deepline 0.3.294 → 0.3.295

package/dist/cli/org-SFJ77MWY.mjs

@@ -0,0 +1,849 @@
+import {
+  DeeplineClient
+} from "./chunk-XL2FO6CW.mjs";
+import "./chunk-CBVIJSHF.mjs";
+import {
+  printCommandEnvelope
+} from "./chunk-6O5YZOVN.mjs";
+import {
+  ACTIVE_ORG_ID_ENV,
+  ACTIVE_ORG_NAME_ENV,
+  API_KEY_ENV,
+  FEATURES_ENV,
+  HOST_URL_ENV,
+  HttpClient,
+  detectAgentRuntime,
+  featureEnvValues,
+  getActiveProjectAuthSource,
+  getResolvedProjectAuthSource,
+  hostEnvFilePath,
+  resolveCliAuthProvenance,
+  resolveCliCommandContext,
+  resolveConfig,
+  resolveProjectPinTarget,
+  saveHostEnvValues,
+  saveProjectDeeplineEnvValues,
+  sdkCliStateDirPath,
+  storedHostFeatures
+} from "./chunk-EACVZI6N.mjs";
+import "./chunk-DLIRSHV6.mjs";
+import "./chunk-LDWT7RJK.mjs";
+import "./chunk-GVUJJJ5G.mjs";
+import "./chunk-NXGCO4JB.mjs";
+import "./chunk-WZYKRD7T.mjs";
+import "./chunk-KRD6H754.mjs";
+
+// src/cli/commands/org.ts
+import { createHash, randomUUID } from "crypto";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  unlinkSync,
+  writeFileSync
+} from "fs";
+import { join } from "path";
+function pendingOrgCreatePath(baseUrl, accountId, sourceOrgId, name) {
+  const intent = createHash("sha256").update(accountId).update("\0").update(sourceOrgId).update("\0").update(name).digest("hex");
+  return join(sdkCliStateDirPath(baseUrl), `pending-org-create-${intent}.json`);
+}
+function readPendingOrgCreate(path, accountId, sourceOrgId, name) {
+  let value;
+  try {
+    value = JSON.parse(readFileSync(path, "utf8"));
+  } catch (error) {
+    throw new Error(
+      `Cannot resume the pending workspace creation recorded at ${path}: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  if (typeof value !== "object" || value === null || value.accountId !== accountId || value.sourceOrgId !== sourceOrgId || value.name !== name || typeof value.idempotencyKey !== "string" || !value.idempotencyKey.trim()) {
+    throw new Error(
+      `Cannot resume the pending workspace creation recorded at ${path}: the saved intent is invalid.`
+    );
+  }
+  return value;
+}
+function loadOrCreatePendingOrgCreate(input) {
+  const stateDir = sdkCliStateDirPath(input.baseUrl);
+  const path = pendingOrgCreatePath(
+    input.baseUrl,
+    input.accountId,
+    input.sourceOrgId,
+    input.name
+  );
+  mkdirSync(stateDir, { recursive: true });
+  if (existsSync(path)) {
+    return {
+      ...readPendingOrgCreate(
+        path,
+        input.accountId,
+        input.sourceOrgId,
+        input.name
+      ),
+      path
+    };
+  }
+  const pending = {
+    accountId: input.accountId,
+    sourceOrgId: input.sourceOrgId,
+    name: input.name,
+    idempotencyKey: randomUUID()
+  };
+  try {
+    writeFileSync(path, `${JSON.stringify(pending)}
+`, {
+      encoding: "utf8",
+      flag: "wx",
+      mode: 384
+    });
+    return { ...pending, path };
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    return {
+      ...readPendingOrgCreate(
+        path,
+        input.accountId,
+        input.sourceOrgId,
+        input.name
+      ),
+      path
+    };
+  }
+}
+async function fetchWorkspaceCreationIdentity(http, apiKey) {
+  const status = await http.post("/api/v2/auth/cli/status", { api_key: apiKey });
+  const accountId = status.user_id?.trim();
+  if (!accountId) {
+    throw new Error(
+      "Workspace creation requires an API key linked to a user account."
