {
   };
 }
 async function maybeAutoRefresh(baseUrl, apiKey) {
-  if (!apiKey?.startsWith(SESSION_TOKEN_PREFIX)) return;
+  if (!apiKey) return;
   const file = loadDotEnvFile();
   if (file.BUSABASE_API_KEY !== apiKey) return;
   const expiresRaw = file[EXPIRES_AT_KEY];
   if (!expiresRaw) return;
   const expiresAt = Date.parse(expiresRaw);
   if (Number.isNaN(expiresAt)) return;
+  if (expiresAt <= Date.now()) return;
   if (expiresAt - Date.now() > AUTO_REFRESH_THRESHOLD_MS) return;
   try {
     const refreshed = await refreshToken(normalizeBaseUrl(baseUrl), apiKey);
@@ -1118,11 +1239,25 @@ async function maybeAutoRefresh(baseUrl, apiKey) {
   } catch {
   }
 }
+function assertCredentialNotExpired(apiKey) {
+  if (!apiKey) return;
+  const file = loadDotEnvFile();
+  if (file.BUSABASE_API_KEY !== apiKey) return;
+  const expiresRaw = file[EXPIRES_AT_KEY];
+  if (!expiresRaw) return;
+  const expiresAt = Date.parse(expiresRaw);
+  if (!Number.isNaN(expiresAt) && expiresAt <= Date.now()) {
+    throw new Error(
+      "Your saved device login has expired. Run `busabase-cli login --device-code` to authorize this CLI again."
+    );
+  }
+}
 async function runLogout(options) {
   const baseUrl = normalizeBaseUrl(options.baseUrl);
   const token = options.apiKey;
   let revoked = "no session to revoke";
-  if (token?.startsWith("bss_")) {
+  const file = loadDotEnvFile();
+  if (token && (token.startsWith(LEGACY_SESSION_TOKEN_PREFIX) || file.BUSABASE_API_KEY === token && file[EXPIRES_AT_KEY])) {
     try {
       const res = await fetch(`${baseUrl}/api/oauth/revoke`, {
         method: "POST",
@@ -1598,7 +1733,7 @@ var nodeSchema = z6.lazy(
       visibility: z6.enum(["private", "workspace", "public"]).optional(),
       version: z6.string().optional(),
       assetId: z6.string().optional()
-    }).default({}),
+    }).catchall(z6.unknown()).default({}),
     position: z6.number(),
     createdAt: z6.string(),
     updatedAt: z6.string(),
@@ -1630,6 +1765,10 @@ var isDescendantInputSchema = z6.object({
 var isDescendantOutputSchema = z6.object({
   isDescendant: z6.boolean()
 });
+var updateNodeMetadataInputSchema = z6.object({
+  nodeId: z6.string(),
+  metadata: z6.record(z6.string(), z6.unknown())
+});
 var searchNodesByNameInputSchema = z6.object({
   query: z6.string().min(1),
   limit: z6.number().int().min(1).max(50).optional().default(20)
@@ -1818,6 +1957,7 @@ var auditActionSchema = z6.enum([
   "asset.metadata_updated",
   "asset.text_written",
   "asset.text_marked_none",
+  "node.metadata_updated",
   "node.purged"
 ]);
 var auditEventSchema = z6.object({
@@ -2007,7 +2147,11 @@ var authInfoSchema = z6.object({
    * space-scoped — when this has more than one entry, callers should confirm the
    * intended space and target it explicitly via the `x-busabase-space` header.
    */
-  spaces: z6.array(authSpaceSchema)
+  spaces: z6.array(authSpaceSchema),
+  /** Cloud only: the server created this user's first Space during this exact request. */
+  createdSpace: z6.boolean().optional(),
+  /** Cloud only: this auto-created Space still needs its idempotent starter initialization. */
+  bootstrapRequired: z6.boolean().optional()
 });
 
 // ../../packages/busabase-contract/src/domains/base/contract/view-schemas.ts
@@ -2245,10 +2389,10 @@ var PackageRecordLineSchema = z8.object({
   fields: z8.record(z8.string(), z8.unknown()).default({})
 });
 
-// src/package/apply.ts
+// ../../packages/busabase-package/src/apply.ts
 import { createHash as createHash5 } from "crypto";
 
-// src/package/tree.ts
+// ../../packages/busabase-package/src/tree.ts
 import { extname } from "path";
 var NODE_SLUG_PATTERN = /^[a-z0-9-]+$/;
 var assertSafeNodeSlug = (slug, context) => {
@@ -2349,7 +2493,7 @@ var walkNodes = function* (nodes) {
 };
 var collectBaseNodes = (nodes) => [...walkNodes(nodes)].filter((node) => node.type === "base");
 