+    );
+  }
+  return { accountId, orgId: status.org_id?.trim() || null };
+}
+async function fetchOrganizations(http, apiKey) {
+  return http.post("/api/v2/auth/cli/organizations", { api_key: apiKey });
+}
+function normalizeAuthScope(value) {
+  if (!value) return "auto";
+  if (value === "auto" || value === "folder" || value === "global") {
+    return value;
+  }
+  throw new Error(
+    `Invalid --auth-scope "${value}". Expected one of: auto, folder, global.`
+  );
+}
+function orgListLines(orgs) {
+  return orgs.map((org, index) => {
+    const current = org.is_current ? " (current)" : "";
+    const role = org.role ? ` [${org.role}]` : "";
+    return `${index + 1}. ${org.name}${role}${current}`;
+  });
+}
+function redactApiKey(value) {
+  if (!value) return null;
+  if (value.length <= 10) return `${value.slice(0, 3)}...`;
+  return `${value.slice(0, 8)}...${value.slice(-4)}`;
+}
+function processEnvValue(name) {
+  return process.env[name]?.trim() ?? "";
+}
+function organizationAuthValues(input) {
+  return {
+    [HOST_URL_ENV]: input.baseUrl,
+    [API_KEY_ENV]: input.apiKey,
+    [ACTIVE_ORG_ID_ENV]: input.orgId,
+    [ACTIVE_ORG_NAME_ENV]: input.orgName,
+    ...featureEnvValues(input)
+  };
+}
+function organizationCommandContext(input) {
+  return {
+    active_organization: {
+      org_id: input.orgId,
+      org_name: input.orgName
+    },
+    auth_scope: input.authScope,
+    metadata_source: input.authScope === "folder" ? "folder_env" : "host_env"
+  };
+}
+function agentCommandContext(commandContext) {
+  return detectAgentRuntime() !== "unknown" ? { command_context: commandContext } : {};
+}
+function resolveOrgSwitchAuthTarget(scope, config) {
+  const activeProject = getResolvedProjectAuthSource(
+    config.baseUrl,
+    config.apiKey
+  );
+  const folderTarget = resolveProjectPinTarget();
+  const globalOverrideWarning = activeProject && scope === "global" ? [
+    `Folder auth in ${activeProject.filePath} overrides global auth for commands run here.`
+  ] : [];
+  if (scope === "folder") {
+    if (!folderTarget.ok) {
+      throw new Error(
+        `Cowork project folder is ambiguous. Candidate folders: ${folderTarget.candidates.join(
+          ", "
+        )}. Set CLAUDE_PROJECT_DIR or cd into the intended project folder before running this command.`
+      );
+    }
+    return {
+      kind: "folder",
+      requested_scope: scope,
+      effective_scope: "folder",
+      reason: "explicit_folder",
+      source: folderTarget.source,
+      warnings: []
+    };
+  }
+  if (scope === "global") {
+    return {
+      kind: "global",
+      requested_scope: scope,
+      effective_scope: "global",
+      reason: "explicit_global",
+      warnings: globalOverrideWarning
+    };
+  }
+  if (activeProject) {
+    return {
+      kind: "folder",
+      requested_scope: scope,
+      effective_scope: "folder",
+      reason: "existing_folder_auth",
+      source: activeProject.source,
+      warnings: []
+    };
+  }
+  if (folderTarget.ok && folderTarget.source === "cowork") {
+    return {
+      kind: "folder",
+      requested_scope: scope,
+      effective_scope: "folder",
+      reason: "detected_cowork_project",
+      source: "cowork",
+      warnings: []
+    };
+  }
+  if (!folderTarget.ok) {
+    return {
+      kind: "global",
+      requested_scope: scope,
+      effective_scope: "global",
+      reason: "ambiguous_cowork_fell_back_global",
+      warnings: [
+        `Cowork project folder is ambiguous, so global auth was updated. Candidate folders: ${folderTarget.candidates.join(
+          ", "
+        )}. Set CLAUDE_PROJECT_DIR or cd into the intended project folder to update folder auth.`
+      ]
+    };
+  }
+  return {
+    kind: "global",
+    requested_scope: scope,
+    effective_scope: "global",
+    reason: "default_global",
+    warnings: []
+  };
+}
+async function handleOrgList(options) {
+  const config = resolveConfig();
+  const http = new HttpClient(config);
+  const payload = await fetchOrganizations(http, config.apiKey);
+  printCommandEnvelope(
+    {
+      ...payload,
+      render: {
+        sections: [
+          {
+            title: "Your organizations:",
+            lines: orgListLines(payload.organizations)
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function handleOrgStatus(options) {
+  const config = resolveConfig();
+  const http = new HttpClient(config);
+  const payload = await fetchOrganizations(http, config.apiKey);
+  const current = payload.organizations.find((org) => org.is_current) ?? payload.organizations.find(
+    (org) => org.org_id === payload.current_org_id
+  ) ?? null;
+  const projectCandidate = getActiveProjectAuthSource();
+  const activeProject = getResolvedProjectAuthSource(
+    config.baseUrl,
+    config.apiKey
+  );
+  const folderTarget = resolveProjectPinTarget();
+  const provenance = resolveCliAuthProvenance(config);
+  const hostPath = hostEnvFilePath(config.baseUrl);
+  const envApiKey = processEnvValue(API_KEY_ENV);
+  const envHostUrl = processEnvValue(HOST_URL_ENV);
+  const authSource = envApiKey ? {
+    scope: "env",
+    source: "process",
+    path: null,
+    api_key: redactApiKey(envApiKey),
+    host: envHostUrl || null,
+    overrides_global: true,
+    overrides_folder: Boolean(projectCandidate)
+  } : activeProject ? {
+    scope: "folder",
+    source: activeProject.source,
+    path: activeProject.filePath,
+    api_key: redactApiKey(activeProject.env.DEEPLINE_API_KEY),
+    overrides_global: true
+  } : {
+    scope: "global",
+    source: "host",
+    path: hostPath,
+    api_key: redactApiKey(config.apiKey),
+    overrides_global: false
+  };
+  const folderTargetPayload = folderTarget.ok ? {
+    ok: true,
+    source: folderTarget.source,
+    dir: folderTarget.dir,
+    env_path: `${folderTarget.dir}/.env.deepline`
+  } : {
+    ok: false,
+    reason: folderTarget.reason,
+    candidates: folderTarget.candidates
+  };
+  const lines = [
+    `Organization: ${current?.name ?? "(unknown)"}`,
+    `Host: ${config.baseUrl}`,
+    `Auth scope: ${authSource.scope}`
+  ];
+  if (authSource.path) {
+    lines.push(`Auth file: ${authSource.path}`);
+  } else {
+    lines.push(`Auth source: ${API_KEY_ENV} process environment`);
+  }
+  if (envApiKey) {
+    lines.push(`${API_KEY_ENV} overrides saved auth for this process.`);
+  } else if (activeProject) {
+    lines.push("Global auth is overridden in this folder.");
+  } else if (provenance.scope === "global" && provenance.project.state === "project") {
+    lines.push("Cloud mutations are blocked until this project is pinned.");
+    lines.push("Pin it: deepline org set --auth-scope folder");
+  }
+  printCommandEnvelope(
+    {
+      ok: true,
+      host: config.baseUrl,
+      organization: current,
+      current_org_id: payload.current_org_id,
+      auth_source: authSource,
+      host_env_path: hostPath,
+      folder_target: folderTargetPayload,
+      project_pin: provenance.scope === "global" && provenance.project.state === "project" ? {
+        available: true,
+        required: false,
+        path: provenance.project.pinPath,
+        cloud_mutations_blocked: false,
+        command: "deepline org set --auth-scope folder"
+      } : {
+        available: false,
+        required: false,
+        cloud_mutations_blocked: false
+      },
+      next: {
+        set_auto: "deepline org set <org>",
+        set_folder: "deepline org set <org> --auth-scope folder",
+        set_global: "deepline org set <org> --auth-scope global"
+      },
+      render: {
+        sections: [{ title: "org status", lines }]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function handleOrgSwitch(selection, options) {
+  const authScope = normalizeAuthScope(options.authScope);
+  const config = resolveConfig();
+  const provenance = resolveCliAuthProvenance(config);
+  if (!selection && !options.orgId && authScope === "folder" && provenance.scope === "global" && provenance.project.state === "project") {
+    const commandContext = resolveCliCommandContext(config);
+    const activeOrganization = commandContext.active_organization;
+    const pinnedFeatures = storedHostFeatures(config.baseUrl);
+    const project_env_paths2 = saveProjectDeeplineEnvValues(