-// src/package/apply.ts
+// ../../packages/busabase-package/src/apply.ts
 var RECORD_BATCH_SIZE = 200;
 var fieldKey = (baseSlug, fieldSlug) => `${baseSlug}\0${fieldSlug}`;
 var applyInstall = async (client, plan, options) => {
@@ -2793,7 +2937,7 @@ var approveAndMerge = async (client, changeRequestId) => {
   return client.changeRequests.merge({ changeRequestId });
 };
 
-// src/package/collect.ts
+// ../../packages/busabase-package/src/collect.ts
 var findSourceNode = (nodes, slugOrId) => {
   const stack = [...nodes];
   while (stack.length > 0) {
@@ -3084,7 +3228,7 @@ var walk = function* (nodes) {
   }
 };
 
-// src/package/github.ts
+// ../../packages/busabase-package/src/github.ts
 import { Uint8ArrayReader, ZipReader } from "@zip.js/zip.js";
 var GITHUB_ALLOWED_HOSTS = [
   "github.com",
@@ -3243,7 +3387,7 @@ var fetchGithubPackageFiles = async (repoUrl, options = {}) => {
   return { source, files };
 };
 
-// src/package/frontmatter.ts
+// ../../packages/busabase-package/src/frontmatter.ts
 import { parse, stringify } from "yaml";
 var DELIMITER = "---";
 var normalizeDocBody = (body) => body.replaceAll("\r\n", "\n").replace(/^\n+/, "").replace(/\n+$/, "");
@@ -3287,7 +3431,7 @@ ${normalizeDocBody(body)}
 `;
 };
 
-// src/package/layout-read.ts
+// ../../packages/busabase-package/src/layout-read.ts
 var decodeText = (bytes, filePath) => {
   const text = bytes.toString("utf8");
   if (text.includes("\uFFFD")) {
@@ -3505,7 +3649,7 @@ var stripExtension = (fileName) => {
   return dot > 0 ? fileName.slice(0, dot) : fileName;
 };
 
-// src/package/layout-write.ts
+// ../../packages/busabase-package/src/layout-write.ts
 import { mkdir, rm, writeFile } from "fs/promises";
 import { dirname, join as join2 } from "path";
 var sortKeysDeep = (value) => {
@@ -3696,9 +3840,20 @@ var writePackageFiles = async (files, outDir, options = {}) => {
   }
 };
 
-// src/package/plan.ts
+// ../../packages/busabase-package/src/plan.ts
+var findTargetFolder = (nodes, slug) => {
+  const roots = nodes.length === 1 && nodes[0].children ? nodes[0].children : nodes;
+  return roots.find((node) => node.slug === slug && node.type === "folder");
+};
+var resolveTargetState = async (client, targetFolderSlug) => {
+  const [nodes, bases] = await Promise.all([client.nodes.list(), client.bases.list()]);
+  return {
+    targetFolder: findTargetFolder(nodes, targetFolderSlug),
+    existingBaseSlugs: new Set(bases.map((base) => base.slug))
+  };
+};
 var buildInstallPlan = (tree, target, options = {}) => {
-  const targetFolderSlug = options.intoFolder ?? tree.manifest.name;
+  const targetFolderSlug = options.intoFolder ?? suggestSlug(tree.manifest.name);
   const warnings = [];
   const existingChildSlugs = new Set(
     (target.targetFolder?.children ?? []).map((child) => child.slug)
@@ -3920,16 +4075,11 @@ var runInstall = async (client, repoUrl, options) => {
   });
   reportProgress2(`Downloaded ${files.size} file(s) from ${source.owner}/${source.repo}.`);
   const tree = readPackageTree(files);
-  const [nodes, bases] = await Promise.all([client.nodes.list(), client.bases.list()]);
-  const targetFolderSlug = options.intoFolder ?? tree.manifest.name;
-  const plan = buildInstallPlan(
-    tree,
-    {
-      targetFolder: findTargetFolder(nodes, targetFolderSlug),
-      existingBaseSlugs: new Set(bases.map((base) => base.slug))
-    },
-    { intoFolder: options.intoFolder, rename: options.rename }
-  );
+  const targetFolderSlug = options.intoFolder ?? suggestSlug(tree.manifest.name);
+  const plan = buildInstallPlan(tree, await resolveTargetState(client, targetFolderSlug), {
+    intoFolder: options.intoFolder,
+    rename: options.rename
+  });
   if (options.dryRun) {
     const report = `${renderPlan(plan)}
 