+      {
+        [HOST_URL_ENV]: config.baseUrl,
+        [API_KEY_ENV]: config.apiKey,
+        ...activeOrganization ? {
+          [ACTIVE_ORG_ID_ENV]: activeOrganization.org_id,
+          [ACTIVE_ORG_NAME_ENV]: activeOrganization.org_name ?? ""
+        } : {},
+        ...pinnedFeatures !== void 0 ? { [FEATURES_ENV]: pinnedFeatures } : {}
+      },
+      provenance.project.dir
+    );
+    printCommandEnvelope(
+      {
+        ok: true,
+        unchanged: true,
+        requested_auth_scope: "folder",
+        effective_auth_scope: "folder",
+        auth_scope: "folder",
+        ...agentCommandContext(
+          activeOrganization ? organizationCommandContext({
+            orgId: activeOrganization.org_id,
+            orgName: activeOrganization.org_name,
+            authScope: "folder"
+          }) : resolveCliCommandContext(config, "folder")
+        ),
+        project_env_paths: project_env_paths2,
+        next: { status: "deepline org status --json" },
+        render: {
+          sections: [
+            {
+              title: "org set",
+              lines: [
+                "\u2713 Pinned this project to the current target.",
+                `Saved folder auth in ${project_env_paths2[0]}.`,
+                "Global host auth was not changed."
+              ]
+            }
+          ]
+        }
+      },
+      { json: options.json }
+    );
+    return;
+  }
+  const http = new HttpClient(config);
+  const payload = await fetchOrganizations(http, config.apiKey);
+  if (!selection && !options.orgId) {
+    printCommandEnvelope(
+      {
+        ...payload,
+        next: { set: "deepline org set <number>" },
+        deprecated_command: options.deprecatedSwitch ? "org switch" : null,
+        replacement_command: options.deprecatedSwitch ? "deepline org set" : null,
+        warnings: options.deprecatedSwitch ? ["org switch is deprecated; use org set."] : [],
+        render: {
+          sections: [
+            {
+              title: "Your organizations:",
+              lines: orgListLines(payload.organizations)
+            }
+          ],
+          actions: [{ label: "Run", command: "deepline org set <number>" }]
+        }
+      },
+      { json: options.json }
+    );
+    return;
+  }
+  let target = payload.organizations.find(
+    (org) => org.org_id === options.orgId
+  );
+  if (!target && selection) {
+    const index = Number.parseInt(selection, 10);
+    if (Number.isFinite(index) && index >= 1 && index <= payload.organizations.length) {
+      target = payload.organizations[index - 1];
+    } else {
+      target = payload.organizations.find(
+        (org) => org.name === selection || org.org_id === selection
+      );
+    }
+  }
+  if (!target) {
+    throw new Error("Could not resolve the selected organization.");
+  }
+  const authTarget = resolveOrgSwitchAuthTarget(authScope, config);
+  if (target.is_current) {
+    let project_env_paths2 = [];
+    const features = await http.post("/api/v2/auth/cli/status", {
+      api_key: config.apiKey
+    }).then((status) => status.features).catch(() => void 0);
+    const authValues2 = organizationAuthValues({
+      baseUrl: config.baseUrl,
+      apiKey: config.apiKey,
+      orgId: target.org_id,
+      orgName: target.name,
+      features
+    });
+    if (authTarget.kind === "folder") {
+      project_env_paths2 = saveProjectDeeplineEnvValues(authValues2);
+    } else {
+      saveHostEnvValues(config.baseUrl, authValues2);
+    }
+    const renderLines2 = [`Already on ${target.name}.`];
+    for (const projectPath of project_env_paths2) {
+      renderLines2.push(`Saved folder auth in ${projectPath}`);
+    }
+    if (authTarget.kind === "global") {
+      renderLines2.push(
+        `Saved global auth in ${hostEnvFilePath(config.baseUrl)}`
+      );
+    }
+    renderLines2.push(
+      `Scope: ${authTarget.requested_scope} -> ${authTarget.effective_scope} (${authTarget.reason})`
+    );
+    if (options.deprecatedSwitch) {
+      renderLines2.push("Warning: org switch is deprecated; use org set.");
+    }
+    for (const warning of authTarget.warnings) {
+      renderLines2.push(`Warning: ${warning}`);
+    }
+    const warnings2 = [
+      ...options.deprecatedSwitch ? ["org switch is deprecated; use org set."] : [],
+      ...authTarget.warnings
+    ];
+    printCommandEnvelope(
+      {
+        ok: true,
+        unchanged: true,
+        organization: target,
+        requested_auth_scope: authTarget.requested_scope,
+        effective_auth_scope: authTarget.effective_scope,
+        auth_scope_reason: authTarget.reason,
+        auth_scope: authTarget.effective_scope,
+        ...agentCommandContext(
+          organizationCommandContext({
+            orgId: target.org_id,
+            orgName: target.name,
+            authScope: authTarget.effective_scope
+          })
+        ),
+        host_env_path: authTarget.kind === "global" ? hostEnvFilePath(config.baseUrl) : null,
+        project_env_paths: project_env_paths2,
+        deprecated_command: options.deprecatedSwitch ? "org switch" : null,
+        replacement_command: options.deprecatedSwitch ? "deepline org set" : null,
+        warnings: warnings2,
+        render: {
+          sections: [{ title: "org set", lines: renderLines2 }]
+        }
+      },
+      { json: options.json }
+    );
+    return;
+  }
+  const switched = await http.post("/api/v2/auth/cli/switch", {
+    api_key: config.apiKey,
+    org_id: target.org_id
+  });
+  let project_env_paths = [];
+  const authValues = organizationAuthValues({
+    baseUrl: config.baseUrl,
+    apiKey: switched.api_key,
+    orgId: switched.org_id,
+    orgName: switched.org_name,
+    features: switched.features
+  });
+  if (authTarget.kind === "folder") {
+    project_env_paths = saveProjectDeeplineEnvValues(authValues);
+  } else {
+    saveHostEnvValues(config.baseUrl, authValues);
+  }
+  const { api_key: _apiKey, ...publicSwitched } = switched;
+  const renderLines = [`Switched to ${switched.org_name}.`];
+  if (authTarget.kind === "folder") {
+    for (const projectPath of project_env_paths) {
+      renderLines.push(`Saved folder auth in ${projectPath}`);
+    }
+  } else {
+    renderLines.push(`Saved global auth in ${hostEnvFilePath(config.baseUrl)}`);
+  }
+  renderLines.push(
+    `Scope: ${authTarget.requested_scope} -> ${authTarget.effective_scope} (${authTarget.reason})`
+  );
+  if (options.deprecatedSwitch) {
+    renderLines.push("Warning: org switch is deprecated; use org set.");
+  }
+  for (const warning of authTarget.warnings) {
+    renderLines.push(`Warning: ${warning}`);
+  }
+  const warnings = [
+    ...options.deprecatedSwitch ? ["org switch is deprecated; use org set."] : [],
+    ...authTarget.warnings
+  ];
+  printCommandEnvelope(
+    {
+      ok: true,
+      host_env_path: authTarget.kind === "global" ? hostEnvFilePath(config.baseUrl) : null,
+      project_env_paths,
+      ...publicSwitched,
+      api_key_saved: true,
+      requested_auth_scope: authTarget.requested_scope,
+      effective_auth_scope: authTarget.effective_scope,
+      auth_scope_reason: authTarget.reason,
+      auth_scope: authTarget.effective_scope,
+      ...agentCommandContext(
+        organizationCommandContext({
+          orgId: switched.org_id,
+          orgName: switched.org_name,
+          authScope: authTarget.effective_scope
+        })
+      ),
+      deprecated_command: options.deprecatedSwitch ? "org switch" : null,
+      replacement_command: options.deprecatedSwitch ? "deepline org set" : null,
+      warnings,
+      render: {
+        sections: [
+          {
+            title: "org set",
+            lines: renderLines
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function handleOrgCreate(name, options) {
+  const config = resolveConfig();
+  const normalizedName = name.trim();
+  if (!normalizedName) {
+    throw new Error("Workspace name is required.");
+  }
+  const http = new HttpClient(config);
+  const identity = await fetchWorkspaceCreationIdentity(http, config.apiKey);
+  let created;
+  let workspaceApiKey;
+  let workspaceFeatures;
+  let pendingIntentPath = null;
+  if (!identity.orgId) {
+    const firstWorkspace = await http.post("/api/v2/auth/cli/org-create", {