@@ -3945,10 +4095,6 @@ Dry run \u2014 nothing was created.`;
   if (options.json) return { installed: true, ...result };
   return renderInstallReport(plan.targetFolderSlug, result);
 };
-var findTargetFolder = (nodes, slug) => {
-  const roots = nodes.length === 1 && nodes[0].children ? nodes[0].children : nodes;
-  return roots.find((node) => node.slug === slug && node.type === "folder");
-};
 var toPlanSummary = (plan) => ({
   targetFolder: plan.targetFolderSlug,
   package: plan.tree.manifest.name,
@@ -4324,6 +4470,7 @@ function runAction(state, handler) {
     const opts = cmd.optsWithGlobals();
     const config = resolveConfig(opts);
     state.config = config;
+    assertCredentialNotExpired(config.apiKey);
     await maybeAutoRefresh(config.baseUrl, config.apiKey);
     const client = createBusabaseClient(config);
     const result = await handler(client, opts, config);
@@ -4335,6 +4482,7 @@ function runArgAction(state, handler) {
     const opts = cmd.optsWithGlobals();
     const config = resolveConfig(opts);
     state.config = config;
+    assertCredentialNotExpired(config.apiKey);
     await maybeAutoRefresh(config.baseUrl, config.apiKey);
     const client = createBusabaseClient(config);
     const result = await handler(arg, client, opts, config);
@@ -4521,7 +4669,7 @@ function buildProgram(state = {}) {
     runAction(state, (_client, _opts, config) => rawFetch(config, "GET", "/api/v1/openapi.json"))
   );
   addGlobalFlags(program.command("whoami")).description("Active space, user, and membership").action(runAction(state, (client) => client.auth.verify()));
-  addGlobalFlags(program.command("login")).description("Connect the CLI to Busabase \u2014 Personal/local, Cloud, or self-hosted").option("--oauth", "force browser OAuth and skip the method prompt").option("--no-browser", "OAuth: print the sign-in URL instead of opening a browser").option("--refresh", "slide the saved OAuth session forward (no browser, no re-login)").addHelpText(
+  addGlobalFlags(program.command("login")).description("Connect the CLI to Busabase \u2014 Personal/local, Cloud, or self-hosted").option("--device-code", "force device authorization and skip the method prompt").option("--oauth", "legacy same-machine OAuth callback flow").option("--no-browser", "print the sign-in URL instead of opening a browser").option("--refresh", "slide the saved OAuth session forward (no browser, no re-login)").addHelpText(
     "after",
     `
 Busabase is an approval-first database and knowledge base for AI agents: agents
@@ -4530,14 +4678,15 @@ propose changes, humans review and merge what becomes trusted data.
 Run interactively, login explains the connection choices and writes the selected
 Busabase instance to ~/.busabase/.env:
   1. Local/Desktop on this computer \u2014 no account, no login
-  2. Busabase Cloud \u2014 browser sign-in (recommended)
+  2. Busabase Cloud \u2014 device sign-in (recommended; works over SSH)
   3. Busabase Cloud \u2014 paste an API key
-  4. Self-hosted Busabase \u2014 browser sign-in
+  4. Self-hosted Busabase \u2014 device sign-in
   5. Self-hosted Busabase \u2014 paste an API key
 The flags below skip the menu (handy for scripts / CI):
 
   busabase-cli login                                   # pick from the menu
-  busabase-cli login --oauth                           # Cloud browser sign-in
+  busabase-cli login --device-code                     # Cloud device sign-in
+  busabase-cli login --oauth                           # legacy same-machine callback
   busabase-cli login --api-key sk_\u2026                    # Cloud API key (headless/CI)
   busabase-cli login --base-url http://localhost:15419 # connect to a local server (no auth)
   busabase-cli login --refresh                         # extend the current session (auto-runs too)`
@@ -4549,6 +4698,7 @@ The flags below skip the menu (handy for scripts / CI):
       baseUrl: config.baseUrl,
       apiKey: opts.apiKey,
       spaceId: config.spaceId,
+      deviceCode: Boolean(opts.deviceCode),
       oauth: Boolean(opts.oauth),
       browser: opts.browser !== false
     });

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runCli
-} from "./chunk-ZC4HCQAB.js";
+} from "./chunk-IO4ARUEI.js";
 
 // src/cli.ts
 process.exit(await runCli(process.argv.slice(2)));

package/dist/index.js

@@ -2,7 +2,7 @@ import {
   HELP,
   render,
   runCli
-} from "./chunk-ZC4HCQAB.js";
+} from "./chunk-IO4ARUEI.js";
 
 // src/index.ts
 import {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "busa-cli",
-  "version": "0.9.9",
+  "version": "0.9.11",
   "description": "Command-line client for the Busabase OpenAPI REST API. Talks to a local or remote `busabase server`. Short-name alias for busabase-cli.",
   "license": "MIT",
   "homepage": "https://github.com/busabase/busabase/tree/main/apps/busabase-cli",
@@ -32,7 +32,8 @@
   ],
   "dependencies": {
     "@zip.js/zip.js": "^2.8.20",
-    "busabase-sdk": "0.9.9",
+    "busabase-package": "workspace:*",
+    "busabase-sdk": "0.9.11",
     "commander": "^14.0.0",
     "tar-stream": "^3.1.7",
     "yaml": "^2.9.0",