+      api_key: config.apiKey,
+      name: normalizedName
+    });
+    const {
+      api_key: apiKey,
+      features,
+      ...publicFirstWorkspace
+    } = firstWorkspace;
+    workspaceApiKey = apiKey;
+    workspaceFeatures = features;
+    created = publicFirstWorkspace;
+  } else {
+    const pending = loadOrCreatePendingOrgCreate({
+      baseUrl: config.baseUrl,
+      accountId: identity.accountId,
+      sourceOrgId: identity.orgId,
+      name: normalizedName
+    });
+    const workspace = await new DeeplineClient({
+      apiKey: config.apiKey,
+      baseUrl: config.baseUrl
+    }).workspaces.create({
+      name: normalizedName,
+      idempotencyKey: pending.idempotencyKey
+    });
+    const switched = await http.post("/api/v2/auth/cli/switch", {
+      api_key: config.apiKey,
+      org_id: workspace.org_id
+    });
+    workspaceApiKey = switched.api_key;
+    workspaceFeatures = switched.features;
+    created = { ...workspace };
+    pendingIntentPath = pending.path;
+  }
+  const authValues = organizationAuthValues({
+    baseUrl: config.baseUrl,
+    apiKey: workspaceApiKey,
+    orgId: created.org_id,
+    orgName: created.org_name,
+    features: workspaceFeatures
+  });
+  saveHostEnvValues(config.baseUrl, authValues);
+  if (pendingIntentPath) unlinkSync(pendingIntentPath);
+  printCommandEnvelope(
+    {
+      ok: true,
+      ...created,
+      initial_credits: typeof created.initial_credits === "number" ? created.initial_credits : 0,
+      api_key_saved: true,
+      switched: true,
+      host_env_path: hostEnvFilePath(config.baseUrl),
+      ...agentCommandContext(
+        organizationCommandContext({
+          orgId: created.org_id,
+          orgName: created.org_name,
+          authScope: "global"
+        })
+      ),
+      render: {
+        sections: [
+          {
+            title: "org create",
+            lines: [
+              `Created organization: ${created.org_name}.`,
+              `Switched to ${created.org_name}.`,
+              `Saved host auth in ${hostEnvFilePath(config.baseUrl)}`
+            ]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+function registerOrgCommands(program) {
+  const org = program.command("org").description("List, create, and set organizations.").addHelpText(
+    "after",
+    `
+Notes:
+  Organizations are workspaces. Auth is stored as an API key scoped to one
+  organization, so setting an org saves a key for the selected auth scope.
+
+  Auth scopes:
+    auto    Update the folder pin that already controls this command; in
+            Cowork, write the mounted project folder; otherwise update global
+            host auth.
+    folder  Write .env.deepline in the current project/Cowork project and make
+            sure .env.deepline is gitignored. Commands below that folder use
+            this org; sibling folders can pin different orgs.
+    global  Write ~/.local/deepline/<host>/.env. Commands outside folder pins
+            use this org. Existing folder pins still override global auth.
+
+  Process env DEEPLINE_API_KEY overrides saved auth for that command only.
+  For projects, agents, CI, and multiple customer workspaces, prefer folder
+  scope or a per-command DEEPLINE_API_KEY. Global scope is machine-wide and
+  can make an unrelated terminal target the last-selected organization.
+
+Agent loop:
+  deepline org list --json
+  deepline org set <number-or-org-id> --auth-scope folder --json
+  deepline org status --json
+  deepline auth status --json
+
+Examples:
+  deepline org list --json
+  deepline org status --json
+  deepline org create Acme --json
+  deepline org set 2
+  deepline org set 2 --auth-scope folder
+  deepline org set --org-id org_123 --json
+  cd path/to/project-a && deepline org set Prove --auth-scope folder --json
+  cd path/to/project-b && deepline org set Mixmax --auth-scope folder --json
+  cd .. && deepline org status --json
+`
+  );
+  org.command("list").description("List your organizations.").addHelpText(
+    "after",
+    `
+Notes:
+  Read-only. Marks the active organization when the server returns that metadata.
+
+Examples:
+  deepline org list
+  deepline org list --json
+`
+  ).option("--json", "Emit JSON output. Also automatic when stdout is piped").action(handleOrgList);
+  org.command("create <name>").description("Create a new organization and switch this CLI to it.").addHelpText(
+    "after",
+    `
+Notes:
+  Mutates workspace and billing state. The new organization is created for the
+  current authenticated user and provisioned on the active PAYG offer before
+  this CLI switches to it. Interrupted requests resume automatically.
+
+Examples:
+  deepline org create Acme
+  deepline org create "Acme Sales" --json
+`
+  ).option("--json", "Emit JSON output. Also automatic when stdout is piped").action(handleOrgCreate);
+  org.command("status").description("Show the current organization and auth source.").addHelpText(
+    "after",
+    `
+Notes:
+  Read-only. Shows the current org plus auth_source.scope, auth_source.path,
+  folder_target, host_env_path, and next commands.
+
+  Scopes are env, folder, or global. env means DEEPLINE_API_KEY/
+  DEEPLINE_HOST_URL in process env wins. folder means nearest/Cowork
+  .env.deepline wins. global means host config wins.
+
+  Run before and after org set to verify what future commands will use.
+
+Examples:
+  deepline org status
+  deepline org status --json
+`
+  ).option("--json", "Emit JSON output. Also automatic when stdout is piped").action(handleOrgStatus);
+  const addOrgSetOptions = (command) => command.option("--org-id <id>", "Set using an explicit organization id").option(
+    "--auth-scope <scope>",
+    "Where to save auth: auto, folder, or global",
+    "auto"
+  ).option(
+    "--json",
+    "Emit JSON output. Also automatic when stdout is piped"
+  );
+  addOrgSetOptions(
+    org.command("set [selection]").description("Set the organization for the selected auth scope.").addHelpText(
+      "after",
+      `
+Notes:
+  Selection can be a list number, exact organization name, or organization id.
+  Without a selection, prints choices. With --auth-scope folder while this
+  project is using global host auth, it pins the current target directly
+  without an additional organization lookup.
+
+  Mutates local auth state and asks Deepline for an org-scoped API key. It
+  writes only the selected scope:
+    auto    Update the folder pin that already controls this command; in
+            Cowork, write the mounted project folder; otherwise update global
+            host auth.
+    folder  Write .env.deepline in the current project/Cowork project and make
+            sure .env.deepline is gitignored.
+    global  Write ~/.local/deepline/<host>/.env.
+
+  Folder auth shadows global auth. If you set --auth-scope global from a pinned
+  folder, commands in that folder still use the folder pin until it is changed
+  or removed.
+
+  Prefer --auth-scope folder for a repository or customer workspace. Use
+  --auth-scope global only for deliberate host-wide interactive defaults; it
+  is shared by every unpinned CLI on this machine. Global auth remains
+  supported in projects; use a folder pin when you want a project-specific
+  default. For automation, pass
+  DEEPLINE_API_KEY only to that invocation and confirm with org status --json.
+
+  Use --json for stable fields including effective_auth_scope,
+  auth_scope_reason, host_env_path, project_env_paths, warnings, org_id, and
+  org_name.
+
+Examples:
+  deepline org set
+  deepline org set 2
+  deepline org set 2 --auth-scope folder
+  deepline org set 2 --auth-scope global
+  deepline org set --org-id org_123 --json
+  deepline org status --json
+`
+    )
+  ).action(handleOrgSwitch);
+  addOrgSetOptions(
+    org.command("switch [selection]", { hidden: true }).description(
+      "Deprecated alias for org set. Set the organization for the selected auth scope."
+    ).addHelpText(
+      "after",
+      `
+Notes:
+  Deprecated alias. Use deepline org set instead. The command still mutates
+  local auth state with the same --auth-scope behavior as org set.
+
+  Run deepline org set --help for scope definitions and the agent verification
+  loop.
+
+Examples:
+  deepline org switch
+  deepline org switch 2
+  deepline org switch 2 --auth-scope folder
+  deepline org switch 2 --auth-scope global
+  deepline org switch --org-id org_123 --json
+`
+    )
+  ).action(
+    (selection, options) => handleOrgSwitch(selection, { ...options, deprecatedSwitch: true })
+  );
+}
+export {
+  registerOrgCommands
+};